[LG V20 ROMs, Kernels, Recoveries, & Other Developm] el-sahef:
I did some further testing on my H990N.

The su98 app works fine (firmware H990N20d_00_OPEN_HK_DS_OP_0920.kdz) but it is still not possible to write to /system. I get the the error "/dev/block/dm-0 is read-only". According to this I have to use a different kernel.

To install a different kernel I would have to use the unlocked engineering bootloader bundled with dirty-santa and twrp, correct? I would like be able to use twrp and magisk anyway.

The reason I am so eager to try this new rooting method is that the second SIM card does not work anymore on my H990N after the dirty-santa rooting process. The phone asks for the pin of the card, unlocks it but then never registers to network. Flashing cust and modem partitions with LGUP after rooting does not fix the problem. Only when reverting to full stock by flashing a kdz with LGUP via "upgrade" the functinality is restored. This problem does not occur on a H990DS which I also have.

I fetched the original aboot, abootbak, recovery and recoverybak with dd and the file sizes of aboot and abootbak match exactly with the size of aboot.img from dirty-santa (2.097.152 Bytes).

But the size of recovery and recoverybak is bigger than twrp-3.0.2-1-h990.img (42.467.328 Bytes vs 27.049.984 Bytes).

These are the partitions on my device:

H990N Oreo 20d

## sda ##
/dev/block/platform/soc/624000.ufshc/by-name/laf /dev/block/sda1
/dev/block/platform/soc/624000.ufshc/by-name/mpt /dev/block/sda2
/dev/block/platform/soc/624000.ufshc/by-name/drm /dev/block/sda3
/dev/block/platform/soc/624000.ufshc/by-name/sns /dev/block/sda4
/dev/block/platform/soc/624000.ufshc/by-name/misc /dev/block/sda5
/dev/block/platform/soc/624000.ufshc/by-name/factory /dev/block/sda6
/dev/block/platform/soc/624000.ufshc/by-name/encrypt /dev/block/sda7
/dev/block/platform/soc/624000.ufshc/by-name/eksst /dev/block/sda8
/dev/block/platform/soc/624000.ufshc/by-name/rct /dev/block/sda9
/dev/block/platform/soc/624000.ufshc/by-name/ssd /dev/block/sda10
/dev/block/platform/soc/624000.ufshc/by-name/keystore /dev/block/sda11
/dev/block/platform/soc/624000.ufshc/by-name/persist /dev/block/sda12
/dev/block/platform/soc/624000.ufshc/by-name/lafbak /dev/block/sda13
/dev/block/platform/soc/624000.ufshc/by-name/system /dev/block/sda14
/dev/block/platform/soc/624000.ufshc/by-name/cache /dev/block/sda15
/dev/block/platform/soc/624000.ufshc/by-name/cust /dev/block/sda16
/dev/block/platform/soc/624000.ufshc/by-name/OP /dev/block/sda17
/dev/block/platform/soc/624000.ufshc/by-name/userdata /dev/block/sda18
/dev/block/platform/soc/624000.ufshc/by-name/grow /dev/block/sda19

## sdb ##
/dev/block/platform/soc/624000.ufshc/by-name/xbl /dev/block/sdb1
/dev/block/platform/soc/624000.ufshc/by-name/xblbak /dev/block/sdb2
/dev/block/platform/soc/624000.ufshc/by-name/fota /dev/block/sdb3
/dev/block/platform/soc/624000.ufshc/by-name/fsg /dev/block/sdb4
/dev/block/platform/soc/624000.ufshc/by-name/dip /dev/block/sdb5
/dev/block/platform/soc/624000.ufshc/by-name/devinfo /dev/block/sdb6
/dev/block/platform/soc/624000.ufshc/by-name/grow2 /dev/block/sdb7

## sdc ##
/dev/block/platform/soc/624000.ufshc/by-name/xbl2 /dev/block/sdc1
/dev/block/platform/soc/624000.ufshc/by-name/xbl2bak /dev/block/sdc2
/dev/block/platform/soc/624000.ufshc/by-name/grow3 /dev/block/sdc3

## sdd ##
/dev/block/platform/soc/624000.ufshc/by-name/ddr /dev/block/sdd1
/dev/block/platform/soc/624000.ufshc/by-name/reserve /dev/block/sdd2
/dev/block/platform/soc/624000.ufshc/by-name/cdt /dev/block/sdd3
/dev/block/platform/soc/624000.ufshc/by-name/spare1 /dev/block/sdd4
/dev/block/platform/soc/624000.ufshc/by-name/grow4 /dev/block/sdd5

