yashsingh1/xdaforums huggingface dataset:
[LG V35 Guides, News, & Discussion] runningnak3d:
Since you have full fastboot, grab a copy of TWRP for the G7 and try booting it. I verified today that laf from the G7 boots just fine on the V35, so TWRP should work until (yes I am being optimistic here) I can get the V35 rooted and build our own TWRP.

In case you are new, the command will be:

fastboot boot twrp.img

Where twrp.img is whatever the filename of TWRP is. If the touch screen works, and the rest of the functionality is there, you can use that for now. However, you will have to have a PC and fastboot boot it every time you want to get into TWRP.

On SD845 and later devices (which the G7 and V35 have), recovery is no longer a separate partition -- it is included in boot. So, you do NOT want to flash the G7 version because while the G7 kernel may work fine for laf, and TWRP, it probably wouldn't be ideal to use as a system kernel.

Let me know if you have any questions.

I do have a question for you. Where did you get your phone from? I have a hard time believing that there are so many V35s out there with engineering bootloaders -- so I would like to get my hands on one and figure out how they unlocked the bootloader.

-- Brian
[LG V35 Guides, News, & Discussion] alex.coffen:
Thanks for your answers.

I bought this phone from taobao which is a bigest famous online shopping site in China. I do not know how they unlocked the bootloader and tell me if something I can help with.

I unlocked LG G2/G4/oneplus 5T myself so I know the basic knowledges about how to execute ADB command and the normal root process. But I do not know the one using patched magisk boot img way.

As far as I understand, you meant that we can temporarily boot into the G7 twrp to use its functions but we cannot actually flash the twrp to the phone. Booting to G7 twrp image, is it safe? (The "safe" I mean is that, if I encounter problems, at least I still can startup the phone with rooted. Otherwise, I need to send my phone to the seller who is 2000KM away to root it again...Last time I booted into its recovery, all my data was erased...) Anyway, I will try it as you suggested, but I will put it the 2nd priority.

The 1st priority is that, I truely want to solve the problem I met about installing magisk module failed. See my attachment. I want to know if I can fix the problem by updating the magisk framework. I need the "safe" way as I just said.

So if I click "yes" in the 33.jpg I attached, do you know which would happen?

A. brick the phone

B. restart and get a factory reset, then I cannot use root any more

C. nothing changed, still install module failed but root can work

D. Solve the problem and can install module successfully
[LG V35 Guides, News, & Discussion] vlad48:
If you press "Yes" it will just download Magisk setup which will fail doing anything it will reboot to the stock recovery which will perform security check and wipeout magisk from boot image.

To solve your problem and install the module properly you need to patch externally your boot image and and flash it back in fastboot mode overwriting both a and b slots.

So:

1. Dump boot via LGUP download mode.

2. Patch it via Magisk Manager.

3. Flash it back under fastboot mode.

4. Install your module and enjoy...

P.S.: If you are not confident on how to perform any of the listed steps above please do not start it at all because definitely you will need to travel 200 km again for restoring root...
[LG V35 Guides, News, & Discussion] alex.coffen:
Thanks for explaining. That is what I worry about. Some questions for you:

1. I have used LGUP to dump boot_a and boot_b. (Very slow, took 1 hour. I renamed them to boot_a_org.img and boot_b_org.img, they are no difference with cksum). So this is currently boot images patched by seller? So, no matter what problems I encounter, I can flash boot_a_org.img(boot_b_org.img) back to boot_a and boot_b to recover my phone anytime and still get rooted? If so, I can feel free to do anything no worrying about the 2000KM delivery...

2. You mentioned "Patch it via Magisk Manager". I can directly patch boot_a_org.img to do it? I think boot_a_org.img is already patched by seller. (I do not have the original unpatched and unlocked bootloader img for V35...)

3. "Patch it via Magisk Manager". can only be done in my V35 phone, or it is OK to do it in other phones?

4. Can I try to boot into G7 twrp then I can flash the newest magisk via twrp? In this way I can fix my problem?

Thank you very much in advance.
[LG V35 Guides, News, & Discussion] vlad48:
1. Download LGUP from HERE

(make sure you put it in the right place afterwards: C:\Program Files (x86)\LG Electronics\LGUP)

2. Shut down your phone and then press VOL+ button and connect it via USB cable to your computer (The phone will boot in download mode).

3. Start LGUP.exe and select DUMP mode. DUMP

only

those partitions (place checkbox):

abl_a

abl_b

boot_a

boot_b

xbl_a

xbl_b

This will finish our backup preparation, so report back once done.

