A guide to extracting LG KDZ firmware update files in order to unpack the super.img held therein.

kdzextraction.md

Extracting KDZs and their super.img partition held within

LG KDZ formats are a pain in the ass. Various tools and scripts have been made for the extraction of said KDZs; not many, if any at all, work with the current KDZ format (v3).

The script mentioned below for extraction should work with all three formats, i.e old, older, and new.

Prerequisites

• Windows (preferably with WSL), or Linux/Mac with a Windows VM
  • NOTE: Unfortunately I am not yet aware of a method for Unix systems that does not require a VM or Wine for the time being. Looking into the 7zip method of extraction may fix this.
• Python 3 and Pip
• With pip, install zstandard
  • pip install zstandard
• 7zip, preferably the zstandard variant:
  • original 7zip : https://www.7-zip.org/
  • zstd variant : https://github.com/mcmilk/7-Zip-zstd/
  • NOTE: I'm unsure whether or not it makes a difference as I don't use the normal 7zip. It should be fine either way, though.
• Probably going to want both Linux and Windows at your disposal for easy filesystem mounting. If running Windows, this can be done easily with WSL. See here. Alternatively, 7zip is perfectly capable of opening and/or extracting ext4 filesystems by itself.
• If running Linux as your host machine, you'll probably have to use a Windows VM, or to use Wine if 7zip works with it. I don't know whether or not this is the case and I haven't bothered to actually check.
• Grab iscgar's kdz extractor.
  • NOTE: Click on the "raw" button and then go ahead and just save that page to your preferred location if you aren't familiar with GitHub gists.
  • For this guide we'll assume you've saved this file as "kdz_extractor.py"

The Process

We'll assume that you are inside of a Windows environment, and that our workspace is the plain and simple Desktop.

1. Create a folder for your extracted images to be placed into; i.e for the V60, "V60_extracted"

2. Ensure that your KDZ and kdz_extractor.py are on the Desktop, or if working elsewhere, are in the same folder together.

3. Within Windows Terminal or alternatively Powershell, run:

   • python3 kdz_extractor.py -e <where to extract> <kdz to extract> An example command, with our working directory as the Desktop, our folder for extraction being "V60_extracted" and our KDZ file having the name "V600TM10p_00_TMO_US_OP_0511.kdz" would be:
   • python3 kdz_extractor.py -e V60_extracted V600TM10p_00_TMO_US_OP_0511.kdz

4. The script will print some information about the file and hang for a few minutes while it gets ready. It will continue to print output once it's working on what chunk it's currently working with and in what partition it resides in. It is important to not cancel the script or get impatient. It takes some time.

5. Once the extraction is complete, within the folder for extracted images, you should see quite a lot of different files. What we will focus on is "0.super.img." The number prefix may vary.

6. Open this folder in Explorer and select the super partition file. Right click, and within the context menu, choose:

   • "7-Zip > Open Archive... > #"

   This will open said archive and you will be met with eight files, four of them with .ext extensions. The "Comment" column will provide the labeling. If you see system, vendor, and product, then the file with the comment of "/" is the odm partition. If you see vendor, product, and odm, the "/" comment file will be system.

7. From here it is simple click and drag. Place the four .ext files into a directory of your choice, and rename each of them to the corresponding file; i.e 4.ext to vendor.raw.

8. If using a bash terminal, you can mount these files with no issues to a folder of your choice. I had success with:

   • sudo mount -t ext4 -o loop system.raw system/

If you're using 7zip, you can simply open the archive, or extract it directly.

Notes

• For some reason, some KDZs throw an error upon extraction talking about a headers issue where it is expecting a certain amount of bytes but gets something different. It is on my todo list to take a look at it and patch it to work if/when that happens. I have only run into this on two of the Stylo 6 KDZ files. The V60 Android 10 KDZ file worked with zero issues. Android 11 is yet to be tested.

Special Thanks

• iscgar for the updated and functional KDZ extractor.
• mcmilk for the simply awesome 7-Zip variant with far more functionality.
• Igor Pavlov's 7-Zip for being a progressive yet classic program for Windows and providing people everywhere with a wide variety of compression and decompression capabilities.

