yashsingh1/xdaforums huggingface dataset:
[LG V30 Guides, News, & Discussion] Josh McGrath:
I had to let my phone completely die so it would be "off". Then when you see the charge more to turn on. Keep trying the button combo below. It took me literally 20 or so times.

Phone off... Hold down volume up, hit power and immediately put the USB cord in. It should open to download mode. But like I said, it took me so many tries to get the right battery charge and button combo
[LG V30 Guides, News, & Discussion] dropiit:
In China,someone has finished the work you are trying.

Now He can flashed US998 kdz into H932 or LS998,the same as V300 kdz.

AND, nothing about root has been mentioned.I can confirm that there is no root on this way.

Updated：Just a moment ago I asked him can we get root on h932 now.The answer is no.
[LG V30 Guides, News, & Discussion] ChazzMatt:
You're being pessimistic. They're trying to convert to other firmware to have access to flash commands AND have unlocked bootloader. This is like when NASA sent Apollo to the moon first without actually landing on the moon. Those astronauts came within a few hundred feet of the moon (with lunar lander and everything) but weren't allowed to land. Full test rehearsal. The NEXT mission was to land on the moon.

US998 doesn't have unlocked bootloader yet or root (but has full flash commands behind locked bootloader). H932 doesn't have root yet. This procedure is to EXPLORE those possibilities.

The questions to be answered are,

when flashing a bootloader unlocked H932 to US998, does the bootloader stay unlocked or does it lock back?

When flashing an H932 to US998, do you have access to flash commands?

If you can get some combination of unlocked bootloader AND flash commands, you can now land on the moon.
[LG V30 Guides, News, & Discussion] jaedenhudson14:
I just got an update notification for the newest security patch. It is VS99610E. I am wondering if anyone has taken this update and lost the ability to use fastboot commands or if anything else has become unavailable to us. If anyone has any details I am sure it will be helpful for all of us.
[LG V30 Guides, News, & Discussion] Abdiel1224:
Can you provide the link?
[LG V30 Guides, News, & Discussion] Abdiel1224:
You are the best!!!
[LG V30 Guides, News, & Discussion] dropiit:
IT’s on a private social circle.Only if you are his QQ( a kind of IM software in China） friend will the link show for you.

And,it is trade srcret,he wont tell us how to do it.
[LG V30 Guides, News, & Discussion] Abdiel1224:
So far looking great in my end!!!

Guys just open the zip created by smitel and if you have lgup installed in local c go there and replace it by the mod one. Then go to model->common-> and then throw there the patch one BUT YOU WILL HAVE TO RENAME IT AS THE FOLLOWING: LGUP_common.dll that way LGUP will recognize the dll.
[LG V30 Guides, News, & Discussion] padmanek:
I don't have this folder either.

That's exactly the version I'm using. It was in the uppercut thread.

Running as admin doesn't change anything for me. Windows 10 x64 here.

I've tried installing all of this again.

1. Unistalled LG UP using Windows uninstaller.

2. Removed C:\Program Files (x86)\LG Electronics\LGUP folder manually.

3. Removed \HKEY_CURRENT_USER\Software\LG Electronics\LGUP from registry.

4. Installed LG UP from the link you've given above.

5. Unpacked your .zip in LG UP folder, overwritten all files it wanted to.

6. Run the .reg

7. Checked in registry if the .reg successfully applied - yes it was there.

8. Rebooted the PC just in case..

9. Connected the phone, checked device manager if it's visible - it was on COM5.

10. Launched LG UP as admin

11. Same error as earlier.

Here's the log: https://pastebin.com/m2Zmqy9N

---------- Post added at 02:48 PM ---------- Previous post was at 02:40 PM ----------

Lol this actually worked.

[MENTION=6556954]smitel[/MENTION]

I renamed your uppercut folder to common and renamed LGUP.dll inside it to LGUP_common.dll and...:

Why do we get more options than you on your screenshot [MENTION=6556954]smitel[/MENTION] ?

