yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] ClockworkImpulse:
I'd assume if you saw no errors it flashed something, that space got filled with, something.
[LG V20 Guides, News, & Discussion] draymond1987:
Although I don't want to repeat myself to be annoying or "that guy": I don't know what could have been flashed, since I could not even select a partition (with just change KDZ to TOT). I can try the KDZ again and see if it errors out again.

Yes, same error as last night.

I'm assuming just changing "blahxx.kdz" to "blahxx.tot" with only the magic of windows and no tool to convert it, would result in the same thing. Yet, it just flashes, something, yet nothing. I would end up with a brick, theoretically, since I would have NO control over the entire firmware being flashed to the device.

Edit: please correct me if I'm wrong :)
[LG V20 Guides, News, & Discussion] Nickvanexel:
Please can you link me the latest lg up download?
[LG V20 Guides, News, & Discussion] ChazzMatt:
See the bottom part og this post:

https://xdaforums.com/showthread.php?p=75239518

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] Nickvanexel:
Ok thanks. So 1.14.3 is the correct version?
[LG V20 Guides, News, & Discussion] draymond1987:
Yes, this is correct. What Chazz linked will get you set up nicely.
[LG V20 Guides, News, & Discussion] ChazzMatt:
That's the newest version at this point in time, yes.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] ChazzMatt:
Anyone can explain this? I thought this wasn't possible?

From my LG US998 stock firmware thread:

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] mikeyinid:
It's funny you posted this here, reading through this thread is what gave me the idea. It looks like using the method I used you can flash ANY LG signed kdz to your phone. I just unchecked all the files with bak at then end and it flashed fine. Apparently you can even downgrade your FW in this manner.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5545101]steadfasterX[/MENTION] here are the details to make this work on the G4. I am still getting timeouts just like the V20, so maybe you can help with this since it consistently works on the G4 when flashing small amounts of data:

* Backup misc partition

* Wipe misc partition

* MISC WRTE offset,size body=data // For now I am using a 0 offset because when doing a COPY, the src_offset isn't just the offset of the misc partition + the offset within the misc partition, so until that can be figured out, we just write from the beginning of misc. That is why we back it up and wipe it -- we will restore it afterwards. Also, only one MISC WRTE is sent with the entire body being the data to be written. It isn't like WRTE where a new WRTE is sent every 3 megs.

* OPEN

* IOCT fd_num,0x1261 // I still don't know what 0x1261 means, but this works. Since OPEN opens the FD with write protection, I am guessing this enables write. I know if you don't send it, the write fails.

* COPY fd_num,misc_offset,size,recovery_offset

* IOCT fd_num,0x1261 // This probably isn't needed since it probably just re-enables write protection, but I would send it anyway.

* CLSE fd_num

* Restore misc partition that was backed up

That is it. That will consistently allow you to flash recovery on eMMC devices. The problem I am running into, and the reason I didn't submit a PR is the timeout when sending anything large -- but I know that is just my lack of knowledge with Python.

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
I could have sworn Brian said that we should not try flashing other variant's firmware / partition because we could brick.

I mean, if y'all want me to be a guinea pig, I could try when I get home?
[LG V20 Guides, News, & Discussion] mikeyinid:
I have a US cellular 998, and flashed VS996 on it without issue. I'm sure there are some potential issues you could run into but this worked fine for me.
[LG V20 Guides, News, & Discussion] steadfasterX:
many thx again ;)

yea i remember that I had the same issue for MM long time ago.. I will look into that when i find some free time.

.
[LG V20 Guides, News, & Discussion] runningnak3d:
The US998 (US Cellular) and the Verizon V30 must share the same RSA key. I would need a dump of xbl or abl from both models.

I checked the H930, H932, and US998 (carrier unlocked) and they are different. I never checked the Verizon model to see if it matched any of the others.

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
So I just check everything besides .bak and flash away? I assume I should not flash the modem file because my radio will break. I only seen what the T-Mobile KDZ has within it.
[LG V20 Guides, News, & Discussion] mikeyinid:
I chose the VZW fw because it's Oreo and I have VZW. I guess it would be possible they share the same RSA key, but unlikely? Has anyone actually attempted to flash a different variants fw in this manner and it not worked?
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5830858]draymond1987[/MENTION] You might want to verify that the RSA key is the same. Also, what would you gain flashing Verizon firmware onto an H932?

