yashsingh1/xdaforums huggingface dataset:
[LG V30 Guides, News, & Discussion] Josh McGrath:
I have already messed mine up doing some digging and changing things and needs a system reset so I'll be your guinea pig if you need.

Somehow I broke WiFi calling which I have to have where I live right now
[LG V30 Guides, News, & Discussion] R800x_user:
so my magisk manager doesn't want to work with me after i did a factory reset. i dont have the patch boot.img option by chance do you have magisk working properly? as in having the patch boot.img option.

edit: so i managed to patch the boot img but unable to pull it off my phone weird enough. anyways its a no go like runningnaked said thy rsa key doesn't match.

Edit: didn't work. Back to square 1.
[LG V30 Guides, News, & Discussion] wolfgart:
i think try to sign packages ( apk / zip ) could be the right way to follow ...

Just to understand where the Key to sign is ...
[LG V30 Guides, News, & Discussion] jameslapc2:
That's easy to get around. Just charge it to 79% then put it in recovery mode with the cord still in. Then leave it on the green screen for about fourty five minutes and bam you have a full device.
[LG V30 Guides, News, & Discussion] Moriatier:
Hopefully it will be on the list in February. By that time you would probably have returned your phone. Aha.
[LG V30 Guides, News, & Discussion] wills3gslide:
This is due to integrity checks on system apps and files, wish we had a way to push an injected boot.img or system.img, I have an magisk injected boot.img and could possibly due a system.img but problem is pushing it back to phone

Seriously thinking of downgrading phones for the time being due to not having fastboot commands, thinking maybe Moto z2 force or I hate to say but Iphone x for a while till root is figured out then jump back, love all all the features of the H932 but fastboot commands is a must

Believe its going to take a awesome hacker to share an exploit or finding another way to get twrp, boot.img or system.img pushed.

Tried several different ways with no luck
[LG V30 Guides, News, & Discussion] R800x_user:
LG has stepped up their security game and samsung just joined them in a sense with their new bootloaders.

https://www.xda-developers.com/samsung-galaxy-s8-note8-bootloader-odin/

After this snapdragon 835 with its tight security measures along with android security. maybe root for 2018 phones might not happen unless they have working fastboot. Til then I'll be doing more research on the snapdragon 835 and android permissions.
[LG V30 Guides, News, & Discussion] brossovitch:
Heres a copy of the patched boot.img

From H93210c

Patched with Magisk.

https://drive.google.com/file/d/144kIuAVHGVKj9mSQW1tTp0rEzQsCrrXs/view?usp=drivesdk
[LG V30 Guides, News, & Discussion] Josh McGrath:
That doesn't say anything about LG. I hate Samsung so I will never own another one again. They'll make a work around with Samsung. They have so many talented people working on them while with LG, we have very few.
[LG V30 Guides, News, & Discussion] R800x_user:
Just pointing that they are hardening up their security that's all. We had a very talented dev but the community kept hating on him. And by that i mean mostly complain about what doesnt work vs the hard work put in. The v10 was a nightmare to work on too. But the on the brightside we have devs like runningnaked which confirmed that most of the stuff we are currently trying wont work. I'm trying to find one of his posts in this thread when he comapred the rsa keys from the us998 and h932. maybe using the rsa key he found to sign a update.zip. . just a thought :silly:
[LG V30 Guides, News, & Discussion] wolfgart:
i really think that the right way to follow should be try to sign some .apk file to /system that let us to root device .

Some sort of tethered root
[LG V30 Guides, News, & Discussion] runningnak3d:
[MENTION=5497494]R800x_user[/MENTION] You have to have the private key, which we don't have. I did find out why the public key was included in update.zip.

LGFOTA.apk compares META-INF/android/otacert to /etc/security/otacerts.zip. If it isn't found, it won't even reboot to recovery. Kinda pointless if you ask me since recovery has the key in /res/keys, and that is the one that is used to verify the zip.

Back to digging for holes in lafd...

-- Brian
[LG V30 Guides, News, & Discussion] R800x_user:
Yeah I was just looking at the fota folder and spotted the public key. i was also examining the update engine xml and it mentions user root and group root in the code.

What if we copy the certificate thats located in that otacerts.zip to a update zip with a patched bootimg

But even with a patched boot.img probably wont work huh.

Well I would like to learn to interact with lafd you got any pointers?

Wow even root has a certification file!
[LG V30 Guides, News, & Discussion] runningnak3d:
Here is a good read on how signing apks works (which are just zip files). update.zip is signed in the exact same way. The cert that is included in the zip, and the one that is on the phone are the public keys from the cert -- they already match :)

When you generate an X509 cert, you get a public key and a private key. When you sign an update.zip, you use the private key that matches the public key that you include on the phone. Without the private key, you can never recreate the signature (until RSA is broken).

As for talking to laf, if you want to join us on IRC, you are more than welcome: irc.freenode.net / #lafd

-- Brian
[LG V30 Guides, News, & Discussion] Josh McGrath:
Does anyone have a serial port still? Or a serial to USB converter? A lot of companies are using uart secruity again so LG might have done the same but I do not have a serial com port to use.
[LG V30 Guides, News, & Discussion] burmjeff:
Tmo_simlock and facebook installer I think are the only system apks on phone that can be exploited with janus. Playing around with it I was able to install a modified tmo_simlock apk with my own dex file. I don't think it does us any good though due to the apk's lack of permissions.
[LG V30 Guides, News, & Discussion] car2carl:
Do you mean to get diagnostic serial port? I can have my H932BK backup under QCN file
[LG V30 Guides, News, & Discussion] R800x_user:
Just as a fyi there is a 10D ota coming in for us h932 users.

https://xdaforums.com/lg-v30/how-to/tmo-releases-10d-t3743296
[LG V30 Guides, News, & Discussion] R800x_user:
.deleted
[LG V30 Guides, News, & Discussion] lightninbug:
Is this good/bad? Should we upgrade?
[LG V30 Guides, News, & Discussion] R800x_user:
Thats up to you. I will stay on our current version. might capture the ota once it starts popping up on my phone and post it for someone to tinker with.
[LG V30 Guides, News, & Discussion] deadlyquirk:
So android is technically open source. They tell you what bugs they are patching and will usually link to outside pages with more information. For example In the January security patch they fix CVE-2017-13176

This is something the v30 is vulnerable to if you are running b or c firmware. It's allows an app to get root by doing something I don't quite understand.

Piggybacking off of exploits is how people get root traditionally. https://android.googlesource.com/platform/frameworks/base/+/4afa0352d6c1046f9e9b67fbf0011bcd751fcbb5
[LG V30 Guides, News, & Discussion] S-C:
Maybe they can help now?

https://xdaforums.com/lg-v30/how-to...k-achieved-t3743359/post75403645#post75403645
[LG V30 Guides, News, & Discussion] lightninbug:
Will this work for us?!?
[LG V30 Guides, News, & Discussion] jcsww:
Still no Oreo update. )=
[LG V30 Guides, News, & Discussion] wills3gslide:
All you can do is try it and please report back. May have to use the model numer on the box and not just H932

Will try it tonight as well
[LG V30 Guides, News, & Discussion] Revolts:
Doubt it since I don't think you can get the device-id because the fastboot commands are disabled.

I could be wrong, though.
[LG V30 Guides, News, & Discussion] wolfgart:
only this can help us.

https://android.googlesource.com/platform/frameworks/base/+/4afa0352d6c1046f9e9b67fbf0011bcd751fcbb5

If someone is able to build any .apk including this exploit, we can gain tethered root and then gain all around there...
[LG V30 Guides, News, & Discussion] Septfox:
No. Even assuming that the fastboot command to grab the device ID was present, them providing an unlock is based on whether or not the model is whitelisted.

Carriers almost invariably request that manufacturer not provide unlock services to their models; that's right, if a carrier tells you it's the manufacturer's fault that's there's no unlock, they're spouting BS. Verizon is probably the most likely to blatantly lie like this, I don't know other carriers well enough to condemn them out of hand

The above in mind, it's likely that your application would be automatically rejected, and trying to contact LG directly will just get you a generic "we're sorry, this model doesn't support bootloader unlocking" response. Claiming no device support is better than trying to justify their going along with the carrier keeping partial ownership over the $800 phone you just supposedly bought from them.