I'm running the "DUMP" right now to try it out.

Anywhere I can read about what do all those functions in LG UP do?
[LG V30 Guides, News, & Discussion] Abdiel1224:
But dont use dll provided by [MENTION=6556954]smitel[/MENTION] is corrupted for some reason.
[LG V30 Guides, News, & Discussion] padmanek:
I'm using his .dll, the one from model/uppercut folder renamed from LGUP.dll to LGUP_common.dll and it seems to be working. Running DUMP as we speak to test it.
[LG V30 Guides, News, & Discussion] smitel:
Maybe because I'm using it against a H955?

I dunno.

Anyhow, good to hear it's working for you guys.

I'd say my work here is done. :D

BTW, check out the 'phonesetting' stuff. It's pretty sweet.
[LG V30 Guides, News, & Discussion] Abdiel1224:
Try doing partition dl
[LG V30 Guides, News, & Discussion] padmanek:
But what do I flash back? The partitions i got using DUMP have no file extension, do I just rename it to .img and try to flash back?
[LG V30 Guides, News, & Discussion] Abdiel1224:
no, .bin extension file
[LG V30 Guides, News, & Discussion] padmanek:
I'll try when I get out of work. What kind of error do you get?
[LG V30 Guides, News, & Discussion] lightninbug:
Now that we have patched LGup working, what's the next door to knock on?
[LG V30 Guides, News, & Discussion] padmanek:
If LGUP's Partition DL is working then you should be able to flash twrp into recovery partition..no? But is it actually working? If it's not then I guess we have the wrong .dll patched. Why are we using uppercuts .dll instead of getting one from official .kdz for our model?
[LG V30 Guides, News, & Discussion] R800x_user:
Something I think would possobly be a issue is getting to The recovery. Like would a simple adb reboot recovery shoot us straight into said twrp if flashed onto our recovery partition. Or do we have to use the button combo like previous v series?
[LG V30 Guides, News, & Discussion] lightninbug:
Either or AFAIK. Once you achieve root, you could even use an app to reboot to TWRP, no button combo or adb command needed.
[LG V30 Guides, News, & Discussion] lightninbug:
I am just looking for what needs to be done next. And I'll test.
[LG V30 Guides, News, & Discussion] SGCMarkus:
Atleast on the H930 LG seems to have removed the reboot command for whatever reasons (from normal Terminal). Still works with Adb though (Adb does have more rights than the normal user, but still less than root).

With root its also possible in Termux for example, without it tells me command not found.

On other ROMs like Lineage or so (still testing things on my old phone) "reboot recovery" (from any terminal app) should work though with user permissions.
[LG V30 Guides, News, & Discussion] Josh McGrath:
The bootloader remains unlocked when flashing a stock kdz.

Does the 930 have fastboot flash commands?
[LG V30 Guides, News, & Discussion] padmanek:
Okay, I got home and tried to use Partition DL and LG UP just stops responding. :( :( :(

So either our LG UP is jinxed OR uppercut's .dll ain't cutting it.

I have some .kdz's for my H930 laying around so I grabbed a .kdz extractor from here

and extracted a 10f one. Inside there was 3 files: one .dz file, one .dll file called LGUPc.dll and a file called LGUPc.dylib.

Attached them to this post.

[MENTION=6556954]smitel[/MENTION] could you try to patch this .dll for us?
[LG V30 Guides, News, & Discussion] smitel:
What's it worth? ;)
[LG V30 Guides, News, & Discussion] padmanek:
For me, with BL unlocked, rooted v30 not much :D I'm just trying to help. But US guys with locked BLs might want to chip in something ...or wait until LG does (or does not) put their model on BL unlockable list.

I've tried to paste in the extracted .dll into \LGUP\model\common folder and renaming it to LGUP_common.dll but it doesn't work. Getting errror: DLL for H93010v is invalid. Please install valid DLL package(*msi) for the model.
[LG V30 Guides, News, & Discussion] brossovitch:
I'm broke for the next few weeks. I'm sure these guys want root enough to donate. .

