[Solved] Exploring LG G4 Root-Injection, exFAT, VoLTE issue ... H81210n Rogers/Fido

[sdembiske]

*See the Addendum at the bottom of this OP for The Solve*

This thread has arisen from a particular issue that was originally thought to have arisen* by flashing a pre-rooted system image that was prepared following the method outlined by Senior Member hackarchive in "Root ANY LG G4 Variant 100% Success Directives | Root Injection | Less Bricks" (https://forum.xda-developers.com/g4/general/lg-g4-100-root-success-directives-root-t3180586).
*later proved by Senior Member steadfasterX to be an erroneous assumption.

The issue: The H812 LG G4 (that has an un-lockable bootloader) that came from the carrier (Canada's Roger's/Fido) with Marshmallow (H81220x) installed. It was rolled back to Lollipop H81210h originally with the pre-rooted H81210n system image flashed after - the reason: both the stock and pre-rooted 'h' versions did not have the last stagefright vulnerability patch whereas the 'n' version did, hence an added level of security. However, no one had a confirmed Roger's/Fido stock H81210n kdz (Rogers/Fido is the only carrier in Canada that has the VoLTE option included and operational for the LG G4) that anybody could find a link to and when an exFAT formatted SD card was put in the pre-rooted 'n' version, it failed to recognize the format (no problem with FAT32) whereas it was recognized in the rooted earlier released 'h' version. The 4gb restriction size of FAT32 did not allow the backup of the system image with Senior Member steadfasterX's "TWRP-in-FiSH" (https://forum.xda-developers.com/g4/development/locked-twrpinfish-locked-g4-devices-t3573048) to the external sd card given the FAT32 size restriction. The exFAT recognition issue originally appeared to have arisen with the pre-rooted 'n' version when the missing original stock kdz was installed through the refurbish method with LGUP-NEW without an SD card installed or when the original system image was extracted OR, as steadfasterX has suggested, it was originally for a phone with a different kernel.

At the suggestion of steadfasterX and thanks to his work on this issue, the effort to reverse-engineer and revert to stock from the root-injection method itself has been undertaken. The work is all his, the testing to date and soft-bricking getting to this point, are mine.

Make no mistake ... this is a work-in-progress and soft-bricks and other risks, always a possibility

What you have here is a link to steadfasterX's latest revision to help unravel this issue that should not change anything if the DEBUG setting is left as it is: DEBUG=1. Follow his instructions exactly. I have run this version with DEBUG=1 with absolutely no problems and no issues rebooting after - no actual changes were made to the phone when the DEBUG=1 mode was used.
Note: Changing the 1 to a 0 will allow actual execution of the script and is not advised at this time*.
* Not advised at all as it will = Soft Brick.

Refer to the following link: https://forum.xda-developers.com/showpost.php?p=72837723&postcount=343
but please, post to this thread only if you are interested in helping/testing/solving or have any questions etc.

Thanks.
S.

Addendum: Credit for The Solve ...

Full credit for the solve goes to ReeS86- refer to his post @ReeS86
Special Thanks to all the work by steadfasterX he put into helping us get to this point.
For a quick and easy method to get an exFAT formatted SD card recognized in the pre-rooted Rogers/Fido H81210n system image: see the Addendum in my post @sdembiske

 

[steadfasterX]

yea thats better here then there

ok lets see where it goes...

happy bricking

.

 

[sdembiske]

yea thats better here then there

ok lets see where it goes...

happy bricking .

Here's a link to the DEBUG=1 log from revert_root_injection.sh v0.2:
https://paste.omnirom.org/view/be1a8f21

No issues/problems in executing or rebooting from the script in DEBUG=1 mode. :good:

 

[steadfasterX]

Here's a link to the DEBUG=1 log from revert_root_injection.sh v0.2:
https://paste.omnirom.org/view/be1a8f21

No issues/problems in executing or rebooting from the script in DEBUG=1 mode. :good:

ok!

so now pls gimme this on your rooted device:

boot in TWRP

adb shell
mount /system <-- may complain that it is already mounted. if so ignore ;)
tar cvzf /tmp/init.tar.gz /system/etc/init.d/
exit
adb pull /tmp/init.tar.gz .

then e.g. upload the init.tar.gz here as a attachment .


