yashsingh1/xdaforums huggingface dataset:
[LG V30 Guides, News, & Discussion] runningnak3d:
The reason you can cross flash firmware on the V20 is because LG screwed up. They used the SAME RSA cert to sign ALL the models except the H918 (T-Mobile). They fixed that on the V30. Again, I have only checked 3 models so far, but the cert that they used is different across all 3.

No, you can't just extract boot, patch it, and then flash it -- it will fail the signature check that lafd does. If you could get it onto the phone, then yes, that would work, but you have to have a way to flash it.

-- Brian
[LG V30 Guides, News, & Discussion] brossovitch:
That's the point of the patched dll and unlocked bootloader though right? Otherwise I have no idea why any of the past 6 pages exist on this thread..

---------- Post added at 03:08 AM ---------- Previous post was at 03:02 AM ----------

just sayin.
[LG V30 Guides, News, & Discussion] ChazzMatt:
Someone in China says they have done it.
[LG V30 Guides, News, & Discussion] padmanek:
I can do that (pull boot, patch it with magisk and flash back) because my BL is unlocked. (I have EU OPEN H930 blessed by LG to unlock BL) How does that help you if yours isnt? You'll brick if you flash it because it wont be signed anymore.
[LG V30 Guides, News, & Discussion] runningnak3d:
It doesn't matter how much you patch LG UP or the DLL since lafd -- the process that runs on the phone -- expects a SIGN opcode with a SIGN payload, or it will not flash. If you send the SIGN opcode from the KDZ, then the SHA256 of the partition that you are flashing must match. If you modify the image, it will no longer match and LAF will "laugh" at you.

Don't take my word for it. Try it. You are not going to brick your phone flashing boot or system (modified or not). The worst that is going to happen if you flash a modified boot or system is that lafd erases the partition. You just have to flash those partitions from a valid KDZ to recover.

You have the right concept. By having an unlocked bootloader, it no longer checks the integrity of boot -- but you have to get it on the phone. Flashing it is the issue. lafd is standing in your way :)

-- Brian

---------- Post added at 09:19 PM ---------- Previous post was at 09:18 PM ----------

They flashed boot and system NOT the full firmware stack.

-- Brian
[LG V30 Guides, News, & Discussion] brossovitch:
I have an unlocked bootloader. Just no Fastboot flash commands...
[LG V30 Guides, News, & Discussion] Josh McGrath:
"the laugh at you". Are you talking about the "i am laffing so hard right now" message? I thought that was just someone being a smartass in the programming app I was using
[LG V30 Guides, News, & Discussion] runningnak3d:
Actually it is: "Hello, I am LAF, nice to meet you!" :)

But yes, it was someone at LG having fun....

-- Brian
[LG V30 Guides, News, & Discussion] dropiit:
They say after flash the phone can support more carriers' bands in China.Is the modem.img flashed?Is the modem.img included in boot or system?
[LG V30 Guides, News, & Discussion] padmanek:
Oh I thought only EU got BL unlocked. So why don't you use DUMP to get boot.bin and then patch it with Magisk and Partition DL it back?

With BL unlocked will LAF complain it's not signed?
[LG V30 Guides, News, & Discussion] runningnak3d:
modem is its own partition and is signed with the RSA cert, so they didn't flash that. However, the RIL (Radio Interface Layer) is contained in system. That very well could have opened up additional bands.

-- Brian
[LG V30 Guides, News, & Discussion] ChazzMatt:
Well, that's start. ;)

I could flash T-Mobile easily unlocked bootloader over my US998? Or am I being too simplistic?

Sent from my official carrier unlocked LG V30+ US998
[LG V30 Guides, News, & Discussion] runningnak3d:
No, you flash abl from an H932 onto your US998 and you will be opening an RMA. boot and system are the only safe things to flash.

-- Brian
[LG V30 Guides, News, & Discussion] padmanek:
Will LAF complain about flashing tampered boot if the BL is unlocked (H932 model)?
[LG V30 Guides, News, & Discussion] brossovitch:
It is in neither. Modem partition is separate
[LG V30 Guides, News, & Discussion] runningnak3d:
Actually it doesn't complain, it happily ACTS like it is flashing, and what you are left with is a blank partition.

BL locked or unlocked doesn't matter when it comes to flashing, only when booting. If you have an unlocked bootloader, and you have full fastboot, and flash a modified boot. As long as your bootloader is unlocked the phone will boot. Lock your bootloader, and now you have a bootloop until you unlock the bootloader again.

