[LG V20 Guides, News, & Discussion] me2151:
Despite previous warnings. I ran dirty cow and successfully exploited.

1|elsa:/data/local/tmp $ ./dirtycow /system/bin/applypatch recowvery-applypatch

/dirtycow /system/bin/applypatch recowvery-applypatch <

warning: new file size (18472) and file old size (165144) differ

size 165144

[*] mmap 0x772fbb7000

[*] exploit (patch)

[*] currently 0x772fbb7000=10102464c457f

[*] madvise = 0x772fbb7000 165144

[*] madvise = 0 1048576

[*] /proc/self/mem 1367343104 1048576

[*] exploited 0x772fbb7000=10102464c457f

elsa:/data/local/tmp $ ./dirtycow /system/bin/app_process64 recowvery-app_proces

s64

dirtycow /system/bin/app_process64 recowvery-app_process64 <

warning: new file size (10200) and file old size (18600) differ

size 18600

[*] mmap 0x7c65c2d000

[*] exploit (patch)

[*] currently 0x7c65c2d000=10102464c457f

[*] madvise = 0x7c65c2d000 18600

[*] madvise = 0 1048576

[*] /proc/self/mem -1971322880 1048576

[*] exploited 0x7c65c2d000=10102464c457f

elsa:/data/local/tmp $ exit

exit

C:\Users\Loki\Desktop>adb logcat -s recowvery

--------- beginning of system

--------- beginning of main

--------- beginning of crash

11-05 14:42:28.794 20889 20889 I recowvery: Welcome to recowvery! (app_process64

)

11-05 14:42:28.794 20889 20889 I recowvery: ------------

11-05 14:42:28.794 20889 20889 I recowvery: Current selinux context: u:r:zygote:

s0

11-05 14:42:28.795 20889 20889 I recowvery: Set context to 'u:r:system_server:s0

'

11-05 14:42:28.796 20889 20889 I recowvery: Current security context: u:r:system

_server:s0

11-05 14:42:28.796 20889 20889 I recowvery: Setting property 'ctl.start' to 'fla

sh_recovery'

11-05 14:42:28.799 20889 20889 I recowvery: ------------

11-05 14:42:28.799 20889 20889 I recowvery: Recovery flash script should have st

arted!

11-05 14:42:28.799 20889 20889 I recowvery: Run on your PC or device to see prog

ress: adb logcat -s recowvery

11-05 14:42:28.799 20889 20889 I recowvery: Waiting 3 minutes to try again (in c

ase it didn't start or you forgot to dirtycow applypatch first)...

11-05 14:42:28.854 20896 20896 I recowvery: Welcome to recowvery! (applypatch)

11-05 14:42:28.854 20896 20896 I recowvery: ------------

11-05 14:42:28.854 20896 20896 I recowvery: Loading boot image from block device

'/dev/block/bootdevice/by-name/boot'...

11-05 14:42:28.996 20896 20896 I recowvery: Loaded boot image!

11-05 14:42:28.996 20896 20896 I recowvery: ------------

11-05 14:42:28.996 20896 20896 I recowvery: Saving old ramdisk to file

11-05 14:42:29.051 20896 20896 I recowvery: Decompressing ramdisk (gzip -d)

11-05 14:42:29.332 20896 20896 I recowvery: Checking '/cache/ramdisk.cpio' for v

alidity (size >= 4194304 bytes)

11-05 14:42:29.332 20896 20896 I recowvery: '/cache/ramdisk.cpio': 16810752 byte

s

11-05 14:42:29.332 20896 20896 I recowvery: File OK

11-05 14:42:29.332 20896 20896 I recowvery: Decompression of ramdisk successful

11-05 14:42:29.332 20896 20896 I recowvery: Deleting '/cache/ramdisk.gz' (no lon

ger needed)

11-05 14:42:29.337 20896 20896 I recowvery: ------------

11-05 14:42:29.337 20896 20896 I recowvery: Opened cpio archive '/cache/ramdisk.

cpio' (16810752 bytes)

11-05 14:42:29.337 20896 20896 I recowvery: Wrote new file (308 bytes) to cpio a

rchive,

11-05 14:42:29.337 20896 20896 I recowvery: Final size: 16810848 bytes

11-05 14:42:29.337 20896 20896 I recowvery: ------------

11-05 14:42:29.337 20896 20896 I recowvery: Compressing cpio to ramdisk (gzip -9

-c)

11-05 14:42:35.374 20896 20896 I recowvery: Checking '/cache/ramdisk.gz' for val

idity (size >= 2097152 bytes)

11-05 14:42:35.375 20896 20896 I recowvery: '/cache/ramdisk.gz': 6542799 bytes

11-05 14:42:35.375 20896 20896 I recowvery: File OK

11-05 14:42:35.375 20896 20896 I recowvery: Compression of ramdisk successful

11-05 14:42:35.375 20896 20896 I recowvery: Deleting '/cache/ramdisk.cpio' (no l

onger needed)

11-05 14:42:35.393 20896 20896 I recowvery: Loading new ramdisk into boot image

11-05 14:42:35.404 20896 20896 I recowvery: ------------

11-05 14:42:35.404 20896 20896 I recowvery: cmdline: "console=ttyHSL0,115200,n8

androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disab

led=1 cma=32M@0-0xffffffff androidboot.hardware=elsa"

11-05 14:42:35.404 20896 20896 I recowvery: Setting permissive arguments on cmdl

ine

11-05 14:42:35.404 20896 20896 I recowvery: cmdline: "console=ttyHSL0,115200,n8

androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disab

led=1 cma=32M@0-0xffffffff androidboot.hardware=elsa androidboot.selinux=permiss

ive enforcing=0"

11-05 14:42:35.404 20896 20896 I recowvery: ------------

11-05 14:42:35.404 20896 20896 I recowvery: Updating boot image hash

11-05 14:42:35.767 20896 20896 I recowvery: Writing modified boot image to block

device '/dev/block/bootdevice/by-name/recovery'...

11-05 14:42:35.980 20896 20896 I recowvery: Done!

11-05 14:42:35.980 20896 20896 I recowvery: ------------

11-05 14:42:35.980 20896 20896 I recowvery: Permissive boot has been has been fl

ashed to /dev/block/bootdevice/by-name/recovery successfully!

11-05 14:42:35.980 20896 20896 I recowvery: You may use 'reboot recovery' now to

enter a permissive system.

11-05 14:42:35.980 20896 20896 I recowvery: ------------

11-05 14:42:35.980 20896 20896 I recowvery: Warning: If you don't reboot now, th

is will continue to run every 3 minutes!

11-05 14:42:35.980 20896 20896 I recowvery: ************************************

***********

11-05 14:42:35.980 20896 20896 I recowvery: * give jcadduono a hug, will y

a? *

11-05 14:42:35.980 20896 20896 I recowvery: ************************************

***********

However just as [MENTION=2376614]jcase[/MENTION] Has said. dm-verity made it unable to boot. My phone however is not bricked, which means we can experiment in getting DM-Verity disabled through the exploit scripts