• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[ROOT] H872 (up to and including 20g)

Did this method work for you?

  • Yes

    Votes: 123 61.8%
  • No

    Votes: 23 11.6%
  • No and I lost download mode

    Votes: 29 14.6%
  • No and I have a brick

    Votes: 24 12.1%

  • Total voters
    199
Search This thread

runningnak3d

Recognized Developer
Nov 10, 2010
2,649
7,204
Largo
WARNING
  • DO NOT LET YOUR PHONE REBOOT, OR POWER OFF UNTIL I TELL YOU THAT IS WHAT YOU NEED TO DO.
    If you do, I am not sure what shape your phone will be in.
  • This should go without saying, but you MUST have your bootloader unlocked (check OEM UNLOCK in developer options AND fastboot oem unlock). If you don't, you will probably brick your phone.
  • If you use this on any model G6 besides the H872, you will be stuck in a bootloop, and you will not be able to fix it since you will have wiped out download mode!
  • This is safe if no mistakes are made (typos, missing a step, etc). However, if you do mess up, the risk is high that you lose download mode at best, or brick your phone at worst.
  • If you deviate from this procedure, and think: "I can just skip a step, or I can do this on my own Linux install". Don't complain if you brick your phone.

PREREQUISITES:
  • You must have a version of laf that has the COPY opcode.
    Since none of the firmware available for the H872 has the COPY opcode, we have to use the H918 laf partition.
    Grab the H918 10p KDZ: link to 10p KDZ
  • You need to be on 11g or above. Be aware, once you are on 11g+ you cannot downgrade to any versions prior to 11g due to anti-rollback.
    You will need a copy of the KDZ that your phone is on. If you are not currently on 11g, upgrade before continuing.
    For 11g : Link to 11g KDZ
    For 11h : Link to 11h KDZ
    For 20a : Link to 20a KDZ
  • We are going to flash this using the patched LG UP. There may be one that was patched specifically for the G6 -- don't use it,
    it has NOT been tested. Grab the one for the V20: link
    It MUST be installed in: C:program Files (x86)LG ElectronicsLGUP
    You can't just unzip it anywhere and run it, it will not find the model file.
  • You need the H872 Unofficial 3.2.3 TWRP by @Eliminator74. 3.2.3 is included in the repo so that you know that you have the exact version.
    If you decide to use any other version, you will brick your phone because the commands below are for this exact version!
  • You need to grab FWUL (version 2.7 or later) and burn it to a USB stick: link
    Even if you have Linux, and you think you can install the dependencies, don't. I know this works from FWUL.
  • If you are rooting on 20a, you will need a Micro-SD card. Copy the TWRP 3.2.3 image and the latest Magisk zip to the SD card.

WARNING: Only applies if rooting while on 20a
Minor Encryption-related issues have occurred while testing 20a. If your data partition is encrypted, TWRP will NOT be able to decrypt it. Because of this, you will have to perform a wipe and format of your Data partition. Be sure to backup all data on your device prior to continuing by copying important files to an external SD card or using LG Mobile Switch to back it up.

PROCEDURE PART 1: Getting a working LAF onto your phone
By far this is the most dangerous part of this procedure.
  • Boot to download mode
  • In LG UP, choose partition DL.
  • Pick the H918 10p KDZ
  • Click start / ok
  • When you will be given a list of partitions to flash, only check laf
  • Click start / ok
  • You will get a warning about additional modified partitions -- ignore it, and click OK.
  • As a safety feature, LG UP will start flashing those modified partitions after laf completes flashing.
    After the flash is initiated, pay close attention to the "step" and as soon as it changes from laf to another partition, PULL THE USB CABLE!
    If you let it completely flash the H918 KDZ, your phone WILL reboot, and you WILL have a brick that can't be fixed.
    You need to pay attention, but you also don't need to be sitting on pins and needles. You have quite a bit of time to pull the cable since system is one of the partitions that is flashed
  • Click OK and it will start flashing.
  • Once laf is flashed, and you have pulled the USB cable, you can click exit, and then re-open LG UP.
  • Choose partition DL again, and this time pick the H872 KDZ for the version your phone was on prior to flashing 10p (11g, 11h, or 20a)
  • Select all partitions except laf. If you forget to uncheck laf, you will have to do this all over again.
  • When it completes, it will reboot your phone.
  • Go back into download mode. This time you will be running the H918 laf, and we can continue with PART 2


