yashsingh1/xdaforums huggingface dataset:
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Mikeyd7186:
[MENTION=5359721]Shtiff1[/MENTION] can you link me the way to downgrade i have not been able to find anything yet
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
Do you have kdz?

---------- Post added at 01:45 AM ---------- Previous post was at 01:27 AM ----------

Do you have kdz file for your phone?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Mikeyd7186:
[MENTION=5359721]Shtiff1[/MENTION] no sir i have been looking all day on here and google but cant find what i need
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
https://t.me/v50thinq/88892

---------- Post added at 02:13 AM ---------- Previous post was at 02:11 AM ----------

Click link
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=5259467]Mikeyd7186[/MENTION], check the post#36. You could switch slot to a previous version.

If you have a model that has available downloadable fw, you could just flash it. Check https://lg-firmwares.com.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
Ok, finally got the output text file and the memdump.bin. Here they are:
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=10121203]antintin[/MENTION], you again posted a zip without the memdump.bin file, instead including the v50g8-dump tool. That is useless.

When you run the dump tool it will say it created memdump.bin and sleep indefinitely. Open a new cmd window without terminating the one with the dump tool. In the new cmd window type

adb pull /data/local/tmp/memdump.bin

to download the memdump. bin from the phone to your pc.

It should be around 32MB in size. So the resulting zip cannot be just few kB.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
sorry about that, here's the actual zip
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=10121203]antintin[/MENTION], Ok, finaly;)

I will see what I can do..
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Mikeyd7186:
Ok update i went on with what was suggested in post #36 and i do get into another slot i believe but it asks for a start up pin and when i went into it in settings before it was grayed out so i never messed with it so i just went back into the april slot

Ok got it set up trying again

---------- Post added at 12:35 AM ---------- Previous post was at 12:23 AM ----------

Well that did not work i guess the smart lock does not carry over to the other slot had to go back to aprils again but the code worked on it
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
Dude just go through all the tries and it will just factory reset you. That's just what happens
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Mikeyd7186:
Ok got it downgraded and working but as in post #9 I have the same version so guess stuck for now I have tried all -t options
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
ok, hope you can achieve something, no pressure though ;) Believe it or not I had the results.txt file, the memdump file, and the v50g8-dump file in the same folder every time. And I somehow managed to zip the two wrong ones together twice in a row....
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Mikeyd7186:
[MENTION=4418980]j4nn[/MENTION] Ok Well figured I would try and flash kdz that I found on LG page as suggested and followed the instructions and it got to 4% then just closed out and it wouldn't open back up, didnt have access to folder so I went and allowed it through windows security and then it opened but still same results 4% then uppercut just closed out and nothing happened on the phone, unfortunately it updated overnight so I will be doing it over again lol
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
released v50g8-mroot with support for Magisk v20.4

Released v50g8-mroot with support for Magisk v20.4 started from temp root shell including working su permission asking notification from apps.

Added also support for multiple new targets (3 x G8 Sprint and one G8 T-Mobile US).

Please test it including the magisk stuff as that has not yet been tested with any LG phone (tested it only with my phone running pie) and post feedback here, possibly including the output from adb shell.

[MENTION=10121203]antintin[/MENTION], your Sprint G8 with Android 10 beta November 2019 security patch should be now supported.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] siulmagic:
Will test magisk root.

Magisk temp root, confirmed working on LG g8 Sprint 20d firmware dec sec patch.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] BrandonB1218:
Sent you a donation for your work. Thank you!
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
It seems I have included the old version of v50g8-mroot with scripts for magisk that did not support yet the new targets, sorry for that.

I've updated the attached v50g8-mroot.zip, please re-download and re-test.

Thank you [MENTION=2768375]BrandonB1218[/MENTION] for you donation - based on your comment mentioning G8 I have updated the first post of the LG G8 temp root thread.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
Thank you so much! Really appreciate your work: temp root and magisk are both working. Now its just a matter of bl unlocking and flashing some partition backups another user made of 20d. We did get some sprint g8 bricks, so I'm not sure if I want to try just yet, but thanks so much for your help!
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=10121203]antintin[/MENTION], glad to hear that it worked. So maybe you can get a backup from another sprint g8 user of the important partitions from a fw version that allows updates to get you out of the dead end you have been in with your phone, restoring them with 'dd' commands?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
The exploit works based on use after free, that means it depends on state of memory heap and how it changes during exploit time.

That means there is some portion of unpredictability and a chance that something else is overwritten than hoped for by shaping the heap.

So to get best results, one should stop anything that could run in background, like:

set airplain mode, turn off wifi and bluetooth so there is no data connection at all

set "Stay awake" to ON while charging (i.e. using adb shell) in developer options

disable auto updates of system and apps

debloat your system so useless apps do not run in background

reboot your phone having all the above

wait two minutes after boot up with phone unlocked, screen on connected to PC via usb cable having 'adb shell' already active (checking with 'uptime' command)

start the exploit

after getting root shell and succesfuly starting magisk, do not forget to properly exit the temp root shell by use of 'exit' command two times, so the 'adb shell' with the exploit is ended with the rest of clean up
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Seasee606:
Will post memdump when i can.

Thanks for all of your effort with this phone it is appreciated! :good:
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
an additional tip - when starting magisk with 3 stages of ./magisk-start.sh after getting a root shell:

please be sure to enter each command separately, line after line - do not paste all in a single block and do not put them in a script.

There are reasons this is divided in 3 stages. With this approach I got the best stability, while putting ./v50g8-mroot together with -1 and/or -2 stuff in a single script run resulted with a reboot most of the time.

Phases 2 and 3 need to be split for functional reasons to start magisk with working su permission asking notification.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
Can anyone who can use the temp root for longer time post the log from terminal including the start up of magisk?

After you exit temp root shell and then the adb shell, can you disconnect from usb and use the phone with magisk for extended period of time?

For how long?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] py0zz1:
Hi. Good Exploit!

I am currently writing Exploit code for the G8.

I tried inserting ctl_node and modifying cred through 'write64 ()'.

But 'write64 ()' does not work properly.

I'd like to get a hint about this, can you disclose the Exploit Code for that part?

write64() error is 'invalid argument'..
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=10837445]py0zz1[/MENTION], I wonder why are you working on G8 exploit while it is already available in this thread?

As stated in OP, I will put it on github later. It is not ready yet, some Sprint V50 users complain about immediate reboot after getting a root shell so it can't be used. It is still work in progress. After it is finished, I will need to clean up the code removing lots of my unneeded debug and test stuff before releasing it.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
i cant get setenforce to work
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
G8 verizon
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
Nevermind I got it
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] firedroidx:
https://drive.google.com/file/d/1uNp3VlOA7ElpxLEdxZiT0xhfEGCPAyWa/view?usp=sharing

This is for a US G820UM AT&T on sw version G820UM20j.

factoryversion = 'LMG820AT-00-V20j-LAO-COM-FEB-04-2020-ARB00+0'
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
Bootloader unlock and magisk working on Sprint g8!!! Unfortunately after 2 people bricked, but now we know what to do.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] motogvasyag:
Do you need to unlock the bootloader and the permanent root (Magisk) on your LG G8 Verizon? I can do it remotely, write in telegrams, I rarely go here https://t.me/UnlockLG
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
I need it to compare with those who get a reboot instead
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] BrandonB1218:
So I'm on v20f. Got the phone used on Swappa, that's what it shipped with. I attempted to force every target available to see if anything would happen, but never got passed the setting selinux to enforcing step. Attempted a memdump and got a segmentation fault. Any idea if this exploit will work on v20f at all?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=2768375]BrandonB1218[/MENTION], if you mean you cannot get any further than

[+] selinux_enforcing before exploit: 1

this line, the firmware is not vulnerable.

In such case you would need to flash a vulnerable .kdz if available or try to downgrade to previous version via switching to the inactive slot.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] tron1:
Try to swap the active partition. Phone provider is Sprint?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shryvone21:
Request to patch LMG820AT-00-V20i-LAO-COM-JAN-07-2020-ARB00+0

I tried the ./v50g8-mroot -t (arguments[2,3,14,15]), and none of them worked. So I am attaching my memdump.bin for attempt with -t option 3. Hope dev can help. Will donate if dev finds an way for att patch lvl Jan 7 2020 V20i-COM. Thank you. :) Keep up the good work.

Really wanna just use viperfx audio and lspeed with some background speed ram scripts and gpu mods. Make my dreams come true please.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] crazynapkinman:
[MENTION=4418980]j4nn[/MENTION] I have a peculiar predicament. I had to send my phone (G8 Sprint, USA) to LG Services for repair. They replaced the board and seemingly only flashed slot A with an OS (April Patch).

What are the chances of getting a working exploit with this setup?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=5906430]crazynapkinman[/MENTION], unfortunately that is really a bad luck - april security patch level has this exploit's vulnerability fixed, it will never work, sorry.

Your only chance would be to somehow flash an older firmware, if possible at all. Or maybe firehose if it gets leaked.

Very unlikely that someone would develop another temproot using some newer vulnerability while your device already had one.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shryvone21:
Question...

