yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] jimenezboy:
Props to you [MENTION=3167089]runningnak3d[/MENTION] for the work you are doing. You're like an Olympic marathon runner being cheered on by everyone in the stadium for being close to winning with a big lead over the rest.
[LG V20 Guides, News, & Discussion] runningnak3d:
So, what we have been looking for has been staring us in the face the whole time:

-----BEGIN PUBLIC KEY-----
Not including that on here for now...
-----END PUBLIC KEY-----

They don't use the RSA key that is in the CPU that verifies the firmware, they embedded the key right in lafd.

Getting gdb running wasn't a waste of time though. It was stepping through lafd that allowed me to find this.

The 32 byte hash for each slice that is sent is just a sha256 of the compressed slice and they use zlib with level 1 compression, but we can use whatever we want as long as the hash matches.

So, what about the sign_hash ... that is a hash of the payload with 0xFF in place of the hash (you can't hash the hash :P ).

We now have all the pieces needed to make not only our own SIGN payload, but this was the missing piece on how to make our own KDZs.

None of this has been fully tested yet. There may still be a gotcha -- I have gotten my hopes (and others) up WAY too many times. I am tired though, the test will have to wait till tomorrow...

-- Brian

EDIT: Oh yea, I almost for got the best part -- IF, and it is still an IF for now, this works, the only thing that will be needed to make it work on the G5, G6, and V30 (T-Mobile only for now since they can still unlock their bootloaders from fastboot) will be a dump of their LAF partition to extract the key. Now that I know where to look, there is no need to run the debugger anymore.
[LG V20 Guides, News, & Discussion] storm68:
Nice. Thanks for the update. Been coming back to this thread 20x a day. Lol
[LG V20 Guides, News, & Discussion] androiddiego:
1+
[LG V20 Guides, News, & Discussion] BROKEN1981:
You THE MAN!
[LG V20 Guides, News, & Discussion] storm68:
I nominate runningnak3d as a recognized developer. :p
[LG V20 Guides, News, & Discussion] BROKEN1981:
I had to look, I thought he had the tag.
[LG V20 Guides, News, & Discussion] storm68:
He really should. IMO
[LG V20 Guides, News, & Discussion] Zacharee1:
I'm pretty sure I can nominate him as an RC, but he needs to apply to RD.

And most importantly, he actually has to WANT the title.
[LG V20 Guides, News, & Discussion] Tilde88:
Hey there! Great news. I happen to have a spare motherboard if you need it to be tested on something... The issue is, that motherboard is 9008'd...Not sure if LAF will be able to work with it... But if it does, and you don't want to risk your device, I can put that mobo back on my H918 and work with you. I 9008'd that mobo by flashing H910 stuff to it, so yea lol...

If it doesn't work with DL Mode 9008, then I'm still willing to use my stock H918 10q (sep 2017 sec patch)... It just sits lifelessly in my room since it has no root anyway lol.

Thanks for your work, you have amazing intuition!
[LG V20 Guides, News, & Discussion] Ampicillin:
More power to you. :) :good:
[LG V20 Guides, News, & Discussion] runningnak3d:
Hey just wanted to let you guys know that I didn't run into problems, I have the flu.

I wanted to hop on here and let everyone know that I will be back to finish this up just as soon as I feel better.

Everything checks out, I just need to put it into an actual usable tool.

-- Brian
[LG V20 Guides, News, & Discussion] storm68:
Awesome. Thanks for the report being I check the thread religiously. Lol. Hope you feel better. :good:
[LG V20 Guides, News, & Discussion] jimenezboy:
Sorry bout the flu man. You'll be well. Cheers for the update.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Hope you feel better man. Also please get a developer tag!
[LG V20 Guides, News, & Discussion] androiddiego:
[MENTION=3167089]runningnak3d[/MENTION] You are the man! Thanks for the update and sorry to hear about the flu. Get well, take your time.

You are a blessing to the entire LG community. The V30 guys are going to love you! I've been following their threads and they have no idea what is coming.

Cheers! And get well. And thanks!
[LG V20 Guides, News, & Discussion] BROKEN1981:
I still can't believe 1 guy pwned a dev team at LG. Not too many people can brag about things like that.
[LG V20 Guides, News, & Discussion] dudeawsome:
bro I agree
[LG V20 Guides, News, & Discussion] noidman123:
I read this whole post but this part tripped me up. What exactly does this mean? Is it still a no go without the private key?
[LG V20 Guides, News, & Discussion] storm68:
Confused... So yes or no.
[LG V20 Guides, News, & Discussion] runningnak3d:
Sorry for the confusion there.

