yashsingh1/xdaforums huggingface dataset:
[LG G6 Guides, News, & Discussion] Rafeh:
Thanks [MENTION=507687]wassname[/MENTION] . Root works on Oreo rom. But Not on H873 PIE ROM.
[LG G6 Guides, News, & Discussion] wassname:
Mine passes saftey net without this (SU98) installed and failed with it installed. So yeah.

---------- Post added at 12:20 AM ---------- Previous post was at 12:18 AM ----------

Ah thanks. So it looks like you probobly need an Oreo rom with Security patch date 1 Sep 2019 or less.
[LG G6 Guides, News, & Discussion] Rafeh:
Although I got root but adaway not working. Unable to change hosts file. Idk why. I tried manually too but not working
[LG G6 Guides, News, & Discussion] 6addri:
Will this work on the Korean variant of g6? LG doesnt provide bootloader unlock for it too
[LG G6 Guides, News, & Discussion] MexHH:
Got the app installed but root install says failed.

I am on V20h-TWN-XX, 8.0.0, 1 April 2019 security patch
[LG G6 Guides, News, & Discussion] demod_oz:
oh man.. I have been waiting for this for ever! I have a certain app that I forgot the password too and I wanted take a backup of that app.

I installed SU98 and it failed. running from adb shell shows as per link.

I'm running V7.0 - patch level 1 October 2017. Sw version V10m-TWN-XX

Is there a way to roll back to an earlier patch level?

edit:

oh damn... maybe I need to update..

edit2:

So I have an OTA V20c-JUL-25-2018 Oreo update available. Has anyone tried this version on the H870DS?
[LG G6 Guides, News, & Discussion] Redick 27:
Yeah, but only at oreo, in pie it doesnt work
[LG G6 Guides, News, & Discussion] demod_oz:
Thanks again for this.. I just got my G6 rooted.

I'm not sure if it was just me, but I followed your instructions and had the apk say fail down the bottom. So I ran su98 via the shell to compare output and it ran succesfully, but I still didn't have root. I then had to run the apk app via the phone gui, and it installed the su. After that I had root, and have now successfully backed up an app that I have lost passwords to. Safe at last! :) Still cannot get into it, but hey I've more options now! :)

My phone was running Nougat V7.0 - patch level 1 October 2017. Sw version V10m-TWN-XX - Too old for exploit.

Upgraded via OTA to V20c-JUL-25-2018 Oreo. patch level 1 July 2018, sw version V20c-TWN-xx

Also had to disable play store from removing su98.

Thanks all! I can't believe its taken this long!
[LG G6 Guides, News, & Discussion] dioadi:
[MENTION=3529827]demod_oz[/MENTION] Can you help me on how to run su98 via the shell?

I also experience the same fail message when installing root from the app gui.

Edit:

Nevermind, I get it works for my VS998 LG G6.

It's just as demod_oz mentioned, execute su98 from root shell first

adb push su98 /data/local/tmp

adb shell

cd /data/local/tmp

chmod 755 su98

./su98

Then reinstall su98 from the app, it will now successfully installed.
[LG G6 Guides, News, & Discussion] ExtatikK:
Long time listener, first time poster.

I'm at an impasse here with my progression. I'm in fwul, and the confusion I'm encountering is with the wget (link) that doesn't seem to exist. Now I've read a ton of this thread and I can't seem to find anyone addressing that particularly, so thusly leading me to this post.

**Edit**

By the point it says to extract parts.zip I'm totally at a loss. I have no file with that name and haven't been able to find anything through further research.

-thanks in advance!
[LG G6 Guides, News, & Discussion] 6addri:
Thanks for your post. [MENTION=507687]wassname[/MENTION] I got my G6 rooted. OS version : 8.0 Oreo G600LR20d, Security patch April 1, 2018.

But I cant modify /system (remount /system r/w) so I can't use adaway and root checker says my phone rooted.

