• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

LG Tribute 2 (boost) reference guide

WARNING: DO NOT FLASH ANYTHING TO BOOT OR RECOVERY. IT WILL NOT WORK. BUMP WILL NOT WORK. NO EXPLOIT IS AVAILABLE RIGHT NOW. TEMP ROOT IS THE BEST THING YOU HAVE.

Hello, everyone. Let this serve as a guide for the LS665 (boost mobile). This is about the only info out there as the device is a month old. I have put all of the findings I have gone through below. Smack the thanks button around if you find it helpful.


Device Codename: LS665
Android Version: 5.1.1
Kernel Version: 3.10.49 (Source)
Baseband Version: MPSS.DPM.2.0.c11-00021-M8936FAAAANUZM-1
Build number: LMY47V
Software Version: LS665ZV3

Root is available on LS665ZV3
Root: King Root

Vulnerable To:
  • CVE-2015-3828 (start stagefright)
  • CVE-2015-1539
  • CVE-2015-3824
  • CVE-2015-3829
  • CVE-2015-3827
  • CVE-2015-1538 (end stagefright)
  • CVE-2015-3636 (ping pong)

Partitions
Code:
lrwxrwxrwx root  root  1970-01-01 00:20 DDR -> /dev/block/mmcblk0p23
lrwxrwxrwx root  root  1970-01-01 00:20 aboot -> /dev/block/mmcblk0p5
lrwxrwxrwx root  root  1970-01-01 00:20 abootbak -> /dev/block/mmcblk0p11
lrwxrwxrwx root  root  1970-01-01 00:20 boot -> /dev/block/mmcblk0p18
lrwxrwxrwx root  root  1970-01-01 00:20 cache -> /dev/block/mmcblk0p37
lrwxrwxrwx root  root  1970-01-01 00:20 carrier -> /dev/block/mmcblk0p35
lrwxrwxrwx root  root  1970-01-01 00:20 drm -> /dev/block/mmcblk0p31
lrwxrwxrwx root  root  1970-01-01 00:20 eksst -> /dev/block/mmcblk0p26
lrwxrwxrwx root  root  1970-01-01 00:20 encrypt -> /dev/block/mmcblk0p25
lrwxrwxrwx root  root  1970-01-01 00:20 factory -> /dev/block/mmcblk0p29
lrwxrwxrwx root  root  1970-01-01 00:20 fota -> /dev/block/mmcblk0p30
lrwxrwxrwx root  root  1970-01-01 00:20 fsc -> /dev/block/mmcblk0p21
lrwxrwxrwx root  root  1970-01-01 00:20 fsg -> /dev/block/mmcblk0p20
lrwxrwxrwx root  root  1970-01-01 00:20 grow -> /dev/block/mmcblk0p39
lrwxrwxrwx root  root  1970-01-01 00:20 hyp -> /dev/block/mmcblk0p3
lrwxrwxrwx root  root  1970-01-01 00:20 hypbak -> /dev/block/mmcblk0p9
lrwxrwxrwx root  root  1970-01-01 00:20 laf -> /dev/block/mmcblk0p17
lrwxrwxrwx root  root  1970-01-01 00:20 metadata -> /dev/block/mmcblk0p14
lrwxrwxrwx root  root  1970-01-01 00:20 misc -> /dev/block/mmcblk0p12
lrwxrwxrwx root  root  1970-01-01 00:20 modem -> /dev/block/mmcblk0p33
lrwxrwxrwx root  root  1970-01-01 00:20 modemst1 -> /dev/block/mmcblk0p15
lrwxrwxrwx root  root  1970-01-01 00:20 modemst2 -> /dev/block/mmcblk0p16
lrwxrwxrwx root  root  1970-01-01 00:20 mpt -> /dev/block/mmcblk0p32
lrwxrwxrwx root  root  1970-01-01 00:20 pad -> /dev/block/mmcblk0p6
lrwxrwxrwx root  root  1970-01-01 00:20 persist -> /dev/block/mmcblk0p13
lrwxrwxrwx root  root  1970-01-01 00:20 persistent -> /dev/block/mmcblk0p34
lrwxrwxrwx root  root  1970-01-01 00:20 rct -> /dev/block/mmcblk0p27
lrwxrwxrwx root  root  1970-01-01 00:20 recovery -> /dev/block/mmcblk0p19
lrwxrwxrwx root  root  1970-01-01 00:20 rpm -> /dev/block/mmcblk0p4
lrwxrwxrwx root  root  1970-01-01 00:20 rpmbak -> /dev/block/mmcblk0p10
lrwxrwxrwx root  root  1970-01-01 00:20 sbl1 -> /dev/block/mmcblk0p1
lrwxrwxrwx root  root  1970-01-01 00:20 sbl1bak -> /dev/block/mmcblk0p7
lrwxrwxrwx root  root  1970-01-01 00:20 sec -> /dev/block/mmcblk0p24
lrwxrwxrwx root  root  1970-01-01 00:20 sns -> /dev/block/mmcblk0p28
lrwxrwxrwx root  root  1970-01-01 00:20 ssd -> /dev/block/mmcblk0p22
lrwxrwxrwx root  root  1970-01-01 00:20 system -> /dev/block/mmcblk0p36
lrwxrwxrwx root  root  1970-01-01 00:20 tz -> /dev/block/mmcblk0p2
lrwxrwxrwx root  root  1970-01-01 00:20 tzbak -> /dev/block/mmcblk0p8
lrwxrwxrwx root  root  1970-01-01 00:20 userdata -> /dev/block/mmcblk0p38