Really appreciate your help! I've been busy and just read through everyrhing. You are a great help to us.

Thank you.

---------- Post added at 11:48 PM ---------- Previous post was at 11:45 PM ----------

Should we patch together the DLL from all v30 model kdz? H932, H930, & US998 all in one dll patched into the one you guys have been using?

---------- Post added at 11:51 PM ---------- Previous post was at 11:48 PM ----------

And LG will not put our H932 onto the BL unlock list.

But also, my H811 G4 isn't on the list and it's been rooted for almost 2yrs now. Even just updated my G4 to last months update and Fastboot still works.

I think they're just blocking us intentionally. They should at least allow fastboot to work after they stop supporting the device, at the very least.
[LG V30 Guides, News, & Discussion] smitel:
That's right.

The .DLL needs to be patched to work with the patched LGUP.
[LG V30 Guides, News, & Discussion] ChazzMatt:
I'll donate another $20

Sent from my official carrier unlocked LG V30+ US998
[LG V30 Guides, News, & Discussion] jcsww:
Isn't it possible to unlock the bootloader of the H933 as well? With them being $0 again on a contract through my Canadian provider. I might pick one up just to mess around with to help out, if it is possible to unlock. I really do't want to mess with my V30+ H932 because I use that phone a lot, especially being back up in Canada for a few weeks.
[LG V30 Guides, News, & Discussion] padmanek:
[MENTION=6287517]brossovitch[/MENTION]

[MENTION=3250376]ChazzMatt[/MENTION]

I've just patched it myself. Wasn't hard at all. [MENTION=6556954]smitel[/MENTION] posted a guide for it in his main thread after all.

Download any hex editor, I got Hxd. Open the .dll, search for "3d 09 01 0b 80 7f" and replace with "b8 00 00 00 00 eb"

You get the .dll for your model by extracting it from .kdz using this extractor . Plain and simple.

I've put it inside \LGUP\model\common folder and renamed to LGUP_common.dll and it works!

Partition DL DOES WORK , doesn't hang and let's me choose what partition I want to flash.

All credit goes to [MENTION=6556954]smitel[/MENTION] and his guide how to do it.
[LG V30 Guides, News, & Discussion] smitel:
Deal! :)

It shows a new 'DFT' option for my Flex2.

View attachment LGUP.1.0.31.9.v30.kdz.zip
[LG V30 Guides, News, & Discussion] ChazzMatt:
I'll be home in an hour. I will send the money then. Thank you so very much for your continued help.

Sent from my official carrier unlocked LG V30+ US998
[LG V30 Guides, News, & Discussion] R800x_user:
I'll be using this later today once im off work to attempt to flash the h930 twrp on the h932 recovery and see that happens. Thanks to everyone participating. I'll report back if I brick or succeed. Also will be donating once I recover my PayPal account.
[LG V30 Guides, News, & Discussion] Josh McGrath:
Be careful guys, I didn't change the dll file, but I was able to select the partition (only recovery and recover.bak) because I wasn't thinking and it bricked me good

Edit:, but this was on the us998 file on my 932

If you get bricked, look back at my post. It's a pita but at least I saved my original v30.
[LG V30 Guides, News, & Discussion] padmanek:
But you can just enter DL mode and flash stock .kdz back and you'll be good as new :)

Everyone, should we check if the .dll for diffrent variant firmwares is the same? I'll get some md5 tool right away and check for H930 10f 10v and 11m.

For H930 EU OPEN all .dlls are the same for:

-10f

-10v

-11m

MD5: 75A25C82BAA4EB7ADF4D6E27D0678D62

The same .dll was also inside

-US 998 10c

-VS 996 10d

It's pretty safe to assume all V30s use the same .dll IMO.
[LG V30 Guides, News, & Discussion] R800x_user:
Did you just flash twrp? Over the recovery partition?
[LG V30 Guides, News, & Discussion] Abdiel1224:
Nope same to me hardbricked it wont even charge :/ talking to LG for a replacement... Done for now
[LG V30 Guides, News, & Discussion] padmanek:
What did you do exactly? Did you try to flash US998 10c over H931 10h?

