[ROOT] H872 (up to and including 20g)

[runningnak3d]

WARNING​

• DO NOT LET YOUR PHONE REBOOT, OR POWER OFF UNTIL I TELL YOU THAT IS WHAT YOU NEED TO DO.
  If you do, I am not sure what shape your phone will be in.
• This should go without saying, but you MUST have your bootloader unlocked (check OEM UNLOCK in developer options AND fastboot oem unlock). If you don't, you will probably brick your phone.
• If you use this on any model G6 besides the H872, you will be stuck in a bootloop, and you will not be able to fix it since you will have wiped out download mode!
• This is safe if no mistakes are made (typos, missing a step, etc). However, if you do mess up, the risk is high that you lose download mode at best, or brick your phone at worst.
• If you deviate from this procedure, and think: "I can just skip a step, or I can do this on my own Linux install". Don't complain if you brick your phone.

PREREQUISITES:

• You must have a version of laf that has the COPY opcode.
  Since none of the firmware available for the H872 has the COPY opcode, we have to use the H918 laf partition.
  Grab the H918 10p KDZ: link to 10p KDZ
• You need to be on 11g or above. Be aware, once you are on 11g+ you cannot downgrade to any versions prior to 11g due to anti-rollback.
  You will need a copy of the KDZ that your phone is on. If you are not currently on 11g, upgrade before continuing.
  For 11g : Link to 11g KDZ
  For 11h : Link to 11h KDZ
  For 20a : Link to 20a KDZ
• We are going to flash this using the patched LG UP. There may be one that was patched specifically for the G6 -- don't use it,
  it has NOT been tested. Grab the one for the V20: link
  It MUST be installed in: Crogram Files (x86)LG ElectronicsLGUP
  You can't just unzip it anywhere and run it, it will not find the model file.
• You need the H872 Unofficial 3.2.3 TWRP by @Eliminator74. 3.2.3 is included in the repo so that you know that you have the exact version.
  If you decide to use any other version, you will brick your phone because the commands below are for this exact version!
• You need to grab FWUL (version 2.7 or later) and burn it to a USB stick: link
  Even if you have Linux, and you think you can install the dependencies, don't. I know this works from FWUL.
• If you are rooting on 20a, you will need a Micro-SD card. Copy the TWRP 3.2.3 image and the latest Magisk zip to the SD card.

WARNING: Only applies if rooting while on 20a
Minor Encryption-related issues have occurred while testing 20a. If your data partition is encrypted, TWRP will NOT be able to decrypt it. Because of this, you will have to perform a wipe and format of your Data partition. Be sure to backup all data on your device prior to continuing by copying important files to an external SD card or using LG Mobile Switch to back it up.

PROCEDURE PART 1: Getting a working LAF onto your phone
By far this is the most dangerous part of this procedure.

• Boot to download mode
• In LG UP, choose partition DL.
• Pick the H918 10p KDZ
• Click start / ok
• When you will be given a list of partitions to flash, only check laf
• Click start / ok
• You will get a warning about additional modified partitions -- ignore it, and click OK.
• As a safety feature, LG UP will start flashing those modified partitions after laf completes flashing.
  After the flash is initiated, pay close attention to the "step" and as soon as it changes from laf to another partition, PULL THE USB CABLE!
  If you let it completely flash the H918 KDZ, your phone WILL reboot, and you WILL have a brick that can't be fixed.
  You need to pay attention, but you also don't need to be sitting on pins and needles. You have quite a bit of time to pull the cable since system is one of the partitions that is flashed
• Click OK and it will start flashing.
• Once laf is flashed, and you have pulled the USB cable, you can click exit, and then re-open LG UP.
• Choose partition DL again, and this time pick the H872 KDZ for the version your phone was on prior to flashing 10p (11g, 11h, or 20a)
• Select all partitions except laf. If you forget to uncheck laf, you will have to do this all over again.
• When it completes, it will reboot your phone.
• Go back into download mode. This time you will be running the H918 laf, and we can continue with PART 2

PROCEDURE PART 2: Installing TWRP

• Boot from your FWUL USB stick.
• Put your phone into download mode. With the phone powered off, hold vol up and plug in the USB cable. You do not need to touch the power button -- the phone will power on and enter download mode.
  This will NOT look like normal download mode on the phone. All you will get is small box that says: "Download mode" -- this is normal. You will also not have ANY indication on the PHONE that it is being flashed.
• Once booted, login. The password is: linux
• Double click the LG folder that is on the desktop
• Double click on LG LAF (runningnak3d) icon and you will be at a terminal prompt.
  The following are the commands that you enter into that terminal. You can copy / paste them if you like.

git pull
git checkout h872-miscwrte
./step1.sh

When you are told to, pull the USB cable, and the phone will power off. You now have TWRP on your laf partition. At this point you can flash a ROM, or Magisk or whatever you like, but I would suggest
at least flashing TWRP to the recovery partition. There is no button combination to get into laf (download mode), so if you only have TWRP on laf, then you will need a USB cable to get into recovery.

