yashsingh1/xdaforums huggingface dataset:
[LG V30 Guides, News, & Discussion] brossovitch:
Wait a minute... So theoretically, we may be able to use part of the G4 to root?

I still use my rooted T-Mobile G4 (h811) so I don't have to go far for it.

But it just had working fastboot after Marshmallow somwe never needed an unlock.bin, just OEM UNLOCK and flash TWRP..
[LG V30 Guides, News, & Discussion] ChazzMatt:
No, he got the unlock.bin code from an LG G4 request thread. But it's actually a Huawei M8 unlock.bin code somebody posted in that thread. So, theoretically you can use part of a Huawei M8 to unlock bootloader and root. Yeah, crazy.

I went to that thread and looked for the LG G4 unlock code and couldn't find it. I told him all I saw was an M8 unlock code. He said yeah, that's what he used.
[LG V30 Guides, News, & Discussion] brossovitch:
Wow.

I wonder if it will work for our TMO v30...

I'd love to try it sometime soon.

Maybe someone will give a try.
[LG V30 Guides, News, & Discussion] Josh McGrath:
So did he do the fastboot oem unlock *unique code* then?
[LG V30 Guides, News, & Discussion] ChazzMatt:
He has some screenshots in that thread.

Sent via open market LG US998 V30/V30+
[LG V30 Guides, News, & Discussion] runningnak3d:
His bootloader getting unlocked had nothing to do with him flashing the unlock.bin. When fastboot says that something fails -- it FAILS.

When he cross flashed ROMs, one of the partitions that gets flashed is persist. This is the partition that determines if your bootloader is unlocked or not -- well some bytes contained in it.

By pure chance, one of the ROMs that he flashed had a different persist partition than what his phone's abl was expecting, and it unlocked. I knew that every model V20 except the H918 had full fastboot, but I wasn't sure about the V30 since abl is encrypted.

This does the H932 ZERO good since you would need to be able to flash the abl of a different model, and the H932 is the odd man out when it comes to RSA keys.

However, his find CAN be used to root every other V30.

I guess I might as well go ahead and release lafsploit 2.0 due to this find. I had been holding it back because there was no need for it (the V20s have the engineering aboot, and the V30s abl was encrypted), so need to release an exploit that wasn't needed. Now LG is going to make sure to pull the fastboot commands, and not just lock them.

-- Brian
[LG V30 Guides, News, & Discussion] RQYP:
So let me clarify. Are you saying now that EVERY V30 variant (i.e. V30 LS998 or H933) EXCEPT T-mobile H932 can be bootloader unlocked using this method?

If so, that would be quite ironic...
[LG V30 Guides, News, & Discussion] runningnak3d:
I can't say for certain -- again, abl is encrypted so you can't take a disassembler to it. However, knowing how LG works, I would say with fair certainty that method will work on any V30 except the H932 (again, you would need to flash another abl, and you can't do that).

Just so I can't say that flashing unlock.bin wouldn't do anything to the H932, I did it. I grabbed the one from that thread and here is the output:

fastboot flash unlock unlock.bin
target reported max download size of 536870912 bytes
sending 'unlock' (0 KB)...
[B]FAILED (remote: unknown command)[/B]
finished. total time: 0.000s

Now, it is a different failure than he got. But a failure is a failure when it comes to fastboot.

-- Brian
[LG V30 Guides, News, & Discussion] rdeets:
I apologize in advance if the following is a series of stupid questions, but:

In regards to the bootkey that's tied to the CPU, is that key assigned per device or per line? What I mean is, could you flash one H932 boot partition to another H932 with LGUP? What I'm getting at is, if a method worked on one H932, would it work on all of them?

Secondly, in regards to the boot key, do we know how LG signs it? Would it be possible to reverse engineer it to find not only what the key is, but to duplicate faux keys that will boot?

