[EXPERIMENTAL] Full ADB Root, System RW, and DM-VERITY Off for ALL G5's!!!

[BIG_BADASS]

Hey Hunikel, have you tried the LG Flash tool? I only have a G4 but I believe it's available for the G5 as well ( https://forum.xda-developers.com/lg-g5/development/lg-flash-tool-2-0-1-6-patched-t3371668 ). I think it's more risky than LGUP but I've seen postings in the G4 forums that some people were able to use LG Flash tool to fix model number and then LGUP afterwards.

Why is LG Flash Tool more risky than LG Flash Tool? Please give reasoning behind it. Thanks

---------- Post added at 02:12 PM ---------- Previous post was at 01:28 PM ----------

This works for LG H831 ?

 

[GuestD2616]

Has anyone tested this on the RS988 variant?

 

[stinka318]

is there a special button combination i need to activate the menu in recovery mode, so i can wipe data

Power off then volume down and power button together then release power.....it works on my model LG g5 h850k

 

[peter19220]

Does it work on F700k? I just got it today. Thanks!

 

[SirMatin]

Deleted :/

 

[aselker]

I sort of hate to ask, I feel like this has been answered, but I'm having a hard time understanding this.

What is the status of this tool? It gives a full ADB shell with rw access to /system, but still can't give apps root access?

 

[thjubeck]

By attaching a debugger to LGUP I found a couple of new commands

INFOSPRO is called 4 times which by reading is setting some sort of properties

SIGN

SIGN is called twice before anything begins to work such as the OPEN or WRTE command and the response should be something like success cmd SIGN

I think this is the missing link as after this all commands are given with 2 kilocent commands then 2 kilometr commands in that order so possibly the SIGN command is important but also the fact that the kilocent command is given twice then the 2 kilometr responses are sent but that's just speculation. Let me know what you guys think

also two other commands that were found are

OPCMCHEK

MISCWRTE


EDIT: disregard the SIGN part seems this is more important

CHCKCLER is given twice before the exec command works it seems so new command there as well


I think CHCKCLER is our missing link. Disclaimer I am on the LG G5 but it has the same issue.

Debugged application message: [00:23:187] usb speed is high speed.
.
Debugged application message: [00:23:187] Not Support Fail Safe
.
Debugged application message: [00:23:187] Progress sleep for 1000 9 11
.
Debugged application message: [00:23:203] Set Progress 9
.
Debugged application message: [00:23:703] Set Progress 10
.
Debugged application message: [00:24:203] [T0000032] 43 48 43 4B 43 4C 45 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8C BA 00 00 BC B7 BC B4 CHCKCLER........................
.
Debugged application message: [00:24:203] [R0000032] 43 48 43 4B 43 4C 45 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BC B7 BC B4 CHCKCLER........................
.
Debugged application message: [00:24:203] LAF_CMD_SUB_CLER.

.
Debugged application message: [00:24:203] DATA CHECK SUM ERROR device = 0 tool = 0

