• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

LG Tribute 2 (boost) reference guide

D

Deleted User

Guest
WARNING: DO NOT FLASH ANYTHING TO BOOT OR RECOVERY. IT WILL NOT WORK. BUMP WILL NOT WORK. NO EXPLOIT IS AVAILABLE RIGHT NOW. TEMP ROOT IS THE BEST THING YOU HAVE.

Hello, everyone. Let this serve as a guide for the LS665 (boost mobile). This is about the only info out there as the device is a month old. I have put all of the findings I have gone through below. Smack the thanks button around if you find it helpful.


Device Codename: LS665
Android Version: 5.1.1
Kernel Version: 3.10.49 (Source)
Baseband Version: MPSS.DPM.2.0.c11-00021-M8936FAAAANUZM-1
Build number: LMY47V
Software Version: LS665ZV3

Root is available on LS665ZV3
Root: King Root

Vulnerable To:
  • CVE-2015-3828 (start stagefright)
  • CVE-2015-1539
  • CVE-2015-3824
  • CVE-2015-3829
  • CVE-2015-3827
  • CVE-2015-1538 (end stagefright)
  • CVE-2015-3636 (ping pong)

Partitions
Code:
lrwxrwxrwx root  root  1970-01-01 00:20 DDR -> /dev/block/mmcblk0p23
lrwxrwxrwx root  root  1970-01-01 00:20 aboot -> /dev/block/mmcblk0p5
lrwxrwxrwx root  root  1970-01-01 00:20 abootbak -> /dev/block/mmcblk0p11
lrwxrwxrwx root  root  1970-01-01 00:20 boot -> /dev/block/mmcblk0p18
lrwxrwxrwx root  root  1970-01-01 00:20 cache -> /dev/block/mmcblk0p37
lrwxrwxrwx root  root  1970-01-01 00:20 carrier -> /dev/block/mmcblk0p35
lrwxrwxrwx root  root  1970-01-01 00:20 drm -> /dev/block/mmcblk0p31
lrwxrwxrwx root  root  1970-01-01 00:20 eksst -> /dev/block/mmcblk0p26
lrwxrwxrwx root  root  1970-01-01 00:20 encrypt -> /dev/block/mmcblk0p25
lrwxrwxrwx root  root  1970-01-01 00:20 factory -> /dev/block/mmcblk0p29
lrwxrwxrwx root  root  1970-01-01 00:20 fota -> /dev/block/mmcblk0p30
lrwxrwxrwx root  root  1970-01-01 00:20 fsc -> /dev/block/mmcblk0p21
lrwxrwxrwx root  root  1970-01-01 00:20 fsg -> /dev/block/mmcblk0p20
lrwxrwxrwx root  root  1970-01-01 00:20 grow -> /dev/block/mmcblk0p39
lrwxrwxrwx root  root  1970-01-01 00:20 hyp -> /dev/block/mmcblk0p3
lrwxrwxrwx root  root  1970-01-01 00:20 hypbak -> /dev/block/mmcblk0p9
lrwxrwxrwx root  root  1970-01-01 00:20 laf -> /dev/block/mmcblk0p17
lrwxrwxrwx root  root  1970-01-01 00:20 metadata -> /dev/block/mmcblk0p14
lrwxrwxrwx root  root  1970-01-01 00:20 misc -> /dev/block/mmcblk0p12
lrwxrwxrwx root  root  1970-01-01 00:20 modem -> /dev/block/mmcblk0p33
lrwxrwxrwx root  root  1970-01-01 00:20 modemst1 -> /dev/block/mmcblk0p15
lrwxrwxrwx root  root  1970-01-01 00:20 modemst2 -> /dev/block/mmcblk0p16
lrwxrwxrwx root  root  1970-01-01 00:20 mpt -> /dev/block/mmcblk0p32
lrwxrwxrwx root  root  1970-01-01 00:20 pad -> /dev/block/mmcblk0p6
lrwxrwxrwx root  root  1970-01-01 00:20 persist -> /dev/block/mmcblk0p13
lrwxrwxrwx root  root  1970-01-01 00:20 persistent -> /dev/block/mmcblk0p34
lrwxrwxrwx root  root  1970-01-01 00:20 rct -> /dev/block/mmcblk0p27
lrwxrwxrwx root  root  1970-01-01 00:20 recovery -> /dev/block/mmcblk0p19
lrwxrwxrwx root  root  1970-01-01 00:20 rpm -> /dev/block/mmcblk0p4
lrwxrwxrwx root  root  1970-01-01 00:20 rpmbak -> /dev/block/mmcblk0p10
lrwxrwxrwx root  root  1970-01-01 00:20 sbl1 -> /dev/block/mmcblk0p1
lrwxrwxrwx root  root  1970-01-01 00:20 sbl1bak -> /dev/block/mmcblk0p7
lrwxrwxrwx root  root  1970-01-01 00:20 sec -> /dev/block/mmcblk0p24
lrwxrwxrwx root  root  1970-01-01 00:20 sns -> /dev/block/mmcblk0p28
lrwxrwxrwx root  root  1970-01-01 00:20 ssd -> /dev/block/mmcblk0p22
lrwxrwxrwx root  root  1970-01-01 00:20 system -> /dev/block/mmcblk0p36
lrwxrwxrwx root  root  1970-01-01 00:20 tz -> /dev/block/mmcblk0p2
lrwxrwxrwx root  root  1970-01-01 00:20 tzbak -> /dev/block/mmcblk0p8
lrwxrwxrwx root  root  1970-01-01 00:20 userdata -> /dev/block/mmcblk0p38