Think you can make it work on patch jan 7 v20i? Would donate.:) pleaseeeee?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] siulmagic:
Can anyone with a tmobile device that can temp root , dump there system partition and upload it? please
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shryvone21:
Help op

Command to get an dump is first pushing the v50g8-dump to tmp. Then to get your memdump.bin do:

./v50g8-dump -t [num]

Example:

./v50g8-dump -t 3

After you adb shell...

Just to help...
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] siulmagic:
Can anyone with a Tmo G8, please upload the content of Product/OP with a root explorer, and the system_a partition, ofc you have to be temp rooted and it has to be from android 10. thank you.

edits: Already got the dumps. thank you
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] TPMJB:
So I have a build prior to any of these. I imagine there's no way to update to a specific one now that the most recent update patches this vulnerability, right?

I have LMG820AT-00-V10g-LAO-COM-MAR-16-2019-ARB00+0
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=2696368]TPMJB[/MENTION], is not it possible to do fota updates step by step for each security patch level and stop on a desired one if your phone does not have downloadable .kdz?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] TPMJB:
I don't know - this is new to me. I have an AT&T version of the G8 and I thought people could only update if they had an AT&T sim. My last phone was a V30.

If I'm wrong, please correct me
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
temp root updated for 3 new G8 targets

Added support for one Verizon G8 and two AT&T G8 targets:

LMG820AT-00-V20a-LAO-COM-JAN-09-2020-ARB00+5

LMG820AT-00-V20i-LAO-COM-JAN-07-2020-ARB00+0

LMG820AT-00-V20j-LAO-COM-FEB-04-2020-ARB00+0

Also includes changes to make the root shell more stable (should fix issues with V50 but hopefully G8 could benefit too).

Released as v50g8-mroot2.zip available in the first post.

[MENTION=7153887]firedroidx[/MENTION], [MENTION=4862833]Shryvone21[/MENTION], [MENTION=2696368]TPMJB[/MENTION]

Please test and confirm if it works here as this build had not been tested.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shryvone21:
Good:good::good::) thank you so much! Lspeed here I come!
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=4862833]Shryvone21[/MENTION], please test and confirm if it works here as this build had not been tested.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
L speed? Not to be rude, but that app is practically useless on Android 10
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] avryabov:
I got temp root with Magisk on my TMobile G8. However, the phone reboots itself after several minutes I have root. Is it normal behavior because of instability of the exploit?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=10878123]avryabov[/MENTION], that is hard to tell - what did you do just before it rebooted?

Can you try it few times more, following the guide carefully including the tips?

Could you please run 'adb logcat' in a new 'cmd' window in parallel to the exploit shell window and keep the phone connected on usb after starting magisk, just exiting the exploit shell with 'exit' two times, but keeping the logcat running?

And send me both, the log from the exploit and the logcat log?

Thank you for the donation. Updated the first post.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] TPMJB:
Hey boss, I'd love to test but I'm still on Pie with my AT&T phone. I don't know how to update. If I use an AT&T sim card I probably will get the version that isn't vulnerable.

Edit: Also annoying is it's AT&T locked and they won't help me at all. Clean ESN though. It's apparently never been on AT&T's network so it's not a registered IMEI with AT&T, so they can't help me.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Espen115:
Just so you know, as I recently went through the process, it updates each release in order as opposed to one big one that puts you fully up to date. Mine went from Aug -> September -> October -> January (Android 10) -> February. I stopped there because April is the one that was said patches it out. I did have to get an active account via AT&T prepaid to get updates to come.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] TPMJB:
Do you know if I could do this via Red Pocket, which also uses AT&T towers? And what did you do? Just stick in the sim card and wait for it to update once?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Espen115:
I truthfully don't think they work via AT&T MVNOs. I have Cricket Wireless (also uses AT&T towers) as my main provider and the update didn't go through with it. I spent $15 for 2GB of data from AT&T on their website, activated the SIM card, and about an hour and a half later the phone notified me there was an update available.

Also coming in to post that the temporary root works now on February AT&T update, but the Magisk script is failing for me at the "./magisk-start.sh -1". I've already cleared out the directory on my phone and attempted again from scratch, but I get this regardless:

"alphalm:/data/local/tmp $ ./magisk-start.sh -1

+ FRESH=false

+ '[' -1 '=' --fresh ']'

+ '[' ! -e /data/adb/magisk/busybox ']'

+ FRESH=true

+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'

Load policy from: /sys/fs/selinux/policy

fopen: /sys/fs/selinux/policy failed with 13: Permission denied"
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=10870465]Espen115[/MENTION], the ./magisk-start.sh script is supposed to be run in the root shell provided by the exploit. Obviously it does not work when you run it in normal adb user shell.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Espen115:
Right, the issue was that it actually never launched an elevated shell. I didn't realize until I went back and checked again. Here's the output on the exploit:

Is there anything extra that I'm missing on that? It doesn't give errors, crash the script, or reboot the phone as it previously had, but it seems it isn't going through to the next step. Attempted it in both cmd and powershell, if it matters.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
Since there's so many people stuck on Android pie with the at&t g8, do you think you could look into downloading some pie kdzs for the us or Canadian g8 and seeing if the exploit could work? If so, at&t g8 users please also send the results and dump from v50g8-dump
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] avryabov:
Sorry, **** happened with my phone.

