yashsingh1/xdaforums huggingface dataset:
[LG K10 Guides, News, & Discussion] OficerX:
https://drive.google.com/file/d/158G2a-xX_I3USwlIbxGw0mMUKsO_TaYU/view?usp=sharing

Use these strings to find video_printf

then look for references to "undefined abort, halting", "data abort", "prefetch abort", "unhandled syscall".

these are directly followed by call dprintf, change them to call video_printf

https://drive.google.com/file/d/1xCKjLaXFYoGimKmoeQojRtHRI9ZBhSGB/view?usp=sharing

Next call (here sub_4601C90C) is to function that dump registers and stack contents.

https://drive.google.com/file/d/1iLNVs-ntfjW33UhHWslRP8jSWWNPYS16/view?usp=sharing

Change all dprintf calls to video_printf.

Flash exploit and patched lk then reboot.

Your device should boot into directly into bootrom, then run unlock procedure, your device should resume booting and proceed to loading LK from.

Device after leaving bootrom should enter for a moment into preloader download, so before flashing anything you can use pl.py --identify command to check if SBC, SLA and DAA are all off to check if unlocking works.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Correct me if I'm wrong but the addresses to change the secure boot are the same right?
[LG K10 Guides, News, & Discussion] Rortiz2:
Hey,

Could you check those links? The second and the last one aren't working and I'd like to see how the function that dumps registers looks like (as reference).

Thanks :good:
[LG K10 Guides, News, & Discussion] OficerX:
I'm 99% sure they are, I found this while reversing seclib from MT6535, it turned out these addresses are valid for my SOC, your SOC is very similar to my and MT6535, so I think should correct.

But you can find it by looking for reads from 0x10206060 (efuses).

See here

https://drive.google.com/file/d/19kqoLTT0nKR7vmf9AwwHOy6ihKjqEoNo/view?usp=sharing

As you can see it checks for these values and if they match it disables secure boot.

https://drive.google.com/file/d/19ITt5NV9EZggnFjfbUmf_cp5WCPBG_m_/view?usp=sharing

https://drive.google.com/file/d/1JeBjTOwTOjdjBTZkQmaP22edgZEKPiBE/view?usp=sharing

Oops, forgot to set permissions, now it's working.
[LG K10 Guides, News, & Discussion] Rortiz2:
Thanks you! :)

BTW, secure boot addresses are different for mt8163:
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Hi, I think that the option to modify the LK and modify the printf will take some time for now because unfortunately I don't have the knowledge and skills in using such a powerful tool as ida pro, another option that I you had advised, the UART via micro USB, it is not the first time I hear it and once I have already tried to build a UART with a micro usb cable but unfortunately I have not obtained any logs from the devices and I think I have built it wrong , I'll probably get a pre-made one from a shopping site. A friend of mine advised me not to use the microusb cable because it "probably" doesn't get the logs from a crashed LK.

So I ask you that you are probably sure or you have tried it, but UART via microusb is a good option?

From fastboot if I do "fastboot oem p2u on", fastboot responds and confirms so I can be sure my device supports UART. If anything you have any tips or tutorials to build a uart cable correctly?

My UART adapter is a CP2102, okay?

(P.S: My micro usb connector doesn't have a wire ID, ONLY D+, D- and GND and VCC)

(P.S2:Do you have any tips or tutorials to disassemble the binary well in ARM)
[LG K10 Guides, News, & Discussion] OficerX:
On my device at first I was booting modified LK, it was very slow process, at one point I couldn't move further, I had working exploit running my payload but I couldn't make it boot Linux (later it turned out that it did not load DTB, I added call to bldr_load_dtb and it worked then), device was just hanging.

I updated to Oreo, LG added crash handler so I did'nt have to boot patched LK anymore and this significantly sped up everything.

I could'nt use UART because LG disabled it.

When device boots preloader checks whether proper cable is connected and either switches USB into UART or leaves it as it is, but in my case this feature was disabled at compile time.

You can check in linux source in usb phy driver code that performs mode switch and then check if preloader or LK has it.

P.S. Now I have partially working UART, I enable it in payload (see microloader/linuxboot), it works (TX voltage goes high to ~3.3V), but I cannot get output till Linux boots, I still need to figure it out.

This won't help you in making exploit but can help later during kernel development.