Partition dump backup:

DOWNLOAD IT HERE (System rooted, but can uninstall)

Getting into "Download Mode"
  1. Power off
  2. plug usb in
  3. hold power and volume up at the same time

Getting into Recovery Mode

  1. Power off
  2. plug usb in
  3. hold power and volume down at the same time

Boot / Kernel info

Code:
  page size  : 2048
  kernel size  : 7997632
  ramdisk size  : 2375543
  dtb size  : 182272
  base  : 0x80000000
  kernel offset  : 0x00008000
  ramdisk offset : 0x02000000
  tags offset  : 0x00000100
  dtb img  : dt.img
  cmd line  : console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=c50 user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 vmalloc=504m

fstab
Code:
# Android fstab file.
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK

#TODO: Add 'check' as fs_mgr_flags with data partition.
# Currently we dont have e2fsck compiled. So fs check would failed.

#<src>  <mnt_point>  <type> <mnt_flags and options>  <fs_mgr_flags>
/devices/soc.0/7864900.sdhci/mmc_host  /storage/external_SD  vfat  nosuid,nodev  wait,voldmanaged=external_SD:auto
/dev/block/bootdevice/by-name/system  /system  ext4  ro,barrier=1,discard  wait,check
/dev/block/bootdevice/by-name/userdata  /data  ext4  nosuid,nodev,barrier=1,noauto_da_alloc,discard  wait,check,encryptable=/dev/block/bootdevice/by-name/encrypt
/dev/block/bootdevice/by-name/persist  /persist  ext4  nosuid,nodev,barrier=1  wait,check
/dev/block/bootdevice/by-name/cache  /cache  ext4  nosuid,nodev,barrier=1  wait,check
/dev/block/bootdevice/by-name/drm  /persist-lg  ext4  nosuid,nodev,barrier=1,noatime,noauto_da_alloc,errors=continue  wait,check
/dev/block/bootdevice/by-name/sns  /sns  ext4  nosuid,nodev,barrier=1,noatime,noauto_da_alloc,errors=continue  wait,check
/dev/block/bootdevice/by-name/boot  /boot  emmc  defaults  defaults
/dev/block/bootdevice/by-name/recovery  /recovery  emmc  defaults  defaults
/dev/block/bootdevice/by-name/misc  /misc  emmc  defaults  defaults

Battery Cover Pin Out
Did you know you dont need the battery cover on to manipulate power on, off, volume buttons.
Here is the pin out:
bottom right - common ground
bottom left - Volume -
top right - Power
top left - Volume +

To turn on power, youd get a paper clip and connect the bottom right with the top right. If you want power and volume down (recovery) youd connect the bottom left, bottom right, and top right pads together.
 
Last edited by a moderator:
Any chance I could get some instructions on how to apply the backup to recover a soft-brick? I tried to apply root for "Tribute and all variants" ... Apparently the T2 is NOT a variant! I know the basics, just need to know which partitions to apply which .img files to.

(Would I just follow the partition info in the fstab dump?)

It would appear that I was thinking of another phone when I said I knew the basics. On this phone I have ADB access (shell only) and "Download Mode." Fastboot status is not available/unknown. Help?

EDIT: Managed to get it to boot recovery... still won't boot after factory reset, as expected. Continuing to await your advice, good Sir!

UPDATE: Since I don't have root, I don't have ADB sideload capability. Not that I can figure out, anyway. I CAN access some root functionality via shell from the send_command found in the post I used to try to root in the first place.

I have seen a number of others have inadvertently followed those instructions on this same model and wound up with the same results. Hopefully we can use me as a trial to figure out how to help everyone effected.
 
Last edited:
Upvote 0
Since I have this phone now I'm going to attempt to port CWM to it, but I'm a noob at this and will be teaching myself as I go along so it may take months to be completed since I'm also a full time CS major.

Your going to have a tough time since the bootloader is locked. Don't let that deter you though, you can have things ready for when someone figures out an exploit.

Also, start with twrp. You can build it with cm12.1 source, and cwm is basically dead.
 
  • Like
Reactions: jamoosh
Upvote 0
Your going to have a tough time since the bootloader is locked. Don't let that deter you though, you can have things ready for when someone figures out an exploit.

Also, start with twrp. You can build it with cm12.1 source, and cwm is basically dead.
Thanks for the vote of confidence and the advice, I only was gonna start with CWM because that's the one XDA University gave instructions on, but I'll look into a TWRP tutorial since I like that one best anyway.
 
Upvote 0
A dump from what I know has the android system in it, I found a image file named system.img, thats the system folder with the apps in it right? I can't seem to open it. It wants me to burn a cd but I just want to open it. I tried ext4 unpacker and that said the file was not the right format. Could any of you tell me how I could open it? I would like to open it so I could try some apps on my LG L22C, in the reviews I watched the apps looked different then the normal ones. I think the apps should work because from what I have read the LG Power is the same as the LG Leon and the LG Leon is the same as the LG Tribute 2. Any help is very much appreciated!
 
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones