[ROOT] H932 - lafploit 1.5 up to v20a

[runningnak3d]

WARNING​

• DO NOT LET YOUR PHONE REBOOT, OR POWER OFF UNTIL I TELL YOU THAT IS WHAT YOU NEED TO DO.
  If you do, I am not sure what shape your phone will be in.
• This should go without saying, but you MUST have your bootloader unlocked (check OEM UNLOCK in developer options AND fastboot oem unlock). If you don't, you will probably brick your phone.
• If you use this on any model V30 besides the H932, you will be stuck in a bootloop, and you will not be able to fix it since you will have wiped out download mode!
• This is safe if no mistakes are made (typos, missing a step, etc). However, if you do mess up, the risk is high that you lose download mode at best, or brick your phone at worst.
• If you deviate from this procedure, and think: "I can just skip a step, or I can do this on my own Linux install". Don't complain if you brick your phone.

PREREQUISITES:

• You MUST to be on 10d: link
• You must have H933 10h laf installed. You will need the KDZ: link
• We are going to flash this using the patched LG UP: link MOD EDIT: original link dead. Try THIS ONE instead
  It MUST be installed in: Crogram Files (x86)LG ElectronicsLGUP
  You can't just unzip it anywhere and run it, it will not find the model file.
• You need TWRP: link
• You need an SD card that is formatted for FAT16 with TWRP copied onto it EXACTLY as it is named when you download it.
• You need to grab FWUL (version 2.7 or later) and burn it to a USB stick: link
  Even if you have Linux, and you think you can install the dependencies, don't. I know this works from FWUL.
• After installing TWRP, grab @weakNPCdotCom's latest TWRP flashable ROM threads: Oreo 20s or Pie 30d
• MOD EDIT: If your phone is (or has been) on Pie, you need to use a later LGUP version to roll back to Nougat 10d, then SWITCH to the original LGUP version linked below for the remaining steps. See this post for details.

PROCEDURE PART 1: Getting a working LAF onto your phone
By far this is the most dangerous part of this procedure.

• Make sure you are on or downgraded to 10d
• Boot to download mode
• In LG UP, choose partition DL.
• Pick the H933 10h KDZ
• Click start
• You will be given a list of partitions to flash, ONLY check laf
• Click start
• You will get a warning about additional modified partitions -- ignore it, and click OK.
• As a safety feature, LG UP will start flashing those modified partitions after laf completes flashing.
  After the flash is initiated, pay close attention to the "step" and as soon as it changes from laf to another partition, PULL THE USB CABLE!
  If you let it completely flash the H933 KDZ, your phone WILL reboot, and you WILL have a brick that can't be fixed.
  You NEED to pay attention. The additional partitions that are flashed are very small. The second that step changes from laf to
  the next partition, PULL THE USB CABLE!
• Click OK and it will start flashing.
• Once laf is flashed, and you have pulled the USB cable, you can click exit, and then re-open LG UP.
• Choose partition DL again, and this time pick the H932 10d KDZ.
• Select all partitions except laf. If you forget to uncheck laf, you will have to do this all over again.
• When it completes, it will reboot your phone.
• Go back into download mode. This time you will be running the H933 laf, and we can continue with PART 2

PROCEDURE PART 2: Installing TWRP

• Boot from your FWUL USB stick.
• Put your phone into download mode. With the phone powered off, hold vol up and plug in the USB cable. You do not need to
  touch the power button -- the phone will power on and enter download mode.
• Once booted, login. The password is: linux
• Double click the LG folder that is on the desktop
• Double click on LG LAF (runningnak3d) icon and you will be at a terminal prompt.
  The following are the commands that you enter into that terminal. You can copy / paste them if you like.

MOD EDIT: Refer to THIS POST to make sure that LGLAF is able to read the SD card

git pull
git checkout h932-dd-write
./step1.sh

When you are told to, pull the USB cable, and the phone will power off. You now have TWRP installed. At this point you can flash a ROM, or Magisk or whatever you like.