How could I install the extracted kdz on my device?? I have a LG v60 that is brick and i cannot install kdz, the only way my PC recognizes phone is in EDL mode

I'm working on that. Right now, actually.
It's been a huge confusing mess, but I'm making some headway now, so we'll see.

Hi. I extract product image but the OP folder inside is empty. How can I get that folder? I don't see any OP partition from the kdz.

 0/ 1 : gpt_main1.bin_0 (277 bytes)
 0/ 2 : gpt_main2.bin_0 (277 bytes)
 0/ 3 : gpt_main3.bin_0 (335 bytes)
 0/ 4 : gpt_main4.bin_0 (3099 bytes)
 0/ 5 : gpt_main5.bin_0 (404 bytes)
 0/ 6 : gpt_main6.bin_0 (212 bytes)
 1/?? : mpt (<empty>)
 2/?? : drm (<empty>)
 3/?? : p_persist_lg (<empty>)
 4/?? : sns (<empty>)
 5/?? : ssd (<empty>)
 6/ 7 : persist.img_15368 (6196 bytes)
 7/?? : misc (<empty>)
 8/ 8 : ftm.img_23816 (70 bytes)
 9/?? : power (<empty>)
10/?? : eksst (<empty>)
11/?? : rct (<empty>)
12/?? : srtc (<empty>)
13/?? : pstore (<empty>)
14/?? : els (<empty>)
15/?? : operatorlogging (<empty>)
16/?? : eri (<empty>)
17/?? : carrier (<empty>)
18/?? : persdata (<empty>)
19/ 9 : vbmeta_system.img_85000 (1942 bytes)
20/?? : vbmeta_system_b (<empty>)
21/?? : metadata (<empty>)
22/10 : super_1.img_89129 (478 bytes)
22/11 : super_256.img_89384 (88375579 bytes)
22/12 : super_256.img_154920 (124730602 bytes)
22/13 : super_256.img_220456 (99643388 bytes)
22/14 : super_256.img_285992 (48126828 bytes)
22/15 : super_229659.img_318787 (8254548 bytes)
22/16 : super_235972.img_325100 (12411100 bytes)
22/17 : super_239771.img_328899 (46 bytes)
22/18 : super_239872.img_329000 (184256220 bytes)
22/19 : super_239872.img_394536 (163695012 bytes)
22/20 : super_239872.img_460072 (351 bytes)
22/21 : super_370950.img_460078 (63070399 bytes)
22/22 : super_403720.img_492848 (327090 bytes)
22/23 : super_404538.img_493666 (8713819 bytes)
22/24 : super_407199.img_496327 (45 bytes)
22/25 : super_407296.img_496424 (125128889 bytes)
22/26 : super_407296.img_561960 (125306180 bytes)
22/27 : super_407296.img_627496 (128818224 bytes)
22/28 : super_407296.img_693032 (203189718 bytes)
22/29 : super_407296.img_758568 (179701692 bytes)
22/30 : super_407296.img_824104 (168759944 bytes)
22/31 : super_407296.img_889640 (203480697 bytes)
22/32 : super_407296.img_955176 (180007880 bytes)
22/33 : super_407296.img_1020712 (228414914 bytes)
22/34 : super_407296.img_1086248 (202483672 bytes)
22/35 : super_407296.img_1151784 (60731255 bytes)
22/36 : super_1095440.img_1184568 (61615997 bytes)
22/37 : super_1128192.img_1217320 (25 bytes)
22/38 : super_1129625.img_1218753 (37486564 bytes)
22/39 : super_1141224.img_1230352 (46 bytes)
22/40 : super_1141248.img_1230376 (127311389 bytes)
22/41 : super_1141248.img_1295912 (170950918 bytes)
22/42 : super_1141248.img_1361448 (151886891 bytes)
22/43 : super_1141248.img_1426984 (127058548 bytes)
22/44 : super_1141248.img_1492520 (209024127 bytes)
22/45 : super_1141248.img_1558056 (129768028 bytes)
22/46 : super_1141248.img_1623592 (211898277 bytes)
22/47 : super_1141248.img_1689128 (179791958 bytes)
22/48 : super_1141248.img_1754664 (238488596 bytes)
22/49 : super_1141248.img_1820200 (192238571 bytes)
22/50 : super_1141248.img_1885736 (93037842 bytes)
22/51 : super_1855967.img_1945095 (37082827 bytes)
22/52 : super_1867446.img_1956574 (46 bytes)
22/53 : super_1867520.img_1956648 (153797118 bytes)
22/54 : super_1867520.img_2022184 (78025751 bytes)
22/55 : super_1867520.img_2087720 (139423875 bytes)
22/56 : super_1867520.img_2153256 (78813289 bytes)
22/57 : super_1867520.img_2218792 (145002859 bytes)
22/58 : super_1867520.img_2284328 (113184523 bytes)
