[LG V20 Guides, News, & Discussion] SidneyD:
I'm a novice enthusiast when it comes to phones. When my wife needed a replacement phone after hers started to fail (I blame repeated gravity-related incidents, but she insists that's not it), I decided to see if I could transform my old V20 into a "new" V20 for her. I didn't know what was to come, but I was going to do it!

This can also serve as a pseudo-guide for other novices, and something to laugh at for those more experienced as I list all the steps I took, and all the mistakes I made through the process. If you are going to use this as a guide, make sure you read it completely before starting! I've made mistakes, and I list them here, but don't repeat them!

Big list of files​

Stuff for Linux live environment:

Etcherv1.7.9 https://github.com/balena-io/etcher/releases

steadfasterX's FWUL/mAid_v4.0-RC3_x86_64.iso https://leech.binbash.rocks:8008/mAid/

Stuff for Windows:

Android SDK Platform Tools (adb and fastboot) https://developer.android.com/studio/releases/platform-tools#downloads

LGMobileDriver_WHQL_Ver_4.8.0.exe http://tool.lime.gdms.lge.com/dn/downloader.dev?fileKey=UW00120120425

LGUP_Store_Frame_Ver_1_14_3.msi http://downloads.codefi.re/autoprime/LG/Flash_Tools/LGUP/

LGUP_Common_DLL_Ver_1_0_40_2.msi https://drive.google.com/uc?id=1MQ7u7ghlNNzjAgVkCpCmswdtZjeB3l6p&export=download&confirm=t

CXZa's utilities https://xdaforums.com/t/lg-tools-lg-kdz-dll-tool-lgup_ui-fixer-lg-kdz-downloader.3916444/

Files you'll want on your external SD card:

H91810p_00_0717.kdz https://xdaforums.com/t/root-lafspl...-and-including-20h-now-n00b-friendly.3773443/

Phoenix591's h918-20g-prerooted.zip https://xdaforums.com/t/rom-oreo-ro...-20g-20h-oreo-flashable.3848854/post-77987795

topjohnwu's Magisk-v23.0.zip (renamed from .apk) https://github.com/topjohnwu/Magisk/releases/tag/v23.0

TeamWin's twrp-3.6.1_9-0-h918.img https://dl.twrp.me/h918/

rootchecker apk https://apkpure.com/p/com.joeykrim.rootcheck

(optional but highly recommended) Darnrain1's Auto_Debloat v7.4 https://xdaforums.com/t/custom-stoc...hones-volte-and-wifi-calling-working.4432865/

(optional) F-droid apk https://f-droid.org

(optional) laf_restore.zip https://xdaforums.com/t/laf-restore-zip-file.4398879/

(optional) Phoenix591's encrypt-v3.zip https://xdaforums.com/t/recovery-unofficial-twrp-3-3-1-1-2019-10-25.3720239/

Credits:

@topjohnwu for Magisk

@Phoenix591 for 20g in zip format and TWRP

@npjohnson for TWRP

@CXZa for their awesome LG utilities

@runningnak3d for the core of the project: lafsploit

@75th for updated method of using lafsploit

@steadfasterX for their amazing FWUL/mAid and SALT

@me2151 for their original root exploit Dirty Santa

@demasta123 for finding and sharing laf_restore.zip

@Darnrain1 for the excellent debloat script

What I did:

Flashed mAid_v4.0-RC3_x86_64.iso to my thumbdrive via Etcher.

Put the thumbdrive into my little Lenovo laptop and booted (had to reboot cause the bootloader menu was super brief), and selected "Search for GRUB2 configuration on external media"

Logged in (password is 'linux')

Connected to WiFi

Started V20 in download mode (VOLUP+USB)

Opened SALT and under Advanced found that none of my partitions were displayed (which I expected because the V20 has Universal Flash Storage).

In SALT there's three buttons on the bottom. The leftmost one allowed me to change all the ummm sources? builds? to 'develop' and then I restarted SALT. Now I can see the partitions!

Clicked the backup option and selected Custom. All the partitions appeared to be selected, but I can't see the whole window because it doesn't allow itself to be resized smaller than a certain point which was too large for my little laptop screen. Since it appeared that all the partitions were checkmarked, I tapped Enter and it prompted me for a location to save the 60GB(!) backup.