(Also just come to a better idea - compress and upload somewhere your boot_a file I'll try to patch it with latest Magisk and upload it back to you)
[LG V35 Guides, News, & Discussion] runningnak3d:
Laf has new security that prevents reading for now. LG UP 1.14 and 1.15 can't read .. and I can't find a copy of 1.16.

-- Brian
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=3167089]runningnak3d[/MENTION] maybe you are mixing V40 with V35. Using this DUMP only version of LGUP bootloader unlocked phones are able to dump all (even non kdz partitions) so he will be able to perform this operation.
[LG V35 Guides, News, & Discussion] bacon612:
This only works for v35 phones with unlocked bootloader?
[LG V35 Guides, News, & Discussion] alex.coffen:
Yes, I have already dumped those part:

abl_a

abl_b

boot_a ============> I rename this one to boot.img

boot_b

xbl_a

xbl_b

Could you teach me what is each one used for?

So boot.img is currently boot image patched by seller? So, no matter what problems I encounter, I can flash boot.img back to boot_a and boot_b to recover my phone anytime and still get rooted? If so, I can feel free to do anything no worrying about the 2000KM delivery...

You mentioned "Patch it via Magisk Manager". I can directly patch boot.img to do it? I think boot.img is already patched by seller. (I do not have the original unpatched and unlocked bootloader img for V35...)
[LG V35 Guides, News, & Discussion] alex.coffen:
The files I dumped from LGUP are bin file or img file?

I try to patch the boot.img file but everytime I get error. See attachment.
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=8443609]alex.coffen[/MENTION] Yes if you backup your boot image and do not boot into RECOVERY everything will be safe.

It appears your DUMP was not done properly. Please if possible open your boot.img with HEX editor and take a look at it - if there are only 0-es there than it appears something is wrong with your dump.
[LG V35 Guides, News, & Discussion] alex.coffen:
Yes, all 0-es. What should I do? I have already re-installed the USB dirver 4.2.0. See attachment.
[LG V35 Guides, News, & Discussion] alex.coffen:
Since I failed to use LGUP dump boot img, I think about another way.

I installed termintor on my phone. Under directory /dev/block/bootdevice/by-name, I execute "ls -l" then I can find all partitions, for one example:

boot_a -> /dev/block/sde11

In this case, do you know if I can use "dd if=/dev/block/sde11 of=/storage/emulated/0/Download/boot_a.img" to get the boot img?

[MENTION=3167089]runningnak3d[/MENTION]， [MENTION=629603]vlad48[/MENTION]
[LG V35 Guides, News, & Discussion] alex.coffen:
Since I failed to use LGUP to dump boot img, I think about another way.

I installed termintor on my phone. Under directory /dev/block/bootdevice/by-name, I execute "ls -l" then I can find all partitions, for one example:

boot_a -> /dev/block/sde11

In this case, do you know if I can use "dd if=/dev/block/sde11 of=/storage/emulated/0/Download/boot_a.img" to get the boot img?

[MENTION=3167089]runningnak3d[/MENTION]， [MENTION=629603]vlad48[/MENTION]
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=8443609]alex.coffen[/MENTION] - well your are right this will be your boot.img for backup which you can patch also via Magisk and flash it back via fastboot.

I think SU is needed first so the terminal command will be:

su
dd if=/dev/block/sde11 of=/storage/emulated/0/Download/boot_a.img

please share your dump if possible
[LG V35 Guides, News, & Discussion] alex.coffen:
Finally I got the boot.img and also patched via Magisk patched_boot.img (I checked "Preservce force encryption" and "Preserve AVB2.0/Dm-verity" when install to boot img, OK?).

I want to double confirm that I did not do wrong things and can flash the patched_boot.img to boot_a and boot_b. If I get bootloop or some failure after flashing, I can flash boot.img to bring it back, right? "Safe"?

BTW, I shared the boot.img for you guys, hope it will help: https://drive.google.com/file/d/15flqTX3SE_j_p7Yk35SlRAilKR0PkbpE/view?usp=sharing
[LG V35 Guides, News, & Discussion] alex.coffen:
One more thing:

[/mnt/hgfs/Myriad$]md5sum boot_b.img

cd94712458a3b2d1bcb0b1a3d934fd40 boot_b.img

[/mnt/hgfs/Myriad$]md5sum boot_a.img

a9c53d5e755c7c9af5ac49bf3637a18c boot_a.img

[/mnt/hgfs/Myriad$]cksum boot_a.img

2588219073 67108864 boot_a.img

[/mnt/hgfs/Myriad$]cksum boot_b.img

2675431352 67108864 boot_b.img

boot_a.img is different with boot_b.img? I can use any one of them?
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=8443609]alex.coffen[/MENTION] I can not guarantee you 100% but you should be safe at least 90%.