PROCEDURE PART 2: Installing TWRP
  • Boot from your FWUL USB stick.
  • Put your phone into download mode. With the phone powered off, hold vol up and plug in the USB cable. You do not need to touch the power button -- the phone will power on and enter download mode.
    This will NOT look like normal download mode on the phone. All you will get is small box that says: "Download mode" -- this is normal. You will also not have ANY indication on the PHONE that it is being flashed.
  • Once booted, login. The password is: linux
  • Double click the LG folder that is on the desktop
  • Double click on LG LAF (runningnak3d) icon and you will be at a terminal prompt.
    The following are the commands that you enter into that terminal. You can copy / paste them if you like.
Code:
git pull
git checkout h872-miscwrte
./step1.sh
When you are told to, pull the USB cable, and the phone will power off. You now have TWRP on your laf partition. At this point you can flash a ROM, or Magisk or whatever you like, but I would suggest
at least flashing TWRP to the recovery partition. There is no button combination to get into laf (download mode), so if you only have TWRP on laf, then you will need a USB cable to get into recovery.

OPTIONAL:
If you don't know what to do with TWRP, and you just want to run rooted stock 11g, 11h or 20a, this is for you....
First boot into TWRP - with the phone off, hold vol up and plug in the USB cable.

PROCEDURE PART 3: Rooting and cleanup
Now that you are in TWRP:
Nougat (11g, 11h Users)
  • ./step2.sh
If you ran step2.sh you have TWRP on laf, and recovery, and you are rooted. If you only ran step1.sh, then you have TWRP on laf. Either way, enjoy!

Oreo (20a) Users
  • Once in TWRP, click the “Wipe” button.
  • Choose Advanced Wipe and select the Dalvik, Data and Cache options and Wipe. Do not reboot the phone.
  • Go back to the main menu or main wipe screen
  • Select “Format Data” and complete the format.
  • Go back to the main menu and choose Install, and then Install Image.
  • Flash the TWRP 3.2.3 image from external_sd to the RECOVERY partition. DO NOT Reboot to System.
  • Go back to the main screen and attempt to reboot to Recovery.
  • If you are able to reboot to recovery without any issues, you should now Install the Magisk zip from external_sd.
  • After flashing Magisk, you may now reboot to system and Oreo should boot to the initial Android Setup screen.
  • After booting to Oreo, make sure you enable installations from Unknown Sources in your Android Settings and install the latest Magisk Manager.

If Oreo boots to an "Encryption Unsuccessful" screen, you will need to format the Data partition again. Tap the reset button and it should boot to Recovery. Perform another wipe of cache/data/dalvik and go back to the Wipe screen and Format Data. Reboot system and you should boot to Oreo Normally.

To Restore Download Mode
20a - Flash @Eliminator74's Bootstock with LAF image using TWRP
11g - Flash @weakNPCdotCom's StockLAF image using TWRP

CREDITS:
  • @KAsp3rd -- he risked his phone to make this happen. There were no guarantees that the H918 laf would boot and function.
  • Lekensteyn -- His base work on the G2 / G3 gave me a GREAT headstart!
  • @steadfasterX - He added some real nice features, great guy to bounce ideas off, and just testing crazy ideas because he wasn't afraid to brick his phone :) Also, for FWUL
  • tuxuser - Helping with my lacking in Python
  • @smitel - His original reverse engineering of LG UP. Great inspiration!
  • @weakNPCdotCom - Testing/Help with H87220a (Oreo)

-- Brian

XDA:DevDB Information
lafsploit - H872, Tool/Utility for the T-Mobile LG G6

Contributors
runningnak3d, KAsp3rd, weakNPCdotCom
Source Code: http://gitlab.com/runningnak3d/lglaf


Version Information
Status: Testing

Created 2018-04-09
Last Updated 2018-10-09
 
Last edited:

FCORivers

Senior Member
Dec 31, 2011
941
309
Carolina
You ARE the man!