The issue here is getting the modified boot onto the phone. RSA signature checking can not currently be defeated. If it could, the security of the Internet would be toast. :)

I found a hold in lafd on the v20 that allows me to bypass the signature check. Not using LG UP -- talking to lafd directly with Python. I based my work on the work done by this guy: https://github.com/Lekensteyn/lglaf/

Back in the days of the G2, G3 and even the G4 prior to Marshmallow, you could talk to lafd and get full shell access with the EXEC opcode (EXEC sh dd if=/sdcard/twrp of=/dev/block/blahblah). LG patched that hole REAL quick. But I used his work as a basis to figure out the communication between LG UP and lafd, but again, LG has patched THAT hole on the V30.

-- Brian
[LG V30 Guides, News, & Discussion] brossovitch:
Okay, so here's all I'm saying.,

On our TMobile H932, we can FASTBOOT OEM UNLOCK. This supposedly unlocks the bootloader giving us the warning screen on boot saying that security cannot be checked. This also voids our warranty.

If this does nothing then LG is screwing us badly because if it's not actually unlocked, then why is our warranty void?!

Anyway, with the BL unlocked, LAF won't zero out the modified boot partition, yeah? So everything you guys are saying about flashing the boot & system partitions should work.

Worst case scenario, laf zeros the modded boot partition and we need to flash full KDZ. No biggie.

How do we flash only the boot? Well, flash only the boot.img with this modded LGUP.

The concept makes sense, especially since the dev of Magisk actually does this himself.

That's all I'm saying. Not trying to argue, just explaining it should technically work.

I'm away from home so I can't even try right now until maybe Monday.

Now, the newest Magisk Manager apk, has the boot.img patching option. So we just need to patch it, move it to a pc, then see if it flashes. The results can't be as bad as flashing other variant partitions as we've established at this point.

Anyway, I could be wrong. Maybe I'm over thinking it... But, eh.

---------- Post added at 04:17 AM ---------- Previous post was at 04:05 AM ----------

This sucks!

I actually updated my G4 to last months OTA and reflashed TWRP and Rooted again a few hours ago. I miss full Fastboot. I miss rooted devices. This is a sad time..
[LG V30 Guides, News, & Discussion] Josh McGrath:
I'll give it a shot in a few since I already need to do a factory reset anyway. I'm thinking my radio is bad since the net constantly has to be turned off and back on
[LG V30 Guides, News, & Discussion] brossovitch:
Wait, I thought you'd bricked?
[LG V30 Guides, News, & Discussion] Josh McGrath:
I did but was able to recover it luckily. I remember what [MENTION=3167089]runningnak3d[/MENTION] was saying now. After we rooted the g5 with a modified tot file, lg was um, "consulted" for free and told them to add sig checks to their software. So it will probably not work, but I am.curious what it will do so I'm going to try.

Will probably zero out the laf like he said it would. But either way, I have a replacement waiting for me to pick up and have the kdz if needed to restore.
[LG V30 Guides, News, & Discussion] Jubeldum:
LAF at you.

I'm sorry, but I couldn't get this out of my head. Just a little humor in this trying time.
[LG V30 Guides, News, & Discussion] Josh McGrath:
LG and codefire probably are laughing at us right now. Lol but hey, we are learning stuff right
[LG V30 Guides, News, & Discussion] padmanek:
Learning by bricking :)
[LG V30 Guides, News, & Discussion] askermk2000:
*bricks* - the building blocks of learning :)

[MENTION=5070414]Josh McGrath[/MENTION]

Do I understand correctly that the V30 is essentially unbrickable ?

As your method works after being in 9008 mode?

That's quite neat, unfortunately I can't seem to get it working on my V20.
[LG V30 Guides, News, & Discussion] Josh McGrath:
I hardly think it's unbrickable. The Qualcomm 9008 mode means , yeah, you're screwed. Look into deep flash cables cause that's what mode certain phones have to be in to use the official Qualcomm software. You can buy or make one yourself and try it.

If you get the cable, let us know how it goes. But honestly I don't know if it will work with the v30 but it's Qualcomm software and drivers so I would assume it would.

I wondered if the fastboot flash commands works that way, with that cable. I was going to buy before I got so damn sick
[LG V30 Guides, News, & Discussion] askermk2000:
I don't need to look into that. I'm an authority on the subject after running a long thread in V20 section some months back.

The reason I asked is because the steps you described in your first incident, seemed to me = hard-brick, but maybe I didn't read that quite right.

So I guess you only flashed/erased boot or system partitions then, well no big deal, hardly worth calling it a brick.
[LG V30 Guides, News, & Discussion] Josh McGrath:
Yeah, I believe I still had download/recovery because it did flash, but wouldn't boot.

