yashsingh1/xdaforums huggingface dataset:
[LG V50 ThinQ Guides, News, & Discussion] robertyco_32:
Hello, this is my log, even so my phone restarts, I cannot put the first line of 1,2,3, I have the sprint model

C:\Users\Josh\Downloads\opera autoupdate\platform-tools>adb shell

flashlm:/ $ cd /data/local/tmp

flashlm:/data/local/tmp $ ./v50g8-mroot

[+] factoryversion = 'LMV450AT-00-V20a-LAO-COM-JAN-15-2020-ARB00+2'

[+] Mapped 200000

[+] selinux_enforcing before exploit: 1

[+] pipe file: 0xfffffff2d8b57800

[+] file epitem at fffffff2bbd38580

[+] Reallocating content of 'write8_inode' with controlled data...[DONE]

[+] Overwriting 0xfffffff2d8b57820 with 0xfffffff2bbd385d0...[DONE]

[+] Write done, should have arbitrary read now.

[+] file operations: ffffff86b3821250

[+] kernel base: ffffff86b2280000

[+] init_cred: ffffff86b462e588

[+] memstart_addr: 0xffffffce00000000

[+] First level entry: 124f0a003 -> next table at fffffff324f0a000

[+] Second level entry: 1ed8cf003 -> next table at fffffff3ed8cf000

[+] sysctl_table_root = ffffff86b465b098

[+] Reallocating content of 'write8_sysctl' with controlled data.....[DONE]

[+] Overwriting 0xfffffff3f5389068 with 0xfffffff36a562000...[DONE]

[+] Injected sysctl node!

[+] Reallocating content of 'write8_selinux' with controlled data...[DONE]

[+] Overwriting 0xffffff86b4dddffc with 0x0...[DONE]

[+] Node write8_inode, pid 12828, kaddr fffffff2c48c3100

[+] Replaced sendmmsg dangling reference

[+] Replaced sendmmsg dangling reference

[+] Node write8_selinux, pid 12756, kaddr fffffff2bbd6d100

[+] Replaced sendmmsg dangling reference

[+] Replaced sendmmsg dangling reference

[+] Node write8_sysctl, pid 13097, kaddr fffffff335d4e800

[+] Replaced sendmmsg dangling reference

[+] Replaced sendmmsg dangling reference

[+] Cleaned up sendmsg threads

[+] epitem.next = fffffff2d8b57820

[+] epitem.prev = fffffff2d8b578d0

[+] Launching privileged shell

root_by_cve-2020-0041:/data/local/tmp #

C:\Users\Josh\Downloads\opera autoupdate\platform-tools>./magisk-start.sh -1
[LG V50 ThinQ Guides, News, & Discussion] Shtiff1:
Did you add end part?
[LG V50 ThinQ Guides, News, & Discussion] robertyco_32:
it does not let me and put the next line because it is blocked and restarted

"Invalid argument"
[LG V50 ThinQ Guides, News, & Discussion] Inerent:
Updated donations:

Максим Компанцев	10,00*USD to Inherent

Pow San Liu	3 EUR to Inherent

Brandon Burchfield	10 USD to Inherent

Brandon Burchfield	10 USD (or more, idk what J4nn got) to [MENTION=4418980]j4nn[/MENTION]
[LG V50 ThinQ Guides, News, & Discussion] lukxx:
Hey, I have LMV500EM, I've heard that we can get permanent root for it now, but can't seem to find where. This is the only thread that has any action happening in it, so could you please point this noob to the right direction? :)
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
Already updated in the donations section of the G8 temp root thread (24-05-2020 at 21:53).

Also thanked in the G8 thread in the post#57 (24-05-2020, 21:57).
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
I need it to compare with those who get a reboot instead
[LG V50 ThinQ Guides, News, & Discussion] Shtiff1:
Fixed, passing safety net! ?
[LG V50 ThinQ Guides, News, & Discussion] robertyco_32:
I already have magisk installed but even so I cannot make the temporary root work as the tutorial says and my own settings reboot I wait 2,5,10 minutes and it is always the same it reboots I leave log for more details.

PS C:\Users\Josh\Downloads\opera autoupdate\platform-tools> adb shell

flashlm:/ $ cd /data/local/tmp

flashlm:/data/local/tmp $ ./v50g8-mroot

[+] factoryversion = 'LMV450AT-00-V20a-LAO-COM-JAN-15-2020-ARB00+2'

[+] Mapped 200000

[+] selinux_enforcing before exploit: 1

[+] pipe file: 0xffffffd605965600

[+] file epitem at ffffffd627640d00

[+] Reallocating content of 'write8_inode' with controlled data.....[DONE]

[+] Overwriting 0xffffffd605965620 with 0xffffffd627640d50...[DONE]

[+] Write done, should have arbitrary read now.

[+] file operations: ffffff85fae21250

[+] kernel base: ffffff85f9880000

[+] init_cred: ffffff85fbc2e588

[+] memstart_addr: 0xffffffeac0000000

[+] First level entry: e71e0003 -> next table at ffffffd6271e0000

[+] Second level entry: eaaae003 -> next table at ffffffd62aaae000

[+] sysctl_table_root = ffffff85fbc5b098

[+] Reallocating content of 'write8_sysctl' with controlled data..........[DONE]

[+] Overwriting 0xffffffd735389b68 with 0xffffffd633e86000...[DONE]

[+] Injected sysctl node!

[+] Reallocating content of 'write8_selinux' with controlled data...[DONE]

[+] Overwriting 0xffffff85fc3ddffc with 0x0...[DONE]

[+] Node write8_inode, pid 14541, kaddr ffffffd6451b0680

[+] Replaced sendmmsg dangling reference

[+] Replaced sendmmsg dangling reference

[+] Node write8_selinux, pid 15055, kaddr ffffffd702736680

[+] Replaced sendmmsg dangling reference

[+] Replaced sendmmsg dangling reference

[+] Node write8_sysctl, pid 15000, kaddr ffffffd6559b6700

[+] Replaced sendmmsg dangling reference

[+] Replaced sendmmsg dangling reference

[+] Cleaned up sendmsg threads

[+] epitem.next = ffffffd605965620

[+] epitem.prev = ffffffd6059656d0

[+] Launching privileged shell

root_by_cve-2020-0041:/data/local/tmp # ./magisk-start.sh -1

+ FRESH=false

+ '[' -1 '=' --fresh ']'

+ '[' ! -e /data/adb/magisk/busybox ']'

+ FRESH=true

+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'

Load policy from: /sys/fs/selinux/policy

fopen: /sys/fs/selinux/policy failed with 22: Invalid argument

1|root_by_cve-2020-0041:/data/local/tmp #

PS C:\Users\Josh\Downloads\opera autoupdate\platform-tools>
[LG V50 ThinQ Guides, News, & Discussion] Lishoo:
Question about different model support

[MENTION=4418980]j4nn[/MENTION] how about letting users of LG G6 to use this exploit on 9.0 PIE, can you give us some hints what needs to be changed in the original source code?
[LG V50 ThinQ Guides, News, & Discussion] antintin:
This is an Android 10 only exploit. Anyway, all g6 users have bl unlock anyway I thought?
[LG V50 ThinQ Guides, News, & Discussion] Lishoo:
Why do you think it's only Android 10 related?

Only this models can be officially unlocked:

• LG V50: LMV500EM for the European market

• LG V40: LMV405EBW for the European market

• LG G7: LMG710EM for the European market

• LG V30: H930 and H930G for the European market

• LG G6: US997.USA for the U.S. open market

• LG G6: H870 for the European market

• LG V20: US996.USA for the U.S. open market

• LG V10: H960A for the European market and Android M (Except France)

• LG G5 SE: H840 for the European market

• LG G5: RS988.USA for the U.S. open market

• LG G5: H850 for the European market

• LG G4: H815 for the European market
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=9926403]Lishoo[/MENTION], [MENTION=10121203]antintin[/MENTION], actually the exploit is not specific to android major version (10 / 9 / whatever).

All these exploits need a vulnerable kernel. If any firmware / android release should be vulnerable entirely depends on the kernel if it got the bug merged in or not.

So this CVE-2020-0041 can be present in android 9 too, depending on vendor's kernel update / merging / releasing activity and also if the bug gets merged in google's android kernel first (it got into pie's too).

So on some devices this can be exploited with pie while not having Q at all. Others get it with Q only for few fw versions. And some may not get it at all.

So I would recommend checking kernel sources across all available fw versions (if they can be switched by manual flashing) first to verify the vulnerability presence on particular version.

A first quick test might be to run a not tailored exploit with current fw and see if it does anything or not (if it reboots the phone for example, the kernel would be vulnerable).

I cannot provide more specific hints, it requires knowledge of reverse engineering and kernel internals, that's just too much to explain here.
[LG V50 ThinQ Guides, News, & Discussion] awdrifter:
Is this like a tethered root where it resets after reboot or does it still expire without rebooting after some time?
[LG V50 ThinQ Guides, News, & Discussion] antintin:
It's a temp root. Each time you reboot it's gone. But if you have stable temp root, you can bootloader unlock.
[LG V50 ThinQ Guides, News, & Discussion] awdrifter:
Cool, that doesn't sound too bad. I might look for a cheap LG V50 to play with.
[LG V50 ThinQ Guides, News, & Discussion] TheLoonyRebel:
As of right now the Sprint V50 lacks stable temp root. Just a heads up in case you are thinking of getting that model.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=4490217]awdrifter[/MENTION], [MENTION=2440946]AngryManMLS[/MENTION], that is not precise - there is stable temp root for V50 - just use the V500N20m-testJ.zip. What is not stable yet is temp root with support for magisk started from it. So you can actually get a stable adb temp root shell with V500N20m-testJ. That may be used for bootloader unlock eventually, not sure how is the state with that though.
[LG V50 ThinQ Guides, News, & Discussion] TheLoonyRebel:
This is what happens when I'm behind on the things in the Telegram chat. LOL! Thanks for the update j4nn.
[LG V50 ThinQ Guides, News, & Discussion] TheLoonyRebel:
Temp root not working on my Sprint V50 January 2020 patch. Log attached. [MENTION=4418980]j4nn[/MENTION]

Here's the memdump I just took from my V50. I used target value 11 with the G8/V50 mem dump tool.

https://www.androidfilehost.com/?fid=12420606652095397954
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=2440946]AngryManMLS[/MENTION], what result do you get with v50g8-mroot?

What is your V50 variant?

I forgot that the V500N20m-testJ is only designed for one target, the Korean V50 with 20m firmware version.

That has been stable with Inerent's V50. Obviously you have something different.
[LG V50 ThinQ Guides, News, & Discussion] TheLoonyRebel:
Sprint V50.

v50g8-mroot reboots after using.

FYI I'm TheLoonyRebel on the Telegram channel.
[LG V50 ThinQ Guides, News, & Discussion] awdrifter:
I found a dual screen model LM-V510N on eBay, is that compatible with this exploit? It's not listed in the first post. Thanks.
[LG V50 ThinQ Guides, News, & Discussion] spa1978:
hello,

for my v50 sprint lock I wanted with the root to recover the MSL code ... unfortunately with the guide after 10 seconds it restarts

But I recovered the SPC code do you have any solution ???
[LG V50 ThinQ Guides, News, & Discussion] TheLoonyRebel:
We're still trying to figure out the rebooting after temp root issue.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
stable temp root for V50 including magisk setup

I have finally managed to fix the problem causing immediate reboot/crash right after obtaining a temp root shell reported here to happen with LG V50 phones using v50g8-mroot.

Hopefully this allows to get stable temp root including temp magisk start up with V50.

Also added support for one Verizon G8 and two AT&T G8 targets.

Released as v50g8-mroot2.zip available in the first post, enjoy...

[MENTION=5429208]andrewwm[/MENTION], [MENTION=10125704]aiap[/MENTION], [MENTION=4946861]robertyco_32[/MENTION], [MENTION=4490217]awdrifter[/MENTION], [MENTION=2440946]AngryManMLS[/MENTION], [MENTION=7826305]spa1978[/MENTION]
[LG V50 ThinQ Guides, News, & Discussion] antintin:
Great news! Thanks for the hard work.... It seems less and less of the original testers can help you now since most of them bl unlocked
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=10121203]antintin[/MENTION], well it would be nice to test and confirm if it works here (and in G8 thread too) as this build had not been tested.
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
Good news! The Sprint V50 temp root now lasts a lot longer. I was able to leave it up while using my phone until it crashed about a minute or two later.
[LG V50 ThinQ Guides, News, & Discussion] Shtiff1:
Did you just do it once?
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
I tried it now a few times and it worked much longer. If I do something intensive like changing the battery saver modes, it crashes the phone.
[LG V50 ThinQ Guides, News, & Discussion] Shtiff1:
See if you can catch a log for [MENTION=4418980]j4nn[/MENTION]

---------- Post added at 03:53 AM ---------- Previous post was at 03:51 AM ----------

Maybe let if run without doing anything for a while. Then try to get a log for [MENTION=4418980]j4nn[/MENTION]
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
Please be sure to follow the guide in the second post to setup magisk from temp root carefully. I would not recommend changing 'battery saver modes' with temp root as that sounds like killing half of android running processes and that really can result with a crash if some of then could be influenced by the exploit.

See also the other TIPS FOR BETTER STABILITY OF THE EXPLOIT at the end of the second post.

Please post the log from the terminal used to start the exploit followed by start up of magisk including time for how long you could use the phone after that with magisk working, mentioning what you did last before the phone rebooted.
[LG V50 ThinQ Guides, News, & Discussion] andrewwm:
Got it. When I was running the exploit long before, every time I rebooted the phone the 'battery saver' would go to back to maximum. The reddit sync app would sign me out after every reboot as well. Really strange behavior. This persisted every reboot, not just crashes.

Does setting up magisk do anything permanent? Do I risk bricking the phone will magisk root?
[LG V50 ThinQ Guides, News, & Discussion] spa1978:
you are really good guys .. this morning i have some free hours ... i will try with my v50 sprint and send log + procedure used
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=5429208]andrewwm[/MENTION], I would consider strange what you have described.

Basically using the temp root exploit to start up magisk does not do any permanent changes.

As soon as you reboot, temp root is gone including magisk daemon, but magisk manager is still installed. When you start that magisk manager app without re-doing the temp root, you would just see "magisk not installed" kind of error in the manager.

There is only magisk daemon configuration setup under /data/adb/magisk/ directory, which is not accessible by non-root user (i.e. you cannot remove it without root, you cannot access it from normal adb shell and no app could access it either). That would obviously get removed with a factory reset together with other 'data'.

Concerning bricking risks - you need to know what you are doing when making changes somewhere or allowing root access to something.

Obviously you cannot change anything in /system and /vendor partitions (or any other partition covered by avb 2.0 in android 10, I am not sure about exact list of partitions protected by that on Q). Also avoid 'upgrading' (or other installing) of magisk within magisk started from the temp root - that could result with flashing of patched 'boot' image, which would not boot with still locked phone obviously.

You can safely use apps that need root for their work like iptables based firewall or backup solution apps.

Many magisk modules that work in 'system less' mode could work too as they do not really make any modification permanently but instead use runtime only 'modification' via bind mounts. You obviously need to start the exploit each time after reboot including magisk start up, which could then start the installed modules. Due to the boot up timing difference with regard to other system services and apps, you may encounter that some module would not work as expected, because it has been started later than designed. It may help to restart influenced services/apps, but that is module specific.

Magisk hide may also work this way, so it can happen that some app detects root because the hide function has been started too late. So that app may need to be force stopped and restarted possibly even with clear of it's data to remove the record that root has been detected.

For permanent changes in system partitions (including permanent root) you would need to unlock bootloader first.
[LG V50 ThinQ Guides, News, & Discussion] py0zz1:
/bin/dd crash

Hi.

After getting root authority using temp root, the machine reboots when trying to dump system files to /bin/dd.

Do you know anything about this?
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
[MENTION=10837445]py0zz1[/MENTION], it is known that v50 is not that stable with temp root as g8 is with the same exploit binary. The reason for that is unknown. Just read few pages back in this thread, there are some tips to make it more stable.

Unfortunately I do not even get feedback I ask for, not having the target phone, so my testing options are very limited.
[LG V50 ThinQ Guides, News, & Discussion] d_Barood:
https://ibb.co/rsb2Qgs

I am getting this

what to do ?
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
new temp root version released

hopefully stability improved even more with V50 allowing stable magisk start from temp root - released as v50g8-mroot3
[LG V50 ThinQ Guides, News, & Discussion] goochbun2:
Can I do the sprint g8 volte and wifi calling fix for TMobile, using this method on a v50. I know I'll have to change somethings. But my worry is changing build.prop and 2 other files with a locked bootloader?

Also if we can get a sprint v50 unlocked bootloader and then see if we can get the TMobile 5g fix. Since TMobile killed 5g for the phone since it didn't work with TMobile 5ge or fake 5g kn n71
[LG V50 ThinQ Guides, News, & Discussion] antintin:
You'll have to unlock the bootloader for any volte fix. Join the telegram group please
[LG V50 ThinQ Guides, News, & Discussion] goochbun2:
I keep hearing about telegram and yet I don't have any idea how to join or find it. I know I'm old I guess.

Also I hope the kdz handling changes with TMobile owning sprint now and if they convert the v50 sprint model I won't need to root or volte fix. But it may be worth it since the 5g scam from TMobile killing 5g on devices because of tower bugs in Nokia equipment. The s20 had the same patch that needed applied to make it work again
[LG V50 ThinQ Guides, News, & Discussion] antintin:
That very likely won't change unfortunately as there's differences in hardware, and they can't do anything remotely to switch hardware locks. I mean maybe they will somehow push an update or make a kdz for the Sprint model, but again, they probably don't care and won't do it.