Partition dump backup:

DOWNLOAD IT HERE (System rooted, but can uninstall)

Getting into "Download Mode"
  1. Power off
  2. plug usb in
  3. hold power and volume up at the same time

Getting into Recovery Mode

  1. Power off
  2. plug usb in
  3. hold power and volume down at the same time

Boot / Kernel info

Code:
  page size  : 2048
  kernel size  : 7997632
  ramdisk size  : 2375543
  dtb size  : 182272
  base  : 0x80000000
  kernel offset  : 0x00008000
  ramdisk offset : 0x02000000
  tags offset  : 0x00000100
  dtb img  : dt.img
  cmd line  : console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=c50 user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 vmalloc=504m

fstab
Code:
# Android fstab file.
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK

#TODO: Add 'check' as fs_mgr_flags with data partition.
# Currently we dont have e2fsck compiled. So fs check would failed.

#<src>  <mnt_point>  <type> <mnt_flags and options>  <fs_mgr_flags>
/devices/soc.0/7864900.sdhci/mmc_host  /storage/external_SD  vfat  nosuid,nodev  wait,voldmanaged=external_SD:auto
/dev/block/bootdevice/by-name/system  /system  ext4  ro,barrier=1,discard  wait,check
/dev/block/bootdevice/by-name/userdata  /data  ext4  nosuid,nodev,barrier=1,noauto_da_alloc,discard  wait,check,encryptable=/dev/block/bootdevice/by-name/encrypt
/dev/block/bootdevice/by-name/persist  /persist  ext4  nosuid,nodev,barrier=1  wait,check
/dev/block/bootdevice/by-name/cache  /cache  ext4  nosuid,nodev,barrier=1  wait,check
/dev/block/bootdevice/by-name/drm  /persist-lg  ext4  nosuid,nodev,barrier=1,noatime,noauto_da_alloc,errors=continue  wait,check
/dev/block/bootdevice/by-name/sns  /sns  ext4  nosuid,nodev,barrier=1,noatime,noauto_da_alloc,errors=continue  wait,check
/dev/block/bootdevice/by-name/boot  /boot  emmc  defaults  defaults
/dev/block/bootdevice/by-name/recovery  /recovery  emmc  defaults  defaults
/dev/block/bootdevice/by-name/misc  /misc  emmc  defaults  defaults

Battery Cover Pin Out
Did you know you dont need the battery cover on to manipulate power on, off, volume buttons.
Here is the pin out:
bottom right - common ground
bottom left - Volume -
top right - Power
top left - Volume +

To turn on power, youd get a paper clip and connect the bottom right with the top right. If you want power and volume down (recovery) youd connect the bottom left, bottom right, and top right pads together.