It's still a brick, just a soft brick not a hard brick, I should have specified.
[LG V30 Guides, News, & Discussion] wolfgart:
LG V30 partitions dump has a .bak copy of each partition .

Does it is possible to enable some function of LGUP to overwrite a .bak partition to be used like the stock one ? Example : use LAF.BAK instead of LAF.BIN
[LG V30 Guides, News, & Discussion] visus75:
Hello

if you want to check .. mine is V300K from KT Korea, and i'm on Oreo stable, since it is from LG's home may be something could be different and interesting to know.. if let me know and tell me what to do..
[LG V30 Guides, News, & Discussion] smitel:
BTW, regarding RSA keys, I don't know how you guys extract the RSA keys, but I found a thing on github to extract keys from AVB images and made a small patch to make it work with my H955:

https://github.com/bkerler/dump_avb_signature/pull/1

It might be worth checking if this works with your V30s and then building a database somewhere with PHONE-KDZ-KEY.
[LG V30 Guides, News, & Discussion] runningnak3d:
[MENTION=6556954]smitel[/MENTION] Thanks for the link. The AVB sig is what gets ignored when you have an unlocked bootloader, it is not the firmware signature that is checked by the key in the CPU.

Good link none-the-less :)

-- Brian
[LG V30 Guides, News, & Discussion] padmanek:
Are you certain about the /recovery checks? I mean, the only working way of rooting V30 (H930 BL unlocked with full fastboot available) currently starts with flashing twrp into recovery with fastboot.

I'm actually surprised that [MENTION=5070414]Josh McGrath[/MENTION] got soft bricked by just doing that. Yeah he did it with Partition DL because his unlocked BL doesn't have fastboot flash commands but does it matter?

Edit: after re-reading his post he actually said he forgot to use the correct .dll file which could be the reason Partition DL failed?
[LG V30 Guides, News, & Discussion] runningnak3d:
No, if LG UP recognizes the phone and allows you to flash, the DLL is working, it doesn't matter what model it is from. There is nothing phone specific about the flashing process contained in the DLL.

Without being able to decompile abl because it is encrypted now, I can't say for certain, but it is my guess that fastboot oem unlock only stops abl from verify boot -- recovery and laf are probably still verified.

The only way someone will know for sure is to try again. Whatever you do, do NOT flash LAF. You can recover from a bad flash of recovery, but you blow up LAF and you have no way to flash anything.

This is all moot, since without the ability to either bypass the SIGN check, or forge it (good luck getting a hold of the private RSA key), there just is no way to flash modified partitions.

Hey look on the brightside. At least there is a chance that a kernel exploit will be found, and you can flash a rooted boot image. There is also a chance that an engineering abl could leak. Again, you would need a way to flash it -- and that would require a kernel exploit.

-- Brian
[LG V30 Guides, News, & Discussion] runningnak3d:
[MENTION=1104326]simtel[/MENTION] posting the link to the tool that can pull the AVB sig got me thinking. If T-Mobile used the same cert to sign older versions of the LAF partition, it is just a matter of finding an older version that is still exploitable, AND is signed with the same key. Then it can be flashed with the patched LG UP (the SIGN will match), AND it will load since the abl will be happy with the AVB key.

You guys might want to start extracting firmware from older T-Mobile LG phones and comparing the AVB key. Just need to find a version that still has the COPY hole and you can use the V20 "LAFsploit"...

-- Brian
[LG V30 Guides, News, & Discussion] TheDannemand:
OK, this is so trivial, I am almost embarrassed to suggest it, and I am sure someone must have tried it already -- although I don't see it mentioned in this thread:

We know bootloader is easily unlocked on the H932, but fastboot's flash commands have been removed. But how about booting the TWRP image file straight from the fastboot command line, as in "fastboot boot twrp-3.1.1-0-h930.img"? Or is fastboot boot also stripped on the H932?

I am new to the LG ecosystem, but that is what I used to do on my Nexus 5: I kept stock recovery on the phone and simply booted TWRP from fastboot when I needed it. Once loaded with the above command, I could flash anything from TWRP, as long the bootloader was unlocked.

I've read [MENTION=3167089]runningnak3d[/MENTION]'s enlightening descriptions of the heightened security on LG devices and the need for recovery to match RSA keys. But this wouldn't violate that security, as it only works with bootloader unlocked, and it doesn't itself involve flashing anything onto the device (which could be potentially malicious). Of course what we flash once TWRP is loaded is another matter ;)

I would try it myself, but I am not ready to unlock bootloader until I am out of warranty. In this household new phones need to last 2-3 years or longer. There is a reason why a Nexus 5 from 2013 was my last phone...
[LG V30 Guides, News, & Discussion] runningnak3d:
One the V20 and G6 they pulled the fastboot boot command, I can't imagine that they would have put it back, but yea, you won't know if you don't try.