You must use the key combination (with phone off, hold vol down + power. When the LG logo appears, immediately release and then hold power until you get the the factory reset screen. Choose yes twice and you will be in TWRP) to IMMEDIATELY boot into recovery. If you don't, then recovery-from-boot.p will wipe out TWRP, and you will have to do THIS part again.



CREDITS:

• Lekensteyn -- His base work on the G2 / G3 gave me a GREAT headstart!
• @steadfasterX - He added some real nice features, great guy to bounce ideas off, and just testing crazy ideas because he wasn't afraid to brick his phone Also, for FWUL
• tuxuser - Helping with my lacking in Python
• @smitel - His original reverse engineering of LG UP. Great inspiration!

-- Brian

XDA:DevDB Information
[H932] lafsploit 1.5, Tool/Utility for the LG V30

Contributors
runningnak3d

Version Information
Status: Testing

Created 2018-09-14
Last Updated 2020-07-21

 

[runningnak3d]

PROCEDURE PART 1: Getting a working LAF onto your phone

• Make sure you are on version 10d. Again, check in Software Info / Software Version if you are unsure.
• Boot to download mode
• In LG UP, choose partition DL.
• Pick the H933 10h KDZ
• Click start
• You will be given a list of partitions to flash, ONLY check laf
• Click start
• You will get a warning about additional modified partitions (cache, OP, userdata) -- ignore it, and click OK.
• Click OK and it will start flashing.
• Once the flash completes, your phone will reboot into the OS. Just power off, and go back into download mode.
• Choose partition DL again, and this time pick the H932 10d KDZ.
• Select all partitions except laf. If you forget to uncheck laf, you will have to do this all over again.
• When it completes, it will reboot your phone.
• Go back into download mode. This time you will be running the H933 laf, and we can continue with PART 2

 

[runningnak3d]

PROCEDURE PART 2: Installing TWRP and rooting

• Make sure the SD card is in your phone.
• Boot from your FWUL USB stick.
• Put your phone into download mode. With the phone powered off, hold vol up and plug in the USB cable. You do not need to
  touch the power button -- the phone will power on and enter download mode.
• Once booted, login. The password is: linux
• Double click the LG folder that is on the desktop
• Double click on LG LAF (runningnak3d) icon and you will be at a terminal prompt.
  The following are the commands that you enter into that terminal. You can copy / paste them if you like.

git pull
git checkout h932-dd-write
./lglaf.py

These next commands you will type into the LGLAF shell. It will look like this:

LGLAF.py by Peter Wu (https://lekensteyn.nl/lglaf)
Type a shell command to execute or "exit" to leave.
#

You will type these commands at the # prompt that you see above. When you enter the commands, you will NOT get any indication that the command completed. However, if you get this:

Hello, I am LAF. Nice to meet you.

then you typed the command incorrectly, and you need to try again. There are TWO spaces between !EXEC and toybox.
Also, the phone will NOT indicate that flashing is taking place since we are using dd and NOT the normal WRTE opcode. When you enter !CTRL POFF, the phone will go to 100%.

Lastly CAPS matter. These lines need to be typed exactly (better to use copy / paste). If you mess up, it is no big deal, just try again.

!EXEC  toybox dd if=/storage/external_SD/twrp.img of=/dev/block/sde bs=4096 seek=10246\0
!CTRL POFF

You can now pull the USB cable, and your phone will power off. You now have TWRP installed. At this point you can flash a ROM, or Magisk or whatever you like.

You must use the key combination to immediately boot to TWRP:

• Power off your phone
• Hold vol down + power.
• When the LG logo appears, immediately release power (and ONLY power) and then immediately hold power again until you get the the factory reset screen.
  You never let go of vol down until the factory reset screen appears. Once it appears, you can release both buttons.
• Choose yes twice by using the vol down key and power to select, and you will be in TWRP.

