[T-Mobile LG G2] :
so I did some research on the Kingo issue and it does seem to communicate with an online service quite often, most of it looks innocent although it did request some suspicious sounding files, hopefully not to push to my device, i'll look into it further but for now I'll leave you guys with my discoveries, I'll pass it on to the other thread tomorrow.

**Seems like I can't upload files or post links just yet (or I'd put it in DropBox) but here's some of the packets/headers I sniffed:

These are headers that a browser would use to communicate with a webserver. The lines we need to pay attention to are the first (GET/POST), the Content-Length, and the Host. The GET means the client/Kingo was requesting a file or data from the webserver. POST means it was posting data to the webserver, content-length says how much data is posted.

[B]it posts about ~80 bytes of data.[/B]

POST /api/get_flash_files?timestamp=1387784928632&channel=v4&lang=en HTTP/1.1
Cache-control: no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/octet-stream
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Content-Length: 85
Connection: Keep-Alive
Accept-Encoding: gzip
Accept-Language: en-US,*
Host: service.wmshua.com

[B]afterwards it retrieves "android_flash.sbin" from another server.[/B]

GET /script__ch_v4__/android_flash.sbin?_upt=560d566b1387788641&timestamp=1387785044647&channel=v4&lang=en HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) WanMeiShua/2.0
Cache-control: no-cache, must-revalidate
Pragma: no-cache
Connection: Keep-Alive
Accept-Encoding: gzip
Accept-Language: en-US,*
Host: android-rom.b0.upaiyun.com

[B]and then another file, "basefunc_40.sbin".[/B]

GET /script__ch_v4__/basefunc_40.sbin?_upt=1567a53c1387788643&timestamp=1387785046020&channel=v4&lang=en HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) WanMeiShua/2.0
Cache-control: no-cache, must-revalidate
Pragma: no-cache
Connection: Keep-Alive
Accept-Encoding: gzip
Accept-Language: en-US,*
Host: android-rom.b0.upaiyun.com

[B]this one I saved to the side for further inspection later because of its name "root_kit_base.sbin", ~100 kilobytes.[/B]

GET /script__ch_v4__/root_kit_base.sbin?_upt=ef43ebef1387788647&timestamp=1387785050669&channel=v4&lang=en HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) WanMeiShua/2.0
Cache-control: no-cache, must-revalidate
Pragma: no-cache
Connection: Keep-Alive
Accept-Encoding: gzip
Accept-Language: en-US,*
Host: android-rom.b0.upaiyun.com

all while making several ~80-~100 byte POST commands in between to inform the webserver of its progress. Kingo seems to act as a front-end for a web-based rooting service, would still like to know what all the remote data/files are for.

POST /api/root_count?timestamp=1387785088807&channel=v4&lang=en HTTP/1.1
Cache-control: no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/octet-stream
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Content-Length: 104
Connection: Keep-Alive
Accept-Encoding: gzip
Accept-Language: en-US,*
Host: service.wmshua.com

POST /check HTTP/1.1
UtsTag: 2
Content-Type: application/octet-stream
Content-Length: 231
Connection: Keep-Alive
Accept-Encoding: gzip
Accept-Language: en-US,*
User-Agent: Mozilla/5.0
Host: update.wmshua.com

POST /api/report_flash_log?timestamp=1387785105066&channel=v4&lang=en HTTP/1.1
Cache-control: no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/octet-stream
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Content-Length: 356
Connection: Keep-Alive
Accept-Encoding: gzip
Accept-Language: en-US,*
Host: service.wmshua.com

Sorry I tried to explain the best I could, because if it IS a rootkit, it can pretty much hide itself in the file system/storage/apps on your device and do a lot more harm / allow unauthorized access. I don't really know why all this is necessary for root method. I'm not jumping to conclusions since I don't fully understand the situation but I'm just letting everyone guys know, you guys be the judge. For now, I'll keep looking into it more when I get the chance until we find another root method or get ioroot working again.