.

 

[sdembiske]

ok!

so now pls gimme this on your rooted device:

boot in TWRP

adb shell
mount /system <-- may complain that it is already mounted. if so ignore ;)
tar cvzf /tmp/init.tar.gz /system/etc/init.d/
exit
adb pull /tmp/init.tar.gz .

then e.g. upload the init.tar.gz here as a attachment ..

Here you go.

 

[steadfasterX]

Here you go.

ok so far so good.
now it is "safe" to DEBUG=0 ..

give it a try :fingers-crossed:
and upload the log from the ext sd afterwards again..


.

 

[sdembiske]

ok so far so good.
now it is "safe" to DEBUG=0 ..

give it a try :fingers-crossed:
and upload the log from the ext sd afterwards again...

No go this time either. Softbricked same as last time on the reboot - however, this time TWRP didn't freeze up and allowed the reboot from inside. Pulling the battery and trying normal power up gave the same result. No sound and couldn't get past the spinning lg logo. It'll take me a bit of time to get up and running again.

Here's the link to the log: https://paste.omnirom.org/view/19951ee0

 

[ReeS86]

I'm curious what security fixes and other fixes were present between the h and n versions of the Rogers H812 system software. It seems to me a good option may be to install 10h KDZ and then root, then copy any libstagefright files needed from the 10n KDZ and check to see if the vulnerabilities are fixed. I might try this out because I had no issues with the 10h firmware including the exFAT working correctly while rooted.

 

[sdembiske]

I'm curious what security fixes and other fixes were present between the h and n versions of the Rogers H812 system software. It seems to me a good option may be to install 10h KDZ and then root, then copy any libstagefright files needed from the 10n KDZ and check to see if the vulnerabilities are fixed. I might try this out because I had no issues with the 10h firmware including the exFAT working correctly while rooted.

Good idea. I know some of the stock Motorola LTE versions were updated with the first stagefright vulnerability patch and it was able to be ported over into to copies of stock versions that didn't have it. Refer to the Miscellaneous section in the following thread https://forum.xda-developers.com/moto-g/4g-development/rom-stock-motorola-4g-lollipop-rom-t3142816
You may want to check with recognized contributor lost101, author of that thread for any suggestions.

The other approach might be to try and get the Roger's-Fido/VoLTE app/settings off the the 'h' version and see if they can be incorporated into the stock 'n' version that does handle exFAT but doesn't have VoLTE as it is carrier specific, although, I think your approach might bring more fruitful results quicker.

 

[steadfasterX]

I'm curious what security fixes and other fixes were present between the h and n versions of the Rogers H812 system software. It seems to me a good option may be to install 10h KDZ and then root, then copy any libstagefright files needed from the 10n KDZ and check to see if the vulnerabilities are fixed. I might try this out because I had no issues with the 10h firmware including the exFAT working correctly while rooted.

Good idea. I know some of the stock Motorola LTE versions were updated with the first stagefright vulnerability patch and it was able to be ported over into to copies of stock versions that didn't have it. Refer to the Miscellaneous section in the following thread https://forum.xda-developers.com/moto-g/4g-development/rom-stock-motorola-4g-lollipop-rom-t3142816
You may want to check with recognized contributor lost101, author of that thread for any suggestions.

The other approach might be to try and get the Roger's-Fido/VoLTE app/settings off the the 'h' version and see if they can be incorporated into the stock 'n' version that does handle exFAT but doesn't have VoLTE as it is carrier specific, although, I think your approach might bring more fruitful results quicker.