It really sucks that they encrypted abl so it isn't possible to just LOOK and see what is available.

I hate Qualcomm. THEY are the ones to blame for this security. LG isn't doing anything that every other OEM that uses SnapDragon processors is doing. If Qualcomm hadn't have come up with the reference implementation for security, LG would still be scratching their ba**s. I hope the d**k head that notified LG that they needed to add signature checks to their firmware flashing was banned. I am all for reporting security holes where data can be compromised. Flashing what you want onto a phone ISN'T that kind of security hole. On a stock phone the userdata partition is encrypted, and there is no way to decrypt it no matter what you flash on the phone.

-- Brian
[LG V30 Guides, News, & Discussion] crazyut:
On the US998 v30+ carrier unlocked (equivalent to H930), I have attached the fastboot commands from the command prompt and what happened when I tried to fastboot boot command. It gave a red triangle boot error, then powered down. I booted up afterwards normally. Not sure if this helps for the H932 or if you can get a comparison list of fastboot commands from H932.
[LG V30 Guides, News, & Discussion] TheDannemand:
Thank you for that response. If they stripped fastboot boot on the G6 and V20, I cannot imagine it's back in the V30. Regrettably. This merely reflects my newness to the LG ecosystem -- or rather, to the 2017+ Android rooting scene.

And yes, I think we can all agree that owners should be allowed to flash whatever they want on their devices. I'd argue that root should be a factory supported feature from Google (AOSP), to be enabled in fastboot along with oem unlock. I can get root/Admin access on any other OS if I so choose. A lot of users wouldn't need custom ROMs or kernels if they had plain root -- saving a boatload of RMAs caused by failed flashing attempts.

Thanks again for your response!
[LG V30 Guides, News, & Discussion] EMSpilot:
Do you still get the red triangle every time you reboot?

Thanks
[LG V30 Guides, News, & Discussion] TheDannemand:
Thank you for this. It confirms what [MENTION=3167089]runningnak3d[/MENTION] posted, that fastboot boot is indeed gone and hasn't miraculously come back. I am sure that is true for the H932 as well.

But what a lovely list of fastboot commands you have available there on your US998/H930 :crying:

As I read it, [MENTION=379391]crazyut[/MENTION] booted normally afterwards. Which would make sense, since fastboot boot doesn't flash anything or otherwise change the device.
[LG V30 Guides, News, & Discussion] crazyut:
Yes, you are correct. It did boot normally and I did a 2nd reboot to see if anything happened. Nothing I could see.

On a bootloader unlocked H932, when you do the adb reboot bootloader, then you do a fastboot -help or --help or /?, does it display anything?

---------- Post added at 12:54 PM ---------- Previous post was at 12:53 PM ----------

No, it boots normally as if nothing happened because apparently nothing did :/
[LG V30 Guides, News, & Discussion] Josh McGrath:
You really don't know who it was? He did it because people were stealing others work including his, and we're generally being **** heads in the LG forums. Not that I support it at all... Kinda screwed the 98pct of the good people for the bad ones
[LG V30 Guides, News, & Discussion] brossovitch:
Yes, typing fastboot help displays all of the Fastboot Commands.

However, anything you use fails..

I have tried all forms of

Fastboot flash twrp....

Fastboot boot twrp....

Fasboot flash recovery twrp....

Etc... Etc...

None works.

After fastboot oem unlock it says warranty void and every boot up it has orange warning screen.
[LG V30 Guides, News, & Discussion] crazyut:
I was curious to see what other commands are missing as compared to US998 unlocked version.
[LG V30 Guides, News, & Discussion] brossovitch:
We can OEM unlock and oem lock. But warranty still void no matter what. Which is CRAP because if we can't do anything, why does it void the warranty?!
[LG V30 Guides, News, & Discussion] Josh McGrath:
I agree with that 100pct! But warranty is void through LG, and technically Tmobile. But tmobile reps dont give a damn, and the refurbishers dont even know what root is probably much less a bootloader.

If we cant do anything, then it should be void. Thats stupid. This is why i buy from retailers and not LG directly.

EDIT: The Magisk automatic patch of the abl (LGs BOOT) requires a custom kernel- which we do not have.
[LG V30 Guides, News, & Discussion] brossovitch:
Patching the kernel with the Magisk app makes it.