This is the command I typed via adb shell.

lucye:/storage/emulated/0/Download # mount -o remount,rw /system

mount: '/dev/block/dm-0'->'/system': Device or resource busy

How can I solve this problem?

and btw, can I install root management apps like superSU here?
[LG G6 Guides, News, & Discussion] sayefchamp:
[MENTION=507687]wassname[/MENTION] , with the method you shared I gained root.

But I want to ask that can we install twrp using flashify app from play store or flash superSU app using it....????
[LG G6 Guides, News, & Discussion] rcky844:
Wait will this work with H870DS?

---------- Post added at 02:10 PM ---------- Previous post was at 02:09 PM ----------

You can dump me the stock recovery, I will make TWRP for your device
[LG G6 Guides, News, & Discussion] zark32:
[MENTION=10273523]TipzTeam[/MENTION] can you make TWRP for G600K Korean version too?
[LG G6 Guides, News, & Discussion] rcky844:
What's that model? And dump me a stock recovery file please!
[LG G6 Guides, News, & Discussion] zark32:
that model is LG G6 LGM-G600K South Korea version, btw sorry for noob question but how can I get the stock recovery file? and for installing TWRP it is possible to install it without unlocked bootloader?
[LG G6 Guides, News, & Discussion] rcky844:
No, you need a unlocked bootloader to install TWRP.
[LG G6 Guides, News, & Discussion] rcky844:
See the LB Recovery Porting Project, I will port it for your device.
[LG G6 Guides, News, & Discussion] patweck:
How can I install the custom recovery if I don't have my bootloader unlocked? LGM-G600K bootloader cannot be unlocked
[LG G6 Guides, News, & Discussion] sayefchamp:
how to dump stoc recovery....???

I don't know how to.....
[LG G6 Guides, News, & Discussion] rcky844:
You can dump it from the kdz file if you are not rooted.

But I can dump it myself so no problem I think I made it

---------- Post added at 01:22 AM ---------- Previous post was at 01:20 AM ----------

Yes it is possible to unlock that device's bootloader. First try ail devbootloader@lge.com and provide you IMEI number. Also tell them it is a H870.

If it doesn't work, then wait for 200 brain cells human to explain and exploit the unlock.bin
[LG G6 Guides, News, & Discussion] lawong:
no we cant do that, they know our variant just by the imei .
[LG G6 Guides, News, & Discussion] rcky844:
I know, but somebody I know that have an unlocked H870DS, we are trying to bypass unlock.bin rn.
[LG G6 Guides, News, & Discussion] Mohammad Jebreeni:
Hope you succeed guys!
[LG G6 Guides, News, & Discussion] rcky844:
Thanks
[LG G6 Guides, News, & Discussion] patweck:
Any news? Or progress? Your efforts are very much appreciated.
[LG G6 Guides, News, & Discussion] rcky844:
Umm, no we are trying to figure out which is public key and unlock key, just hang out for that thread.
[LG G6 Guides, News, & Discussion] ExtatikK:
Thanks everyone for their hard work. This rules that there's been progress. :) I did some tinkering of my own, but I fear I'm not quite up to snuff.

I did have one question though, were someone able to help. I got through the initial steps all the way to where it says to use the LGLAF program in which I can't access the phone in the slightest... That I've been over on GHub and no solution there that I found for my own issue.

As per my device though, I don't seem to have any fastboot commands on the remote end. I get the "remote Error: Unknown Command" for most commands I attempt... Tried to extract the aboot image and read the available options, but didn't quite accomplish that feat. Screens attached for software references.

I'm using MX's latest release and Win10.

And this is the disposition of my device so far.

https://ibb.co/1z07nfz
https://ibb.co/Jz0qMJk
https://ibb.co/d4T9f4w
[LG G6 Guides, News, & Discussion] rcky844:
Did you unlocked your bootloader already, maybe it is a bootloader corruption or just redownload the fastboot package, here's how:

Windows:

Just download them from Google

Ubuntu / Linux:

Get the package fastboot for Ubuntu

Search online for other linux
[LG G6 Guides, News, & Discussion] ExtatikK:
Title

It's on the remote side in the phone. Computer side sends flawlessly. Remote end returns unknown command. It sure does know it's locked still though. I've tried to -f the flash command lol. Just in case, as if that wouldn't be something that god and everyone had already done were it to work. The only oem commands I can get to respond are OEM lock which returns with the command failing due to it already being locked, and then the string to get the ID# for LG Dev team.