OPTIONAL:
If you don't know what to do with TWRP, and you just want to run rooted stock 11g, 11h or 20a, this is for you....
First boot into TWRP - with the phone off, hold vol up and plug in the USB cable.

PROCEDURE PART 3: Rooting and cleanup
Now that you are in TWRP:
Nougat (11g, 11h Users)

• ./step2.sh

If you ran step2.sh you have TWRP on laf, and recovery, and you are rooted. If you only ran step1.sh, then you have TWRP on laf. Either way, enjoy!

Oreo (20a) Users

• Once in TWRP, click the “Wipe” button.
• Choose Advanced Wipe and select the Dalvik, Data and Cache options and Wipe. Do not reboot the phone.
• Go back to the main menu or main wipe screen
• Select “Format Data” and complete the format.
• Go back to the main menu and choose Install, and then Install Image.
• Flash the TWRP 3.2.3 image from external_sd to the RECOVERY partition. DO NOT Reboot to System.
• Go back to the main screen and attempt to reboot to Recovery.
• If you are able to reboot to recovery without any issues, you should now Install the Magisk zip from external_sd.
• After flashing Magisk, you may now reboot to system and Oreo should boot to the initial Android Setup screen.
• After booting to Oreo, make sure you enable installations from Unknown Sources in your Android Settings and install the latest Magisk Manager.

If Oreo boots to an "Encryption Unsuccessful" screen, you will need to format the Data partition again. Tap the reset button and it should boot to Recovery. Perform another wipe of cache/data/dalvik and go back to the Wipe screen and Format Data. Reboot system and you should boot to Oreo Normally.

To Restore Download Mode
20a - Flash @Eliminator74's Bootstock with LAF image using TWRP
11g - Flash @weakNPCdotCom's StockLAF image using TWRP

CREDITS:

• @KAsp3rd -- he risked his phone to make this happen. There were no guarantees that the H918 laf would boot and function.
• Lekensteyn -- His base work on the G2 / G3 gave me a GREAT headstart!
• @steadfasterX - He added some real nice features, great guy to bounce ideas off, and just testing crazy ideas because he wasn't afraid to brick his phone Also, for FWUL
• tuxuser - Helping with my lacking in Python
• @smitel - His original reverse engineering of LG UP. Great inspiration!
• @weakNPCdotCom - Testing/Help with H87220a (Oreo)

-- Brian

XDA:DevDB Information
lafsploit - H872, Tool/Utility for the T-Mobile LG G6

Contributors
runningnak3d, KAsp3rd, weakNPCdotCom
Source Code: http://gitlab.com/runningnak3d/lglaf


Version Information
Status: Testing

Created 2018-04-09
Last Updated 2018-10-09

 

[FCORivers]

You ARE the man!

Good job, I'm certainly tempted to try, but have never done such kind of procedure to get root and I started flashing and rooting some time ago but everything was easier back then, I'll probably wait a bit, what's a week or two when I got the phone May last year.

Enjoy your time off. You really deserve it.


From a SM-960U that thinks is a SM-960U1...

Sent from my SM-G960U1 using Tapatalk

 

[Denversmartphone]

brick to me i didn't pull out the cable during laf partition...im on qualcomm 9008 no way to come out

 

[runningnak3d]

Just curious, did you somehow overlook that step, or were you not looking and missed it?

-- Brian

 

[pantmunu]

Just curious, did you somehow overlook that step, or were you not looking and missed it?

-- Brian

I feel like he just wants a way or a tool to unbrick Qualcomm 9008 models. Looking at his name and post on other thread. I might be wrong tho.


Amazing job btw. Much respect for you sir !!

 

[Denversmartphone]

I feel like he just wants a way or a tool to unbrick Qualcomm 9008 models. Looking at his name and post on other thread. I might be wrong tho.


Amazing job btw. Much respect for you sir !!

it my fall, when i start to do laf partion i didn't see when come out laf partition, so i let the program do his job after i see that it come to system write and i understand that it was there that i will pull the cable out, btw i will wait some good person will found solution for the qualcomm 9008 problem..they made a lot of good job..and of course is my mistake...if someone know how to come out from this problem i will be grated for all life..for the moment i will wait..or i found someone can unlock for a good price i will pay him and do the job...

 

[runningnak3d]

The only fix for 9008 mode on UFS devices (which the G6 is) is a firehose programmer and QFIL. It is no longer possible to boot from an SD card. AFAIK, there is no signed (yes it MUST be signed) firehose for the H872.

Your only options are T-Mobile or LG warranty, or pay to have it repaired if it isn't under warranty. You could also swap the board with an H872 that has a cracked screen, but getting the thing apart looks like a real PITA.

-- Brian

 

[Denversmartphone]

The only fix for 9008 mode on UFS devices (which the G6 is) is a firehose programmer and QFIL. It is no longer possible to boot from an SD card. AFAIK, there is no signed (yes it MUST be signed) firehose for the H872.