It's cool. I love my v30, even without root.
[LG V30 Guides, News, & Discussion] Josh McGrath:
I would post a screen shot but it has been disabled by my forum admin.. ??

"Stock kernel could not be patched, please use a custom kernel."

FAILED

Installation failed

It's detecting it as a Sony ELF64 file..wierd
[LG V30 Guides, News, & Discussion] brossovitch:
How did you do it?

You just take the kernel IMG from the kdz and then select it from the Magisk app then it will patch it.

Extract it, put it on the SDcard then select it and it will patch it. I'll be home in about 60hrs i can try it then..
[LG V30 Guides, News, & Discussion] brossovitch:
Dude, that would be amazing if it could work! Even for the system dump. Inwas trying a few days ago but the PC I was on just refused to even try. Thank you!
[LG V30 Guides, News, & Discussion] betam4x:
Am I missing something here? At least some ADB commands are working on my device (adb reboot bootloader, for instance), what specifically isn't working?
[LG V30 Guides, News, & Discussion] ChazzMatt:
Most of the fastboot commands you need to flash.

https://xdaforums.com/showthread.php?p=74193296
[LG V30 Guides, News, & Discussion] betam4x:
Could LGUP be of use here? It recognizes my device. I don't dare attempt to flash anything though.

---------- Post added at 07:47 PM ---------- Previous post was at 07:46 PM ----------

(I'm not new to rooting, flashing, etc, but I'm new to the LG ecosystem. I started poking around with the phone earlier)
[LG V30 Guides, News, & Discussion] metalhed32:
I'm not sure how any of this works, so my thoughts may be useless, but has anyone tried using an Android Wear device/software vulnerability as a bridge to re-enable adb commands?
[LG V30 Guides, News, & Discussion] mr turtle droid:
i didnt even know that was a thing and no one has tried that yet
[LG V30 Guides, News, & Discussion] stanleyopar2000:
wait. Are you telling me that even the INTERNATIONAL unlocked V30 is unrootable??
[LG V30 Guides, News, & Discussion] ChazzMatt:
No one has said that. Are you quoting someone?

If you are referring to the thread title, yes the op could have titled it "T-mobile H932: Progress Towards Root/TWRP/ROMs (not achieved yet)" -- to make it totally clear he only wanted to discuss one specific LG V30 model. He later edited his post #1 to clarify the topic of discussion but only after a few posts where we pointed out the "open market" phones would have guaranteed root, recovery, ROMs.

Are you referring to my post #2?

https://xdaforums.com/showthread.php?p=74203186

For "international", if you're talking about the Europe H930, it will soon be placed on LG Developer Bootloader Unlock list. And will quickly be rooted, etc. once bootloader unlock codes are given. Same with the "open market" US998, which has not been released yet.

H930 was just released a week or so ago (early November 2017). LG hasn't yet updated the

LG Developer Bootloader Unlock list

to include it yet. The "open market" US998 will be released in early December and will also be placed on the

LG Developer Bootloader Unlock list.

These two models will have official bootloader unlock with full ADB commands, whereas the T-mobile model has most of the ADB fastboot flash commands removed. Same as the LG G6 T-mobile model -- "unlocked" bootloader but no published root * after 7 months.

_______

* There are rumors someone cracked the bootloader and rooted a Verizon LG G6, but for their own reason chose not to publish the method. Knowing the person who told me, I have no reason to doubt it. But, no, I don't know how they did it, as I am not a dev. This leads to a bunch of questions. Do some of the carrier models have ADB flash commands if you can get past the bootloader?
[LG V30 Guides, News, & Discussion] Josh McGrath:
[MENTION=3250376]ChazzMatt[/MENTION] OT but what phone are you using now? My v20 is pissing me off and I'm like you and want root from day 1
[LG V30 Guides, News, & Discussion] ChazzMatt:
I'm currently still using my Moto XT1225 (64GB "international" version of the Droid Turbo, but which has all the AT&T LTE bands plus more HSPA bands). Basically was smaller version of the Moto Nexus 6 -- but with larger 3900 mAh battery. I wrote a bootloader unlock guide for it as well as the sibling Moto XT1250 (exact FCC ID clone of the Verizon Droid Turbo) here on XDA.

I have RR 7.X custom ROM with [MENTION=5747496]bhb27[/MENTION] custom kernel.

My wife is using same model phone.

I'm waiting for the LG V30 US998. I'll buy it first, then probably buy a 2nd for her once everything is rooted and customized well enough. Waiting even a month more for hers could save me money with lower price.