You should only tap the power key to select yes. Don't press and hold, and don't spam the power key.
It takes TWRP a little bit to boot -- be patient.
If you don't do this, and you let the phone boot into the OS, then recovery-from-boot.p will wipe out TWRP, and you will have to do THIS part again.
By THIS part, I mean if you mess up the key combo, and the phone boots to the OS, you only have to do PART 2 -- not this entire process.

ROOTING:
OK, so now you are in TWRP, we need to flash a few things or TWRP will be wiped out, and your phone will be encrypted again.

• First swipe to allow modifications
• Choose wipe / format data / type yes
• Choose reboot / recovery -- this will reload TWRP. Do not choose reboot / system. Make sure that when it reboots you are able to mount data without it prompting for a pin / passcode.
  If it does, then you need to format data again and reboot to recovery because you chose WIPE and not FORMAT.
• Pick install, and browse to your SD card where you have Magisk, dm-noverity-opt-encrypt, and rctd remover
• You can install each one individually, or you can add them all together in the queue -- it is your choice. Also, Magisk needs to be flashed first -- the order of the other two zips doesn't matter.
• Now that they are flashed, reboot to recovery yet again just for good measure. If everything looks good, reboot to system and you should have a rooted phone.

OPTIONAL:
If you would like a second copy of TWRP on your laf partition (I *highly* recommend this), follow these instructions:

• Download the version of TWRP that you want to install onto laf.
• Rename it to twrp.img
• Boot your phone to TWRP, and connect it to your PC
• Open a command prompt where you downloaded TWRP and type:
  • adb push twrp.img /sdcard/
  • adb shell dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/laf

With the phone off, hold vol up and plug in the USB cable and you should be greeted by your second copy of TWRP.


CLEANING UP:
If you do NOT want TWRP on laf, then we at least need to get the H932 laf back onto your phone.

• Download this zip onto your phone: h932_laf.zip
• Boot to TWRP
• Choose install, and browse to where you downloaded the zip
• When it finishes flashing, you will have the H932 laf back.

I can't say this enough, you should really consider keeping two copies of TWRP around. You will never be in a situation where you go: "Man, I wish I had download mode, but all I have is TWRP".
However, there are plenty of times that you may wish that you had a second copy of TWRP. Imagine flashing a ROM that wipes out recovery. Oppps. Imagine flashing a new version of TWRP and
it doesn't boot -- again -- opps.

-- Brian

 

[ChazzMatt]

I've added link to WTF instructions pointing T-mobile H932 users to here. ALL other V30/30+/V30S can use that easier method, but T-mobile H932 HAS to use this method.

 

[runningnak3d]

OK -- those are the final instructions for now. Root away!

I have upgraded to Oreo, and then downgraded to 10d and tested this 4 times so I know it works fine. However, getting H933 laf onto your phone is dangerous. PLEASE pay attention and pull the USB cable. You can be too quick -- pulling it while it is still flashing laf. If you do, then you just need to flash 10d and start again. However, if you wait and your phone reboots, the H933 has a different RSA key and your phone is toast.

I don't have a TMO G7 to test with, but this should work for them as well. Just need to find the correct laf to flash for them.

-- Brian

 

[HKSpeed]

I remember when the OP released this method for the T-Mobile G6 (I used to have one). Many bricked their phones in the process. Others were successful and happy. Too risky for me.

 

[runningnak3d]

I can't post a screenshot right now, but here ya go -- proof that this works:

joan:/ $ su
joan:/ # 
joan:/ # cd sys                                                                                         
sys/     system/
joan:/ # cd system/                                                                                     
joan:/system # cat build.prop | grep H932                                                               
ro.product.model=LG-H932
ro.lge.swversion=H93210d
ro.lge.factoryversion=LGH932AT-00-V10d-TMO-US-JAN-11-2018-ARB00+0
joan:/system #

-- Brian

 

[inuyasha1999]

First thing: Nice job, Brian! Thank you, and those who helped bring this to light by being guinea pigs.