I opened the file browser and I found the laptop's internal hard drive listed as '158 GB Volume'. Clicking it prompted for a password so I tried 'linux' and it worked! I created a directory at /home/user/Documents/H918, then copied the very cryptic path from the address bar of the file browser over to SALT and started the backup.

I babysat the laptop so it would not fall asleep or w/e just in case that would ruin the backup.

It hung during the backup (possibly because I was looking for a way to change the mouse senstivity and the screen timeout) so I had to forcibly power off the laptop and reboot into FWUL/mAid. I had to remove the battery from the phone to get it out of download mode. I did everything as before but this time I am only backing up the userdata partition as it is by far the largest, and I am touching NOTHING during the process other than the occasional mouse jiggle. If/When that's done I'll backup everything else. I very much doubt I need the userdata but better safe than sorry. The speed is slow; less than 1GB/minute.

Hung again, and I discovered that my poor little laptop was super hot, so I think that my laptop's cooling has failed, or for some reason it doesn't engage in FWUL/mAid. I'll need to either find a cooling solution, or more likely use my big desktop for this.

I used my desktop to do this, and was able to extract all the partitions as .img files. I also captured my device info and saved it to the PC as well. I was going to do the rest of the steps right from FWUL/mAid but outside of SALT, I couldn't get anything to work. I think it was missing Java because nothing was listed for echo $JAVA_HOME and the ADB tool would not launch. I'll just do the rest from Windows.

Back in Windows I tried compressing the images with 7zip but it was being a resource hog so I'll do it later and let it run overnight since I want this super compressed.

I went through the process of unlocking the bootloader:

Booted up phone to OS.

Skipped/Bypassed as much of the initial setup as possible. For some reason it keeps telling me it will "process my request" when it has connection to the Internet (cell data or wifi). Don't know WTF that is. Hope it is wiped during the process of rooting and installing a new ROM.

PC didn't have drivers, but I ran the LGMobileDriver_WHQL_Ver_4.8.0.exe and it installed them.

Set USB mode to file transfer.

Enabled USB debugging.

Enabled Dev Options.

Enabled OEM unlock.

adb reboot bootloader

fastboot oem unlock

fastboot reboot

Since the userdata was wiped I had to go through the setup again, enabled dev options, usb debugging (oem unlock was enabled and greyed out unsurprisingly).

adb reboot bootloader

fastboot getvar unlocked (reported as yes; so the bootloader is successfully unlocked!)

Now for flashing H91810p_00_0717.kdz, I head back to FWUL/mAid to use SALT.

Or not. SALT doesn't work because LG changed something in regards to being able to flash as of MM, but it appears I can do this in Windows with LGUP.

A (device-specific?) DLL file is required for LGUP and after much searching I learned that it is extracted directly from the KDZ. Fortunately CXZa has some nifty tools available, one of which is a dll extractor which is perfect for this. The readme for the dll extractor said I should install LGUP_Common_DLL_Ver_1_0_40_2.msi in addition to LGUP_Store_Frame_Ver_1_14_3.msi so I did so. I used the dll extractor to get the needed dll file from H91810p_00_0717.kdz. The option to copy to the LGUP folder didn't appear to work so I tried again and told it to not copy the dll. It doesn't say as such but it places the extracted dll in the folder that the kdz was in with the same name as the KDZ +.dll.

Copied and renamed the extracted dll to 'C:\Program Files (x86)\LG Electronics\LGUP\model\Common\LGUP_Common.dll'

Upgraded LGUP with CXZa's tools (not really necessary but neat)

Ran LGUP as admin, selected UPGRADE, for the BIN file I selected the H91810p_00_0717.kdz that I downloaded from the link in the original lafsploit thread by runningnak3d, and clicked start (and held my breath...)

It worked! The phone rebooted as part of the process directly to the OS, and Settings > Phone Info shows "H91810p" so I should be ready for the next part which is following the updated lafsploit instructions by 75th with some minor edits by me for clarity: :

Boot from your FWUL/mAid USB stick.

Put your phone into download mode.

Double click the LG folder that is on the desktop.