Firstly go in Fastboot mode and try to boot your patched image from your PC command prompt using fastboot.exe locally:

fastboot boot boot_a.img

Then if it boots use your A boot image and flash it to A slot firstly and check if it will boot.

Whatever happens - just do not panic and do not try enter the recovery! try to boot into Fastboot mode firstly (vol down and plugging USB cable while the phone is shut down)

Good luck!
[LG V35 Guides, News, & Discussion] alex.coffen:
Thanks. I will try it tomorrow.

Simple question, last one: How to force shutdown the phone...?
[LG V35 Guides, News, & Discussion] vlad48:
Regarding force shutdown it is as always - volume down+power for 60 seconds.

if you fail in bootloop with red warning screen that security check was failed and you need to press power button - pres volume down instead and then power button (it will try to boot your b image)

Also patched properly your boot-a image for Magisk 18.1 and added TWRP recovery 3.2.1 please download it HERE and start your tests with firstly trying to boot this image via fastboot.

Good luck and waiting for your report!
[LG V35 Guides, News, & Discussion] alex.coffen:
No luck!! I cannot get into fastboot mode.

I tried to reboot into fastboot via "adb reboot bootloader", I cannot get into bootloader/fastboot mode and I went directly into the system...

Then I tried to press power buttom while plugging in the usb cable, I did not get into bootloader/fastboot mode either, just showed the charging screen....

I googled, I just can find V30 korea version does not have fastboot, the I doubt my V35 does not have fastboot...
[LG V35 Guides, News, & Discussion] vlad48:
Than it appears your root solution provider flashed only your patched boot image in slot A. Your bootloader is stock locked one and that is the reason why your dumps via LGUP are full with 0-es.

Please share a screenshot form your phones software info page and I will tell you all options you have.
[LG V35 Guides, News, & Discussion] alex.coffen:
where i can find the phone software info? via cpuz?
[LG V35 Guides, News, & Discussion] vlad48:
Easiest way is to go in Settings-->System-->About Phone-->Software Info and take a screen shot or retype all the info here.
[LG V35 Guides, News, & Discussion] alex.coffen:
OK，attached.
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=8443609]alex.coffen[/MENTION] O.K. now everything is clear you have AT&T version with locked bootloader, but you have root. There is one guy in China which found korean eng bootloader and flashes it with the Korean ROM, but it appears you are not using his service.

Now to sum things up and possible solutions:

1. You can go to this guy and he will remotely flash an unlocked bootloader to your phone but for a prize...

2. I can share with you the abl partitions with the unlocked bootloader which will work with your phone and you will have fastboot etc. but to flash it you

- either travel 200 km to your guy and he will flash it properly

- or you can try to risk flashing it by yourself using dd command (risk of bricking is about 25% and you will need to travel again to restore the phone)

3. Final option is if you can try to flash your patched boot_a.img via dd but it might fail because of the phone locked bootloader so you will need to travel again.
[LG V35 Guides, News, & Discussion] alex.coffen:
I do not understand. I check the oem lock status, it shows bootloader is already unlocked. see attachment.
[LG V35 Guides, News, & Discussion] alex.coffen:
I will try to reach the guy who is not available because his wife just had a baby, I just heard and think about the options.

btw, It is not 200 km , it is 2000 km...

anyway, thank you very much for all you did.

Last time you said it will boot to stock recovery if I choose "yes", why recovery? I can take a chance to click yes if the worst thing is install fails, no boot to recovery. CAN I CLICK YES?

now 1 to 4:

1. click yes if you agree.

2. contact the guy to fix my problem remotely.

3. use dd to flash your abl partition

4. use dd to flash patched boot img
[LG V35 Guides, News, & Discussion] vlad48:
Well the screenshot shows just a slide switch which is not working already properly. That is all. Your bootloader is locked.

1. click yes if you agree. - forget about this option you will loose root

2. contact the guy to fix my problem remotely. - 0% risk but it costs....

3. use dd to flash your abl partition - 25% risk of a brick

4. use dd to flash patched boot img - 40% risk of a brick
[LG V35 Guides, News, & Discussion] alex.coffen:
OK, don't get me wrong. I trust you and just want to provide you enough info then you can have right judgement.

Even the warning message does not mean the unlocked bootloader?

Is it possible that fastboot just does not exist on my V35?

Please share me your abl partition in case I am willing to by the 25% brick risk:)
[LG V35 Guides, News, & Discussion] vlad48:
Sadly even the warning message means that security check did not pass but phone will try to boot - and yes you can have this messages in yellow and red because of different checks during boot.

And believe me there is bootloader which is unlocked and has fastboot mode in it. (take a look at the attached picture).

Files are here

Check again their partition location and write them with dd.

What you are risking is to brick to 9008 mode which means that your phone will not even boot and needs to be restored (remote restore is possible for LGV35 but I am not sure about the cost of this service in China, International ones are about $30)
[LG V35 Guides, News, & Discussion] alex.coffen:
My phone is already rooted. What i wanna is just the xposed. Do you know a way to install xposed in my case? As we know, systemless magisk xposed is not an option.
[LG V35 Guides, News, & Discussion] vlad48:
No idea how to install it.
[LG V35 Guides, News, & Discussion] alex.coffen:
OK. Thank you again. You are a good man!

I will post here regarding the following and let you know if you do not mind. :)

(I just found you got your V35 unlocked. How did you do that? Can I use your method?)
[LG V35 Guides, News, & Discussion] alex.coffen:
[MENTION=629603]vlad48[/MENTION] OH MY GOD!!!!!

I am able to install magisk modules on my V35 now. Magisk works fine without any problem now.

I swear to god! I did NOT do anything!! It is just fixed!!!

Before I could not help to flashing the abl partitions, I went to magisk again and found it is back to work...

What happened?! It is self-cured?? After I failed to get in fastboot then phone switches slotA to slotB?? Anyway, my problem has been solved!

I really appreciate your kindly help so far. You are a good and patient man! I learned a lot.:good::good:
[LG V35 Guides, News, & Discussion] runningnak3d:
That warning message means that your bootloader is unlocked. The fact that you don't have full fastboot is a different issue. If your bootloader wasn't unlocked, you wouldn't be able to flash modified boot images.

So, now the big question is, how did they unlock the bootloader without the engineering abl.

If I were you, I wouldn't risk flashing the eng. abl just yet.

-- Brian
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=3167089]runningnak3d[/MENTION] actually he did not flashed boot images at all - this was done by a guy and I think it was via test-point he flashed only Magic patched image to slot A.
[LG V35 Guides, News, & Discussion] runningnak3d:
It doesn't matter how he got the patched boot image on the phone. There are two errors that you will get if you have a modified boot image -- the yellow one that he has. That indicates that dm-verity failed, BUT the bootloader is unlocked so the phone will boot. Then there is the dreaded RED message. That means you have a modified boot image, but you bootloader isn't unlocked, so you are SOL.

Starting with Oreo, phones that SHIPPED with Oreo, must have signed boot AND system -- not just dm-verity, they are checked for ARB as well now. So trust me, it is not possible to boot a modified boot image if your bootloader is locked. I almost bricked my V35 because I figured I would see if the G7 system image would boot -- no harm right -- it is just system. Now that we have Treble support, flashing system from any phone is probably going to work, since it is just a GFI image.

Well, that triggered the ol' RED warning, and said my phone would not boot. Luckily I had left laf alone, so I was able to recover.

TL;DR: You can't flash modified ANYTHING without an unlocked bootloader.

-- Brian
[LG V35 Guides, News, & Discussion] vlad48:
Many thanks for this clarification [MENTION=3167089]runningnak3d[/MENTION]! I was tricked to think that his bootloader is locked because he failed to dump anything via LGUP while on engineering one we achieved dump of all partitions via the same LGUP combo, also I think there is one member here who flashed engineering abl partitions and was also able to dump everything via LGUP... Really it is interesting how they managed to unlock this bootloader in China especially for AT&T model...
[MENTION=8443609]alex.coffen[/MENTION] It will help a lot if you can dump via dd and share your abl partitions.
[LG V35 Guides, News, & Discussion] engMTW:
---------- Post added at 12:49 PM ---------- Previous post was at 12:48 PM ----------

For $20, you can get your very own engineering bootloader remotely, it seems. https://2.taobao.com/item.htm?id=58...195193.1997079397.9.49251407N6jayi&abbucket=6

Another seller appears to be doing mail in rooting, which is less interesting. https://item.taobao.com/item.htm?spm=a1z10.1-c.w4004-2241735512.1.4a0a4b32FA4Aym&id=582657768753

Very interesting that that specific seller can do the T-Mobile variant, which the other seller cannot do. They also have a listing for the V35, G7, V40, etc. https://item.taobao.com/item.htm?spm=a1z10.3-c.w4002-2231978258.41.24bf3c30yJMjkE&id=584617493981
[LG V35 Guides, News, & Discussion] runningnak3d:
I am trying to find someone that can actually setup the order for a remote unlock, then I can sniff the traffic and figure out how they are doing it.

