[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Catboy123:
This is really driving me insane now. I have a H830, Android 7.0, 20A. My bootloader is unlocked (verified with adb, phone pauses before boot telling me that the bootloader is unlocked). I have followed this guide exactly, but I cannot get passed two parts. First 'adb shell reboot recovery'. All it does is restart my device to a blank screen that says 'no command' with the android on his back. I have managed to get past this once, but I can't for the life of me manage to do it again. The one time I managed to get around it, I was stopped by the './dirtycow /system/bin/run-as recowvery-run-as' part of the instruction. I input that command and the phone makes a noise, and stays unresponsive. I am able to verify that the phone is still connected to adb with 'adb devices' but I am not able to run 'run-as exec ./recowvery-applypatch boot'. The terminal says 'run-as: Package 'exec' is unknown. What the hell am I doing wrong?

Recowvery>adb push dirtycow /data/local/tmp
336 KB/s (9984 bytes in 0.028s)

Recowvery>adb push recowvery-applypatch /data/local/tmp
1503 KB/s (18472 bytes in 0.011s)

Recowvery>adb push recowvery-app_process64 /data/local/tmp
995 KB/s (10200 bytes in 0.010s)

Recowvery>adb push recowvery-run-as /data/local/tmp
1107 KB/s (10192 bytes in 0.008s)

Recowvery>adb shell
h1:/ $ cd /data/local/tmp
cd /data/local/tmp
h1:/data/local/tmp $ chmod 0777 *
chmod 0777 *
h1:/data/local/tmp $ ./dirtycow /system/bin/applypatch recowvery-applypatch
./dirtycow /system/bin/applypatch recowvery-applypatch
warning: new file size (18472) and file old size (165144) differ

size 165144

[*] mmap 0x7b49dd7000
[*] exploit (patch)
[*] currently 0x7b49dd7000=10102464c457f
[*] madvise = 0x7b49dd7000 165144
[*] madvise = 0 1048576
[*] /proc/self/mem 1367343104 1048576
[*] exploited 0x7b49dd7000=10102464c457f
h1:/data/local/tmp $ ./dirtycow /system/bin/app_process64 recowvery-app_process64
rtycow /system/bin/app_process64 recowvery-app_process64 <
warning: new file size (10200) and file old size (18600) differ

size 18600

[*] mmap 0x779d73a000
[*] exploit (patch)
[*] currently 0x779d73a000=10102464c457f
[*] madvise = 0x779d73a000 18600
[*] madvise = 0 1048576
[*] /proc/self/mem -1971322880 1048576
[*] exploited 0x779d73a000=10102464c457f
h1:/data/local/tmp $ exit
exit

Recowvery>adb logcat -s recowvery
--------- beginning of system
--------- beginning of main
--------- beginning of crash
08-05 17:30:12.430 7788 7788 I recowvery: Welcome to recowvery! (app_process64)
08-05 17:30:12.430 7788 7788 I recowvery: ------------
08-05 17:30:12.430 7788 7788 I recowvery: Current selinux context: u:r:zygote:s0
08-05 17:30:12.430 7788 7788 I recowvery: Set context to 'u:r:system_server:s0'
08-05 17:30:12.431 7788 7788 I recowvery: Current security context: u:r:system_server:s0
08-05 17:30:12.431 7788 7788 I recowvery: Setting property 'ctl.start' to 'flash_recovery'
08-05 17:30:12.445 7788 7788 I recowvery: ------------
08-05 17:30:12.445 7788 7788 I recowvery: Recovery flash script should have started!
08-05 17:30:12.445 7788 7788 I recowvery: Run on your PC or device to see progress: adb logcat -s recowvery
08-05 17:30:12.445 7788 7788 I recowvery: Waiting 3 minutes to try again (in case it didn't start or you forgot to dirtycow applypatch first)...
08-05 17:30:12.512 7792 7792 I recowvery: Welcome to recowvery! (applypatch)
08-05 17:30:12.512 7792 7792 I recowvery: ------------
08-05 17:30:12.513 7792 7792 I recowvery: Loading boot image from block device '/dev/block/bootdevice/by-name/boot'...
08-05 17:30:12.708 7792 7792 I recowvery: Loaded boot image!
08-05 17:30:12.708 7792 7792 I recowvery: ------------
08-05 17:30:12.708 7792 7792 I recowvery: Saving old ramdisk to file
08-05 17:30:12.743 7792 7792 I recowvery: Decompressing ramdisk (gzip -d)
08-05 17:30:13.115 7792 7792 I recowvery: Checking '/cache/ramdisk.cpio' for validity (size >= 4194304 bytes)
08-05 17:30:13.115 7792 7792 I recowvery: '/cache/ramdisk.cpio': 13411328 bytes
08-05 17:30:13.115 7792 7792 I recowvery: File OK
08-05 17:30:13.115 7792 7792 I recowvery: Decompression of ramdisk successful
08-05 17:30:13.115 7792 7792 I recowvery: Deleting '/cache/ramdisk.gz' (no longer needed)
08-05 17:30:13.122 7792 7792 I recowvery: ------------
08-05 17:30:13.122 7792 7792 I recowvery: Opened cpio archive '/cache/ramdisk.cpio' (13411328 bytes)
08-05 17:30:13.122 7792 7792 I recowvery: Wrote new file (308 bytes) to cpio archive,
08-05 17:30:13.122 7792 7792 I recowvery: Final size: 13411396 bytes
08-05 17:30:13.122 7792 7792 I recowvery: ------------
08-05 17:30:13.122 7792 7792 I recowvery: Compressing cpio to ramdisk (gzip -9 -c)
08-05 17:30:16.567 7792 7792 I recowvery: Checking '/cache/ramdisk.gz' for validity (size >= 2097152 bytes)
08-05 17:30:16.567 7792 7792 I recowvery: '/cache/ramdisk.gz': 5905559 bytes
08-05 17:30:16.567 7792 7792 I recowvery: File OK
08-05 17:30:16.567 7792 7792 I recowvery: Compression of ramdisk successful
08-05 17:30:16.567 7792 7792 I recowvery: Deleting '/cache/ramdisk.cpio' (no longer needed)
08-05 17:30:16.579 7792 7792 I recowvery: Loading new ramdisk into boot image
08-05 17:30:16.587 7792 7792 I recowvery: ------------
08-05 17:30:16.587 7792 7792 I recowvery: cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=h1 dhash_entries=131072 ihash_entries=131072"
08-05 17:30:16.587 7792 7792 I recowvery: Setting permissive arguments on cmdline
08-05 17:30:16.587 7792 7792 I recowvery: cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=h1 dhash_entries=131072 ihash_entries=131072 androidboot.selinux=permissive enforcing=0"
08-05 17:30:16.587 7792 7792 I recowvery: ------------
08-05 17:30:16.587 7792 7792 I recowvery: Updating boot image hash
08-05 17:30:17.031 7792 7792 I recowvery: Writing modified boot image to block device '/dev/block/bootdevice/by-name/recovery'...
08-05 17:30:17.290 7792 7792 I recowvery: Done!
08-05 17:30:17.290 7792 7792 I recowvery: ------------
08-05 17:30:17.290 7792 7792 I recowvery: Permissive boot has been has been flashed to /dev/block/bootdevice/by-name/recovery successfully!
08-05 17:30:17.290 7792 7792 I recowvery: You may use 'reboot recovery' now to enter a permissive system.
08-05 17:30:17.290 7792 7792 I recowvery: ------------
08-05 17:30:17.290 7792 7792 I recowvery: Warning: If you don't reboot now, this will continue to run every 3 minutes!
08-05 17:30:17.290 7792 7792 I recowvery: ***********************************************
08-05 17:30:17.291 7792 7792 I recowvery: * give jcadduono a hug, will ya? *
08-05 17:30:17.291 7792 7792 I recowvery: ***********************************************

*used reboot recovery here*

Recowvery>adb devices
List of devices attached
LGH83054c2fd87 device

C:\Users\dmdan\Downloads\Recowvery>adb shell reboot recovery

Recowvery>adb devices
List of devices attached
LGH83054c2fd87 device

C:\Users\dmdan\Downloads\Recowvery>adb shell reboot recovery

Recowvery>adb shell
h1:/ $ cd /data/local/tmp
cd /data/local/tmp
h1:/data/local/tmp $ cd /data/local/tmp
cd /data/local/tmp
h1:/data/local/tmp $ ./dirtycow /system/bin/app_process64 recowvery-app_process64
rtycow /system/bin/app_process64 recowvery-app_process64 <
warning: new file size (10200) and file old size (18600) differ

size 18600

[*] mmap 0x7cacaa8000
[*] exploit (patch)
[*] currently 0x7cacaa8000=10102464c457f
[*] madvise = 0x7cacaa8000 18600
[*] madvise = 0 1048576
[*] /proc/self/mem -1971322880 1048576
[*] exploited 0x7cacaa8000=10102464c457f
h1:/data/local/tmp $ run-as exec ./recowvery-applypatch boot
run-as exec ./recowvery-applypatch boot
run-as: Package 'exec' is unknown
254|h1:/data/local/tmp $ ^C
C:\Users\dmdan\Downloads\Recowvery>adb devices
List of devices attached
LGH83054c2fd87 device

Recowvery>adb reboot

Recowvery>adb devices
List of devices attached
LGH83054c2fd87 device

Recowvery>adb shell
h1:/ $ cd /data/local/tmp
cd /data/local/tmp
h1:/data/local/tmp $ run-as exec ./recowvery-applypatch boot
run-as exec ./recowvery-applypatch boot
run-as: Package 'exec' is unknown
254|h1:/data/local/tmp $