yashsingh1/xdaforums huggingface dataset:
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] McNutnut:
April 1st. I doubt it's breakable by recwovery. 10g appears to have been released yesterday for the US996 and I would assume that's on May 1st.

If you've already got access to TWRP you can just flash the 10h image(s) along with SuperSU/Magik and be on 10h rooted. I personally extract the kdz firmware file, flash all the partition images, sans recovery, in TWRP, and install Magisk to update to the newer firmware on my US996. All without the need to format the data partition (so far).

Any variant with an unlocked bootloader and fastboot flash capabilities (US996 only?) who is wanting to root can just fastboot flash TWRP and then use the button combination to "factory reset" into TWRP to install SuperSU/Magisk. Wouldn't matter what firmware version or security patch you're on. Us US996 users are safe in that (theoretically) any firmware is rootable.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] itsprstar:
H990T??

Hi all guys, first off sorry if this has already been asked before, but I would like to know if this method works with the H990T?, tnxs in advance!
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] androiddiego:
No.

https://xdaforums.com/v20/how-to/dirty-santa-h990-singe-t3550035
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] dimm0k:
interesting, wouldn't 10g be older than 10h?

I've never done a conversion from kdz to images and flashed this way before, is there a more detailed guide on this somewhere so I don't leave any stone unturned from your first method? from what I understand is to basically extract all of the files from the kdz and flash everything in it except the recovery while in TWRP? I believe someone did this for the LGV10 when I had that device, but killed a few devices along the way and that's what scares me
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] McNutnut:
Ha. You're right, it could/should be older. I didn't even pay attention to the lettering and just assumed it was newer since it just popped up recently. Will have to check it out and see what it brings. Given the date in the file name it does appear older ("_1216.kdz" -> December 16th). Thanks for pointing out my complete oversight...

I'll try and expand my other thread to include a flashable 10h if it would help. https://xdaforums.com/v20/how-to/us996unlocked-twrp-flashable-10f-t3544573

I use the kdz extractor tool here: https://xdaforums.com/showthread.php?t=2600575
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] dimm0k:
awesome! thanks for resurrecting that flashable 10f link for me, I actually came across it recently when my device was misbehaving and that may have or at least helped bring my device back to life/stock. if you have time feel free to include a flashable 10h, but if not I should be able to extract the same files with the kdz extractor and mirror your 10f.zip structure. do you happen to also know if this .zip can be used on another LGV20 of different variant by any chance provided I use the kdz for that specific variant?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] McNutnut:
Thread has been updated to include 10h. Enjoy!

As for using the same zip structure for use on another variants, I don't see why it wouldn't work. I would just confirm the other variants have the same partitions as listed in the zip/kdz and that they're in the same locations on the phone. If you have any additional questions feel free to PM me. Don't want to derail this thread too much.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] shotguns10:
I just tried to flash TWRP but it said no such file or directory(I put TWRP renamed to TWRP.img and supersu on the sdcard)
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Still_living714:
Happened to me, place it also on internal storage. And try that
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] shotguns10:
I just did that and the command executed, but it didn't open TWRP.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] midwhiteflava:
I won't mention any names because I refuse to play the blame game and I hadn't done my due diligence. Due to a recent thread opened for the 10h KDZ based image which upon its installation RE-ENCRYPTED without my knowledge, and a series of events that resulted in both an unroot and loss of TWRP, I am now stuck with a US996 that is pretty much worthless to me as I cannot root it back. I. tried. everything.

Recowvery does NOT work on 10h and likely never will.

That being said, I see the G6 forum is almost empty as nobody knows how to unroot it. What the actual **** is LG thinking?!?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] keennay:
Hello all. I just picked up this phone brand new from the T-Mobile store.

I've read through this thread & have questions:

1) What are my options for rooting the T-Mobile variant of this phone? Is DirtyCow still the best method?

2) I see my software version is H91810i. What is the 'H91810j KDZ' version I see online?

3) Is it recommended I upgrade to '10j' before loading TWRP?

