[Google Pixel 2 XL Guides, News, & Discussion] runningnak3d:
You can't write because the key that is in the Pixel XL 2 lafd is different. Every version of lafd that I have seen has all had the same RSA key that is used to decrypt the SIGN payload -- not the case for you guys.

That means that you can't flash any KDZ for a normal LG phone.

Writing doesn't work with lglaf because as of Nougat lafd, you MUST send a SIGN opcode / payload. The SIGN payload contains a list of the partitions with their SHA1 hashes. The problem is that the payload is signed with an RSA key, so you can't just go and make it up, or modify an existing payload. The public half of the key is embedded in lafd, the private half is locked up in some corporate d**k heads office.

Under normal flashing circumstances (this is extremely abbreviated -- only the essential opcodes are listed) it goes like this:

HELO

KILO CENT

KILO METR

OPEN /dev/block/sda

SIGN <sign payload>

WRTE

The OPEN opcode requires a full payload on UFS devices. That payload include the block device being opened and then a lot of flags that get set (read only / read/write, etc). I still haven't fully decrypted the OPEN payload, but I have enough sniffs that I just pass them as is.

The problem comes when you need to send the SIGN payload. Unless someone has found a way to find a hash collision in SHA1 that doesn't take decades of CPU/GPU time, there is just no way around it.

So, on the V20 and G6 I used MISC WRTE that is used for writing to the misc partition. There is no checks / verification on that opcode. However, writing to misc doesn't get you anything, you need to be able to copy the data to the correct offset on the block device. Sometime in mid 2017 LG pulled the COPY opcode from lafd. Now on the V20 that isn't a problem. The laf partition isn't checked for ARB, so you can flash an ancient laf partition. On the G6, it was pulled in the firmware that was released for the phone. Luckily the H918 V20 laf will boot on the G6 -- so viola, they have the COPY opcode that they need.

You guys are screwed a couple of ways:

1 - You have no way to flash anything that isn't already for your phone, so no way to get a laf image from another device up and running.

2 - If you could flash a laf that had the COPY opcode, it wouldn't boot due to the laf images that do have it being for much older processors (SD820 or older) and the kernel just isn't going to boot on the SD835.

So, let's talk about this IMEI thing that no one wants to talk about.

1 - It is against XDA rules to actually instruct someone on how to change it. It may be legal in the US, but it is most definitely illegal in other parts of the world. So, I will steer clear actually discussing how to do it.

2 - On every phone that I have ever had, in order to change the IMEI I had to already be rooted, so I think this is a scam (I have NOT seen the video, so this is just my guess)

3 - If Google does determine if you can enable OEM Unlock by checking IMEI, you don't have to change it on the phone -- you just make a proxy that spoofs it when the phone goes to talk to their servers.

Has anyone bothered to factory reset and then sniff the traffic when the phone is activated without a SIM in it?

-- Brian