yashsingh1/xdaforums huggingface dataset:
[LG V35 Guides, News, & Discussion] ChazzMatt:
Exactly.

If it works like the US998 V30, clicking those bands will lock you onto one band with no easy way to restore auto select. Do NOT touch any of those bands.
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=8443609]alex.coffen[/MENTION] Nearly forgot that you are on AT&T firmware those steps can be performed only if you are on Google Fi - actually then you will be able to check/uncheck bands you want to use. Thanks also to ChazzMatt for pointing this out!
[LG V35 Guides, News, & Discussion] runningnak3d:
Just an FYI - I bricked my V35, and am now waiting on a replacement.

I needed to null out a partition, and so I found an old non A/B KDZ that had the right offset, but apparently it was on the wrong LUN (or the ol' "pull the USB cable" trick didn't work).

What is sad is that I found out AFTER the fact that the ERSE opcode still works, and I could have just used that.

I did still have download mode, so before shipping the phone back, I did wipe laf_a and laf_b just to see if that would get into fastboot -- nope, not anymore. If you wipe laf now, all you get is the nasty RED warning.

Anywho -- I should have a replacement phone in a few days.

-- Brian
[LG V35 Guides, News, & Discussion] alex.coffen:
Sorry to hear about this. This is also what I worried about so I tried to take every step carefully. My replacement phone is LG G4 H815 which I dont want to use any more. CPU is slow and full of lag...

Do you want me to ask a price for taobao seller who claims to be able to unbrick any LG devices? Ping me privately if you want.
[LG V35 Guides, News, & Discussion] herb9876:
Hey Brian I sent you a pm let me know if I can help
[LG V35 Guides, News, & Discussion] alex.coffen:
[MENTION=3167089]runningnak3d[/MENTION]， [MENTION=629603]vlad48[/MENTION], [MENTION=4429707]bacon612[/MENTION]

I soft bricked my phone today just because I installed the xposed edge module and I checked "forbidden the navi bar" (my bad!!)in it. After I rebooted, I got black screen and only long press power button "reboot, shutdown, airplane mode" could work.

I tried to enter xposed safe mode, still got black screen. I also tried "adb", didn't work! I had ran out of my options.

Then I have to REBOOT TO STOCK RECOVERY:crying:(I want to erase my private data then delivery my phone to provider 2000 km away)，then I figured out something:

1. In my situation, after I restarted to recovery, it would erase all my user data for no doubt;

2. After 1st reboot, I saw my bootloader was still unlocked. But I opened magisk manager, I can see that "Magisk not installed". I think I have ****ed up;

3. Then I reboot again, after the 2nd reboot, I went to magisk manager again, I can see "Magisk installed!" and root works, but the issue that I can not install modules came back:(

4. Then I clicked "yes" to "need to install addition xxx for Magisk", then I was able to install modules again;

5. Here, my phone was back completely.

So the worst situation I may meet in the future is ging to recovery and erase data. After that I can still get root back:):)!

6. DO NOT check "forbidden the navi bar" in the xposed edge! instead we can use command "wm overscan 0,0,0,-140" in shell terminator to disable the navi bar in the safe way.
[LG V35 Guides, News, & Discussion] a652311279:
Hey Brian

i saw chinese guy said them flash engineering model ABL and FTM partition to unlock fastboot then get root in G7.

they also said the root must rely on the octopus box

I hope the info will help u:)

sorry my bad english
[LG V35 Guides, News, & Discussion] vlad48:
I have hit the button, but again many thanks [MENTION=4862086]a652311279[/MENTION]!

Octopus box is needed only for V40 flash and bootloader unlock solution.

For V35 and G7 I think octopus is not needed at all.

It will help a lot if the guy can share just a hint on how he gains the temp root for flashing bootloader files, but I doubt he will reply...
[LG V35 Guides, News, & Discussion] jwrezz:
This was a very interesting read. Subscribing in case there is more news!
[LG V35 Guides, News, & Discussion] 9264:
I bought this phone two days , it likes yours rooted but no twrp so I am afraid flash magisk addmod but I installed xposed it works well.

I just want know which can we used in masgik .

Sry for my bad English
[LG V35 Guides, News, & Discussion] alex.coffen:
You can use all magisk modules. There is no problem at all.
[LG V35 Guides, News, & Discussion] bacon612:
[MENTION=629603]vlad48[/MENTION] this post has the link to the eng abl we are thinking of trying to flash to these Chinese rooted v35s?
[LG V35 Guides, News, & Discussion] alex.coffen:
You have got your phone from China? Please tell me the result if you flash the abl from the link.