Good job, I'm certainly tempted to try, but have never done such kind of procedure to get root and I started flashing and rooting some time ago but everything was easier back then, I'll probably wait a bit, what's a week or two when I got the phone May last year.

Enjoy your time off. You really deserve it.


From a SM-960U that thinks is a SM-960U1...

Sent from my SM-G960U1 using Tapatalk
 

Denversmartphone

Senior Member
Mar 26, 2018
110
12
I feel like he just wants a way or a tool to unbrick Qualcomm 9008 models. Looking at his name and post on other thread. I might be wrong tho.


Amazing job btw. Much respect for you sir !!

it my fall, when i start to do laf partion i didn't see when come out laf partition, so i let the program do his job after i see that it come to system write and i understand that it was there that i will pull the cable out, btw i will wait some good person will found solution for the qualcomm 9008 problem..they made a lot of good job..and of course is my mistake...if someone know how to come out from this problem i will be grated for all life..for the moment i will wait..or i found someone can unlock for a good price i will pay him and do the job...
 

runningnak3d

Recognized Developer
Nov 10, 2010
2,649
7,204
Largo
The only fix for 9008 mode on UFS devices (which the G6 is) is a firehose programmer and QFIL. It is no longer possible to boot from an SD card. AFAIK, there is no signed (yes it MUST be signed) firehose for the H872.

Your only options are T-Mobile or LG warranty, or pay to have it repaired if it isn't under warranty. You could also swap the board with an H872 that has a cracked screen, but getting the thing apart looks like a real PITA.

-- Brian
 

Denversmartphone

Senior Member
Mar 26, 2018
110
12
The only fix for 9008 mode on UFS devices (which the G6 is) is a firehose programmer and QFIL. It is no longer possible to boot from an SD card. AFAIK, there is no signed (yes it MUST be signed) firehose for the H872.

Your only options are T-Mobile or LG warranty, or pay to have it repaired if it isn't under warranty. You could also swap the board with an H872 that has a cracked screen, but getting the thing apart looks like a real PITA.

-- Brian

did you think in the future will come out a firehose file the lg g6? very thanks for your unswer and help, and very good job, i admire this talent people
 

hendusoone

Senior Member
Dec 13, 2009
111
35
Boston, MA
Thanks for putting this together, runningnak3d!

So, reading through the tutorial, you say this towards the end, after doing the cleanup steps:
Now you have TWRP on laf, and recovery, and you are rooted.
So... does that mean attempting to boot into LAF will always put you into TWRP? If yes... is there any way to get the original LAF partition back, while keeping TWRP in recovery?
 

FCORivers

Senior Member
Dec 31, 2011
941
309
Carolina
  • Like
Reactions: Denversmartphone

runningnak3d

Recognized Developer
Nov 10, 2010
2,649
7,204
Largo
Thanks for putting this together, runningnak3d!

So, reading through the tutorial, you say this towards the end, after doing the cleanup steps:

So... does that mean attempting to boot into LAF will always put you into TWRP? If yes... is there any way to get the original LAF partition back, while keeping TWRP in recovery?

Yes, you can extract it from the 11g KDZ and flash it, but why? There will never be a situation where you would want laf over TWRP.

-- Brian
 

hendusoone

Senior Member
Dec 13, 2009
111
35
Boston, MA
Yes, you can extract it from the 11g KDZ and flash it, but why? There will never be a situation where you would want laf over TWRP.

-- Brian
My main reason is to maintain multiple methods of recovery. With a working LAF, you can flash a KDZ to get back to a working phone (even though it would need to be re-rooted). With TWRP in the LAF partition, if for some reason both instances of TWRP failed, that is no longer possible.
 