22/59 : super_1867520.img_2349864 (2670 bytes)
22/60 : super_2260763.img_2349891 (11064595 bytes)
22/61 : super_2276230.img_2365358 (21120957 bytes)
22/62 : super_2282803.img_2371931 (46 bytes)
22/63 : super_2283008.img_2372136 (316165 bytes)
22/64 : super_2283408.img_2372536 (23439 bytes)
22/65 : super_2283434.img_2372562 (40 bytes)
23/66 : userdata_0.img_6380584 (356 bytes)
23/67 : userdata_512.img_6381096 (421 bytes)
23/68 : userdata_1023.img_6381607 (735 bytes)
23/69 : userdata_2560.img_6383144 (136 bytes)
23/70 : userdata_7680.img_6388264 (1983 bytes)
23/71 : userdata_8186.img_6388770 (68 bytes)
23/72 : userdata_8693.img_6389277 (19 bytes)
23/73 : userdata_9728.img_6390312 (153 bytes)
23/74 : userdata_11264.img_6391848 (284 bytes)
23/75 : userdata_11776.img_6392360 (301 bytes)
23/76 : userdata_12288.img_6392872 (4905 bytes)
23/77 : userdata_12800.img_6393384 (657880 bytes)
23/78 : userdata_14336.img_6394920 (331106 bytes)
24/?? : grow (<empty>)
25/79 : gpt_backup0.bin_15388667 (1263 bytes)
25/80 : gpt_backup1.bin_2043 (250 bytes)
25/81 : gpt_backup2.bin_2043 (250 bytes)
25/82 : gpt_backup3.bin_2043 (307 bytes)
25/83 : gpt_backup4.bin_637947 (3068 bytes)
25/84 : gpt_backup5.bin_4091 (376 bytes)
25/85 : gpt_backup6.bin_1019 (183 bytes)
26/86 : xbl.elf_6 (2811342 bytes)
27/87 : xbl_config.elf_1030 (42825 bytes)
28/88 : xbl.elf_6 (2811342 bytes)
29/89 : xbl_config.elf_1030 (42825 bytes)
30/90 : aop.mbn_6 (104871 bytes)
31/91 : tz.mbn_134 (1278065 bytes)
32/92 : hypvmperformance.mbn_1158 (609064 bytes)
33/93 : NON-HLOS.bin_3206 (92478870 bytes)
34/94 : abl.elf_68742 (204511 bytes)
35/95 : dspso.bin_68998 (18745704 bytes)
36/96 : km41.mbn_85382 (112560 bytes)
37/97 : akmu.mbn_85510 (8519 bytes)
38/98 : boot.img_85638 (31870168 bytes)
39/99 : devcfg.mbn_110214 (22583 bytes)
40/100 : qupv3fw.elf_110246 (17974 bytes)
41/101 : laf.img_110266 (33008419 bytes)
42/102 : vbmeta.img_134842 (2555 bytes)
43/103 : dtbo.img_134858 (78246 bytes)
44/104 : uefi_sec.mbn_141002 (54800 bytes)
45/105 : shrm.elf_142026 (27362 bytes)
46/106 : multi_image.mbn_142058 (3470 bytes)
47/107 : cpucp.elf_142066 (29998 bytes)
48/108 : featenabler.mbn_142322 (29345 bytes)
49/109 : vendor_boot.img_142354 (736731 bytes)
50/110 : qweslicstore.bin_166930 (2034 bytes)
51/111 : raw_resources.img_166994 (239298 bytes)
52/112 : imeiprot.mbn_169042 (20893 bytes)
53/113 : aop.mbn_169170 (104871 bytes)
54/114 : tz.mbn_169298 (1278065 bytes)
55/115 : hypvmperformance.mbn_170322 (609064 bytes)
56/116 : NON-HLOS.bin_172370 (92478870 bytes)
57/117 : abl.elf_237906 (204511 bytes)
58/118 : dspso.bin_238162 (18745704 bytes)
59/119 : km41.mbn_254546 (112560 bytes)
60/120 : akmu.mbn_254674 (8519 bytes)
61/121 : boot.img_254802 (31870168 bytes)
62/122 : devcfg.mbn_279378 (22583 bytes)
63/123 : qupv3fw.elf_279410 (17974 bytes)
64/124 : laf.img_279430 (33008419 bytes)
65/125 : vbmeta.img_304006 (2555 bytes)
66/126 : dtbo.img_304022 (78246 bytes)
67/127 : uefi_sec.mbn_310166 (54800 bytes)
68/128 : shrm.elf_311190 (27362 bytes)
69/129 : multi_image.mbn_311222 (3470 bytes)
70/130 : cpucp.elf_311230 (29998 bytes)
71/131 : featenabler.mbn_311486 (29345 bytes)
72/132 : vendor_boot.img_311518 (736731 bytes)
73/133 : qweslicstore.bin_336094 (2034 bytes)
74/134 : raw_resources.img_336158 (239298 bytes)
75/135 : imeiprot.mbn_338206 (20893 bytes)
76/136 : apdp.mbn_346271 (2820 bytes)
77/137 : logfs_ufs_8mb.bin_354693 (554 bytes)
78/138 : storsec.mbn_487813 (8184 bytes)
79/139 : sec.elf_487973 (2844 bytes)
80/140 : sec.elf_501520 (2844 bytes)
81/141 : rtice.mbn_509712 (79894 bytes)```

