yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=8233777]Swordknight27[/MENTION] I will be in touch to get you the files, and walk you through the process.

I could be wrong about the downsides (well, losing the headphone jack I am 99.999% certain), but the others -- ehh -- I will be real curious. But you really need to understand that there may be other downsides that I am not even aware of because there is no leaked documentation on the MSM8996. You might have to stand on one foot,and rub your head while you pat your stomach just to get the phone to turn on :)

No, it won't be that bad. But just throwing this out there, the modem could be disabled so the phone would only be useful as a tablet. Now I have NOTHING to indicate that would happen, but I am giving that as an example of worst case scenario. The battery not charging, and the camera having issues, I am 60/40 -- ehh maybe 70/30 ... enough that I am not will to test it. I am glad you are, because heck, I *could* be wrong about losing the headphone jack, in which case the phone would be perfectly normal (well as normal as any phone rooted with DirtySanta).

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
If it doesn't work, intentionally brick it and either file a claim or warranty exchange with TMobile .
[LG V20 Guides, News, & Discussion] steadfasterX:
And keep in mind that we still have my infinity box here to try which uses its own fire hose

I do not own your device though so it would require a remote session which I have done a lot in the past for other phones like the G4
[LG V20 Guides, News, & Discussion] Josh McGrath:
If you want to test anything on the v30 h932, let me know
[LG V20 Guides, News, & Discussion] BROKEN1981:
Could it achieve root for the H918? What are the downsides to this box you speak of?
[LG V20 Guides, News, & Discussion] steadfasterX:
Well as said I have the tools here which can handle these devices to flash in emergency download mode and according to the vendor without limitations. In my opinion this is still an extremely risky way because it has the potential to hard brick your device regardless what they say.

Itself it is not able to root your device but if there is a debug aboot which means it's enables the way to root) is working for your device and someone share that it is possible to FLASH it in this mode

http://forum.gsmhosting.com/vbb/f29...-2-qlm-v1-16-lot-new-models-features-2306012/
[LG V20 Guides, News, & Discussion] runningnak3d:
Actually the H918 has fastboot oem unlock available, so they just need TWRP flashed. Can the Infinitybox flash recovery? If so, then for the H918 it would be:

* Unlock bootloader

* Backup TZ

* Wipe TZ

* Flash TZ and TWRP

* Immediately boot to TWRP and flash an su so that recovery-from-boot.p doesn't overwrite TWRP.

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
Yes at least in theory.

Do we need a special lglaf repo/branch for the wipe? Or will the original one be sufficient?

Which TWRP version btw? Can you link it?

Wait.. You can unlock this? So why not flashing in fastboot?
[LG V20 Guides, News, & Discussion] Zacharee1:
TMO lets us unlock the bootloader, but fastboot is stripped of any useful commands. Like a cruel taunt :p
[LG V20 Guides, News, & Discussion] storm68:
So you can use "fastboot oem unlock" command and that's it? Hhmmm.
[LG V20 Guides, News, & Discussion] bigcletus:
If that infinity box can flash TWRP, we should be in business right? Sounds promissing...
[LG V20 Guides, News, & Discussion] BROKEN1981:
So can your "box" flash TWRP?

https://xdaforums.com/v20/development/h918-recowvery-unlock-v20-root-shell-t3490594/page1

Twrp can be found here for the lgv20 h918

I'll be willing to test if I'll have a working modem, battery charging and headphone jack lol
[LG V20 Guides, News, & Discussion] steadfasterX:
Thx.

I mean what is T-Mobile thinking? This is not an unlock it's a joke !

Well ok to be crystal-clear here are the risks :

first we need to enforce the emergency download mode. we will do so by wiping the trust zone partition which SHOULD enforce the emergency download mode.

second we will use Infinity to push a special fire hose to the device in this mode and trying to boot it.

When we are able to come up to here the last step is just flashing trustzone and TWRP

So if our assumption that wiping the trustzone partition will NOT bring up emergency download mode (although it does for the g4 and afaik for other LGs ) you are screwed until someone find out which pins need to be bridged in order to force the emergency download mode.

if the firehose of infinity is not able to boot you are screwed .

