[LG G5 Guides, News, & Discussion] el-sahef:
Hello,

by studying and editing of the config files in /cust from various .kdz with and without carrier branding I was able to activate VoLTE for alle three German network providers Telekom, O2 and Vodafone. I could test VoWiFi for Telekom and O2 only because Vodafone currently enables this option only for their contracts but I just have a prepaid SIM from them. But I assume that VoWiFi also works there.

This can serve as a useful template for anyone who might attempt this for the network providers in other countries. The G5 has many carrier branded .kdz firmwares from which necessary information could probably be extracted.

ATTENTION, if your phone is unrooted and bootloader-locked and you do something wrong you might brick your device! You are solely responsible for any bricked phones and unintended consequences if you follow this HowTo!

Although it would have cost them nothing to leave it up LG decided to shut down the website that issued the bootloader unlock keys (shame on them!) and as of now there is no other method to unlock the bootloader. dm-verity does not check the contents of the cust partition and there is a root shell exploit to gain temporary root access for modification, so it is possible to use the cust editing method on bootloader-locked phones. But the process is much more complicated and time-consuming. So if you have not unlocked your bootloader while it was still possible or own a model which was never eligible for the official unlock, it will be more difficult to do.

If your phone is bootloader-unlocked and you screw up something you can easily recover to factory by flashing a .kdz or restoring just the cust partition.

1) Download the attached zip file "LG_G5_H850_v30f_OPEN_EU_VoLTE_VoWiFi_GER.zip" (MD5 df1f872eb8cc9d59afd26507c34d1896) and the zip file "cve2019-2215-3.18-4c0f97b.zip" (MD5 76a110f293172bf31a77b9539ce4ccc3) from this forum post in this xda forum thread. Extract both.

2) Upgrade your phone to firmware v30f OPEN_EU (H85030f_00_OPEN_EU_OP_1122.kdz) (newest oreo firmware).

3) Enable USB data transfer and USB debugging on the phone. Connect to a PC which has ADB installed and working.

4) Copy the folder OPEN_COM from the first zip file to the Download folder (full path /storage/emulated/0/Downloads) on the phone.

If your phone is Rooted and bootloader-unlocked:

R1) Copy the complete folder OPEN_COM with a root file explorer of your choice (e. g. MiXplorer) to /cust. There already is a folder OPEN_COM, so the contents will be merged. Overwrite all files that may already be present.

If your phone is Not Rooted and bootloader-locked:

NR1) Open Windows command prompt (or terminal application if you are using Linux) and type "adb devices" & press enter. The connected phone must be shown as "authorized". If it is "unauthorized" you have to allow the ADB connection to the PC on phone.

NR2) On the command line, navigate to the folder from the second zip file which contains the file "su98". This is the only file that we need from the second zip file.

NR3) Enter command and press enter:

adb push su98 /data/local/tmp

The output should look similar to this:

1 file pushed, 0 skipped. 13.5 MB/s (41040 bytes in 0.003s)

Important: Do NOT push the file su98.c instead of the file su98 (without file extension). Unhide the file extensions if you are on Windows and in doubt.

Enter commands and press enter after each of them:

adb shell
cd /data/local/tmp
chmod 755 su98
./su98 -n

The output of the last command should look similar to this:

IN: detected kernel version 3
IN: starting exploit for devices with waitqueue at 0x98
RENT: soon will be calling WRITEV
ILD: Doing EPOLL_CTL_DEL.
ILD: Finished EPOLL_CTL_DEL.
ILD: initial portion length 0x12000
ILD: task_struct_ptr = 0xffffffc0ccdcd080
ILD: clobbering with extra leak structures
RENT: clobbering at 0xffffffc05f803ca0
ILD: Doing EPOLL_CTL_DEL.
ILD: Finished EPOLL_CTL_DEL.
ILD: wrote 69688
RENT: readv returns 69688, expected 69688
RENT: clobbering test passed
ILD: clobbered
RENT: writev() returns 0x13008
RENT: Reading leaked data
ILD: task_struct_ptr = 0xffffffc0d28a4000
ILD: Finished write to FIFO.
RENT: leaking successful
IN: thread_info should be in stack
IN: parsing kernel stack to find thread_info
RENT: soon will be calling WRITEV
ILD: Doing EPOLL_CTL_DEL.
ILD: Finished EPOLL_CTL_DEL.
ILD: initial portion length 0x12000
ILD: task_struct_ptr = 0xffffffc0ccdcd080
ILD: clobbering with extra leak structures
RENT: clobbering at 0xffffffc052429ca0
ILD: Doing EPOLL_CTL_DEL.
ILD: Finished EPOLL_CTL_DEL.
ILD: wrote 69688
RENT: readv returns 69688, expected 69688
RENT: clobbering test passed
ILD: clobbered
ILD: extra leak
ILD: Finished write to FIFO.
RENT: writev() returns 0x17008
RENT: Reading leaked data
RENT: Reading extra leaked data
RENT: leaking successful
IN: task_struct_ptr = ffffffc0ccdcd080
IN: thread_info_ptr = ffffffc0d28a4000
IN: Clobbering addr_limit
RENT: clobbering at 0xffffffc0d28a4008
ILD: Doing EPOLL_CTL_DEL.
ILD: Finished EPOLL_CTL_DEL.
ILD: wrote 69648
RENT: readv returns 69648, expected 69648
RENT: clobbering test passed
IN: thread_info = 0xffffffc0d28a4000
IN: should have stable kernel R/W now
IN: searching for cred offset in task_struct
IN: search_base = ffffffc000000000
IN: searching for selinux_enforcing
IN: searching for kallsyms format strings
IN: patching longer version at ffffffc00140a518
IN: patching shorter version at ffffffc00140a528
IN: **fail** probably you have read-only const storage
und selinux_enforcing in /proc/kallsyms
IN: setting root credentials with cred offset 550
IN: UID = 0
IN: enabling capabilities
IN: SECCOMP status 0
IN: disabled selinux enforcing
ched /data/local/tmp/selinux_enforcing.symbol
IN: re-joining init mount namespace
IN: rejoining init net namespace
IN: root privileges ready
IN: popping out root shell
:/data/local/tmp #

The relevant part is "popping out root shell" at the end. If it worked you have root permissions on this commandline now.

Enter command and press enter:

mount -o rw,remount /cust

If it worked there should be no error messages.

Enter command and press enter:

cp -v /storage/emulated/0/Download/OPEN_COM/cust_OPEN_EU.prop /cust/OPEN_COM/

The output should look similar to this:

cp '/storage/emulated/0/Download/OPEN_COM/cust_OPEN_EU.prop'

Enter command and press enter:

cp -v /storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/* /cust/OPEN_COM/_config/config_OPEN_EU/

The output should look similar to this:

cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/amrwb_gpri.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/apns.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/com.lge.ims.rcs.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/com.lge.ims.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/featureset.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/global_apns.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/ike_conf.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/ims_conf.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/mapcon_conf.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/radio_gpri.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/rcs.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/telephony.xml'
cp '/storage/emulated/0/Download/OPEN_COM/_config/config_OPEN_EU/vo_config.xml'

Enter command and press enter:

mount -o ro,remount /cust

If it worked there should be no error messages.

Common again for both rooted + bootloader-unlocked and unrooted + bootloader-locked phones:

5) Shut down phone and put in your SIM card. The SIM card must be enabled for VoLTE and / or VoWiFi from your carrier.

6) Power up the phone and enter SIM PIN. Dial the following number: *#546368#*850# (for an RS988 the number would be *#546368#*988#).

7) In the menu that appears, go to "Field Test" > "GPRI VoLTE/VoWiFi" > "UX" and activate the first six hooks. Some of them might already be enabled.

8) In "Settings" --> "Network" --> "Call" enable "VoLTE" and "Wi-Fi calling" if not already enabled. Click on the text "Wi-Fi calling" to open a sub-menu. Here you can choose if VoLTE or VoWiFi should take priority in your default cellular network and when roaming if both is available.

9) You should see a VoLTE icon besides the network indicator icon and VoLTE should be enabled. If you connect to a WiFi network with internet access and have chosen to prioritize VoWiFi over VoLTE this icon should change to an earphone with WiFi symbol. This means that VoWiFi is active.

If you change the SIM card you have to repeat steps 6, 7 and 8.

The modification stays if you reset the phone to factory settings. It will go away if you flash a .kdz firmware file.

How to adapt for other countries / network providers:

I can't really help much with this. I was lucky that all the neccessary config settings for German carriers were present (although scattered) in varius carrier-branded and unbranded .kdz files. I just combined them and did some trial and error.

A good start is to find the MCC and MNC for your country and network providers. Then download and extract branded and unbranded .kdz files for your country and / or carrier. Search the files in "cust" for all settings that apply to your MCC / MNC and try them.

You also have to know which folder in cust gets loaded. Look in "Settings" --> "General" --> "About Phone" --> "Software Info" what it says there. E. g. for an unbranded european G5 H850 it says V30f-EUR-XX. This corresponds to OPEN_EU and if you examine the .cfg files in "cust" you will see that in this case the config in the folder OPEN_COM/_config/config_OPEN_EU gets loaded. You have to find out which config gets loaded on your phone (this is based on the NT code and buyer code) and edit the files in that folder for VoLTE and VoWifi.