[SHARE] lgup tool

asialove2013

Senior Member
Sep 6, 2013
580
390
0
Now that you mention it. I'm going to try to replace the Data1.cab file in the dll msi with the one from the LG V40 ThinQ. I'll see if that works.
Use IDA to analyze the LGUP 1.14 original, You will see why there is a message " .msi not properly installed"
I am still trying to find out why.
 

onslaught86

Senior Member
Jul 26, 2009
991
450
113
Any v40 user here try the LG UP 1.14 patched together with LG v35 DLL file?
Yes. The V35 DLL, version 1.0.36.10 (and one from the G7), will allow LGUP 1.14 to open, but it will error when attempting to flash. LAF protocol is not match DLL = 0x1000010 Device = 0x10000016

DLLs from V40 KDZs are too new and spit out the DLL for [your model] is invalid, please install valid DLL package *.msi for the model error as do older DLLs and the new one from the G8.

LGUP 1.15 - which can be downloaded here - is not patched to bypass the login, but the LGUP command line tool works. Unfortunately it also errors with the please install DLL package response.

The older LG flashtool can be used to identify DLL versions, but I don't think we're going to get much further with DLLs alone unless they can be patched. Good old Uppercut is no joy either.

Hopefully someone can locate/leak/modify LGUP 1.16, locate/leak the msi for V40, or modify LGUP 1.14/1.15 to bypass the checks. Or find some other way around this.
 

CXZa

Senior Member
Apr 9, 2013
561
182
73
cxzstuff.blogspot.com
Weird this command line version. Or these.. They have all the resources of the GUI version in it.
Without the unneeded? resources the command line version is less than 500KB, with them it's over 10MB.
Why? Laziness? IDK. Anyway, what I have checked command line version doesn't differ that much from
a GUI version... The disassembled code I mean. Maybe that could be a hole needed for a proper hacker?
The 1.15 is protected and packed with themida. The command line version is not...
 

onslaught86

Senior Member
Jul 26, 2009
991
450
113
Weird this command line version. Or these.. They have all the resources of the GUI version in it.
Without the unneeded? resources the command line version is less than 500KB, with them it's over 10MB.
Why? Laziness? IDK. Anyway, what I have checked command line version doesn't differ that much from
a GUI version... The disassembled code I mean. Maybe that could be a hole needed for a proper hacker?
The 1.15 is protected and packed with themida. The command line version is not...
Yeah I was surprised when the CMD LGUP 1.15 just...worked, without any login or barriers. Hasn't been since tinkering with Sony's Emma that I've come across a login-gated flash tool in the wild.

Turns out this is what has been used to successfully flash G7s with Korean Pie. There have been discussions of this tool in other threads too.

It's possible the lax security is because LGUP is primarily used by service centres and carriers who are just following instructions rather than having familiarity with command line tools but it's certainly odd, possible the CMD version is not usually distributed. There are clearly elements of signature checking for both DLL and KDZ, as using a variety of different DLLs has offered signature failure errors. If the CMD version can bypass the signature verification a modified V40 DLL without the 1.16 restriction may do the trick.

I don't mind manually flashing updates, it's just frustrating being locked out of the latest build for LM-V405EBW - the device I have on hand does not have a serial number and cannot receive OTAs or updates via LG Bridge. So close, but missing the final piece of the puzzle. Hopefully it will come in due course.
 

awireless

Senior Member
Apr 9, 2018
347
96
0
Hey when using the LGUP_Cmd.exe how do i flash say 2 phones at the same time like the GUI can? I tried doing comx,comy but didnt work it just did the first one or do i just open multiple instances of the command prompt and do it that way? Also what are the extra options i tried PARTITION_DL but didnt do anything?
 

awireless

Senior Member
Apr 9, 2018
347
96
0
I have 1.16 seems like LG has changed the way we flash devices making crossflash harder.


0x5319, OPID mismatch. MPCS_US to NAO_US. IMPL unlock first. [TZ Unlock : 0x2]
Can you give us link to download please?

Also it looks like your trying to flash unlock firmware on metro pcs? If that is what your doing it wont work T-Mobile and Metro is different RSA signature.
 
Last edited:

twoxa

Senior Member
Jun 10, 2009
1,511
452
113
Boston
Guys don't mess with cross flashing if you don't want to end up with a brick. Unlock boot loader, root US Pie and live happy.
There s no such thing as flashing/rooting this phone via lgup tool.
 

asialove2013

Senior Member
Sep 6, 2013
580
390
0
LGUP_Cmd.exe ver 1.14 if somebody else wants to do comparisons...

edit:
Found from LG updates available here (it's in the LGMST_SVC_TOOL.zip)
http://csmg.lgmobile.com:9002/client/app/live_update.jsp
(Oh yeah, some nice tools there, but the problem remains the same. They need to be cracked...)
In fact, Someone in Shenzhen China has already "cracked' the LGMST_SVC_TOOL.exe.
The LGMST_SVC_TOOL.exe allows you to download many useful tools & software.
I try to edit the LGMST_SVC_TOOL.exe, but found the "Shell" i can not decrypt.
 

CXZa

Senior Member
Apr 9, 2013
561
182
73
cxzstuff.blogspot.com
In fact, Someone in Shenzhen China has already "cracked' the LGMST_SVC_TOOL.exe.
The LGMST_SVC_TOOL.exe allows you to download many useful tools & software.
I try to edit the LGMST_SVC_TOOL.exe, but found the "Shell" i can not decrypt.
> "cracked' the LGMST_SVC_TOOL
If you have it, please do share... Thanks!

In 1.14 command line (and in 1.15 aswell) there is all the resources of UI there. Why is that? Have been wondering if there is a possibility to bypass the cmd line into the UI, but I haven't had enought time (and skills perhaps) to check it out yet...
 

asialove2013

Senior Member
Sep 6, 2013
580
390
0
> "cracked' the LGMST_SVC_TOOL
If you have it, please do share... Thanks!

In 1.14 command line (and in 1.15 aswell) there is all the resources of UI there. Why is that? Have been wondering if there is a possibility to bypass the cmd line into the UI, but I haven't had enought time (and skills perhaps) to check it out yet...
I do not have..
I am trying to find a lgup 1.16.,..
Can not get it either.
 

Inerent

Senior Member
Oct 6, 2017
1,024
363
93
39
Bucharest

asialove2013

Senior Member
Sep 6, 2013
580
390
0
Hello!
Is this DLL possible to work for LG V50? Idw a bricked device...:D
Do not know, Need skills to bypass the LGUP Version Check.
But it is said the new KDZ of LG V40 or LG V50 use zstd compression.
It seems that LGUP 1.14 can not decompress the kdz file with zstd compression.
If we can extract partitions from a KDZ of ZSTD compression and build a TOT firmware, we may be able to flash the TOT with LGUP 1.14.
 
  • Like
Reactions: Inerent

Inerent

Senior Member
Oct 6, 2017
1,024
363
93
39
Bucharest
Do not know, Need skills to bypass the LGUP Version Check.
But it is said the new KDZ of LG V40 or LG V50 use zstd compression.
It seems that LGUP 1.14 can not decompress the kdz file with zstd compression.
If we can extract partitions from a KDZ of ZSTD compression and build a TOT firmware, we may be able to flash the TOT with LGUP 1.14.
I was flashing and crossflashing for my G7 ThinQ with LG UP 1.15 and command line and everything was fine. But it seems that there is no LG Common dll for V40 and V50. Am I wrong? If for V40 exists, will it be ok to use it with my V50?