... but if you can bring up the emergency download mode and the firehose of Infinity is working as they promised then we can flash TWRP and you can boot it

And as usual because you would be the first trying that way nobody knows what side effects all this may have

NOTE:

When I say "screwed" I mean you will have a complete unusable device which even do not turn on anymore

At the moment this will require LG support repair or replacing the main board
[LG V20 Guides, News, & Discussion] Josh McGrath:
Technically, you could force 9008 mode by flashing another aboot or another firmware. Ask me how I know lol

And yes if it doesn't work then you will need to either RMA with LG or warranty exchange with TMobile. Is recommend having a backup phone when you do it .

If it does permabrick you can jump on Twitter with TMobile help and pm them to order a new one for you
[LG V20 Guides, News, & Discussion] runningnak3d:
If it was possible to flash an aboot, then it would be possible to flash anything -- a wipe is the only option :)

Do NOT wipe aboot. If you wipe aboot, the phone does NOT go into 9008, it is just dead. The PBL goes into an infinite loop -- it can't deal with a nulled aboot.

I can guarantee that wiping TZ will throw the phone into 9008.

[MENTION=5545101]steadfasterX[/MENTION] Yes, a special branch is needed for the V20. So we don't have 200 forks out there, I will make a PR off your fork, and then you can make a V20 branch.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Well, I'm willing to try.

---------- Post added at 04:56 PM ---------- Previous post was at 04:56 PM ----------

I'm willing to try
[LG V20 Guides, News, & Discussion] steadfasterX:
yes I know about aboot.. wiping that was my first LG repair ;)

ok that would be perfect. use the g4-stable one then ;)

ok. we need to prepare the wipe part first but will let you know when ready..

.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Ok, thank you. My BL is unlocked. I hope I don't need a special cables. I just have the USB cable that came with the device.
[LG V20 Guides, News, & Discussion] steadfasterX:
Yea that's fine (usually)
[LG V20 Guides, News, & Discussion] dudeawsome:
Keep us updated on the process and if you come across anything
[LG V20 Guides, News, & Discussion] BROKEN1981:
Awesome. I'm a bit scared but I'll do it.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5545101]steadfasterX[/MENTION] OK, I have created the PR.

A warning to anyone thinking of playing around with this -- you will probably brick your phone. I have only pushed enough changes to make --dump and --wipe work, all the other options will either not work, or brick your phone.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
In the event my phone bricks, how do I contact LG and what should I say to them? I'm asking you since you had done this already. Also I got this phone as soon as it came out.

---------- Post added at 08:30 PM ---------- Previous post was at 08:28 PM ----------

So what is the process? Also are we doing this via PM's? You had said you can do this via remotely. Well we do it like that? Keep in mind I am a noob. So please be patient with me.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5631635]BROKEN1981[/MENTION] Since we all got an additional 30 months of warranty due to the settlement, it is just a matter of opening an RMA on LG's website. You get a drop down list, pick "Won't power on". You need to attach a pic of your proof of purchase. If you don't have the actual receipt (like I didn't), just take a picture of the barcode on the side of the box. If you don't have that either, you will have to contact them and tell them your threw it away and they will open an RMA for you manually.

You will get a shipping prepaid shipping label to print. Then you just need to get a FedEx box, slap the label on, and mail just the phone back (you pull the back, battery, SIM, SD card).

It takes about 5 days to get to them, and 3 days for them to fix it, and then it only takes about 3 days to get back -- so 11 days total.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Ahh awesome! I kept my box. Old habbit.
[LG V20 Guides, News, & Discussion] steadfasterX:
You're not my first n00b ;)

(we all are at some place..)

Nope. In would prefer IRC for this. I will send you the instructions by PM when ready.
[LG V20 Guides, News, & Discussion] BROKEN1981:
IRC?
[LG V20 Guides, News, & Discussion] steadfasterX:
You're too young ;) or I'm too old :rolleyes:

No worries. Really. I will explain by pm.
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=5631635]BROKEN1981[/MENTION]

What service do you have? If you have insurance on your line, they ship even faster (not a claim) if you go through TMobile. It would be easier to just get a warranty exchange than to go through LG. I got my replacement v30 in 2 days after I killed it in 9008 mode
[LG V20 Guides, News, & Discussion] BROKEN1981:
I haven't had insurance since the LG VX8000 lol.
[LG V20 Guides, News, & Discussion] shadavis08:
Like Telegram but not as fancy LOL
[LG V20 Guides, News, & Discussion] BROKEN1981:
I'll act like I know what telegram is lol.

