[LG V20 Guides, News, & Discussion] emdroidle:
This posting is nominally retired. Please go to the "official" thread here for potentially updated instructions and more kernel builds.

Beware! This is currently at beta status and only a few people have successfully tried this so far.

While I have tried to ensure this works for anyone, this may fail. The result of a failure could include voiding of warranty and hardware damage. This is also one of the most complicated rooting procedures due to SE Linux, sorry about this, but we've been unable to simplify things.

As preparation, I would like folks to be familiar with LGUP/LGBridge and how to use them. Using LGUP is also how to get back to stock. On the H990DS Bluetooth is implemented via kernel module and the kernel module has to be loaded off /system, therefore there is no choice but to write to /system.

Step 2 of DirtySanta retrieves the files "abootbackup.img", "bootbackup.img" and "recoverybackup.img". Save these files! I'm not 100% certain, but I suspect "abootbackup.img" may need to be restored before doing full LGUP.

For the most part the steps are identical to the classic DirtySanta, but a few of the files are different.

Once you get to step 3, the procedure is different.

First, the TWRP image is different, use this one instead, which targets the H990. Instead of running step3.sh/step3.bat; instead run the command `fastboot flash recovery twrp-3.0.2-1-h990.img`,

then repeat this command (apparently the debug bootloader is unreliable with this command). After this run the command `fastboot reboot`, then follow the directions for getting into TWRP. Instead of running step3.sh/step3.bat, unpack the attached step3_h990.zip and run step3_h900.sh if on OSX/Linux/FreeBSD/Unix or click on step3_h990.bat if on Windows.

After step 3, do not do the `fastboot flash boot bootbackup.img` step. Instead flash the attached zip (a specially modified kernel targeting the H990DS) during the same step as flashing SuperSU.

Likewise "boot1.img" and "boot2.img" should also be ignored. Those are for DirtySanta with the US V20 models, and not the H990DS.

After step 3, boot in to TWRP. Press and hold volume DOWN; press and hold power until the LG logo comes up, then briefly release power (0.5-1.0sec) and then hold power again. You will then be prompted "Delete all user data (including LG and carrier apps) and reset all settings?", select "Yes" twice and as long as TWRP installation was successful you'll get into TWRP and no reset will be done.

Inside TWRP flash the attached h990ds-kernel.zip and then flash SuperSU.zip. At this point the process should be complete. There won't be static on boot, you'll have root and nothing else should have changed.

Ensure you have a backup plan: https://xdaforums.com/v20/how-to/restore-v20-to-100-stock-bricked-devices-t3524903

Backup your phone data. LG Bridge/LG Backup is pretty reliable, but I strongly advise backing up everything onto a desktop/laptop computer. If you backup to SD card, the SD card must not be encrypted! (failures will destroy the key and the data)

Go to Settings -> General -> About phone -> Software info -> Android security patch level; if your phone is on an update after December 31, use LGUP to "refurbish" to an earlier firmware release (this will do a factory reset).

Ensure you have ADB/Fastboot files installed and working: https://xdaforums.com/showthread.php?t=2588979

Ensure you have all relevant files prepared:

Installed backup plan.

Installed Terminal Emulator on device.

Downloaded dirtysanta's files and copied them to ADB directory.

Downloaded files, Put kernel and SuperSU zip into SD card; and TWRP into ADB directory.

Note: It may be necessary to download anti-virus/anti-malware programs when unpacking the original DirtySanta. At least one has detected `dirtycow`/CVE-2016-5195 as malware (it can in fact act in that role).

[*]Using dirtysanta's steps: Run "RUNMEFIRST.bat" <-- Do not close.

[*]Run "step1.bat" <-- Wait until you can type something again.

[*]Type "run-as con" <-- If you get unknown package error, means your latest security patch patched it out; go back to step 3. LGUP should be able to downgrade you to an earlier firmware update.

[*]Type "chmod 0777 /storage/emulated/0/*"

[*]Open Terminal Emulator, Type "id"

[*]Look for something containing "untrusted_app". If not found, Start all over again. If found, continue.

[*]Type "applypatch /system/bin/atd /storage/emulated/0/dirtysanta" into Terminal Emulator

[*]Wait for RUNMEFIRST.bat console to prompt you to run step2.bat.

[*]Run "step2.bat"

[*]Save copies of the files "abootbackup.img" and "bootbackup.img" produced in the previous step (will be in the same directory as "step2.bat"), the latter is crucial in returning to stock.

[*]At a command prompt run the following commands, but make sure to wait at least 30 seconds between each. Do not skimp on that delay as otherwise the likelihood is this will fail (this is the most unreliable step in this process); waiting longer than 30 seconds is fine.

fastboot flash recovery twrp-3.0.2-1-h990.img

fastboot flash recovery twrp-3.0.2-1-h990.img

fastboot reboot

[*]Step 17: Boot in to TWRP.

Press and hold volume DOWN; press and hold power until the LG logo comes up, then briefly release power (0.5-1.0sec) and then hold power again.

You will then be prompted "Delete all user data (including LG and carrier apps) and reset all settings?"

Select "Yes" twice, and as long as TWRP installation was successful you'll get into TWRP and NO RESET will be done.

Inside TWRP flash "h990ds-kernel.zip" and then flash SuperSU.zip. At this point the process should be complete. There won't be static on boot, you'll have root and nothing else should have changed.

Going back to stock:

As with those whole rooting procedure, this is hazardous. Be careful, go slow and don't rush things.

Method 1: (TWRP, strongly preferred!)

Boot into TWRP (DOWN + Power with a brief release during LG logo).

Copy the file "abootbackup.img" from your archive to your phone (adb push abootbackup.img /).

Run `adb shell` and type (or copy&paste) the following commands:

dd if=abootbackup.img of=/dev/block/bootdevice/by-name/aboot
sync
sleep 30
sync

Get into Download mode. Power off phone from TWRP. Press and hold UP, then power phone on (no need to hold power).

Load the appropriate KDZ file onto your phone via LGUP.

Method 2: (fastboot)

Boot into fastboot mode. Any of these methods should work:

(if Android running normally) Run `adb reboot bootloader`

(from a powered down state) Press and hold DOWN, then plug in USB cable.

(powered down, USB plugged in) Press and hold DOWN, then power on.

With "abootbackup.img" in the current directory run the following commands, while waiting at least 30 seconds between them:

fastboot flash aboot abootbackup.img
(wait >30s)
fastboot flash aboot abootbackup.img
(wait >30s)
fastboot reboot

Get into Download mode. Press and hold UP. If the phone has already started to load Android, pull the battery, reinstall battery; then press and hold UP and power on.

Load the appropriate KDZ file onto your phone via LGUP.

Warning: This is at beta testing state and could well brick your device. No warranty is provided, use at your own risk (though I certainly hope nothing will go wrong).

These directions are likely very poor quality, if you're not well experienced with shell prompts and all the tricks that can be done, please wait. This kernel is also exclusively for the H990DS, if you've got any other model, stay away. The H990 (single-SIM) will not work, though you could have an interesting experiment.

Folks who haven't done a lot of experimentation, please hold off until experienced people have confirmed this works. There is a lot that could go wrong.

I believe I have fulfilled the condition for the bounty.

Thanks to:

[MENTION=4591212]me2151[/MENTION] the original DirtySanta bootloader, crucial for this to work

[MENTION=3061906]thubble[/MENTION] for figuring out the last bit of the modem and (successful) guinea pig #2

[MENTION=5184450]USA-RedDragon[/MENTION] for making everyone aware of LineageOS's source tree

[MENTION=2764901]exadeci[/MENTION] (successful) guinea pig #1

[MENTION=4741759]Xenogenics[/MENTION] helping others, posting some reasonable instructions

MD5: 5182bc528db03c2848c591f809a65564

SHA160: 14bd8f2714fd652b259b6a60407d071dbf672809

SHA512: dc049ab1e83a51a40e59d7871e1b122559836c1df13b2f7104f13d2cf82d3eb7ca767def108d267d56ae90e7ee58c5f3fc95d60af638a492cb113a982bf64315