yashsingh1/xdaforums huggingface dataset:
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=3167089]runningnak3d[/MENTION] A bit different output on another bootloader unlocked V35 (lglaf origin branch used):

[android@fwul lglafng]$ python3 lglaf.py
LGLAF.py by Peter Wu (https://lekensteyn.nl/lglaf)
Type a shell command to execute or "exit" to leave.
# whoami
# !EXEC toybox whoami\0
root
!EXEC /system/bin/toybox whoami\0
root
[LG V35 Guides, News, & Discussion] steadfasterX:
For the g4 I didn't used the new / changed Crypto lib that's why it isn't in the latest stable.

The latest FWUL nightly contains it though .
[LG V35 Guides, News, & Discussion] b8engl:
How come the output is different from my device to yours [MENTION=629603]vlad48[/MENTION]

b8engl@duploclique:~/lglaf$ git checkout develop
Already on 'develop'
Your branch is up to date with 'origin/develop'.
b8engl@duploclique:~/lglaf$ git pull
Already up to date.
b8engl@duploclique:~/lglaf$ python3 lglaf.py
LGLAF.py by Peter Wu (https://lekensteyn.nl/lglaf)
Type a shell command to execute or "exit" to leave.
# whoami
Hello, I am LAF. Nice to meet you.# !EXEC toybox whoami\0
Hello, I am LAF. Nice to meet you.# !EXEC /system/bin/toybox whoami\0
Hello, I am LAF. Nice to meet you.#
[LG V35 Guides, News, & Discussion] runningnak3d:
[MENTION=5566659]b8engl[/MENTION] That combination of firmware + laf doesn't work. You have to try another one.

[MENTION=629603]vlad48[/MENTION] The bootloader being unlocked doesn't open the toybox backdoor. So, there is something else that is different about that phone. Do you know what version of the firmware, and what version of laf? Even though it has an engineering bootloader, if we can find a similar combination of firmware + laf from what we are able to flash -- we might have something.

-- Brian
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=3167089]runningnak3d[/MENTION] LAF version is 1000013. Firmware is standard - 11i
[LG V35 Guides, News, & Discussion] runningnak3d:
lg-firmwares only has AWM10a. Do you have a copy of 11i?

I am going ahead and downloading 10a, and going to dig through it. USUALLY older is better, but not always since they may introduce exploits in later versions -- so having a copy of 11i would be good.

-- Brian
[LG V35 Guides, News, & Discussion] vlad48:
I think we should search for 11x firmware 11 stays for AT&T I think...

So to everyone here do you have an AT&T KDZ?
[LG V35 Guides, News, & Discussion] b8engl:
what's the point of doing this... I mean, how we are going to program the laf in the first place?
[LG V35 Guides, News, & Discussion] runningnak3d:
AT&T never releases KDZs. So, since it wasn't possible to make a dump, anyone (myself included) that has flashed a KDZ will never be able to go back to AT&T unless we figure out the dump authentication that is in laf now and someone that hasn't flashed can make a dump -- AND we are able to root so we can flash the partitions back.

Umm -- using LG UP.

-- Brian
[LG V35 Guides, News, & Discussion] b8engl:
Is there a way to view laf version on terminal? I got many backups, I need to figure out which one is it ...

Could you point me out to the new LGUP with common patched?
[LG V35 Guides, News, & Discussion] runningnak3d:
It is in the second post of this thread....