This phone thinks it's an 870kebb__, while saying in system settings in the gui that it's a v20, and doesn't have the ID that you can getvar in the boot loader... It's sincerely confused.

EDIT**

and I have debian based MX distro dual booted... I don't ubuntu. I don't see the benefit of ubuntu were there to be one either.
[LG G6 Guides, News, & Discussion] rcky844:
is oem unlocking enabled?
[LG G6 Guides, News, & Discussion] ExtatikK:
Yes, I'm 1000 and 3 percent sure that oem unlocking is enabled. That brings me to a question that's not particularly relevant, but how come theres a button for oem unlocking when it, in fact, does not live up to its namesake.

**Edit** please forgive all the questions. I have been a creeper for years and am just now realizing the grave error of my ways.
[LG G6 Guides, News, & Discussion] patweck:
If I update to pie rom will the root work?
[LG G6 Guides, News, & Discussion] ZyraTavish:
Any update on this?
[LG G6 Guides, News, & Discussion] packyman:
hello, would this rooting method work on my european h870 model?

I would unlock it official via lg developer account, but I got error because ID mismatch between device ID and IMEI.

I checked my IMEI, its right. I have ordered the phone as refurbished via aliexpress, I think its not so official as sold.
[LG G6 Guides, News, & Discussion] ExtatikK:
Titley Goodness

Update on my sitch, I'm currently with my phone denying any access from lglaf. Can't figure for the life of me what the hell to do. But it's returning this error code:

-(LAF_ERROR_ACCESS_DENIED)

Funny thing though is when I lsusb to find my phone while it's in download mode as described by OP, I get this:

-Bus 001 Device 003: ID 1004:633a LG Electronics, Inc. Ultimate 2 Android Phone L41C

That's an old trac phone, I have come to find out. So I'm not entirely certain of what the hell I've done to the identity of this guy, but he's confused.

-- Thanks in advance for help. It's been many hours pouring over this... Were I only better at this, I'm sure I'd have cracked it.
[LG G6 Guides, News, & Discussion] lui112:
After installing SU98, I can't install bin file via SU98. Can you guys help?
[LG G6 Guides, News, & Discussion] lui112:
After using adb installing SU98, I can't install the bin file.

My phone Oreo version. LG6.

V20a-HKG-XX

Kernel: 3.18.71

Security: 1 May 2018
[LG G6 Guides, News, & Discussion] lui112:
I can't install file after running SU98 on phone.

How do you manage it?

I type commend

adb push su98 /data/local/tmp

but error saying SU98: No such file or directory.

Pls help
[LG G6 Guides, News, & Discussion] :
Hey. In order to push, you must put the file "su98" in the same folder as "platform-tools", or whatever you renamed your adb folder to. It should work after that. Once you get root running, make sure to check if you have issues rebooting. If not, next time you install su98, make sure to check the box that ensures that su98 installs on boot.
[LG G6 Guides, News, & Discussion] lui112:
Thanks a lot. I put the file in the correct directory and root successfully.

But I find a problem. I want to move app to the system didn't work. I can't set Mount /system RW, using adb command or apps.

Is that there are limitations of the root as it can't unlock bootloader?
[LG G6 Guides, News, & Discussion] :
I'm not exactly sure what you mean, but, please, keep inind that this is not only temporary, but also does not work with all apps. For me, Adaway doesn't work properly, though the root-booster app I'm using does.
[LG G6 Guides, News, & Discussion] lui112:
I mean I can't read/write the system partition. Adaway mine doesn't work either.
[LG G6 Guides, News, & Discussion] :
I'm not too experienced in the BTS of rooting/programming, but it sounds like that's because of the bootloader lock. All we can do for now is try our best to unlock it, and finally get the most out of the phone we put out money into. Cross your fingers, as some people are working on it as we type, I believe.
[LG G6 Guides, News, & Discussion] AliJawadAbidi:
Dude where did you get H870 and H918 kdz from I am trying to unlock the bootloader of my VS988.
[LG G6 Guides, News, & Discussion] jafferkhan:
Why would you need that firmware if you're trying to unlock a Verizon phone? Just curious because I too have the Verizon version that I wanna unlock and root...

Thanks

---------- Post added at 07:54 PM ---------- Previous post was at 07:53 PM ----------

Wishing you best of luck. Will happily donate when something concrete comes along for the Verizon version
[LG G6 Guides, News, & Discussion] Slushi:
Hi, I'm a first time poster. I recently got a AS993 phone and am currently trying to get it rooted myself, though unsure if there are any more updated methods currently since the OP seems to have gone missing. If anybody could redirect me to any updated information on this it'd be more then appreciated! I'm too scared to really proceed with the information currently provided cause I don't want to brick the phone as I just got it in the mail today. (I did read through some of the posts and I don't think I saw anything really mentioning AS993 which is why I'm genuinely curious)
[LG G6 Guides, News, & Discussion] flyingv1982:
[MENTION=3167089]runningnak3d[/MENTION] [MENTION=10273523]TipzTeam[/MENTION] Can it be useful? https://www.zdnet.com/google-amp/ar...ffects-seven-years-of-lg-android-smartphones/
[LG G6 Guides, News, & Discussion] runningnak3d:
I almost wasn't going to reply to this because this is embarrassing. All the time I spent reversing aboot / abl and I didn't see this because I didn't care about changing the boot image -- so I just skipped right over looking at that part of the code. There were many requests to change the boot image, and if I had listened, I would have stumbled across this. I am humbled.

Anywho -- with that said, yes, absolutely. It will take some time to find the offsets, but the G6 can have full EL3 .. that means running unsigned firmware / firmware signed with any cert (with the exception of xbl since that is still verified by the PBL).

So, the process would go something like this:

* Use lafsploit to write a modified raw_resources that contains the code required to disable sig checks.

* Use lafsploit to write TWRP

* Reboot and enjoy your now unlocked phone.

At that point you could run TMO firmware on any other model that used this exploit, and vice versa. Finally be able to flash US997 (or any other model) firmware on a TMO. The only exception being xbl, but again, that is just a loader and doesn't affect the functionality of the phone.

Stay tuned -- I am going to contact the author of that exploit and see if we can pool our resources to unlock as many LG phones as possible. I can't tell from the article if that is something he would be interested in or not -- but stay tuned.

EDIT: Just want to be clear about something. There are still eFuses in the CPU that determine things like what bands are available on the radio. So just flashing a modem *may* not be good enough to unlock all bands on a particular model. Also, there is still the chance that running modem firmware from another model would brick your phone (soft brick -- since after this exploit, it would no longer be possible to brick a phone unless you upgraded / overwrote xbl or flashed / modified the raw_resources that will be released).

Also, for those reading the the above article, xbl is what used to be sbl1 on older LG phones.

-- Brian
[LG G6 Guides, News, & Discussion] rcky844:
Hey there, also we got root access with a misc partition exploit
[LG G6 Guides, News, & Discussion] JerryFeik:
I have a g6 sprint and I'm waiting for a method to unlock the bootloader or/and get root
[LG G6 Guides, News, & Discussion] brickhayabusa:
[MENTION=10869381]JerryFeik[/MENTION] you'll wait forever if you ask that way....
[LG G6 Guides, News, & Discussion] JerryFeik:
I apologize for the way I said it :mad:
[LG G6 Guides, News, & Discussion] Slushi:
Thank you for finally responding about this. I'm sure you'll do a great job and hopefully we'll get to see more work with this done in the future. May I ask though as a AS993 user should I wait for this to be worked on more or should I do the prior method mentioned with the original post? Hope it's not too much trouble to ask!
[LG G6 Guides, News, & Discussion] motitas:
Ready, set, glass brick

I am going to hop into attempting to unlock my BL on this LS993. I payed about $100 for a brand new unit. Would suck if it fully bricks but alas I am an iOS user...