Thank you @haise0. Am trying this script to extract LG X210IMW (india) firmware file "X210IMW10e_00_OPEN_ESA_DS_OP_0312.kdz" downloaded from https lg-firmwares.com/downloads-file/18960/X210IMW10e_00_OPEN_ESA_DS_OP_0312/ but get the following error:

python3 kdz_extractor.py -e ./lg-X210IMW10e ./lg-X210IMW10e_00_OPEN_ESA_DS_OP_0312.kdz
KDZ Header

version = 3, magic = 25223824, size = 1320
records = 3
Record(name='X21011g_00.dz', size=2185165245, offset=5365576)
Record(name='LGUP_c.dll', size=3891664, offset=83768)
Record(name='LGUP_c.dylib', size=1390144, offset=3975432)
tag = 3.13
extended_mem_id = AdditionalRecord(offset=83768, size=0)
data =
additional_records_size = 0
suffix_map = AdditionalRecord(offset=0, size=0)
data = ['']
sku_map = AdditionalRecord(offset=0, size=0)
data = ['']
extended_sku_map = AdditionalRecord(offset=0, size=0)
data =
ftm_model_name =

Traceback (most recent call last):
File "iscgar-kdz9-extractor.py", line 716, in
main()
File "iscgar-kdz9-extractor.py", line 685, in main
parse_secure_partition(in_file)
File "iscgar-kdz9-extractor.py", line 573, in parse_secure_partition
sec_part = SecurePartition(f)
File "iscgar-kdz9-extractor.py", line 217, in init
assert all(p == 0 for p in signature[sig_size:]), 'non-zero byte(s) in signature padding'
AssertionError: non-zero byte(s) in signature padding

---

Trying kdztools-1.2 also shows error:

./unkdz -f ./lg-X210IMW10e_00_OPEN_ESA_DS_OP_0312.kdz -l
[!] Error: Data between headers and payload! (offsets 826 to 83768)

Good Work.Please give detailed guide and also work on extraction+flashable zip converter using custom recovery for new kdz.

requires use windows just for 7-Zip to open super.img?, there is an linux tool can unpack and repack them called lpunpack and lpmake, its in google android repo

not work extract v40 kdz but succes extract v60