Well my first try on this would be:

Backup v10n
Flash v10H
Restore v10n system image only

See what happens. Normally there are low chances that this brick anything but there are still no guarantees..

Btw I would like to see a DEBUG=1 run on a v10h..
I wonder if there are diffs in the root injection..


.


Sent from my LG-H815 using XDA Labs

 

[BIG_BADASS]

All this trouble because no bootloader unlock... what a shame

---------- Post added at 10:27 AM ---------- Previous post was at 10:21 AM ----------

I'm curious what security fixes and other fixes were present between the h and n versions of the Rogers H812 system software. It seems to me a good option may be to install 10h KDZ and then root, then copy any libstagefright files needed from the 10n KDZ and check to see if the vulnerabilities are fixed. I might try this out because I had no issues with the 10h firmware including the exFAT working correctly while rooted.

What is the difference between H and N versions?

 

[sdembiske]

Well my first try on this would be:

Backup v10n
Flash v10H
Restore v10n system image only

See what happens. Normally there are low chances that this brick anything but there are still no guarantees..

Btw I would like to see a DEBUG=1 run on a v10h..
I wonder if there are diffs in the root injection..

Sent from my LG-H815 using XDA Labs

Will try and get to it sometime over the long weekend that we have coming up here and give it a shot as well as providing the DEBUG=1 log on a v10h .

Thanks again.

 

[steadfasterX]

Will try and get to it sometime over the long weekend that we have coming up here and give it a shot as well as providing the DEBUG=1 log on a v10h .

Thanks again.

You may could ask the maintainer of :

https://forum.xda-developers.com/g4/development/h815-freedom-rom-t3630056/post72866870

He made an installer for his ROM which let you select VoLTE so he may now what is needed to activate it. I know it's for the h815 but it should be similar..


.

Sent from my LG-H815 using XDA Labs

 

[sdembiske]

Well my first try on this would be:

Backup v10n
Flash v10H
Restore v10n system image only

See what happens. Normally there are low chances that this brick anything but there are still no guarantees..

Btw I would like to see a DEBUG=1 run on a v10h..
I wonder if there are diffs in the root injection..

Sent from my LG-H815 using XDA Labs

As suggested, here are the revert_root_injection logs (x2 - DEBUG =1 and DEBUG=0), plus the TWRP recovery log of system image restore of the 'n' version from 'h' internal.

Same problem with revert-root-injection when the DEBUG option was set to "0" to execute - i.e., soft brick ... lol.

And, perhaps not unexpected, the exFat formatted card was still not recognized but what did surprise me is that none of my settings, apps etc., were restored on the 'n' system image restore after.

Link to logs: https://gist.github.com/sdembis/89de74e401def3ed0e091c565a19e0e9

I then restored all (excluding system image) from my backup in external after the first restore attempt - it failed on the Data restore but everything was back to normal from what I could tell on the reboot.

PS: I pm'ed both you and ReeS86 the response from the rom author you suggested I contact re: the VoLTE install. He was very helpful and sounds like a good guy. Thanks for the suggestion. Much appreciated.

Best,
S.

 

[steadfasterX]

As suggested, here are the revert_root_injection logs (x2 - DEBUG =1 and DEBUG=0), plus the TWRP recovery log of system image restore of the 'n' version from 'h' internal.

Same problem with revert-root-injection when the DEBUG option was set to "0" to execute - i.e., soft brick ... lol.

And, perhaps not unexpected, the exFat formatted card was still not recognized but what did surprise me is that none of my settings, apps etc., were restored on the 'n' system image restore after.

Link to logs: https://gist.github.com/sdembis/89de74e401def3ed0e091c565a19e0e9

I then restored all (excluding system image) from my backup in external after the first restore attempt - it failed on the Data restore but everything was back to normal from what I could tell on the reboot.

PS: I pm'ed both you and ReeS86 the response from the rom author you suggested I contact re: the VoLTE install. He was very helpful and sounds like a good guy. Thanks for the suggestion. Much appreciated.