-- Brian
[LG V35 Guides, News, & Discussion] engMTW:
A TaoBao broker can do this! Lots on Google. I've used https://www.bhiner.com/ before, but it wasn't for a remote service. If I had to use a broker for this, I'd use someone I could chat with first. A service like https://www.ebay.com/itm/Import-fro...rvice-Help-buy-Assistant-Broker-/253204292611 would probably be good. I'd message them on Skype and explain first.

I have a feeling that you could actually purchase this without a broker, just using the Taobao app on an android phone. They take international payments.
[LG V35 Guides, News, & Discussion] herb9876:
I feel like a square trying to get into a circle regarding these service links. I have a couple V35 AT&T let me know if i can help in any way.... How do you pay for this remote service hell how do you find a clickable link nevermind payment .... ?
[LG V35 Guides, News, & Discussion] engMTW:
Buying and contacting the seller through the mobile app works without a broker and with a US card. I can do it on iOS without issue, just gave it a test. I don't actually have a V35/G7/V40 to use this service with, though. If you need help with the involved language barrier, let me know.
[LG V35 Guides, News, & Discussion] runningnak3d:
That would be awesome!

I can PayPal you the money if you can set it up.

I will PM you all the details.

Dude, you get mad props for helping out.

-- Brian
[LG V35 Guides, News, & Discussion] engMTW:
Okay! I can buy the service or I can show you how to buy it, whichever you want. :)
[LG V35 Guides, News, & Discussion] bacon612:
I reached out to these guys on Skype but no reply yet. I have a payment in to a broker (superbuy.com) to get in touch with another remote unlock service on Taobao that reviewed well. [MENTION=3167089]runningnak3d[/MENTION], check your telegram

I'll report back here with my findings
[LG V35 Guides, News, & Discussion] alex.coffen:
Let me know if I can provide anything to help you figuring out how to unlock the bootloader.
[MENTION=629603]vlad48[/MENTION], the abl partitions you can get here :

https://drive.google.com/file/d/1BPEWfBkVitoFDfRaqCpGZNkhh8aCecKU/view?usp=sharing

https://drive.google.com/file/d/1y09rqzJqBg1LPyryo4iiASR6o9xCQ4Oi/view?usp=sharing

So, my bootloader is unlocked but fastboot is missing. Do you know how I can get a working fastboot? Since I may need it in the future, current signaling of my phone is bad with band 3, I will try to change the baseband when there is a new one available.

Regarding the taobao services, as far as I know, if I want to root LG V35, I need to pay 280 CNY which is $40+... The taobao services provider can root your phone remotely.
[LG V35 Guides, News, & Discussion] bacon612:
So this ebay broker just got back to me on skype. Surprisingly, they claim to not speak chinese. I still have my order into www.superbuy.com for this unlock service so we'll see.

Edit: Superbuy doesnt want to touch this. Looks like it will have to be taobao direct.

I spoke with [MENTION=8443609]alex.coffen[/MENTION] and he is actually in China and can help us with communication if we need it. Looks like we have some options here...
[LG V35 Guides, News, & Discussion] wangke525:
Is there a twrp for v35?
[LG V35 Guides, News, & Discussion] vlad48:
1. You will get fastboot if you flash the engineering abl I shared already with you.

2. Try open the service menu via dialing *#546368#*350# -->Field Test -> Modem Settings -> LTE Band Selection and enable all bands

Yes there is boot image patched with Magisk and TWRP which was already tested and confirmed working on the engineering V35 we have, but I have no idea if it will work for you - you need to be bootloader unlocked for sure.
[LG V35 Guides, News, & Discussion] alex.coffen:
>> Try open the service menu via dialing *#546368#*350# -->Field Test -> Modem Settings -> LTE Band Selection and enable all bands

In the LTE Band Selection there are "Band1", "Band2"..., no option like "enable all bands". And I googled, for example, if I click "Band1" here, then the phone will use Band1 only, will not switch to other Bands automatically, and no way to restore.

Do we have this page: 5457#*600# like this for G6, I tried 5457#*350#, failed to get in any page.
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=8443609]alex.coffen[/MENTION] just try and check them all or if it does not allow you check with different band combinations and see if your reception goes better. Also as you are roted you can use this app to pinpoint the bands which will improve your signal reception.