Did you use the new 1.0.31.9 dll?
[LG V30 Guides, News, & Discussion] ChazzMatt:
:good:

Confirmation number:

6SH687300W9752257

Donation amount:	$20.00 USD
[LG V30 Guides, News, & Discussion] Abdiel1224:
Yes i was okay doing boot and system in partition DL. But i was dumb and flash the whole kdz file and pufff Hardbrick.
[LG V30 Guides, News, & Discussion] ChazzMatt:
Are you sure that's the right string? I thought that string was for G5. Or is it the same string, but you need the .dll for your model? Just asking.

See if the smitel matches what you did? See his attachment.
[LG V30 Guides, News, & Discussion] smitel:
BTW, hint, do not work with IDA Pro on LGUP in between FortNite BattleRoyale matches: https://cdn.discordapp.com/attachments/362916022904291329/404050732657016832/unknown.png :)
[LG V30 Guides, News, & Discussion] Josh McGrath:
Well all I did was flash the recovery parts and it bricked me so something is going very wrong here. But again, that was on the 998 kdz

Use my recovery method guys, it will work even though it's a real pita. This is why I hate non removable batteries

---------- Post added at 01:53 AM ---------- Previous post was at 01:50 AM ----------

When I start feeling better, I'm just going back to figuring out how to repack recovery in the kdz for our 932.
[LG V30 Guides, News, & Discussion] smitel:
This replaces

cmp eax, somebytes

jg somewhere

with

mov eax, 0

jmp somewhere

To patch their signature verification to always succeed.

As long as LG uses WinVerifyTrust() in the same fashion in their DLLs, this replacement should work to allow the model dll to work with the patched LGUP.
[LG V30 Guides, News, & Discussion] padmanek:
His patched .dll has the same exact MD5 as my own patch: AAD5DDEE660C576D3951E14D0E616AF4

Watch out tho, inside his zip he placed the new .dll next to the .exe file, it's the .dll that was modified 20th of January, not the one in model/uppercut

For safety I'm uploading just the patched .dll here.
[LG V30 Guides, News, & Discussion] runningnak3d:
You guys should really read up on how the firmware is signed with an RSA cert. The public key is in the CPU. When the phone boots, it verifies the firmware with that key. If it doesn't match, it goes into QD_LOADER mode (9008). The firmware for the H930, H932, and US998 are all signed with a different key. You are safe flashing boot and system since they are not signed. But xbl, abl, hyp, modem, etc are all signed, and it appears that recovery and laf have additional checks on the V30.

As for packing a KDZ -- there is a signature that is sent via LG UP in a SIGN opcode. It is also signed with an RSA cert. The public key is embedded in lafd -- the daemon that gets run when you go into download mode. The SIGN is a list of the partitions with their SHA256 hashes.

Just trying to save you guys from bricking phones. Don't say you weren't warned. I have spent 6 months trying to crack the security of LAF on the V20 and I found a hole. That hole doesn't exist on the V30. Not saying another one doesn't, but blindly flashing partitions from different models (at least the 3 that I have checked) will brick your phone. I am not guessing here -- I know it will...

EDIT: also -- abl (formerly aboot) contains fastboot mode, and it is encrypted as WELL as being signed on the V30 (well all SD835 based phones).

-- Brian
[LG V30 Guides, News, & Discussion] padmanek:
Well, that sums up our attempts to convert one variant into another. We should not try this at home...
[LG V30 Guides, News, & Discussion] brossovitch:
Well that is good then. In a way.

We need to keep the firmware to our devices anyhow..