I will report my findings back to this thread. I wish there was either a link to the files originally provided (scoured the git and there are no remnants) or at least some documentation of what they did. If anyone has clues please let me know. I know this project is mostly abandoned but I can see it's about 90% there.
[LG G6 Guides, News, & Discussion] flyingv1982:
Hello! Have your attempts been successful?
[LG G6 Guides, News, & Discussion] motitas:
[MENTION=5613926]flyingv1982[/MENTION]

So I have a lead on where we should be headed. I will post a thread with all my findings and all the best conceivable options in a couple of hours. I think that some advice from other devs can lead us to a solid rooting method. I am pretty sure we can do it at this point. I will also present some methods for the temp root.

It seems that we may be able to DD the partitions we need and I was able to source the us997 files we need.

Worst case scenario: Magisk Temproot

Best Case: Unlocked BL

For the moment I would highly recommend the pie rom and debloating using adb and the guide on this forum. You would be surprised how much bloatware and telemetry services are running in the background. Honestly I’m kinda upset at LG for collecting so much data without consent.
[LG G6 Guides, News, & Discussion] flyingv1982:
That's sounds awesome! Waiting for your findings!
[LG G6 Guides, News, & Discussion] Asif Murad:
Links are broken

I already bricked an H872 in unroot process, so is very careful this time with AS993. Can you kindly update the Links that mentioned in "Requirement:" since they are not working. Thanks a lot
[LG G6 Guides, News, & Discussion] JZX1GT:
Very curious about the turnout of this. Thankyou everyone!
[LG G6 Guides, News, & Discussion] patsonator:
I don't know how to execute theses commands. Plz help me. I'm using windows.
[LG G6 Guides, News, & Discussion] iods:
Hello everybody, the links for the root file doesn't work, does anyone have an updated link ? thanks
[LG G6 Guides, News, & Discussion] jthein1989:
I have to point this out, lol.

My nickname since I was a toddler is "dude".
[LG G6 Guides, News, & Discussion] diosdetiempo:
I will eagerly await H870DS being done with my mouse over the donation button :p
[LG G6 Guides, News, & Discussion] cheeze.keyk:
is this applies also to H870DS? :confused:
[LG G6 Guides, News, & Discussion] engMTW:
OP has been updated. Love to see progress being made on this.
[LG G6 Guides, News, & Discussion] runningnak3d:
The SD card I was using had bad blocks, so I have to go pick up another card (it was my LAST spare - lol).

Part of the flash process flashes, and then dumps and does a SHA check to make sure that if people (like I did) have bad SD cards, or noisy USB cables, etc. that you don't brick your phone.

Just one bad byte in aboot and you have a BRICK.

-- Brian
[LG G6 Guides, News, & Discussion] engMTW:
SD card failures are annoying as hell. Been there, done that.
[LG G6 Guides, News, & Discussion] runningnak3d:
And just like that -- a brick.

# dd if=/dev/block/sda skip=12294 of=/dev/block/sde bs=4096 seek=[B]35856[/B] count=32
# !CTRL POFF

That 35856 was supposed to be 35846 -- fat fingered typo......

16 [B]35846[/B] 35877 F65D4B16-343D-4E25-AAFC-BE99B6556A6D Unknown

I am going to try and see if I can get it unbricked remotely. If not, I will have choice but to return a brick. I am back at a standstill. *SMFH*

-- Brian
[LG G6 Guides, News, & Discussion] Blissey:
Damn that's bad ! :( still good luck !!
[LG G6 Guides, News, & Discussion] Zryxeon:
Hiya nak3d :)

I admire your effort - LG snould be running naked from you ;)

Know, I have an H870DS that I'm ready to sacrifice; Israeli variant if matters.

