yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] TheDannemand:
Ahh, recovery is dm-verity checked, not RSA key checked. Thank you for that correction. Of course that explains why the open market variants can have TWRP after disabling dm-verity, which wouldn't be possible if they were RSA checked. Silly me :silly:

And thank you for that excellent explanation of the prospects for V30 and specifically the H932. That's better odds than I had hoped.

Yes, I remember you explaining in the H932 root threat how apparently successful LG UP flashes can be just partition erases with a subsequent failed flash.

This obsession on the part of vendors, carriers and Qualcom with obstructing developers and power users is just infuriating. Everybody wants phones that are as secure as possible from hackers and malware. But there is not a single good reason (other than greed) for the phone to self destruct (ARB, eFuse etc) if a device owner intentionally chooses to unlock it for purposes of development or modification. A single warning screen and a factory wipe upon fastboot oem unlock is all that's needed to have the best of both worlds.

Thanks again. The efforts of you, [MENTION=5545101]steadfasterX[/MENTION] and others are so appreciated!

/newbposting
[LG V20 Guides, News, & Discussion] xdav20:
Your efforts to find solution(s) is admirable. Thank you.

I don't wish my question to distract anyone from what you have been doing. Please ignore as you see fit.

I was wondering if anyone found a way to shorten the red triangle screen? Having unlocked the bootloader of Huawei Mediapad M3, I noticed the smiliar red triangle screen is way shorter, to the point is not annoying at all. I always believed, LG purposefully, extended the timeout to annoy the rooted users. I have already tried to see if there was a secret key combinations that would bypass the timeout with no avail. I also did a quick strings search on aboot image for hidden commands but my untrained eyes didn't spot anything valuable. If it turned out there was a way to set the timeout, what else would be there?

Please ignore if I'm off the topic.
[LG V20 Guides, News, & Discussion] runningnak3d:
Those images are contained in raw_resources which is loaded by aboot. The length of time that they are displayed may also be in that partition, or it could be in aboot. The problem with messing with raw_resources is that if it falls to load, that is just like having a broken aboot, and your phone is a brick. Very risky without a way to unbrick (need a working firehose), so I haven't done much research on the format of raw_resources.

If the display time is in aboot, there is no way to change it.

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
Well I did a little hack a while ago for the g4 in raw resources. I removed the boot logo shown in nougat (the big triangle one) ;)

As runningnak3d already said that partition contains e.g. the logo shown at boot. Timings are done in aboot or elsewhere.

I've also heard about hacks with that partition but even when I have some ideas I've never done anything in that direction.

Oh and btw for the g4 it boots even with an erased rr partition .
[LG V20 Guides, News, & Discussion] ph4nt0m117:
So has there been ANYthing going forward the last few days? I'm about to switch back to my iphone 5S the battery tank on my V20 is so insane because of how god awful the stock rom is. I'm about to throw the damn thing through a wall.
[LG V20 Guides, News, & Discussion] ybnrmalatall:
turn off location
[LG V20 Guides, News, & Discussion] jcpowell:
My wife dropped her V20 in the bath tub and it now acts as if someone is repeatedly touching the screen with never-ending ninja quick taps. This has been over a week now if this so... Pretty sure it's gone.

Thinking about bricking it with the firehose for the sake of warranty and experimentation... Will they still find the water damage is my question?

On another note, would replacing the motherboard possibly solve an issue like this? I've got one.

*Edit*

I understand this was sorta off topic, (besides wanting to use the firehose on it) but I knew everyone left with a v20 would see it if I wrote it here.
[LG V20 Guides, News, & Discussion] lightninbug:
Throw it in a bag of white rice for 48 hours.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Depends on the rep honestly. Your sticker will be red from water. Both on the back and the battery. If you take the stickers off...who knows they may not say anything.

I did the exact same thing and I put my v20 under the blow dryer blowing it through the inside of the phone for a good while and then even put it in rice. 2 days later, it worked fine. Mine even had the screen issue you are describing. PS.. your camera lenses will fog up afterwards so use a blower dryer again
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Bro I turn off networking till I need to use it, I turn the brightness all the way down, I turn off rotation so the damn accelorometer doesn't use battery. It literally takes no time for this phone to use its battery. I'm just going to swap back to my optimus G till the root comes out.