Last edited:

runningnak3d

Recognized Developer
Nov 10, 2010
2,649
7,204
Largo
If something stopped TWRP from booting on laf, then laf wouldn't boot on laf either. They are both just kernel / initrd boot images.

Do what you want, but trust me, you are a lot safer with two copies of TWRP.

-- Brian
 

NighthawkXL

Senior Member
Mar 4, 2013
396
313
Florida
If something stopped TWRP from booting on laf, then laf wouldn't boot on laf either. They are both just kernel / initrd boot images.

Do what you want, but trust me, you are a lot safer with two copies of TWRP.

-- Brian

Generally, I'd agree. Having redundant TWRP recoveries is probably better.

But it is nice that we can restore LAF on the off chance we want to restore the phone to default via KDZ. Perhaps to sell it or such.

---

Anyway, thanks for all the great work! I'll probably give it a whirl in a few days. Hopefully, this will spur some ROM development for the H872.
 

slayer3032

Senior Member
May 23, 2013
181
32
I made it all the way through to mounting system with read/write, twrp console just complains that it failed to mount /system with "device or resource busy". I haven't attempted to boot into recovery again since booting into system but twrp is definitely on laf still. I did try booting from laf twrp to recovery twrp before booting to system and it didn't have permissions either.

Installing Magisk doesn't give me root as it spits an error can't write to /system.

I truly never thought I'd ever see TWRP on this device, this is incredible.
 

beany23

Senior Member
Jan 15, 2015
633
487
I made it all the way through to mounting system with read/write, twrp console just complains that it failed to mount /system with "device or resource busy". I haven't attempted to boot into recovery again since booting into system but twrp is definitely on laf still. I did try booting from laf twrp to recovery twrp before booting to system and it didn't have permissions either.

Installing Magisk doesn't give me root as it spits an error can't write to /system.

I truly never thought I'd ever see TWRP on this device, this is incredible.

U can mount /system. If u still have twrp on the laf partition all u have to do is reboot twice back into twrp then go to mounts and check system, clear cache then flash the magisk zip. But one thing o truly hate about magisk is my frequencies don't stick on kernel apps so I flashed regular su and right now everything is running amazing.

---------- Post added at 02:04 PM ---------- Previous post was at 01:42 PM ----------

Also if anyone has got a bootloop after flashing something I found out that the phone reboots when you are restoring backup. To fix this flash recovery system and boot from the backup but u have to keep tapping on the screen so it dont timeout and restore wrong.
 
  • Like
Reactions: Ken C

Top Liked Posts

  • There are no posts matching your filters.
  • 59
    WARNING
    • DO NOT LET YOUR PHONE REBOOT, OR POWER OFF UNTIL I TELL YOU THAT IS WHAT YOU NEED TO DO.
      If you do, I am not sure what shape your phone will be in.
    • This should go without saying, but you MUST have your bootloader unlocked (check OEM UNLOCK in developer options AND fastboot oem unlock). If you don't, you will probably brick your phone.
    • If you use this on any model G6 besides the H872, you will be stuck in a bootloop, and you will not be able to fix it since you will have wiped out download mode!
    • This is safe if no mistakes are made (typos, missing a step, etc). However, if you do mess up, the risk is high that you lose download mode at best, or brick your phone at worst.
    • If you deviate from this procedure, and think: "I can just skip a step, or I can do this on my own Linux install". Don't complain if you brick your phone.