Could you please pull me your system.img & boot.img files? Have gone from one-click-root to brick and back... rooted now but no way to get a clean install of phone so can receive marshmellow (or any) update(s)!!
Any help will be greatly appreciated.
Thanks
zach
 
Upvote 0
I bricked this phone with SuperSUME. Dumb mistake with not having custom recovery for it... I am attempting to build a TWRP over the next few days for this phone. Using the http://forum.xda-developers.com/android/development/guide-how-to-root-lgls770-5-1-1-t3184649 method I am able to view files in the Send_Command.exe shell with "LS" commands. My phone is stuck in a bootloop however I feel there is still hope for it. I took a copy off of a friends phone of Boot, Recovery, System and carrier partitions in .img format. Does anyone have any suggestions as to what I may be able to do to recover this phone. It is my life force :p

Included example of LS http://puu.sh/n3nqV/51a00759ed.png
 
Upvote 0
OK so I have rooted my ls665 using Kingroot, and I got the xposed installer and a couple of modules running by following a link from this thread. My question is, is it possible to flash TWRP or CWM using flashfire or flashify? I'd imagine nobody has compiled one yet, but if there was one, couldn't it be flashed that way, and then on to custom Roms? I've had other phones with locked bootloaders before and that's how it was done
 
Last edited:
Upvote 0
OK so I have rooted my ls665 using Kingroot, and I got the xposed installer and a couple of modules running by following a link from this thread. My question is, is it possible to flash TWRP or CWM using flashfire or flashify? I'd imagine nobody has compiled one yet, but if there was one, couldn't it be flashed that way, and then on to custom Roms? I've had other phones with locked bootloaders before and that's how it was done
Yeah but not with the recovery you can flash a rom with flashfire, but nobody would try.
 
  • Like
Reactions: huggs
Upvote 0
The lg leon roms would go nicely in
So a Leon ROM will work on the Triumph 2 unmodified? Same hardware? I mean I'm not gonna be the first to try it, this is my only phone atm, but good to know for someone else who might want to try. What about TWRP for the Leon? Could I just grab that & flash it via flashfire or flashify?
 
Last edited:
Upvote 0
So a Leon ROM will work on the Triumph 2 unmodified? Same hardware? I mean I'm not gonna be the first to try it, this is my only phone atm, but good to know for someone else who might want to try. What about TWRP for the Leon? Could I just grab that & flash it via flashfire or flashify?
You can't flash the recovery since the bootloader is locked
 
Upvote 0
So a Leon ROM will work on the Triumph 2 unmodified? Same hardware? I mean I'm not gonna be the first to try it, this is my only phone atm, but good to know for someone else who might want to try. What about TWRP for the Leon? Could I just grab that & flash it via flashfire or flashify?
Don't get me wrong I think it would work, I dont actually know i dont have the device anymore XD
 
Upvote 0
Leon's TWRP doesn't work for the Tribute 2. Flashed it with TWRP Manager and booting recovery gives Secure Boot Error 1003. So I have no recovery now lol. No big deal for me really, but figured I'd let it be known on here so somebody else doesn't make the same mistake I did.
Ummm ask someone to backup there stock recovery and send it to you
 
Upvote 0
A dump from what I know has the android system in it, I found a image file named system.img, thats the system folder with the apps in it right? I can't seem to open it. It wants me to burn a cd but I just want to open it. I tried ext4 unpacker and that said the file was not the right format. Could any of you tell me how I could open it? I would like to open it so I could try some apps on my LG L22C, in the reviews I watched the apps looked different then the normal ones. I think the apps should work because from what I have read the LG Power is the same as the LG Leon and the LG Leon is the same as the LG Tribute 2. Any help is very much appreciated!
Using that logic I tried to flash twrp from the Leon and I have no recovery now
 
Upvote 0
Does anybody know how to get into the secret menu on this phone? I've tried all the #*#*_____*#*# codes I could find for the Leon, and none have worked.

BTW, I was able to get my recovery back by flashing this with Flashify. Just rename the file to have " .img " after it and flash away!!

drive.google.com/file/d/0B76ml2yzUbRZMmE4eG03bWo1N0E/view?usp=docslist_api

I wish it was a working TWRP, but at this point a working stock recovery is better than nothing
 
Last edited:
  • Like
Reactions: b00f0087
Upvote 0
Upvote 0
MEID changed when I install tot file. Do you know how to change this back?

Here is the Recovery for LG H343 (LG RISIO H343 for Cricket is the same hardware variant of LG Tribute 2 LS665 Boost Mobile or LG Tribute Duo Sprint)
http://www.mylgphones.com/lg-h345-l...e-frp-google-account-verification-bypass.html

Also this is the LG H343 firmware in TOT format:
https://www.needrom.com/wp-content/uploads/2016/07/h343.zip

LGH343AT-01-V20d-310-150-APR-01-2016-ARB01+0.tot
 
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones