yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] dharakv:
And this is not exclusive to the modem partition right?

BTW, whats the difference of a TWRP backup vs a SALT one? Which one would more accurately represent the actual partitions?

I read about the stagefright vulnerability. Apparently the MMS photo/video has to download to your phone before executing. I have noticed on LG G4, it only downloads if you press the "Download" button.
[Android Software/Hacking General [Developers Only]] sdembiske:
No, it is not exclusive but it will not backup all your user data (it excludes storage - e..g., photos, videos saved on SD card etc,), whereas Salt can backup all of your user data. You will have to have Titanium backup and restore as well as a backup of your SD card to your PC/laptop.

Salt is definitely a more accurate representation of all your individual partitions, IMO. If and when you decide to UsU unlock your phone, you can flash any of the partitions in fastboot mode, for example, provided you know what your doing.

Some stagefright code can actually circumvent that and it still doesn't take care of the other security issues you have currently or will have down the road ...
[Android Software/Hacking General [Developers Only]] dharakv:
Tried another SALT backup. It failed but if the userdata partition was corrupted, I would expect that because the LG Flash Tool only touched the System partition. I'll have to do a full KDZ flash and try the SALT backup to confirm. Regarding partitions, is there any way I can figure out what each and every one is used for? I'm guessing it is vendor dependant so I wont be able to find one specific to the LG G4.

All I know is that /userdata stores the user files like pictures videos documents,office suite files, etc, and modem I think stores MAC address, IMEI, ERI, System stores things you shouldnt mess with(need to learn more about this). And I have absolutely no clue about Laf and all the others.
[Android Software/Hacking General [Developers Only]] sdembiske:
Check out this thread: [GUIDE] Making Dump Files Out of Android Device Partitions - the rest you'll have to search out on your own. I'm out now.
[Android Software/Hacking General [Developers Only]] dharakv:
[MENTION=6302635]sdembiske[/MENTION] You have provided me with more than enough information and support. I can't thank you enough. I will try to handle the rest on my own.

Have a wonderful day
[Android Software/Hacking General [Developers Only]] steadfasterX:
There are much more vulnerabilities then just stagefright. Just read the Google security bulletins.

The diff between TWRP and SALT backups is:

SALT backups every single partition

TWRP backups just those generally needed (e.g for flashing custom ROMs and going back)

When it comes to unlock or even more to unbrick a TWRP backup is not enough. That's why I recommend to do at least once a BASIC SALT backup which contains everything except system (can be restored from a kdz) and userdata (which is needed only when you wanna backup your internal storage)

I know a lot about the partitions so if you wanna know something special ask ans I may can answer that.
[Android Software/Hacking General [Developers Only]] dharakv:
Ok so the later H812 5.1 KDZ's don't have stagefright patching?

Let's say the SALT backup failed because some of the partitions are corrupt. This could very well be possible as the last full KDZ flash I've done is around a year ago. I guess the solution would be to re-flash and overwrite all partitions, but can that be done through a KDZ flash?

Sorry for all the trouble, the reason I want to know about functionality of partitions is that I want to know exactly what gets changed when I do modifications and all... First I believe I must know the structure of the OS and everything instead of blindly messing around.
[Android Software/Hacking General [Developers Only]] steadfasterX:
I dont have googled what the patchlevel of the latest 5.1 is (while i strongly believe it must be incredible outdated). I just say forget about stagefright as thats just one major security hole. There are others like Broadpwn for WiFi or BlueBorne for bluetooth and many others (search here and watch out for all critical and high ones)

Compare that with the security patch level of the 5.1 KDZs and then you know where you stand: an easy target - stagefright patched or not.

just for completeness: MOST of the security issues requires the user to do some action (like installing an apk etc) .... but not all.

Regarding the partitions:

~90% of the partitions can be recovered from a KDZ. those are e.g, the whole bootloader stack, system, boot, factory and others

those which can't be recovered are e.g.: misc (wifi,imei), modemst1, modemst2 (both: network unlock,imei) are very important ones but also persist, persistent and devinfo (those are for the device unlock state) and others like cust/carrier (LTE,APNs,..)

So there is usually always a way to recover a device even without a backup. but its hard and e.g. when it comes to network unlock impossible without the unlock key.

Example if you loose misc, modemst1 and modemst2 you will loose your imei. imei can be recovered by writing with an hex editor to misc or using windows software to re-write it. if you would have a backup its just a flash in fastboot/twrp needed instead.

