yashsingh1/xdaforums huggingface dataset:
[LG K10 Guides, News, & Discussion] OficerX:
Yes, I fixed UART.

Actually you don't need special cable, only UART to USB bridge (I use cp2120).

The code I wrote switches USB into UART regardless of cable type attached.

You can see it in microloader/linuxboot/uart.c and try porting and put it somewhere into LK to run it at boot.

That method still requires patching code but may be better because you will see all messages.

You could also try booting small program over usb to enable uart and then boot LK.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I also tried with a microusb but there is no pin called "ID" which is probably the fundamental one for the uart and the serial connection so I'm deciding to order a cable already manufactured for the uart, I found some on amazon, aliexpress and ebay but as soon as I have the opportunity to order one I take it, if you want to suggest me a cable in these three sites can help me.

P.S: I would have tried to solder on the motherboard but I don't have a suitable soldering iron so I use the USB-MicroUsb method
[LG K10 Guides, News, & Discussion] OficerX:
ID pin is only used detect cable type, serial communication happens on D+ and D-,

software checks for cable types switches usb into proper mode: usb host/usb gadget/hdmi/audio/uart/other. I can't suggest you which cable to buy, these may not work at all, because different phones require different method, eg. my Samsung Galaxy S4 exposes uart when I connect to it cable which has 523K Ohm resistor inserted beetween ID and GND pin, for some that didn't work and they had to use 619K Ohm resistor or other, some methods didn't even involve ID pin.

You can try FTDI micro usb to serial cable (strings in preloader suggest that developers at MediaTek used that), but it doesn't mean it will work for you, USB to UART switching happens in software, preloader when starts checks if uart cable is attached (this can be anything, resistance, voltage on VCC), and then selects mode, this feature can be even unavailable at all, if your firmware was built with it disabled (probably that was in my case), then you can only do it programatically.

I have since yesterday fully working UART, it's enabled in linuxboot (payload loaded by exploit), no special cable, just normal usb cable attached to CP2102, you can try porting that to your device and embed it somewhere into LK to enable it early at boot.

You can also try just holding cable onto TX without soldering.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
[/COLOR]

How can I understand how the preloader recognizes the UART in my case?

P.S: You would have a scheme that you can share that at least I'm sure I follow the right scheme for uart
[LG K10 Guides, News, & Discussion] OficerX:
You can check in Linux source code (linux must again perform switch after usb phy driver is initialized), look there for code that switches to uart, and then check what triggers it, if you really lucky you will find what you looking for, if you don't then you can either reverse preloader usb driver, try various different cables/methods and hope it will work, or enable uart using software.

If you won't find anything in Linux, the most reliable method will be software method, it's just few calls, you can create small program that will enable uart, and either boot it from usb from preloader or boot it from LK partition.

When you enable UART D+ will become TX and will go from ~0V to 3.3V, D- should be 0V, then you extend program with infinite loop printing anything to uart, connect to computer set

baud rate to 921600

stop bits: 1

data bits: 8

flow control: off

You should see messages, if you get garbage then try with different baud rates, if you don't get anything then it something is wrong.

If uart works then you can extend program to load LK.
[LG K10 Guides, News, & Discussion] CXZa:
BTW. that test_recovery_with_exploit.img is a boot.img (M250E20c, oreo).

Also microloader\microloader.bin is a boot.img (M250E10f, nougat).

Could this TWRP.img be used to this test, or there some differences in it?

https://xdaforums.com/goto/post?id=83843999
[LG K10 Guides, News, & Discussion] noidodroid:
Awesome find! I am a qualcomm guy but I can see this as definitely useful. I will follow this thread. =]
[LG K10 Guides, News, & Discussion] OficerX:
Uploaded accidentally, removed.

Real microloader is in bin\microloader.bin

Yes, it can be used, but it's outdated.

I just updated repo with newer TWRP (bin\twrp.img).

PS. You can use that to permamently root your device.