No, that was just a test for me to see if everything truly was reverse engineered correctly. I was able to replace the key in lafd because I have a rooted phone.

-- Brian
[LG V20 Guides, News, & Discussion] noidman123:
I can only imagine how taxing this is by yourself. Hopefully you get some kind of help or we reach some kind of breakthrough soon or else a lot of LG's will end up as paperweights or worse lol.
[LG V20 Guides, News, & Discussion] storm68:
Oh well. Being I'll be with my V20 for awhile I guess I'll just live with stock. Thanks for trying seriously. I'll be signing off for now. Kudos on your dedication! :good::good::good:
[LG V20 Guides, News, & Discussion] BROKEN1981:
I just want to say thank you for all the hard work you put into this.
[LG V20 Guides, News, & Discussion] laneyyy:
Is an RSA attack something that is possible?
[LG V20 Guides, News, & Discussion] SJMarty:
Please don't beat yourself up. You're the only one that was giving us hope for root and for that, we are all very appreciative.

And for the record, F- LG. Never again. Watch for the V20 run on Swappa.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Not LG's fault. It's TMobile
[LG V20 Guides, News, & Discussion] BROKEN1981:
From what I've read, dirtycow was not patched 100%. Why can't that be exploited on 10P?

It's either that or wait for another kernel flaw.
[LG V20 Guides, News, & Discussion] runningnak3d:
I already made a post about why the incomplete dirtycow patch doesn't apply to us: https://xdaforums.com/showpost.php?p=74695260&postcount=128

To sum up, transparent huge pages aren't enabled in the kernel on our phones (and probably not on ANY Android phone). But if you look at that thread, I went ahead and compiled up the proof of concept just to be 100% sure.

I wouldn't go ditching your V20 just yet (or for that matter at all -- well all the non T-Mobile variants). We have an engineering aboot -- that is GOLD. If you move on to another LG phone, that isn't T-Mobile, unless another engineering aboot leaks, you have zero chance of getting root, because all the other carriers don't allow the bootloader to be unlocked. And FYI Samsung is no better now. Go check their forums. They have patched all the holes in ODIN so that root on the Qualcomm varieties is impossible.

If you guys want to lay blame on a company for root being so hard -- blame Qualcomm, they are the ones that came up with the security measures that LG, Samsung, etc are using.

I mean putting an RSA key in the CPU -- brilliant. That opened the door for using RSA for everything (IE: download mode). LG just jumped on the bandwagon.

Also, there IS still hope. I didn't have much yesterday, mainly because I was kicking myself for not paying attention to which key had been extracted.

There is the chance that an exploit can be found in lafd. By using SIGN, they may think that their security is so good that they dropped their guard on the actual daemon.

Also, there is a chance that given the number of signatures that we have, that a private key can be found. Yes, THIS is a *REAL* longshot, but I haven't given up yet :)

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Either I don't remember you explaining about dirtycow or I missed the post.

No matter what, I just want you to know that for me personally, what you have done for the H918 community is well appreciative.

If there was a bounty for root and you gave up, I would have still gave you a donation for the effort and communication.

I'm not good with words, but I want to thank you very much for everything you did for all of us.
[LG V20 Guides, News, & Discussion] noidman123:
Seconded.
[LG V20 Guides, News, & Discussion] runningnak3d:
And this is why you never give up hope. While digging for an exploit, I found a couple of interesting things:

* If you don't have access to LG UP and you need to flash your phone, format an SDcard as FAT and make a directory called SWUpdate. Stick the KDZ for your phone in there and power it on. That is kinda nifty. Since I run Linux, it would have been nice to know about that a few times.

Nifty, but that isn't going to get us root....

* Found a file called pub in the initrd. Checked it out and it was another PUBLIC RSA key. This seemed kinda weird. Why would they hardcode an RSA key, and have a file?

So I dug some more....

* Discovered that if you put the pub file on an SDcard, lafd tries to read it. Notice the "tries" to read it. SELinux stops that from happening.

Kept digging....

* Found that if you stick a homemade RSA public key in the SWUpdate dir with a KDZ, it fails to flash. Yes, FAILS and that is a good thing.

Checked it out, and sure enough, it failed to flash because it failed signature verification -- which of course it would since the key wouldn't match the KDZ.