-- Brian
[LG V35 Guides, News, & Discussion] jwrezz:
Thank you all for all the work you're putting in to this phone. I love mine, especially for the camera, but hate the "LG-ness" of it. 8.0.0 is just not cutting it when I've got 5yo devices running Pie.
[LG V35 Guides, News, & Discussion] ChazzMatt:
Just bought an AT&T LG 35 from someone in this thread (perfect, mint, fantastic price) -- as they are buying a rooted one from China. My daily phone is still my rooted stock LG V30+ (128GB) US998, but this looks interesting now that [MENTION=3167089]runningnak3d[/MENTION] is involved. Even if root does not happen, I can eventually give it to my wife. I never bothered to unlock bootloader and root her 64GB V30 US998 as I only have time for my own phone. ;)

I just wish the V35+ (128Gb) was available in the U.S. or even on the Internet. I can find it mentioned (like that AT&T was supposed to carry it) but can never find it actually for sale, that can be shipped to U.S.
[LG V35 Guides, News, & Discussion] runningnak3d:
There are guys in China that will upgrade the RAM and storage for a reasonable fee. Once I figure out how to root this thing, I think I will go for the 8gig / 256gig upgrade.

-- Brian
[LG V35 Guides, News, & Discussion] TheDannemand:
After reading your first notes on SD845 security, I never thought V35 would see root. If you really manage to root this thing, it'll be the perfect phone: The best of V30 and V40, combined. Except the 64GB, as noted.

Unfortunately not many were produced (I assume) so the few units left on the market will fly off the shelves quickly.
[LG V35 Guides, News, & Discussion] runningnak3d:
For all the security that Qualcomm added, LG still has a gaping hole. It would be like building a 4 foot thick steel and concrete house, and then putting a wooden door in the back.

LG could make their phones unrootable, but they must have the worst security team imaginable.

-- Brian
[LG V35 Guides, News, & Discussion] TheDannemand:
Well that's just great. And I really am not being sarcastic at all. That IS just great :D

I had planned to keep my V30+ (T-Mobile H932UBK) for at least another year, probably even longer. But I am smelling a window of opportunity with the V35 that won't be there forever.

I've been reading up on the V35 forums (which we finally got) but still a bit confused about the models (US): Of course the V350AWM (AT&T), but is the Amazon and the Google Fi model the same (both V350ULM)? And are there reasons to avoid any of these?

I'm not too worried about bloat: I'll generally just remove it with ADB, even if I'm not rooted. I imagine they're all easier to SIM unlock than anything T-Mo... But I assume AT&T will never share KDZs for the V350AWM, so there's that.

Which one do you have yourself?

Sorry, I'll let you get back to more important work :o
[LG V35 Guides, News, & Discussion] bacon612:
Most of us have the Sim unlocked AWM (including [MENTION=3167089]runningnak3d[/MENTION]) as it's significantly cheaper and can be (mostly) crossflashed to ULM variant kdzs. Hardware is all the same besides the Korean variants, apparently. All models are presently bootloader locked but I have faith...
[LG V35 Guides, News, & Discussion] TheDannemand:
Excellent! Thank you for that information. That really makes it a lot easier that they can be cross-flashed. Does the cross-flashing SIM unlock it (as with V30) or must you negotiate with AT&T first to get an unlock code?

And from what I can see, looks like LTE band support isn't a concern either. Of course no B71 (T-Mobile 600MHz) but it'll be years before my area gets that anyway.

And yes, I too have faith, that's the whole reason I am now interested in V35.

Thanks again.
[LG V35 Guides, News, & Discussion] ChazzMatt:
Cross flashing apparently does not carrier unlock it. You need a code. But many dealers sell with it already carrier unlocked.

Sent via open market LG US998 V30/V30+
[LG V35 Guides, News, & Discussion] TheDannemand:
Got it, thank you. Yeah I'm just a little shell shocked with the problems SIM unlocking my T-Mobile V30+ (twice now after getting it back re-locked from LG repair, each time taking weeks to get T-Mobile to unlock it again).
[LG V35 Guides, News, & Discussion] ChazzMatt:
I understand. But the T-Mobile V30 H932 is just a little problematic. I've not seen similar issues with AT&T V30 or V35, especially when dealer unlocked.

