yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] zaillwonder:
Can not open SALT

Thanks for the tool as I was trying to restore images after a factory reset. But unfortunately I was stuck at the beginning of this process. My phone is Verizon G4 with VS9862BA without root.

I can get the phone to download mode, and when I double-click SALT icon the phone screen changed a little bit showing the VS9862BA software info, but there is no SALT window or console showing up in FWUL. I am a new comer to Linux and android root. Hope to get some help. Thank you~

BTW, I use FWUL on a 32GB usb stick. And, just by clicking the icon, the SALT has no response regardless of connecting a phone or not. Did I miss anything?

--------------------------------

Update: I changed to FWUL stable version 3.1, and it works. But the current problem is that I can not find photos in the userdata partition (I can only see some new images). Should I look into other partitions or it is impossible to restore my old photos?

Thanks.
[Android Software/Hacking General [Developers Only]] dharakv:
I downloaded FWUL 3.1 64bit version and am running it in a virtual machine. When I connect my LG V20 to it, SALT detects it as LS997 with unknown ARB (Please refer to saltdetection2.png attachment).

I tried to do a full backup but it came up with an error "Calculated target size is too small(0)! Upload and share the debug log. https://bpaste.net/show/65f3ef39fdb0

Then I tried to view the partitions and surprisingly it only showed 2 partitions: NO and GPT, both of unknown type (Please refer to saltpartitions.png)
[Android Software/Hacking General [Developers Only]] steadfasterX:
Switch to the develop channel and try again. See the FAQ for the how-to .
[Android Software/Hacking General [Developers Only]] nobodywasishere:
Can I use SALT to do this to my LG V20?
[Android Software/Hacking General [Developers Only]] dharakv:
Hi SteadfasterX,

Thanks for your prompt reply. I have done as you said in FAQ #10, and the update process gets stuck on an io error. (please refer to saltupdateerror.png) I tried to export the log file to a bpaste link but it gave another error on generating the link, so I have screenshotted the last portion of the log file (please refer to saltUpdateErrorLog.png).

Thank you so much.
[Android Software/Hacking General [Developers Only]] steadfasterX:
Uhm do you run FWUL on dvd / as live ISO within a VM? This won't work then. Use an USB stick to run FWUL (recommended for several reasons) or use the persistent VirtualBox builds linked in the FAQ if for any reason you cannot use an USB stick.
[Android Software/Hacking General [Developers Only]] dharakv:
Yeah, but it's an img file instead of an iso. Using the forgetful version because the persistent one errors out on bootup and just gets stuck at a rootfs prompt....
[Android Software/Hacking General [Developers Only]] dharakv:
Update: I tried again running persistent in Vbox using [MENTION=6302635]sdembiske[/MENTION]'s method:

https://xdaforums.com/showpost.php?p=75389990&postcount=483 and it gave me the same error while switching to develop mode.

I burned FWUL onto a flashdrive, and it enabled me to switch to the develop mode, however, upon trying to take a SALT backup, I'm still getting the "calculated target size is too small (0)!" issue.

Logs: https://bpaste.net/show/e4b26c100b99

2019-06-02 15:12:11: F_BACKUP: started with these arguments:
2019-06-02 15:12:15: F_BACKUP: DEBUG: List partitions:
No GPT
2019-06-02 15:12:15: F_BACKUP: DEBUG: adding No to 0
2019-06-02 15:12:15: F_BACKUP: DEBUG: adding GPT to 0
2019-06-02 15:12:15: F_BACKUP: DEBUG: choosen mode: 1, COMPLSIZE: 0
2019-06-02 15:12:15: F_MSGE: started
2019-06-02 15:12:52: ERROR: Calculated target size is too small (0)!
Upload and share the debug log!
2019-06-02 15:12:52: 0
2019-06-02 15:12:52: F_EXIT: started
2019-06-02 15:12:52: EXIT: F_BACKUP with code 4
2019-06-02 15:12:56: F_ADVMENU: started with LG-LS997
2019-06-02 15:12:56: F_ADVMENU: main YAD_PID is 2096
2019-06-02 15:12:58: CR setting: Auto =
2019-06-02 15:12:58: getlog script started

And SALT is still only detecting those 2 partitions I mentioned earlier: NO and GPT

I'm starting to wonder whether the two errors may be related?
[Android Software/Hacking General [Developers Only]] steadfasterX:
NO and GPT are no partitions its an error message.

without a full log from the advanced menu its hard to understand what happens.