If you won't get UART working then I think that patching LK is all you have left.
[LG K10 Guides, News, & Discussion] Rortiz2:
Maybe you need to patch the cmdline? I don't know, I'm just throwing some ideas.
[LG K10 Guides, News, & Discussion] OficerX:
I already did that, UART works in Linux, it doesn't work in LK, it's enabled but there is no output, I need it to get working as early in boot process as possible to debug 64 bit kernel (for it's not booting at all)

My UART driver must faulty.

I turned in Linux most stuff related usb, gpio, clocks into no-op and UART is still working.

Right now i'm porting TWRP, but whem I finish it I will try again with uart.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Ok if patching the LK is the only option, is there a tutorial or guide for using IDA Pro? As already said unfortunately I don't know how to use it and therefore I want to learn but I don't know how to do it
[LG K10 Guides, News, & Discussion] Rortiz2:
Gotcha.

Can I ask you something?

I'm able to find video_printf (FUN_41E24C4C):

But i'm not able to find out the dprintf calls :confused: I swear IDA/ghidra aren't correctly parsing the strings (maybe because bad offset?):

Do you have ideas of what I could do?

Thanks!

EDIT: Same for the register/stacks :(

What are your load options? I'm using 0x200 as file offset and 0x41E00000 as base (in your case it's 0x46000000).
[LG K10 Guides, News, & Discussion] OficerX:
My version (I think it's 7.0) doesn't support assembling of ARM code so I have to patch by hex editing.

To check if your version supports it try if "Edit -> Patch Program -> Assemble" works, I newer used this so I can't help you here.

I if it doesn't then you can look for plugins, maybe some implement assembler for arm, otherwise you can either craft instructions by hand or use gcc to compile your instructions, objdump compiled code and enter it through IDA hex editor.

When I will get my computer back working, I will send you detailed instructions on how to do that.

P.S. You can try ghidra (I don't know if it's better or not, never tried it)
[LG K10 Guides, News, & Discussion] OficerX:
Go to beginning, your code should start by series of jumps, follow first jump, there should be STR instruction something like STR R6, [someaddr] this is absolute pointer pointing to where boot argument is located, your LK base will be that - offset of bootarg, you can check LK code on github as reference.

Now I can't help you much but I will send you pics when I get my computer working again.

It's also possible that code is using indirect addressing like global offset table, you can find exception handlers by beginning from second jump and following calls, see LK boot and exception handling code, since it's written in assembly should be very similar if not the same.

See partinfo.py and partdump.py tools in my repo, your lk is probably divided into lk, cert1, cert2, partinfo will show you proper offset and size.
[LG K10 Guides, News, & Discussion] Rortiz2:
Got it working I think.

Thanks, my problem was the pre-BFBF header in the image. I removed it, loaded the image (base 0x41E00000 and offset 0x200) and this time all looks ok :good:

As for cert1, cert2 I don't think my lk includes those:

Cheers.
[LG K10 Guides, News, & Discussion] OficerX:
I'm glad you got it working.

cert1 and cert2 are used for secure boot, i'm sure you have least cert1, could you please send me your lk so I can later check it? It's bug in tool.
[LG K10 Guides, News, & Discussion] Rortiz2:
Sure, check attachments.

Regards.
[LG K10 Guides, News, & Discussion] OficerX:
Thanks.
[LG K10 Guides, News, & Discussion] CXZa:
Same problem in this link... 5.png?
[LG K10 Guides, News, & Discussion] OficerX:
Fixed
[LG K10 Guides, News, & Discussion] OficerX:
Here you have instructions:

First you need to whether code you want to patch is ARM or THUMB.

You do this by doing ALT+G and checking value of T, if it's 1 then code is THUMB.

Here is one liner that generates code, compiles it and makes hexdump

for thumb:

(sed '1s;^;.section .text, "ax"\n.thumb\n.syntax unified\n.global _start\n_start:\nbl 0x46032DAC - ;' | arm-none-eabi-gcc -Ttext=0x0 -nostdlib -o _temp -march=armv7-a -xassembler - && arm-none-eabi-objcopy -O binary _temp /dev/stdout | od -t x1 -An -) <<< 0x4601CB96

for arm:

(sed '1s;^;.section .text, "ax"\n.arm\n.global _start\n_start:\nbl 0x46032DAC - ;' | arm-none-eabi-gcc -Ttext=0x0 -nostdlib -o _temp -march=armv7-a -xassembler - && arm-none-eabi-objcopy -O b

inary _temp /dev/stdout | od -t x1 -An -) <<< 0x4601CB96

You only need to change 0x46032DAC to address of yours video_printf, last address is address of instruction your patching.

