New idea Bootloader relock and unlock (for people who can't do this using LG method) - LG Optimus L9 P760, P765, P768, P769

Hello. Last time I was thinking about locking bootloader for Optimus L9. I decompiled Hidden Menu app and checked how bootloader status is checked. I found that everything is on NV partition. When i dumped nv using dd commad i was searching using hex editor and i found that 4 characters are stored on 00004800 and 00004801 (h) offset. If bootloader is unlocked there should be: 1101 (4353 DEC). This magic numer i found when i decompiled hidden menu app.
Now I need people who can't unlock bootloader and people who can unlock, but don't want to do this. I need also some people who have unlocked bootloader to confim if this string is correct. You need only to dump this 4 characters using my little script. You only must have root. Download zip in attachments and do this using 2 ways:
If you have adb working correctly
Extract zip
Run dump.cmd
Follow instruction
If you have done everything correctly you should have OUTPUT.txt
Check if this file is not empty and if it is ok send here on XDA
If you have problems with above method:
Download and run Terminal Emulator from Google Play
Type su and accept poup-up
Type dd if=/dev/block/platform/omap/omap_hsmmc.1/by-name/nv of=/sdcard/nv.img
Using computer type copy nv.img to the directory where you extracted zip
Open manual.cmd
Follow instructions
Check if OUTPUT.txt is not empty and send there it here
DON'T SEND US NV.IMG, BECAUSE IT INCLUDES IMEI. I ONLY WANT THIS ONE TXT FILE WHICH INCLUDES YOUR BOOTLOADER STATE.
IT WILL HELP US TO FIND METHOD TO LOCK BOOTLOADER AGAIN AND UNLOCK BOOTLOADER FOR SOME PEOPLE.
Decompiled bootloader check code:
Code:
package com.lge.hiddenmenu.bootloadunlock;
import android.app.ListActivity;
import android.os.Bundle;
import android.util.Log;
import android.view.*;
import android.widget.ArrayAdapter;
import android.widget.ListView;
import java.io.File;
import java.io.RandomAccessFile;
public class BootLoader_Unlock extends ListActivity
{
public BootLoader_Unlock()
{
String as[] = new String[1];
as[0] = "BootLoader Unlock Check";
mTopMenu = as;
}
private void showResult(int i)
{
android.app.AlertDialog.Builder builder = new android.app.AlertDialog.Builder(this);
Log.e("BootLoader Unlock", (new StringBuilder()).append("readNV(36): ").append(i).toString());
if(i == 4353)
builder.setMessage("Unlock");
else
builder.setMessage("Lock");
builder.setPositiveButton(0x104000a, null);
builder.setTitle("BootLoader Unlock Check");
builder.show();
}
public int device_unlock_flag_read()
{
short word0;
boolean flag;
File file;
RandomAccessFile randomaccessfile;
word0 = 0;
flag = true;
file = new File("/dev/block/platform/omap/omap_hsmmc.1/by-name/nv");
randomaccessfile = null;
RandomAccessFile randomaccessfile1 = new RandomAccessFile(file, "r");
randomaccessfile1.seek(18432L);
word0 = randomaccessfile1.readShort();
Log.e("BootLoader Unlock", (new StringBuilder()).append("swrv_fused_status=").append(word0).toString());
Exception exception;
Exception exception1;
try
{
randomaccessfile1.close();
}
catch(Exception exception4) { }
if(!flag)
word0 = -1;
return word0;
exception;
_L4:
Log.e("BootLoader Unlock", (new StringBuilder()).append("readNV(36): exception occurs: ").append(exception).toString());
flag = false;
try
{
randomaccessfile.close();
}
catch(Exception exception3) { }
break MISSING_BLOCK_LABEL_73;
exception1;
_L2:
try
{
randomaccessfile.close();
}
catch(Exception exception2) { }
throw exception1;
exception1;
randomaccessfile = randomaccessfile1;
if(true) goto _L2; else goto _L1
_L1:
exception;
randomaccessfile = randomaccessfile1;
if(true) goto _L4; else goto _L3
_L3:
}
public void onCreate(Bundle bundle)
{
super.onCreate(bundle);
setTitle("BootLoader Unlock Check");
setListAdapter(new ArrayAdapter(this, 0x1090003, mTopMenu));
}
public boolean onKeyDown(int i, KeyEvent keyevent)
{
i;
JVM INSTR tableswitch 3 4: default 24
// 3 31
// 4 31;
goto _L1 _L2 _L2
_L1:
return super.onKeyDown(i, keyevent);
_L2:
getWindow().clearFlags(128);
finish();
if(true) goto _L1; else goto _L3
_L3:
}
protected void onListItemClick(ListView listview, View view, int i, long l)
{
if(i == 0)
showResult(device_unlock_flag_read());
}
protected void onPause()
{
getWindow().clearFlags(128);
super.onPause();
}
protected void onResume()
{
getWindow().addFlags(128);
super.onResume();
}
private static final int NV_IDX_SWRV_FUSED_STATUS = 36;
private static final String NV_PATH = "/dev/block/platform/omap/omap_hsmmc.1/by-name/nv";
private static final int UNLOCK_VALUE = 4353;
private final String TAG = "BootLoader Unlock";
private String mTopMenu[];
}
Other resources in attachments.

---

ok, here, you have my output file. I had lock bootloader, I hope that this file help you. thanks
Sorry for my english

---

Duno crap about this phone but I went ahead and tried your script.

---

Would this work on CyanogenMod 9?
Is it even possible to replace nv.img with a modified version without a security error?

---

I think in nv there is information if bl is locked or unlocked

---

Here's the dump for my locked bootloader.

---

Here's the dump for my locked bootloader because i can't unlock it after rma

---

I think this is an efuse/prom like Samsung's Knox bit. But I thought it were a specific PROM chip, or integrated into the main chipset(the VIA Apollo mainboard southbridges had such a one-way flash cell.
If it's part of NVRAM, there may be the flash voltage line missing for that specific block, though I never heard of such.

---

No we figured out the exact line that's preventing us from unlocking in the source code. We just can't get the package signed to fix it.
---------- Post added at 03:06 PM ---------- Previous post was at 03:03 PM ----------
Hmm i wonder what the chances of this working is? I have very little hope through what i've been through

---

bulletfreak said:
No we figured out the exact line that's preventing us from unlocking in the source code. We just can't get the package signed to fix it.
---------- Post added at 03:06 PM ---------- Previous post was at 03:03 PM ----------
Hmm i wonder what the chances of this working is? I have very little hope through what i've been through
Click to expand...
Click to collapse
Although I don't use my L9 P769 anymore, only keep it for a backup, I edited a copy of my NV image with the data @artas182x posted in the OP and flashed it to the phone. The phone booted just fine, but apparently the NV images get's rebuilt or something along those lines with every boot as the Bootloader Status says it's still locked. If we can figure out how to write directly to the NV partition while the device is booted, then we may have a chance to unlock the bootloader.

---

i confirm that 1101 is for unlocked phone

---

There must be something on our flash. We must find what writes to nv partition.

---

You're about to discover a way to unlock the bootloader despite LGs restrictions. But re-locking it may be impossible.

---

Would watchdog have anything to do with it getting reflashed? Or does that just check for other "malicious" processes?
---------- Post added at 05:05 PM ---------- Previous post was at 05:01 PM ----------
Does Android automatically write logs of the boot up process or would we need to use a logcat for that?

---

re-lock impossible? its possible now with a cable with 910k resistor, you just need to Flash stock rom via LG mobile support tool or kdz updater, and your BL will be locked
Napisane używając SwiftKey, zaszyfrowane Enigmą i wysłane kablem Ethernet

---

Just to be sure is anyone actually going to look into this?

---

LG P768 Boot Unlock

---

How will i go about trying this? Like can i get a link to a modified nv.img? Logcats are unable to keep logs of the boot up process right? So is there anything i can use to log it?

---

We need uboot and x-loader logs

---

artas182x said:
We need uboot and x-loader logs
Click to expand...
Click to collapse
how does one obtain those?