yashsingh1/xdaforums huggingface dataset:
[LG G6 Guides, News, & Discussion] Redick 27:
You need a bootloader unlock. Create a whitelist for root access.

Last month i downgraded my g600l and root it. And yeah turns out fine. I remount my system root files.

One time i tried to delete some system app to the system app. No chance . got rebooted over and over again. Also i tried to uninstall using terminal (to permanent uninstall not like adb,still have odex file) says warning and rebooted.

I digress, unlock buddy unlock.
[LG G6 Guides, News, & Discussion] Ahkrin:
[MENTION=3167089]runningnak3d[/MENTION] I have an LG G6 H870(ZAF not EU) that I'm willing to lose. I can't get an ARF no. it returns nothing when I try the code line.

Edit: Used this code

adb shell cat /sys/bus/platform/devices/lge-qfprom/antirollback

and it returns 1, what are my next steps?
[LG G6 Guides, News, & Discussion] bobbiebeats:
I want my G6 thinQ rooted
[LG G6 Guides, News, & Discussion] rcky844:
There's no hope, runningnak3d haven't logged in for a few months now.

Also,

DO NOT

try the method mentioned in the thread, it will brick your phone.
[LG G6 Guides, News, & Discussion] potatohead:
there is a lg g6 firehose file on github, with that, theoretically, we can 9008 the G6 (all variants except TMo), pull the boot img off QFIL's Partition Manager, patch it with Magisk and push it back, bootloader unlock is no longer needed, so is TWRP (for root).

backing up of all partitions should be, again theoretically, possible; thus bricking should also be longer a concern.

i do not own a G6, however, the above is how I achieve root for G7.

pls correct me if I am wrong (reason being G6 does not work like a G7 etc).
[LG G6 Guides, News, & Discussion] rcky844:
than please provide me the firehose
[LG G6 Guides, News, & Discussion] JEANRIVERA:
maybe is this one?

https://github.com/programmer-collection/lg/tree/master/G6
[LG G6 Guides, News, & Discussion] potatohead:
bingo!

didn't link it in the first place as wanna seek clarification first, afraid there may be eager ones who may rush to flash and ended up bricking their device if my assumptions are wrong.

looking forward to hearing the views of more :)
[LG G6 Guides, News, & Discussion] potatohead:
Silly me; the method mentioned above to get root via QFIL should work IF we can get the G6 to enter 9008 mode at will easily (as with the G7), but after some reading up, I realized this is not the case, my bad.

Wanted to try out the firehose file and read out the partitions from a G5 which I hold, eventually realizing 9008 mode at will without physical shorting or soldering is a no go. I believe G5 should be a closer sibling to the G6 than G7 is.

Will really be glad if I am wrong here.
[LG G6 Guides, News, & Discussion] keystar71:
LG G6 + Thinq h873U (Canadian)

Hi [MENTION=3167089]runningnak3d[/MENTION]

My G6 now runs under android 9 pie. As of today, Is it possible to root it ? and if so What are the steps. The

last one I have rooted is a Samsung Galaxy S4 :) If there is a possibility, I can manage it if I have the steps..

Thank you !!
[LG G6 Guides, News, & Discussion] ChazzMatt:
If you want root, sell 2027 G6 and buy the 2017 V30/V30+ -- which has the specs the G6 should have had...

All V30 variants have root.

Was $110 but starting about two weeks ago dealer raised the "mint" US998 V30+ (128GB) price to $160.