-- Brian
[LG V20 Guides, News, & Discussion] mikeyinid:
I checked the check all box, then went through and unchecked all of the boxes with files ending in bak

I flashed everything, even the modem. I have service still.

---------- Post added at 11:59 AM ---------- Previous post was at 11:58 AM ----------

Yea, I would definitely NOT flash vzw onto the H932. I only tried it because I can't get ota updates and I have vzw. My voicemail was all jacked up so hopefully having vzw fw fixes that.
[LG V20 Guides, News, & Discussion] ChazzMatt:
Oreo. ;)

Now I'm curious about the open market LG US998 V30/V39+, if they share the same RSA key as Verizon like U.S.Cellular model US998.

Both open market LG US998 and U.S.Cellular model US998 are identical, as far as I know except one is not eligible for bootloader unlock.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] Zacharee1:
The V20 is UFS?
[LG V20 Guides, News, & Discussion] runningnak3d:
Yes: https://www.skhynix.com/eng/product/nandUFS.jsp it is the 2.1 part.

-- Brian
[LG V20 Guides, News, & Discussion] andy_zhang:
Lg added validation at V20.

通过我的 1505-A02 上的 Tapatalk发言
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=6542293]andy_zhang[/MENTION] The patched LG UP doesn't verify the KDZ or TOT. If you know how to create a valid UFS TOT file, please share the details.

-- Brian
[LG V20 Guides, News, & Discussion] andy_zhang:
Delete

China user
[LG V20 Guides, News, & Discussion] storm68:
Hhhmmm something doesn't smell right with you dude. Please be aware that moderator closed a thread he opened on wanting to crack stuff!!! Spam!
[LG V20 Guides, News, & Discussion] BROKEN1981:
Seems it's just lost in translation. His English is horrible.
[LG V20 Guides, News, & Discussion] andy_zhang:
Delete

China user

---------- Post added at 10:14 PM ---------- Previous post was at 10:12 PM ----------

Delete

China user
[LG V20 Guides, News, & Discussion] Shirazak:
Can we get back to the task at hand.....
[LG V20 Guides, News, & Discussion] runningnak3d:
Well, you are more than welcome to help out. Grab a copy of IDA, attach it to LG UP, install a USB sniffer, and then start flashing / doing various things with LG UP. Once you have set some break points in IDA, you can analyze the sniffs that occurred at those points.

Sorry if I am being a little facetious, but I lost a drive with ALL my work on it. I am trying to recover it, but that is a slow process.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
Hmm. Sounds like [MENTION=4591212]me2151[/MENTION]. He may or may not have lost the drive with DirtySanta on it.
[LG V20 Guides, News, & Discussion] me2151:
Heh. The Macbook with it on it was stolen.
[LG V20 Guides, News, & Discussion] Zacharee1:
You still lost it, scrub :p
[LG V20 Guides, News, & Discussion] Vee63b:
[MENTION=5580523]dudeawsome[/MENTION], [MENTION=3167089]runningnak3d[/MENTION]

Thanks for the info on the UFS bit, it helped me research an alternative for our devices. So i stumbled across this, it requires a rooted device, but it does target UFS KDZs.

https://xdaforums.com/v20/development/tool-kdz-writer-t3649818

Also, sorry to hear that you've lost the drive with your work on it [MENTION=3167089]runningnak3d[/MENTION], I'd definitely would've have helped sniff the data if my laptop didn't meet an unfortunate end at my little brothers hands. So I'm afraid all I can do now is help brainstorm until I get another laptop.

[MENTION=5580523]dudeawsome[/MENTION] would you be kind enough to test run a 10q KDZ for TMO through and see if it repacks using KDZ Writer?

Start simple and just add the SU binary in both

\system\xbin

\system\bin

Then try to repack it with KDZ Writer. If you don't have a TMO device or don't wanna risk your device, I can put my phone up on the chopping block to test. I'll just have to borrow a laptop to LGUP.

By the way, thanks. Both of y'all, for still working on trying to get root for the rest of us.
[LG V20 Guides, News, & Discussion] dudeawsome:
I will make a dump of my current ROM but first I'd have to re flash it bc I flashed a bad file and having issues also may you let me know if I do re pack will you get any of my data such as picture etc
[LG V20 Guides, News, & Discussion] Vee63b:
If you dump after a clean reflash, or just dump the \system, no. If you dirty flash tho, app data would be contained; but I wouldn't want to put anyone in that predicament, to have their data available to the public, so I was actually getting the link for a stock KDZ for you to add the SU binary to so we can avoid any issues with 3rd Party App data, orphaned files, etc in the repacked KDZ if it works lol.