Double click on open-lglafsploit.desktop and you will be at a terminal prompt.

Enter the following into that terminal. I'd copypasta the first line at least:

git clone https://gitlab.com/runningnak3d/lglaf -b h918-miscwrte

cd lglaf

./step1.sh

When you are told to, pull the USB cable, and the phone will power off. You now have TWRP on your laf partition.

I then booted to Download mode (VOLUP+USB) again and the phone booted to the TWRP 3.2.1-3 image installed on the laf partition. I did not mount system as rw (keep as read only). Chose Install > Install Image > and browsed to the TWRP image (twrp-3.6.1_9-0-h918.img) on my external SD. For the location to flash it I selected Recovery, and then swiped to flash.

When complete I hit the Back button twice, and changed to Install Zip. Selected Magisk-v23.0.zip, and swiped to confirm flash. When done wiped cache/dalvik, then reboot system. I opted to not install the TWRP app.

Back in the OS I turned on wifi because Magisk had to download the full app. Once Magisk was done I turned off wifi because holy **** why are outbound firewalls not a thing on phones!? Then w/in the Magisk app I selected Install, checkmarked both Preserve AVB 2.0/dm-verity and Preserve force encryption (I learned later this was a big mistake), and then chose the Direct Install method, and rebooted when it completed.

I then installed the root checker apk, and it verified that I was rooted!

Spoiler content hidden.

With 10p and the original laf back on the phone I went through the same steps as before for lafsploit and got TWRP 3.6.1_9-0 flashed onto recovery again. I figured that since I have to re-run Magisk after flashing 20g there isn't any point to doing it now so I skipped it this time.

Then w/in recovery I flashed h918-20g-prerooted.zip, wiped cache, and rebooted to System. Once there I went into Magisk and did the recommended Direct Install method for patching the image and rebooted. Tested with a root checker app and we have root!

Sweet, now it is time to debloat the phone and get it set up for actual use, but first I will check to make sure my tools are still accessable.

VOLUP+USB will show TWRP 3.2.1-3 briefly then the phone reboots... which is super odd, but not a dealbreaker since the VOLDN+PWR, release PWR for 1s, press PWR method gets me to actual recovery (TWRP 3.6.1_9-0).

Going into recovery I find that the device is encrypted and asks for a password that I never configured (was this set up on first boot of 20g, or did Magisk do this?). Reading online looks like you can virtually never decrypt your data in TWRP, but if you want to make any changes you'll need to get rid of the encryption. That's a shame because it's like you can have either a secure device (encrypted), or a usable one (rooted and debloated). I need a usable one so goodbye encryption.

Wipe > Format data > reboot

It booted to something called "Secure start-up" and said "Decryption unsuccessful" and that I needed to reset the phone. Sure, whatever. It then rebooted to recovery (TWRP 3.6.1_9-0). Weird. But data was not encrypted this time. Tried rebooting to system and got the same secure startup thing. Tried resetting again and back to recovery. Decided to just flash the 20g zip again and reboot.

I am at Secure start-up again! WTH?! I told it to reset to get me back to TWRP and here under Wipe I selected

Dalvik

System

Data

Internal Storage

Cache

and did a Format Data again. Then told it to reboot to Recovery, not System.

Back in TWRP I told it to mount System and allow modifications. Changed the filesysem of System from vfat to ext4 to make extra sure System was nuked. Reboot System (it shouldn't boot to anything if the ****er is actually wiped this time). Hung on LG logo, so I'm pretty sure I was able to remove the old OS.

Pulled battery, and did the VOLDN+PWR, release PWR for 1s, press PWR dance to get into "factory reset" which in reality leads to TWRP 3.6.1_9-0. Flashed 20g again, hopefully with better success.

Secure start-up! Why won't this thing die?! I initially thought that it was the ROM itself, or wiping data in TWRP irrevokably ****ed it somehow. Further reading lead me to this post by Theraze who clued me in that TWRP for V20 has a bug that doesn't properly clear the encryption flag. Fantastic.

I would go back and start over but I don't think I can. I'd need to use the LGUP utility, but since the phone doesn't present itself as a COM port anymore I

don't think it will work. On a whim I tried LGUP... and after like a full minute it ****ing sees the phone! :D I will try flashing H91810p_00_0717.kdz onto it again. It booted to TWRP 3.2.1-3 lol. I forgot we replaced the laf dl mode with TWRP.