The only way I can see it working - again assuming you could pull the device ID - is if LG accidentally/lazily added all variants to the whitelist and simply left it to fix later assuming that nobody would try it; and as we've seen with the US998, it's not an entirely wrong assumption to make. I've seen people try and fail to unlock the dual-SIM variant, but who knows.

Someone should grab a Verizon handset and see what happens :v
[LG V30 Guides, News, & Discussion] R800x_user:
And this https://github.com/odensc/janus

I find it odd that we are given instructions on how to build a kernel for 932 but to get it into the device baffles me.
[LG V30 Guides, News, & Discussion] deadlyquirk:
I'll fire up my laptop and give that a shot. Who knows what will happen.
[LG V30 Guides, News, & Discussion] Josh McGrath:
What system app are you using it with? I'll try it too but I hate python script

It doesn't look like it will help us here, according to this;

" APKs signed with signature scheme v2 are protected against the vulnerability. This requires that the APKs are running on devices supporting the latest signature scheme (Android 7.0 and newer). Scheme v2 is protected because unlike scheme v1, it considers all bytes in the APK file."
[LG V30 Guides, News, & Discussion] :
I just received a system update notification! This night be the security patch for January. I'll edit this post in a few.

Edit: Confirmed. Brings the V30 to January 2018 Security Patch. Not Oreo though.
[LG V30 Guides, News, & Discussion] :
H93210d
[LG V30 Guides, News, & Discussion] Josh McGrath:
Yup, got it tonight too. I didn't install it, but it looks like it's just a general Android security fix, nothing specific changing with the MDF or kernel versions.
[LG V30 Guides, News, & Discussion] 20degrees:
So basically, 4 months with no updates and then they release an update finally with no fixes in it. Wow....... No wonder people no longer want to buy LG phones.
[LG V30 Guides, News, & Discussion] wills3gslide:
Stopped in store today to browse around and got to talking with the sales rep about the V30, of course hes blaming LG for the changes with the bootloader being locked down, he also stated the sales of this device are not near as expected, told him its a no brainer why sales are down
[LG V30 Guides, News, & Discussion] Tinkerer_:
Good to hear sales are slower than expected by sellers, that will help push the prices lower faster, while the early "bugs" are being addressed.

Shouldn't this thread be re-titled, since root/TWRP have purportedly been achieved?

from

https://xdaforums.com/lg-v30/how-to/us998-bootloader-unlock-achieved-t3743359/page5
[LG V30 Guides, News, & Discussion] ChazzMatt:
No need to to re-title this thread. This thread is supposed to be about the T-Mobile variant.

Read the very first sentence of the op. It was a fork from the other "all variants" Bootloader Unlock and Root thread. The T-Mobile variant still doesn't have root.

Right now, it's only the open market variants that have root, because of unlocked bootloader with full flash commands available. And with the US998, right now is only the V30 because LG has not added V30+ IMEI to the database (yet).

I wish the op [MENTION=334821]mr turtle droid [/mention] would please edit the thread title to include the T-Mobile model number -- H932. That would eliminate all confusion...

Op:

Sent from my official open market LG US998 V30+
[LG V30 Guides, News, & Discussion] Revolts:
Since on tmobile devices (maybe others) you can unlock the bootloader using "fastboot flashing unlock_critical" (?) we just can't do anything with it since we can't flash twrp. Can someone confirm that this is the case?
[LG V30 Guides, News, & Discussion] ChazzMatt:
Yes, that's what the whole thread is about. ;) Go read post #1 and then post #2.
[LG V30 Guides, News, & Discussion] runningnak3d:
If you guys want root (the H932 variant) then one of four things has to happen:

1 - You find an exploit in a system app that has high enough privileges to write to block devices (/dev/block/bootdevice/by-name/recovery)

2 - You find a kernel exploit that allows you to write to block devices

3- You help out with the attempts to exploit download mode: https://xdaforums.com/v20/how-to/laf-download-mode-how-root-t3676011

4 - Exploit recovery mode with an OTA exploit (this one I have pretty much written off - but you never know)

I am REAL close to being able to exploit download mode, but I need help.

-- Brian
[LG V30 Guides, News, & Discussion] wolfgart:
i can really help you if you need some test but for the " 1 - " point :

You find an exploit in a system app that has high enough privileges to write to block devices (/dev/block/bootdevice/by-name/recovery)

in my opinion we should to focus on exploit a system app to gain # shell . After we have # we can easily build all other work

pm me on Telegram app if you want . I have H930 european
[LG V30 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION] I am deliberately staying on the v30 10b doing some things, so if you need to check if they closed any holes compared to the newest update, let me know.

