lglaf doesn't work anymore on LG K10 2017 (M250N) since the last Oreo update.

[GijsTimmers]

I'm afraid that LG did something with the last Oreo update to prevent us from using lglaf:

$ python extract-partitions.py --debug
2018-09-14 10:46:24,417 LGLAF.py: DEBUG: Using endpoints 83 (IN), 02 (OUT)
Traceback (most recent call last):
  File "extract-partitions.py", line 70, in <module>
    main()
  File "extract-partitions.py", line 65, in main
    with partitions.laf_open_disk(comm) as disk_fd:
  File "/usr/lib/python3.7/contextlib.py", line 112, in __enter__
    return next(self.gen)
  File "/home/user/Downloads/lglaf/partitions.py", line 59, in laf_open_disk
    open_header = comm.call(open_cmd)[0]
  File "/home/user/Downloads/lglaf/lglaf.py", line 254, in call
    raise RuntimeError('Command failed with error code %#x (%s)' % (errCode, msg))
RuntimeError: Command failed with error code 0x8000010a (LAF_ERROR_ACCESS_DENIED)

I made sure to enable OEM unlocking in Developer Options. Dialing *#*#759#*#* does not give me a OEM unlock menu anymore (as it did before).

[runningnak3d]

extract-partitions.py doesn't have KILO (CENT / METR) challenge response authentication. All new versions of lafd require KILO to talk at all. You can use partitions.py --list to get a list, and --dump to dump the ones that you want.

-- Brian

[GijsTimmers]

Brian, thanks for responding; sadly, both commands (partitions.py --list and partitions.py --dump) result in the same error.

[runningnak3d]

You need to pass the --cr parameter so: ./partitions.py --cr --list or ./partitions.py --cr --dump

-- Brian

[GijsTimmers]

Hi Brian, thank you;

I got a little bit further with this issue by doing a clean Linux install and then issuing the following in this order:

1. sudo pip3 install pycrypto pyusb
2. sudo pip3 install cryptography

Now, when running python lglaf.py I get the following:

$ python lglaf.py 
LGLAF.py by Peter Wu (https://lekensteyn.nl/lglaf)
Type a shell command to execute or "exit" to leave.
# ls
Hello, I am LAF. Nice to meet you.# 

Apparently, LG disabled a lot of commands, as this seems to be the response when a command is not supported.

When running lglaf with the --rawshell argument, the dmesg command does seem to get through:

# dmesg
(...)
<4>[  889.136818 / 09-18 14:43:57.770][4] -(4)[0:swapper/4]Power/swap DP: No enter --- SODI3: No enter --- SODI: No enter --- 
<12>[  891.313029 / 09-18 14:43:59.940][4]  (4)[278:lafd][LAF] dmesg!!

Everything else I tried did not seem to be supported.

On the partitions.py command, I tried issuing this with the --cr switch, but this one is not supported by Lekensteyn's lglaf; I cloned steadfasterX's lglaf which does allow for a --cr switch. This only resulted in errors:

$ python partitions.py --cr yes --list
Traceback (most recent call last):
  File "partitions.py", line 378, in <module>
    main()
  File "partitions.py", line 341, in main
    list_partitions(comm, disk_fd, args.partition, False)
  File "partitions.py", line 127, in list_partitions
    diskinfo = get_partitions(comm, fd_num)
  File "partitions.py", line 41, in get_partitions
    data = laf_read(comm, fd_num, read_offset // BLOCK_SIZE, chunksize)
  File "partitions.py", line 76, in laf_read
    header, response = comm.call(read_cmd)
  File "/home/user/Downloads/lglaf-auth/lglaf.py", line 269, in call
    raise RuntimeError('Command failed with error code %#x (%s)' % (errCode, msg))
RuntimeError: Command failed with error code 0x80000119 (LAF_ERROR_<unknown>)
$ python partitions.py --cr no --list
Traceback (most recent call last):
  File "partitions.py", line 378, in <module>
    main()
  File "partitions.py", line 336, in main
    with laf_open_disk(comm) as disk_fd:
  File "/usr/lib/python3.7/contextlib.py", line 112, in __enter__
    return next(self.gen)
  File "partitions.py", line 63, in laf_open_disk
    open_header = comm.call(open_cmd)[0]
  File "/home/user/Downloads/lglaf-auth/lglaf.py", line 269, in call
    raise RuntimeError('Command failed with error code %#x (%s)' % (errCode, msg))
RuntimeError: Command failed with error code 0x8000010a (LAF_ERROR_ACCESS_DENIED)
$ python partitions.py --cr yes --dump recovery recovery.img
Traceback (most recent call last):
  File "partitions.py", line 378, in <module>
    main()
  File "partitions.py", line 344, in main
    diskinfo = get_partitions(comm, disk_fd)
  File "partitions.py", line 41, in get_partitions
    data = laf_read(comm, fd_num, read_offset // BLOCK_SIZE, chunksize)
  File "partitions.py", line 76, in laf_read
    header, response = comm.call(read_cmd)
  File "/home/user/Downloads/lglaf-auth/lglaf.py", line 269, in call
    raise RuntimeError('Command failed with error code %#x (%s)' % (errCode, msg))
RuntimeError: Command failed with error code 0x80000119 (LAF_ERROR_<unknown>)

[P3nguin-M]

Same exact issue on a G7. Have went through the same steps and cloned steadxfaster's lglaf. Dmesg shows activity and I can ctrl a reset, poweroff, etc.
Anyone working on this or is kept secret?

[steadfasterX]

anyone able to provide the same command but with the "--debug" switch?

[kocmo]

anyone able to provide the same command but with the "--debug" switch?

@steadfasterX For what it's worth, I'm getting the same error 0x80000119 trying to dump any partition on LG V40. Using steadfasterX fork, branch develop. Ran with --debug, attaching log.

steadfasterX branch develop.dump laf_a on LG V40.error 0x80000119.log

"partitions.py --list" works for me, lists partitions on LUNs up to sdf.

[steadfasterX]

anyone able to provide the same command but with the "--debug" switch?

@steadfasterX For what it's worth, I'm getting the same error 0x80000119 trying to dump any partition on LG V40. Using steadfasterX fork, branch develop. Ran with --debug, attaching log.

steadfasterX branch develop.dump laf_a on LG V40.error 0x80000119.log

"partitions.py --list" works for me, lists partitions on LUNs up to sdf.

you can try my "ufs-test" branch (assuming that the v40 is an UFS device) but not guarantees. The problem is that in the middle of implementing the new UFS methods we both (@runningnak3d and I) stopped development. That means even though it might work for parts of the device the open commands are hard coded and so you can work only with one of the UFS disks at the same time. my mentioned UFS branch contains all known open cmds though and the only thing to do would be implementing a logic to use all of them automatically (for listing) and ofc a more intelligent logic when it comes to more like backing up etc (i.e. use only the required open cmd etc).

My main issue was (and still is) that I do not own a LG UFS device and I am not willing to buy one. I don't know what happened to @runningnak3d but he might be your best chance (if he ever comes back here).

[kocmo]

@steadfasterX Danke schön, mann - yeah, I see the hardcoded open commands in laf_open_disk() in ufs-test branch, and I can backport other commits (laf_crypto, challenge-response, etc.) from develop branch to ufs-test branch. I see the Wireshark protocol dissector, enough for me to work on ... when I have time :-/

P.S.: Those hardcoded open commands - did you (or anyone else) verify them as working on UFS devices?

[mitar]

Just to note that these instructions worked for me on my LG M257 Harmony (Cricket). So the fork, installing extra dependencies, and then running python partitions.py --cr yes --list and python partitions.py --cr yes --dump out.bin userdata. Without fork I was able to dmesg and ls with python lglaf.py --cr --debug --skip-hello --rawshell, but not much more.