.
[Android Software/Hacking General [Developers Only]] dharakv:
Please correct me if I'm wrong, but the bootloader is stored in the Boot partition, meaning it is the first partition to run once you power the phone on right? I'm guessing it also contains the GPT partition table and controls the Download Mode. So if you screw up this one, you're done...

TWRP (and TWRP-in-FISH) would replace the recovery partition, but this can be booted even if all other partitions are damaged(except boot)?
[Android Software/Hacking General [Developers Only]] steadfasterX:
The bootloader stack is not just one partition..

(flashable) bootloader stack = sbl1, pmic, rpm, tz, sdi, hyp, aboot

A regular android boot:

PBL (read only flash) --> sbl1 (interacting with: pmic, rpm, tz, sdi, hyp) --> aboot (fastboot) --> boot (kernel + ramdisk) --> system (ROM)

The gpt is on the very first start on the mmc it's not a partition itself. It describes the partition structure (name, size, start sector, end sector)

Download mode is stored in the laf partition and for locked devices it's required to match the version of the bootloader stack as otherwise it will fail to boot (same for recovery partition btw)

And last but not least we have a qualcom device. That means you can completely erase the gpt and all partitions and still be able to recover (see my signature).

TWRP in FIsH does not replace the recovery partition as this would fail to load on locked devices. Maybe read the story about FIsH..
[Android Software/Hacking General [Developers Only]] dharakv:
This is perfect! Just what I've been looking for. :good: So even in a hard brick, there's still enough current going through the motherboard to flash data to it. However, if the PBL partition is corrupted or destroyed, can we say the phone is completely dead and unrecoverable(I'm guessing pbl performs the same functionality as UEFI/BIOS, and required to send power to all components on the motherboard).

I'd make an educated guess that unbricking a hardbricked device involves flashing pbl, sbl1, pmic, rpm, tz, sdi, hyp, aboot(bootloader) and laf partitions onto the phone, then once laf is there, you can use LG FLASH TOOL to flash a full KDZ.

I see the android boot structure very simillar to the EFI boot sequence as opposed to BIOS.

Let's suppose one were to delete all partitions on their phone, reflash the pbl partition, and flash the bootloader and OS from a very different phone. Assuming you were able to find matching hardware driver software for the current phone and install them in the foreign OS, it should theoretically run well, right?

You stated earlier that the bootstack is overwrote when performing a full KDZ flash. Does this mean that after the bootloader is unlocked, a KDZ flash will re-lock the bootloader?

Also, would it theoretically be possible to unlock an H812 bootloader by taking a full SALT backup of a BL unlocked H811 or H815, delete all H812 partitions, and flash all the H811/H815 partitions onto the H812?
[Android Software/Hacking General [Developers Only]] steadfasterX:
Please open a new thread regarding this as this is going completely off-topic now
[Android Software/Hacking General [Developers Only]] dharakv:
How do I move this post to another thread?
[Android Software/Hacking General [Developers Only]] Ghost Dragon:
Help me please, gpt unknown.

https://bpaste.net/show/28d886ad6f28
[Android Software/Hacking General [Developers Only]] steadfasterX:
Copy and paste.

You have one of those firmwares which behave unusual.

That's a known bug though:

https://github.com/steadfasterX/SALT/issues/13

Either wait until I have added that as an option in SALT or follow the guide in the above issue for a temporary fix.
[Android Software/Hacking General [Developers Only]] lordico:
Could you please describe how do I install SALT in Windows 10? Thanks a lot !
[Android Software/Hacking General [Developers Only]] steadfasterX:
Don't quote big posts like the OP.

Read the OP again topic Windows.
[Android Software/Hacking General [Developers Only]] steadfasterX:
Well you don't get it.. It seems ;)

FWUL is not made for linux. It's made for windows. Follow all steps in the FWUL thread and you can boot from your USB stick FWUL like you boot windows. FWUL is Linux running from a USB stick / dvd without touching your windows.
[Android Software/Hacking General [Developers Only]] dharakv:
Will do. thanks
[Android Software/Hacking General [Developers Only]] bodziak:
MD5 verification on v29a

Hi,

I did backup yesterday when on ROM v20G..SALT detected that device is MD5 capable. I run verification there was only one error on userdata partition, and 8 warnings. today I'm on v29a and i did backup again and MD5 verification and i got 51 errors. there is something strange in log as well see bellow

2017-12-21 13:31:37: F_VERIFYBAK: vfilerem: fota, REMFILE: Hello,

2017-12-21 13:31:37: F_VERIFYBAK: #fota.bin verify ERROR ((f1c9645dbc14efddc7d8a322685f26eb != Hello,))!