When you have hex dump open hex view in IDA, synchronize it with dissassembly (right click then "Synchronize with"), press F2 to start editing code, press again F2 to apply changes, then go back to dissassembly and check if call is valid.

If you need to revert patch go to "Edit -> Patch program -> Patched bytes".

When you done to apply patches to file go to "Edit -> Patch program -> Apply patches to input file"
[LG K10 Guides, News, & Discussion] XRed_CubeX:
delete
[LG K10 Guides, News, & Discussion] OficerX:
I have working TWRP, it boots, mounts system, can load aromafm from SD card,

internal SD and data partition not working, everything else not tested yet.

https://drive.google.com/file/d/1UuqsiPEO5-49fghbJAOzFqnRUuhBaNi5/view?usp=sharing

Image has microloader injected already.

It still needs lk payload, I'm working on removing that requirement.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I am using IDA from windows and WSL, I ran that command from ubuntu and it generated a "_temp" file and another "lk.bin-sign: Zone.Identifier".

After this step I got confused, I don't know how to get the address of my video_printf and I don't know where to change it, probably from what I understand I have to change the address of the command you told me with that of my video_printf
[LG K10 Guides, News, & Discussion] OficerX:
You need to replace 0x46032DAC with address of your video_printf, then for every call instruction you patch, you replace 0x4601CB96 with address of instruction you are patching.

I told you before how to find exception handler and video_printf so I quote my previous post.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Hi, I was able to modify the LK correctly but there are problems:

If I put my device in bootrom mode and flash the LK with the command:

"sudo python3 flash_lk_payload.py bin / lk_payload.bin"

I get the error:

"ERROR CMD_WRITE32: 0x01

failed to disable watchdog "

Instead if I use the command:

"sudo python3 flash_lk_payload.py -b bin / lk_payload.bin"

I get the error:

"ocr = 0x000000

ocr = 0x40000000

Traceback (most recent call last):

File "flash_lk_payload.py", line 64, in <module>

main ()

File "flash_lk_payload.py", line 48, in main

mmc.mmc_init ()

File "/home/xredcubex/Downloads/lgk10exploit-master/plib/mmc.py", line 578, in mmc_init

print ('ocr =% # 08x'% ocr, flush = True)

TypeError:% x format: an integer is required, not NoneType "

On plib / mmc.py in line 578:

"print ('ocr =% # 08x'% ocr, flush = True)"

Adding the # in front, and redoing the command, the command goes ahead and reboots my device, however when I disable secure boot, my device boots normally in Android, at this point what should I do?
[LG K10 Guides, News, & Discussion] Rortiz2:
Hey,

I also managed to patch LK without problems (if somebody also used ghidra as me, use this script to save the patched lk). However, I don't think this is working. I flashed my boot image with microloader and invalid offsets (0xFFFFFFFF) to force a crash but the tablet just loops in the BQ logo without any stacktrace..

Maybe I need to modify something..? I'm pretty sure video_printf patch it's working as I patched another dprintf calls (the ones in the boot/recovery load function) just to make sure it really worked (see attached image).

BTW, any news regarding my LK? Just curious if it was really a bug in your tool :good:

Regards.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
P.S: But what do you mean by exploit? I tried to put the microloader with the address 0xFFFFFFFF too but the device reboots indefinitely and the bootloader on the screen does not show anything
[LG K10 Guides, News, & Discussion] OficerX:
It reboots because it's crashing because it's trying to write to 0xFFFFFFFF. Now you need to flash patched LK, then perform unlock procedure from BootROM to make device boot, you should see crash log dumped to screen, make pic of it send it here together with your LK.

But don't ever flash LK from android, recovery or laf, should be done from preloader use either SP Flash Tool or download.py, with invalid LK (including wrong signature, thats why temporary unlock is needed) your device won't boot, no recovery, no laf or anything, you are left only with BootROM/preloader so make sure you can write memory from it.
[LG K10 Guides, News, & Discussion] OficerX:
Change bootopt to 64S3,32N2,32N2.

Your bootopt sets kernel as 64-bit, must be 32-bit for it to work, LK loads 64-bit kernels at constant hardcoded address, completely ignoring address in bootimg header.

Your kernel is loaded at 0x40080000, should be inject_addr - crafted_hdr_size + page_size which is 0xFFFFFFFF - 0x70 + 0x04 = 0xFFFFFF93

No I haven't checked yet your LK.