However, we need the Bootloader from another device, theoretically. Not the entire KDZ. Only Bootloader then twrp.. then I imagine after we have TWRP we can flash our bootloader back... Because TWRP will be our flashing source... Maybe?
[LG V30 Guides, News, & Discussion] Josh McGrath:
Oh thanks for the input. I thought we had moved past the sign checks.

I was under the impression that the lguppercut bypassed the sign requirements. I didn't know they were required. A lot must have changed since the g5 days cause and unlocked bootloader turns off security.

Looks like a kernel exploit is the way to go here

I hate asking this, but are you still testing your method of writing to the laf?
[LG V30 Guides, News, & Discussion] smitel:
Oops, I thought I made a new lgup.zip, but yeah, you're right. :)
[LG V30 Guides, News, & Discussion] brossovitch:
I guess we're pretty much screwed .

Unlocked bootloader says it doesn't do security checks, but it still checks firmware? But it doesn't check system....
[LG V30 Guides, News, & Discussion] Josh McGrath:
I'm still learning but the kernel is also doing checks at the system level, not bootloader. Hence why the dm-verity file was needed to disable it on the g5 and v20
[LG V30 Guides, News, & Discussion] brossovitch:
Okay, so can we flash system and kernel(boot) partitions? If so, we can use the h932 kernel, patched with magisk, yea? Then flash it in place and simply install the app.

Alternatively, boot patched with SuperSU as well? If what I just read above is correct, we can modify the kernel and System however we like?
[LG V30 Guides, News, & Discussion] padmanek:
We're not using uppercut with the patched .dll and patched LGUP. If you did then... :D

All uppercut was doing was placing a "generic" .dll inside LG UP that allowed it to detect any LG phone and do a basic .kdz flash.
[LG V30 Guides, News, & Discussion] brossovitch:
Wait, the fastboot mode says is has a dm-verity disable option... Probably doesn't work though...
[LG V30 Guides, News, & Discussion] padmanek:
The combination you used to get into download mode is strange.

My V30 goes into DL mode every time like this:

1. Turn phone off.

2. Hold volume UP.

3. Plug in USB-C cable

4. You're in DL mode.

5. You can let go of volume UP now.

No pressing power or any other button.

That didn't work when u got bricked?
[LG V30 Guides, News, & Discussion] runningnak3d:
The abl (the bootloader that you are talking about) is the second quickest way to brick your phone.

When the phone boots, there is the PBL (Primary Boot Loader). It is contained in the CPU. It loads XBL (eXtended Boot Loader). XBL loads ABL. ABL loads BOOT, LAF or RECOVERY (and also gives you fastboot mode). Every piece of that boot chain is checked against the RSA key that is in the CPU. So there is NO WAY to replace the abl unless you get one that is signed with the SAME RSA cert that the CPU has the public key from.

The only thing that the patched LG UP gives you is additional features. One of those features is partition DL mode. In that mode, it doesn't check to see if what you are flashing is meant for the phone (please see my post on LAF and INFO GPRO and INFO SPRO opcodes). So, it will let you flash even raw images. However, if lafd gets a WRTE opcode without a SIGN opcode, it will NOT actually flash. However, it will very nicely do an ERSE on the partition first, and then you have a blank partition.

Yes, I have solved flashing arbitrary partitions by talking directly to LAF on the V20. However, I have checked and LG patched that hole on the V30 -- actually, they beefed up security a LOT.

I am willing to help look for holes in lafd (I have already extracted it from the 3 KDZs that I have, and have started decompiling it), but only after I get my phone back and finish the work for the v20 guys. Again, I am not saying this isn't possible -- just not the way you guys are trying to do it.

-- Brian
[LG V30 Guides, News, & Discussion] Josh McGrath:
Man, I would feel much better if someone more experienced would chime in here. On the v20, TMobile v20 had boot unlock options. Other had dirty santa

On locked bootloaders, you can only run the system software loaded on it because of sig checks (think s8, rooted, but can't use ROMs)

Unlocked means you can run kernels and custom ROMs, obviously, since the sig checks aren't "on" anymore. Plus personal data is much more susceptible on unlocked devices.

