yashsingh1/xdaforums huggingface dataset:
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] el-sahef:
Nevermind, it works. The commands for remounting /system as rw seem to be wrong.

I checked it differently now:

C:\adb>adb shell
elsa:/ $ cd /root
/system/bin/sh: cd: /root: Permission denied
2|elsa:/ $ cd /data/local/tmp
elsa:/data/local/tmp $ ./su98
MAIN: detected kernel version 3
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xffffffc0b298dc00
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xffffffc0f23878a0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69688
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: task_struct_ptr = 0xffffffc068454000
CHILD: Finished write to FIFO.
PARENT: leaking successful
MAIN: task_struct_ptr = ffffffc0b298dc00
MAIN: stack = ffffffc068454000
MAIN: Clobbering addr_limit
PARENT: clobbering at 0xffffffc068454008
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69648
PARENT: readv returns 69648, expected 69648
PARENT: clobbering test passed
MAIN: thread_info = 0xffffffc068454000
MAIN: should have stable kernel R/W now
MAIN: searching for cred offset in task_struct
MAIN: search_base = ffffffc000000000
MAIN: searching for selinux_enforcing
MAIN: setting root credentials with cred offset 550
MAIN: UID = 0
MAIN: enabling capabilities
MAIN: SECCOMP status 0
MAIN: disabled selinux enforcing
MAIN: root privileges ready
MAIN: popping out root shell
elsa:/data/local/tmp # cd /root
elsa:/root # ls
elsa:/root # mkdir test
elsa:/root # ls
test
elsa:/root #

Now the question is if (and how) I can use this to get root usage like it is with dirtysanta (Magisk, mount /system rw to debloat, etc.).
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] arpruss:
I added a -n option to rejoin init namespaces (i.e., "./su98 -n"). This might help with some of the mounting issues or not. I haven't tested it.

My own plan is to just use su98 as my su and not install any other su.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Warrentheo:
H910 with 20h (Fresh Wiped)

elsa:/data/local/tmp $ ./su98
MAIN: detected kernel version 3
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xffffffc0f4d0b980
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xffffffc0753f0ea0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69688
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: task_struct_ptr = 0xffffffc036020000
CHILD: Finished write to FIFO.
PARENT: leaking successful
MAIN: task_struct_ptr = ffffffc0f4d0b980
MAIN: stack = ffffffc036020000
MAIN: Clobbering addr_limit
PARENT: clobbering at 0xffffffc036020008
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69648
PARENT: readv returns 69648, expected 69648
PARENT: clobbering test passed
MAIN: thread_info = 0xffffffc036020000
MAIN: should have stable kernel R/W now
MAIN: searching for cred offset in task_struct
MAIN: search_base = ffffffc000000000
MAIN: searching for selinux_enforcing
MAIN: searching for kallsyms format strings
MAIN: patching longer version at ffffffc0014116b0
MAIN: patching shorter version at ffffffc0014116c0
MAIN: **fail** probably you have read-only const storage
found selinux_enforcing in /proc/kallsyms
MAIN: setting root credentials with cred offset 550
MAIN: UID = 0
MAIN: enabling capabilities
MAIN: SECCOMP status 0
MAIN: disabled selinux enforcing
cached ./selinux_enforcing.symbol
MAIN: root privileges ready
MAIN: popping out root shell
elsa:/data/local/tmp #

Still a bit of a noob to some of this, Now just need to know how to do a full device image from this shell, and then how to install Magisk or TWRP from this shell... Anyone point me in the right direction?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] elliwigy:
once u get root shell just copy boot.img to sonewhere the magisk apk can see it..

cp /dev/block/bootdevice/by-name/boot /storage/emulated/0/Download/boot.img

then open magisk manager and select insrall then patch file then navigate to your boot.img.. wait til its done..

then u write it back with root shell..

dd if=/storage/emulated/0/Download/magisk_patched.img of=/dev/block/bootdevice/by-name/boot

then simply reboot..