EDIT:

I've looked at size of kernel, it's 5MB, are you sure you flashed microloader there?
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I flashed from preloader with SP Flash Tool both the modified LK and the modified boot.img but unfortunately it keeps restarting. Now I am attaching the modified LK, forgive me if I ask you this favor but check if there is something wrong and if there is please correct
[LG K10 Guides, News, & Discussion] XRed_CubeX:
PS: Should I do this too? My device is 64-bit too and it reboots anyway
[LG K10 Guides, News, & Discussion] OficerX:
If it reboots it's ok, you don't need to change anything, now you need to get crash log.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
But where is stored the logs?
[LG K10 Guides, News, & Discussion] OficerX:
You need to flash patched LK then you will have logs on screen.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
But if I said in the message above that I tried to do it but nothing comes out:
[LG K10 Guides, News, & Discussion] OficerX:
If I have time I will check it tomorrow.

In meantime try booting original boot.img on modified LK and see if it boots normally.

Also you can try to enable messages that Rortiz2 enabled (see his last post) and see if anything comes out.

Please send original LK also.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
The original boot.img already boots and I had already tested (always with my modified LK) and that's fine, so now I'm attaching my original boot.img and the original LK (lk is signed anyway, I got it from stock rom)

P.S: I compressed both files in a zip because the two separate files cannot be sent due to limits
[LG K10 Guides, News, & Discussion] OficerX:
Your LK was looking ok, except few patches were missing in stack dumping code and BFBF header present in unmodified version you sent was missing from modified, maybe that was why you could'nt see anything?

I enabled also few additional messages (just in case) that may be helpful (see enabled messages.txt).

Try first booting normal boot.img to see if it's working, you should see some messages printed on screen.

Then try with microloader and send pictures.

Note printed kernel address of microloader, should be near 0xFFFFFFFF
[LG K10 Guides, News, & Discussion] Rortiz2:
Hi,

Yes I also noticed about the LK forcing 64 bit kernel. Yes, the kernel size it's 5MB because that was when there was no microloader installed (normal boot image).

I'll try what you pointed out later I guess.

Thanks.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Hi, thank you for trying to patch the LK but unfortunately I think there is a small error, I tried to flash the LK with and without the BFBF header both from SP flash tool but unfortunately when I start amonet to disable the secure boot it can't boot the LK so I don't know why it does this, the amonet has always worked so I don't think it's my problem but the image you sent me
[LG K10 Guides, News, & Discussion] OficerX:
I checked code again and it seems correct.

Maybe some call to video_printf was made before video was initialized and that triggered assertion.

Try this image
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I tried to flash this other image again but unfortunately it still does not start, now I'll list exactly what I do.

1) I turn off the device by disconnecting the battery.

2) I reattach the battery without turning on the device

3) Start SP Flash Tool and with the Write Memory function select the correct address and select the LK image sent by you.

4) I click on Write, connect the device off and so it goes and flashes.

5) After writing I disconnect the device and reconnect the battery.

6) Restart in linux (I use dual boot), I start the amonet script, with the device turned off I press vol - (so I start the bootrom), and I connect it to the computer so the script starts and deactivates the secure boot.

7) The device does not boot into the Lk
[LG K10 Guides, News, & Discussion] Rortiz2:
Yes, this is exactly what happened to me yesterday :cowboy:
[LG K10 Guides, News, & Discussion] OficerX:
Maybe I misidentified something else as video_printf, check leaked source code (links in previous posts) and compare it with disassembly.

If it's correct then revert previous patches and try patching only a single dprint call eg. for "Android bootimg hdr - kernel addr" and see if it works.

I will take look at this later.

P.S. Are you sure temporary unlock did work before? Or maybe could it be that you flashed LK somehow improperly (wrong offsets etc.) and then assuming device won't boot you proceeded directly into bootrom to apply unlock, and this way you completely missed fact that you was still booting unmodified signed LK?

It looks very weird, before it looked as if you was still booting unmodified LK, now it looks like bootrom unlock doesn't work at all.

If thats not the case, then try booting with single instruction patched and see results, if works then continue.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I can assure you that the first LK I sent was modified and I used that at the beginning and I can also assure you that it did not boot without amonet, there is probably something in the LK you sent after
[LG K10 Guides, News, & Discussion] Rortiz2:
Hey,

Don't patch the 64bit kernel/32 bit kernel dprintf calls:

I checked myself and that breaks the LK ;)

Regards.
[LG K10 Guides, News, & Discussion] OficerX:
I reverted patch 64 bit kernel/32 bit kernel calls as [MENTION=8978978]Rortiz2[/MENTION] suggested (thanks).

Try if it's working now.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I tried this other image but unfortunately it still doesn't work, I have no more ideas on what to do
[LG K10 Guides, News, & Discussion] OficerX:
As last try, try this image, this is the image you sent patched already, I added single patch to

RAM:41E31844 aSAndroidBootIm_1 DCB "[%s] Android Boot IMG Hdr - Kernel Address : 0x%08X",0xA,0

image does not contain BFBF header.

Message should be printed regardless of installed boot.img, whether microloader or android.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Ok, this image works fine and while booting below the kernel address appears
[LG K10 Guides, News, & Discussion] XRed_CubeX:
P.S: I tried to flash the microloader with this LK but nothing is shown
[LG K10 Guides, News, & Discussion] OficerX:
Thats weird, that message should be printed before loading microloader, LK loads bootimg header, dumps header, then loads kernel to address specified in header. Seems like in your case it works differently.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
So in my case nothing can be done?
[LG K10 Guides, News, & Discussion] Rortiz2:
Same happens here. If I flash the microloader nothing appears in the screen.

I'm pretty sure i'm probably doing something wrong while generating the boot + microloader.

I'll retry tonight.

Regards.
[LG K10 Guides, News, & Discussion] OficerX:
For sure can be. You can try patching other version version of LK, you should have lk2 partition on your device, you can try that version, you can also get from internet some older or newer version.

But if you choose to try other version, first do bindiff, you can use unix command cmp -l and then compare in hexdump, because sometimes LK my differ only slightly, like embedded string with compile date differs, code may be the same.

You can try continuing with the same, just put somewhere earlier call to video_printf, and check it arrives there, if it does then put checkpoint somewhere else, that way you may be able to find where it stops working, nothing else comes too mind, except getting UART to work.

I already have uart partially working (see my previous posts), it's enabled programmatically so you could then from preloader upload small program that would enable UART and then boot LK.

I'm still working on getting UART, I will post it here when it's done.

You can see usb phy driver in linux source, as it contains code for enabling uart.

Leaked preloader code also has it.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I checked the partitions of my device and there is no LK2, the modified version of the LK is taken from the initial Stock ROM with which the device was born, do I try to modify the LK of the updated rom?
[LG K10 Guides, News, & Discussion] OficerX:
Try.
[LG K10 Guides, News, & Discussion] Rortiz2:
Hey,

So I tried again and got the same result :(

I tried setting inject_addr to 0xFFFFFF93 as you mentioned but I still can't see the crash nor the video_printf calls that I patched (The Android Boot Image stuff...).

I also noticed bootopt was already set to 64S3,32N2,32N2 so what did you mean with "Change bootopt to 64S3,32N2,32N2."?

Do you have any ideas of what I could do? Maybe I'd need to go for the same method as they used in the Fire HD8 2017/HD 10 2017

Thanks.
[LG K10 Guides, News, & Discussion] OficerX:
If it's set to 64S3,32N2,32N2 then it's good, try setting address to 0x0.

What do you by the same method?
[LG K10 Guides, News, & Discussion] OficerX:
[MENTION=9436535]XRed_CubeX[/MENTION] [MENTION=8978978]Rortiz2[/MENTION] you can try usb2jtag if video_printf method won't work.

I can't here much as I never tried it, because I have no debugger, I can only give few hints.

It's possible that yours LK contains support for it (look for strings, and/or register accesses), whether my LK enables it depends on settings stored in misc partition.

This can also be enabled/disabled from fastboot, if you can get into it (you may need to patch code to get into it).
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I have access to fastboot and my device when I do "fastboot oem p2u" still responds with "OKAY" (so I remember but I'm sure it responds). The problem is that I don't have a UART cable and trying to build it nothing came out, in fact I'm looking for a uart cable with all the micro usb already built on sites like Amazon, Aliexpress and ebay.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Ok I checked if there were references to "Uart" and "p2u" and actually something appears.
[LG K10 Guides, News, & Discussion] Rortiz2:
Hey,

Thanks but that's not an option for me as I lack of the needed cable.

I'll keep trying with video_printf.

I saw you fixed UART didn't you :)?

Regards.