Still not a bad deal, considering how good this phone is...

https://www.ebay.com/itm/173665613177

___

LG V30/V30+

* 1440P OLED (537 ppi)

* Qi wireless charging

* 3.5mm headset jack

* Quad DAC

* DTS 3D stereo (with root to enable LG libs)

* FM Radio

* IP68 dust/water resistance

* rear camera OIS on normal lens - plus 120 degree wide angle lens

* superfast fingerprint sensor

* 64GB (V30) or 128GB (V30+) internal storage

* microSD port for additional storage

* bootloader unlock and root (all variants)

* no notch

US998

CDMA: 800 MHz CDMA

2G GSM: 850/900/1800/1900 MHz

3G UMTS (HSPA):850/900/1900/2100 MHz

4G LTE Bands: 1/2/3/4/5/7/12(17)/13/20/25/66

_____

Be sure to get a good case like this:

Spigen® LG V30 [Rugged Armor] Shockproof Case Slim TPU Cover

https://www.ebay.com/itm/Spigen-LG-V30-Rugged-Armor-Shockproof-Case-Slim-TPU-Cover/253142676754

These phones are like slippery fish with glass backs.

That case is actually slim but very good.
[LG G6 Guides, News, & Discussion] Shynepo:
Hello friends, I could not read through the whole thing. Are we there? Is root possible? Thank you
[LG G6 Guides, News, & Discussion] gfsLuc:
Of course it is possible. We just have to ask LG to support it.
[LG G6 Guides, News, & Discussion] calmasterkey:
hi friends, does anyone know how to unlock h870 bootloader without unlock.bin? lg I don't launch this model, some way to install custom ROM without unlocking bootloader. Thank you
[LG G6 Guides, News, & Discussion] Đại Trần:
I can access EDL mode using testpoint and use QFIL to flash boot. But is it really possible to get ROOT just by patching the boot through magisk? I don't think it can be that easy. :))
[LG G6 Guides, News, & Discussion] runningnak3d:
Type:

dmesg

You don't need to post the whole output ;)

What you are looking for is something that say GLOBAL (you may have to scroll back a bit) ... if you see anything that references H873 then something went wrong with the laf flash.

If you can't find it, then you may need to restart laf, and run dmesg right after it boots. You can use:

!CTRL POFF

To turn your phone off when you pull the USB cable, or:

!CTRL RSET

if you want to reboot your phone. Either way, you will need to go back into download mode, and then immediately run lglaf.py and dmesg.

-- Brian
[LG G6 Guides, News, & Discussion] xrosser:
Lol sorry, taking up a lot of forum space. Only thing that seems to have GLOBAL is this:

<12>[ 68.589529 / 02-19 17:06:42.239][2] [LAF] read property item = GLOBAL

No reference to H873
[LG G6 Guides, News, & Discussion] runningnak3d:
Well what the f**k..... this was supposed to be the EASY part -- lol.

I am going to have to ponder on this for a bit. You can boot back to the OS.

It will probably be tomorrow before I can jump back on this. Sorry about that :(

As a side note, it is really nice working with someone that you don't have to explain everything to.

-- Brian
[LG G6 Guides, News, & Discussion] xrosser:
Hey before you head off, I may have figured it out... I flashed the H873 LAFBAK partition, only unchecking LAF. Would it have used that to restore the un-modifiable LAF partition? Almost done flashing now and then I'll see if that helped...

---------- Post added at 04:52 PM ---------- Previous post was at 04:45 PM ----------

Nope didn't help. Lol. Good luck with the pondering! Can't do too much on my end but I will see if I can troubleshoot, I guess.
[LG G6 Guides, News, & Discussion] runningnak3d:
Flash the H870 laf. I didn't realize that the H873 is the Canadian model. Make sure you grab an H870 KDZ that is still ARB 0 if that model had ARB incremented.

-- Brian
[LG G6 Guides, News, & Discussion] xrosser:
I flashed an H87010e laf and it goes straight to the normal Firmware Update instead of simply 'Download Mode" with blue dots. And lglaf.py is totally locked down with that message, not even 'ls' will run. Or was I supposed to flash the H915 laf and flash H870 as the remainder? Perhaps I just downloaded an improper KDZ.
[LG G6 Guides, News, & Discussion] runningnak3d:
Now do the !EXEC toybox whoami\0

-- Brian
[LG G6 Guides, News, & Discussion] xrosser:
Returns "Hello, I am LAF. Nice to meet you."

dmesg confirms that it is running the H870 laf
[LG G6 Guides, News, & Discussion] runningnak3d:
OK, we are going to go the nuclear route.

FYI -- this is what I have to do every time I have come up with a root method. It is TEDIOUS.... I can't guarantee that this is going to work either.

It is one thing to decompile lafd, and the firmware, and you THINK that it is going to work -- and then BAM it doesn't. I KNOW that some combination will give us a rooted lafd.

The trick is finding a set of firmware that unlock vpexec.

With that said, flash the entire H870 KDZ, and then flash JUST the H873 laf and let me know what you get.

There is very little risk in this since the RSA key is the same on all G6s except the H872.

Don't suppose you want to call me?

-- Brian
[LG G6 Guides, News, & Discussion] xrosser:
Okay I will do that as soon as I get home. Got an errand to run. I'll post here again once I'm back, and if you're on and see that message, we'll call.
[LG G6 Guides, News, & Discussion] xrosser:
[MENTION=3167089]runningnak3d[/MENTION] Alright I am back. Flashing H870 KDZ now and then I will flash the H873 and post the results.

---------- Post added at 09:38 PM ---------- Previous post was at 09:27 PM ----------

This resulted in the same locked-down LAF partition :cyclops:
[LG G6 Guides, News, & Discussion] runningnak3d:
You tried !EXEC toybox as well? (with two spaces :P )

Alright, gonna keep the H870 firmware, and flash the H915 laf.

-- Brian
[LG G6 Guides, News, & Discussion] xrosser:
Tried toybox and it did not work. Flashed H915 laf and same result.
[LG G6 Guides, News, & Discussion] runningnak3d:
Alright, one last hoo-ra, and then I am stumped for the night. H98110k or below (they are ARB 0).

-- Brian
[LG G6 Guides, News, & Discussion] xrosser:
Do you mean H918? or is there an H981?
[LG G6 Guides, News, & Discussion] xrosser:
[MENTION=3167089]runningnak3d[/MENTION] Hoo-ra! I flashed the H918 laf and it worked!

# whoami
root

Your last intuition was right on the money.

EDIT: Looking now at dmesg, the particular KDZ I used for the laf seems to be TMobile (TMO) as opposed to GLOBAL. I suppose I can always find a global kdz if that's necessary for our purposes.

---------- Post added 2nd October 2018 at 12:20 AM ---------- Previous post was 1st October 2018 at 11:39 PM ----------

Well, I jumped the gun and paid the consequence. I used partitions.py --wipe and --restore to flash aboot aaaaaaand bricked the phone. Doesn't seem to boot now. We were so close and I had to go and try something. Not sure if Brian will have any insights tomorrow, but without being able to get into Download mode, there is probably no easy solution.
[LG G6 Guides, News, & Discussion] Ulqiorra:
Will this exploit work for H870S ? Its bootloader cannot be unlocked officially by LG :(
[LG G6 Guides, News, & Discussion] bick:
It's very early days yet for this fix, keep watching as these guys do their magic!

Don't forget this is costing people money as they possibly destroy their phones, we need to let them sort this out model by model.

Excellent work guys, I will watch with eager anticipation.
[LG G6 Guides, News, & Discussion] blackhawk_LA:
It would be nice to set a donation account in case someone brick his phone and needs to be sent to lg to repair it
[LG G6 Guides, News, & Discussion] runningnak3d:
Oh man. You are correct. SOOO close.

--wipe uses the ERSE opcode to well ... erase the partition, however, --restore only works on MM or lower lafd. So if you use --wipe, --restore does nothing and all you have done is wiped out aboot.

Yep, that is a brick that can't be fixed except by LG.

The reason we needed root was so that we could use dd. We were going to dd the aboot and TWRP images off the SD card.

EDIT: at least we learned quite a bit from this. Just knowing that H870 firmware plus H918 lafd gets you a root shell is a huge hurdle. Thank you very much for your time, and I am sorry you bricked your phone.

