yashsingh1/xdaforums huggingface dataset:
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
Received 150 USD to my paypal from Kevin Borges with following comment:

Thank you and all other contributors for the donations.

I've updated the first post (not only the donations list but added some more clarifications too).

Please note, as discussed since beginning with [MENTION=8615083]Inerent[/MENTION], only the temp root exploit has been supposed to be implemented by me.

There is however available an engineering booloader, that may eventually allow to unlock bootloader after flashing from temp root.

This needs to be tested first and can involve some risks to brick the phone.

I do not own any LG phone (and do not even want one), so I am not doing that, sorry.

But I've already checked few things regarding the engineering bootloader and I can conclude, that it could be compatible in the sense that it most likely would not brick the device.

The reason I see that comparing stock firmware ABL image and the eng bootloader (aka ABL) seems that both use the same signing root certificate and they both have identical OU info in the signature certificate:

OU=07 0001 SHA256,
OU=06 0000 MODEL_ID,
OU=05 00000000 SW_SIZE,
OU=04 0031 OEM_ID,
OU=03 0000000000000001 DEBUG,
OU=02 000A50E100310000 HW_ID,
OU=01 000000000000001C SW_ID

If it would work with android 10 is another question though.

Please find attached source for split utility, to get some parts of the image likely to start with a signature certificate.

Those parts then can be converted to text form representation of the certificate via following command for example:

openssl x509 -in LUN4_abl_a_COM3.img-001238 -inform der -text -noout > LUN4_abl_a_COM3.img-001238.txt
[LG V50 ThinQ Guides, News, & Discussion] Inerent:
Yes, Jann, thats true. But thx for helping us with some advices. I hope we are a big community (also users are coming from LG v30 and V40) and will figure this out, or rise another bounty if not.

Thx for helping us!
[LG V50 ThinQ Guides, News, & Discussion] TheLoonyRebel:
$20 donation sent to [MENTION=4418980]j4nn[/MENTION] from me. Thanks for the hard work.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=2440946]AngryManMLS[/MENTION], thank you for the donation. Updated the first post.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
LG G8

Please note, if the exploit works with March firmware, it does not make it compatible with any other older firmwares, even if they are vulnerable.

The kernel build (binary image) is different there, i.e. it would need different offsets in the exploit to succeed.

The reason for selecting March security patch level with LG V50, i.e. the V500N20m firmware version, has been in order to exploit the newest still exploitable firmware.

The bug has been fixed in LG kernel since April security patch level, so using March fw allows you to use the latest still vulnerable and the most up to date fw for the temp root.

For other targets like the G8 might be useful to select other fw version if there are multiple variants that would use identical kernel binary image, possibly even not having a downloadable fw release for a variant, while existing for another variant (this may be a case if phone variants have identical or nearly the same hw).
[LG V50 ThinQ Guides, News, & Discussion] TheLoonyRebel:
The difficult thing is that the G8 variants are all over the place with which firmware/security patch they are on. My T-Mobile variant (G820TM) is on January 2020 meanwhile say the Verizon variant (G820UM) is on February 2020. So it's a mess which pretty much tells me each variant will need to have it's own exploit made for it.

Edit: Just found out the G820UM just got the April security update. KDZ isn't out yet for that.
[LG V50 ThinQ Guides, News, & Discussion] antintin:
Hello, I've been talking to inherent on telegram; I think he sent you some of my outputs / logs. I'm sorry I haven't been able to donate as I'm unfortunately not old enough to do so. I've got a Sprint g8 which is stuck on the Android 10 beta on November patch. If you adapt this for other g820um variants, will it likely work with my patch or not?
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=2440946]AngryManMLS[/MENTION], most likely April security fixed the bug making it not exploitable anymore.

Yes, each kernel build/image would need specific support in the exploit.

[MENTION=10121203]antintin[/MENTION], I need the binary image of kernel used in the firmware that is running the phone we would target with the temp root exploit in order to develop support for it.

Is your Android 10 beta on November patch firmware downloadable anywhere?

Or can you flash any other firmware?

