[LG V20 Guides, News, & Discussion] Gunwolf:
I apologize if this is in the wrong place as this is my first thread, but I wanted to show people that OneClickRoot does work for T-Mo. They are legitimate. It cost me $35 and I chose to pay another $20 for a full phone replacement and guarantee if anything goes wrong they fix it. I had an H91810J Version with a newer security patch.

I am pasting the code they used through the command prompt, at least what I could from my buffer. I also missed part of the commands as I had the buffer size in my command prompt set too low so I missed some of the commands. I know more went on behind the scenes as I did the exact same thing numerous times and it NEVER flashed twrp. I have all the programs they used as well if they should be posted? Hopefully I am not violating any policies here as I am new to XDA so if I am please let me know.

A few of these steps were missing in the dirty cow exploit when I tried it or as I stated I missed some of it in the command prompt and more was going on through their program I didn't see. I have also rooted or I should say followed other people methods to root a phone several times (and understood the exploit) but I couldn't get twrp flashed on this. You can read my followup posts.

C:\Users\XXXXXXFAMILY>cd "C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo"

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb devices

List of devices attached

LGH918XXXXXXXX device

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb shell

elsa:/ $ cd system/xbin

cd system/xbin

elsa:/system/xbin $ ls

ls

dexlist tcd

elsa:/system/xbin $ exit

exit

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb reboot bootloader

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>fastboot devices

LGH918XXXXXXXX fastboot

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>fastboot oem unlock

...

(bootloader) Device already : unlocked!

OKAY [ 0.016s]

finished. total time: 0.016s

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>fastboot reboot

rebooting...

finished. total time: 0.000s

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push twrp.img /storage/emulated/0/Download

adb server is out of date. killing...

* daemon started successfully *

2361 KB/s (25759744 bytes in 10.654s)

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push dirtycow /data/local/tmp

9 KB/s (9984 bytes in 1.000s)

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push recowvery-applypatch /data/local/tmp

1153 KB/s (18472 bytes in 0.015s)

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push recowvery-app_process64 /data/local/tmp

637 KB/s (10200 bytes in 0.015s)

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push recowvery-run-as /data/local/tmp

9 KB/s (10192 bytes in 1.000s)

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb shell

elsa:/ $ cd /data/local/tmp

cd /data/local/tmp

elsa:/data/local/tmp $ chmod 0777 *

chmod 0777 *

elsa:/data/local/tmp $ ./dirtycow /system/bin/applypatch recowvery-applypatch

./dirtycow /system/bin/applypatch recowvery-applypatch

warning: new file size (18472) and file old size (165144) differ

size 165144

[*] mmap 0x7554457000

[*] exploit (patch)

[*] currently 0x7554457000=10102464c457f

[*] madvise = 0x7554457000 165144

[*] madvise = 0 1048576

[*] /proc/self/mem 1367343104 1048576

[*] exploited 0x7554457000=10102464c457f

elsa:/data/local/tmp $ ./dirtycow /system/bin/app_process64 recowvery-app_process64

dirtycow /system/bin/app_process64 recowvery-app_process64 <

warning: new file size (10200) and file old size (18600) differ

size 18600

[*] mmap 0x7288fd4000

[*] exploit (patch)

[*] currently 0x7288fd4000=10102464c457f

[*] madvise = 0x7288fd4000 18600

[*] madvise = 0 1048576

[*] /proc/self/mem -1971322880 1048576

[*] exploited 0x7288fd4000=10102464c457f

elsa:/data/local/tmp $ exit

exit

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb logcat -s recowvery

--------- beginning of system

--------- beginning of main

--------- beginning of crash

04-23 00:35:53.713 8495 8495 I recowvery: Welcome to recowvery! (app_process64)

04-23 00:35:53.713 8495 8495 I recowvery: ------------

04-23 00:35:53.713 8495 8495 I recowvery: Current selinux context: u:r:zygote:s0

04-23 00:35:53.713 8495 8495 I recowvery: Set context to 'u:r:system_server:s0'

04-23 00:35:53.714 8495 8495 I recowvery: Current security context: u:r:system_server:s0

04-23 00:35:53.714 8495 8495 I recowvery: Setting property 'ctl.start' to 'flash_recovery'

04-23 00:35:53.716 8495 8495 I recowvery: ------------

04-23 00:35:53.716 8495 8495 I recowvery: Recovery flash script should have started!

