I think this has been tried before. Not sure

 

The code is there for it in the Spirit bootloader, but it's A.) disabled, and B.) if you can circumvent that you need still need a valid unlock certificate signed by LG.

So no. As is, not gonna work for the Spirit or Motion (or any Secure Boot 3.0 LG phones).

 

Just tried again to make sure, doesn't work.

 

I've been working on it for a little while (on the Spirit, same phone at the basic architecture level). I can confirm there is oem-unlock code in the bootloader (which is currently disabled) that needs a signed LG certificate not unlike the HTC fastboot unlock method. I can also confirm that there is a fastboot backdoor, and I think I know how to trigger it, but I'm waiting for LG to send me back my Spirit (bricked it playing musical bootchains) to test it before releasing anything publicly.

 

By "backdoor" do you mean how to get into fastboot? Could the unlock code be what is stored in the oem fuse?

 

If you want to learn a lot about the msm8960 architecture, I suggest reading http://forum.xda-developers.com/showthread.php?t=1756919 It is long though, you have been warned!

 

There is no master "unlock code". Unlock certificates are generated per-device with LG's "master" signing key.

You'd have to modify the bootloader to jump to the unlock code in the fastboot section of the bootloader, as the way it's currently implemented in the bootloader, no control paths jump to it.

 

Which version of IDA do you have btw? I am stuck with an old release, that has almost no arm support. Makes it very hard.

 

6.1. Same version as you do. I know, without Hex-Rays ARM support, we are at the mercy of professionals like djrbliss.

 

GFan ( a data security company ) has a method used by some phone mfg,
using the charger as the trigger for opening 2nd init.
Does any one think it can trigger the aboot unlock oem
to load a custom ROM to the device, given that some linux person has a built rom already to load.

 

Well, if you can tell me how it is used as a trigger, I will try.

 

Mine is unlockd. Got a friend at LG. Hooked me up on the DL. He cant do too many at a time cuz itll look suspicious. Pm if u want his info. Only can do five maybe ten at a time so hurry up.

 

I call B.S unless your friend is in Korea

 

I wouldn't say stuff like this unless you can provide undeniable proof. Its frowned upon it, ive seen many a member state they create some rom or got something working but obviously never did. People hated those members D:

 

if yours is unlocked then you could simply upload your partitions and then everybodies would be unlocked

 

Already asked for this in a pm, and offered instructions if needed. Waiting for a reply. Seems kinda shady though, but entirely impossible.

 

Negative. The unlock certificate is generated per-device.

Also highly doubtful of this.

 

I got the info and called the guy but it said the phone # was disconnected so either he gave me the wrong # or this is fake.

 

I'd bet both. The paranoiac in me hopes you used something like Skype when you called as well.

 

I don't think LG cares either way. It's the carriers who will go apeshit.

 

if that were truly the case then it would only be the carrier devices that were the case. lg wants their devices locked, its a smart business decision