.-
[Android Software/Hacking General [Developers Only]] dharakv:
Full log: https://bpaste.net/show/e4b26c100b99
[Android Software/Hacking General [Developers Only]] Stavinair Bluewing:
Reading the wall of text in order to do all this is extremely intimidating. Mind making a video tutorial for LS991? Dumb question, theoretically can installing salt be done without a computer?
[Android Software/Hacking General [Developers Only]] steadfasterX:
Thanks but that's not from the develop version 3.22..

Besides that if you can find a partition listing for your model may be of help as well.

Pls take a log upload with the develop version ..

So I should do a video for what ? Every single action you can do with SALT ? For every LG device then as well because ls991 isn't the only LG which SALT supports .. Well lemme think about it. Every function will take at least 45 min of work as when I do things I try doing it right. We have extracts for kdzs, SALT can update itself , it can backup in custom ,basic or full mode, it can mount image files, convert ROM zips , list partitions and for sure unlock the LG g4. Sum those above and you will get the answer.

BUT

Feel free to help the community (that's why everything is open source) and do those videos by yourself. I will be very happy to link them and it will be appreciated .

SALT is able to run everywhere where the requirements can be met . That means yes you need a PC.
[Android Software/Hacking General [Developers Only]] dharakv:
That's a bit strange, because I clicked the update button and changed it as follows:

g4-develop

develop

develop

And the update worked so I restarted SALT....
[Android Software/Hacking General [Developers Only]] steadfasterX:
Do it again and share the debug log from the advanced menu without closing SALT before .
[Android Software/Hacking General [Developers Only]] dharakv:
https://bpaste.net/show/439e706138ae
[Android Software/Hacking General [Developers Only]] steadfasterX:
Really weird that the version doesn't change after that .. It should as there are no related errors in the log ..

Ok do this:

Close all SALT windows - or do a fresh reboot.

Open a terminal and:

rm -rf /home/android/programs/SALT

git clone -b develop https://github.com/steadfasterX/SALT.git /home/android/programs/SALT

rm -rf /home/android/programs/lglafng

git clone -b develop https://github.com/steadfasterX/lglaf.git /home/android/programs/lglafng

Start SALT . go directly in the advanced menu and share the debug log.

If you see v3.22 in the title of SALT you can try connecting and backing up your device again .

Note:

Do not use the update button in SALT anymore .
[Android Software/Hacking General [Developers Only]] dharakv:
After entering those commands, I get a Fatal Error message when I start SALT... Please refer to the attachment.

Update: I tried the command "pacman -Sy python-crypto" but still stuck on this error.

Thank you.
[Android Software/Hacking General [Developers Only]] steadfasterX:
Well uninstall that one again (pacman -Rn python-crypto) and follow this:

"if you get an error about crypto stuff you need to install python crypto dependency (not part of FWUL atm) as well:"

sudo pacman -S python-pip

sudo pip install cryptography
[Android Software/Hacking General [Developers Only]] dharakv:
Thanks, as soon as I entered those 3 commands, I was able to start SALT, and I noticed it is version 3.22-11 TESTING:good: I am now able to see all the partitions properly as well, and upon attempting a full backup, it doesn't give me that size error. However right after the backup starts, the progress bar jumps to 100% and remains there... (Please refer to attachment)

Logs: https://bpaste.net/show/59393df085b7

Update: It jumps to 100% regardless of whether it is a Full or Basic Backup, however when I select Custom backup and exclude the userdata partition, it seems to be running fine. On the V20, userdata is 51GB, so maybe the massive size is causing an issue?

Thank you so much.
[Android Software/Hacking General [Developers Only]] steadfasterX:
Nope only custom backup is supported in that develop channel ..
[Android Software/Hacking General [Developers Only]] dharakv:
Ok it seems the backup has completed, but I'm not so sure if everything got backed up.. The total backup is about 9.7 GB (the userdata partition is 51 GB and was excluded). The phone was marketed as 64GB total internal storage, meaning 3.7GB is missing? :confused:
[Android Software/Hacking General [Developers Only]] DarrenNewsgroup:
The missing space will be losses down to formatting, there is always some overhead. Also there is the possibly that 64GB is actually 64 * 1000 * 1000 * 1000 bytes whereas the size recorded can be measured in 64 * 1024 * 1024 * 1024 so there is another 2.4% "lost" immediately (it isn't lost, just was never there - a nice trick employed by hard drive manufacturers).

Either way I would suggest the discrepancy is to be expected
[Android Software/Hacking General [Developers Only]] dharakv:
Found it quite interesting how nothing in my build.prop file shows any relation to an LS997, but SALT still picks it up. I guess SALT reads very low-level firmware details (almost motherboard level)?