And, if that's the case, and if we could generate working faux keys, is that all that is needed to prepare a fastboot partition with working fastboot commands?

If all that is achieved, wouldn't we be home free for TWRP, kernels, ROMs, and potentially Treble?

I'm sorry if that is the above is ignorant and/or a gross oversimplification, I'm just trying to wrap my head around the process of breaking OEM locks.
[LG V30 Guides, News, & Discussion] ahmedyar91:
Hi Brian, Please ignore if this has been answered previously,

looking at the current progress, what are the possibilities of getting root On Lg G6(not T mobile variant) .?

Regards
[LG V30 Guides, News, & Discussion] runningnak3d:
That is the idea. ;)

-- Brian
[LG V30 Guides, News, & Discussion] rdeets:
So... it seems that the answer to this thread is to buy a Sprint v30, flash it to US998, and to sale our H932? That's what I'm strongly considering doing.
[LG V30 Guides, News, & Discussion] Addiso:
Seems the case unless runninnak3d can find a way to help us achieve root and twrp. Was thinking about the guy from China with the h930 parts on the h932? What if the h930 is our key for boot loader unlock. Or what if we try with a locked boot loader first and partition dl. I'm just hoping we cant find a way if not I'm on to the next.
[LG V30 Guides, News, & Discussion] rdeets:
Yeah, I got tired of having a rootless phone. Ordered an LS998 from eBay for $325. Should be here Thursday. As soon as I get that up and running, I'm listing my H932 and being done with it.
[LG V30 Guides, News, & Discussion] heero01:
So is this phone dead now and should we just try to get another model.
[LG V30 Guides, News, & Discussion] bacon612:
I did the same. Should be here by the weekend. At $325 and root I finally see value in the v30. Will also be using it on TMo. Do we have word yet if flashing T-Mobile radios will grant us band 77? I'm curious.
[LG V30 Guides, News, & Discussion] rdeets:
Unfortunately, not possible at the moment. All of the H932's partitions, including modem, are CPU signed. So... Nothing can be flashed to OR from the H932.

However, there is a way to enable bands via root. US998 has all T-Mobile bands enabled by default - except for 71. The root method shows that band 71 is enabled, but no one has been able to actually verify that band 71 is enabled AND working.

But, all in all, I'll take root + Treble + Lineage over band 71 if the choice had to be made.
[LG V30 Guides, News, & Discussion] igotroot:
If I would have only known we were going to have this much of a problem to get root I would have just got a Samsung or One plus????
[LG V30 Guides, News, & Discussion] Josh McGrath:
Do you have a link for the thread for this info? I went through the EFS and the us998 and h932 have a different file tree.
[LG V30 Guides, News, & Discussion] rdeets:
Mostly from here

https://xdaforums.com/lg-v30/help/wtf-lg-v30-t3790500/page35
[LG V30 Guides, News, & Discussion] Josh McGrath:
Thanks for the link. Time to play catch-up:)
[LG V30 Guides, News, & Discussion] bacon612:
Agreed

---------- Post added at 06:11 AM ---------- Previous post was at 06:10 AM ----------

I ordered the OP6 too. Total cost for a v30+ and OP6 still under what original V30 price was. I'll fiddle with them both and maybe return one. I'd like to get back into flashing roms to my hearts content though.
[LG V30 Guides, News, & Discussion] Arcide:
That's kind of a dumb conclusion, since you're using carrier locked/impaired phone. Why didn't you get a global unlocked version if you care about root?
[LG V30 Guides, News, & Discussion] ChazzMatt:
I think people buy carrier locked down phones and just expect devs to work magic...

We just got lucky recently with the WTF Oreo bootloader unlock exploit.

But T-Mobile H932 has completely different RSA encryption than the other North America V30 variants or even European/Mideast/Asia/Pacific V30 variants.

Even the new V30S can be bootloader unlocked and rooted.

It's very ironic the T-Mobile variant is the only V30/V30+ in the entire world that now can't be bootloader unlocked and rooted, since it was the only one that had "OEM bootloader unlock" option. It really looked like it would be the only success story, except for the "open market" variants.

But LG even broke their "promise" (tradition) and never let the open market LG US998 V30+ have bootloader unlock. (I bought both open market LG US998 V30 and V30+.) Now, we have it ANYWAY.

Sent via open market LG US998 V30/V30+
[LG V30 Guides, News, & Discussion] mattgyver:
You mean that's not how it works?! :laugh::D

I've got my 932 listed. Once it sells, I'll grab a 998..
[LG V30 Guides, News, & Discussion] Arcide:
You don't even have to get the unlocked variant, considering the current situation. I don't know all the details, but you could probably just get the cheapest carrier variant (excluding tmo) and unlock it without any problems.
[LG V30 Guides, News, & Discussion] ChazzMatt:
I think he was probably talking about the Sprint LS998 V30+. It's dirt cheap right now. Mint, $325. Easy to convert to US998.

Sent via open market LG US998 V30/V30+
[LG V30 Guides, News, & Discussion] mattgyver:
No, carrier unlocked. Unless all the V30 models have the same chip to get TMobile bands, aside from band 71..
[LG V30 Guides, News, & Discussion] ChazzMatt:
I think they meant you don't have to get US998 -- any North America V30/V30+ variant (except T-Mobile) can convert to carrier unlocked US998.

Your can get mint LS998 V30+ for $325.

In 10 minutes it's a carrier unlocked US998 V30+. ;)

10 more minutes it bootloader unlocked and rooted.

Sent via open market LG US998 V30/V30+
[LG V30 Guides, News, & Discussion] brossovitch:
Well. I'm waiting for my OnePlus 6.

OP6 has treble, Bootloader Unlock, will definitely have dev support, and supports all TMO bands (including B71!)

And for $615 I got 128gb variant, a nice case, tempered glass screen protector, OTG cable, and pretty nice OnePlus headphones. The headphones are actually pretty decent apparently and they are 24 ohm impedance, which is good. And the sound quality of the OP6 is looking to be very good as well.

And most importantly, the headphone jack is on the bottom where it belongs! Now I can stop ruining headphones AND stop dropping my device every time I use headphones! Yay! Its a super WIN.

No wireless charging, but I've only used it one time ever for 10min so no loss to me. The notch doesn't bother me anymore... And I can overlook the lack of SDcard support.

1080p screen, no matter. It isn't an issue on anything less than 60 inches anyway..

RIP V30 & G6..

Y3s I know that G6 can be rooted but not easily so it's not worth it to me.

I own my G6 & V30 and will continue to use them. But I'll probably never root them.

I will never again buy a carrier branded device (hopefully).
[LG V30 Guides, News, & Discussion] igotroot:
Back then, I got 2 v30+ phones for $450. So THAT was a no brainer. Yes you read that correctly. 2 for $450.

As for the response by [MENTION=3250376]ChazzMatt[/MENTION] he's on point.
[LG V30 Guides, News, & Discussion] Arcide:
Well yes, that's a great deal, but my point is that you can't always have the best of both worlds, and generally carrier locked phones are often inferior to unlocked ones.
[LG V30 Guides, News, & Discussion] runningnak3d:
The H932 can be rooted, but I will not release the procedure until the V20 gets Oreo. Sorry, but IMHO, LG has delayed the release of Oreo so they can patch the holes that have already been revealed .. so I won't reveal anymore for now.

If you upgrade to Oreo when it is released, you probably won't get root.

-- Brian
[LG V30 Guides, News, & Discussion] ChazzMatt:
[MENTION=3167089]runningnak3d[/MENTION], you mean do not upgrade to the V2 of the the T-mobile Oreo. Right?

What about the people already on T-mobile Oreo (version 1) from the first rollout before they stopped? THAT is not patched by LG yet. The

KDZ is available still now on the Development section.

That should be safe, as that was released before [MENTION=6158380]TxanMoe[/MENTION] discovered the easy Oreo bootloader unlock exploit.

(completely separate post below.)

____________________________

Just

converted my 2nd Sprint LS998 V30+ to carrier unlocked US998 V30+

. MINT on ebay for $325.

About to

bootloader unlock, TWRP and root it.

http://www.lg.com/us/cell-phones/lg-US998-Silver-lg-v30

US998

CDMA: 800 MHz CDMA

2G GSM: 850/900/1800/1900 MHz

3G UMTS (HSPA):850/900/1900/2100 MHz

4G LTE Bands: 1/2/3/4/5/7/12(17)/13/20/25/66
[LG V30 Guides, News, & Discussion] brossovitch:
Wow. That's quite a development predicament.

Well my V30 is on the Oreo release from a few weeks ago. But the one that I own is still unused and on the h93210c firmware it was launched with.. I've only had it turned on for a maximum of 45min since I've had it. Charged it overnight to 100% one time while powered off.

If a root from our savior comes I'd be ecstatic! And obviously toss donation bucks. Having this device rooted on Oreo would make it worthy to use for a few more years at least.

---------- Post added at 07:51 PM ---------- Previous post was at 07:49 PM ----------

Oh BTW guys.

Locking your Bootloader and then upgrading to Oreo actually seems to erase the unlock flags in the bootloader.

In case anyone needs to warranty their device...
[LG V30 Guides, News, & Discussion] runningnak3d:
This exploit has nothing to do with the WTF exploit, and I have no idea if it works on Oreo or not -- the phone I was sent was on Nougat, and I kept it on Nougat.

-- Brian
[LG V30 Guides, News, & Discussion] TheDannemand:
[MENTION=3250376]ChazzMatt[/MENTION]: I saw about the success with your 2nd LS998 in the WTF thread. That's awesome. Between this and Frankenphone, congratulations and kudos to you and [MENTION=6158380]TxanMoe[/MENTION] on the huge discoveries.

But I have to tell you, posting it on here as well is rubbing it in a bit for H932 owners [emoji17]

[MENTION=3167089]runningnak3d[/MENTION]: That's the best news I've seen for H932 owners in a long time. Thank you for giving us hope! And I think you are spot on about LG sitting on the V20 Oreo update in order to see what you come up with. Like others, I've been feeling the same is what has held up the H932 update, with two cancelled update cycles from T-Mobile since you began posting LAF results.
[LG V30 Guides, News, & Discussion] ChazzMatt:
Right, for the question to you I wasn't talking about the WTF method. It was specifically V1 T-Mobile Oreo is safe or not? Because T-Mobile paused the rollout to "improve" it, and V2 may be patched against your exploit but they didn't know about it in time for V1.

That's my question. A lot of people have already upgraded -- either by the first wave of OTA or by flashing the T-Mobile Oreo KDZ (V1) posted here in this forum.

The second part of my post was a completely separate post.
[LG V30 Guides, News, & Discussion] TheDannemand:
I agree, that's a very pertinent question, though I don't know if it can be answered without actually installing the H932 V1 update. For my part, I decided to sit on my hands (with Nougat) precisely for the reason Brian described.

---------- Post added at 03:47 PM ---------- Previous post was at 03:32 PM ----------

Whoa, that's another great piece of news for us. Kind of ties in with Chazz question about whether H932 Oreo V1 is still LAFsploitable.

Here's what I mean: Even if I could root my H932 today, I am inclined to sit tight a bit longer because my 2-year warranty is too valuable to to give up. This phone has to last me 3+ years, that's just the reality here. I can live with stock, my main interest is custom ROMs after LG stops updating.

BUT, if H932 Oreo V1 is still rootable, AND if installing it clears the Tamper flag, that means I could allow myself to root (if/when possible). If I need warranty, I can flash Oreo V1 (which I presume is ARB1) without blowing my eFuse. Correct?

(BTW I remain mystified why the Frankenphone/WTF guys can roll back from Oreo to Nougat without blowing theirs.)

Edit: To clarify my question: If a year from now I am on whatever ROM (stock or custom) that is ARB1, and I need warranty, I should be able to unlock bootloader and flash back H932 Oreo V1 (to clear my Unlock/Tamper flag) without blowing my eFuse. And my phone would still be rootable IF Oreo V1 is LAFsploitable. Anybody see a flaw in this logic?
[LG V30 Guides, News, & Discussion] brossovitch:
Well, lets say you remain on 7.1.2... you'll have that Bootloader and all. Let's say you root and install a custom ROM. Then you need to warranty....

You'll need to manually flash the kdz of the ROM you started on with LG Up. Or restore your stock backup from TWRP.

HOWEVER... If you're rooted with lafsploit and TWRP replaced your LAF partition, I would say you're SOL unless you can manually restore/flash the stock LAF img for the firmware you're phone is on.

Okay, so IF you restore the full firmware back to where you started (lets say h93210d) then you would need to lock the bootloader and then use LG Bridge to update to Oreo.

At that point, I fully believe that it erases thentamper flag as it doesn't show up anymore.on the bootloader. Mine had 5 flags and nown zero. So yea....
[LG V30 Guides, News, & Discussion] mattgyver:
First off, ❤️ :heart:.

Second, considering the V20 JUST got a 7.0 update with March security patches, I doubt they'll be getting Oreo soon. Hopefully they do, though, since if THAT'S the case, I won't sell my H932. I'll pull it from the sites it's on.
[LG V30 Guides, News, & Discussion] TheDannemand:
Thank you!

We'll if one was to stay on stock Nougat or Nougat based custom ROMs, the wonderful news your gave us about the Oreo update clearing the Tamper flag should already take care of it.

I was more thinking that this might allow us to proceed with Oreo based ROMs, after having gotten root, without the fear of being denied warranty. Such ROMs would all be ARB1 (I assume) and would thus prevent rollback to Nougat. But they would not prevent flashing Oreo V1 (which I assume is also ARB1) in order to clear the Tamper flag. And if Oreo V1 turns out to be LAFsploitable (as [MENTION=3250376]ChazzMatt[/MENTION] speculated) we should still be able to root again after a completed warranty cycle -- unless LG puts a newer, un-exploitable ROM on the phone during their service.

Of course if the phone is hard bricked, that would make it impossible to flash anything, including Oreo V1, and the whole point is moot. I am thinking of other warranty claims such as screen defects, a failing DAC etc.
[LG V30 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

As usual, I will put my v30 up for testing, privately of course. I have a spare z2 force so a brick isn't a big deal for me anymore

I'm still on Nougat also
[LG V30 Guides, News, & Discussion] runningnak3d:
I will grab the V1 KDZ and see if the exploit still exists. Since they delayed the rollout, it was probably to patch it .. but I guess we will see.

As for volunteers, I really appreciate it, but again, I still have a V20, and I would REALLY like Oreo, so I will not release any more information until I have a V20 Oreo KDZ in my hands :)

-- Brian
[LG V30 Guides, News, & Discussion] Gamesoul Master:
I've kept my H932 on Nougat just in case. Although it doesn't sound like any testing is needed, I am willing if it comes down to it :)

Honestly, I just wish I could do more to show my appreciation for all the effort put forth. I must say, runningnak3d has put so much time and effort into this, and while I definitely know the love of helping others, I still wish I could do *something*.

And of course, time is not a concern. Whether it gets released today or "later this year", I'm just happy that the work was done and people will benefit. If waiting means more people can benefit, it's totally worth it.
[LG V30 Guides, News, & Discussion] runningnak3d:
Well, I just checked the V20 forums and some dude posted most of the procedure for booting from an SD card which is how root will be gained.