Can you say which G8 model/carrier would have identical hardware to your Sprint G8, while having a downloadable fw?
[LG V50 ThinQ Guides, News, & Discussion] antintin:
Well I'm not entirely certain, maybe I can ask vl48. I think any g820um should be fine though. I doubt there is any beta kdz available to download, however. I unfortunately can only go on the final pie version or November patch beta 10 on my Sprint. My updates are broken :
[LG V50 ThinQ Guides, News, & Discussion] quantan:
After the temp root, can we flash Magisk patched boot img to /dev/block/bootdevice/by-name/boot_a or something like that? Does it still work after a reboot :D
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=3561542]quantan[/MENTION], most likely not, due to dm-verity/AVB 2.0 - it is a temp root...

Magisk (with possibly limited functionality) may be eventually started from the exploit, but it seems not to work yet...
[LG V50 ThinQ Guides, News, & Discussion] snake65:
Would be good to at least have android 10 on the Australian V50 but we can't even get that.

Will never buy lg again.
[LG V50 ThinQ Guides, News, & Discussion] Inerent:
That is not LG fault, is your carrier one. Wait patiently, pretty soon all our problems are resolved.
[LG V50 ThinQ Guides, News, & Discussion] hooutoo:
I have to agree with you on this one. Right now, LG is getting it's lunch eaten by many Chinese OEMs and their bleeding cash in the smartphone business. LG latest "FLAGSHIP", the V60, is a d*** joke when comparing it's 60Hz screen refresh rate to any new smartphone. It's selling for $809.99 new on Tmob and their already selling for less than $700 on Ebay. By end of summer, $390?

I too "Will never buy LG again!".

BTW, I have an Essential PH-1, admittedly old hardware but I'm already running Android 11 DP4 as a daily with very few problems. The V50 won't see 11 for what....... 18 months?
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
Released v50g8-root.zip supporting multiple targets - see the first post.

Enjoy!
[LG V50 ThinQ Guides, News, & Discussion] Inerent:
Thank you so much my dear friend, Jann! :good:

You are the best developer EVER! :good::highfive:
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
Please keep posting your logs from the exploit confirming your target to work.

In case you have an unsupported target, like Sprint for example and you find any '-t num' option eventually working, please be sure to post it here with info about your phone model and carrier. It would be useful for others.

Thanks.
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
If I run the exploit on my phone, does it leave any traces (besides the script) or mess with the system in any way to prevent software updates or trip any apps that check for root? I know that once you reboot the phone the root goes away.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], the exploit makes changes only in memory of linux kernel to patch credentials of current process to root user and set selinux to permissive. This all will be gone after reboot.

In my opinion the exploit is perfectly safe apart from that your kernel may crash and therefore make the phone reboot.
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
In that case then, I tried all of the V50 targets in the exploit script and none of them worked on my Sprint V50 on Jan 1st security patch.

LMV450AT-00-V20a-LAO-COM-JAN-15-2020-ARB00+2
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], that is unfortunate, but kind of expected - Sprint firmwares are not available for download, so I cannot analyse the kernel image to add support for it.

It is a pure luck that a target (created from downloadable fw for different carrier/phone model) works for some Sprint releases (as it happened already for few).
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
That's unfortunate, that's the only Android 10 release for the Sprint model. Is guessing and checking possible based on the other kernels and how they differ in respect to each other? Could the logs of the script from all the V50 target failures help get a sense of what is failing?

Have you looked at the Verizon V50 KDZ? They share a very similar model number (V450VM instead of PM): https://kdz.gresslg.tk/LG V50 ThinQ 5G/V450VM10j_01_VZW_US_OP_0305.kdz
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], interesting, V450VM does not have any fw listed on lg-firmares, but your linked kdz is a pie release, so it will not help.

ro.vendor.lge.factoryversion=LMV450AT-00-V10j-LAO-COM-MAR-05-2020-ARB00+1

ro.build.version.release=9

ro.build.version.security_patch=2020-03-01
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
I forgot that the Verizon V50 hasn't gotten Android 10 yet although it has a newer security patch. Maybe if it gets Android 10 the kernel may be similar enough?
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], unfortunately if it gets android 10 with april or newer security patch, it is very probable that the release will contain the fix of the vulnerability we are exploiting here, so it would not be useful.