So, where does that leave us? I am going to have to finish up [MENTION=6984210]emdroidle[/MENTION]'s KDZ creation tool -- adding in the SIGN generation.

I can't guarantee anything, but I am almost positive that if we create a KDZ that has a SIGN payload that was created with OUR private key, and we stick the public key in with the KDZ onto an SDcard -- it should flash.

-- Brian
[LG V20 Guides, News, & Discussion] Still_living714:
Gotta try this lol this is nifty information ?️?️?️
[LG V20 Guides, News, & Discussion] runningnak3d:
Oh and just because -- why not keep this here as well....

If you want to update your phone over WiFi:

* Make sure your AP has no security and the subnet is 192.168.10/24 and the SSID is MID0

* Install a tftp server on a box that has the IP 192.168.10.100

* create a directory called /SWUpdate with no security

* Stick the KDZ for your phone in that directory

* Boot to download mode

* Press the power key 4 times. You will get a screen that says waiting for any connection

* Press vol down 4 times. You will get a list of SSIDs that your phone finds.

* Pick your MID0 SSID and the tftp client will connect to your server and start flashing your phone.

This is TOTALLY useless. I am only posting it here because I thought it was a riot.

-- Brian
[LG V20 Guides, News, & Discussion] binnedoy:
What a rollercoaster, thanks anyways for trying
[LG V20 Guides, News, & Discussion] androiddiego:
[MENTION=3167089]runningnak3d[/MENTION] you never stop to amaze me!

Cheers!
[LG V20 Guides, News, & Discussion] caitsith810:
First and foremost, I wanna thank you for all the work that you've been putting in, and this is coming from a H918 noob(I got mine just a few days ago and made the fatal mistake of updating to 10R). I'd definitely donate for all of the work you've put in.

Furthermore, out of curiousity, I tried this with a 10j KDZ and it halfway worked until it said that the binary was not authorized. Could there be a possibility that this could be changed in some fashion to allow it to work and create the potential to downgrade?

I'm probably asking some really dumb questions, but I am a V20 noob and I've been intrigued at all of the work that's being done to achieve root in some fashion.
[LG V20 Guides, News, & Discussion] runningnak3d:
It failed because of ARB and that isn't a matter of maybe finding an exploit, there is no defeating ARB. The CPU is physically damaged when ARB is incremented, and the CPU directly does the RSA signature verification of the firmware -- there just are no attack vectors.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
We could always replace the CPU.... : thinking:
[LG V20 Guides, News, & Discussion] gavilan2010:
Thanks Dude. For all your work...
[LG V20 Guides, News, & Discussion] AidenM:
Interesting. So when a KDZ is flashed with LGUP normally, the verification is performed between the private key used to sign the KDZ file and some (presumably) hard-coded public key in LGUP. However, LGUP will attempt to use a custom public key if provided one, so all we have to do is sign a KDZ with our own private key and provide LGUP the corresponding public key. Could we then somehow bypass ARB by modifying KDZ files to match the ARB level on the CPU? For example, downgrade to 10k would be possible if we could modify the 10k KDZ to be ARB-1 and use flash it using the method you discovered.
[LG V20 Guides, News, & Discussion] askermk2000:
With regards to ARB; no its not the KDZ that's the problem. The ARB stuff happens in the bootloader itself. So unless you have the source code for the bootloader and the key that's programmed into the SoC itself you cannot do anything remotely what you're thinking of.

So back to square one. I believe this has been reiterated just about to the "blue in the face" level by now.
[LG V20 Guides, News, & Discussion] runningnak3d:
The ARB version isn't just in the KDZ, it is also set in each piece of the firmware (XBL, aboot, modem, hyp, etc...) and they are signed with the private key. When the phone boots, it uses the public key from the CPU to verify each piece of firmware. So, no, there is no getting around ARB ... but we don't need to. If we can figure out how to pack a KDZ, we can replace recovery with TWRP (recovery, boot, and LAF are not signed -- they are only checked with dm-verity if the bootloader is locked).

Packing a KDZ is proving fairly difficult. I have started another thread to discuss the structure.
[LG V20 Guides, News, & Discussion] partcyborg:
Hi!