Sent via open market LG US998 V30/V30+
[LG V35 Guides, News, & Discussion] TheDannemand:
Yeah, I know. T-Mobile's SIM unlock is known to be the worst, going back several models now. As you know, their phones can't be unlocked with a code (like everybody else) but only with a Device Unlock system app that queries T-Mobile servers. Problem is if the phone gets re-locked and/or gets out of sync with its recorded status on those servers, T-Mobile tech support and customer service have no idea how to fix it. And they don't realize that they don't know, so they'll just keep requesting Unlock the usual way (with a code) which simply triggers an email after 3 days telling you to use the Device Unlock app. Very frustrating. FCC complaint is the way to fix it: That's handled by TMO Executive Office, who strangely enough do know how to flip the right bit on those servers.

Sorry about the OT rant. Won't happen again (I think). Glad to hear that's not an issue with any of the V35 models :)
[LG V35 Guides, News, & Discussion] ChazzMatt:
Since you flashed the V35 to the Google Fi KDZ, does that now allow it to have all the Google Fi bands? Or is there any difference between AT&T V35 and Google Fi V35 bands? With V30 Frankenstein flashing the V30 AT&T H931 to US998 actually changed the phone entirely to US998, including bands able to be received.

LG V35 Google Fi bands

https://www.lg.com/us/cell-phones/lg-V350ULM-Google-Fi-v35-thinq

GSM: 850/900/1800/1900 MHz;

UMTS (HSPA): 850/900/1700/2100 MHz;

LTE: 1/2/3/4/5/7/8/12/13/14/17/20/25/26/28/29/30/38/39/40/41/66

I'm also curious why the Google Fi V35 LG.com specs don't show CDMA bands as I assume that would be a requirement to work on Sprint... Even Google Fi site won't confirm the bands it receives: https://fi.google.com/about/phones/#lg-v35-thinq

LG.com says it has CDMA, but then doesn't list the CDMA bands section like it does for US998, etc
[LG V35 Guides, News, & Discussion] TheDannemand:
I am guessing Google Fi only switches to Sprint when there is Sprint LTE signal, which doesn't require CDMA support (to my understanding).

Edit: Hmm... but the phone would still need to be provisioned on the Sprint network, which I thought was negotiated through CDMA. Either way, good question!
[LG V35 Guides, News, & Discussion] UncleJoe1985:
Just got a cheap AT&T V35 off eBay after losing my Galaxy S5. The main reason I want to root is to use it as a development platform for the Hexagon 685 DSP (1024bit SIMD), which unfortunately requires the QDSP shared libs to be signed using LG's private key, due to the processor completely lacking memory protections.

I've been reading this thread and the other longer one. I'm new to rooting, but know a lot about OS internals. Here's my understanding of what's been tried or could be done.

1. Flash an engineering bootloader using LGUP to enable FastBoot

2. Soft root using vulnerability finder (is that what the TaoBao/Aliexpress service exploits?). Are there automated programs similar to nmap to scan for root exploits in the kernel or processes running as root?

3. Reverse engineer an existing bootloader and insert code to give write permissions to / or upload a completely custom bootloader that implements FastBoot. Is this possible or will the modified bootloader get rejected because the signature doesn't match?

What's the progress?
[LG V35 Guides, News, & Discussion] Iantuition:
I'd like to know the progress as well. Just got a V35 and V30 as possible warranty replacements for a V20 (long story). If root is on the horizon, I'll keep the V35 (which would then be perfect). If not, I'll keep the V30.
[LG V35 Guides, News, & Discussion] vlad48:
So far the progress is the same as like 5 months ago - bootloader unlock and root afterwards can be achieved only via flashing the needed files with JTAG box while the phone is in 9008 mode.
[LG V35 Guides, News, & Discussion] Iantuition:
Sheesh. From the last page it looked like there was hope. Guess I'll keep this V30 until I can sell it. This trash front camera just isn't gonna do it for me.
[LG V35 Guides, News, & Discussion] ctheanh:
It's just amazing for the first step. Thank you.
[LG V35 Guides, News, & Discussion] jtsurfs:
Seems there is someone over in the G7 forum who can unlock bootloader using Octoplus. Having the bootloader unlocked would help, right?
[LG V35 Guides, News, & Discussion] Redline:
I assume you're all aware of the below linked thread on 4pda.ru?