I hope you'll make it! If I'll send it to you, is there a chance it'll return rooted?

Thanks,

Rez
[LG G6 Guides, News, & Discussion] engMTW:
EDL probably still works. One of the usual types on eBay can likely fix it. Or you can just use the firehose package yourself, it it’s out there. No big deal.

Generally, if the thing pops up in Qualcomm mode, it can be fed the firehose. It can be force fed an image remotely with one of those DRM boxes even if it can’t get into Qualcomm mode. There’s one guy on eBay that can do it. I wouldn’t mind having the guy do it - I have plenty of G6es, I just really want root out there for everyone & would rather save you the effort of doing trying an unbrick yourself.

The G6 you have will take any US/Canada, non-Us997 firehose. AS993, H873, etc. But anyone with an Octopus has LG_LS993_19-08-2018_20-21-40.dump, which is correct for the model you have. Thumbs up, good luck.

If you can’t get it fixed remotely, I can send you another G6. :)
[LG G6 Guides, News, & Discussion] runningnak3d:
Well sh*tburger. The phone won't go into EDL. What I overwrote was part of devcfg which is a signed partition. EDL will not kick in under certain conditions -- like if you null out xbl or aboot, or if the chain of trust verification process gets into a loop. That is more than likely what is happening since the signature is what was overwritten. Has anyone found the "force EDL mode" pins?

Anyway, if you PM an address, I will ship it back to you. I am sorry man.

-- Brian
[LG G6 Guides, News, & Discussion] engMTW:
I’ll shoot you a return label when I get a computer.

Someone found the points for the V30. Don’t see anything for the G6. In the event that they are the same: https://www.google.com/amp/s/xdaforums.com/lg-v30/help/test-lg-v30-plus-9008-mode-t3884973/amp/

Edit: I see the same two pads in the same location after looking at a scan of a G6 motherboard, for whatever it’s worth.

---------- Post added at 04:53 PM ---------- Previous post was at 04:35 PM ----------

Updated my post
[LG G6 Guides, News, & Discussion] jthein1989:
Darn. I would love to help out more, but I can't send you my daily, lol.
[LG G6 Guides, News, & Discussion] Coxis:
Please no! I was getting so hopeful. :crying:
[LG G6 Guides, News, & Discussion] Blissey:
Seems Rip Our Last Hope :(
[LG G6 Guides, News, & Discussion] engMTW:
I've offered the OP another phone. Waiting for a reply.
[LG G6 Guides, News, & Discussion] Dr. Furet:
Thank you for your kindness! It's because of people like you that we can achieve that kind of thing! And we don't say it enough, thank you. Thank you so much! <3
[LG G6 Guides, News, & Discussion] Blissey:
Shame On LG !! But honestly feels nice we have nice Devs and Good Human Community !!! Hope brian crack this bootloader and root things for us peace ! :svetius:
[LG G6 Guides, News, & Discussion] engMTW:
Talked to the OP. Will be sending another phone on Monday/Tuesday. We're back on.
[LG G6 Guides, News, & Discussion] HkQc:
Send me your PayPal in Pm, I'll gladly pay you some beers! ;)
[LG G6 Guides, News, & Discussion] Arif.Hameed:
Did you send the phone?
[LG G6 Guides, News, & Discussion] HkQc:
Be helpful guys, nobody owes us anything, you know? :D
[LG G6 Guides, News, & Discussion] engMTW:
I am just waiting for the dead phone to be returned to me before I ship another. Relax
[LG G6 Guides, News, & Discussion] soad26:
All phones? So will this work with G600L korean variant?
[LG G6 Guides, News, & Discussion] dead-letters:
Wasn't root achieved on a h873?, if yes then why isnt the method out yet ?. Dying to root this phone and appreciating all the effort.:)
[LG G6 Guides, News, & Discussion] engMTW:
Good news - I got the dead phone back today. Going to ship another to the OP, he'll get it tomorrow
[LG G6 Guides, News, & Discussion] badmaan:
Thank you so much, you are so generous. :fingers-crossed: