[T-Mobile LG G6 Guides, News, & Discussion] barcodelinux:
Just got one from the BOGO TMO offer! Now let's root it.....wait, what??

So I got in on the BOGO TMO offer yesterday. OTA'd up to H87210q. I have use LG devices before (D415 && H815/H811).

I have a little time on my hands with the holidays coming up and thought I could help out. Here's an adb shell dump of the partitions. It looks like the recovery partition is /dev/block/sde2 with a backup on sde3. aboot is on sde6

lucye:/ $ ls -l /dev/block/platform/soc/624000.ufshc/by-name/
total 0
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 aboot -> /dev/block/sde6
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 abootbak -> /dev/block/sde7
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 apdp -> /dev/block/sde26
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 boot -> /dev/block/sde1
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 cache -> /dev/block/sda17
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 cdt -> /dev/block/sdd3
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 cmnlib -> /dev/block/sde22
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 cmnlib64 -> /dev/block/sde24
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 cmnlib64bak -> /dev/block/sde25
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 cmnlibbak -> /dev/block/sde23
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 ddr -> /dev/block/sdd1
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 devcfg -> /dev/block/sde16
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 devcfgbak -> /dev/block/sde17
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 devinfo -> /dev/block/sdb6
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 dip -> /dev/block/sdb5
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 dpo -> /dev/block/sde28
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 drm -> /dev/block/sda4
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 eksst -> /dev/block/sda11
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 encrypt -> /dev/block/sda10
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 eri -> /dev/block/sda7
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 factory -> /dev/block/sda9
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 fota -> /dev/block/sdb3
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 fsc -> /dev/block/sdf3
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 fsg -> /dev/block/sdb4
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 grow -> /dev/block/sda19
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 grow2 -> /dev/block/sdb7
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 grow3 -> /dev/block/sdc3
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 grow4 -> /dev/block/sdd4
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 grow5 -> /dev/block/sde29
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 grow6 -> /dev/block/sdf4
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 grow7 -> /dev/block/sdg2
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 hyp -> /dev/block/sde12
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 hypbak -> /dev/block/sde13
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 keymaster -> /dev/block/sde20
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 keymasterbak -> /dev/block/sde21
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 keystore -> /dev/block/sda14
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 laf -> /dev/block/sda1
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 lafbak -> /dev/block/sda2
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 misc -> /dev/block/sda8
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 modem -> /dev/block/sde18
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 modemst1 -> /dev/block/sdf1
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 modemst2 -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 mpt -> /dev/block/sda3
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 msadp -> /dev/block/sde27
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 operatorlogging -> /dev/block/sda6
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 persist -> /dev/block/sda15
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 persistent -> /dev/block/sdg1
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 pmic -> /dev/block/sde14
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 pmicbak -> /dev/block/sde15
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 raw_resources -> /dev/block/sde8
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 raw_resourcesbak -> /dev/block/sde9
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 rct -> /dev/block/sda12
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 recovery -> /dev/block/sde2
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 recoverybak -> /dev/block/sde3
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 reserve -> /dev/block/sdd2
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 rpm -> /dev/block/sde10
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 rpmbak -> /dev/block/sde11
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 sec -> /dev/block/sde19
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 sns -> /dev/block/sda5
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 ssd -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 system -> /dev/block/sda16
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 tz -> /dev/block/sde4
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 tzbak -> /dev/block/sde5
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 userdata -> /dev/block/sda18
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 xbl -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 xbl2 -> /dev/block/sdc1
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 xbl2bak -> /dev/block/sdc2
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 xblbak -> /dev/block/sdb2
lucye:/ $

lucye:/ $ ls -l /dev/block/platform/soc/624000.ufshc/by-num/
total 0
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p1 -> /dev/block/sda1
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p10 -> /dev/block/sda10
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p11 -> /dev/block/sda11
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p12 -> /dev/block/sda12
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p13 -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p14 -> /dev/block/sda14
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p15 -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p16 -> /dev/block/sda16
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p17 -> /dev/block/sda17
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p18 -> /dev/block/sda18
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p19 -> /dev/block/sda19
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p2 -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p20 -> /dev/block/sde20
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p21 -> /dev/block/sde21
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p22 -> /dev/block/sde22
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p23 -> /dev/block/sde23
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p24 -> /dev/block/sde24
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p25 -> /dev/block/sde25
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p26 -> /dev/block/sde26
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p27 -> /dev/block/sde27
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p28 -> /dev/block/sde28
lrwxrwxrwx 1 root root 16 2017-03-21 22:22 p29 -> /dev/block/sde29
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p3 -> /dev/block/sda3
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p4 -> /dev/block/sda4
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p5 -> /dev/block/sda5
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p6 -> /dev/block/sda6
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p7 -> /dev/block/sda7
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p8 -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 2017-03-21 22:22 p9 -> /dev/block/sda9
lucye:/ $

Ok, so now we now where it (TWRP) goes. Now we need to figure out how to:

1) Root it from the OS level, backup recovery && dd the recovery.img

or

2) Unlock the bootloader (willing to do) and figure out a way to write the recovery.img

From what I've read, the latter seems to be where we are now. Does anyone know the status of the rooting effort? I've read some places that KingRoot might work. Anyone tried? I've always been leery of pre-packaged rootkits.