Best,
S.

Hm the following is not clear for me:

You have restored the system image of N to H as suggested. Ok. And then? Does it soft brick as well?
the recovery log shows the backup only.. But it wouldn't be helpful anyways or do you had an error while restoring?

Yes using the revert script on H was 99% sure that it soft bricks as well that's why I said DEBUG=1 but it seems u like it so.. nvm

Thx to the log It looks like the root method between H and N is not different btw..


.

Sent from my LG-H815 using XDA Labs

 

[sdembiske]

Hm the following is not clear for me:

You have restored the system image of N to H as suggested. Ok. And then? Does it soft brick as well?
the recovery log shows the backup only.. But it wouldn't be helpful anyways or do you had an error while restoring?

Yes using the revert script on H was 99% sure that it soft bricks as well that's why I said DEBUG=1 but it seems u like it so.. nvm

Thx to the log It looks like the root method between H and N is not different btw..

Sent from my LG-H815 using XDA Labs

No, neither of the restores resulted in a soft brick. The first restore of the 'n' backed up system image (from internal) went fast with no issues but didn't have the apps and settings that I backed up - that is the TWRP log I attached in my last post. The 2nd restore (all except system image from external), done right after the first, failed on restoring Data but I was able to reboot from within TWRP and all settings and apps were back as they should have been.

Here is the link to that log: https://gist.github.com/sdembis/160047faa4b22717edf36658e5e42ea7

Any ideas as to why the reversion is failing and whether it might be able to be overcome?

Thanks again,
S.


.

 

[steadfasterX]

No, neither of the restores resulted in a soft brick. The first restore of the 'n' backed up system image (from internal) went fast with no issues but didn't have the apps and settings that I backed up - that is the TWRP log I attached in my last post. The 2nd restore (all except system image from external), done right after the first, failed on restoring Data but I was able to reboot from within TWRP and all settings and apps were back as they should have been.

Here is the link to that log: https://gist.github.com/sdembis/160047faa4b22717edf36658e5e42ea7

Any ideas as to why the reversion is failing and whether it might be able to be overcome?

Thanks again,
S.


.

The idea of restoring the system image (ONLY this!) from N to H :
this was a test to see if you have the VoLTE working afterwards - was VoLTE working?

.

 

[sdembiske]

The idea of restoring the system image (ONLY this!) from N to H :
this was a test to see if you have the VoLTE working afterwards - was VoLTE working?.

Sorry, I didn't check it because the other problem, namely exFAT was no longer recognized was still present. I'll re-check everything today.

 

[sdembiske]

The idea of restoring the system image (ONLY this!) from N to H :
this was a test to see if you have the VoLTE working afterwards - was VoLTE working?.

Thinking this through a little - as the rooted Roger's/Fido 'h' version does have VoLTE, I would expect it to have VoLTE when the 'n' version system image with VoLTE is restored over that 'h' version. I am going to try instead taking the 'n' version without VoLTE but recogning exFat that I've rooted and restore the system image from the pre-rooted 'n' version with VoLTE but not recognizing exFat, to see if VoLTE is present. If it is, I suspect that exFAT will still not be recognized as it was with the retored 'n' version over the 'h' version, I would only end up with the same problem I have now with the pre-rooted 'n' version - VoLTE with no exFAT recognition.

Or, did you mean restoring the rooted 'n' version system image without VoLTE over the rooted 'h' version with VoLTE and exFAT recognition?

 

[ReeS86]

I was able to loop mount both the bell H812n and Rogers H812n rooted system images and run KDiff3 on both of the root directories. It seems there are a few config files here and there that reference VoLTE as well as the odd missing file between the two. I'm going to keep digging maybe I'll find something about ExFAT as well.

Edit: Looks like the rooted system image posted to the Canadian G4 thread is from Videotron in Quebec. Still don't see anything about ExFAT...