I hardly use FB, Twitter. Most I use is XDA and slack.
[LG V20 Guides, News, & Discussion] Josh McGrath:
That's umm, quite a long ass time ?. You will still get your replacement in 5 days if you don't have ins.

I would recommend calling TMobile and getting a warranty sent out . They don't charge you unless you actually pick it up from the store and then it's just even 5 dollars. Still quicker than going through LG . Plus the people who refurb phones for the carriers usually don't know what a qfuse is or a bootloader so less chance of getting charged for out of warranty
[LG V20 Guides, News, & Discussion] storm68:
Yeah I always say it did the update and this is what happened! Lol
[LG V20 Guides, News, & Discussion] NotYetADev:
Slow down you guys

Slow down. I would try this instead; knock two birds out with one stone. Grab the latest patched LG UP and the earliest KDZ you can find for your device, definitely one that's pre-dirty santa patch. Dump it, or skip the KDZ and dump step and have someone who has an early dirtysanta vurnable firmware version on the same model use EMMC DUMP mode on their patched LG UP.

Now we know, AntiRollBack is likely stored in the following bootloader-related partitions: XBL, ABOOT, XBL2, or LAF.

Now previously, a few guys and I on Telegram did some experimenting. You CAN write data to partitions one partition at a time regardless of AntiRollBack using PARTITIONDL in the patched LG UP. The issue? We tried writing TWRP directly to recovery. On all varients (I tried this on my VS995 with the dirtysanta bootloader, stock bootloader, and someone with an H918) ABOOT gets into a fastboot loop after the data is writen. I was only able to exit this mode in the dirtysanta bootloader by using a fastboot flash command, or by flashing the rest of the partitions. (Side note, the patched LG UP is finicky. I've had most success by using files renamed PARTITIONNAMEHERE.img). The one thing we didn't try? Writing to the aboot partition. More specifically, writing an old bootloader with a downgraded AntiRollback version to ABOOT, then flashing BOOT.img and SYSTEM.img one at a time.

Why didn't we try this? Well we didn't know how extensive checks are emplemented. Looking at the patent document for AntiRollback, if a mismatch is detected, it will put your device in EDL mode. This v20 was the testers daily driver, so we didn't try it. However, also outlined in ARB is that fastboot oem unlock most commonly disables these checks that force the device into EDL mode.

Now, why am I saying you should go this route?

1. If ABOOT does happen to be writable, guess what? You just found out devices with an engineering bootloader don't need an exploit like dirtysanta to flash ABOOT anymore. Furthermore, we gain knowledge ABOOT is writable by LG UP, just like /system and boot.

2. So what if ABOOT successfully writes to the bootloader? Now we can try to reboot. If we are greeted with any screen what so ever, if any screen comes up at all, we just downgraded antirollback successfully, or we didn't we just bypassed it entirely. We're good to flash the rest of the partitions and boot to a dirtysanta vurnable release to root.

So what if it writes successfully, but even with fastboot oem unlock in place and antirollback STILL trips the device into download mode? Well that's where we were headed next anyway, right? We're in 9008 Download mode, and we know this because the patent says that's what it will do. The good news is we got there safely, instead of very dangerously wiping random partitions like I see a few people suggesting. Even better? We have a valid aboot, so it will know how to properly take us into 9008 mode.

I appologize I didn't write up all this information sooner; I just figured it'd help!
[LG V20 Guides, News, & Discussion] Josh McGrath:
For what it's worth, I pulled the ABL from the us998 unlocked us v30 and flashed via lgup to my h932, instant 9008 mode, not even a screen. But things may have changed since the v20? Also, I did a blind flash because I had no idea where the partition was or if it was different.