So the fix is finding a way to flash recovery since they took the damn fastboot commands away.

If nothing else, we are all learning a lot from this.
[LG V30 Guides, News, & Discussion] ChazzMatt:
Is the LG V30 security any different from the LG V20?

Because with the patched LGUP file we, everyone in the world, is able to flash one variant KDZ over another with LG V20. You are able to convert one variant to another. Carrier signal functionality is gone -- but Wi-fi and sideloads are available.

The patched LGUP file even correct partition mismatches.

https://xdaforums.com/v20/how-to/guide-patch-lgup-to-unlock-features-t3652222

[GUIDE][UNBRICK] Patch LGUP to unlock features & unbrick V20 (Variant mismatch fix)

Using a specially coded LGUP.exe, it allows you to flash a version of LG firmware -- like for another model variant -- you shouldn't be able to flash.

Also worked on an LG G5.

This trick became VERY useful when Dirty Santa bootloader exploit was patched. With the LG V20 "international" variant,

you flashed the H9990 another carrier's variant OLDER firmware version

--which still allowed the exploit to run. Yes, you temporarily lost all carrier signal functionally, but you could still use Wi-Fi and USB sideload.

You basically temporarily converted the "international" V20 H990 to another variant model (like Freedom POP H915). You then ran the exploit to unlock the bootloader, install TWRP. (Running the exploit is NOT the point here, keep reading. I know Dirty Santa won't work. It's the LGUP firmware flashing METHOD that's the point.)

THEN, after installing TWRP, you flashed BACK to your regular ROM -- except for recovery where you still had TWRP.

Carrier signal functionally restored, AND you now had bootloader unlocked and TWRP installed. BOOM.

I'm not trying to be stupid, but what is different about the V30 that the same method won't work that worked for tons of G5 and V20 phones?
[LG V30 Guides, News, & Discussion] brossovitch:
Okay. But.....

We CAN extract the Kernel (boot) partition from our model KDZ. and we CAN patch it with magisk.

And if this special LGUp lets us flash a single partition, like Boot. Then we should have root!

I dunno why I didn't think of it before. Is that not feasible?

---------- Post added at 02:40 AM ---------- Previous post was at 02:38 AM ----------

I personally don't want a ROM, I just want root. Therefore, someone extract the kernel from the H932 kdz please?
[LG V30 Guides, News, & Discussion] Josh McGrath:
This is what I'm wondering too. I know that thanks to a certain member on here and few assholes on here as well that made him do it, they added sig checks I think on the g5 (?) That he's referring to

---------- Post added at 02:42 AM ---------- Previous post was at 02:41 AM ----------

This is the way it was done before. That's exactly what twrp does. But I can't figure out for the life of me how to pack the kdz. I'm fine with bricking to learn this stuff
[LG V30 Guides, News, & Discussion] brossovitch:
Well, we don't need to repack the kdz. Just unpack and get the kernel. Magisk will patch it so we can flash it. I think it can output to the correct file extension as well.....

---------- Post added at 02:48 AM ---------- Previous post was at 02:45 AM ----------

What formats can lgup flash for single partition?
[LG V30 Guides, News, & Discussion] johanruda:
I've got a H930DS. If anyone need anything from it, lemme know! :)
[LG V30 Guides, News, & Discussion] padmanek:
.tot, .kdz, .img, .bin
[LG V30 Guides, News, & Discussion] brossovitch:
Can you pull out the boot.bin?

Rename it, "boot.img" since img and bin are literally the same, yea?

Then DL magisk manager and have it patch the boot.img file. Then, rename back to boot.bin, then us this LGUp to flash it as the boot/kernel partition. Then if it doesn't cause any issues we will have root?

But we'll still have laf and everything intact so we can flash the kdz is something goes wrong. I need to get home so I can be by a pc...

Edit:

Or leave it img! Just read last post.

Why wouldn't this work guys? The rest can be pushed with adb...