Currently, we both face a problem with lack of fastboot in our phone. I really want the full fastboot and then we can try to boot to the twrp for G7 or V30.
[LG V35 Guides, News, & Discussion] bacon612:
I am working on this now, Alex. I flashed the eng abl successfully and now have functioning fastboot. I am unable to boot twrp from the one created for alex in this thread. Phone boots normally instead of booting twrp but is updated magisk 18.1 insead of my normal boot (non fastboot boot) which is magisk 18. The good news here is that for these taobao rooted v35s, flashing eng abl unlocks fastboot.
[LG V35 Guides, News, & Discussion] a652311279:
Hey bro.

Can you flash the abl partitions and try to unlocked bootloader？
[LG V35 Guides, News, & Discussion] alex.coffen:
OK. I had PM you about how to reach me via weChat before. Please invite me and then we can talk.
[LG V35 Guides, News, & Discussion] bacon612:
No my bootloader was already unlocked.
[LG V35 Guides, News, & Discussion] runningnak3d:
Because recovery is embedded in the boot image, you have to boot with a flag passed so that it will start recovery. I can't tell you how since I have never had a phone with an SD845 proc and fastboot.

However, now that you have fastboot, your phone is pretty much unbrickable (the only partitions you can't wipe out are xbl*, abl*, devcfg*). But as long as you are only messing with boot, system, and laf -- you can always recover your phone.

If that boot image boots, go ahead and flash it to boot_a and boot_b, and then you can try to reboot to recovery -- either one of the apps, or use the key combo. Make SURE that all of your data is backed up in case something goes wrong and it wipes your phone.

Then if you want to try a ROM, grab one of the G7 ROMs, extract it, and flash ONLY system. It should at least boot, I am curious as to how much actually works once it is booted.

Lastly, I am still looking for the magic combination that will allows the rest of us to root, but I am starting to think without a USB capture, it is going to be a LONG time. I am one person, those Chinese companies that find these exploits have tons of devs.

EDIT: just to be clear, you have NOTHING to worry about as far as losing root, and not being able to get it back now that you have fastboot. Fastboot boot and fastboot flash are your friends :)

You could flash a stock KDZ *minus* abl (partition DL, select all, then unselect abl_a and abl_b), if for some reason you wanted to. Do not EVER flash abl now that you have the engineering abl.

Afterwards, you would boot to fastboot and flash the boot image that has TWRP, then you can boot to TWRP and root again. That is just to give you an idea of how you can try different things, lose root, but be able to root your phone again. Full fastboot is a wonderful thing ;)

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
[MENTION=3167089]runningnak3d[/MENTION], what are your thoughts on flashing Google Fi firmware with LGup now that I have unlocked bootloader and fastboot? I'd like to get away from at&t firmware and be able to flash something stock but newer.
[LG V35 Guides, News, & Discussion] runningnak3d:
See my edit on the above post. I was making it when you made this post -- lol.

EDIT: also, I can't emphasize this enough, make a FULL backup of your phone before flashing anything. Since the DUMP option of LG UP won't work, and the --dump option of lglaf won't work either until me or [MENTION=5545101]steadfasterX[/MENTION] figures out the new authentication of laf, you will need to use dd.

Boot to TWRP, and:

adb shell
cd /dev/block/bootdevice/by-name
ls

For each partition in there except for userdata:

dd if=<partition name> of=/sdcard/<partition name>.img
exit

Obviously replace <partition name> with each name you get from ls.

Once you have the backup, you need to get it off your phone:

adb pull /sdcard/<partition name>.img

Again, do that for each partition, and SAVE that somewhere safe.

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
Thanks again for this explanation. I have flashed that twrp image to boot_a and boot_b. I then booted and installed 'easy reboot' for root users, which i have used in the past. When i prompted 'easy root' to boot to recovery, it just boots the phone to fastboot and not twrp. Am I missing something? I want to flash the rctd disabler and no verty-opt-encrypt in twrp but cant seem to get into it.

---------- Post added at 05:03 PM ---------- Previous post was at 04:51 PM ----------

Am I able to do these backups from within android using adb since I can boot twrp?
[LG V35 Guides, News, & Discussion] runningnak3d:
So you flashed the boot image and can't get to TWRP?

It needs to be done from TWRP because a phone booted to the OS is using things like your efs partitions.