-- Brian
[LG G6 Guides, News, & Discussion] potatohead:
It is exactly that easy as stated in my post. Simply pull the original boot image from the KDZ of the G6 firmware via unKDZ software or via qfil, then patch it using magisk on any phone with magisk manager installed (use the choose a file method, u can even turn off verity and encryption in the patch if u unchecked both options in magisk prior). After which simply flash the boot image via qfil. Your G6 is now rooted, boot normally and install magisk manager to complete the root setup.

For any phone that can access qfil at will, with bootloader unlocked, the rooting battle is already won before it starts.

For more info, read the G7 forum. All the best!
[LG G6 Guides, News, & Discussion] Đại Trần:
I have a lg g6 korea with bootloader locked. So can I get ROOT this way? :rolleyes:
[LG G6 Guides, News, & Discussion] potatohead:
you have already said you can flash boot, with bootloader locked, thus i dont see why you cant flash the magisk patched boot image; anyway, i also dont see any harm in giving it a try since you already the phone in hand, best scenario is you succeed and your g6 is rooted, harmless scenario is the flash failed, nothing changes, worst scenario is flash successful but phone stuck at boot, simply go back to qfil and flash stock boot image again.

there is nothing to lose here.
[LG G6 Guides, News, & Discussion] Đại Trần:
I patched my boot with magisk and flash it via Qfil. What do I need to do next?
[LG G6 Guides, News, & Discussion] potatohead:
The attached image is a warning that your system has been modified.

Does your G6 boot past that image into Android properly, or it stucks at that image?

If it boots into Android, simply install the latest magisk manager and finish setting up boot. If it does not boot properly, it means root cannot be achieved without unlocking bootloader, then simply flash stock boot image via qfil for the phone to boot properly again.
[LG G6 Guides, News, & Discussion] elliottjonathan1986:
hi everyone i am what people would call a NOOB @ the new methods of rooting but i am pretty tech savvy. And have always been very intrigued with learning the ins and outs of the Android system and the command line. with that being said i have a VS988 that i want to root. any help would be appreciated and i would be totally willing to donate this phone to the purpose of helping EVERYONE who wants this phone rooted. So if there is anyone on this thread willing to take the time to give me insight i would dedicate my time and energy to achieve root on this phone for the purpose of helping EVERYONE. not just myself. thanks to all for your time
[LG G6 Guides, News, & Discussion] shaon.stk:
Im using h873 does it have any way to unlock bootloader and flash twrp?
[LG G6 Guides, News, & Discussion] JZX1GT:
Really curious about how that turned out!
[LG G6 Guides, News, & Discussion] Anand_Sas:
I got a lgg6 VS988 I can test it out for you

-- Brian[/QUOTE]
[LG G6 Guides, News, & Discussion] Biggie_still:
Can you help me with your boot.img, I'm on pie
[LG G6 Guides, News, & Discussion] Biggie_still:
Please guys help me with LG600L boot.img please.
[LG G6 Guides, News, & Discussion] Biggie_still:
I assume since this thread has been quiet lately means the process works?? Well not for me and I hope you should be able to see this and help me out..In qfil I'm getting fail error anytime I tried to load partition manager that DEVICE IS NOT IN EDL MODE... please how do I go to emergency download mode(EDL) when I'm already in download mode??
[LG G6 Guides, News, & Discussion] surfshark:
Its like reading a great novel here. Too bad h873 wont get rooted. And i dont even read novels.

Anyways is there a way for h873 to flash modem cause calls wont work, i just want to reflash the modem or restore the modem. Any way to flash any model’s modem??
[LG G6 Guides, News, & Discussion] Pathum_Sandaruwan:
Any idea how to root this thing?
[LG G6 Guides, News, & Discussion] MinecraftAddict:
So here is what happens when I change my boot partition to one with Magisk injected. This is a VS988 with US997 kdz flashed on it. I've got another US997 that was unlocked via the official LG Unlock program, I'll see if I can spot the differences in the partitions.
[LG G6 Guides, News, & Discussion] Juandr0ide:
What if you flash twrp? Or the abl partition from the unlocked one?
[LG G6 Guides, News, & Discussion] x3r0.13urn:
Hi, apologize for bumping old or maybe dead thread.