But from what I can tell, the update is just general security fixes like Spectre etc
[LG V30 Guides, News, & Discussion] wolfgart:
you make the right step. I have done the same with my Semi-Bricked H930. I stay on initial 10c ( November 17 patch )
[LG V30 Guides, News, & Discussion] Josh McGrath:
Yup, and come to think about it, I haven't seen any info about it all. I'll go through it tonight again cause I didn't even to think to check if it's antirollback 1
[LG V30 Guides, News, & Discussion] KillerofJoy:
Sorry guys gave it a shot with 2 or 3 different programs including some older ones I had on my Pc.. However I did find xpirt on here(xda) covering a complete method of firmware extraction on stock devices.. Undoubtedly what he used to extract both the updates of firmware he posted on the model V30 he has.. Yet again having a hard time trying to find time to sit & pull it.. I will try & contact him soon maybe a quick walk through to help with using his methods.. I had helped in porting fulmics to G5 with him testing & file legwork putting the port together T-mobile version H830.. Sorry just busy with work..
[LG V30 Guides, News, & Discussion] wills3gslide:
Please share the full update. thanks in advance[/QUOTE]

My apologies team, have been trying everything to upload the full update the last 2 days with very slow upload speeds but did manage to get it on Mega at:

H93210c update

https://mega.nz/#!464GCBjS!OBXuza8gx_c_-G-kN22-EolLh3hI_HGSLYg73Kzlz7w

Please remember this is T-MOBILE VARIANT ONLY!!!!!!

Enjoy!!!!

PS:

Someone might re-upload to another server who has faster upload speed so we have multiple, please post link in this form

OP: you can add this to your cover thread if you like

Thank you
[LG V30 Guides, News, & Discussion] VeixES:
Thank you for system update. Went through the system/modem partition but unfortunately could not find info that could confirm full LTE band and Carrier Aggregation support.
[LG V30 Guides, News, & Discussion] wills3gslide:
Thanks for the confirmation, soon as extra time comes my way, will take a look at it, may be able to inject root/twrp to the update and repack, need a twrp that will work on the H932
[LG V30 Guides, News, & Discussion] AliLaPointe:
Would getting files from the US Cellular (US 998) help root efforts? If so, point me towards the software I would need to extract system files. Tangentially related, while browsing in the QuickShortcutMaker app, I came across some interesting Hidden Menu settings on this phone. Specifically, there's LTE band selection stuff for T-MOBILE despite it being a US Cellular phone. I wonder if there's a way to flash this to TMO, this unlocking Band 71 functionality...
[LG V30 Guides, News, & Discussion] ChazzMatt:
Interesting.

Especially if the U.S. Cellular V30 is basically the same model as the the "open market" (bootloader unlock eligible) US998 LG will start selling in early December. Basically -- except U.S. Cellular IMEI won't be eligible for bootloader unlock. But the US998 will still have those menus...

By the way, the U.S. Cellular V30 is already SIM card unlocked, network unlocked. It's the "unofficial" carrier unlocked LG V30. It will already work on T-mobile -- just stick a T-mobile SIM card in -- but it's not supposed to have LTE band 71. IF you could enable it, then that would be interesting.

Get a friend with a T-mobile SIM card, then open that hidden menu while on T-mobile network.
[LG V30 Guides, News, & Discussion] RoxAbout:
Alt Site

My apologies team, have been trying everything to upload the full update the last 2 days with very slow upload speeds but did manage to get it on Mega at:

H93210c update

https://mega.nz/#!464GCBjS!OBXuza8gx_c_-G-kN22-EolLh3hI_HGSLYg73Kzlz7w

Please remember this is T-MOBILE VARIANT ONLY!!!!!!

Enjoy!!!!

PS:

Someone might re-upload to another server who has faster upload speed so we have multiple, please post link in this form

OP: you can add this to your cover thread if you like

Thank you[/QUOTE]

Thank you for the file!

However It would be nice not to install mega desktop in order to d/l the file. I for one don’t care for this shady company.

Can an alternate site be used?

Thank you for your efforts!