keep in mind bl should b unlocked when doing this.. ur basically just patching the boot.img with magisk root..
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] elliwigy:
all u gotta do forroot is patch boot.img with magisk then write it back
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Warrentheo:
I thought this would work, and Magisk patched the image with no issue, but, and this is not your fault of course, but this appears to have bricked my device, and I can't get into download mode anymore... Please edit your post...
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] elliwigy:
lol i wont edit my post because u bricked.. im not responsible for u or anyone else who wants to try.. if u dont kno wat ur doing or how to recover fron mishaps then maybe you should avoid these sort of things.

With that being said, i have no idea wat device u have, wat firmware you were on, if u did anything prior, wat magisk u used, wat u had for breakfast or w.e lol.. u took it upon urself to read my post n then try to replicate it with w.e u got goin on which is ur fault. You could have asked some questions first if u were unsure or needed clarification..

to add, i did nothing outside of the normal magisk method of rooting which should b common sense at this point..

sorry for the rant but tellin me i should edit my post because you messed up ur phone was a bit much.. almost makes me wanna run away from lg again and stay in samsung forums..
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Phoenix591:
The problem is most of the V20 variants cant bootloader unlock (only the factory unlocked us996 and h918) . But there is a leaked development bootloader (aboot) that doesn't care, its packaged with the dirtysanta exploits here.

It probably shouldn't be too hard to put together a script with your new exploit to flash the dev bootloader since you're getting a shell already.

That should get all variants working except the LS997, which is incompatible with that bootloader. (and the H918 isn't compatible with it either)

That said, this is a great exploit, and certainly can save a lot of rollback fuss.

---------- Post added at 09:07 PM ---------- Previous post was at 09:03 PM ----------

you weren't bl unlocked like his post was warning you should be (only the H918 and factory unlocked us996 can) . This exploit does have potential to allow it , but it does need to be paired with the leaked bootloader used currently with dirtysanta.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] arpruss:
I've made a very simple installer apk that just uses su98 to provide a temp root, without any external su shell like supersu or magisk. The temp root can be automatically installed on each boot. It's in the releases directory of my su98 github. Note that if you've got root installed with this, SELinux is disabled.

While more sophisticated su versions have a user interface for checking whether you are willing to allow a given app to have a root shell, this version by default allows all apps to call the shell, and doesn't even give a notification about it.

But if you want, there is some rudimentary security. Use adb to create a file called /data/local/tmp/su98-whitelist.txt and list in it all the apps you want to allow access to su. (You will want to set 644 permissions for it so that apps can't modify it.) If the whitelist file exists, su98 will only allow access from apps that are listed in it. Apps that have been denied access will get logged in /data/local/tmp/su98-denied.txt . You can then add them to the whitelist manually. (Or you can add everything to it with sort < su98-denied.txt | uniq >> su98-whitelist.txt)
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TheInfiniteAndroid:
So in theory it would be fully possible to unlock the bootloader on H910 (for example) and acquire root all through this instead of the old method involving downgrading etc.?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Warrentheo:
Lol, you sound like you have been burned for trying to help people far to many times, and if I accidentally pushed some button I was not aware of, I am sorry...(not sarcasm) I am indeed well on the Noob side of the learning curve, but if I cared about the device, I would not have tried it... I tried to head off any issues by specifically saying that I don't blame you, but somehow I failed, and for that I am also sorry... My reason for saying that you may wish to edit your post is because it is now confirmed to corrupt the bootloader, and so I had hoped to head off any issues for someone that did care about their devices... But Thank You, and don't worry about it...

I have an H910 with 20h... I think this is correct, I did turn off the OEM Lock setting in dev options, and the Magisk patch seamed like it had no issues patching the boot.img dump (I use this option on my ZenFone 6 for OTA updates, looked the same), but the bootloader now shows a heavily corrupted version of a red exclamation triangle with a failed attempt at words all smeared across the screen, and just boot loops... I think Dirty Santa style alternate bootloader is the appropriate way to go here...

Anyone want a bootloader bricked H910 with freshly wiped 20h installed?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] elliwigy:
i just feel ur device messin up literally has nothing to do with me or wat i posted lol.. it def sounds like ur bl is locked which is the reason ur gettin the red warning.. it means u patched ur boot.img with magisk and now trimg to boot it in a locked state which is not allowed.

if u had the oem toggle on as in unlocked u could prolly run fastboot oem unlock then maybe a wipe to try n boot..

I am very familiar with DS.. I kno the deva and I was literally the first VZW V20 owner to unlock/test
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Warrentheo:
The H910 version has always been the odd one out... For some reason AT&T doesn't let it have KDZ files, and no manual firmware downloads or way to recover from bad flash, it was why I hadn't really rooted it before... Apparently the F800 Korean version is the only one that is going to get Pie, so I figured it was ripe to try and free up the lock down on this one to make it useful again... Oh well...
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Phoenix591:
Only the H918 (plain fastboot oem unlock, but fastboot is neutered to prevent actually flashing anything) and factory unlocked us996 (can unlock bootloader by flashing file generated through LG's website) can actually unlock the bootloader in fastboot.

That's why your this exploit plus the bootloader used with dirty Santa would be great combo.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] elliwigy:
hey, im not taking someone elses credit lol i didnt write the exploit or the poc lol just saying
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Phoenix591:
Sorry, lost track when skimming these new threads.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] lfos51:
Hi! I have an H910 with the F800S rom (F800S20K_00_0315.kdz), but the mobile network is not working and I need some help with the commands to unlock the bootloader and install TWRP to reinstall modemst 1 and 2 and fix the problem. Could you help me by making a tutorial to install TWRP (the commands beyond what you passed ...) please?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Phoenix591:
Aboot is absolutely necessary, without it the protection kicks in and bricks. (the *bak partition's are not, however, they arn't actually used for anything), but if aboot gets screwed up you don't have download mode either.

As for writing to /system, I'd see if Magisk doesn't just take care of it once you have the dirtysanta bootloader in place. (modified boot and maybe /system (can't remember for sure for system) without unlocked/dev bootloader = device is corrupt and will not boot)

One is fine, and its what the dirtysanta guide does already (exploit, replace bootloader, boot to fastboot to flash twrp).

Two is also fine, I've dd'ed twrp directly to recovery as well. (the extra space is just ignored)

Why not use the recent TWRP I just put out?

you can use the easier to type /dev/block/bootdevice/by-name listings rather than looking up the partition name and number.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] arpruss:
I can't write to /system either, but I don't really care very much for my purposes. :)
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] arpruss:
I'm terminating my public development of this exploit due to legal worries related to: https://www.eff.org/deeplinks/2018/...s-whittle-our-own-personal-jailbreaking-tools

I hereby release all the code I wrote for this into the public domain, but I've deleted the github repo. Sorry.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] hahmad78:
2nd sim issue on h990n is after 20d, even on h990ds, 20b kdz present same second sim issue with dairty santa and mk kernal.

i ave checked by flasdhing different things, and which i concluded is that LG changed something in kernal which make 2nd sim issue on h990n above 20d, and h990ds 20b.

A easy way to solve 2nd sim issue is to flash efs and firmware backup from 20d on h990N , or 20a on H990ds, it will resolve 2nd sim issue.

first take backup in twrp of 20d h990n, or 20a h990ds and tan restore it in 20h h990n or 20b h990ds
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] el-sahef:
Thank you for your advice.

But either I am doing something wrong or it does not work for me. This is what I did:

1) Flashed the complete H990N20d_00_OPEN_HK_DS_OP_0920.kdz on my H990N (Hongkong version) via "upgrade" with LGUP, restored to factory-settings in the system. Both SIMs are working in this state.

2) Rebooted phone, uploaded su98 to the phone, got root shell and overwrote aboot and abootbak with the engineering aboot.img from dirty santa, recovery and recoverybak with twrp-3.0.2-1-h990.img.

3) Powered off phone, switched on phone with button combination to get into twrp, wiped data, dalvik and cache, installed kernel H990DS_v2.2-mk2000.zip from Aug 03, 2019 | 09:54AM and Magisk-v20.0.zip

4) Booted phone, did the android initial setup, entered both SIM PINs (both were accepted) but only the first SIM can connect to the network. For the second SIM card, the two circling arrows are displayed like it would search for the network but it never connects.

With this I should have efs and firmware from 20d (which should not have been altered by the rooting procedure) but it still does not work. When I reflash H990N20d_00_OPEN_HK_DS_OP_0920.kdz or any other kdz for my phone with LGUP the second SIM works again.

With dirty santa I also had this problem with the non-working second SIM card on the three rootable kdzs for my phone (H990N10b_00_OPEN_HK_DS_OP_1017.kdz, H990N10d_00_OPEN_HK_DS_OP_1117.kdz and H990N10e_00_OPEN_HK_DS_OP_1208.kdz).

Can you please give me a more detailed description of what you did, especially the exact versions of kdz / rom zip / kernel / magisk if you still know them?

Maybe it has something to do with the kernel versions I used.

Edit:

Would it be safe / possible to flash H990ds kdz on my H990N with patched LGUP via "Partition DL" and select everything except aboot, abootbak, recovery and recoverybak? That is the method I used to upgraded from nougat to latest oreo on my AME H990ds which I also have and works with root, H990ds20a_00_OPEN_AME_DS_OP_1121.kdz and second SIM card.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] hahmad78:
I have h990ds ame variant, and i have flashed h990n all kdzs from nougat to oreo on it with both options of root and non rooted with lg up. If rooted than lg up partition dl option for volte experiments.

2nd sim issue occured for me whenever i upgraded to 20f and 20h of h990n, or 20b of h990ds keeping root by lg up partition dl option flashing. Currently i am running 20b non rooted on it, both sims working fine. Did you restored firmware and efs both from 20d working sims ?

I did like atleast 20 times, whenever 2nd sim issue, restored backup of working oreo kdz,

I have flashed 10b,d,0 and last nougat h990n roms on my h990ds with nougat both kernels, neocore and lexican dots kernel 1.5, but never faced the issue of 2nd sim, i did not use su98 exploit, but used typical dirtysanta procedure for root.

20d of h990n rom also work for me fine, no 2nd sim issue, only 20f,h and 20b created issue for me.

And it looks to me after my messes and experiments that lg changed something in kernal maybe

You should go thru proper procedure, nougat rom 10b, dirty santa for root and than make backup, and than uograde to oreo with partition dl, than make its backup too, and than later 20f or h and than restore backup
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Daved+:
Awesome work
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] el-sahef:
Someone has made a backup here:

https://xdaforums.com/showpost.php?p=80702567&postcount=167
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TheInfiniteAndroid:
Is it possible at all to bundle in the engineered bootloader so that someone with a locked bootloader can unlock the bootloader & flash magisk all in one go?

This'll eliminate the need to rollback & follow the dirtysanta root procedure, thanks in advance!
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] ozkaya:
OK, it works for a V20 and I can get a root shell. Is it possible to mount /system rw? I tried some terminal commands but it fails, most probably because dm-verity is still active. The interesting thing is Adaway app can write to /system/etc/hosts file and it stays until a reboot then reverts to stock hosts. Any thoughts?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] elliwigy:
if ur bl is locked ull need to install root in daemon mode somehow when device starts.. probably via using a init scrit somewhere that doesnt reset when device reboots
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] wassname:
Worked for me on a LG G6, log and version details here https://xdaforums.com/showpost.php?p=80908533&postcount=204
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Anwiday:
Newbie here. What is a root shell and does it mean anything for rooting the ls997 in the future?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] elliwigy:
u shouldnt even bother unless u dont care if u brick ur phone.. if u dont know what a root shell is then thats my suggestion
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Phoenix591:
There is still no way to unlock the ls997 bootloader (the dirty santa bootloader doesn't work with ARB 1) which means no way to install permanent root, twrp, debloat or do very much at all without tripping the locked bootloader into bricking you.

You can get a temporary root shell with this and if not super careful brick yourself with it like someone did earlier in one of the threads about this.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Ronald93:
As I get su98 if it's not on your page????

Quiero el su98 por favor I want the su98 repository for someone to give it to me???
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] arpruss:
Doesn't patching boot.img run afoul of dm-verity?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] rcky844:
Doesn't work, tested using LG G6 just to see if v30a works
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] elliwigy:
I'm late I know but typically yes if bl is locked. This is typically why older devices with locked bl still use supersu for root aka system root bcuz they cannot modify the boot.img
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysticblaze347:
Cant get this to install. Su98.apk is installed, just app wont install bin. On ls99720a, july 1 2018, kernel 3.18.71. Is oreo
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysticblaze347:
I got it
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] lui112:
I have the same problem, can you guys help?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysticblaze347:
Try running the adb method in op then rerun on booted phone
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] lui112:
After using adb installing the SU98, I still can't install after opening SU98 app. What's wrong with me? Did I make the wrong steps?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysticblaze347:
Might take a few attempts to install to bin via app. If not then idk.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TarAntonio:
Is it possibile a guide for noob? I successfully unlock many devices but i would a root also my h990ds with oreo. Dirty santa seems complicate
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] starlyn1232:
su98 deleted

thanks
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TarAntonio:
Thread died
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysteriouslog6:
I have the file downloaded
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TarAntonio:
Hi could you please upload? And if is possible also a guide if you can and would? Many thanks
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] willy_itc:
Please NEED this file ./su98

Please NEED this file ./su98
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysteriouslog6:
guys i have the file but i cant post the url as i am only a junior member sorry
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] aCIDsLAM:
File

Thanks for the file, mayukhbejoy23. He shared me the link.

https://drive.google.com/file/d/1yWxC9cH5n-m0xmP9Rm7zE6vRP-OqvSE8/view?usp=sharing
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysteriouslog6:
Thanks for sharing the link for me
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TarAntonio:
Su98.c downloaded but the first adb command not found the file to push. What I'm doing wrong?
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysticblaze347:
Push from PC, make sure u are reading from right directory in adb shell.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TarAntonio:
I create a new ordner where I put a text with prompt commands in this thread, su98. c and window for launch prompt commands through adb.

Many thanks for answers and helps
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TarAntonio:
hi

this is the log

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten.

C:\Users\User>adb devices

List of devices attached

LGH990c8d23f54 device

C:\Users\User>adb push su98 /data/local/tmp

adb: error: cannot stat 'su98': No such file or directory

C:\Users\User>adb push su98.c /data/local/tmp

adb: error: cannot stat 'su98.c': No such file or directory

C:\Users\User>adb push "C:\Users\User\Desktop\Neuer Ordner\su98.c"

adb: usage: push requires an argument
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysticblaze347:
Place su98 file in the same area (folder) that you launch adb from and then push after adb read phone. Make sure you are launching command window with alt+shift - right click or ctrl+ shift - right click (one if them) from adb folder also. A menu will pop up and then select command window option if done right. Enter needed commands from there.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TarAntonio:
HI Many thanks but nothing succeded
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Mysticblaze347:
Try to add file type in command line after su98 (Ex: su98.txt) then try pushing

Edit: don't do that. Just copy whole text from text box in first page in op and paste that in command window and hit enter.
[LG V20 ROMs, Kernels, Recoveries, & Other Developm] TarAntonio:
Thanks

You mean the prompt command? Or all the text file in su98.c?