I've assume that backup should be OK. "HELLO" do not look like MD5. Is it correct assumption ?

Bodziak
[Android Software/Hacking General [Developers Only]] steadfasterX:
Ah yes. fixed. Unfortunately v29 seems to not support the md5sum cmd anymore ...

Please update SALT and try again. you should get no offer regarding verification now. Can you confirm this for v1.2-4 ?

thx
[Android Software/Hacking General [Developers Only]] sdembiske:
Rooted, locked H812 with 5.1 not connecting in download mode (confirmed) in SALT in FWUL (forgetful), either in VM or direct boot from USB.

I know the H812 has presented problems connecting in download mode (as discussed in [! DISCONTINUED !] [TUTORIAL][LOCKED][UNLOCKED][ANY G4] DLM Backup with ReeS86 in post #23 proving to be very restrictive.

Is there any workaround in SALT available? Any suggestions appreciated, steadfasterX.

Thanks,

S.
[Android Software/Hacking General [Developers Only]] ReeS86:
I can give it a shot later today when I can escape from some last minute Xmas shopping to see if I experience the same issues
[Android Software/Hacking General [Developers Only]] satiricon22:
Hello,

I have a couple of questions.

First, how can I backup my /data/ partition on an unrooted device? I don't see it listed in the partitions.

Secondly, how can I wipe the dalvik cache with the shell?

Many thanks in advance!
[Android Software/Hacking General [Developers Only]] steadfasterX:
Hm this should have been fixed already..

Connect device download mode in FWUL and open a terminal. gimme the output of

lsusb

Then also start SALT from within a terminal and copy and paste the output from the terminal plus: in SALT open the advanced menu and there the debug log. Paste the output from here as well.

Pls do the same as written above for sdembiske then.

Click backup. Choose FULL.

what's the output of

ls -la /data ?

Usually just selecting the text in the shell will copy automatically.
[Android Software/Hacking General [Developers Only]] satiricon22:
I'll try a full backup overnight, but I worry that /data won't be there since it's not listed.

When I type ls -la /data I get:

drwxrwx--- system system 2015-01-01 00:00 fota

Thanks for your help!
[Android Software/Hacking General [Developers Only]] steadfasterX:
there is no "data" partition. The partition is named userdata and gets mounted to the directory /data. I think that's why you get confused.

The full backup will contain userdata partition which is what you need.

In the SALT shell type:

mount -t ext4 /dev/block/bootdevice/by-name/userdata /data

and:

ls -la /data

rm -rf /data/dalvik-cache

ls -la /data

Thx but one thing is missing:

Start SALT from the terminal in FWUL by:

sudo ./salt

I need the output from the terminal (only that)
[Android Software/Hacking General [Developers Only]] steadfasterX:
Well. Sometimes the download mode needs some time to be fully loaded. Give it at least 30 sec after you see the cycling arrow screen and if it does not work on the first try just try it again after another 30 sec.

I'm glad it works for you now. Restricted download modes should be no prob anymore for SALT - at least not for the backup part.
[Android Software/Hacking General [Developers Only]] sdembiske:
Error in full backup process encountered. USB?

Link to error encountered: https://gist.github.com/sdembis/435686a80606def957945af62ff53d3d

Basically said that backup wasn't supported for the device?

I'll be getting busy with our kids coming over for XMAS eve dinner and XMAS day dinner tomorrow, so won't be able to get back to you for any suggestions you might have to try for a couple of days.

Wishing you a good one.

Best,

S.

---------- Post added at 05:59 PM ---------- Previous post was at 05:49 PM ----------

Perhaps that was the problem encountered on prior tries. It timed me out when just clicking the SALT desktop icon after 30 seconds. Perhaps the timeout needs to be extended to a longer time frame .. e.g., 60 seconds, to cover devices that may be a little slower loading?