It is in incomplete, and HOW to root isn't included either.

I am now torn as to wether I go ahead an post the complete procedure.

*sigh* I am never going to get Oreo on my V20s lol.

-- Brian
[LG V30 Guides, News, & Discussion] TheDannemand:
[MENTION=3167089]runningnak3d[/MENTION]: Maybe appeal to the member who posted it to pull the information again, and why it's important. If done quickly, I suppose there's a chance.
[LG V30 Guides, News, & Discussion] devilsmarch:
It's possible that even if they pull it down the information has been archived or scraped by LG if they're watching these forums. Pulling the information down might not even be helpful at this point.
[LG V30 Guides, News, & Discussion] runningnak3d:
Yea, he doesn't appear to speak English.

Anyway since the pertinent part is out there, this is the basic outline of the procedure:

* Wipe your TZ partition. This will give you a 9008 brick in a "controlled manner"

* Flash the image that I am going to post to an SD card (has to be 64gigs or larger)

* Boot your phone into recovery -- you will be in TWRP

* Write your tz partition back

* Write TWRP to your recovery partition

* Power off / Pull SD card

* Boot your phone to recovery -- you will have TWRP

* Finish the usual root procedure (flash Magisk / etc)

Again, I know this works with Nougat, and I will make an Oreo SD image as well. There is really no reason why it shouldn't work with Oreo, but I haven't tested it.

I won't be able to get to this till tomorrow when I am back at work. That is where all my H932 stuff is.

-- Brian
[LG V30 Guides, News, & Discussion] TheDannemand:
Wow! So it's not even LAFsploit, but the good old SD card boot.

Thanks a lot for all your contributions to the LG user community. Once again!

Edit: BTW is this also a way for users with a 9008 brick to revive their phone?
[LG V30 Guides, News, & Discussion] runningnak3d:
It depends on HOW they got the 9008 brick. If they flashed firmware from another model -- no. You can't fix an RSA key mismatch this way. That is why we have to get a 9008 brick in a controlled manner by wiping tz.

If they got a 9008 brick by forgetting to flash an important partition, or by flashing a lower ARB, then yes.

EDIT: also, this still requires lafsploit to brick your phone in a controlled manner. It *could* be done with LG UP, by pulling the USB cable, but that would be extremely dangerous.

-- Brian
[LG V30 Guides, News, & Discussion] TheDannemand:
Got it, thank you. This actually helps explain several things for me!
[LG V30 Guides, News, & Discussion] Opsectx:
Awaits patiently for the file.
[LG V30 Guides, News, & Discussion] rdeets:
Is the bootloader still locked with this method, meaning no custom kernels/roms?
[LG V30 Guides, News, & Discussion] Opsectx:
Installs twrp
[LG V30 Guides, News, & Discussion] mattgyver:
Which V20 thread? I've looked through a few, but don't know which specific one to find more info. I know nothing of what "tz partition" means. Is that all within lafsploit threads?
[LG V30 Guides, News, & Discussion] Opsectx:
Q & A section "LG v20 9008 error"

---------- Post added at 08:34 PM ---------- Previous post was at 08:33 PM ----------

Tz partition is the "trust zone" partition.
[LG V30 Guides, News, & Discussion] TheDannemand:
[MENTION=3167089]runningnak3d[/MENTION] made clear he intends to release the full thing - just not today. I suggest everybody just wait for that and give the guy a holiday weekend break.

What he posted today is merely the outline steps, because someone in the V20 forum spilled the beans about SD card boot anyway, thus busting his plan to sit on this exploit until LG has released Oreo for V20.

I cannot imagine that it would (or could) remain unlocked as we'll be flashing custom recovery. The ability to unlock BL and relax some of the RSA key checking is one of the benefits we still have with H932 - even if we don't have any useful fastboot commands.