[LG V20 Guides, News, & Discussion] runningnak3d:
EDIT: 2018-08-14

Wow -- re-reading this, whoa, what a bunch of assumptions / misinformation.

Note to self, update this post with the ACTUAL findings, and the ACTUAL way that the *current* (as of Nougat and Oreo) works. Also, add in the way that Google is going to F**K us all in the A** by adding AVB to the boot, and recovery, (and then LG can very easily add it to laf) in 9.0 (Pie). Pie in the face. A**holes.

LAF Is the LG Advanced Flash. When you hold vol up and insert your USB cable to get into download mode, aboot loads a partition called LAF.

It is just a boot image, but instead of the ramdisk (initrd) doing things like mounting system, so Android boots, it loads download mode.

As part of my research on the Boot Chain of Trust (BCT), it occurred to me that if you have an unlocked boot loader, you can flash whatever you want to the recovery partition. The only LG V20s that have unlockable boot loaders WITHOUT using the engineering aboot are the US996 (unlock.bin from LG), and the H918 (fastboot oem unlock). This wouldn't really be needed by the US996 since it has all fastboot commands available, the H918 however, does not.

In the thread about rooting the H918, I came up with the idea of patching LG UP to ignore ARB (Anti-RollBack). When a phone has an unlocked boot loader, aboot (applications boot) doesn't do RSA verification on the boot image. In addition, the boot image doesn't talk to the QFPROM to increment ARB. Heck, the boot image doesn't even have the code needed to write to QFPROM (ARB qfuse). So, the only thing stopping us from flashing an older kernel and system image is that LG UP checks the KDZ to see what ARB version it is at, and it checks QFPROM to see what ARB version the phone is at. If the KDZ is less -- it fails.

So, that is one way. Patch LG UP to ignore ARB, and then flash boot and system from an older KDZ. Unfortunately, my reverse engineering skills aren't great. On the other hand, my ability to read packet dumps and figure out protocols is much better (worked on -- and still work on World of Warcraft emulation). So I got to thinking, LG UP talks to LAF, so time to load up some wireshark, and start sniffing the USB bus to figure out what exactly is being said.

After working on this for a couple of days, I thought that there HAS to be someone else out there that thought of this same thing. Turns out I was correct: link.

As you can see it is a little old, but it put me much farther ahead than I would have been. I think the project was dropped, because as stated above, you need an unlocked boot loader -- and I think T-Mobile is the only one that still does.

BUT we have an engineering aboot. So, this tool is of use to ALL V20s, since we can just push the engineering aboot, and twrp just like back when dirtycow worked.

Finally to the point of this post. I would like some help updating the protocol. It appears that dmesg works no matter what:

<snip>
pseudo_chg_ui[0]
<3>[ 3132.160144 / 01-01 01:06:45.539][1] LGE charging scenario : state 0 -> 0(0-0), temp=31, volt=3804, BTM=0, charger=1, cur_set=0/0, chg_cur = -232
<6>[ 3132.160154 / 01-01 01:06:45.539][1] [LGE-CC] lge_monitor_batt_temp_work : otp_ibat_current=0
<6>[ 3132.160177 / 01-01 01:06:45.539][1] [LGE-CC] lge_monitor_batt_temp_work : Reported Capacity : 17 / voltage : 3804
<6>[ 3133.448127 / 01-01 01:06:46.819][3] FG: update_sram_data: soc:[17], soc_raw[1863], voltage:[3804909], ocv:[3749062], current:[-232542], batt_temp:[310], charge_raw [374287 / 3167000]
<12>[ 3136.173937 / 01-01 01:06:49.549][3] [LAF] protocol version mismatch. rcv = 1000001, dev = 1000004
<12>[ 3136.174137 / 01-01 01:06:49.549][3] [LAF] read property item = ATT
<12>[ 3136.289486 / 01-01 01:06:49.659][2] [LAF] execvp failed. error = 2
<6>[ 3136.560128 / 01-01 01:06:49.939][3] pet_watchdog [enable : 1, jiffies : 4295250952, delay_time : 1000]
<6>[ 3137.006156 / 01-01 01:06:50.379][2] SMBCHG: lgcc_charger_reginfo: [STATUS] USB_PRESENT[1], PARALLEL_STATUS[2], USB_TYPE[SDP]
<6>[ 3137.006165 / 01-01 01:06:50.379][2] SMBCHG: lgcc_charger_reginfo: [STATUS] TOTAL_IUSB[500], PMI_IUSB[1700], SMB_IUSB[0]
<6>[ 3137.006172 / 01-01 01:06:50.379][2] SMBCHG: lgcc_charger_reginfo: [STATUS] TOTAL_IBAT[3100/3100(vote)], PMI_IBAT[3000], SMB_IBAT[1000]
<6>[ 3137.006179 / 01-01 01:06:50.379][2] SMBCHG: lgcc_charger_reginfo: [STATUS] CABLE_ID [OPEN], CABLE_INFO[SDP], USBIN_VOL[4973]
<6>[ 3137.006185 / 01-01 01:06:50.379][2] SMBCHG: lgcc_charger_reginfo: [STATUS] BATT_SOC[17], BATT_VOL[3804], BATT_TEMP[310], BATT_CUR[-232542]
<6>[ 3137.006193 / 01-01 01:06:50.379][2] SMBCHG: lgcc_charger_reginfo: [STATUS] CHG_EN[Enable], CHG_STATE[CHARGING/500MA/CC], SAFTY_STATE[Set/Not yet]
<6>[ 3137.006199 / 01-01 01:06:50.379][2] SMBCHG: lgcc_charger_reginfo: [STATUS] XO_tHERM[36], PA_THERM[33], BOARD_THERM[32] VTS[333]
<6>[ 3142.000053 / 01-01 01:06:55.379][2] [bm] monitoring
<12>[ 3142.384450 / 01-01 01:06:55.759][3] [LAF] protocol version mismatch. rcv = 1000001, dev = 1000004
<12>[ 3142.384664 / 01-01 01:06:55.759][3] [LAF] read property item = ATT
<12>[ 3142.498642 / 01-01 01:06:55.869][3] [LAF] dmesg!!

Enough to let me know that at the very least, the protocol version has changed.

So, once the missing pieces are back in place, we will be able to once again root any model, on any security patch.

Why can't they plug this hole? They could actually. They could force all phones to require OTA updates -- no more download mode. Until they do, they can change the protocol all they want, but as long as LG UP can talk to the phone, then it can be figured out once again. As for the engineering aboot. That can of worms can't be closed -- they have no way of updating the RSA key in the CPU. Well they could have, if they didn't decide to go the full on / locked down / method. There are slots for 4 keys in QFPROM, but they made the mistake of locking the CPU so that no new keys can be written. The advantage to them was that people like myself can't write my own key. The disadvantage is that if something like the eng aboot leaks, they can't do a thing about it.

So -- WHO'S WITH ME?!? :)

-- Brian