LG V20 H91810q-Stock KDZ:

https://lg-firmwares.com/download-file/?fileId=10544
[LG V20 Guides, News, & Discussion] dudeawsome:
okay got as i am looking into kdz write it says it writes the kdz to the device but has no instructions on how we would go about repacking
[LG V20 Guides, News, & Discussion] Vee63b:
It looks like it writes directly to the KDZ file and repacks automatically. I can Teamviewer in and assist you when I get off of work. 8pm PST though. I'm off on weekends.
[LG V20 Guides, News, & Discussion] dudeawsome:
okay i see ill make the kdz and send it to you if you could try it out bc i dont want to risk losing root

---------- Post added at 09:51 PM ---------- Previous post was at 09:45 PM ----------

you sure this does not write the kdz partitions to the device bc it says "Tool for writing portions of KDZ files to LG devices." in the op
[LG V20 Guides, News, & Discussion] Vee63b:
Hang tight, lemme check it again.
[LG V20 Guides, News, & Discussion] draymond1987:
Checking RSA keys, I don't know how to do, but I can learn aha. And I'd only benefit from flashing VZW, to have Oreo.

I didn't know if that variant has a method of root?

Didn't know if the device would be like "yes I am now VZW model and you can flash things now."

And did not know if doing so, could help figure out a root method for TMobile variants.

I know, I'm not thinking logically about it.
[LG V20 Guides, News, & Discussion] mikeyinid:
Since the 998 is unlocked as well maybe there is some sort of correlation. I wouldn't be surprised if it works on the open market variant as well.

Open market variant has unlocked bootloader though so I would just flash an Oreo rom lol

*I meant since the vzw variant is unlocked as well
[LG V20 Guides, News, & Discussion] ChazzMatt:
FYI, flashing Oreo Verizon V30 firmware over Nougat U.S.Cellular model US998 (which may also work on open market LG US998):

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5545101]steadfasterX[/MENTION] just pointed out something SO obvious, I am smacking myself.

The misc partition isn't big enough to hold all of TWRP -- hence the timeout. When lafd hits the end of a block device / partition / open FD, and you are still sending data, it hangs. This is why it works for small amounts of data: "0123456789" or "It WORKED!".

So this will require what is being flashed to be chopped up into usable pieces that will fit onto misc, and then multiple COPY opcodes sent. Something like:

Determine misc size, and set that as chunk_size

MISC WRTE 0,chunk_size

COPY fd_num,misc_offset,chunk_size,recovery_offset

MISC WRTE 0,chunk_size

COPY fd_num,misc_offset,chunk_size,new_recovery_offset // where new_recovery_offset == recovery_offset+chunk_size

Keep iterating until all data written. Obviously final chunk_size will have to be taken into account since it will be smaller.

Tested with something smaller:

./misc-write.py --restore protocol.md recovery
2018-04-03 14:41:43,030 partitions: INFO: # Flags From(#s) To(#s) GUID/UID Type/Name
39 1152921504606846976 573440 655359 9D72D4E4-9958-42DA-AC26-BEA7A90B0434 Unknown
83C992E0-1CEC-D414-9709-3D4FF9141913 recovery
2018-04-03 14:41:43,030 partitions: INFO: Opened fd 40 for disk
2018-04-03 14:41:43,183 partitions: INFO: Done writing 0 bytes from protocol.md

and then:

# !MISC READ,0,13165
# LG LAF Protocol
This document is a reverse-engineered protocol description for LG Advanced Flash
(LAF), the download mode offered by various LG models. It is based on analysis
on the `Send_Command.exe` utility and `LGD855_20140526_LGFLASHv160.dll` file and
a USB trace using Wireshark and usbmon on Linux. Some commands were found in the
`/sbin/lafd` binary.

<SNIP>

It is all there....

Sweeeeeeet. It is coming together.