I was hoping the ABL would let me use fastboot commands since that model isn't neutered like the rest are, including the v20.
[LG V20 Guides, News, & Discussion] NotYetADev:
Cross model flashing isn't a very reliable test, and in the situation I posted won't work due to verity check issues. I'd still try the method i've outlined. Try to be careful next time woth ABOOT. It's a critical component.
[LG V20 Guides, News, & Discussion] runningnak3d:
I'm guessing you didn't bother to read much of this thread, or you would know why you had boot loops, and why it isn't a simple matter of using a patched LG UP.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
Exactly ? i found out real quick the partitions are different. I wasn't meaning that i was comparing to your method. Sorry if it came out that way, just kind of an FYI if anyone wanted to try that.

Edit: yes, runningnak3d I figured it would brick me but I needed a replacement anyway due to other issues
[LG V20 Guides, News, & Discussion] steadfasterX:
Besides what runningnak3d already said you can not downgrade an ARB it's impossible because it's a physical fuse which is blown.

the only thing which is possible would be an aboot partition which ignores the arb like the one for the G4 which can boot ANY arb.

And just one more note: for the G4 it works exactly like this we write the engineering aboot partition and we have secure boot off which means we can flash whatever we want afterwards.

Well and last but not least I do not trust any patent papers as those are only guidelines which does not means they really go this way! For example for the G4 it does not go into EDL mode like your papers say it just becomes unusable that's it. you have to force the EDL mode by bridging 2 pins then otherwise you are lost. The only way guaranteed to work for the G4 (and as runningnak3d said for these devices too) is wiping the trustzone partition which is not a random partition like you seem to believe...
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Soooo where are we at? After the firehoseeee..... now what?
[LG V20 Guides, News, & Discussion] storm68:
This post is the one that makes the most sense and logical to me. Always follow something that's been done already (G4) and see from there what reroute needs to be written or taken if it doesn't work in the same and such. Makes perfect sense.
[LG V20 Guides, News, & Discussion] storm68:
[MENTION=5631635]BROKEN1981[/MENTION] tell us it isn't so.... Lol
[LG V20 Guides, News, & Discussion] BROKEN1981:
He hasn't PM'ed me yet. When I do this, I'll let everyone know what happens either way.

---------- Post added at 02:00 AM ---------- Previous post was at 01:58 AM ----------

[MENTION=5545101]steadfasterX[/MENTION]

Are you ready to try this soon?

Remember, this is for the H918. My BL is unlocked via OEM unlock.
[LG V20 Guides, News, & Discussion] storm68:
Yes I'm h918. I need to see it a bit more on solid ground before trying. This is my daily driver and I use phone for work so.... Watch it be something around the lines what they did for the g4 arb01. Lol
[LG V20 Guides, News, & Discussion] BROKEN1981:
I see it did not quote the person I wanted lol. Was not asking if you tried it.

What did they do for the G4 abr01? Was it a bad outcome?
[LG V20 Guides, News, & Discussion] steadfasterX:
PM sent just now.

Sorry will not have the time for a remote session this week but we will do so next week. All details to prepare written in the PM :)
[LG V20 Guides, News, & Discussion] storm68:
I don't know. But they made it work. Platform is also different that's probably why. It was years ago. Lol
[LG V20 Guides, News, & Discussion] runningnak3d:
I don't know if you guys knew this, but with the V20 engineering aboot, we can run any ARB version.

Quick reminder... The ARB version is blown into the CPU. When the phone boots, it checks what ARB version is allowed by aboot, and which pieces of firmware are to be checked. aboot can also say: "Don't check any" which is what ours does.

This part applies to phones the DON'T have an engineering aboot:

Now, if you think you are going to get around incrementing ARB by never flashing aboot -- wrong. In addition to the ARB version being in the CPU, when aboot checks the ARB version, if it checks a piece of firmware that has a greater ARB version, then ARB is incremented, and your phone is now a brick since you have an lower ARB version aboot.

ARB can NOT be defeated unless you can crack RSA signatures... or you get an engineering aboot that doesn't check ARB.