Rox
[LG V30 Guides, News, & Discussion] AliLaPointe:
I'm actually on T-mobile, but when I try to click it, I get an error. Something about not having the right permissions. As far as I know, I can only change permissions via root. Let me know if you have any ideas.
[LG V30 Guides, News, & Discussion] wills3gslide:
Thank you for the file!

However It would be nice not to install mega desktop in order to d/l the file. I for one don’t care for this shady company.

Can an alternate site be used?

Thank you for your efforts!

Rox[/QUOTE]

Understood and apologies for having to upload on Mega, also agree with you on Mega.

As stated in my previous post, if someone wants to re-upload to another server it would be great, I had to find a server that would work with my slow ass upload bandwidth.
[LG V30 Guides, News, & Discussion] NotATreoFan:
I'm away on business currently, but I will download and upload to AFH tonight. Make use of that nice FiOS Gigabit I just got.
[LG V30 Guides, News, & Discussion] TecknoFreak:
Is it possible to upload the system dump? I really really need this for some serious project in porting v30 to other LGs like G4 etc which is already ported but I need some files to port from Tmobile in order to have wificall and volte working. I rather port using this as base and not the Korean variant dump that I have
[LG V30 Guides, News, & Discussion] wills3gslide:
Waz up Teckno,

followed you on many forums in my day, soon as I get some free time away from the wife and kids I would be more than happy to help unless someone beats me to it. Have a lot of projects ahead of me with little time to achieve my goals
[LG V30 Guides, News, & Discussion] NotATreoFan:
For those wanting a faster host: https://www.androidfilehost.com/?fid=745849072291689606
[LG V30 Guides, News, & Discussion] will54880:
So what I am getting from this thread is my at&t lg v30 cannot be unlocked and rooted.
[LG V30 Guides, News, & Discussion] ChazzMatt:
Right. All carrier branded versions are ADB crippled (as far as we know). Whereas the two "open market" versions -- officially carrier unlocked versions -- will have LG-sanctioned bootloader unlock and full ADB flash commands.

That's been known since early September, because I posted that in great detail back then several times in this forum.
[LG V30 Guides, News, & Discussion] ChazzMatt:
The patched LGUP could be of use, like it was with the LG V20 after Dirty Santa was patched.

[GUIDE][UNBRICK] Patch LGUP to unlock features & unbrick V20 (Variant mismatch fix)

https://xdaforums.com/v20/how-to/guide-patch-lgup-to-unlock-features-t3652222

Using a specially coded LGUP.exe, it allows you to flash a version of LG firmware -- like for another model variant -- you shouldn't be able to flash.

Also worked on an LG G5:

This trick became VERY useful when Dirty Santa bootloader exploit was patched. With the LG V20 "international" variant,

you flashed the H9990 another carrier's variant OLDER firmware version

--which still allowed the exploit to run. Yes, you temporarily lost all carrier signal functionally, but you could still use Wi-Fi and USB sideload.

You basically temporarily converted the "international" V20 H990 to another variant model (like Freedom POP H915). You then ran the exploit to unlock the bootloader, install TWRP. (Running the exploit is NOT the point here, keep reading. I know Dirty Santa won't work. It's the LGUP firmware flashing METHOD that's the point.)

THEN, after installing TWRP, you flashed BACK to your regular ROM -- except for recovery where you still had TWRP.

Carrier signal functionally restored, AND you now had bootloader unlocked and TWRP installed. BOOM.

OK, HOW DOES THIS APPLY TO THE T-MOBILE LG V30?

Well, T-mobile is easily unlocked, so you don't need an exploit to unlock the bootloader. But seems like you could use the patched LGUP to flash the firmware for the open market version US998, which has the functionality you need? Then, flash T-Mobile firmware back on, once you get TWRP installed.

I'm not a dev, but that seems like the path to take or some similar route.

The question is, would flashing US998 KDZ over bootloader unlocked T-Mobile LG V30 then give you ADB flash commands?
[LG V30 Guides, News, & Discussion] iantlopp:
Having followed most of what you said on this post, as well as having read the bounty post about the LG G6, am I right in assuming that means the method for the dirty santa exploit doesn't work for the LG G6, then? If so, what's different about the V30 that *may* allow access, or have they locked the V30 down as much as the G6 is?