After flashing twrp (remember to inject microloader) download magisk installer, let it patch boot,

then download it, inject microloader and reflash.
[LG K10 Guides, News, & Discussion] Hakkou1:
I tried this exploit on my M250N, running Nougat and it doesn't seem to work. I tried on two separate Windows machines and on Linux. I did manage to crash the preloader using --crash-preloader when connected on Windows, but that's about it. Handshake also doesn't work. It seems awfully difficult to get the device into preloader mode in the first place, most of the time it just starts booting when connected to a PC, even when it's completely powered off.
[LG K10 Guides, News, & Discussion] OficerX:
Whats your terminal output?
[LG K10 Guides, News, & Discussion] Hakkou1:
These are what I get on Windows.

Output of python pl.py -w --read32 0:

Traceback (most recent call last):
File "C:\Users\Nikola\Downloads\lgk10exploit-master\pl.py", line 132, in <module>
main()
File "C:\Users\Nikola\Downloads\lgk10exploit-master\pl.py", line 67, in main
device.handshake()
File "C:\Users\Nikola\Downloads\lgk10exploit-master\plib\__init__.py", line 106, in handshake
raise HandshakeError()
plib.HandshakeError

Output of python pl.py -w --read32 0 --skip-handshake:

ERROR CMD_READ32: E_CRYPTO_INIT_FAIL
Traceback (most recent call last):
File "C:\Users\Nikola\Downloads\lgk10exploit-master\pl.py", line 132, in <module>
main()
File "C:\Users\Nikola\Downloads\lgk10exploit-master\pl.py", line 85, in main
hexdump(device.read32(addr, 1))
File "C:\Users\Nikola\Downloads\lgk10exploit-master\plib\__init__.py", line 197, in read32
raise Error(Command.CMD_READ32, status)
plib.Error: (<Command.CMD_READ32: b'\xd1'>, 4096)

And this is the serial device:

OK Ports USB Serial Device (COM6) USB\VID_1004&PID_6000\8&29C54EA8&0&2

When I connect it on Linux, there is no /dev/ttyACM* device, so I didn't get far, since I'm not sure which serial interface I'm supposed to use.

Edit: I managed to connect it as /dev/ttyACM0 on Linux and set /dev/ttyACM0 as PL_DEV_PATH, however any command I try to interact with it hangs, even if I just try to identify it or skip the handshake.
[LG K10 Guides, News, & Discussion] OficerX:
Don't use --skip-handshake, it's only useful when handshake was already done, eg. when you re-run tool multiple times.

Use /dev/ttyUSB0 while in preloader, ttyACM0 in BootROM
[LG K10 Guides, News, & Discussion] Hakkou1:
Tried running it with /dev/ttyUSB0 as PL_DEV_PATH, still hangs. This is the output I get when I run python pl.py -w --read32 0 and interrupt it:

Traceback (most recent call last):
File "/home/hakkou/Software/lgk10exploit/pl.py", line 132, in <module>
main()
File "/home/hakkou/Software/lgk10exploit/pl.py", line 67, in main
device.handshake()
File "/home/hakkou/Software/lgk10exploit/plib/__init__.py", line 102, in handshake
c = self.ch.write_read(b'\xa0')
File "/home/hakkou/Software/lgk10exploit/plib/__init__.py", line 52, in write_read
return self.read(size)
File "/home/hakkou/Software/lgk10exploit/plib/__init__.py", line 48, in read
return self.ch.read(size)
File "/usr/local/lib/python3.9/site-packages/serial/serialposix.py", line 565, in read
ready, _, _ = select.select([self.fd, self.pipe_abort_read_r], [], [], timeout.time_left())
KeyboardInterrupt

In lsusb, the device is correctly detected as "MT65xx Preloader".
[LG K10 Guides, News, & Discussion] OficerX:
run as root

dmesg -C

connect device

dmesg

and send me output

also run lsusb -vv with phone connected

and send it
[LG K10 Guides, News, & Discussion] Hakkou1:
Output of dmesg:

[13186.692343] usb 3-2: new full-speed USB device number 31 using xhci_hcd
[13186.835716] usb 3-2: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64
[13186.835719] usb 3-2: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64
[13186.835721] usb 3-2: config 1 interface 2 altsetting 0 endpoint 0x84 has invalid maxpacket 512, setting to 64
[13186.835722] usb 3-2: config 1 interface 2 altsetting 0 endpoint 0x4 has invalid maxpacket 512, setting to 64
[13186.844713] usb 3-2: New USB device found, idVendor=1004, idProduct=6000, bcdDevice= 1.00
[13186.844715] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[13186.844716] usb 3-2: Product: MT65xx Preloader
[13186.844717] usb 3-2: Manufacturer: LGE
[13186.883759] cdc_acm 3-2:1.0: ttyACM0: USB ACM device
[13186.907730] qcaux 3-2:1.2: qcaux converter detected
[13186.907772] usb 3-2: qcaux converter now attached to ttyUSB0

Output of lsusb -vv:

Spoiler content hidden.
[LG K10 Guides, News, & Discussion] OficerX:
You have both ttyUSB0 and ttyACM0,

stop ModemManager (it may misdetect ACM port as modem) then try opening ttyUSB and ttyACM one at the time with minicom (set baud to 921600 no parity, flow control off 8 data bits, 1 stop bit), on one of them you should see READY being printed, this is the correct preloader port, set this as PL_DEV_PATH, set BR_DEV_PATH to /dev/ttyACM0.

Try --identify command, make sure SLA is off, then proceed with --read32.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
In the end I was able to "unlock the bootloader" with an engineering rom, however out of curiosity I wanted to try to connect the uart and I'm getting this (see attachments)
[LG K10 Guides, News, & Discussion] OficerX:
Probably wrong baudrate try, different one starting with 115200,

if that fails try these: 9600, 19200, 38400, 57600, 115200, 230400, 460800.

If it still fails then change stop bits to 2 and try again with these baudrates.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
None of these worked unfortunately, however leaving it alone, my device has the kernel which is closed source unfortunately (I know opensource linux kernel is embarrassing but tell meizu) and now I would like to try to port a kernel source, unfortunately I do not know decode LCM drivers of an ARM64, do you have any tips or guides?
[LG K10 Guides, News, & Discussion] OficerX:
I can't give you any tips about reversing driver, but you can try following tips to determine your LCM model and then find driver somewhere else.

Try searching /sys and grep for lcm, disp, video, mtkfb.

If you have atag,videolfb-lcmname or similar it might reveal name of your LCM, then maybe you will able to find proper driver in kernels for other devices.

Check also debugfs, especially /sys/kernel/debug/mtkfb.

If that fails, you can try greping LK for various LCM names, there is chance that your LCM is one of these:

mediatek/proprietary/bootable/bootloader/lk/dev/lcm · ALPS-MP-M0.MP9-V1.78.1_NB6797_6C_M · MT6797 / vendor · GitLab

GitLab.com

gitlab.com

mediatek/proprietary/bootable/bootloader/lk/dev/lcm · master · MT6795 / vendor · GitLab

GitLab.com

gitlab.com

gs202-kernel-3.4.0/mediatek/custom/common/kernel/lcm at master · 4Fwolf/gs202-kernel-3.4.0

GS202 3.4.0 kernel (mt6575). Contribute to 4Fwolf/gs202-kernel-3.4.0 development by creating an account on GitHub.

github.com
[LG K10 Guides, News, & Discussion] XRed_CubeX:
I already know the name of my LCM but it's not on github
[LG K10 Guides, News, & Discussion] XRed_CubeX:
P.S:It is nowhere to be found, its name is:

jd9365_dsi_vdo_holitech_hd720
[LG K10 Guides, News, & Discussion] OficerX:
In links i gave you, you have leaked LK, you can use that to reverse LCM driver.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
How, idk how to do that
[LG K10 Guides, News, & Discussion] OficerX:
I can't help you much here.

What you need to do is find LCM_DRIVER structure describing your driver.

That structure looks something like this (taken from here)

LCM_DRIVER hx8389b_qhd_dsi_vdo_drv =
{
.name = "hx8389b_dsi_vdo",
.set_util_funcs = lcm_set_util_funcs,
.get_params = lcm_get_params,
.init = lcm_init,
.suspend = lcm_suspend,
.resume = lcm_resume,
.compare_id = lcm_compare_id,
#if (LCM_DSI_CMD_MODE)
.set_backlight = lcm_setbacklight,
.update = lcm_update,
#endif
};

It consists of pointers, first pointer points to driver name.

You can look for driver name in string list and then check references.
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Ok thanks
[LG K10 Guides, News, & Discussion] XRed_CubeX:
@OficerX

Excuse me for the inconvenience, a friend of mine has a Meizu M3 note, we ported to the stage bootrom and all right, the problem is that when we also add the part where secure boot is disabled for the preloader, it works and everything and does not give problems but secure boot we think it continues to be activated, in fact we tried two things:

Build a custom LK and it wouldn't boot, it could have been.

We had tried starting LK stock with a small modified byte and it still wouldn't boot.

I think it is impossible to disable secure boot.

The device allows flashes only with MTK Bypass and also gives them problems but with amonet and MRT it works without problems.

The CPU is MT6755 and starts a 64-bit kernel.

In fact, I no longer remember anything of what I had done with M5c, however if you have any advice regarding this device they are welcome. (My friend does not have a UART over USB and we have no security that it will work because it is a stock LK and not an engineering one)
[LG K10 Guides, News, & Discussion] Rortiz2:
@OficerX Do you know if it is possible to load a bootloader (LK) from bootROM (through USB)? As far as I can see, you tried to do so (?): https://github.com/arturkow2000/lgk10exploit/blob/master/plib/__init__.py#L328-L336
[LG K10 Guides, News, & Discussion] OficerX:
Magic values (and addresses) I used to disable secure boot are differ from device to device and beetween preloader versions, your preloader may also not be vurnelable at all. You can find proper offsets/values by either looking for references to 0x10206060 (EFUSE address) or references to "CERT" string.

Alternatively you may try loading LK from preloader using USB download.
[LG K10 Guides, News, & Discussion] OficerX:
No, this code was executed from preloader (this library can drive both preloader and BootROM as they speak same protocol).

Unless you initialize DRAM there is no way to boot LK - LK is linked to run at specific memory address which is in DRAM.
[LG K10 Guides, News, & Discussion] Rortiz2:
I see. So I need to load Preloader first (who initializes DRAM already) and then I should be able to load LK over USB (talking through Preloader)?
[LG K10 Guides, News, & Discussion] OficerX:
Yes
[LG K10 Guides, News, & Discussion] Rortiz2:
Great, my idea is to do some kind of tethered unlock. I already patched PL with ghidra to disable LK verification and patched LK to disable boot/recovery verification. So far it works fine but would be nice to load everything from USB :)
[LG K10 Guides, News, & Discussion] Rortiz2:
By the way, you're using a custom download agent (cdalib), right?
[LG K10 Guides, News, & Discussion] Mysak0CZ:
Hello!

I'm trying to follow this with my own device (EU M250n, Oreo, fully updated) and hit a bit of a wall...

Identify output:

Spoiler content hidden.

I already have root on my phone using: https://xdaforums.com/t/amazing-temp-root-for-mediatek-armv8-2020-08-24.3922213/

The reason I am trying this isn't to make my phone do anything, but to understand better what is going on.

Using this root I used dd to pull all partitions from the phone as backup. I also tried using dd to flash custom recovery/boot, but never managed to reach recovery and boot change triggers secure boot.

Using your tool I managed to get into custom download agent and used it to pull lk partition (confirming it matches with the one pulled using dd).

I also got the binary itself using partinfo+partdump and looked through it in Ghidra, but I am failing to find similarities to your LK - especially I am unable to find functions accessing EFUSEs.

I also tried using CDA to flash vuln_lk.img, which caused phone to bootloop (I subsequently flashed original same way, restoring it).

I also tried patching original boot using inject_microloader_oreo, which triggered crash caught by DemiGod (photo attached).

At this point I'm not sure how to continue. Only thing I didn't try yet, that I can think of it trying to change some random thing in pulled lk and flashing it to see, if I can boot with that (however I am not sure what would I try to change, that could help me verify I was successful)

I would appreciate, if you would give me any pointers! Thank you for your time~
[LG K10 Guides, News, & Discussion] OficerX:
Hi, I uploaded wrong LK version. I fixed that and repo contains now LK which matches the LK I am running. You can try flashing vuln_lk.img again. If it still doesn't work try flashing also bin/tee1_oreo.bin and bin/tee2_oreo.bin.

It should work now.

You can try also alternative method, which I discovered recently. Oreo bootloader can actually be unlocked (I've done this already on my device and it works). I have yet to find some time do describe this process. Basically this works by getting into fastboot and unlocking bootloader using fastboot oem unlock. On Nougat you could get bootloader "unlocked" but it still wouldn't let you boot an unsigned OS, but if you dump seccfg partition, update to Oreo, and then restore the unlocked seccfg you get truly unlocked bootloader. LG blocks fastboot, so a modified LK is required (loaded over USB using pl.py). The problem is that this method works only on Nougat, on Oreo when I try to load LK over USB it crashes very early idk why.

IIRC key used for signing seccfg is somehow derived by LK from device serial number (unique for each device). I could be wrong, so I uploaded SECCFG_UNLOCKED.IMG from my device (in attachment) so you can give it a try.

As a last resort you can try downgrading to Nougat, unlocking bootloader, dumping seccfg, and upgrading back to Oreo (or porting exploit to your LK version). I upload lk_fastboot.bin to GitHub, you can running it using python pl.py -w --fastboot.

From image you provided I can see explot is at least partially working.

Note the values from stack:

40404040 4601c5a0 42424242 4601c7c8

These values (as well as other) are coming from here https://github.com/arturkow2000/lgk10exploit/blob/master/microloader/inject_microloader_oreo.py#L66

0x4601c5a0 is address of the arch_clean_invalidate_cache_range function which is part of LK (Little Kernel), this is open source so you can check whether at this address is realy this function located.

arch_clean_invalidate_cache_range is called using some sort of trampoline, located at 0x4601C7C8.

This is a single instruction

LDMFD SP!, {R0-R3,R12,LR,PC}^

That instruction fills registers with these values, https://github.com/arturkow2000/lgk...86/microloader/inject_microloader_oreo.py#L71

But in R0 you still have 0x40404040, R3 is 0 but should be 0x04040404. Also note that there are two different modes, one for boot and one for recovery, if you inject microloader into recovery image in boot mode, your bootloader will crash, and the other way, the same problem.

Regarding eFUSE functions, maybe ghidra didn't analyse entire code? You can try Ghidra's aggressive instruction finder (I haven't tested that, but seems it may be helpful), otherwise you need to manually turn unknown areas into code.
[LG K10 Guides, News, & Discussion] qwertyuiop1289:
I'm trying to follow this on my m250n (oreo update) and python pl.py -w --read32 0 says ImportError: cannot import name 'Serial' from 'serial'
[LG K10 Guides, News, & Discussion] Rortiz2:
Perhaps you could try to install pyserial with pip3 install pyserial
[LG K10 Guides, News, & Discussion] qwertyuiop1289:
i've already installed pyserial
[LG K10 Guides, News, & Discussion] XRed_CubeX:
@OficerX Sorry for the trouble, have you ever tried to unlock the device with mtkclient and flash an unsigned image?

Works? Does he boot it? Does the unlocking from mtkclient go and in fact can everything be done?
[LG K10 Guides, News, & Discussion] CXZa:
@qwertyuiop1289 and @luridphantom have unlocked their devices but have they done any flashing yet???

https://xdaforums.com/t/guide-lg-k10-2017-m250x-only-testing-bootloader-unlock.3662742/post-86978711

More here...

https://xdaforums.com/t/how-to-unlo...ther-k-model-lg-devices.4364489/post-86652035
[LG K10 Guides, News, & Discussion] XRed_CubeX:
Interesting, pity that the testimonies are few
[LG K10 Guides, News, & Discussion] CXZa:
Okay, tested the mtkclient Live DVD V4 (current) with Nougat on my m250n. Gave errors but worked eventually. It didn't unlock the bootloader though. I changed the recovery and it gave an error. Then the system booted and "fixed" the recovery...

Then updated and tested with Oreo and it worked.

Bootloader unlocked and my recovery running...

Both cases the mtkclient changed seccfg the same way.

What I didn't do was the erasing of the user- and metadata. It wasn't needed...

And BTW, it doesn't say anything about bootloader being unlocked while booting. Which is nice.
[LG K10 Guides, News, & Discussion] qwertyuiop1289:
Where did you found custom recovery for this phone?
[LG K10 Guides, News, & Discussion] CXZa:
In this very thread (or @OficerX 's github) there is one mentioned (TWRP). Maybe one has to modify it a bit removing things related to OficerX's exploit, IDK. I just enabled adb in stock to test this...

edit: It seems that the TWRP doesn't have microloader in it. Old one had it injected though..
[LG K10 Guides, News, & Discussion] qwertyuiop1289:
Try rooting the phone and flashing twrp via dd, then adb reboot recovery. Now android shouldn't remove it.
[LG K10 Guides, News, & Discussion] CXZa:
The twrp crashes when rebooting. Had to rename install recovery myself.

Spoiler content hidden.
[LG K10 Guides, News, & Discussion] CXZa:
Okay something renamed another file instead. Also magisk seem to have interest in that service. So, stock recovery stays away.

Found reason for that crash from here.

GitHub - arturkow2000/lgk10_mlv5_kernel_3.18_oreo

Contribute to arturkow2000/lgk10_mlv5_kernel_3.18_oreo development by creating an account on GitHub.

github.com

Then to fix it re-made attached 32 bit TWRP from @OficerX 's older one which had microloader in it. Microloader caused problem too.

Otherwise the same as 64 bit, but it doesn't ask to mount encrypted data. Don't know if it's possible even. I could not make it to work. How to change the password what is used?
[LG K10 Guides, News, & Discussion] qwertyuiop1289:
Disable force encryption?
[LG K10 Guides, News, & Discussion] CXZa:
That is always an option... but still I would like to know if it's possible and how...

BTW, when using mtkclient to unlock, backup seccfg 1st, because if you want to lock again mtkclient doesn't necessarily return seccfg as it was before. Changed the critical lock state to 0 when locking. Like OficerX's, mine was 1 before... Maybe it doesn't matter though...
[LG K10 Guides, News, & Discussion] qwertyuiop1289:
TWRP does not decrypt /data well. Try SHRP or OrangeFox, then everything should work.
[LG K10 Guides, News, & Discussion] CXZa:
No recovery for m250 there. And those LG recoveries are huge.

To test if newer is better I ported this G4. It is also huge. Had to put it to laf partition.. didn't work either.. in it's thread it's said that on Nougat stock decrypting should work. But it's 8 now and different device too...

LG G4

Disclaimer:Team Win strives to provide a quality product. However, it is your decision to install our software on your device. Team Win takes no ...

twrp.me
[LG K10 Guides, News, & Discussion] CXZa:
So, to make TWRP to work with data one has to remove encryption...

This is the way I did it using win10 without erasing the data...

edit: hmm... wifi doesn't stay on... so removed for now...

edit2: normal factory reset does the same.. weird..

here one similar post: https://xdaforums.com/t/wi-fi-not-working-after-decryption-zte-k88.3988031/