Rooting LG Spectrum

[hpchoi411]

Thanks :: ???̹? ???α?
try this method if u can read korean.

 

[pbolton]

Sorry my Korean is a little out of practice....lol But appreciate you passing it down. Maybe someone out there does speak it and will translate it for us.

 

[Neph]

The page in question is for rooting the Optimus, which we know can be rooted with Zerg rush. From what I can understand of the broken translation, it is as he described it, but it is not a root for the Spectrum.

Also, two things that have come up that may be of use later.

From a fully powered off state (holding the power button until the phone forces itself off)

Down vol + power = factory reset mode

Down vol + Up vol + inserting usb cable while holding both = download mode

 

[pbolton]

Yes I had also found the Down vol + power = factory reset mode but had not posted anything about it since it does not do anything for us. But the download mode now that might help us along. Yes I wiped and re setup my development box and that method still did not work but did open an empty word document when it completed...lol Also I was able to root one of my other phones here again with ADB and worked fine. As well as ADB would error with device not found if I did not have the correct LG drivers. So Still looking and playing with it trying to figure a way to get it rooted

 

[Neph]

While playing around with one of the KP500 utilities, I was able to get the cab file for the 3.02 version to extract. All it gave me was 3 files.

VS920_WD_1_0_7_0.dll
VS920ZV3_02.S3_02.P58012.R5.wdb
VS920ZV3_02.S3_02.P58012.R5.wdh

No matter what I tried thou, the LG utility refused to flash the phone once the files were extracted, citing a "page error". If any of the above files make sense to you, let me know.

On a similar note, I copied the 3 files and tried to use the KP500 utility to extract the wdb file, but it keep crashing upon trying to extract.

 

[Neph]

I found the flash mode on the phone this morning, but it did not like my extended batter. I am at 100%, but it gave me a battery to low error when trying to flash. I will try later tonight with my regular battery pack once I have a chance to charge it.

To enter the mode, pull your batter and disconnect the USB cable. Replace your battery and put the cover on. Then insert the USB cable. This will pop up an LG screen and then a charging indicator. When I used KP500 tool to run the LG update, it recognized this mode and when trying to flash, the battery indicator turned orange and had the familiar triangle with exclamation point in it. The LG update tool also recognized this as a flash mode for the phone.

If I didn't have to work soon, I would be trying this again, but my regular battery pack is almost dead.

I have a feeling we are very close now.

 

[Neph]

OK, finally have how to downgrade figured out, but unfortunately, the 3.02 firmware is not susceptible to Zergrush or SoC.

Here is instructions on how to flash a new firmware. I take no responsibility if your mess up your phone in the process.

Tools needed:
KP500
LG Update tool from LG site
.cab file containing your firmware
Unified Verizon Drivers from LG Site.

Instructions:

Install drivers

Set phone to Debug mode and make sure drivers install correctly.

Go into your Windows Device Manager and disable the device under Modems -> LGE AndroidNet for VZW USB Modem

Reboot your phone in "Download Mode"

Extract KP500 tool into a directory (i.e. C:\KP500)
Move your .cab file to the same directory

Run your KP500 file as administrator
Choose I "Flash with assistance (file .cab)
Phone Model = VS920
Input the full path to your cab file including .CAB at the end
Input the full file name of your cab (aka version) without the Cab (i.e. VS920Z4_04.S4_04.P58012.R5)

Watch as the LG update tool pops up.

It will most likely tell you that your phone is disconnected, but if you see the message down below of finding your phone in mode 2 (emergency mode) you are on the right path.

Click Restart.

It will find your phone and go thru extracting the cab file and then extracting a .bin file.

At this point if you did something wrong with driver setup or not disabling the modem driver, you will get a page error. If you did it right, you will get a percentage indicator that goes past 15%. Every so often a message will go by about "model dll message not found". This is normal.

Wait for your phone to finish flashing and let it reboot on its own. I did not do a factory reset and everything came back as it was, but with a new firmware version. You may wish to do a factory reset just to be safe.

While I wish this had allowed root, I am happy that we now at least have a way to flash firmwares.

 

[Neph]

On a side note, downgrading to 3.02 gave me the option to pull an update from Settings -> About Phone -> Software Update. Said update brought me right back to version 4.04

 

[Neph]

Also of note. The bin file seems to be a raw data file of information being flashed to the Spectrum. Going into the file with a hex editor shows what appears to be coding in the OS along with the file system information and other info. At this point, cracking it is well above my head.

 

[bL33d]

get r done

 

[Ruvort]

Also of note. The bin file seems to be a raw data file of information being flashed to the Spectrum. Going into the file with a hex editor shows what appears to be coding in the OS along with the file system information and other info. At this point, cracking it is well above my head.

It is much appreciated. Hell I don't even have the phone and am cheering you on. Tip of the hat to you good sir

Sent from my Droid Incredible 2

 

[Neph]

So, here's what I know about the bin file so far. It does have some sort of directory structure, but nothing I have in windows or linux can read/mount the thing. The beginning of the file contains the following directory list.

Modem
SBL1
SBL2
EXT
RPM
SBL3
ABOOT
BOOT
TZ
MODEM_ST1
MODEM_ST2
PERSIST
RECOVERY
MDM
M9K_EFS1
M9K_EFS2
M9K_EFS3
FSG
SSD
BSP
BLB
TOMBSTONES
DRM
FOTA
MISC
SYSTEM
CACHE
USERDATA
MPT
GROW

After that, there is reference to it being NO NAME and FAT16. For those looking to get a copy of the bin, attempt to flash your phone and watch the C:\PROGRAMDATA\LGMOBILEAX\PHONE\ directory. The "Phone" directory itself will be hidden so you will need to unhide it in what ever program you are using to directory surf. During the flash, 3 files will decompress. The .dll, .wdb, and .wdh. After that, a .bin.dec will form and then finally the .bin file. You will need to copy these files out of the directory as they disappear after the LGupdate program closes.

This bin file is what I am working on to either find a root method or a way to inject root into the file. If anyone else wants to take a swing at it, here you go. The file itself will be about 1.3GB

 

[bL33d]

ya good luck hope u sniff it out.

 

[aclark20]

anyone try the new method posted by hpchoi here: LG SPECTRUM ROOTING DONE! - RootzWiki

That's the same link from earlier where he had the downgrade method, but it looks like he updated over the weekend to a different way.

 

[Neph]

The method is the same one. All it does, and this is only half the time, is install the superuser.apk and busybox. Anyone can install these by using the market. To truely gain root, you need to get the SU file into the system directory and give it 755 status, and so far this has not been done.

 

[Neph]

Also of note, block 27 is not system on the LG Spectrum as it is on the Optimus. That is now under block 26. Block 27 on the Spectrum is the /Cache directory.

 

[Neph]

Injecting root into the .bin file is not possible at this time it seems. LG update takes a firm grip on the file as it's being created and does not let go of it until the flash is done. Disconnecting the phone just results in all files being scrapped and re-created from the cab file.

This means we're either going to need to find an exploit or a .cab file older then 3.02

On a plus side, I have now flashed the phone enough times to be comfortable in doing it.

 

[WaVeS]

What's the difference between the Spectrum, Nitro or Optimus LTE? Couldn't we just use the one click roots for them? If not couldn't we tweak it to work?

 

[bL33d]

the exploits those programs use were patched by lg.

 

[WaVeS]

Okay. So if anyone in the Nitro or Optimus LTE forums find a new way to root, they we should have access as well?