-- Brian
[LG V20 Guides, News, & Discussion] mikeyinid:
LG even fixed the emoji in O lol

Been a few hours now and haven't found any issues. Modem works, calls work, texts work. Everything seems to work. I do notice in advanced calling my video calling option is greyed and it says it's been disabled on my account. I will contact vzw and see if it's something on their end or a device issue.
[LG V20 Guides, News, & Discussion] Josh McGrath:
I def would NOT flash the 998 on the 932. I only flashed the laf or abl I can't remember and I ended up with a hard brick, 9008 mode.
[LG V20 Guides, News, & Discussion] draymond1987:
Shoot, well then, I guess I'll sit my butt down and wait for a method that's not that risky aha.

I was just gonna fire up the PC and try. Good thing I checked my phone.
[LG V20 Guides, News, & Discussion] runningnak3d:
Since it is a lot safer for me, I flashed the H932 laf partition onto my H918, and it won't boot. Now, that isn't to say that the H918 laf won't boot on the H932, but the chances are REAL slim.

Fair warning to anyone that wants to try it -- your phone won't be a brick, but you will probably never be able to flash again. Maybe an OTA will come along that has a complete laf, and that would flash through recovery, but that is a HUGE risk.

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
May I ask, what would be the outcome if I successfully flashed the laf partition ?

Also, can you elaborate, never flash again?

Edit: as you can tell, I'd like to help the best I can :)
[LG V20 Guides, News, & Discussion] Josh McGrath:
I'll try it but how will we know it worked? I don't know where to find the laf version

And when you say won't boot, are you hard bricked?
[LG V20 Guides, News, & Discussion] draymond1987:
Do let us know your results! I was also curious about how to tell what laf version.

If you are successful then I will def flash to be a backup confirmation!

What KDZ is gonna be flashed, by the way?
[LG V20 Guides, News, & Discussion] runningnak3d:
By won't boot, I mean that download mode won't boot, your phone will.

By can't flash, I mean that if it flashes, but doesn't boot, then you have lost download mode.

When I say high risk, I mean REALLY high risk. If you want to try it, use the H91810j KDZ

You will know that it worked if it boots.

On some V20 news, I can now consistently flash:

# This is reading 1000 bytes of recoverybak after I flashed the normal boot partition onto it.
#
# !READ 42,20614,1000
ANDROID!��2����l ����console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa androidboot.selinux=permissive enforcing=0�fe��d¾���}P)�Ml6
#
# This is reading 1000 bytes of boot -- notice they match
#
# !READ 42,6,1000
ANDROID!��2����l ����console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa androidboot.selinux=permissive enforcing=0�fe��d¾���}P)�Ml6
#
# This is reading 1000 bytes of recovery with TWRP installed
#
# !READ 42,10246,1000
ANDROID!v<��wi ����console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa androidboot.bootdevice=624000.ufshc androidboot.selinux=permissive��Q����������g��^"�
#
# This is copying 1000 bytes from recovery to recoverybak
#
# !COPY 42,10246,1000,20614
#
#This is reading 1000 bytes of recoverybak again. Notice the difference, recovery is now on recoverybak
#
# !READ 42,20614,1000
#
ANDROID!v<��wi ����console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa androidboot.bootdevice=624000.ufshc androidboot.selinux=permissive��Q����������g��^"�

Between this, and the solution to the fact that the misc partition just isn't big enough, almost all the pieces are in place.

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
Oooh man, this looks like promising news, right!? I feel like you're so close to cracking the code!

I will hunt down this KDZ and cross my fingers that everything works.

I do know it is high risk, and I am willing to try.

If Josh gets his device to flash first, that'll be great.
[LG V20 Guides, News, & Discussion] runningnak3d:
Here is a link to H91810j: link

-- Brian
[LG V20 Guides, News, & Discussion] TheLogicalGamer:
Very promising work & kudos to all involved. If I had the money to spare I would definitely be willing to take more risks, but I just don't have the spare money for another phone right now. That said I'll help anyway I can if for some reason my help is in fact needed.

Also I'd just like to say thanks again. You guys aren't just fighting to get root. You're fighting for the entire community. I've came from a rather poor background monetary wise. With my love of tech & fiddling with it. Having control over our devices that we pay for with our hard earned money should be necessary. Seeing more devices being locked down (At least from carriers. Which makes it affordable for me.) Saddened me to no end, but it also inspired me. Now I am taking Android app development courses (unofficially i.e. not college). To start to learn how to do the work you guys are doing.

I'm not going to clutter up the thread with no real info to contribute. I just thought you guys might like some cheering on. And that at least from my perspective is inspiring and amazing work. OP feel free to delete if this is in the way. :)
[LG V20 Guides, News, & Discussion] draymond1987:
Thank you, sir!

Downloading and backing up my data now (in case) .
[LG V20 Guides, News, & Discussion] Josh McGrath:
I'm downloading now but I'm kinda confused of the purpose of flashing the laf from a 918 to the 932? I'm assuming the LAF is easier to work with?
[LG V20 Guides, News, & Discussion] draymond1987:
I'm reading that the 918 has root and such, so maybe the LAF can help us??
[LG V20 Guides, News, & Discussion] runningnak3d:
laf on the V30 (all of them) has been neutered. No COPY opcode, amongst other things. Even lafd on the newest V20 firmware has that opcode removed.

So, for this to work, you have to flash a laf that:

A - Still has the opcodes needed

B - Will boot

For the V20, that is easy, but for the V30, you don't have a laf that every had the opcodes.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
That's interesting. I didn't know that. So I guess that means that the v30 is out for a regular flash. I think this is going to be the last LG I buy. If I buy a car I can pull the engine and put a 454 big block in it, the same should go with the "property" I paid for from LG
[LG V20 Guides, News, & Discussion] draymond1987:
So Brian, I just would like to clarify. Can this result into a hard brick? Like, tucking my tail and running to T-mobile for a replacement? Like I said, I can figure a way to get a replacement :D
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

I assume that I am supposed to flash both laf and laf.bak?
[LG V20 Guides, News, & Discussion] draymond1987:
I can agree with you there! I really enjoy this device though, especially because of the camera / video recording. I seen reviews that trash the camera but LOVE the LOG video (which I wanna play with more). I absolutely fell in love with having a wide angle lens.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5830858]draymond1987[/MENTION] No, the worst that will happen is that you have no more download mode.

[MENTION=5070414]Josh McGrath[/MENTION] No, just flash laf. There is a slim chance that abl will try lafbak if laf fails and that will give you an out.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
Okay I'll try that first, but I don't mind a hard brick, I think today or tomorrow is the last day I can pick up my replacement anyway.

So just let me know buddy
[LG V20 Guides, News, & Discussion] draymond1987:
I'm ready to pull the trigger with you, so to speak. My backup failed, so I am literally just waiting for it to finish.
[LG V20 Guides, News, & Discussion] Josh McGrath:
I've got a replacement waiting on me if needed, so wait for me to check back in so you won't be stuck without a phone for a few days, just in case
[LG V20 Guides, News, & Discussion] draymond1987:
I've got a ****ty M9 that I could use, but I shall wait, good sir!

I say ****ty, because whomever I got it from, failed to tell me that the battery was toast! Nothing like your phone dying within 3 hours. It would literally drop on idle too. But that's off topic aha. I still love that phone.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Sorry for the OT post... But.. I had the m9 and that damn thing was the worst battery life I've EVER had in any phone!

Uncompressing the kdZ now and then to flash

Edit... There is LAF.bak in that kdz/model after all.

Flashing now
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

This is what I came up with and I cancelled . This looks like a hard boot coming to me. But if you think I should still flash, I will.
[LG V20 Guides, News, & Discussion] draymond1987:
Is that from "partition DL" ?

I'm able to select what to flash, and didn't get that window.

EDIT: Nevermind, I see now LOL.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Yes it was Partion DL and LAF -only- Its basically saying "hey, if you put this here, we have to move all this around at the same time to avoid a collision" <----My guess

[MENTION=5830858]draymond1987[/MENTION]on1987 That screen pops up after its booted into download mode and ready to flash
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5070414]Josh McGrath[/MENTION] That error is because it compares your GPT to the GPT in the KDZ, but you aren't flashing the GPT, so you are good (at least I HOPE you didn't check any of the GPTs :) )

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
I see that now, Josh. Sorry about that.

So I did not select anything else and got the same error. So I do not know if the KDZ will flash everything or not?
[LG V20 Guides, News, & Discussion] Josh McGrath:
'Perfect! Thanks for the fast response and I didnt know that it compared files it wasnt flashing over. :)

Flashing again now

[MENTION=3167089]runningnak3d[/MENTION] Ive cancelled twice now, it is writing system, LAF, LAF.bak...all stuff I didnt select. wth is going here. Im not going to boot out of download till I know whats going on and get the okay from you. Is that normal?