http://4pda.ru/forum/index.php?showtopic=951883&st=0

There is an XDA thread as well:

https://xdaforums.com/lg-g7-thinq/how-to/to-unlock-bootloader-root-models-t3928505

LG V35 - V350AWM, V350ULM

LG V40 - V405UA - Sprint

Are listed under the successfully unlocked devices. Teamviewer is listed as a requirement, so it looks like they do it remotely.

Perhaps one could inquire what they'd be willing to sell the required software for, and we could start a bounty to reach that? Notwithstanding the obvious hesitations to give money to a stranger over the internet :P

Would be cool to be able to have the V35 and/or V40 as open as the V30 family is.
[LG V35 Guides, News, & Discussion] vlad48:
I think I can brief you a bit again...

All those threads mentioned above are linked to a JTAG box solution which flashes engineering abl_a and abl_b while the phone is in 9008 mode.

(While for V35 and V40 9008 is easy to achieve via button combo, it is not so easy to perform the same for some LG G7 models.)

As far as I know the guy from the threads above is offering this service for free, so you just need to have a windows running machine with TeamViewer installed and plugged in phone in 9008 mode.

So far there are 2 ways to make this work without JTAG "box":

1. Finding a way of gaining a "temp root" and flash the abl files. (so far an exploit has been found, but not made public)

2. Dump the loader and firehose from those so called 'boxes' and repack it for further usage.
[LG V35 Guides, News, & Discussion] hooutoo:
Does anyone know of (provide link) or heard of a successful BL unlock on the v35 ATT via the 9008 method? I've left a PM with motogvasyag in hopes he'll contact me but so far nothing?
[LG V35 Guides, News, & Discussion] bacon612:
There's a few guys who will do it. Pm me and I'll point you in the right direction
[LG V35 Guides, News, & Discussion] Semitope:
Any updates? I want to try using Titanium backup to restore my whatsapp since the app wont restore my in app backups.
[LG V35 Guides, News, & Discussion] ChazzMatt:
FYI:. [MENTION=3475147]SGCMarkus[/MENTION] is one of our main V30 ROM devs... Reposting this from V30 thread.

____

OK. Thanks.

Originally he had asked about G6 root and ROMs, which I knew wasn't viable for DS models.

I admit for G7, I assumed -- since I know they're never going to be listed for official bootloader unlock code and WTF won't work for that either.

I see this G7 thread was just started earlier this month, so I'm not too far behind:

https://xdaforums.com/lg-g7-thinq/how-to/to-unlock-bootloader-root-models-t3928505

Sent via open market LG US998 V30/V30+

---------- Post added at 05:49 PM ---------- Previous post was at 05:21 PM ----------

Then why isn't this being discussed in the V35 forum? [MENTION=3167089]runningnak3d[/MENTION]? You know about this?

I have a V35...
[LG V35 Guides, News, & Discussion] brigantti:
[MENTION=3167089]runningnak3d[/MENTION]

any hope for lg g7 tmobile?

your are our only hope to get root on this phone
[LG V35 Guides, News, & Discussion] jazir:
[MENTION=629603]vlad48[/MENTION] The link for the engineering bootloader ABL says it is for the v20, is this incorrect? Is this the same engineering bootloader the teamviewer guy is using to root the G7? Can i flash this ABL myself so i can root my G7+(model EAW)?
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=6598534]jazir[/MENTION] Yes this is the engineering abl for V35.