Second: Brian, there appears to be a break in the link for FWUL. I was still able to copy the link text, then take the break out after pasting it into the address bar to get to the page, but wanted to let you know that the break is there.

 

[Josh McGrath]

OK --

I don't have a TMO G7 to test with, but this should work for them as well. Just need to find the correct laf to flash for them.

-- Brian

Man I hope that's true but the g7 has a locked bootloader HTC style unlock now. LG haven't unlocked the Tmo version last I checked unless I missed something

Also, so it's okay to OTA to Oreo now? I'm on nougat and much rather be on Oreo

 

[runningnak3d]

NOOO Don't ever take an OTA. You will need to flash an Oreo zip to get back. I am guessing there isn't one since there would be no need.

I don't have time to make one today unfortunately.

EDIT: and what?! you mean TMO finally has a locked bootloader on the G7 just like all other carriers? They didn't just strip fastboot flash, they removed oem unlock as well?

-- Brian

 

[runningnak3d]

First thing: Nice job, Brian! Thank you, and those who helped bring this to light by being guinea pigs.

Second: Brian, there appears to be a break in the link for FWUL. I was still able to copy the link text, then take the break out after pasting it into the address bar to get to the page, but wanted to let you know that the break is there.

Fixed. Please let me know if you catch anything else.

-- Brian

 

[Josh McGrath]

NOOO Don't ever take an OTA. You will need to flash an Oreo zip to get back. I am guessing there isn't one since there would be no need.

I don't have time to make one today unfortunately.

EDIT: and what?! you mean TMO finally has a locked bootloader on the G7 just like all other carriers? They didn't just strip fastboot flash, they removed oem unlock as well?

-- Brian

I should have added im sick in bed today and haven't rooted yet so itd be a 100pct stock OTA. Is it still not recommend to OTA to Oreo beforehand?

And yup, it appears LG has done the HTC style unlock and the Tmo version isn't unlockable yet and probably won't be Imo. I think it was LG but could be Tmo since it seems the more custs they get, the more like at&t they become

 

[runningnak3d]

I should have added im sick in bed today and haven't rooted yet so itd be a 100pct stock OTA. Is it still not recommend to OTA to Oreo beforehand?

And yup, it appears LG has done the HTC style unlock and the Tmo version isn't unlockable yet and probably won't be Imo. I think it was LG but could be Tmo since it seems the more custs they get, the more like at&t they become

If you did, you will be wasting your time since you have to downgrade to 10d.

I will try to get a 20a flashable zip up as soon as I can.

-- Brian

 

[Josh McGrath]

If you did, you will be wasting your time since you have to downgrade to 10d.

I will try to get a 20a flashable zip up as soon as I can.

-- Brian

Wow. Being so sick has made me not think straight . I can't believe I didn't think about that since you have to flash back to 10d.

No pressure on the flashable. It isn't that big of deal for me or us but thanks for thinking about us with the extra work.

 

[me2151]

Hey Brian. I dont know if you saw my pm but im glad it works

 

[runningnak3d]

@me2151 No, sorry, my PM box is so backed up. I am going to have to spend some time this weekend going through it.

This isn't quite the same as lafsploit for the H918, but the concept came from research for that project.

Next tasks:
* Get Oreo and root working on the V20
* Get all other G6s root in addition to the H872
* Consider buying a V30 so I can help here as well

-- Brian

 

[me2151]

@me2151 No, sorry, my PM box is so backed up. I am going to have to spend some time this weekend going through it.

This isn't quite the same as lafsploit for the H918, but the concept came from research for that project.

Next tasks:
* Get Oreo and root working on the V20
* Get all other G6s root in addition to the H872
* Consider buying a V30 so I can help here as well

-- Brian

Ah lol. My pm had jsut suggested taking a look into the h932 since its similar to the h918 in regards to bootloader. yea you should join us. I have my P rom working now. ill probably hold off on releasing it to the public though til i do more features. However. Only non stock rom to have enforcing on Joan

 

[igotroot]

@runningnak3d

You stated, "You need to grab FWUL (version 2.7 or later) and burn it to a USB stick: link
Even if you have Linux, and you think you can install the dependencies, don't. I know this works from FWUL."

When I went to the page it has 2 options/2 types of FWUL... which should we download:

"Main Download Server:
persistent mode ( read FAQ #4 ): Latest version (click)
forgetful mode ( read FAQ #4 ): Latest version (click)"

I'm guessing Persistent mode version....?

Thanks

WARNING​

• DO NOT LET YOUR PHONE REBOOT, OR POWER OFF UNTIL I TELL YOU THAT IS WHAT YOU NEED TO DO.
  If you do, I am not sure what shape your phone will be in.
• This should go without saying, but you MUST have your bootloader unlocked (check OEM UNLOCK in developer options AND fastboot oem unlock). If you don't, you will probably brick your phone.
• If you use this on any model V30 besides the H932, you will be stuck in a bootloop, and you will not be able to fix it since you will have wiped out download mode!
• This is safe if no mistakes are made (typos, missing a step, etc). However, if you do mess up, the risk is high that you lose download mode at best, or brick your phone at worst.
• If you deviate from this procedure, and think: "I can just skip a step, or I can do this on my own Linux install". Don't complain if you brick your phone.

PREREQUISITES:

• You MUST to be on 10d: link
• You must have H933 10h laf installed. You will need the KDZ: link
• We are going to flash this using the patched LG UP: link
  It MUST be installed in: Crogram Files (x86)LG ElectronicsLGUP
  You can't just unzip it anywhere and run it, it will not find the model file.
• You need TWRP: link
• You need Magisk: link
• You need an SD card that is formatted for FAT16 with TWRP copied onto it and named twrp.img. Also copy the Magisk zip onto the card.
• You need to grab FWUL (version 2.7 or later) and burn it to a USB stick: link
  Even if you have Linux, and you think you can install the dependencies, don't. I know this works from FWUL.

PROCEDURE PART 1: Getting a working LAF onto your phone
By far this is the most dangerous part of this procedure.

• Make sure you are on or downgraded to 10d
• Boot to download mode
• In LG UP, choose partition DL.
• Pick the H933 10h KDZ
• Click start
• You will be given a list of partitions to flash, ONLY check laf
• Click start
• You will get a warning about additional modified partitions -- ignore it, and click OK.
• As a safety feature, LG UP will start flashing those modified partitions after laf completes flashing.
  After the flash is initiated, pay close attention to the "step" and as soon as it changes from laf to another partition, PULL THE USB CABLE!
  If you let it completely flash the H933 KDZ, your phone WILL reboot, and you WILL have a brick that can't be fixed.
  You NEED to pay attention. The additional partitions that are flashed are very small. The second that step changes from laf to
  the next partition, PULL THE USB CABLE!
• Click OK and it will start flashing.
• Once laf is flashed, and you have pulled the USB cable, you can click exit, and then re-open LG UP.
• Choose partition DL again, and this time pick the H932 10d KDZ.
• Select all partitions except laf. If you forget to uncheck laf, you will have to do this all over again.
• When it completes, it will reboot your phone.
• Go back into download mode. This time you will be running the H933 laf, and we can continue with PART 2

PROCEDURE PART 2: Installing TWRP

• Boot from your FWUL USB stick.
• Put your phone into download mode. With the phone powered off, hold vol up and plug in the USB cable. You do not need to
  touch the power button -- the phone will power on and enter download mode.
• Once booted, login. The password is: linux
• Double click the LG folder that is on the desktop
• Double click on LG LAF (runningnak3d) icon and you will be at a terminal prompt.
  The following are the commands that you enter into that terminal. You can copy / paste them if you like.

git pull
git checkout h932-dd-write
./lgaf.py
!EXEC  toybox dd if=/storage/external_SD/twrp.img of=/dev/block/sde bs=4096 seek=10246\0
!CTRL POFF

When you are told to, pull the USB cable, and the phone will power off. You now have TWRP installed. At this point you can flash a ROM, or Magisk or whatever you like.