4) There's now a Team Win Recovery v3.1.1-0. Can I use that version to follow the same steps from this original post?

Thanks
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] androiddiego:
Use the Recowvery twrp/root method, then install the rom of your choice. The rom will update your phone to the latest firmware assuming it is NATF or WETA.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] keennay:
Thank you!

1) So I can follow this same method and just stop at the Root portion (if I choose to continue using the stock ROM)?

2) Could I always flash a custom ROM at a later choice (after TWRP is setup) without losing any data on this phone?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] dimm0k:
can't you downgrade using an earlier KDZ to root? I believe the anti rollback still allows for it
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] yplim2300:
is there any one click to install Recovery?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] gerland:
Is there any chance yet that the Sprint variant LS 997 on the latest will ever see root?? If not why? Thanks
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Still_living714:
No
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] keennay:
I was able to get this working.

I'm at the last step; are there any advantages to disabling encryption? Any reason why I may/may not want to do this?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] androiddiego:
If you want to have your data work in TWRP, you need to disable decryption.

If you flash a custom rom later you will have to wipe data.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] DeMiNe0:
I have software version H91810i, is there no way to root or flash twrp on this phone now?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] midwhiteflava:
The problem I'm having is because the phone shows as "unknown" with the LG Update tool, the phone is never recognized and therefore it can't install the 10f KDZ. The LG 2014 Tools never starts either. I forget the error and since I spent around 8 hours on this last Sunday I refuse to deal with this again LOL Unless someone out there has an ironclad way for me to roll it back? After that I'm pretty sure recowvery will work for me like it did a few months back.

In particular if there is a way to decrypt the phone without root I can at least use fastboot to flash TWRP which I've already tried and failed.

---------- Post added at 03:08 PM ---------- Previous post was at 02:25 PM ----------

Wow, I found it! Running it now :D

https://xdaforums.com/v20/how-to/v20-kdz-restore-failing-9-completing-fix-t3546817
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] DeMiNe0:
I followed this method and got root, but I couldn't read my data partition. I wiped it and rebooted to a message saying "Decryption Unsuccessful. Factory reset your device." Then it booted me back into TWRP. I did a factory reset, but now it keeps rebooting back into TWRP. I can't get it to boot into system. I installed supersu before wiping. I also tried the other zip to remove encryption.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Vesuvius333:
v20

My apologies for being a noob. I am so very confused. I have version US99610d. Do I update my firmware to the latest version? How do I get root? I really can't make head or tails with the instructions in the 1st page. If somebody can please explain the process in a noob friendly way. Thanks and much appreciated.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] shotguns10:
I followed the steps and got up to running the command to start twrp, it looked like it executed the command but twrp didn't start on my phone. Does anyone have any idea what happened?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] androiddiego:
Did you rename the downloaded twrp image to twrp.img? And did you put it in internal memory - internal sd card?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] shotguns10:
Yes, I renamed it to twrp.img and put it in the main folder of internal storage and my sd card with superSU.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Kevinrdz91:
Hey bro, thanks for the input. Im exactly in the same situation as you. Could you please advice on how you got the bootloader unlocked and checked oem if the device its totally blocked by the RAC center? Thanks!! . what rom are you using right now?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mervingio:
not put the .IMG is by default windows not showing and for SuperSu first flash TWRP then wipe data for decrypt now connect phone to PC upload the SuperSu zip and flash it
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Kevinrdz91:
Bro could you please advice on how you got the bootloader unlocked without having access to the phone? If you could please help me out to get out of this same problem you had (RAC lock) I would extremely appreciate it !!

Thanks!
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] hkbladelawhk:
I'm on one of the initial builds of TWRP from when the V20 was new. I'm unable to get into my phone beyond fastboot and download mode. Is it possible to flash TWRP from either of those modes to update so I can access recovery from the hardware keys?

Vol Down + Power, factory reset didn't let me in

Fastboot erase system

fastboot format system:ext4

fastboot flash recovery (img file)

fastboot boot (img file)

None of the above worked to get me in.

Edit: Solved by restoring firmware to stock with LGUP
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] inurb:
I followed the instructions and flashed TWRP. However it asks for a decrypt password when TWRP loads. How do I get past this? I formatted data twice and I am unable to flash SuperUser since I can't see any mount points. Its read only. Thank you to anyone that can help.

SOLVED:

Here is what I did wrong. After I ran all the dirtycow commands and got permissive root access I rebooted into TWRP. TWRP showed that the sdcard was encrypted. What I kept doing at this step was formatting the sd card which is correct, however I kept rebooting back into system. That was my mistake. I needed to immediately reboot back INTO TWRP RECOVERY instead. Once I rebooted directly back into TWRP recovery after the format I was able to view file system information move su.zip to sd card and install SuperUser.zip from TWRP.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] rjdh2o:
I seem to have a problem when I enter $ getenforce - after hitting enter it says 'enforcing' instead of 'permissive'.

I think that's holding me up from going forward with the following command due to ? Does this have something to do with the build number or update?

Ah hell I'll just paste it -

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell

elsa:/ $ getenforce

Enforcing

elsa:/ $ cd /data/local/tmp

elsa:/data/local/tmp $ ./dirtycow /system/bin/run-as recowvery-run-as

warning: new file size (10192) and file old size (14360) differ

size 14360

[*] mmap 0x7f5eea6000

[*] exploit (patch)

[*] currently 0x7f5eea6000=10102464c457f

[*] madvise = 0x7f5eea6000 14360

[*] madvise = 0 1048576

[*] /proc/self/mem -2122317824 1048576

[*] exploited 0x7f5eea6000=10102464c457f

elsa:/data/local/tmp $ run-as exec ./recowvery-applypatch boot

Warning: setcon transition to 'u:r:init:s0' failed (is SELinux Enforcing?)

Error 1: Operation not permitted

Welcome to recowvery! (run-as)

------------

Current uid: 2000

Setting capabilities

Attempting to escalate to root

Current uid: 0

We have root access!

------------

Executing: './recowvery-applypatch' with 1 arguments

Help

Using T-Mobile H918
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] inurb:
Dumb question, now that i have root does that mean i wont have encryption on internal storage? Meaning if i lose my phone someone could gain access due to lack of encryption? I may have misunderstood op because thats what it sounded like. This root method prevents you from using encryption. Do i have this wrong? Can someone enlighten me? Thanks
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] chris_a4:
Please can anyone help i have unlocked the boot-loader however,

I keep getting stuck here

C:\Users\Desktop\EasyRecowvery-1.2b>adb logcat -s recowvery

--------- beginning of crash

--------- beginning of system

--------- beginning of main

I've let it sit for an hour and nothing, all the vids i see it like instant please help.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] androiddiego:
Easyrecowvery only works on the initial firmware. If you have anything beyond 10d, you have to do it manually.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] rjdh2o:
Just an update

So, I successfully rooted, installed twrp and flashed a new rom to my LG v20 (H918) device. YaY!

Thank you so much @ jcadduono for your awesome work and all who participated in the thread.

I had to downgrade my LG stock rom software version. In the phones settings > about phone > software version mine was ending with the letter 'k'. I used the one that ended in 'J'.

I found this KDZ file somewhere, - H91810j_00_1216-002.kdz --- I used the LG UP program to install the KDZ file, selecting the 'upgrade' option. If anyone using the LG up program has issues with it recognizing your device, like I did, do a search on here for a program called "Uppercut", a user [MENTION=2684188]autoprime[/MENTION] hooked it up. Thanks autoprime!

After installing the new, old LG stock rom version I was able to run the adb commands, exploits all worked and did the rest.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Zacharee1:
NRD90M is the build number, not the software version. Chances are, if anything, you were on 10k.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] rjdh2o:
Edited. Thanks. Was some confusion there.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] inurb:
It's possible you wiped the stock rom. I Did it as well and had to reflash the stock using lgup and uppercut. Then I was able to flash the stock kdz rom.

Remember that once you wipe the SD card via twrp reboot back into twrp, not system. Otherwise your sdcard will show as encrypted and you won't be able to mount it. Once back into twrp and you can see the file system flash the su.zip
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] jim fer:
Please can anyone help i have unlocked the boot-loader however,

I keep getting stuck here

C:\Users\Jimmy\AppData\Local\Android\android-sdk\platform-tools>adb logcat -s recowvery

adb server version (32) doesn't match this client (39); killing...

* daemon started successfully *

--------- beginning of system

--------- beginning of main
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] hrashid88:
so close

Im stuck on

Code:

adb push twrp-3.0.2-x-xxxx.img /sdcard/twrp.img

adb shell

$ run-as exec dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery

"<wait for it to complete>"

$ reboot recovery

I went back replaced dirty cow like it said but when i run the run-as exec it tells me Package "exec" is unknown. Is there something I did wrong. I'm so close:crying:
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] clothtalklp:
Need help

I am rooting an LG V20 and following the thread recowvery unlock your V20/G5 potential now with twrp!

And it's sends me to a GitHub link where after pushing 4 files and a couple commands asked me to exit and enter

adb logcat -s recowvery

I've tried this twice and both times it says

-------begining of system

-------begining of main

And then nothing? I could really use some help
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] clothtalklp:
DISABLE enforcing??

OK please excuse my last post I am still trying to work theu this list of commands in order to root and install twrp on a v20 h918 i have

adb push dirtycow /data/local/tmp

adb push recowvery-applypatch /data/local/tmp

adb push recowvery-app_process64 /data/local/tmp

adb push recowvery-run-as /data/local/tmp

adb shell

$ cd /data/local/tmp

$ chmod 0777 *

$ ./dirtycow /system/bin/applypatch recowvery-applypatch

"<wait for completion>"

$ ./dirtycow /system/bin/app_process64 recowvery-app_process64

"<wait for completion, your phone will look like it's crashing>"

$ exit

adb logcat -s recowvery

"<wait for it to tell you it was successful>"

"[CTRL+C]"

adb shell reboot recovery

"<wait for phone to boot up again, your recovery will be reflashed to stock>"

adb shell

$ getenforce

"<it should say Permissive, adjust source and build for your device!>"

But mine doesn't say permissive it says "enforcing"

can not figure out what im doing wrg I tried setenforce 0

and I got this

127|elsa:/data/local/tmp $ setenforce 0

setenforce: Couldn't set enforcing status to '0': Permission denied

CAN ANYONE LEAD ME IN THE RIGHT DIRECTION?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] treysgreen:
Same here. Did you figure it out?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] CM-Tester:
Maybe it helps

I´ve seen, that you got no answer here... As i am in the same position (get my us996 in around 1 or 2 weeks imported),

maybe this here helps you out:

https://www.youtube.com/watch?v=JVFuAb3fgtM

But please do not ask me right now for special help... I am a beginner like you ;)
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] androiddiego:
The latest version of firmware you can update with this method is 10j. So you could update to 10j (there is a kdz file in the forum with instructions) and then root or you could root 10d and then use one of the custom roms here to get up to 10j. I recommend updating to 10j then rooting. The custom dev here has ended.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] clothtalklp:
Problems downgrading

OK so i came across the same information regarding downgrading to a 10j from a 10k in order to use this root method problem is even after having to use the uppercut program in order to get the LGUP to recognize my device every time i flashed the 10j when it restarted the error message --android.process.acore.is.stopping-- keeps flashing over and over I looked up several articals that say to clear cache from contacts and calendar and remove google accounts and tried them all and so I re applied the 10 via update. Now i need either a solution the the 10j acting crazy or another root method for the 10k
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] androiddiego:
There is no root method for 10k. Where did you get the 10j kdz from?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] CM-Tester:
Hello...

there is a new TWRP (3.1.1-0).

https://twrp.me/site/update/2017/05/19/twrp-3.1.1-0-released.html

Can (or SHOULD) we use this one without issues / Does it work with the flashing- and rooting process ?

[MENTION=4589285]keennay[/MENTION] has asked it before, but didn´t got an answer...

EDIT:

Found this on xda:

https://xdaforums.com/v20/development/recovery-twrp-3-1-0-0-touch-recovery-t3603760

So we have to use the new one exclusive, or the one from the OP ?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] bambam126:
How do I get back to stock im stuck on lg screen and can't get into recovery
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] shojus:
Let me break this down to EASY PEASY instructions...

AFTER your device is bootloader unlocked than open up a command line and execute these commands one by one:

adb push dirtycow /data/local/tmp

adb push recowvery-applypatch /data/local/tmp

adb push recowvery-app_process64 /data/local/tmp

adb push recowvery-run-as /data/local/tmp

adb shell

$ cd /data/local/tmp

$ chmod 0777 *

$ ./dirtycow /system/bin/applypatch recowvery-applypatch

"<wait for completion>"

$ ./dirtycow /system/bin/app_process64 recowvery-app_process64

"<wait for completion, your phone will look like it's crashing>"

$ exit

adb logcat -s recowvery

"<wait for it to tell you it was successful>"

"[CTRL+C]"

adb shell reboot recovery

"<wait for phone to boot up again, your recovery will be reflashed to stock>"

adb shell

$ getenforce

"<it should say Permissive, adjust source and build for your device!>"

$ cd /data/local/tmp

$ ./dirtycow /system/bin/run-as recowvery-run-as

$ run-as exec ./recowvery-applypatch boot

"<wait for it to flash your boot image this time>"

$ run-as su

SO, now you are able to flash TWRP but you must rename that file to "twrp.img" and put it on your internal sd card (I did so using the file explorer on the phone). After that img is on the sd card than you can run this command:

dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery

BAM! You have recovery! So then:

reboot recovery

You should then be booted into TWRP where you need to flash the SuperSU file, after that then I went to "wipe" in TWRP and followed the instructions per the OP.

This is it! Seems hard but it's really not... GET ROOTED WITH TWRP!! ;)
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] slayerh4x:
What is the button combination to get into TWRP. Nothing im trying has worked.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] shojus:
You have asked this about 10 times... People are as confused as you so just wait it out or try something else, cause really no one is quite ready to help as they are just figuring things out too. Be patient, I know you're stressed but you will get it figured out...

---------- Post added at 01:50 PM ---------- Previous post was at 01:49 PM ----------

Just use ADB commands??

either:

reboot recovery

or

adb reboot recovery

Have not figured out the other as of yet, nor have I even tried to.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] mingkee:
Reverse engineering on recovery required to retrieve SHA keys to bypass the bootloader.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] bambam126:
OK then I'll wait
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] shojus:
I promise you will be ok, you are just stuck and someone will help soon. I would but I don't have the foggiest idea where to start so I will let someone help you that may. Good luck :good:
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Rydah:
Anybody get this when running adb logcat -s recowvery:

10-31 10:53:55.745 14108 14108 I recowvery: ------------
10-31 10:53:55.745 14108 14108 I recowvery: Current selinux context: u:r:zygote:s0
10-31 10:53:55.745 14108 14108 I recowvery: Set context to 'u:r:system_server:s0'
10-31 10:53:55.746 14108 14108 I recowvery: Current security context: u:r:system_server:s0
10-31 10:53:55.746 14108 14108 E recowvery: Current security context 'u:r:system_server:s0' does not match 'u:r:system_server:s0'!
10-31 10:53:55.746 14108 14108 E recowvery: Error 22: Invalid argument
10-31 10:53:55.746 14108 14108 E recowvery: Waiting 20 seconds for next try...

It's said this message like 20 times.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] trix4rix:
Finished unlocking bootloader, not too difficult. Now I'm running into an error trying to root. First command in ADB - "adb push dirtycow /data/local/tmp" hits me with this error: "adb: error: cannot stat 'dirtyow': No such file or directory" so obviously I'm missing a file, or some step. can anyone help me clarify?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] slayerh4x:
I mean when I'm not at my PC or if there is an issue after a restore, something like that.