REQUEST: T-Mobile V30 H932 LGUP Partition DUMP - LG V30 Questions & Answers

Title says it. I'm requesting a stock LGUP partition dump from an LG V30. Please provide one from version 20o or 20k. Preferrably unrooted, stock, minimum alterations, and NO 'FRANKENSTEIN' cross-flashed H932 devices! I'm going to test to see if a system dump from a T-Mobile H932 can allow me to unlock LTE band 71 on all LG V30 (JOAN) variants. I discovered I could unlock LTE band 12 on my Verizon VS996 -> USA OPEN US998 Frankenstein phone. Though I cross-flashed, I couldn't get LTE band 12. I fixed it by creating a flashable H931 (AT&T) zip from partitions I found online. Most importantly, flashing modem, modemst1, and modemst2 alone seems to have fixed my issue. I do realize doing this could brick my device, as the H932 has a different RSA key than all the other variants.
The issue: The 3 hidden LTE band selection menus (LG LTE Band Selection, TMO Only, and iot band selection) don't really enable all LTE bands that the V30 (JOAN) supports. Band 71 is for sure sabotaged on all devices but the H932, and the hidden menu doesn't seem to enable it. Similarly for me, no hidden menu could enable band 12 for me, maybe because I was coming from a Verizon VS996 (though this is a special case, no one else has reported this).
The fix: Flash working modem, modemst1, and modemst2 partitions from a working T-Mobile H932. OR flash working H932 modemst1 and modemst2 partitions only. OR flash working H932 system, boot, modem, modemst1 and modemst2 partitions.
*I've flashed an H932 modem before onto my Frankenstein phone without issue, and no bootloop. So maybe it is not RSA-locked...
Anyways, kindly upload your T-Mobile H932 dump (zipped). It can be around 8GB unzipped, and then 3.2GB zipped.
LGUP Install Procedure:
1. Download and install LG USB drivers (under USB Driver) here
2. Download and install LG UP 1.14.3 from here
3. Download .dll file for LG V30 here
4. Navigate to C:\Program Files (x86)\LG Electronics\LGUP\model
5. Create folder called "common" and unzip the .dll file inside of it.
LGUP Patch Procedure:
1. Extract (confirm replace, yes) LGUP+V30DLL_PATCHED.zip to C:\Program Files (x86)\LG Electronics\LGUP
2. Extract LGUP_common.dll in LGUP_common_DLL_V30_ALLVARIANTS.zip to C:\Program Files (x86)\LG Electronics\LGUP\model\common
3. Reboot computer
LGUP Dump Procedure:
1. Update software to latest H932 20o (check for system updates)
2. Turn off phone
3. Connect micro usb cable to computer
3. Hold volume up button and connect the usb cable
4. Open LGUP
5. Select DUMP
6. DON'T select partitions: userdata or data, and cache.
7. Click OK
8. Create a ZIP from all the partition dumps (should be around 30 files)
9. Upload ZIP to Google Drive or MEGA.

---

patato21 said:
Title says it. I'm requesting a stock LGUP partition dump from an LG V30. Please provide one from version 20o or 20k. Preferrably unrooted, stock, minimum alterations, and NO 'FRANKENSTEIN' cross-flashed H932 devices!
Click to expand...
Click to collapse
If you knew about the topic, you would know there's no such thing as Frankenstein H932. This is why they can't use WTF.
This is also why I doubt your statements in the other thread about LTE bands 12 and 13.
Sent via open market LG US998 V30/V30+

---

ChazzMatt said:
If you knew about the topic, you would know there's no such thing as Frankenstein H932. This is why they can't use WTF. This is why I doubt your statements in the other thread about LTE bands 12 and 13.
Click to expand...
Click to collapse
It is possible to have a H932 -> US998 Frankenstein by merely flashing system and boot. Which definitely don't have an RSA key. Why would I have a reason to lie about my situation? It is not impossible for these two scenarios to happen.

---

patato21 said:
It is possible to have a H932 -> US998 Frankenstein by merely flashing system and boot. Which definitely don't have an RSA key. Why would I have a reason to lie about my situation? It is not impossible for these two scenarios to happen.
Click to expand...
Click to collapse
I wrote the instructions for Frankenstein and there's very little you can cross flash between the other North American variants and T-Mobile H932. Not enough to call it Frankenstein.
@runningnak3d is the expert on this, and I deferring him. (This below is quote from @runningnak3d, but some apps don't show the quote reference. So view in web browser.)
__________
https://forum.xda-developers.com/showpost.php?p=76319892&postcount=34
runningnak3d said:
Here is the list of all files that are flashed in a KDZ that are signed with the RSA cert. If just ONE of these doesn't match the key in your CPU, you will probably have a 9008 brick. Some just won't load, and your phone won't work until you flash the proper KDZ (for example modem), but the fact of the matter is -- it is NOT possible to crossflash ANY of these files IF the RSA key in your CPU doesn't match the signature on these files:
Code:
ablbak.image
abl.image
apdp.image
cmnlib64bak.image
cmnlib64.image
cmnlibbak.image
cmnlib.image
devcfgbak.image
devcfg.image
hypbak.image
hyp.image
keymasterbak.image
keymaster.image
modem.image
msadp.image
pmicbak.image
pmic.image
rpmbak.image
rpm.image
storsecbak.image
storsec.image
tzbak.image
tz.image
xbl2.image
xbl.image
If you have an unlocked bootloader, this is the list of files that you can flash without worrying about the RSA key:
Code:
boot.image
recoverybak.image
recovery.image
lafbak.image
laf.image
system.image
userdata.image
If you do not have an unlocked bootloader, and you flash one of the above files WITHOUT flashing the corresponding abl, you will bootloop and never be able to fix your phone. So, if you have a locked bootloader, then you must flash ALL of the partitions listed as being checked by the RSA key, and ALL of the partitions listed here. If you don't -- you will not have a working phone.
And finally, this is the list of files that you can cross flash that aren't checked by the RSA key in the CPU nor dm-verity:
Code:
cache.image
carrier.image
drm.image
eksst.image
encrypt.image
eri.image
factory.image
ftm.image
grow.image
keystore.image
logfs.image
misc.image
mpt.image
operatorlogging.image
persist.image
pstore.image
qni.image
raw_resourcesbak.image
raw_resources.image
rct.image
sec.image
sns.image
srtc.image
ssd.image
Click to expand...
Click to collapse
_____________
1) the whole point of Frankenstein is to carrier unlock the phone and/or get fastboot flash commands to unlock the bootloader. Frankenstein is done BEFORE bootloader unlock. The two partitions you mention require bootloader unlock. Even if theoretically possible, no one is going to flash those from H932 onto their carrier unlocked, bootloader unlocked phone for any reason whatsoever. Why would they? They already have what they need , and it would only potentially mess up their phone in many different ways.
2) There's tons of Frankensteined North America variants on T-mobile (AS998, VS996, H931, H933 converted to US998) - - including Wi-Fi calling, which I'm pretty sure requires LTE band 12 - - and no one else except you has said they can't get it? I am glad you fixed your problem, but as you mentioned in your post, only you have reported it.
I say if you DL partition with dev patched LGUP, it will overwrite the partitions, including modem partitions. I can't see how your modem partitions stayed as VS996.

---

patato21 said:
Band 71 is for sure sabotaged on all devices but the H932, and the hidden menu doesn't seem to enable it.
Click to expand...
Click to collapse
If you can bring LTE band 71 to other V30 models, then more power to you.
We aren't disagreeing about that. I hope you succeed.

---

ChazzMatt said:
I wrote the instructions for Frankenstein and there's very little you can cross flash. Not enough to call it Frankenstein.
@runningnak3d is the expert on this.
All I know is there's tons of Frankensteined North America variants on T-mobile - - including Wi-Fi calling which I'm pretty sure requires LTE band 12 - - and no one else except you has said they can't get it.
I am glad you fixed your problem, but as you mentioned in your post, only you have reported it.
I say it you DL partition with dev patched LGUP, if will overwrite the partitions, including modem partitions. I can't see how the modem partitions are exceptions.
Click to expand...
Click to collapse
Ironically I appear to be stuck on band 2 >.> LS998 > US998

---

me2151 said:
Ironically I appear to be stuck on band 2 >.> LS998 > US998
Click to expand...
Click to collapse
Did you use the hidden menu to choose LTE bands? I made that mistake, it sticks on the last one you choose. I started a thread about it and there's a solution.
Sent via open market LG US998 V30/V30+

---

ChazzMatt said:
Did you use the hidden menu to choose LTE bands? I made that mistake, it sticks on the last one you choose. I started a thread about it and there's a solution.
Sent via open market LG US998 V30/V30+
Click to expand...
Click to collapse
Not to hijack the thread, can you try this file?
I get Dolby in the LG music app, but not the actual icon.
I'm guessing that the same reasons the different v20 got real Dolby applies to the v30 as well.
Sent from my LG-H932 using XDA Labs
Edit, not my work
https://forum.xda-developers.com/v20/themes/mod-stock-lg-music-app-dolby-sound-fx-t3812459

---

ChazzMatt said:
snip
Sent via open market LG US998 V30/V30+
Click to expand...
Click to collapse
As you can see, this is how the stock file looks.
Sent from my LG-H932 using XDA Labs

---

ChazzMatt said:
Did you use the hidden menu to choose LTE bands? I made that mistake, it sticks on the last one you choose. I started a thread about it and there's a solution.
Sent via open market LG US998 V30/V30+
Click to expand...
Click to collapse
Nope never used the hidden menu

---

@potato21 If you want the H932 modem just download one of the H932 TWRP flashable zips and extract it. It is most definitely RSA signed, however, the hole in the US998 abl that allows the WTF unlock method to work may also break the boot chain of trust. In other words .. yes, you may be able to flash the H932 modem. That is what sucks about the fact that abl is encrypted .. can't decompile to check.
As for getting a dump of modemst1 and 2 .. someone will have to dump them with LG UP, or if they are rooted, just boot to TWRP and use dd.
To anyone willing to do it .. you IMEI is contained in fsg, so you are safe sending st1 and st2.
-- Brian

---

runningnak3d said:
@potato21 If you want the H932 modem just download one of the H932 TWRP flashable zips and extract it. It is most definitely RSA signed, however, the hole in the US998 abl that allows the WTF unlock method to work may also break the boot chain of trust. In other words .. yes, you may be able to flash the H932 modem. That is what sucks about the fact that abl is encrypted .. can't decompile to check.
As for getting a dump of modemst1 and 2 .. someone will have to dump them with LG UP, or if they are rooted, just boot to TWRP and use dd.
To anyone willing to do it .. you IMEI is contained in fsg, so you are safe sending st1 and st2.
-- Brian
Click to expand...
Click to collapse
Modem is installable. no rsa on it(that works properly) however it fails hardware checks. so it wont start. It might be possible to hex some changes in to allow it to start on the other models though.

---

me2151 said:
Modem is installable. no rsa on it(that works properly) however it fails hardware checks. so it wont start. It might be possible to hex some changes in to allow it to start on the other models though.
Click to expand...
Click to collapse
The modem firmware is most certainly RSA signed, and *usually* verified by abl in the boot chain of trust. If you can flash the H932 modem on a WTF rooted phone, that means that whatever eff-up that LG did with that abl broke the boot chain of trust:
Code:
binwalk -e modem.img --dd="x509"
openssl asn1parse -inform DER -in 1D2A8.crt
0:d=0 hl=4 l=1164 cons: SEQUENCE
4:d=1 hl=4 l= 884 cons: SEQUENCE
8:d=2 hl=2 l= 3 cons: cont [ 0 ]
10:d=3 hl=2 l= 1 prim: INTEGER :02
13:d=2 hl=2 l= 3 prim: INTEGER :0E1CA0
18:d=2 hl=2 l= 13 cons: SEQUENCE
20:d=3 hl=2 l= 9 prim: OBJECT :sha256WithRSAEncryption
<snip>
499:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
504:d=5 hl=2 l= 25 prim: UTF8STRING :01 0000000000000004 SW_ID
So, that opens up a world of possibilities if LG screwed up and broke the chain of trust and you are able to flash H932 firmware onto other devices. You wouldn't be able to flash xbl or abl (obviously), but other than that you could convert a phone to an H932.
Remember the PBL verifies XBL, and XBL verifies ABL. If the chain of trust stops there ... the LG V30 may be the most awesome phone currently in production.
-- Brian

---

do you still need the files?

---

DSTNMZ said:
do you still need the files?
Click to expand...
Click to collapse
You do NOT want to send someone that complete dump. Sending modemst1 and modemst2 is OK, but there are a lot of files from a full dump that contain info that is specific to your phone -- for example (from your dump) fsg_COM5 contains your IMEI, serial number, and other info. misc_COM5 contains your serial number, and (while not very important) your bt and wifi MAC addresses.
-- Brian

---

DSTNMZ said:
do you still need the files?
Click to expand...
Click to collapse
I would like modem,modemst1 and modemst2 please

---

runningnak3d said:
You do NOT want to send someone that complete dump. Sending modemst1 and modemst2 is OK, but there are a lot of files from a full dump that contain info that is specific to your phone -- for example (from your dump) fsg_COM5 contains your IMEI, serial number, and other info. misc_COM5 contains your serial number, and (while not very important) your bt and wifi MAC addresses.
-- Brian
Click to expand...
Click to collapse
I would not send everything, I put that image as a sample to see what I had obtained, I would only send the parts that are required, and thanks to you now I know that I should not send those files that you mention (fsg_COM5 and misc_COM5) , I am sorry the English language is not my language native in case it does not make sense what I say
---------- Post added at 03:31 PM ---------- Previous post was at 03:23 PM ----------
me2151 said:
I would like modem,modemst1 and modemst2 please
Click to expand...
Click to collapse
there you have it
https://drive.google.com/file/d/1MxbCBGbujzWWnOg35ePk35KVh5sabJ4h/view?usp=sharing

---

DSTNMZ said:
I would not send everything, I put that image as a sample to see what I had obtained, I would only send the parts that are required, and thanks to you now I know that I should not send those files that you mention (fsg_COM5 and misc_COM5) , I am sorry the English language is not my language native in case it does not make sense what I say
---------- Post added at 03:31 PM ---------- Previous post was at 03:23 PM ----------
there you have it
https://drive.google.com/file/d/1MxbCBGbujzWWnOg35ePk35KVh5sabJ4h/view?usp=sharing
Click to expand...
Click to collapse
Thanks
EDIT: Tmobile modemst1 and st2 work just fine on frankenstein

---

me2151 said:
Thanks
EDIT: Tmobile modemst1 and st2 work just fine on frankenstein
Click to expand...
Click to collapse
So you have working band 71 now?
-- Brian

---

runningnak3d said:
So you have working band 71 now?
-- Brian
Click to expand...
Click to collapse
No idea. I dont have band 71 in my area nor am i on stock to try to force it