Went to TWRP 3.6.1_9-0, flashed laf_restore.zip, rebooted to system ~SuCKurE sTarTuP~. Ran LGUP again and told it to flash 10p again. (I really wish the default option was UPGRADE and not REFURBISH; I'm sure I'm going to **** it up one of these times)

I can't believe it. I literally cannot believe it. After flashing H91810p_00_0717.kdz via LGUP I am at the Secure start-up screen. The only difference is it looks slightly different due to it being Nougat this time instead of Oreo. I told it to reset the phone JIC it will actually work, and went to pour myself a stiff drink.

Resetting actually worked. Holy. ****.

FWUL/mAid, lafsploit, flash TWRP 3.6.1_9-0 to recovery, reboot to recovery (no encryption prompt), reboot system, no secure setup.

Tried VOLDN+PWR, release PWR for 1s, press PWR, but it did not put me into recovery. It erased my device. Power off, VOLUP+USB, went into TWRP 3.2.1-3. Reboot recovery. Dead droid "no command" again. GDI.

TWRP 3.2.1-3, flash laf_restore (glad it let me; was worried that I couldn't flash the laf partition while on lafTWRP), reboot system. LGUP to flash 10p AGAIN. Didn't erase the device so didn't need to do setup again at least.

FWUL/mAid, lafsploit again.

In TWRP 3.2.1-3 I did nothing but flash TWRP 3.6.1_9-0 to Recovery and reboot system. Then I ran adb reboot recovery. Dead droid, no command. ****.

LGUP to flash 10p yet again, but this time after it booted up, I did the VOLDN+PWR dance and told it to factory reset. It rebooted and I did setup again, and rebooted to system once before shutting down.

FWUL/mAid and lafsploit yet again.

Unplugged USB and the phone powered off like it should. Then VOLUP+USB. Swiped to allow modifications.

Wiped:

Dalvik

Data

Internal Storage

Cache

Format Data:
Formatting Data using make_ext4fs...
Failed to mount '/data/ (Device or resource busy)
Failed to mount '/data/ (Device or resource busy)
Unable to recreate /data/media folder.
You may need to reboot recovery to be able to use /data again.
Updating partition details...
Failed to mount '/data/ (Device or resource busy)
...done
Unable to mount storage

Opening TWRP's terminal and doing ls shows a /data with lost and found so it's there and empty.

Ran the following command via the TWRP terminal in case the GUI method of flashing is somehow not working:

dd if=/external_sd/Docs/TWRP/twrp-3.6.1_9-0-h918.img of=/dev/block/bootdevice/by-name/recovery

I tried running the following but the file didn't exist:

rm /system/recovery-from-boot.p

Flashed Magisk23.0.zip and again 'Failed to mount '/data/ (Device or resource busy)'. Tried to wipe dalvik/cache but it failed. Reboot System.

Went through initial ****up again. Completed and did adb reboot recovery.

Got to TWRP 3.6.1_9-0. This time. Swiped to allow modifications. Reboot system.

adb reboot recovery

Got TWRP 3.6.1_9-0 so it *might* be working now. Reboot > power off.

Tried VOLDN+PWR dance and it took me to recovery.

I think the lesson is wipe the **** out of the device after getting into lafTWRP both before and after flashing new TWRP to Recovery. Also swipe to allow modification so if there's secret sauce behind the scenes in System that's killing recovery TWRP it is neutralized during the process of getting 3.6.1_9-0 flashed. I am unsure if flashing Magisk is required as part of the process. I don't believe it is as I think mounting system as rw and wiping the other partitions is what's really needed, but I don't think it actually harms anything. (later on I learned that wiping is only part of it; Magisk and no-verity-opt-encrypt are what's needed to stop the encryption that was causing secure startup)

I rebooted to system and again adb reboot recovery. I went to TWRP 3.6.1_9-0 but it did not prompt me about swiping to make modifications so I immediately did reboot system. I was expecting Secure startup but it didn't appear, thank ****.

Back to recovery and I flashed no-verity-opt-encrypt-6.1.zip in the hopes that it would prevent Suckure startup from occuring again when I flash 20g in a minute. Wiped dalv/cache tho probably unnecessary. Reboot system.

No problems thus far. Time to flash 20g again.

Rebooted to recovery and told it to flash 20g. Since I've learned how amazing and cathartic wiping is, I formated data, and then wiped:

Dalvik/Cache

Data (probably not needed)

Internal Storage

Cache

Reboot system.

Secure start-up. *sigh*

VOLDN+PWR dance actually worked this time so that's nice. Swiped to allow modifications. Flashed no-verity-opt-encrypt-6.1.zip. Format data, wipe dalvik data internal cache again. Reboot system.

Secure start-up.

Recovery > flashed laf_restore > reboot system. Secure startup ofc, but I can run LGUP and flash 10p KDZ again to start over. Again.

I'm 99.999% sure that encryption being enabled is the problem.

In https://xdaforums.com/t/twrp-3-1-1-0-touch-recovery.3603760/post-73129295 me2151 says that "Encryption unsuccessful is because you did not do supersu or something to disable force-encrypt". Note that he says "Encryption unsuccessful" but the problem I have is "decryption unsuccessful". Not sure if a typo or a different issue.

Phoenix591 says https://xdaforums.com/t/twrp-3-1-1-0-touch-recovery.3603760/post-75429764 "You need to either root or install no-verity-opt-encrypt to keep stock from replacing twrp with stock recovery iirc"

This makes me think that I'll need to flash Magisk *and* no-verity-opt-encrypt to ensure that there is no encryption at all for the data partition.

FWUL/mAid froze while I was doing this so I hope my notes are correct as they're from my highly fallible memory:

lafsploit

VOLUP+USB > lafTWRP

Left system as ro

Format data (It even mentions we'd need to reenter recovery for data to be accessible again ffs. No wonder I was getting Failed to mount '/data/ (Device or resource busy). I need to learn how to read.)

Reboot > Power off

VOLUP+USB > lafTWRP

System ro

Wipe dalv, data, internal, cache

Flash Magisk (it mentions that forceencryption is enabled and will keep it that way when patching)

Flash no-verity-opt-encrypt-6.1.zip (to override the forced encryption)

Flash TWRP 3.6.1_9-0 to recovery

Reboot recovery

Made it to TWRP 3.6.1_9-0, yay

I would have left ro if prompted; for some reason the prompt about system modifications is inconsistant; sometimes it asks, sometimes not

Reboot system

Did first time setup again, dev options, turn on wifi, let magisk update and let it reboot

Back in system used Magisk's Direct Install method leaving "preserve AVB" UN-checked in case AVB forces encryption back on. Interestingly there wasn't an option for 'Preserve force encryption' so I think no-verity-opt-encrypt is working.

Rebooted

Installed root check app and we have root

Reboot recovery

Format data

Reboot RECOVERY (NOT system!)

Wipe dalv, data, internal, cache

Reboot RECOVERY (NOT system!) <-- not sure if needed, but I'm so sick of secure setup

Flash 20g zip

Flash magisk

Flash no-verity-opt-encrypt

Reboot system this time

Oh my ****ing god it's not at secure setup! It's at the normal first time setup for Oreo! :D:D:D:D:D

Did first time setup again, dev options, turn on wifi, let magisk update and let it reboot

Back in system used Magisk's Direct Install method leaving "preserve AVB" UN-checked in case AVB forces encryption back on (still no Preserve force encryption) and rebooted

Installed root checker and it's rooted

Tested adb reboot recovery and it worked

Tested VOLDN+PWR dance and it worked

Time for debloat

Already in recovery from testing the methods to get into recovery

Wipe > advanced > just dalvik and cache this time (hope this is all I need to do)

Flash Auto_Debloat v7.4

Swiped to wipe dalv/cache JIC

Reboot system

Success!

I suspect that (but haven't tried) flashing encrypt-v3.zip at this point will encrypt userdata and have it decryptable in TWRP. It might not work with the official TWRP 3.6.1_9-0, but Phoenix591 says it should with his version of TWRP. However, this adventure has gone on long enough so I'm not keen on trying it. Maybe later when I have some energy.