04-23 00:35:53.716 8495 8495 I recowvery: Run on your PC or device to see progress: adb logcat -s recowvery

04-23 00:35:53.716 8495 8495 I recowvery: Waiting 120 seconds...

04-23 00:35:53.751 8499 8499 I recowvery: Welcome to recowvery! (applypatch)

04-23 00:35:53.751 8499 8499 I recowvery: ------------

04-23 00:35:53.751 8499 8499 I recowvery: Loading boot image from block device '/dev/block/bootdevice/by-name/boot'...

04-23 00:35:53.931 8499 8499 I recowvery: Loaded boot image!

04-23 00:35:53.931 8499 8499 I recowvery: ------------

04-23 00:35:53.931 8499 8499 I recowvery: Saving old ramdisk to file

04-23 00:35:53.932 8499 8499 I recowvery: Writing to file '/cache/ramdisk.gz'...

04-23 00:35:53.962 8499 8499 I recowvery: Wrote OK: 6558126 bytes

04-23 00:35:53.962 8499 8499 I recowvery: Decompressing ramdisk (gzip -d)

04-23 00:35:54.411 8499 8499 I recowvery: Checking '/cache/ramdisk.cpio' for validity (size >= 4194304 bytes)

04-23 00:35:54.411 8499 8499 I recowvery: '/cache/ramdisk.cpio': 16792832 bytes

04-23 00:35:54.411 8499 8499 I recowvery: File OK

04-23 00:35:54.411 8499 8499 I recowvery: Decompression of ramdisk successful

04-23 00:35:54.411 8499 8499 I recowvery: Deleting '/cache/ramdisk.gz' (no longer needed)

04-23 00:35:54.415 8499 8499 I recowvery: ------------

04-23 00:35:54.415 8499 8499 I recowvery: Opened cpio archive '/cache/ramdisk.cpio' (16792832 bytes)

04-23 00:35:54.416 8499 8499 I recowvery: Wrote new file (308 bytes) to cpio archive,

04-23 00:35:54.416 8499 8499 I recowvery: Final size: 16793036 bytes

04-23 00:35:54.416 8499 8499 I recowvery: ------------

04-23 00:35:54.416 8499 8499 I recowvery: Compressing cpio to ramdisk (gzip -9 -c)

04-23 00:36:00.080 8499 8499 I recowvery: Checking '/cache/ramdisk.gz' for validity (size >= 2097152 bytes)

04-23 00:36:00.081 8499 8499 I recowvery: '/cache/ramdisk.gz': 6539881 bytes

04-23 00:36:00.081 8499 8499 I recowvery: File OK

04-23 00:36:00.081 8499 8499 I recowvery: Compression of ramdisk successful

04-23 00:36:00.081 8499 8499 I recowvery: Deleting '/cache/ramdisk.cpio' (no longer needed)

04-23 00:36:00.095 8499 8499 I recowvery: Loading new ramdisk into boot image

04-23 00:36:00.105 8499 8499 I recowvery: ------------

04-23 00:36:00.105 8499 8499 I recowvery: cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa"

04-23 00:36:00.105 8499 8499 I recowvery: Setting permissive arguments on cmdline

04-23 00:36:00.105 8499 8499 I recowvery: cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa androidboot.selinux=permissive enforcing=0"

04-23 00:36:00.105 8499 8499 I recowvery: ------------

04-23 00:36:00.105 8499 8499 I recowvery: Updating boot image hash

04-23 00:36:00.444 8499 8499 I recowvery: Writing modified boot image to block device '/dev/block/bootdevice/by-name/recovery'...

04-23 00:36:00.614 8499 8499 I recowvery: Done!

04-23 00:36:00.614 8499 8499 I recowvery: ------------

04-23 00:36:00.614 8499 8499 I recowvery: Permissive boot has been has been flashed to /dev/block/bootdevice/by-name/recovery successfully!

04-23 00:36:00.614 8499 8499 I recowvery: You may use 'reboot recovery' now to enter a permissive system.

04-23 00:36:00.614 8499 8499 I recowvery: ***********************************************

04-23 00:36:00.614 8499 8499 I recowvery: * give jcadduono a hug, will ya? *

04-23 00:36:00.614 8499 8499 I recowvery: ***********************************************

^C

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb shell reboot recovery

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb shell

elsa:/ $ getenforce

getenforce

Permissive

elsa:/ $ cd /data/local/tmp

cd /data/local/tmp

elsa:/data/local/tmp $ ./dirtycow /system/bin/run-as recowvery-run-as

./dirtycow /system/bin/run-as recowvery-run-as

warning: new file size (10192) and file old size (14360) differ

size 14360

[*] mmap 0x7f643b9000

[*] exploit (patch)

[*] currently 0x7f643b9000=10102464c457f

[*] madvise = 0x7f643b9000 14360

[*] madvise = 0 1048576

[*] /proc/self/mem -2122317824 1048576

[*] exploited 0x7f643b9000=10102464c457f

elsa:/data/local/tmp $ run-as exec ./recowvery-applypatch boot

run-as exec ./recowvery-applypatch boot

Welcome to recowvery! (run-as)

------------

Current uid: 2000

Setting capabilities

Attempting to escalate to root

Current uid: 0

We have root access!

------------

Executing: './recowvery-applypatch' with 1 arguments

Welcome to recowvery! (applypatch)

------------

Loading boot image from block device '/dev/block/bootdevice/by-name/boot'...

Loaded boot image!

------------

Saving old ramdisk to file

Writing to file '/data/local/ramdisk.gz'...

Wrote OK: 6558126 bytes

Decompressing ramdisk (gzip -d)

Checking '/data/local/ramdisk.cpio' for validity (size >= 4194304 bytes)

'/data/local/ramdisk.cpio': 16792832 bytes

File OK

Decompression of ramdisk successful

Deleting '/data/local/ramdisk.gz' (no longer needed)

------------

Opened cpio archive '/data/local/ramdisk.cpio' (16792832 bytes)

Wrote new file (308 bytes) to cpio archive,

Final size: 16793036 bytes

------------

Compressing cpio to ramdisk (gzip -9 -c)

Checking '/data/local/ramdisk.gz' for validity (size >= 2097152 bytes)

'/data/local/ramdisk.gz': 6539881 bytes

File OK

Compression of ramdisk successful

Deleting '/data/local/ramdisk.cpio' (no longer needed)

Loading new ramdisk into boot image

------------

cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa"

Setting permissive arguments on cmdline

cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa androidboot.selinux=permissive enforcing=0"

------------

Updating boot image hash

Writing modified boot image to block device '/dev/block/bootdevice/by-name/boot'...

Done!

------------

Permissive boot has been has been flashed to /dev/block/bootdevice/by-name/boot successfully!

You may use 'reboot' now to enter a permissive system.

***********************************************

* give jcadduono a hug, will ya? *

***********************************************

elsa:/data/local/tmp $ run-as su

run-as su

Welcome to recowvery! (run-as)

------------

Current uid: 2000

Setting capabilities

Attempting to escalate to root

Current uid: 0

We have root access!

------------

Starting root shell

elsa:/data/local/tmp # dd if=/storage/emulated/0/Download/twrp.img of=/dev/block/bootdevice/by-name/recovery

ownload/twrp.img of=/dev/block/bootdevice/by-name/recovery <

50312+0 records in

50312+0 records out

25759744 bytes transferred in 2.940 secs (8761817 bytes/sec)

elsa:/data/local/tmp # reboot recovery

reboot recovery

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb devices

List of devices attached

LGH918XXXXXXXX recovery

C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb sideload su.zip

Total xfer: 1.48x

C:\XXXXXXFAMILY\Desktop\LG V20 TMo>

Last of what my CMD buffer held. My Bad. I know better. Please Read followups Their is a point to this.