## sde ##
/dev/block/platform/soc/624000.ufshc/by-name/boot /dev/block/sde1
/dev/block/platform/soc/624000.ufshc/by-name/recovery /dev/block/sde2
/dev/block/platform/soc/624000.ufshc/by-name/recoverybak /dev/block/sde3
/dev/block/platform/soc/624000.ufshc/by-name/tz /dev/block/sde4
/dev/block/platform/soc/624000.ufshc/by-name/tzbak /dev/block/sde5
/dev/block/platform/soc/624000.ufshc/by-name/aboot /dev/block/sde6
/dev/block/platform/soc/624000.ufshc/by-name/abootbak /dev/block/sde7
/dev/block/platform/soc/624000.ufshc/by-name/raw_resources /dev/block/sde8
/dev/block/platform/soc/624000.ufshc/by-name/raw_resourcesbak /dev/block/sde9
/dev/block/platform/soc/624000.ufshc/by-name/rpm /dev/block/sde10
/dev/block/platform/soc/624000.ufshc/by-name/rpmbak /dev/block/sde11
/dev/block/platform/soc/624000.ufshc/by-name/hyp /dev/block/sde12
/dev/block/platform/soc/624000.ufshc/by-name/hypbak /dev/block/sde13
/dev/block/platform/soc/624000.ufshc/by-name/pmic /dev/block/sde14
/dev/block/platform/soc/624000.ufshc/by-name/pmicbak /dev/block/sde15
/dev/block/platform/soc/624000.ufshc/by-name/devcfg /dev/block/sde16
/dev/block/platform/soc/624000.ufshc/by-name/devcfgbak /dev/block/sde17
/dev/block/platform/soc/624000.ufshc/by-name/modem /dev/block/sde18
/dev/block/platform/soc/624000.ufshc/by-name/sec /dev/block/sde19
/dev/block/platform/soc/624000.ufshc/by-name/keymaster /dev/block/sde20
/dev/block/platform/soc/624000.ufshc/by-name/keymasterbak /dev/block/sde21
/dev/block/platform/soc/624000.ufshc/by-name/cmnlib /dev/block/sde22
/dev/block/platform/soc/624000.ufshc/by-name/cmnlibbak /dev/block/sde22
/dev/block/platform/soc/624000.ufshc/by-name/cmnlib64 /dev/block/sde24
/dev/block/platform/soc/624000.ufshc/by-name/cmnlib64bak /dev/block/sde25
/dev/block/platform/soc/624000.ufshc/by-name/apdp /dev/block/sde26
/dev/block/platform/soc/624000.ufshc/by-name/msapd /dev/block/sde27
/dev/block/platform/soc/624000.ufshc/by-name/dpo /dev/block/sde28
/dev/block/platform/soc/624000.ufshc/by-name/grow5 /dev/block/sde29

## sdf ##
/dev/block/platform/soc/624000.ufshc/by-name/modemst1 /dev/block/sdf1
/dev/block/platform/soc/624000.ufshc/by-name/modemst2 /dev/block/sdf2
/dev/block/platform/soc/624000.ufshc/by-name/fsc /dev/block/sdf3
/dev/block/platform/soc/624000.ufshc/by-name/spare2 /dev/block/sdf4
/dev/block/platform/soc/624000.ufshc/by-name/grow6 /dev/block/sdf5

## sdg ##
/dev/block/platform/soc/624000.ufshc/by-name/persistent /dev/block/sdg1
/dev/block/platform/soc/624000.ufshc/by-name/grow7 /dev/block/sdg2

So the next steps to try would be

---------------------------------------------

method 1

in root shell:

dd if=aboot.img of=/dev/sde6
dd if=aboot.img of=/dev/sde7

in command prompt on the computer:

adb reboot bootloader (should get me to the new unlocked engineering bootloader)
fastboot flash recovery twrp-3.0.2-1-h990.img
(wait more than 30 seconds)
fastboot flash recovery twrp-3.0.2-1-h990.img
(wait more than 30 seconds)

take out battery, put battery back in, press vol- and power button, release the power button for 0.5 seconds when the LG logo shows up and hold it again to get to the "“Delete all user data (including LG and carrier apps) and reset all settings?" screen and from there everything is like with dirty santa.

---------------------------------------------

method 2

in root shell:

dd if=aboot.img of=/dev/sde6
dd if=aboot.img of=/dev/sde7
dd if=twrp-3.0.2-1-h990.img of=/dev/sde2
dd if=twrp-3.0.2-1-h990.img of=/dev/sde3

power off phone

press vol- and power button, release the power button for 0.5 seconds when the LG logo shows up and hold it again to get to the "“Delete all user data (including LG and carrier apps) and reset all settings?" screen and from there everything is like with dirty santa.

---------------------------------------------

Could this work in theory or would I have to do something different?

For method 2 should I append zeros to twrp-3.0.2-1-h990.img with a hex editor first to match the size of the original recovery and recoverybak?

Currently I can get into download mode by pressing vol+ and inserting the USB cable (connected to a computer) when the phone is powered off. From there I can reflash a kdz with the patched LGUP and recover the phone in case something is messed up.

Are aboot and / or recovery needed for this download mode or not? Or, to put it differently, in case aboot and recovery are in nonworking state, is the download mode still supposed to work?

Of course there are no guarantees but I would like to assess the risk in advance as good as possible.