I would also advice to anybody having already android 10 with security patch of March 2020 or older not to do a system upgrade - it may happen that LG would disable downgrades to a vulnerable version, so even if you had an older .kdz, it might not be possible to flash it.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
tool to dump kernel memory released

Please see the updated first post of G8 thread for v50g8-dump tool, that may be used to fetch some kernel space memory content.

This could allow eventually to add support for targets that do not have a downloadable firmware.
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
One day later the Android 10 release just came out. It has the April security patch. It probably has been patched. I'll get you the kernel dump.
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
Here is my memdump for the Sprint V50 Jan 1st patch attached.
[LG V50 ThinQ Guides, News, & Discussion] awdrifter:
What can be done with this temp root? Will things like Titanium Backup work? Also ad blockers that edits the host file, will those also work? I'm thinking about getting a cheap V50 to play with if that's the case. Thanks.
[LG V50 ThinQ Guides, News, & Discussion] siulmagic:
Temp root allows you to backup your partitions and flash/ unlock bootloader, perma root is only possible for now with BL Unlock. There are guide's on telegram on how to bl unlock your v50. Also do not mess with your system partition while you are temp rooted, avb is on so any changes to system will mostlikelly ether brick you or force you to kdz.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=4490217]awdrifter[/MENTION], apps like tb need working magisk manager. I am still working on that, it is very difficult to start magisk from an exploit and have notifications asking fot root permission working from apps.
[LG V50 ThinQ Guides, News, & Discussion] awdrifter:
Thanks for the info. I'll wait a bit to see how the development progress.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
released v50g8-mroot with support for Magisk v20.4

Released v50g8-mroot with support for Magisk v20.4 started from temp root shell including working su permission asking notification from apps.

Added also support for multiple new targets.

Please test it including the magisk stuff as that has not yet been tested with any LG phone (tested it only with my phone running pie) and post feedback here, possibly including the output from adb shell.

[MENTION=5429208]andrewwm[/MENTION], your Sprint V50 with January 2020 security patch should be now supported.
[LG V50 ThinQ Guides, News, & Discussion] Inerent:
Thx so much, Jann! You've nailed it! I think this is even better than unlocking Bootloader, as this phone literally stays 1 month without restart and also some of us are quite afraid of unlocking Bootloader and loosing safety net certification. Great job! I hope everyone appreciate it! :good::highfive:
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
Awesome, how did you do it without the KDZ? Did the memdump help?

I downloaded the new mroot file but I'm not seeing the Sprint V50 target.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], just run the exploit without any options, your target should now be supported as well as the other targets reported to work here previously with some '-t num' option.

I hope you get root now, confirming the memdump actually helped.
[LG V50 ThinQ Guides, News, & Discussion] allonid:
support lm-v500n20o , april 1, 2020 ?
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
I'm getting target not supported:

127|flashlm:/data/local/tmp $ ./v50g8-mroot
[+] factoryversion = 'LMV450AT-00-V20a-LAO-COM-JAN-15-2020-ARB00+2'
target is not supported.
1|flashlm:/data/local/tmp $ ./v50g8-mroot -T
supported targets:
0 : LMG820NAT-00-V20j-LAO-COM-FEB-12-2020+0
1 : LMG820NAT-00-V20m-LAO-COM-MAR-18-2020+0
2 : LMG820AT-00-V20a-LAO-COM-DEC-23-2019-ARB00+9
3 : LMG820AT-00-V20b-LAO-COM-JAN-10-2020-ARB00+0
4 : LMG820AT-00-V20b-LAO-COM-FEB-12-2020-ARB00+2
5 : LMG820AT-00-V20c-LAO-COM-MAR-19-2020-ARB00+0
6 : LMG820AT-00-V20d-LAO-COM-JAN-28-2020-ARB00+0
7 : LMV500AT-00-V20a-LAO-COM-JAN-24-2020+0
8 : LMV500AT-00-V20e-LAO-COM-JAN-23-2020+0
9 : LMV500AT-00-V20g-LAO-COM-MAR-10-2020+0
10 : LMV500NAT-00-V20b-LAO-COM-DEC-23-2019+0
11 : LMV500NAT-00-V20f-LAO-COM-JAN-31-2020+0
12 : LMV500NAT-00-V20m-LAO-COM-MAR-10-2020+0
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], thanks for reporting that, it seems I have included the old version with scripts for magisk that did not support yet the new targets, sorry for that.

I've updated the attached v50g8-mroot.zip, please re-download and re-test.

Now it should look like this:

$ ./v50g8-mroot -T
supported targets:
0 : LMG820NAT-00-V20j-LAO-COM-FEB-12-2020+0
1 : LMG820NAT-00-V20m-LAO-COM-MAR-18-2020+0
2 : LMG820AT-00-V20a-LAO-COM-DEC-23-2019-ARB00+9
3 : LMG820AT-00-V20b-LAO-COM-JAN-10-2020-ARB00+0
4 : LMG820AT-00-V20b-LAO-COM-FEB-12-2020-ARB00+2
5 : LMG820AT-00-V20c-LAO-COM-MAR-19-2020-ARB00+0
6 : LMG820AT-00-V20d-LAO-COM-JAN-28-2020-ARB00+0
7 : LMV500AT-00-V20a-LAO-COM-JAN-24-2020+0
8 : LMV500AT-00-V20e-LAO-COM-JAN-23-2020+0
9 : LMV500AT-00-V20g-LAO-COM-MAR-10-2020+0
10 : LMV500NAT-00-V20b-LAO-COM-DEC-23-2019+0
11 : LMV500NAT-00-V20f-LAO-COM-JAN-31-2020+0
12 : LMV500NAT-00-V20m-LAO-COM-MAR-10-2020+0
13 : LMG820AT-00-V20a-LAO-COM-NOV-25-2019-ARB00+0
14 : LMG820AT-00-V20d-LAO-COM-DEC-17-2019-ARB00+1
15 : LMG820AT-00-V20d-LAO-COM-JAN-29-2020-ARB00+0
16 : LMG820AT-00-V20e-LAO-COM-FEB-05-2020-ARB00+0
17 : LMV450AT-00-V20a-LAO-COM-JAN-15-2020-ARB00+2
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], the exploit works based on use after free, that means it depends on state of memory heap and how it changes during exploit time.

That means there is some portion of unpredictability and a chance that something else is overwritten than hoped for by shaping the heap.

So to get best results, one should stop anything that could run in background, like:

set airplain mode, turn off wifi and bluetooth so there is no data connection at all

set "Stay awake" to ON while charging (i.e. using adb shell) in developer options

disable auto updates of system and apps

debloat your system so useless apps do not run in background

reboot your phone having all the above

wait two minutes after boot up with phone unlocked, screen on connected to PC via usb cable having 'adb shell' already active (checking with 'uptime' command)

start the exploit

after getting root shell and succesfuly starting magisk, do not forget to properly exit the temp root shell by use of 'exit' command two times, so the 'adb shell' with the exploit is ended with the rest of clean up
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
Got it. I tried setting my battery saver mode to maximum which stops background tasks and other things, it works almost every time.

It still crashes right after the SU prompt is available, is it enough time to do anything with it?
[LG V50 ThinQ Guides, News, & Discussion] aiap:
I have a Sprint V50 on the January patch as well, I can get it to open the root shell but it immediately crashes once it enters it as well.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], [MENTION=10125704]aiap[/MENTION], an additional tip - when starting magisk with 3 stages of ./magisk-start.sh after getting a root shell:

please be sure to enter each command separately, line after line - do not paste all in a single block and do not put them in a script.

There are reasons this is divided in 3 stages. With this approach I got the best stability, while putting ./v50g8-mroot together with -1 and/or -2 stuff in a single script run resulted with a reboot most of the time.

Phases 2 and 3 need to be split for functional reasons to start magisk with working su permission asking notification.
[LG V50 ThinQ Guides, News, & Discussion] aiap:
The problem is that it immediately crashes after obtaining temp root. I managed to run the first part of the magisk script, but it errored saying that it had an invalid argument then crashed afterwards. It crashes after a few seconds irregardless of what I do. I'm not sure why it is doing this because I did the instructions exactly as you laid out.

130|flashlm:/data/local/tmp $ ./v50g8-mroot
[+] factoryversion = 'LMV450AT-00-V20a-LAO-COM-JAN-15-2020-ARB00+2'
[+] Mapped 200000
[+] selinux_enforcing before exploit: 1
[+] pipe file: 0xffffffe9c9c54900
[+] file epitem at ffffffe9aae85600
[+] Reallocating content of 'write8_inode' with controlled data...[DONE]
[+] Overwriting 0xffffffe9c9c54920 with 0xffffffe9aae85650...[DONE]
[+] Write done, should have arbitrary read now.
[+] file operations: ffffff85e4221250
[+] kernel base: ffffff85e2c80000
[+] init_cred: ffffff85e502e588
[+] memstart_addr: 0xffffffd740000000
[+] First level entry: 120d9c003 -> next table at ffffffe9e0d9c000
[+] Second level entry: 10b465003 -> next table at ffffffe9cb465000
[+] sysctl_table_root = ffffff85e505b098
[+] Reallocating content of 'write8_sysctl' with controlled data..[DONE]
[+] Overwriting 0xffffffeab5389468 with 0xffffffea10720000...[DONE]
[+] Injected sysctl node!
[+] Reallocating content of 'write8_selinux' with controlled data....[DONE]
[+] Overwriting 0xffffff85e57ddffc with 0x0...[DONE]
[+] Node write8_inode, pid 2178, kaddr ffffffe9cd051a00
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Node write8_selinux, pid 2211, kaddr ffffffe99b291380
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Node write8_sysctl, pid 1885, kaddr ffffffe99b56e280
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Cleaned up sendmsg threads
[+] epitem.next = ffffffe9c9c54920
[+] epitem.prev = ffffffe9c9c549d0
[+] Launching privileged shell
root_by_cve-2020-0041:/data/local/tmp # ./magisk-start.sh -1
+ FRESH=false
+ '[' -1 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'
Load policy from: /sys/fs/selinux/policy
fopen: /sys/fs/selinux/policy failed with 22: Invalid argument
1|root_by_cve-2020-0041:/data/local/tmp #
[LG V50 ThinQ Guides, News, & Discussion] Shtiff1:
Are you passing safety net?
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5359721]Shtiff1[/MENTION], thank you for your donation - updated the first post.

Can anyone who can use the temp root for longer time post the log from terminal including the start up of magisk?

After you exit temp root shell and then the adb shell, can you disconnect from usb and use the phone with magisk for extended period of time?

For how long?
[LG V50 ThinQ Guides, News, & Discussion] Shtiff1:
I have using it more than 24hrs now
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5359721]Shtiff1[/MENTION], could you please reboot and re-apply temp root with magisk start up the same way as you did before and post the full log from terminal (cmd window)?

And see if it is stable afterwards as before?

Thank you.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
Concerning safety net, do not have any testing results, but I believe it should be possible to pass easily - assuming V50/G8 supports hardware based attestation and bootloader has not been unlocked yet, it should pass even the latest server side changes regarding attestation.

The only thing might be with detection of 'su' which should be possible to hide.

Not tested but I would assume that you could use magisk hide to hide 'su' from certain apps, including those connected to safety net.

My startup script for magisk does all the steps that are done when magisk is integrated in kernel boot image with unlocked bootloader, so I would assume that even most magisk modules should work.

This is however depending on when particular module should have been started, because magisk started from exploit via my startup script differs to the one started within boot by the time everything is started, meaning there may be a module, that needs to be started earlier in the boot process to work as expected.

For example if magiskhide should hide 'su' from an app, it needs to be started earlier than the app. If it did not, it may help to restart that app (possibly with data erase of that app) after starting magisk from the exploit.
[LG V50 ThinQ Guides, News, & Discussion] Shtiff1:
I haven't cleared data on that certain app yet. I have clicked magisk hide and also repackaged manager. I also have not ran this command that I saw in your post. I also sent you a PM.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5359721]Shtiff1[/MENTION], obviously running

su -c 'setenforce 1'

from a new adb shell after exiting the one that used the exploit to start magisk can help with regard to safety net attestation as it may check for selinux permissive - using that command would switch it back to 'selinux enforcing' getting you back to safer environment while keeping root via magisk.
[LG V50 ThinQ Guides, News, & Discussion] Shtiff1:
Awesome, that's what I was thinking. I will try it tomorrow.