So far, the only way to flash it if you are not bootloader unlocked is to use one of those JTAG boxes while the phone is in 9008 mode.
[LG V35 Guides, News, & Discussion] jazir:
[MENTION=629603]vlad48[/MENTION]: Would this tool remove the need for a jtag box? Why is a JTAG box currently considered required to flash the bootloader while the phone is in 9008 mode?

edit: forgot the link: https://xdaforums.com/android/software-hacking/tool-salt-lg-revolution-t3717864
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=6598534]jazir[/MENTION] I think I was clear enough stressing it for the last time now:

No other way of flashing abl apart from using JTAG.
[LG V35 Guides, News, & Discussion] jazir:
[MENTION=629603]vlad48[/MENTION]

I understood what you said, i am asking why that is the case. Why does it require a JTAG box to flash the bootloader?
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=6598534]jazir[/MENTION] well I think it is obvious why and crystal clear if you care to read this thread and have no problems with understanding it on technical level, anyway long and detailed answer:

So our task is to overwrite abl partition and let us review the methods of achieving this known so far:

1st method - using fastboot will not work because bootloader is locked and operation is not allowed.

2nd method - LAFsploit or other LAF tools is not working because of new security signature check and exploit patched.

3d method using an exploit which will give you temp root access to flash it via dd is not working because there no exploits avaliable so far.

4th method using microsd force recovery flasher is not working because it now checks signature.

5th method is gain access to whole phone internal partitions having Qualcom loader and firehose for SD845 and write the needed partition while phone is in dedicated Qualcom 99008 mode and only working so far.
[LG V35 Guides, News, & Discussion] jazir:
[MENTION=629603]vlad48[/MENTION] I don't know if this could help, but this page lists some of the vulnerabilities of the SD845

https://cxsecurity.com/cveproduct/14/38835/sd_38__34__35__firmware/

This also looks potentially promising: https://xdaforums.com/yureka/help/question-qualcomm-download-mode-k-t3068040

Fixed second link*
[LG V35 Guides, News, & Discussion] moises93:
Hi guys, I have both ATT V35 and Octoplus Box, so where can I find the procedure to give this bootloader unlocking a shot? Also if anyone might find any dumps useful with octoplus box let me know and I can do so!
[LG V35 Guides, News, & Discussion] dave71670:
Here. https://xdaforums.com/lg-g7-thinq/how-to/to-unlock-bootloader-root-models-t3928505/page26

The unlocked v35 bootloader is attached within the thread.
[LG V35 Guides, News, & Discussion] vlad48:
Process for V35 on Oreo so far:

1. Enable OEM unlock in Dev Options.

2. While in Android and plugged to your Windows PC via USB press both vol - and power button a shutdown counter will pop up.

3. Just after the counter dissapears and the screen goes dark release vol - and start pressing vol + if the screen will remain dark you are in Qualcomm 9008 mode (you can check your devices in device manager)

4. Start Octoplus and in partition mode replace abl_a and abl_b which you can find in post#2 of this thread.

5. Hold power and vol- again and after the phone reboots quickly release power button while still pressing vol - you will enter into fatboot mode.

6. Start CMD on your win machine and execute:

fastboot oem unlock

(if the command fails check your USB cable and your fasboot exe version and try again)

Optional: You can flash also engineering LAF to enable full partition DUMP via LGUP etc.

Good luck!

P.S.: If any issues PM me or search for LG V35 channel...
[LG V35 Guides, News, & Discussion] volitank:
Will this work for the V350ULM as well? And to make sure I'm understanding this correctly all I have to do is buy one of https://octoplusbox.com/en/products/box/ and then follow your steps and I can unlock the bootloader? How does the box work? I've never used on before. Do you connect the box to the computer and then the phone to the box?
[LG V35 Guides, News, & Discussion] vlad48:
Yes, it works on all V35 models.