---------- Post added at 03:09 PM ---------- Previous post was at 03:07 PM ----------

You do know that doesn't actually work right? He needs to put it in a convection oven.
[LG V20 Guides, News, & Discussion] ybnrmalatall:
Rice does actually work

And if networking doesn't solve it, its a "you" problem.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
lol no really it doesn't. Thats the first thing you learn in motherboard repair. And if any rice dust gets in the phone it can make it way way worse.
[LG V20 Guides, News, & Discussion] jcpowell:
Just going to replace motherboard unless someone tells me that's a bad idea
[LG V20 Guides, News, & Discussion] Josh McGrath:
The motherboard most likely isn't the issue. It's probably the touch screen. At least you can take apart the v20 easily so I'd recommend taking it all apart and drying it out thoroughly first
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

In "theory", how much would root via a non LAF method help you with your LAF project?
[LG V20 Guides, News, & Discussion] runningnak3d:
I have two V20s. The H910 is rooted, and I have a special LAF environment that runs with gdb attached to lafd.

-- Brian
[LG V20 Guides, News, & Discussion] whojabacod:
So is this dead?
[LG V20 Guides, News, & Discussion] TheDannemand:
Two pages back [MENTION=3167089]runningnak3d[/MENTION] posted an overall update:

https://xdaforums.com/showthread.php?p=75670541

Doesn't sound dead to me, just more hard work and some patience required ?
[LG V20 Guides, News, & Discussion] bigcletus:
Any way we could temp root then flash TWRP through terminal with dd? Probably stupid thought but oh well.
[LG V20 Guides, News, & Discussion] Josh McGrath:
I've tried it a little but not much and not much success but maybe you can! My question is, why haven't you tried it? #involve-everyone ?

I encourage everyone to try their ideas, no matter how silly they may sound. (Just don't brick it) ?
[LG V20 Guides, News, & Discussion] whojabacod:
https://xdaforums.com/android/software/tool-tool-one-driversunlocktwrpfactory-t3358711 here, someone with h918 try the recovery flasher
[LG V20 Guides, News, & Discussion] SJMarty:
I'm all for pitching in and helping with the efforts to root this phone but I'm not sure that using this tool is a good idea. Neither the H918 nor any variant of the V20 isn't listed as a supported phone. The description of the tool in the first posting says the "generic phone" has to support fastboot commands. That's been one of the major challenges with the OP's efforts as LG/T-Mobile pulled those from the H918.
[LG V20 Guides, News, & Discussion] Mr December:
Does this mean I may have a root option for my 10r V20?

I just got this phone today and had no idea that this phone wasn't rootable beyond a certain firmware (Lesson learned).
[LG V20 Guides, News, & Discussion] BAFLGV20:
I believe waiting for Oreo would be the best idea. But the G4 recieved root 2 years after everyone thought it wasn't going to.
[LG V20 Guides, News, & Discussion] pbedard:
The recall phone ???
[LG V20 Guides, News, & Discussion] Mr December:
Why do you say waiting for Oreo would be the best idea? That wouldn't change the possibility of root would it? I had a VS987 G5 that never became rootable, so I'm bummed that I didn't research this better sooner. I need Titanium Backup and Xposed in my life. :crying:
[LG V20 Guides, News, & Discussion] Josh McGrath:
The less time that that a new version has been widely used , the more likely the potential EOP exploits will not be known or patched and can be used for root.
[LG V20 Guides, News, & Discussion] runningnak3d:
When it comes to exploiting LAF, it won't be possible with Oreo on the V20 (already not possible on the V30) if they increment ARB. The latest versions of LAF, even on Nougat, are only able to flash with a signature -- there are no alternate flashing methods to even TRY to exploit. Right now that isn't a problem (except for models that don't have a KDZ), because you can roll back. If they increment ARB again (which I am sure they will with Oreo), then THIS method is a no go.

-- Brian
[LG V20 Guides, News, & Discussion] Mr December:
So, it's best to hold off on updating to Oreo next month when it may be released so we don't screw over this LAF method?
[LG V20 Guides, News, & Discussion] jphunnid:
man nothing but respect to you Brain you open my eyes to a viewing this problem completely different, I was just here trying to find out how to root a lgv10 and ended up reading tons of info and ran into your informative post alot here but this post here is eye opening.

These bastards are 100% robbing us and selling us junk throwaways.

I will 100% support a kickstarter like that.

I know their was modular phones in teh past but it never worked out for reason IDK.