Your only options are T-Mobile or LG warranty, or pay to have it repaired if it isn't under warranty. You could also swap the board with an H872 that has a cracked screen, but getting the thing apart looks like a real PITA.

-- Brian

did you think in the future will come out a firehose file the lg g6? very thanks for your unswer and help, and very good job, i admire this talent people

 

[Polycarbonate]

Done!!! Where's your PayPal brother? I need to give you my pledge, thanks so much for opening the doors for this device's development. Can't thank you enough really...

 

[runningnak3d]

Glad you came through it without issue.

Just click on the Donate to Me button -- tis linked to my PayPal.

Thanks,

-- Brian

 

[Denversmartphone]

Guys i found this on the web... maybe for the profesional user this can be a way to unbrick lg g6 with hard brick like mine https://www.androidbrick.com/download/download-latest-2018-qualcomm-flasher-qfil-qpst-2-7-472/
i try to use it and i didn't understand nothing..but my mobile it see as download mode

 

[hendusoone]

Thanks for putting this together, runningnak3d!

So, reading through the tutorial, you say this towards the end, after doing the cleanup steps:

Now you have TWRP on laf, and recovery, and you are rooted.

So... does that mean attempting to boot into LAF will always put you into TWRP? If yes... is there any way to get the original LAF partition back, while keeping TWRP in recovery?

 

[FCORivers]

Guys i found this on the web... maybe for the profesional user this can be a way to unbrick lg g6 with hard brick like mine https://www.androidbrick.com/download/download-latest-2018-qualcomm-flasher-qfil-qpst-2-7-472/
i try to use it and i didn't understand nothing..but my mobile it see as download mode

It's for Huawei.

Sent from my SM-G960U1 using Tapatalk

 

[runningnak3d]

Thanks for putting this together, runningnak3d!

So, reading through the tutorial, you say this towards the end, after doing the cleanup steps:

So... does that mean attempting to boot into LAF will always put you into TWRP? If yes... is there any way to get the original LAF partition back, while keeping TWRP in recovery?

Yes, you can extract it from the 11g KDZ and flash it, but why? There will never be a situation where you would want laf over TWRP.

-- Brian

 

[hendusoone]

Yes, you can extract it from the 11g KDZ and flash it, but why? There will never be a situation where you would want laf over TWRP.

-- Brian

My main reason is to maintain multiple methods of recovery. With a working LAF, you can flash a KDZ to get back to a working phone (even though it would need to be re-rooted). With TWRP in the LAF partition, if for some reason both instances of TWRP failed, that is no longer possible.

 

[runningnak3d]

If something stopped TWRP from booting on laf, then laf wouldn't boot on laf either. They are both just kernel / initrd boot images.

Do what you want, but trust me, you are a lot safer with two copies of TWRP.

-- Brian

 

[NighthawkXL]

If something stopped TWRP from booting on laf, then laf wouldn't boot on laf either. They are both just kernel / initrd boot images.

Do what you want, but trust me, you are a lot safer with two copies of TWRP.

-- Brian

Generally, I'd agree. Having redundant TWRP recoveries is probably better.

But it is nice that we can restore LAF on the off chance we want to restore the phone to default via KDZ. Perhaps to sell it or such.

---

Anyway, thanks for all the great work! I'll probably give it a whirl in a few days. Hopefully, this will spur some ROM development for the H872.

 

[slayer3032]

I made it all the way through to mounting system with read/write, twrp console just complains that it failed to mount /system with "device or resource busy". I haven't attempted to boot into recovery again since booting into system but twrp is definitely on laf still. I did try booting from laf twrp to recovery twrp before booting to system and it didn't have permissions either.

Installing Magisk doesn't give me root as it spits an error can't write to /system.

I truly never thought I'd ever see TWRP on this device, this is incredible.

 

[beany23]

I made it all the way through to mounting system with read/write, twrp console just complains that it failed to mount /system with "device or resource busy". I haven't attempted to boot into recovery again since booting into system but twrp is definitely on laf still. I did try booting from laf twrp to recovery twrp before booting to system and it didn't have permissions either.

Installing Magisk doesn't give me root as it spits an error can't write to /system.

I truly never thought I'd ever see TWRP on this device, this is incredible.

U can mount /system. If u still have twrp on the laf partition all u have to do is reboot twice back into twrp then go to mounts and check system, clear cache then flash the magisk zip. But one thing o truly hate about magisk is my frequencies don't stick on kernel apps so I flashed regular su and right now everything is running amazing.

---------- Post added at 02:04 PM ---------- Previous post was at 01:42 PM ----------

Also if anyone has got a bootloop after flashing something I found out that the phone reboots when you are restoring backup. To fix this flash recovery system and boot from the backup but u have to keep tapping on the screen so it dont timeout and restore wrong.

 

[bickfordman]

Think I will wait till next week I'm just happy you got this far