-- Brian
[LG V20 Guides, News, & Discussion] darkknight1812:
So if I am reading this right, the first step toward rooting would be flash engineer aboot, even for H918? If so then that makes sense since H918 can be unlocked without eng aboot, but (at least to my knowledge) is the only one that has been arb incremented.
[LG V20 Guides, News, & Discussion] runningnak3d:
The H918 has a different RSA key in the CPU, so you can't use the engineering aboot (don't ever flash it, it will brick your phone) -- but you don't need to since you can unlock your boot loader. The reason all the other models need the eng. aboot is because it is unlocked. Using the engineering aboot has a couple of advantages though -- full fastboot, and not checking ARB are two of them...

To root the H918, you only need to unlock your boot loader, and then figure out some way to flash TWRP. After that, flash an su.

[MENTION=5545101]steadfasterX[/MENTION] is working with [MENTION=5631635]BROKEN1981[/MENTION] to see if his Infinity box is capable of flashing the H918 using the built in firehose. If it works, then I will buy one so that I can help you guys out as well.

As for all other model V20s, [MENTION=4756007]jcpowell[/MENTION] has agreed to test the debug firehose.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
To get this thread back on topic, I was finally able to dump the laf partition from the phone that I got back from LG. I took a look and the opcodes that they pulled were:

* COPY - This is used to start copy2

* IOCT - This is used to remove write protection

* RSVD - This has several sub-commands and is used to start indirect flashing

This is what [MENTION=5545101]steadfasterX[/MENTION] and myself were working on when I got the firehose in my email. Since they were pulled, I feel real strongly that they CAN be used to flash. All the opcodes that are left are needed to flash KDZs, these are not.

Another possibility is that they finally decided to do a little house cleaning, but, [MENTION=5545101]steadfasterX[/MENTION] bricked his phone several times, and I was able to write data to an SD card, just not where I wanted (so it would have bricked MY phone).

The pursuit of the LAFSploit is not over yet :)

-- Brian
[LG V20 Guides, News, & Discussion] lightninbug:
Does/would this help in any way with the TMobile v30?
[LG V20 Guides, News, & Discussion] TheDannemand:
First of all I'd say let's just be patient and see what comes out of this (and I'm on H932 as well).

But as I understand previous postings by [MENTION=3167089]runningnak3d[/MENTION], the V30 checks RSA key on recovery partition too, even when the bootloader is unlocked. So differently from the H918, we cannot just flash TWRP, even if we found a way to do so. (Well, we can, if we could, but it wouldn't boot). We'd have to flash either a Magisk'ed kernel or a SuperSU'ed system.

I'm fully prepared to be corrected by those in the know [emoji12]
[LG V20 Guides, News, & Discussion] runningnak3d:
Actually to be clear, the boot loader, and firmware are the only parts that are signed with an RSA key. The insecure side (boot, recovery, and laf) are all verified with dm-verity.

I think that the reason that H932s go into a boot loop when they try to use the patched LG UP to flash any of those three partitions from another model V30 is that the first thing LG UP does is erase the partition before flashing. Then when it goes to flash, the SIGN payload is sent, and I think that on the V30 all the models have different RSA keys in lafd.

So what is happening is the partition gets erased, and then lafd refuses to flash due to not being able to verify the hash of the partition being sent (wasn't able to decrypt the SIGN payload). LG UP has no error indicator for this. You don't get an 0x8xxxxxx error, so it LOOKS like it worked. What you are left with is an erased partition.

On the V20, all models have the same RSA key in the CPU (except the H918), and all models have the same RSA key in lafd (again, except for the H918). So on the V20, we can literally flash anything from any model V20 as long as the ARB version is the same or greater (and with the eng. aboot ARB doesn't even matter). LG *REALLY* screwed up the security of the V20 in that aspect.

From my research on the V30, they fixed that. Every model I have checked has a different key in the CPU, and a different key in lafd.

So, it is my opinion that if we can find a way to flash TWRP onto the H932, you will be able to root. As for the other models, they will never get root unless an eng. abl (on all SD835 based phones, aboot is now called abl, and it is encrypted) leaks. But the thing is, an abl would have to leak for EACH model since the RSA key is different.

TL;DR: I fully believe that root will be obtainable on the H932. I also fully believe that (other than the unlocked models) that will be the only model that will be rootable.

-- Brian