-- Brian
[LG V35 Guides, News, & Discussion] runningnak3d:
Tomorrow I will make you a boot image that you can fastboot boot. It will be tethered TWRP because you won't be able to flash it, but it will be something till I can get mine rooted and can look into why that boot image isn't working.

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
Yes. I flashed that TWRP img from [MENTION=629603]vlad48[/MENTION]'s AFH to both boot_a and boot_b.

I was thinking that the full backup would have to be done from a pre boot environment like TWRP.
[LG V35 Guides, News, & Discussion] runningnak3d:
Have you tried adb reboot recovery or the key combo?

Those recovery reboot apps may not work with TWRP in the boot image.

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
adb reboot recovery yields the same result. Phone boots to bootloader, not TWRP.

Edit: Throwing it out there,

boot_a_mt.img | by vlad48 for V20

https://androidfilehost.com/?fid=1395089523397918381

thats the img i flashed. My v35 is running AWM10f firmware
[LG V35 Guides, News, & Discussion] runningnak3d:
It is booting to fastboot because that is the default if a valid boot image can't be found, so something is wrong with the way he injected TWRP.

In the old days that was a way to get to fastboot .. wipe out laf and then try to boot to download mode. Now LG just pulls all fastboot commands (unless you have an engineering bootloader ;) )

-- Brian
[LG V35 Guides, News, & Discussion] alex.coffen:
I think before we can select "recovery" in the fastboot mode by pressing the volume+/-, and then press power button to get into the recovery.

Does it work?
[LG V35 Guides, News, & Discussion] bacon612:
No
[LG V35 Guides, News, & Discussion] alex.coffen:
[MENTION=3167089]runningnak3d[/MENTION],

Hi Brian,

I agree that we can inject twrp into the boot.img and then we can fastboot boot and even flash it. Could you please teach us how to inject?

I guess that we can use HxD editor to open the original boot.img and replace the old recovery with twrp image.

But how can we know the address where the recovery is located? There should be a file to record the recovery address and its size in hex value. Do you know where I can find it?

/Alex
[LG V35 Guides, News, & Discussion] alex.coffen:
[MENTION=3167089]runningnak3d[/MENTION],

Hi Brain again,

I am a new bird so I want to learn some basic knowledge on LG partitions, which could make me not do things blindly. Is it possible to tell me a little bit more?

Correct me if I was wrong:

1. fastboot is in the partition other than abl or boot partition. So there is just a "flag" in abl partition to lock/unlock the fastboot. Right?

2. abl partition = bootloader? Suppose if we flash the android P, abl for android N also works for P?

3. Now the phone is running on slotA. And I want to run on slotB and hope slotB also can unlocked bootloader, rooted, full fastboot supported. So I only need to make abl_a/b and boot_a/b identical? no more other partition needed?

4. If I want to replace the baseband, what partitions I need to flash?(I want to try baseband for Google FI in my ATT, maybe get better signal)

Thanks very much in advance.

/Alex
[LG V35 Guides, News, & Discussion] runningnak3d:
No, you don't hex edit the image -- it gets extracted, and then TWRP replaces the stock recovery, and a few other changes are needed, then it gets packed back up.

If you are interested, google abootimg

1 - No, fastboot is in abl.

2 - see 1

3 - yes, but the Fi version may need the Fi firmware as well. You won't hurt anything to try flashing just system though.

4 - Yes and no. On the V20, some changes had to be made to get the Nougat engineering aboot (what used to be abl) to work with Oreo.

5 - *IF* the V35 even gets Pie, the Pie boot image will have to be used, but that isn't an issue. The issue could be #4.

6 - Yep, you can switch to slot B and boot a completely different ROM. A/B was meant to allow updating the phone while it was running, but we can use it for multi-boot.

7 - modem

-- Brian
[LG V35 Guides, News, & Discussion] runningnak3d:
OK, so I downloaded [MENTION=629603]vlad48[/MENTION]'s boot image to see what could be wrong with TWRP -- and twrp is 0 bytes, so something went wrong with the compile. [MENTION=629603]vlad48[/MENTION] did you compile that yourself?

With that said, try this G7 twrp image: G7 TWRP

It is not meant to be flashed because it boots directly to TWRP so you would never be able to boot your phone ;)

If it works, go to this thread and thank [MENTION=5646556]J0SH1X[/MENTION].

The G7 laf boots fine on the V35 (the V35, G7 and V40 are almost identical hardware wise -- at least as far as booting and using TWRP), so this should as well. It certainly won't hurt to try until I can get around to making one for this phone. You can also try his persistent TWRP if you want. The worst that is going to happen is that your phone either doesn't boot, or something doesn't work in the OS. If so, you just flash a valid V35 boot image and you are good, and keep using tethered TWRP for now.