Recently I stumbled across this article

🔋 📱❄️🥾🔓, an EL1/EL3 coldboot vulnerability affecting 7 years of LG Android devices

I should probably preface all of this by saying that I'm not really a security professional in the sense that I don't actually do security stuff for a living; I reported this vulnerability in March...

douevenknow.us

Just curious, is it possible this vulnerability repurposed to inject new bootloader which able to be set to unlocked state?
[LG G6 Guides, News, & Discussion] Mohammad Jebreeni:
Hey there guys, I hope you're all well and safe.

Perhaps you already know about this https://opensource.lge.com/index , but I'd still recommend that you guys check it out. It may help us in unlocking the bootloader and perhaps even rooting models that don't have bootloader-unlock/root compatibility of our beloved LG G6!

I tried searching for my phone (H870S), and this is what I got: https://opensource.lge.com/osSch/list?types=ALL&search=H870S .

I really hope this info helps, despite the source code files being very complicated to me. (Maybe someone here could decypher them in a helpful way :?).

Thanks and best regards!
[LG G6 Guides, News, & Discussion] Umer8527:
Please give boot image for Lenovo TB-8504X
[LG G6 Guides, News, & Discussion] doitwell:
I have g6 h870 model no root and bootloader locked . ill try your method
[LG G6 Guides, News, & Discussion] jimrfraser:
How do i donate with out paypal? Runningnak3d actually bricked his phone for our entertainment and thats all it is because our phone is great and doesnt even need root its a fuctioning phone that works well. People only want root to tweak an already perfectly funtioning phone. I can totally see why LG put a lock down. Man i feel so bad.like i said if I can donate through a credit card I absolutely will dude. Let me know how
[LG G6 Guides, News, & Discussion] runningnak3d:
It wasn't my phone that was bricked, it was [MENTION=9478863]xrosser[/MENTION]'s.

There -- FTFY :)

Root isn't just about fixing problems that exist on a phone, it is about being able to customize it any way you want. That may not be your thing, but to *most* people that are on XDA -- it IS their thing.

Him bricking his phone most definitely was NOT for anyone's entertainment. I just hope we get another volunteer, and they understand that the brick didn't happen because of the procedure -- it happened due to an accident.

-- Brian
[LG G6 Guides, News, & Discussion] jimrfraser:
How do non paypal users donate?
[LG G6 Guides, News, & Discussion] xrosser:
Yeah the brick occurred because I made a dumb mistake and I should have known better. I'll be sending it into LG because I want to try again once I'm able lol. I'm confident [MENTION=3167089]runningnak3d[/MENTION]'s method will work! Having root on lafd will enable us to copy over TWRP and aboot (the correct way,

not

the wrong way I attempted in the wee hours of the morning).

I do not know how long it will take for my G6 to get back to me, so I encourage someone else to finish the process.

In

my

opinion, without root and an unlocked bootloader, the LG G6 is a bloated and locked down device suitable for those just looking for something along Apple's philosophy of "It just works" and "Give me some of that sweet sweet corporate device lockdown." If I own an Android device, I unlock the bootloader, root it, install custom ROMs, whatever. If it doesn't let me, I keep trying because (a) I want my phone to operate a certain way, and (b) it's fun.

Thank-you for the offers of donations, however you should direct them towards Brian for his continual work for the betterment of the community. And he is the one who figured out this method, I just followed orders. Until I didn't and bricked my phone, lol.

I will reap what I sowed and take the hit for my action. But Brian sows with his work on these things and doesn't always "reap" any reward. The G6 is making great strides here thanks to him.
[LG G6 Guides, News, & Discussion] adamlee06:
[MENTION=3167089]runningnak3d[/MENTION]

I have a VS988 I'm currently daily driving. Since you know getting the root shell is possible without bricking, should the rest of the procedure be essentially risk free as far as bricking goes, provided instructions are followed?
[LG G6 Guides, News, & Discussion] runningnak3d:
No, the big risk is yet to come.

The SD821 is still an MSM8996 CPU, and based on decompiling various pieces of the V20 and G6 firmware, the V20 engineering aboot should work. However, if I am wrong, then you very likely will end up with a brick.

With that said, I think it is more likely that I may have missed something in the firmware loading, and you are stuck in fastboot. That wouldn't be a big deal -- and you could recover your phone, since you would have full fastboot commands.

With all that said, until this is verified, this is a very dangerous procedure, and the risk of a brick is very high. If you are not prepared to lose your phone, you should NOT attempt it.

There is nothing more that I can verify -- we are at the point where it just has to be tested.

EDIT: also, I just updated the first post to indicate that this is only for models that are still ARB 0. If you are ARB 1, then this will not work.

-- Brian
[LG G6 Guides, News, & Discussion] inserterikhere:
I have a sprint model (LS993). I would be willingly to try it out. If it bricks oh well.
[LG G6 Guides, News, & Discussion] adamlee06:
[MENTION=3167089]runningnak3d[/MENTION] how would I go about checking the anti rollback on my VS988? I haven't used ABT commands since the days of the OG RAZR MAXX, as such I've all but forgotten everything about command shell.

It's on 8.0.0, with the Sept 1 update.
[LG G6 Guides, News, & Discussion] HuEx:
use adb shell... once in adb shell type: getprop ro.lge.swversion_arb

if the output in command prompt window is empty I guess is = 00 if it is 01 then you should get 01 as the output of the command
[LG G6 Guides, News, & Discussion] runningnak3d:
Go ahead and get up to the point where [MENTION=9478863]xrosser[/MENTION]'s phone got bricked. Obviously don't run those commands :P

You can check ARB by hooking your phone up to your PC (you need USB debugging enabled) and:

adb shell cat /sys/bus/platform/devices/lge-qfprom/antirollback

-- Brian
[LG G6 Guides, News, & Discussion] Tinyshy:
is this a valid device for your process? https://imgur.com/a/1iL2jkC
[LG G6 Guides, News, & Discussion] runningnak3d:
It most certainly is :)

Do you understand the instructions up to the point where his phone was bricked?

-- Brian
[LG G6 Guides, News, & Discussion] inserterikhere:
[MENTION=3167089]runningnak3d[/MENTION] Will I need the kdz for ls993? I'm almost home to try this out so I will update soon.
[LG G6 Guides, News, & Discussion] Tinyshy:
I think so. I can give it a shot tonight once I'm off work. If all goes well I'll be up as far as he was by the time I respond to this thread next. That is if no one else beats me to it. In that case congrats to whatever brave soul that is. :)

How confident are you at this point? I'm alright with a brick but it would be a mild inconvenience all the same.

For science though, right? This community has been waiting quite some time and if bricking my phone helps get closer... so be it. Best of luck. I'll be back later
[LG G6 Guides, News, & Discussion] runningnak3d:
I am 90% confident that the worst that you end up with is just fastboot. However, you will have full fastboot, so you can flash your firmware back.

However, there is that 10% that ends with just a brick....

-- Brian
[LG G6 Guides, News, & Discussion] inserterikhere:
Device : LS993

Android Version: 8.0.0

ARB: 00 (I think?)

When I used getprop ro.lge.swversion_arb I got this result

lucye:/ $ getprop ro.lge.swversion_arb
ARB00

But when I used adb shell cat /sys/bus/platform/devices/lge-qfprom/antirollback

This was the result

adb shell cat /sys/bus/platform/devices/lge-qfprom/antirollback
1

So I'm not sure what ARB I am.
[LG G6 Guides, News, & Discussion] enop4:
I have the Us997u, or Amazon version of g6+.

Willing to give it a try. [MENTION=3167089]runningnak3d[/MENTION]

adb shell cat /sys/bus/platform/devices/lge-qfprom/antirollback

returned ''1".

what's next?
[LG G6 Guides, News, & Discussion] adamlee06:
[MENTION=4381791]enop4[/MENTION] yours wont work :(