Thanks again,

S.
[Android Software/Hacking General [Developers Only]] steadfasterX:
I see. No it's still supported but it seems you really need a higher timeout for operations.. Not a big issue though but as Christmas is here I can't do anything until end of next week.. ;)

Wish you all Merry Christmas!
[Android Software/Hacking General [Developers Only]] htr5:
For those with connectivity issues, try a USB 2.0 port.
[Android Software/Hacking General [Developers Only]] shane87:
Just downloaded and tested SALT on Linux Mint 18.1 Cinnamon 64bit. Everything is working great! I did have a slight issue when I first downloaded SALT with a missing dependency. Apparently, Mint 18.1 Cinnamon does NOT ship with xterm. A simple 'sudo apt install xterm' solved my issues. Also I found that my G4 takes about 60-90 seconds to fully load Download Mode. Did not test taking backups, my phone is very low on battery right now and I prefer to only work on my phone when it is fairly well charged. All in all, an excellent tool!
[Android Software/Hacking General [Developers Only]] steadfasterX:
Ah great yeah I missed that xterm part as it's included in FWUL. Thx for pointing on that and the time issue. I updated the OP with both as it's something mentioned by others as well.

Btw while in download mode the phone charges. Slowly but it does ;)

Sorry but my thx click limit has been reached as every day ;)
[Android Software/Hacking General [Developers Only]] shane87:
Yeah, I figured it did charge while in dl mode, but I'm ocd about those kinds of things lol. As far as the timing issue, it was kind of weird. When SALT finally did pick up my phone, it still gave me the error about my phone not being connected, so I hit skip, but then it loaded up my phone's info and the reboot button worked. Anyway, as I said, a great tool. Now I'm just waiting on being able to unlock, and then I'm going to try porting AOKP to h810. Cheers man, and thanks for all of the great work you do!
[Android Software/Hacking General [Developers Only]] steadfasterX:
Thx for your report and for the log!

Ok I see that you are using the develop branches already. Pls do an update so you will get the version 1.2-5.

This will fix

nothing

for you but I need the log again as it contains hopefully more stuff that i need.

Background info:

Your device needs a challenge / reponse which is not expected (means my detection does not believe you need it).

Very very likely its bc of ur refurbished model but we can fix it - on one way or the other.

thx
[Android Software/Hacking General [Developers Only]] cowsngrass:
Thanks for your response! Here's the log:

2018-01-02 03:58:31: Starting SALT v1.2-5:TESTING!

****************************************************

2018-01-02 03:58:31: F_EGO: started

2018-01-02 03:58:31: F_EGO: /tmp/salt.lock created

2018-01-02 03:58:31: DEVCON before: 99

2018-01-02 03:58:31: F_CHKDEVCON: started

aarch64

2018-01-02 03:58:31: F_CHKDEVCON: Device seems to be connected!

2018-01-02 03:58:31: RET: 0

2018-01-02 03:58:31: DEVCON after: 0

2018-01-02 03:58:31: EXPERIMENTAL: 0

2018-01-02 03:58:31: F_GETINFO: started

2018-01-02 03:58:31: F_CDARB: started

2018-01-02 03:58:32,828 partitions: INFO: Wrote 1048576 bytes to -

2018-01-02 03:58:32: F_CDARB:

2018-01-02 03:58:32: F_CDARB: DEVARB=2, DEVARBEMPTY=0

2018-01-02 03:58:32: F_CDARB: ended

battery_level:100 device_sw_version:VS98627C secure_device:S device_factory_version:VS98627C_00 model_name:VS986 target_country:US 2018-01-02 03:58:33: F_GETINFO: ended

2018-01-02 03:58:33: parsing arb:2:0

2018-01-02 03:58:33: parsing battery_level:100

2018-01-02 03:58:33: parsing device_sw_version:VS98627C

2018-01-02 03:58:33: parsing secure_device:S

2018-01-02 03:58:33: parsing device_factory_version:VS98627C_00

2018-01-02 03:58:33: parsing model_name:VS986

2018-01-02 03:58:33: parsing target_country:US

2018-01-02 03:58:43: F_ADVMENU: started

2018-01-02 03:58:51: getlog script started
[Android Software/Hacking General [Developers Only]] Opsectx:
The reason why you're usb disappeared from the mounted device list on windows.... Winblows.

When making a bootable USB on windows OS unetbootin has never gave me a issue in more years than I can remember. Make the USB using the fwul image.

Figure out the hot key to get into your bios. Enter, delete, f1... Varies from manufacturer. Or F12 could be boot order. Once in bios set the USB to be your first priority for boot. Save and reboot. Will auto boot the USB. And you'll be in fwul.