To use it, get into fastboot and:

fastboot boot TWRP.img

TWRP should come up and you can flash / install whatever you want. I will get around to looking into making a boot image that can both boot the OS and boot TWRP, but right now rooting this thing is my priority.

If you do flash this TWRP image to boot_a and boot_b, you will be stuck in a TWRP bootloop and you will need to flash a valid boot image from fastboot to get your phone to boot to the OS -- so really, don't flash it ;)

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
Thanks for your continued efforts, Brian. Good to know why vlads img isnt working too.

As for [MENTION=5646556]J0SH1X[/MENTION] twrp image, when trying to fastboot boot it, it just hangs on the LG logo at boot so something is still not right.
[LG V35 Guides, News, & Discussion] runningnak3d:
Hmm that is strange. It makes no sense that G7 laf will boot (even tested the EM laf first), but this won't. Anyway, it more than likely is the kernel, so I took his TWRP build and packed it up with a V35 kernel.

You can download that here. Again, do not flash this, just try to fastboot boot it.

EDIT: again, I intend to build TWRP specifically for our device, but TWRP compiled for the SD845, and with A/B support *should* just work. Again, for now, my efforts are going to finding a way to root this thing without sending it off to China.

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
Another observation and question. When booting [MENTION=629603]vlad48[/MENTION] twrp image (or flashing it to a and b, which i did) when my phone boots, i get this error message. It doesnt appear to affect the operation of the device at all but i just thought to mention it. Screenshot of error attached...

Is there somewhere that I can get the stock boot.img for v35 since i am reckless and didnt back up my original before flashing vlads?

Edit: Downloaded the twrp-test.img from your AFH and tried to boot it. It still hangs but quicker than vlads. This one hangs at the black and white 'LG v35 thinq" screen whereas vlads would get to the red LG circle logo.
[LG V35 Guides, News, & Discussion] runningnak3d:
The upload was hung -- it should be there now.

To get the stock boot image back, just grab the KDZ for the firmware that you are running and flash just boot_a and boot_b. You will, of course, need to root again.

If you are running the AT&T firmware that doesn't have a KDZ, just grab the Fi KDZ. Tis up to you if you want to flash the whole thing, but I would wait till you get a back up.

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
Since these 350AWM's are all running at&t firmware, its my understanding that there are no KDZs. That said, eventually, i do want to flash Fi firmware as we'll be able to continue to update the device without At&t's nonsense. I will, however, wait until I have a working TWRP so I can do backups before trying to crossflash.
[LG V35 Guides, News, & Discussion] runningnak3d:
The one I uploaded didn't boot?

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
Sadly, no. See edited post #95
[LG V35 Guides, News, & Discussion] runningnak3d:
Well that makes no sense. BTW - I assume you meant the G7 TWRP image, not vlad's.

Anyway, until I have a device I can debug on, TWRP is going to have to wait. :(

-- Brian
[LG V35 Guides, News, & Discussion] bacon612:
I did mean the G7 TWRP image, yes. Vlads just boots through to Android but no TWRP.

No worries on the wait. I'll be patient. Good luck with the exploit hunt. :svetius:
[LG V35 Guides, News, & Discussion] alex.coffen:
[MENTION=3167089]runningnak3d[/MENTION], Brain,

Many thanks for your reply.

Now I am trying to use your posted tool KDZ extractor to unpack the Fi KDZ to get moderm.img with "-s" option.

So I can first backup my own moderm_a and moderm_b first by dd command and then flash the ones below from KDZ to my phone by dd also? Then I can get the Fi's baseband?

python2.7 ./undz -f kdzextracted/V35010e_00.dz -l | grep modem
37/223 : modem_a_774.bin (58854612 bytes)
56/242 : modem_b_99318.bin (58854612 bytes)
python2.7 ./undz -f kdzextracted/V35010e_00.dz -s 37
python2.7 ./undz -f kdzextracted/V35010e_00.dz -s 56

I need the better signal for band3 which Fi may be able to give to me:)
[LG V35 Guides, News, & Discussion] runningnak3d:
Yes, you can *try*. However, you may get the dreaded "green screen of death" because the modem isn't just the baseband -- it handles things like the fingerprint sensor as well, so it *may* need all of the Fi firmware.

If it works -- great, if it doesn't the worst that you will have to do is get to fastboot and flash your modem back.