---------- Post added at 02:12 PM ---------- Previous post was at 02:11 PM ----------

Oh I see.... thank you, I was getting worried there for a minute.
[Android Software/Hacking General [Developers Only]] steadfasterX:
SALT shows what the LAF reports. So that comes directly by laf. Usually LAF reads the misc partition for several of this things so if you dump misc and do a "strings" on it you should see the version trace . This is for the installed firmware.

The stuff in misc gets written by android system but it's not clear when the firmware version gets written. My guess is by LG up after flashing but not in any case ...

When it comes to the model it depends. On yours even the serial is ls997 so at least the installed bootloader stack is ls997. This plus the fact that the laf protocol says it is a ls997 sounds like it's a ls997 ;)
[Android Software/Hacking General [Developers Only]] dharakv:
Ah I see. You mentioned here ( https://xdaforums.com/g4/help/salt-twrp-partition-questions-t3804566/post76889156#post76889156 ) that misc isn't overwritten during a KDZ flash, which means the original phone details (model number, serial number, etc) are still stored there, and that's what laf partition is reading and reporting to SALT.

So that's another way to know I have an LS997. But you also mentioned that the laf version must match the version of the bootloader stack. So if the laf is LS997, the bootloader stack must also be an LS997.... Thanks to SALT (and a little bit of logic) we can discern the true model of the phone without opening the motherboard.:)

But how then is the LS997 bootloader booting a US996 firmware just fine? The PBL of LS997 would see the US996 SBL and brick itself, right? Maybe the seller unlocked the bootloader prior to selling me the phone?:confused:

I was also suspecting that maybe the seller could have simply edited the ro.product.model field within the build.prop file to make it appear as a US996, while still running the LS997 firmware?
[Android Software/Hacking General [Developers Only]] steadfasterX:
No you mix stuff here. I said SOME parts are stored in the misc partition. The serial is an example which I mentioned which is related to the bootloader stack and is NOT part of the misc. It comes from the bootloader stack (aboot in particular). So - as said - this is a proof for a ls997 bootloader stack . Nothing more nothing less.

And still this all means nothing at all. As said you can cross flash firmwares when the PBL allows to. So - as said - you cannot say what happened to your phone until you take the risk of hard bricking it.

Maybe I wasn't clear enough about the PBL. It may allow booting different bootloader stacks. Nobody can say which will load besides the stack made for the model. The only thing needed to cross flash is (besides ARB) a bootloader stack with a signature accepted by the PBL. A h818 can boot with the bootloader stack of a h815. Why? Simply because the bootloader stack is signed by a CA which the h815 and h818 PBL accepts . Nobody knows what signatures are accepted - especially on Frankensteins as there the PBL could have been modified .

And that's only up to the bootloader stack . Afterwards the boot partition gets loaded - which can be for a complete different model - as long as the aboot/xbl accepts the signature of the boot partition which can be (and is) from a total different CA. That way you can boot with a bootloader stack of a ls997 and a boot + system of an US996 or whatever.

So again absolute nothing you can do to find out your REAL model without doing what I told.. Cross flashing with the risk of a hard brick . Nothing else can proof it sorry. Nothing in SALT or logical thoughts or looking at the mainboard . Really .
[Android Software/Hacking General [Developers Only]] dharakv:
Ok so without risking a hard brick, I'm going to go ahead and follow the instructions to unlock the phone's bootloader. There's one method for US996's and another method for LS997's. I'm going to follow the LS997's one.

Once the BL is unlocked, you can cross flash any V20 variant's firmware I'm guessing?

And also, is the laf partition included in the kdz?
[Android Software/Hacking General [Developers Only]] steadfasterX:
Well.. No (and yes). Unlocking will not allow you to cross flash every part. It will allow you to boot modified boot,recovery,system partitions . Complete different thing . So if your question is:

Can I flash the BOOT + SYSTEM of any v20 variant after unlock?

Then the answer is YES - but you cannot flash a kdz by LG up from another variant without a risk of a hard brick . Why has been explained above.

Yes laf is in every kdz included as it's signature must match with the bootloader stack . Same for recovery.

Feel free to use the thx button ;)
[Android Software/Hacking General [Developers Only]] dharakv:
I see, so the real limitation is the read-only pbl.

I want to thank you greatly for all your support, your hard work and dedication....SALT has proved invaluable and priceless to us LS997 users, because Sprint doesnt release the KDZ. So SALT is the only way to backup the modem fully..

Especially in my case, with a frankenstein LS997 running US996, the only way to BL Unlock is to downgrade to a previous version of US996 firmware, which means that without SALT, I wouldn't be able to backup anything... and I'd be stuck with a phone without cell service...