Remember to change boot priority when done in bios. Or your PC will try booting from every USB you have plugged in when rebooting or starting up the machine.
[Android Software/Hacking General [Developers Only]] dharakv:
Update: SALT Backup

Hi everyone,

I finally got down to performing a full KDZ flash (Android 5.1) with LGUP, then proceeded to run a few SALT backups. Unfortunately it's still freezing while backing the userdata partition. One interesting factor to note is that it doesn't freeze at the same point every time.

Out of curiosity, I tried the backup on my work laptop as well with the same results. Most of the other partitions are also failing to mount, even though they backup fully.

Guess I won't be USU unlocking anytime soon until I get to the bottom of this... In the meantime, I'm going to try to isolate the FWUL component by installing SALT on a debian or ubuntu box. If that also doesn't work, I'm going to desperately look into other ways BL can be unlocked.

Wish me luck..
[Android Software/Hacking General [Developers Only]] sdembiske:
If I were in your position (I'm not, thankfully, but if I were ... ), I would upgrade to stock MM, do a partial SALT backup, allow a Google backup of your device data and copy over all of your SD card contents to your PC/laptop ... then to proceed to USU unlock your device.

If

it completes sucessfully, I would then flash TWRP, install SuperSU and then back up everything in TWRP after you've tried booting up at least once. If successful, I would then copy back any relevant data (photos,videos etc) one or two at a time from your SD card backup on your PC/laptop and, after each progressive copy, try backing up your user data in SALT to see if successful, until such time as it fails again. If you happen to get that far, I would then backup completely as well in Titanium Backup and Restore.

You worst case scenario is you end up sending it in for repair, which you would probably end up having to do any way in trying to solve it.

At this stage, you will not find another method to unlock your bootloader unless LG finally decides to provide the unlock codes. No one has done the research and work on it, to the extent that steadfasterX has, period. If you do find an alternate unlock method, chances are very high it will lead to a complete hard brick of your device, IMO.
[Android Software/Hacking General [Developers Only]] steadfasterX:
90% of freezes are disk space issues. The other is the firmware timeouts. Without a log no one can help.

userdata backup is not necessary to unlock though
[Android Software/Hacking General [Developers Only]] dharakv:
I will go forth with your suggestion. However, supposing the other partitions do backup fully, but are unmountable, should I still proceed to USU unlock? I've had the phone for two years now, and the warranty period is over. If something goes wrong, it's all on me.

Also regarding other possible BL unlock methods... i believe there's more than one way to skin the cat... Would it be possible to modify sbl1 in order to verify an H811 aboot? Then we can unlock the BL with a single command.

---------- Post added at 09:25 PM ---------- Previous post was at 09:15 PM ----------

I'm going to assume its due to timeouts, as I have almost the entire storage space free (I just have 3 or 4 photos). I'll definitely provide logs if anything goes wrong after following sdembiske's suggestion.

Thanks again.
[Android Software/Hacking General [Developers Only]] sdembiske:
Once you start the unlock process, follow the steps exactly, do not stop to check if partition are mountable. If it completes sucessfully, flash the latest TWRP, install SuperSU and reboot. If it boots sucessfully, you don't have to worry, eh ... ? Just do a complete TWRP backup after that. If that backup restores, you're good.

Do you not think that steadfasterX has gone through all those cockeyed half-ass methods? Give your head a shake! My suspicion is you could blow fuses following your skin-the-cat method on the H812 - it's been tried before I believe and led to more issues - why take that risk?

Your choice of course but I'm out of this now. This is becoming Much-Ado-About-Nothing at this point, IMO.
[Android Software/Hacking General [Developers Only]] steadfasterX:
Really? Yea try it. I have spent more the 1 year to make UsU. do you think in haven't tried EVERYTHING? Good! I like that. Never given up is the reason why we have UsU now.

Have you even read UsU OP? I mean right at the top where I describe the journey of UsU? Well try it on your own and if you find a better way open your own thread, good luck :) !

about the disk space : I talk about where you try to store the full SALT backup. You need 33 GB of free disk space there and this is possible only when you attach your windows drive or other storage. If you use FWUL persistent and then trying to store a full backup there it will fail for sure! 100% sure!
[Android Software/Hacking General [Developers Only]] ReeS86:
I reported this before but will post it again, as [MENTION=6302635]sdembiske[/MENTION] has suggested you need to update to MM version of android to do a backup. I tried a dozen different times to do a SALT full backup on Android 5.1 with my H812 and it failed on a random progress, usually the system partition which is the first really big one. After updating to MM everything worked perfectly the first try.