-- Brian
[LG V35 Guides, News, & Discussion] alex.coffen:
I saw in some chinese forums they always backup modem, xbl, xbl2 for baseband flash, for v30. and someone bricked phones (only 9008 restore)when cross flashing baseband...

do you know what are the xbl and xbl2 for?

EDIT: I find some articles to describe that xbl. Now I only know xbl contains something linked to the chips and protocol. So it should has something to do with the baseband I guess. But I will not try to flash xbl cos I do not want to go to 9008 mode with any possibility.

I also found that the size of modem_a.img from Fi(0758CFFFF) is smaller than the one in ATT(0B5FFFFF). In this case, should I try the replacement? And after address 0758CFFFF in ATT's modem.img, there are not all 0es, which I guess I cannot use "fastboot flash modem_a modem_a_NEW.img" directly. Instead I need to execute "fastboot erase modem_a" before that?
[LG V35 Guides, News, & Discussion] bacon612:
So with some help, I managed to get TWRP booting on my V35.

Here is the img:

https://www.androidfilehost.com/?fid=1395089523397934026

Issues with it are that when flashed to boot_a, it wont boot to anything but TWRP. Obviously, when fastoot booting it its fine. If anyone wants to check it out, its there.
[LG V35 Guides, News, & Discussion] alex.coffen:
I tried. Yes we can boot into TWRP, but this version of TWRP does not decrypt data(It even did not ask pin code for me), so I cannot see anything in sdcard or internal flash.

I think the newest TWRP version solved this problem, which can let us input the pin code to decrypt our phone? Can you try to patch the new TWRP?
[LG V35 Guides, News, & Discussion] bacon612:
So when i use TWRP to format data, upon the next boot, i get an error saying that the decryption is unsuccessful and LG erases the phone.

I didnt have anything on it as its not my DD. I am going to look into copying the no verity.zip with DD and flashing it with fastboot now...
[LG V35 Guides, News, & Discussion] TheIronMaiden:
It would be a crazy idea to compile custom roms with twrp and root built in, flash using a modified lgup app. to bypass the locked bootloader. But I'm not knowledgeable in this area, sadly, wish I can help out. Good luck, gentlemen. You guys are so close.
[LG V35 Guides, News, & Discussion] runningnak3d:
It is looking more and more like the only way to root this phone is with jtag. I am still looking into some kernel exploits, but for now, I think sending your phone to China is the only way.

I think I will buy one from China already rooted so I can use fastboot to make finding an exploit much easier, and I don't risk bricking another phone.

-- Brian
[LG V35 Guides, News, & Discussion] siulmagic:
How do they bootloader unlock it remotely thats my question, its black magic i tell you.
[LG V35 Guides, News, & Discussion] runningnak3d:
If it is possible to do it remotely, I will eventually figure it out, but as I said, that is much easier when I am not worried about bricking a phone :)

There are hard bricks (9008) and soft bricks. If you have fastboot, there are no soft bricks you can't recover from.

However, if you don't and you lose download mode, and your phone won't boot to the OS to take an OTA update, you might as well have a hard brick .. that is what happened to my last v35.

-- Brian
[LG V35 Guides, News, & Discussion] siulmagic:
I see i am temped to buy a lg v35 and try this guy out:

https://www.ebay.co.uk/itm/133007274478
[LG V35 Guides, News, & Discussion] runningnak3d:
Awesome find. I will buy it, and then sniff the USB and network traffic to find out what is done .. IF they will do it remotely to the US.

-- Brian
[LG V35 Guides, News, & Discussion] siulmagic:
Let me know how it goes.

Edit:Btw that link i found is from someones signature here.
[LG V35 Guides, News, & Discussion] vlad48:
It is simple - you disassemble your phone (Must have removed back cover and middle frame ( 10 screws ) to get access to battery connector ( this is very important to reset after Qualcomm QLoader 9008 state) and shortcut the testpoint to achieve 9008 then engineering abl is flashed via JTAG remotely.

My guess is that remote service in China is using same pattern for (G7, V35 and V40) but they found a way on erasing a partition via LAF and bring the phone in 9008 mode remotely.
[LG V35 Guides, News, & Discussion] runningnak3d:
Wiping a partition to put the phone in EDL is easy. Getting the firehose to program is the missing piece. If I can get these guys to do it, I can grab the firehose from the USB sniff.

It is interesting that they say you have to pull the battery to reboot. I am guessing the PBL on these things doesn't have a reboot command.

-- Brian
[LG V35 Guides, News, & Discussion] alex.coffen:
Hope you get your phone rooted and figure out how they can do it!