I wish we can just swamp out the ram, cpu, etc just like a computer when in reality the phone is nothing but a small comptuer.
[LG V20 Guides, News, & Discussion] SMTB1963:
Mine arrives Tuesday, and I did not know about root issues as well. I just made a cursory check of the forum and saw there were ROMs available and figured "oh good! I can root this phone!"

Silly me. Silly noobish me. :silly:

Anyways, I just finished reading this entire thread and although 95% was over my head, it was simply fascinating. Man there's some big brains around here.

[MENTION=3167089]runningnak3d[/MENTION] - thanks so much for your work on this, and for writing up your process. Very exciting/entertaining to follow.

Cheers!

:good:
[LG V20 Guides, News, & Discussion] Enismirdal:
Just gonna third that sentiment. Also just got this phone, and had no idea that the H918's fastboot was gutted in newer firmwares. I too figured the availability of ROMs for the variant was a good enough sign, and should've known better.

Regardless, this is a lot of impressive work - and it is indeed nifty to have it written up in detail. I'm interested to see what all comes of it, and not just for myself.
[LG V20 Guides, News, & Discussion] omariscal1019:
I dont even have this device and im following this thread its super interesting. Hope your sucessful [MENTION=3167089]runningnak3d[/MENTION]!!!
[LG V20 Guides, News, & Discussion] runningnak3d:
SHA1 hash collisions: link

So, not very realistic, but if someone can come up with a crapton of compute power, this is possible.

The RSA signature is an encrypted SHA1 of the partition portion of the SIGN payload. So, if we could find a collision that creates a payload with the same SHA1 as what is encrypted, then we would have a valid SIGN payload with modified SHA256 hashes. So, the SIGN payload gets sent with the modifications needed, the signature gets decrypted, the SHA1 hash matches the payload, so lafd accepts the SHA256 hashes of the partitions that we want to flash.

It would absolutely work -- now -- find a METRIC crapton of compute power to start checking SHA1 hashes, or get the Google dudes to release the source to SHAttered. I mean 110 hours?!? That would absolutely be doable. There is a reason they don't want it in the wild.

Mainly this post is about dreaming and to say nothing new has come to light (even on old versions of lafd).

-- Brian
[LG V20 Guides, News, & Discussion] laneyyy:
Is this something that us without much knowledge can help with? Is there a way we can all process a chunk each or something?
[LG V20 Guides, News, & Discussion] runningnak3d:
Absolutely it would be possible. Unfortunately that would require writing a client like folding@home or seti@home, and I don't have the time to take on a project like that.

Tis sad too, because the SIGN payload has SOOOO much padding that I know a hash collision could be found.

But again, as soon as this is cracked, LG will just change lafd, and it will all be useless going forward. I mean it would require about 30 seconds work for them to change the SIGN payload signature to SHA256, and cracking that would be as hard as cracking the 2048bit key.

-- Brian
[LG V20 Guides, News, & Discussion] pro_granade:
Not sure if it helps but I have a PC with a 1080ti, and another with a RX 480, so they can bruteforce pretty good if you wanna just run a script on them for months lmfao
[LG V20 Guides, News, & Discussion] ph4nt0m117:
I have 5 servers with dual 6c12t xeons in them doing nothing and waiting to be used. Will that work?
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5083130]pro_granade[/MENTION] [MENTION=8504953]ph4nt0m117[/MENTION] I appreciate the offer, but without an understanding of how Google pulled off SHAttered, it would take years on a home PC, or about 50k to 100k of compute time on a cloud service to brute force it.

If Google ever releases SHAttered, I could do it with the equipment I have :)

-- Brian
[LG V20 Guides, News, & Discussion] Gamesoul Master:
Ahh, well... I suppose it is but a dream after all. But if one were to be lucky, could it perhaps happen sooner? Not to get anybody's hopes up, but isn't it remotely possible (like, lottery winning odds) that the solution could be found incredibly early on in the search?
[LG V20 Guides, News, & Discussion] SMTB1963:
From the link:

Even if they released shattered, it would be impractical for a regular Joe to crack. Maybe those BTC miners could do it?

[IMG="Miners"]https://www.economist.com/sites/default/files/imagecache/640-width/images/print-edition/20150110_WBP001_0.jpg[/IMG]

No, but you could put them to work on World Community Grid. Come crunch for science with XtremeSystems!

:D
[LG V20 Guides, News, & Discussion] runningnak3d:
Wow, I MUST have been on crack. I swear I read that as 110 HOURS. Yea, 110 years -- just not possible even with SHAttered -- lol.

I even have it in my post:

Massive wishful thinking can really distort your ability to read :(

-- Brian
[LG V20 Guides, News, & Discussion] shahinman:
While awaiting (like others) on a root for H91810P my phone automatically downloaded a System Update and states: "To finish update, restart your device".

I have gone to see system apps to disable or clear cash for this app, but cannot find it. Does anybody know how to stop this OS update?
[LG V20 Guides, News, & Discussion] Snakecharmed:
Settings > Notifications > Apps > Google Play services > Block: On
[LG V20 Guides, News, & Discussion] BROKEN1981:
It's still abr1, so don't worry.
[LG V20 Guides, News, & Discussion] shahinman:
This worked perfectly :good: :laugh: Thank you.

You are right that it is anti roll back 1 for the next OS updates too. However it might even get harder (to root) with each update. :eek:
[LG V20 Guides, News, & Discussion] pro_granade:
So I'm almost sure this wouldn't work because of the phone checking what it's booting, but could you rebrand a V20 from one carrier to another by firmware if they're both on ARB1?
[LG V20 Guides, News, & Discussion] Zacharee1:
The point of it still being ARB 1 is that, even if the newer versions aren't rootable, you can always flash a KDZ back.
[LG V20 Guides, News, & Discussion] BROKEN1981:
How come you can't exploit blueborn to gain root?
[LG V20 Guides, News, & Discussion] runningnak3d:
You are right, I should have said: "Out of their two choices, they happened to make the wrong one" :)

As for the RSA key, it is 2048 bit, but no, I don't think it is possible to retrieve it from QFPROM without somehow reading that area of the CPU directly -- only LK has access to that portion of the QFPROM, and unlike other portions of QFPROM, it isn't mapped into HLOS space. Since it isn't possible to get access to LK (that is the whole point of protected boot) there is no way to read that area. However, there are some parts of QFPROM that ARE mapped into HLOS memory address space. Some are actually readable via sysfs: /sys/devices/platform/lge-qfprom but most you have to find the offset and read the memory address directly.

Unfortunately the size of the partitions, and the offsets has to be correct as well, and it isn't as simple as just getting them from the phone or from the KDZ. When booting from SD card (this is a guess - nothing to back it up) I believe that info is in QFPROM.

I have put this on the back burner because there are less and less people bricking their phones now that info is out there on what specifically NOT to do, or you WILL brick your phone, but yes, I will pick it back up one day.

There is actually an opcode to send the slice sizes so no need to hack something together. Still need to fully decode it, but it is there.

Once this project is done, not having a KDZ file won't be an issue anymore. You will be able to dump your phone (you can already do that with the patched LG UP), make the modifications needed, and then flash everything back. Also, recovering from a soft brick without a KDZ will now be possible as long as someone made a dump (or you can GET someone to make a dump for you).

Another side project that I am working on is being able to unlock the bootloader. On the H910 aboot still looks at the persistent partition to see if it should be unlocked. I need to research this more to see if it applies to other models.

[/quote]

I don't have one, and unfortunately I don't have the equipment needed to try and figure it out (a "silly scope" would sure help).

However, just looking at decompiled xbl and aboot, I am 99.9% sure you are correct.

There are a few other people helping on this project now, so maybe we will have some results soon. Let me know if you would like access to our share.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Any reason why blueborn can't be exploited to gain root?
[LG V20 Guides, News, & Discussion] Zacharee1:
I'm pretty sure BlueBorne is just a privilege escalation bug. It doesn't actually give the attacker root access.
[LG V20 Guides, News, & Discussion] dudeawsome:
Got my replacement today and rooted and on latest 10q but gonna keep up with this if any files need from 10q please feel free to let me know
[LG V20 Guides, News, & Discussion] Vee63b:
Just bouncing an idea here, but wouldn't it be possible to pull a rom dump with the SU binary in system and then turn the dump into a tot/kdz for LGUP?
[LG V20 Guides, News, & Discussion] runningnak3d:
If you have documentation on how to create a TOT or KDZ, please point me to it. Extracting is fairly simple, there are a lot of unknowns that can be ignored, putting them back together is proving much more difficult.