It updated to 20e version, regardless of I have "Automatic system updates" switched off in Developer options.

So I have to downgrade it first back to 20d. Most probably it will take time.

The three times as I remember, when I had root, I just did random actions, nothing really specific to root activities.

It just rebooted after several minutes (about 5 or 10).

Two times with "adb shell" opened, one without it.

PS: most probably it was coincident, I think because "Update Center" package was not disabled, it was updating my phone against my will in the same time when I wanted to test root access. I'm really upset about that behavior of my phone.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=10870465]Espen115[/MENTION], huh, that is really strange. Could you please run following commands in your normal adb shell:

ls -lZ /system/bin/sh
which sh
ls -lZ `which sh`

[MENTION=10121203]antintin[/MENTION], I've already checked with Korean pie firmware, the kernel is not vulnerable. It is not probable, that AT&T or Canada/US firmware would have kernel build from more updated kernel sources, containing the vulnerability. But sure, anybody can run any of the released exploits and see if it can do anything past the 'selinux_enforcing before exploit: 1' line. If the v50g8-dump was able to provide a memdump.bin even better, that would confirm it would be exploitable opening the possibility to add support.

[MENTION=10878123]avryabov[/MENTION], that update in the background stuff is really unfortunate, but could cause some unpredictable instabilities. Is not there a sure way to disable the updates somewhere?

Please be sure to use 'exit' twice in the root shell after starting magisk - that is really important as the rest of the clean up happens only in that case.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] TPMJB:
I can confirm update doesn't work on Red Pocket. At least Red Pocket works on AT&T locked phones, though.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=2696368]TPMJB[/MENTION], just follow the post#93 to get the required update.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] TPMJB:
Ah, well I bought an AT&T sim card off eBay so I guess I can try it once I get it
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] nitrosbacksh94:
first off, thanks to everyone for their hard work in making this possible.

second, I followed the guide (LMG820AT-00-V20d-LAO-COM-DEC-17-2019-ARB00+1) and everything appears to work properly until 'Launching Privileged Shell' at which point it spits back out to starting adb shell. same as Espen115 earlier. my cmd window looks just like his log. I tried j4nn recommendation but seems like I'm supposed to do something more. Any help would be GREATLY appreciated.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
You on sprint? Did you try T codes?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] nitrosbacksh94:
thanks for your reply. I am on tmobile. yes i have tried SOME t codes, i think 2 6 and 14 but i was unsure if i was even trying them right. if it fails to get temp root do i just change the number on the end and hit enter again? or do i have to restart the phone and process? All the t codes i tried resulting in the script hanging after 'Launching Priviliged Shell' with 'alphalm: /data/local/tmp $'

Thanks again for any help :)
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
Did you do this?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] nitrosbacksh94:
yes and i am running supported firmware (LMG820AT-00-V20d-LAO-COM-DEC-17-2019-ARB00+1)
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
Is that one of these?
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
Tmo is only showing January

---------- Post added at 09:33 PM ---------- Previous post was at 09:31 PM ----------

You can join the telegram group and Alot more people could probably help you.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] nitrosbacksh94:
I probably will hop on the telegram. I am running the 'sprint g8 fw 20d' i actually got the phone on pie and it auto updated to 20d before i could stop it with icebox. Do you know where i can find the telegram? thanks for your patience and assistance.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] Shtiff1:
LG V50 - G8 - G8S - G8X ThinQ

LG V50 - G8 - X/S ThinQ Community

https://t.me/v50thinq
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
new temp root version released

added support for Amazon G8 target and hopefully fixed not getting a root shell problem with mroot2 on G8 - released as v50g8-mroot3
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] j4nn:
[MENTION=4862833]Shryvone21[/MENTION], please test the v50g8-mroot3 just released - should support your target with stable root shell including possibility to start magisk from it

[MENTION=10878625]josh0321[/MENTION], please test your Amazon G8 target with v50g8-mroot3
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] jdushey:
Do you know if there is an exploit to root the LM-G850QM which essentially is a G8X ThinQ phone?

I can't seem to find one.
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] antintin:
No, sorry
[LG G8 ROMs, Kernels, Recoveries, & Other Developme] josh0321:
It is working! Thank you!