There's been users who have flashed custom roms on their LS997s and havnt had a backup of the modem who are now stuck without cell service....so once again, thanks so much. I highly recommend this to all V20 users.

I'm guessing the modem.img, modemst1.img and modemst2.img from the SALT backup are the "modem" partitions that are needed for cell service? Could you please recommend a safe way to flash these? I've heard of modified LG UP versions with a "Partition DL" mode where you can flash partition by partition. Is this safer than TWRP? Some users were also mentioning using dd command?

Also, what if you flash different versions of boot and system? Say boot is LS997 and system is US996? Or what if boot is a newer US996 (10p) but system is an older US996 (10f)? Instead of flashing the entire downgraded US996 10f KDZ im thinking of just flashing system... (Upon doing some research, there have been users who have flashed the exact same US996 kdz on their LS997's and were ok, except for the cell service.)

I apologize for all the trouble...
[Android Software/Hacking General [Developers Only]] steadfasterX:
Exactly .

Well. Modem contains at least the baseband firmware (on the g4 also other stuff like sensors, sound.. firmwares).

modemst1/2 containing stuff related to the baseband / cell service. At least one thing I know is stored there: sim and network unlock.

TWRP is not safer or less safe - when doing it right . The developer lgup versions - when you find one working with your model (require also a modded model specific MSM dll) may be easier to use once everything is setup but well.. TWRP with the correct dd commands is perfectly fine and safe and maybe even easier and for sure faster then setting up the lgup dev version...

Depends . Often enough it will work (means it will boot and maybe even everything will be fine) as long as you stay within the same major android release (so e.g. between MM but 100% not when using a MM boot with a N system). I see no reason doing that though. Anyways it may have issues when it comes to kernel modules (e.g WiFi ).

Not sure what you want to achieve with flashing the system of a us996 .. Keep in mind that LG is a REAL pita , they blow fuses even from system partition!!!!! So before cross flashing stuff like that you should be VERY sure about the ARB of what you want to flash . If the us996 has the same ARB level, ok but it it has a higher ARB you will loose cell service may having issues with your camera, sound, sensors,... This is fixable (well .. better workaround it) usually but requires some work so better avoid it . A backup of your modem partition will not save you here..
[Android Software/Hacking General [Developers Only]] dharakv:
:good: Thank you it's clear to me now.

I also noticed there's two partitions called 'carrier' and 'factory'. Are these also required to get calls/text/data working? Also I noticed a partition called encrypt. Could it be that all or some of partitions on the phone themselves are encrypted?

Thanks for that, I will do some more research of my own regarding the dd command.

Yes the 10p I am (supposedly) currently running is Nougat with ARB 0, so the 10f, being an older version, too is definitely Nougat as well with ARB 0 (V20's come with nothing below Nougat)

My goal by flashing system of an earlier unpatched kdz is ultimately to get access to an unpatched firmware version, so I can unlock the bootloader. The 10p has the exploit patched but the 10f doesn't. I don't want to risk flashing the entire KDZ so I thought if I flash system alone, I can avoid the risk of losing cell service (and other possible issues).

Basically the exploit works by opening a privileged(root) shell in adb via the following commands:

adb logcat -s dirtysanta

adb push dirtysanta /storage/emulated/0
adb push aboot.img /storage/emulated/0
adb push dirtycow /data/local/tmp
adb push my-run-as /data/local/tmp
adb shell chmod 0777 /data/local/tmp/*
adb shell /data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/my-run-as
adb shell /data/local/tmp/dirtycow /system/bin/applypatch /data/local/tmp/dirtycow
adb shell

But one more interesting thing I found was... when I issue the command "adb reboot bootloader", it doesn't take me to the bootloader, instead it just reboots the phone, meaning the fastboot commands aren't in the firmware.... Now that's strange because I think all (legitimate) US996 have the fastboot binaries.... So possibly whatever the partition that stores and/or deals with fastboot and adb (I'm guessing it's the system partition) is still LS997 ?

Thanks again,

dharakv
[Android Software/Hacking General [Developers Only]] steadfasterX:
Pff.. Well this is going to be a LG training heh?! The carrier usually contains stuff like apn settings (so Internet etc) some logos and such but that can depend on each model

no. It is needed to store stuff for device encryption. Partition encryption (FDE) was never made for anything else then userdata and that has been super seeded by FBE.

Ok that may work - as long as the ARB is fine (which SALT is showing you when extracting the kdz).

Not that interesting sorry ;) fastboot is within the bootloader stack which means aboot/xbl and that is ls997 in your case .