If we COULD make a KDZ, then yes, the patched LG UP would be able to flash it ... I have already proven that it ignored signature verification in partition DL mode.
[LG V20 Guides, News, & Discussion] dudeawsome:
Yes there is hold up lemme link you up it's still a work in progress https://www.google.com/amp/s/xdaforums.com/v20/development/kdz-creator-t3577524/amp/
[LG V20 Guides, News, & Discussion] loopytee:
Are you aware of this thread already?

https://xdaforums.com/showthread.php?t=2179431&page=2
[LG V20 Guides, News, & Discussion] popwar:
Hope its soon. V20 going byebye if not.
[LG V20 Guides, News, & Discussion] loopytee:
Sorry if this is not useful info.

http://opensource.lge.com/osSch/list?types=NAME&search=LGls997
[LG V20 Guides, News, & Discussion] Vee63b:
Yea, I was reading over the thread and saw that, then i saw dudeawesome's post that he has a rooted device on 10q and remembered seeing a thread of a KDZ Editor/Creator.

(https://xdaforums.com/v20/development/kdz-creator-t3577524)

I figured if it does work, I think I remember reading that it was a hit or miss for what the OP of that thread was trying to use it for because they didn't have a KDZ to work with.

For the H918 tho, we actually have a KDZ. We could try and edit the KDZ for the H918 and try to Frankenstein a pre-rooted KDZ/ToT by adding the SU binary into system without an SU app so users can download their preferred SU management app; because TWRP has an official app in the play store that can flash recovery with root. Or pre-TWRP so users can flash their own SU/Magisk zip.

Also getting a dump of dudeawesome's device since its already rooted might be a viable option as well.
[LG V20 Guides, News, & Discussion] askermk2000:
I remember reading a thread a while back.

There was this respected and capable developer who knew how to create kdz-files, but someone stole his work, someone on xda apparently. He then decided to never share what he knew again, and completely stop to support the LG community on XDA.

Can't remember what thread it was now, but I guess it shouldn't be too hard to find.

Also it would seem some ppl have made tot/kdz-archives, the most vivid example being [MENTION=6542293]andy_zhang[/MENTION] who was active in my thread before. Though he never said how he supposedly created the us996 tot-file.

Edit: Can't find that thread now... anyone else know what I'm talking about?
[LG V20 Guides, News, & Discussion] wren2k:
Sorry not aware of that conversation but that got me searching and I found a guide to creating a KDZ. It's for an older phone so I'm not sure if it's helpful.

https://xdaforums.com/showthread.php?t=2179431
[LG V20 Guides, News, & Discussion] runningnak3d:
Unfortunately making a KDZ file for a single LUN with multiple partitions (eMMC - /dev/block/mmcblk0p1, /dev/block/mmcblkp2, etc.), and making a KDZ for a multiple LUN device (UFS -- which is what is in the G5, V20, G6 -- /dev/block/sda, /dev/block/sdb, etc) is a whole different ballgame.

-- Brian
[LG V20 Guides, News, & Discussion] loopytee:
Is this what you are remembering?

https://xdaforums.com/showthread.php?t=2483250&page=7

Post 67 states from 5/2016

NEWS: After some major work, my tool appears to able to unpack and repack KDZ and DZ files. As such, it should now be possible to upload modified firmwares to LG devices now.
[LG V20 Guides, News, & Discussion] dudeawsome:
thanks we finally might have a fix to this issue [MENTION=3167089]runningnak3d[/MENTION]
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=6984210]emdroidle[/MENTION]'s KDZ tools are for working with the older version KDZ format for devices that used eMMC. They can't repack a UFS KDZ.

-- Brian
[LG V20 Guides, News, & Discussion] loopytee:
That should be post 67 not 365

---------- Post added at 01:06 PM ---------- Previous post was at 01:03 PM ----------

@runningnak3d

Sorry for all the posts. I have zero programming knowledge but thought I could at least do some searching that might help out the cause.

Thanks for all you and the others are doing
[LG V20 Guides, News, & Discussion] shahinman:
Oh good, thank you, I did not know, I thought I would be locked in since I am not rooted. And hopefully ARB is not 2 and some other checks/balances to stop people like me.
[LG V20 Guides, News, & Discussion] tswb:
will this works with lg v20 h91810s and when it be out.
[LG V20 Guides, News, & Discussion] TheDannemand:
Please read just a little bit in the thread: The project is still being worked on. It may or may not succeed to achieve root. If it does, H918 should be covered, though I assume which versions/ARB would depend on the eventual method.

But NOBODY can say how long it will take, which is why such questions are frowned upon around here.