You need to buy box which supports JTAG so it will be this one

The box itself gets plugged to USB on a Windows working machine and afterwards scans for available device in respective mode - here is a sample video...
[LG V35 Guides, News, & Discussion] volitank:
Okay and the phone hooks up to the box with the USB C or do I have to do some soldering? Comes with wire and a circuit board. Sorry if these should be known, I've never done JTAG before.
[LG V35 Guides, News, & Discussion] vlad48:
Yes. the phone hooks via USB-C. No case openings, soldering etc.
[LG V35 Guides, News, & Discussion] volitank:
Sweet that doesn't seem bad then. Are there good benefits to doing this? I don't see any custom roms or anything. Can you install twrp after unlocking? ect.
[LG V35 Guides, News, & Discussion] vlad48:
Well TWRP is long time available but it is useless with stock LG ROMs, because of different encryption pattern in stock vold and TWRP.

LOS16 also can be easily build thanks to V40 and G7 developers, but again here comes the question - what purpose you are using your V35 and do you actually need all this stuff...

P.S.:I am happy enough with my tweaked stock rooted ROM...
[LG V35 Guides, News, & Discussion] volitank:
For sure, the stock rom isn't bad, I wouldn't be upset just having rooted stock rom. I just really like Lineage OS. This is the first phone I've ever had that was hard locked down. Came from nexus 6 and nexus 5x and had it on both. cyanogenmod on all my phones before that. It just bugs me a little bit that I'm not allowed to have root on a device that I own.
[LG V35 Guides, News, & Discussion] ChazzMatt:
Thanks, I didn't know V35 had TWRP. No one ever mentioned it, that I saw in this thread. Maybe I just overlooked it.

With V30 you can disable LG encryption, reformat, install TWRP and enable TWRP encryption -- if understand correctly. Mine is currently unencrypted.

You can't do that with V35?

I love TWRP for backup and restore reasons.

Sent via open market LG US998 V30/V30+
[LG V35 Guides, News, & Discussion] patato21:
Who has an octoplus pro box with jtag and willing to help me?
[LG V35 Guides, News, & Discussion] volitank:
If someone will do that I'll ship $40 easy. I don't really want to buy the whole thing.
[LG V35 Guides, News, & Discussion] Shawnashley:
TWRP exists for V35? The device isn't listed on TWRP device list. How is it possible?
[LG V35 Guides, News, & Discussion] ChazzMatt:
Unofficial TWRP, like for many devices. Same for LG V30.

Every LG V30 (Joan) variant has bootloader unlock, TWRP and root. And we've had TWRP since 2017.

But you won't find TWRP listed for LG V30 as it's somewhat a pain to get official recognition and not necessary.

Sent via open market LG US998 V30/V30+
[LG V35 Guides, News, & Discussion] Eric janaika:
Question: What's the process for rooting the V35? I assume first step is asking [MENTION=8187877]motogvasyag[/MENTION] to unlock the bootloader which he has been so graciously doing. But in the closed G7 thread, he states that you lose fastboot (and my V35 doesn't seem to have that anyway). Someone else asked how you root without fastboot/TWRP, and the answer was use Magisk to modify and flash the boot image. Root isn't required to flash the boot image? What happens if the bootloader isn't unlocked? It won't flash? Or you brick your phone by flashing an unsigned image?
[LG V35 Guides, News, & Discussion] vlad48:
Sadly for V35 there is no out of the box images which have fast boot enabled (Like G7 ULM for example) so the process is:

1. Flash V35 Oreo engineering bootloader and unlock. (If bootloader is locked you can not permanently modify any of phones partitions.)

2. Fastboot flash magisk patched boot image to enable root.
[LG V35 Guides, News, & Discussion] Larethio:
If Remote Service is available for the V35 whats the best provider?
[LG V35 Guides, News, & Discussion] vlad48:
[MENTION=6424316]Larethio[/MENTION] Search in reddit or ask folks in LG V35 TG channel for a guidance.
[LG V35 Guides, News, & Discussion] X-Nemesis:
https://xdaforums.com/member.php?u=8187877

Send him a message and go from there.
[LG V35 Guides, News, & Discussion] hachiroku:
deleted comment
[LG V35 Guides, News, & Discussion] dave71670:
Deleted