Just wanted to clarify one detail from above. The Samsung Qualcomm phones are in fact rooted. The s8 and s8 plus were rooted back in August using the sampwnd exploit, and the s8/s8+/n8 we're rooted (by me)! a few months ago with samfail. Sampwnd uses a eng system and a "factory" repair boot image without selinux enforce or dm-verity, and samfail uses the same boot images and the poor design of Samsung's odin protocol to flash arbitrary images. Unfortunately as my guess is lg doesn't use odin the same methods are unlikely to apply here, but if you have eng root then you can write new system roms with flashfire anyway.

Anyway just wanted to clear that up, and say hello to some fellow xda members fighting the good fight. I too have spent a lot of my weekends over the last few months trying to find a bootloader unlock with no success. I'm happy to share any nuggets of wisdom or approaches we have tried (maybe they will work for you?) but I didn't read through the whole thread so I have no idea what you have already looked at :). If I get some time this weekend I'll read through this thread and a) look for ideas I haven't thought of, and b) share anything one of us in Samsung land came up with that wasn't mentioned.

Good luck to all of you! *waves*
[LG V20 Guides, News, & Discussion] Christufurr:
I'm a little upset i didn't think of rooting my phone earlier before i updated :( BUT [MENTION=3167089]runningnak3d[/MENTION] the man hours that you have put into this.... is just amazing, I am still 100% sure i will get on here one of these days and you will have cracked it :D Thanks for all the work you have done, if i knew even a little of what i was doing without a tutorial i would be right there with you!

Still sitting on H91810R and just waiting. But it will be worth it :D
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=8360749]partcyborg[/MENTION] Thanks for the info. I was checking out the Samsung, Sony, Motorola, (any OEM that uses Qualcomm chips) sub-forums -- looking for something I might have missed. When I made that post, Samsung had patched samfail, and you guys were looking for another hole. Or maybe it was the the U1 vs U2 bootloaders. Anyway, glad you guys found another hole :)

LG UP is LG's equivalent to ODIN. Unfortunately, LG has stepped up their security. You used to be able to flash arbitrary partitions. Now, the daemon that runs while in firmware update mode, that the tool talks to, must have a list of the partitions that are going to be flashed, with their hashes. It is no big deal to create that -- it was fairly easy to document. Unfortunately, it is signed with an RSA cert, and the daemon will reject anything that doesn't have a hash.

While looking for an exploit in lafd (the daemon that actually does the flashing), I found a couple of backdoors that look promising. I call them backdoors because I have never seen them documented anywhere.

The one that looks promising is that lafd looks for a directory called /SWUpdate on the SDcard and if it finds it, and there is a valid KDZ (LG's firmware format), AND an RSA public key called 'pub', then it uses that public key to decrypt the SIGN payload contained in the KDZ.

Unfortunately, there is a LOT about the KDZ format this isn't documented, so I am having to attack that now. I have tested flashing from the /SWUpdate dir without the pub file, and it works (uses the built in key), so if the KDZ format can be fully documented, I am confident that we will be able to root again.

As for unlocking the bootloader. On the V20, aboot looks at the persist or persistent partitions (sorry it has been a while) to see if it is unlocked. LG pulled the fastboot commands to unlock it (fastboot oem unlock) for all the carriers except T-Mobile, BUT they didn't pull the check. So for us, it is just a matter of setting it as unlocked, manually (which requires the ability to flash arbitrary partitions). Luckily, we don't have to do that because an eng aboot leaked.

Feel free to join us on irc: irc.freenode.net / #lafd we can always rename the channel to something less LG specific :)

-- Brian
[LG V20 Guides, News, & Discussion] partcyborg:
So there was a bootloader revision increment that samfail was explicitly called out as fixed in the changelog, but they failed as it still works ?. Supposedly there is a v3 note revision that does patch it, but I've yet to personally verify anything
[LG V20 Guides, News, & Discussion] runningnak3d:
I need someone with a phone that isn't rooted to do a test for me....

This will require wiping your phone, as it requires flashing a KDZ. This test will NOT root your phone, but it will give me some insight.

If you are willing, please post:

* Model of your phone (H918, H990, VS995, etc)

* Current firmware revision (v10p, v10r, etc.)

* firmware version that you are willing to flash (it MUST be the same ARB as the firmware you are currently running, you can even flash the EXACT firmware that you are currently running. For example, the H918 can flash v10p, v10q, v10r since they are all ARB 1)

* A link to the firmware (so I can extract it).

You will need to flash a couple of times. This WILL NOT brick your phone -- some of the tests may not work (I am actually counting on that), but there is no risk to your phone.

If all of that is acceptable, then please send me a PM. Don't bother posting in this thread, as post tend to get lost in the noise.