You must use the key combination (with phone off, hold vol down + power. When the LG logo appears, immediately release and then hold power until you get the the factory reset screen. Choose yes twice and you will be in TWRP) to IMMEDIATELY boot into recovery. If you don't, then recovery-from-boot.p will wipe out TWRP, and you will have to do THIS part again.

You will have to format data, and make sure you flash Magisk before rebooting into the OS!

CREDITS:

• Lekensteyn -- His base work on the G2 / G3 gave me a GREAT headstart!
• @steadfasterX - He added some real nice features, great guy to bounce ideas off, and just testing crazy ideas because he wasn't afraid to brick his phone Also, for FWUL
• tuxuser - Helping with my lacking in Python
• @smitel - His original reverse engineering of LG UP. Great inspiration!

-- Brian

XDA:DevDB Information
[H932] lafsploit 1.5, Tool/Utility for the LG V30

Contributors
runningnak3d

Version Information
Status: Testing

Created 2018-09-14
Last Updated 2018-09-14

 

[kevin71246]

Feedback

I had a moment to go through the instructions as a "typical user", and am providing feedback to make this as painless as possible, crystal-clear, & hopefully prevent any bricks!: (Please correct any inaccuracies!!)

• 
  

  This should go without saying, but you MUST have your bootloader unlocked (check OEM UNLOCK in developer options AND fastboot oem unlock)...

  EVERYTHING should be said!!! Especially things that will brick our phones People like me that ARE extremely computer literate and have been 'custom rom-ing' for almost a decade still won't know all of these nuances. I've been just catching up on all of these advancements with the V30 and your latest discovery, read hundreds of posts, but I still won't pretend to know everything! And apparently a mistake like this could've made my phone gar-bosh. So don't underestimate peeps like me So: in Android phone settings->Developer Options: There are 2 checkbox(es) we need to select? "OEM Unlock" and "Fastboot OEM unlock"? (Im not sure about the latter mostly)
• 
  

  ...You MUST to be on 10d...

  Link or steps if you're NOT? Ways to check? (I like many users will either get a random phone off ebay, or have one already, and won't know our baseline or how to determine this. & is this a deal breaker if it's not 10d?)
• 
  

  ...You must have H933 10h laf installed...

  Link or steps if you're NOT? Does that link also contain the software or is there another link we need? (Again, if there's another link, version-mismatch might cause unpredictable results for some users)
• Fat32: I've used SwissKnife https://swissknife.en.uptodown.com/windows to do easy FAT (same as FAT16) formatting. I say this because I already saw issues around this.
• I'm looking to buy a V30 only since you figured this out Much thanks! I'll say that again, you're awesome & I'm jealous! It sounds like now ALL variants can get the bootloader unlocked and a custom recovery installed: H932 via this thread/method & all other variants via WTF exploit (Again, please keep me honest!). (I just want to double-check my info so I (& others) buy a phone that will be able to get a custom ROM & plan to get the H932 and will report back if/when I get band 71 working for those interested.

I know some of you that have been in this since the beginning are thinking, come on man, read the posts! Like I said, I have been for over a week. There are thousands of posts, and even if I/we read EVERYTHING, we still wouldn't be able to decipher the bad info from the good! ...so thanks for your patience I'll post more once I actually try this. And thanks again Brian!! Really awesome...

---------- Post added at 03:07 PM ---------- Previous post was at 03:01 PM ----------

* Consider buying a V30 so I can help here as well

Umm... For all of us that use this and get it working, I think we should do donations until Brian can get a free V30, eh?!? (Can't yall read between the lines ) Besides, think of all the additional support you'll get if he actually has a phone to test with!! haha

 

[Josh McGrath]

@igotroot

Did you get it working yet? If not I can run you through the hardest part of it. Also, choose the persistent FWUL. Basically persistent mode means it saves your data when you leave. It's just easier that way