[LG G Stylo Questions & Answers] haise.zero:
There hasn't been a post from us in a while since development has been contained in the Discord.

For those who don't want to join to check in, here's where we're at:

- `fastboot oem` commands are not available from fastbootd, as with `fastboot flashing` commands. On top of that, fastbootd is **not** the bootloader, but just fastboot alone. The bootloader is not able to be booted, as LAF boots first. Booting bootloader from recovery sends the device back to system. We can get a root shell with SteadfasterX's lglaf, however, there are pretty much zero commands that we can run through it outside of the actual LAF commands, and we don't know enough about the arguments in bytes just yet to actually do anything with this.

- The Stylo 6 does not have an EDL mode that we've been able to find. That being said, we do have a suspicion that it's contained in laf as among other things; see below.

- The LGE Serial Port that gets mounted in download mode from laf accepts ATtention commands (AT commands). While it varies from what it will mount as when we have it in modem mode (use the PDM option in LGUP 1.16 with up to the 2.x dll after using the UI config and its addon) it still responds accordingly despite not showing up in device manager as a modem. This indicates that the laf partition has multiple modes of operation and that it, in some places at least, utilizes AT commands, likely to boot back into download mode (AT%DLOAD) after running the PDM option and writing an IMEI, etc as well as flashing a new KDZ.

- While we haven't been able to consistently replicate this across our devices and LGUP installations, LGUP actually will read the device when it is in modem mode. I have several options like HIDDEN MENU and a couple of others that are greyed out in download mode, but become available in modem mode. However, every option asks for the SPC code of the device and unfortunately there's not a whole that I've seen that would allow me to retrieve my device-specific SPC code. If anyone has a method of doing this that happens to be more modern or still relevant, let me know please.

- Crossflashing Android 10 and even 11 devices is in theory possible as it does not actually depend on any server side requests, but rather a TrustZone ID unlock of the device itself (referenced in lgup as a TZ ID Unlock). We believe it's contained within the DLL file itself to undergo that operation although we have not discovered exactly how to invoke that or where it is just yet.

- LGUP is packed with a Themida version from 2012. If anyone can unpack that, we can deobfuscate it ourselves and from there have very neatly written code that will help explain what we're actually looking at.

- Apparently download mode is not "normal" as when I go to dump the device it claims that this process only uses "NORMAL MODE." I have no idea what normal mode would be in this case.

- The hidden menu referred to in LGUP is apparently not the same one used in the dialer. Mastercodeon managed to get his toggled and working, and when he invoked said hidden menu it gave him essentially a single option, which was to enable the modem port even when in userspace, i.e connecting via USB in the home after unlocking his device mounts his phone as an LG phone as well as an LG modem.