    PREREQUISITES:
    • You must have a version of laf that has the COPY opcode.
      Since none of the firmware available for the H872 has the COPY opcode, we have to use the H918 laf partition.
      Grab the H918 10p KDZ: link to 10p KDZ
    • You need to be on 11g or above. Be aware, once you are on 11g+ you cannot downgrade to any versions prior to 11g due to anti-rollback.
      You will need a copy of the KDZ that your phone is on. If you are not currently on 11g, upgrade before continuing.
      For 11g : Link to 11g KDZ
      For 11h : Link to 11h KDZ
      For 20a : Link to 20a KDZ
    • We are going to flash this using the patched LG UP. There may be one that was patched specifically for the G6 -- don't use it,
      it has NOT been tested. Grab the one for the V20: link
      It MUST be installed in: C:program Files (x86)LG ElectronicsLGUP
      You can't just unzip it anywhere and run it, it will not find the model file.
    • You need the H872 Unofficial 3.2.3 TWRP by @Eliminator74. 3.2.3 is included in the repo so that you know that you have the exact version.
      If you decide to use any other version, you will brick your phone because the commands below are for this exact version!
    • You need to grab FWUL (version 2.7 or later) and burn it to a USB stick: link
      Even if you have Linux, and you think you can install the dependencies, don't. I know this works from FWUL.
    • If you are rooting on 20a, you will need a Micro-SD card. Copy the TWRP 3.2.3 image and the latest Magisk zip to the SD card.

    WARNING: Only applies if rooting while on 20a
    Minor Encryption-related issues have occurred while testing 20a. If your data partition is encrypted, TWRP will NOT be able to decrypt it. Because of this, you will have to perform a wipe and format of your Data partition. Be sure to backup all data on your device prior to continuing by copying important files to an external SD card or using LG Mobile Switch to back it up.

    PROCEDURE PART 1: Getting a working LAF onto your phone
    By far this is the most dangerous part of this procedure.
    • Boot to download mode
    • In LG UP, choose partition DL.
    • Pick the H918 10p KDZ
    • Click start / ok
    • When you will be given a list of partitions to flash, only check laf
    • Click start / ok
    • You will get a warning about additional modified partitions -- ignore it, and click OK.
    • As a safety feature, LG UP will start flashing those modified partitions after laf completes flashing.
      After the flash is initiated, pay close attention to the "step" and as soon as it changes from laf to another partition, PULL THE USB CABLE!
      If you let it completely flash the H918 KDZ, your phone WILL reboot, and you WILL have a brick that can't be fixed.
      You need to pay attention, but you also don't need to be sitting on pins and needles. You have quite a bit of time to pull the cable since system is one of the partitions that is flashed
    • Click OK and it will start flashing.
    • Once laf is flashed, and you have pulled the USB cable, you can click exit, and then re-open LG UP.
    • Choose partition DL again, and this time pick the H872 KDZ for the version your phone was on prior to flashing 10p (11g, 11h, or 20a)
    • Select all partitions except laf. If you forget to uncheck laf, you will have to do this all over again.
    • When it completes, it will reboot your phone.
    • Go back into download mode. This time you will be running the H918 laf, and we can continue with PART 2


    PROCEDURE PART 2: Installing TWRP
    • Boot from your FWUL USB stick.
    • Put your phone into download mode. With the phone powered off, hold vol up and plug in the USB cable. You do not need to touch the power button -- the phone will power on and enter download mode.
      This will NOT look like normal download mode on the phone. All you will get is small box that says: "Download mode" -- this is normal. You will also not have ANY indication on the PHONE that it is being flashed.
    • Once booted, login. The password is: linux
    • Double click the LG folder that is on the desktop
    • Double click on LG LAF (runningnak3d) icon and you will be at a terminal prompt.
      The following are the commands that you enter into that terminal. You can copy / paste them if you like.
    Code:
    git pull
    git checkout h872-miscwrte
    ./step1.sh
    When you are told to, pull the USB cable, and the phone will power off. You now have TWRP on your laf partition. At this point you can flash a ROM, or Magisk or whatever you like, but I would suggest
    at least flashing TWRP to the recovery partition. There is no button combination to get into laf (download mode), so if you only have TWRP on laf, then you will need a USB cable to get into recovery.

    OPTIONAL:
    If you don't know what to do with TWRP, and you just want to run rooted stock 11g, 11h or 20a, this is for you....
    First boot into TWRP - with the phone off, hold vol up and plug in the USB cable.