That is at least partly off topic what we do here. I'm glad to help you here as long as it is related to SALT . Otherwise open a new thread for this kind of discussion and mention my nick or link your post here then.
[Android Software/Hacking General [Developers Only]] Stavinair Bluewing:
Bluetooth file transferring support has been dropped for everything past marshmallow. Any possible way to get past this?
[Android Software/Hacking General [Developers Only]] steadfasterX:
Your question is SALT related because .....???
[Android Software/Hacking General [Developers Only]] Varso01:
SALT is running but no display

I am trying to run SALT from FWUL and the log tells me it is already running but no menu is showing up. It is like nothing is running.

My current set up is FWUL in persistent mode.

LG G4 H812 in download mode

executing start does noting

Here is my log file

2019-06-11 18:54:44: Starting SALT v3.21-4:STABLE!

****************************************************

2019-06-11 18:54:44: F_CKUSU: USU=0 (1=yes, 0=no)

2019-06-11 18:54:44: F_CKUSU: ended

2019-06-11 18:54:44: F_GETINFO: USU 0:

2019-06-11 18:54:44: F_ROMCOMP: started

2019-06-11 18:54:44: F_EGO: started

2019-06-11 18:54:44: F_MSG: started

2019-06-11 18:54:44:

Oops... SALT seems to be running already!

Do you want me to ignore this (not recommended)?

2019-06-11 18:54:44: F_MSG: ended

2019-06-11 18:54:44: F_EGO: Aborted on users request

1

0

2019-06-11 18:54:45: UsU compatibility: 1 (0=h815, 1=h811)

2019-06-11 18:54:45: F_GETINFO: ROMCOMP H811

2019-06-11 18:54:45: F_CHKLAFV: started with this args:

2019-06-11 18:54:46: F_CHKLAFV: detected 1000001

2019-06-11 18:54:46: F_CHKLAFV: no comparison needed

2019-06-11 18:54:46: F_GETINFO: LAFVER 1000001

2019-06-11 18:54:46: F_GETINFO:

2019-06-11 18:54:46: F_GETINFO: ended

2019-06-11 18:54:46: parsing

2019-06-11 18:54:47: parsing H811

2019-06-11 18:54:47: parsing 0

2019-06-11 18:54:47: parsing 1000001

2019-06-11 18:54:47: parsing 99

2019-06-11 18:54:47: parsing H81220x

2019-06-11 18:54:47: parsing S

2019-06-11 18:54:47: parsing LGH812AT-00-V20x-302-610-NOV-22-2016+0

2019-06-11 18:54:47: parsing imei:xxxxxxxxxxx

2019-06-11 18:54:47: parsing serial:xxxxxxxxxxx

2019-06-11 18:54:47: parsing LG-H812

2019-06-11 18:54:47: parsing BELL

2019-06-11 18:54:47: parsing CA

2019-06-11 18:54:47: Detected stuff:

DEVCON=0

LAFVER=1000001

LGUSU=no

LGSERIAL=LGH812dxxxxxxxxx

LGOPER=BELL

LGMODEL=LG-H812

LGSWV=H81220x

LGFACV=LGH812AT-00-V20x-302-610-NOV-22-2016+0

LGCOUNTRY=CA

LGSEC=S

LGBATT=99

ROMCOMP=H811

DEVARB=0

2019-06-11 18:54:47: Flashing functionality enabled bc: LAFVER = 1000001 and/or EXPERIMENTAL = 0

2019-06-11 18:54:47: HINT: Flashing temporarly NOT auto enabled (until all tests finished)!

2019-06-11 18:54:47: F_MAIN: starting G4 menu

2019-06-11 18:54:47: F_EXIT: started

2019-06-11 18:54:47: EXIT: main->end with code 0

removed '/tmp/salt.lock'

I am at a lost at what to do next. Sorry if I did not do a search on my problem but I did not know what my search keywords should have been.<thanks for your help
[Android Software/Hacking General [Developers Only]] steadfasterX:
This is not the /home/android/salt.log isn't it ? It does not look like as it's missing half of the stuff I expect here.

Also what FWUL type ? VM ? USB ?
[Android Software/Hacking General [Developers Only]] steadfasterX:
When there is one thing I hate then modified logs ;) do not touch anything when providing logs and please do not paste logs like that directly . Use a paste service like paste.omnirom.org or similar .

Ok but do you have ever rebooted ? It really looks odd what your logs showing. A reboot should fix and issues regarding "SALT is running already" . Do that and then start SALT from a terminal and share the log and the terminal output (with a paste service).