[Verizon LG G3] roirraW "edor" ehT:
THIS METHOD IS DANGEROUS!!! IT'S TESTED FINE FOR ME 2-3 TIMES, AND FOR SOME OTHERS AS WELL, BUT QUITE A FEW PEOPLE BRICK THEIR PHONES. SINCE I CAN'T REPLICATE THE ISSUE, I HAVE NO IDEA WHAT COULD BE HAPPENING DIFFERENTLY FOR OTHERS, AND HAVE NO WAY OF TELLING IF ANYONE IS NOT FOLLOWING THE DIRECTIONS PROPERLY.

THIS METHOD SHOULD BE A LAST DITCH EFFORT AND IS MAINLY AIMED AT THOSE WHO DESPITE ALL THEIR BEST METHODS TRYING THE TOT METHOD, WOULD ONLY RESULT IN A "KS ERROR" MESSAGE IN THE TOT TOOL.

This is an alternative to the way I usually recommend which is downgrading to 10B via the TOT method and using the .DLL from 35B, then rooting with the Stump app and putting TWRP on with TWRP Manager.

Thanks to [MENTION=2941286]xdabbeb[/MENTION] for packaging the 35B bootstack.

Thanks to [MENTION=7291175]b00ster23[/MENTION] for confirming this works for those who received the "ks error" when trying to use the TOT method to downgrade.

I am not responsible if you brick your device or lose data.

The aim of these instructions is for those on 100% stock VS985 35B (5.1.1), 46A or 47A (6.0) to be able to root, install TWRP, AND flash another ROM (requirement) and/or to be able to downgrade from 35B, 46A or 47A to ANY release via the KDZ method with LG Flash Tool 2014.

Tested by me by flashing the 35B KDZ with the CSE option and taking the OTA from 35B to 46A and then the OTA to 47A. After TWRP was installed, I restored my TWRP backup of the rooted stock ROM I was running previously.

You will HAVE to flash another ROM (and appropriate full Bootstack zip) from TWRP, or use LG Flash Tool 2014 to flash any KDZ once you reboot from this process, since this doesn't include a bump'd kernel for whichever stock ROM you're currently running.

1. Root with the KingRoot app from www.kingroot.net (needs connected to internet and re-rooted with Kingroot after every reboot, if you reboot for any reason).

2. Extract the following files from [MENTION=2941286]xdabbeb[/MENTION]’s 35B bootstack available at http://xdaforums.com/verizon-lg-g3/development/xdabbeb-s-vs980-2-0-0-t3231279 in the Downloads section in the bottom half of the first post:

aboot.bin

laf.bin

modem.bin

persist.bin

rct.bin

sbl1.bin

You can use ZArchiver from the Play Store at https://play.google.com/store/apps/details?id=ru.zdevs.zarchiver&hl=en or a file manager that has archive support built in like X-plore File Manager at https://play.google.com/store/apps/details?id=com.lonelycatgames.Xplore&hl=en.

Extract them to your internal storage (not inside a folder).

Screenshot of how they should look in X-plore File Manager:

3. Download the latest official TWRP. Tested with v3.0.0, should work the same with 2.8.7.0. Get either from here https://dl.twrp.me/vs985/. Put the TWRP img file the same place as the bootstack partitions you extracted.

4. Install Terminal Emulator for Android from the Play Store at https://play.google.com/store/apps/details?id=jackpal.androidterm&hl=en.

5. Downgrade your partitions by copying and pasting the following commands using Terminal Emulator with SuperUser permissions. You don’t have to do one at a time, you can copy and paste the entire list of commands.

Also attached the commands below to this post as a text file, so you can download the text file, and copy and paste the commands from it.

su
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/sbl1
dd if=/sdcard/sbl1.bin of=/dev/block/platform/msm_sdcc.1/by-name/sbl1
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/aboot
dd if=/sdcard/aboot.bin of=/dev/block/platform/msm_sdcc.1/by-name/aboot
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/laf
dd if=/sdcard/laf.bin of=/dev/block/platform/msm_sdcc.1/by-name/laf
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/modem
dd if=/sdcard/modem.bin of=/dev/block/platform/msm_sdcc.1/by-name/modem
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/persist
dd if=/sdcard/persist.bin of=/dev/block/platform/msm_sdcc.1/by-name/persist
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/rct
dd if=/sdcard/rct.bin of=/dev/block/platform/msm_sdcc.1/by-name/rct
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/sdcard/twrp-3.0.0-0-vs985.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery

Replace “twrp-3.0.0-0-vs985.img” in the last command with the filename of your preferred custom recovery.

After you paste the commands, press “Enter” on your keyboard to issue the last command.

Screenshot of what the pasted commands in Terminal Emulator should look like. If the output of any of your commands is different, something might have gone wrong and you should redo those particular command(s):

6. Type:

reboot recovery

into the Terminal Emulator once you're ready to reboot into recovery.

7. You will HAVE to flash another ROM (and appropriate full Bootstack zip) from TWRP, or use LG Flash Tool 2014 to flash any KDZ once you reboot from this process, since this doesn't include a bump'd kernel for whichever stock ROM you're currently running.