.
Debugged application message: [00:24:203] ==============Start Direct Download 2485MB ==============
.
Debugged application message: [00:24:218] umount system (/system)
.
Debugged application message: [00:24:218] [T0000032] 4B 49 4C 4F 43 45 4E 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E3 7B 00 00 B4 B6 B3 B0 KILOCENT.................{......
.
Debugged application message: [00:24:218] [R0000032] 4B 49 4C 4F 43 45 4E 54 90 A9 25 4A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B4 B6 B3 B0 KILOCENT..%J....................
.
Debugged application message: [00:24:218] [T0000048] 4B 49 4C 4F 4D 45 54 52 00 00 00 00 02 00 00 00 00 00 00 00 10 00 00 00 A3 07 00 00 B4 B6 B3 B0 KILOMETR........................
F4 7C 31 45 4C FF 58 73 0A D6 CB 7D 23 7B F0 17 .|1EL.Xs...}#{..
.
Debugged application message: [00:24:218] [R0000032] 4B 49 4C 4F 4D 45 54 52 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B4 B6 B3 B0 KILOMETR........................
.
Debugged application message: [00:24:218] [T0000047] 45 58 45 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 00 00 00 57 EC 00 00 BA A7 BA BC EXEC....................W.......
75 6D 6F 75 6E 74 20 2F 73 79 73 74 65 6D 00 umount./system.
.
Debugged application message: [00:24:234] [R0000032] 45 58 45 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 00 00 00 00 00 00 00 BA A7 BA BC EXEC............................
.
Debugged application message: [00:24:234] [T0000032] 4B 49 4C 4F 43 45 4E 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E3 7B 00 00 B4 B6 B3 B0 KILOCENT.................{......
.
Debugged application message: [00:24:234] [R0000032] 4B 49 4C 4F 43 45 4E 54 CA DB 0F 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B4 B6 B3 B0 KILOCENT...!....................
.
Debugged application message: [00:24:234] [T0000048] 4B 49 4C 4F 4D 45 54 52 00 00 00 00 02 00 00 00 00 00 00 00 10 00 00 00 6D 6D 00 00 B4 B6 B3 B0 KILOMETR................mm......
CB 74 3A 1A 43 2F 7D F9 DF 11 42 DC 7E 09 0A 8C .t:.C/}...B.....
.
Debugged application message: [00:24:234] [R0000032] 4B 49 4C 4F 4D 45 54 52 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B4 B6 B3 B0 KILOMETR........................
.
Debugged application message: [00:24:234] [T0000060] 45 58 45 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1C 00 00 00 17 2E 00 00 BA A7 BA BC EXEC............................
6D 6F 75 6E 74 20 2D 6F 20 72 65 6D 6F 75 6E 74 2C 72 6F 20 2F 73 79 73 74 65 6D 00 mount.-o.remount,ro./system.
.
Debugged application message: [00:24:234] [R0000032] 45 58 45 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 00 00 00 00 00 00 00 BA A7 BA BC EXEC................#...........
.
Debugged application message: [00:24:234] /system Unmount Success.
.
Debugged application message: [00:24:234] Erase Partition name : system, sector addr : 0xE886, size(sector count) : 0x120000

 

[bluedry]

I'm a Canadian H831 owner. Just wanted to post to say great work so far and if you get SuperSU or another SU app installed, enjoy the $850 bounty.

Hi ToYeD,
I also have a G5 H831 (with Videotron), you can confirm that process is working fine ? You didnt have any issue since then ?
Thank you !

 

[bgagan4]

Any update on the status of this on nougat yet?

 

[user4978023]

can I copy supersu to phone via adb with shell root? Or any another method to give root permission to an app?

 

[Burockerdogan]

Has anyone tested on h850tr variant?

 

[Astr4y4L]

@Honestly Annoying

Hi All ,
I am working on several devices with the same security problems ie varity and such.

I'm fairly confident I can reproduce whats going on in your use of dcow to dcow the run-as
and then dcow the applypatch with the dcow binary...

but how did you modify the /boot.img to allow the changes?
as I would like to port this technique to a few other devices just to disable dm varity?

any help or in-site will greatly be appreciated
thanks
Astr4y4L
Team_Astr4y4L

 

[serpent android]

Brother will this Work for lg g5 h820 running nougat

 

[bgagan4]

Brother will this Work for lg g5 h820 running nougat

Have you gone through the thread brother? I'm sure you'd find the answer there.

 

[hsali]

Hi All, please will this work for H860, please help

 

[GianCarloni7]

una consulta gente del foro, disculpe que escriba castellano, no se nada casi nada de ingles, le hago una consulta este método funcionaria para un h850ar?porque lo he intentado y termino en triangulo rojo siempre.muchas gracias

you can resolve this ? pudiste resolverlo ?

 

[cheeze.keyk]

you can resolve this ? pudiste resolverlo ?

please speak in english only. :good:

 

[shhaanee]

Is this method compatible with the lg g5 korean variants? (f700)
Thanks in advance

 

[NaLySe]

What about petitions to LG Electronics to receive the official bootloader unlock for all versions of the G5? We will be able to gain a significant number of signatures!

 

[syaifulepul]

Power off then volume down and power button together then release power.....it works on my model LG g5 h850k

did u able to get it root? i have the same variant also