Thanks,

-- Brian
[LG V20 Guides, News, & Discussion] Tilde88:
I'll do it. I have an H918 on 10q. Willing to flash 10q and 10p. Phone is full stock 10q. I bought the board to replace my 9008'd board. Came with this stock fw. Bootloader is unlocked, since that is all that can be done. Phone is not used since it can't be rooted, so data doesn't matter.

SIM locked, no non-vol edits.

Fellow XDA dev, but I'm at no where near the level of understanding as yourself.

[MENTION=3167089]runningnak3d[/MENTION] here is the link to the KDZ i will use. This is 10q, but again, I can also do 10p if it helps you. Let me know what steps or info you need

https://drive.google.com/uc?id=0B2qQMII67rChU2lOTVVCSXFzOVU&export=download

(i realized after posting this that you want to be PM'd... PM sent :-p)
[LG V20 Guides, News, & Discussion] iNeedRoms:
I would absolutely be willing to do that.... if it wasn't for the fact that LS997 don't got a .kdz file available anywhere. Ahh Sprint, gotta love restricting users.
[LG V20 Guides, News, & Discussion] runningnak3d:
You don't need to worry about packing up KDZs. I solved the SIGN issue -- or more to the point I got around it.

Unfortunately I wasn't paying attention, and I bricked my phone. But the fact that I have a bricked phone means it wrote what I told it to. I thought I had my H910 hooked up, but I had my H918 and you don't write the eng aboot to an H918 unless you want a brick.

Root is coming as soon as I can get a replacement phone. This is no longer a roller coaster, or a maybe. I am sitting here with a brick in my hands that proves that it works :)

[LAF] Not protected partition!!! /dev/block/sde
[LAF] success to open the flash driver, dev = /dev/block/sde, fd = 40
[LAF] success to close handle to flash driver, fd = 40
[LAF] start laf copy2

Notice that last line. That used to read [LAF] fsync fail when the SIGN payload was wrong.

I am going to go beat myself for making such a STUPID mistake, and then order another one off eBay.

-- Brian
[LG V20 Guides, News, & Discussion] SJMarty:
Catching up on the thread...this is great news.

I have two V20s (H918) and one of them is not in use yet. Let me know if there's something I can test for you.

I would like to make a suggestion...

To show our appreciation for your months of dedication to this effort, we could contribute to a fund so you don't have to pay for another phone. It's a small gesture, I know, but I want to do something.

I'm unsure of the procedure for the bounties and what-not that I've seen on XDA but however it's done, I'm in for $50.
[LG V20 Guides, News, & Discussion] Still_living714:
Im sure with the people following this thread we can make it happen
[LG V20 Guides, News, & Discussion] mattnin:
Is there a PayPal link? I'd like to contribute too for the bricked phone.
[LG V20 Guides, News, & Discussion] jcpowell:
Throw up a PayPal link or Google wallet and we will help buy another device to tinker on
[LG V20 Guides, News, & Discussion] runningnak3d:
I really appreciate it guys, but I knew the risks going into this. That is one of the reasons that I want to:

1 - Test this again. If there was a secondary reason that my phone bricked, I need to know about it. Based on the fact that it is a 9008 brick, that makes sense based on what I flashed, but I need to be sure.

2 - Add additional protection. As it is right now, might as well call it "The Brick Tool". As you see, even knowing what I was doing, I still bricked my phone because it is just that easy. LG UP and lafd have TONS of redundant checks. As I have mentioned before, some of them are a security measure (the SIGN payload), but most are just to make sure that your phone doesn't get bricked by doing something that you shouldn't -- and I mean literally, as in it will damage your phone. It is easy enough to add some of those checks in with a switch "--IWANTTOBRICKMYPHONE" to override them. That way if you REALLY want to flash firmware that has a different RSA signature, you can :)

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Was really hoping you would throw up a donation link. Just so we could all show our appreciation. Perhaps when you crack this open, you will.
[LG V20 Guides, News, & Discussion] androiddiego:
Brian,

Let us help you buy a new phone.

Yeah, you knew the risk, but you did it on our behalf. We owe you.

It's no big deal.

I fried my first V20 (water damage) and bought a replacement off ebay for $350 about 3 months ago. If 14 of us chip in $25 each, you have a new phone. No big deal! You'll actually let us feel like we're helping.
[LG V20 Guides, News, & Discussion] popwar:
I am seeing them on ebay in good and new condition between $160 - $225.