    PROCEDURE PART 3: Rooting and cleanup
    Now that you are in TWRP:
    Nougat (11g, 11h Users)
    • ./step2.sh
    If you ran step2.sh you have TWRP on laf, and recovery, and you are rooted. If you only ran step1.sh, then you have TWRP on laf. Either way, enjoy!

    Oreo (20a) Users
    • Once in TWRP, click the “Wipe” button.
    • Choose Advanced Wipe and select the Dalvik, Data and Cache options and Wipe. Do not reboot the phone.
    • Go back to the main menu or main wipe screen
    • Select “Format Data” and complete the format.
    • Go back to the main menu and choose Install, and then Install Image.
    • Flash the TWRP 3.2.3 image from external_sd to the RECOVERY partition. DO NOT Reboot to System.
    • Go back to the main screen and attempt to reboot to Recovery.
    • If you are able to reboot to recovery without any issues, you should now Install the Magisk zip from external_sd.
    • After flashing Magisk, you may now reboot to system and Oreo should boot to the initial Android Setup screen.
    • After booting to Oreo, make sure you enable installations from Unknown Sources in your Android Settings and install the latest Magisk Manager.

    If Oreo boots to an "Encryption Unsuccessful" screen, you will need to format the Data partition again. Tap the reset button and it should boot to Recovery. Perform another wipe of cache/data/dalvik and go back to the Wipe screen and Format Data. Reboot system and you should boot to Oreo Normally.

    To Restore Download Mode
    20a - Flash @Eliminator74's Bootstock with LAF image using TWRP
    11g - Flash @weakNPCdotCom's StockLAF image using TWRP

    CREDITS:
    • @KAsp3rd -- he risked his phone to make this happen. There were no guarantees that the H918 laf would boot and function.
    • Lekensteyn -- His base work on the G2 / G3 gave me a GREAT headstart!
    • @steadfasterX - He added some real nice features, great guy to bounce ideas off, and just testing crazy ideas because he wasn't afraid to brick his phone :) Also, for FWUL
    • tuxuser - Helping with my lacking in Python
    • @smitel - His original reverse engineering of LG UP. Great inspiration!
    • @weakNPCdotCom - Testing/Help with H87220a (Oreo)

    -- Brian

    XDA:DevDB Information
    lafsploit - H872, Tool/Utility for the T-Mobile LG G6

    Contributors
    runningnak3d, KAsp3rd, weakNPCdotCom
    Source Code: http://gitlab.com/runningnak3d/lglaf


    Version Information
    Status: Testing

    Created 2018-04-09
    Last Updated 2018-10-09
    13
    I'll just leave this here.
    8
    I tried my hand at making a video tutorial for this method. There are a few mistakes, but hopefully it should still be helpful.
    Here's the link if anyone is interested:
    https://www.youtube.com/watch?v=-z4CWLikPcI
    6
    Fired everything up again (after having some much needed rest), all systems are functioning and root has been obtained.
    @runningnak3d - Going back to restoring stock LAF, you said we can extract it from the KDZ, but where to we flash it from? or it just a image we can do inside TWRP from recovery?

    If you want to restore original laf:

    1- Download original laf here: https://drive.google.com/file/d/1CfqXtGVMlyOHbOfzFGTFOKBECF1oGkML/view?usp=sharing

    2- Copy laf.img to phone.

    3- Enable adb on phone.

    4- Open command prompt.

    5- Adb shell, accept adb on phone.

    6- Su, allow on phone.

    7- dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/laf

    8- dd if=/sdcard/laf.img of=/dev/block/platform/soc/624000.ufshc/by-name/laf

    Now you have stock laf and you can enter on download mode again.
    6
    Exactly what I'm asking, I want to flash a real H872 twrp to recovery partition via the laf h870 twrp installed during the root process. Right now we can't flash H872 custom roms (without modifying the zip) because twrp thinks it's a H872. Thank you for your reply.

    Understood. I haven't had the time to build TWRP for the 872 yet. I should have one out in the coming days. Unless you happen to know where one exists