For the telegram group just search "lg v50" in telegram; apparently it's against the rules to post links for that here
[LG V50 ThinQ Guides, News, & Discussion] goochbun2:
They already converted sprint S10 and s20 to TMobile. And with the 1 million customers moved to TMobile from sprint. And putting more strain on old 2g and 3g equipment has caused a 11 day up and down outages. Heck the Monday they moved all those customers over caused a huge outage that the FCC is now having an investigation.

LG reasons for upgrading LG v50

1. Cold boot exploit.

2. Ransom ware

3. LG v50 Android 11 eventually.

TMobile reason to update

1. Risking LG partnerships on budget phone market.

2. More strain on old equipment

3. CEO promising 1st Gen 5g phones compatibility

(S10 already converted)

Not converting many phones to TMobile can also cost them customers especially ones that paid for a flagships. Customers like myself was less willing to purchase a new device from T-Mobile or sprint because it wasn't worth the contracts and they actually didn't offer it free for the upgrade they still wanted money for the s20 replacement. Which was very unfortunate. But this caused many sprint customers to not upgrade the LG v50. The issue is when roaming on TMobile from sprint the volte also doesn't work so it's a matter of time that TMobile will have more issue the next wave of devices being put on TMobile towers if they don't provision volte on the network
[LG V50 ThinQ Guides, News, & Discussion] EJudeGarcia:
Is this root for korean lg v50???
[LG V50 ThinQ Guides, News, & Discussion] awdrifter:
Is the LM-V450PM rootable with this exploit? My S8+'s screen cracked again, it's time to get a new phone.
[LG V50 ThinQ Guides, News, & Discussion] j4nn:
exploit sources released

Exploit sources for all temp root releases are available at my github here.
[LG V50 ThinQ Guides, News, & Discussion] patato21:
Is it possible to use this root exploit on another phone like the V30? I'm trying to root the H932 model without the ridiculous FWUL and LAF method. It's already bootloader unlocked, I just need to flash the TWRP recovery image but LG is known for bricking download mode on T-Mobile phones which wont allow you to boot or flash any images. It has the August 2019 LG Security patch and is running Pie with the 4.4.153 kernel.
[LG V50 ThinQ Guides, News, & Discussion] AndyRozman:
I have Sprint firmware LM-V450PM, with Android 10 (August patch I think) - (SW version: V450P20f). Will this root be extended for that model.
[LG V50 ThinQ Guides, News, & Discussion] antintin:
It can't be
[LG V50 ThinQ Guides, News, & Discussion] AndyRozman:
Why not? Is problem version of Phone or version of Android?
[LG V50 ThinQ Guides, News, & Discussion] antintin:
Security patch
[LG V50 ThinQ Guides, News, & Discussion] AndyRozman:
IS there any way for me to downgrade to January version? I was trying to get KDZ but no luck so far... Switching to different slot put me in June patch version, but even that was overriden now, because I forgot to disable automatic upgrade...
[LG V50 ThinQ Guides, News, & Discussion] antintin:
No, sorry. There's no kdzs for the sprint variant. You'll have to wait till we can use edl
[LG V50 ThinQ Guides, News, & Discussion] yobakolobok:
Just flashed "LMV500NAT-00-V20m-LAO-COM-MAR-10-2020+0", as it was the freshest one. The first time i tried a binary from OP it seemed to hung up on step

> Reallocating content of 'write8_inode' with controlled data.................

Then I stopped it with Ctrl+C, took it out of the dual screen case and then it worked as intended. The problem is, when I close the root cli to push some additional files, I run this binary again and now it reboots the phone for some reason. The phone seems to work fine, but every time the binary passes "write8_inode" it reboots the phone. Is there something I might irreversably screw so I need to reflash, or is there a simpler way to get back to root cli?

UPD: seemed to work on 5th, I think, attempt. Seems that I didn't brick the needed component and now even magisk works. I guess I'll leave it there for someone, it's magisk-setup first, then binary, then magisk-start, everything else caused reboot.
[LG V50 ThinQ Guides, News, & Discussion] shreddocaster:
Hello, what is edl?
[LG V50 ThinQ Guides, News, & Discussion] revized:
Excellent work! Will Donate to help root progress :)
[LG V50 ThinQ Guides, News, & Discussion] nellatl:
Does this work for the sprint and American versions of the lg v50?
[LG V50 ThinQ Guides, News, & Discussion] rodken:
https://www.xda-developers.com/exploit-qualcomm-edl-xiaomi-oneplus-nokia/
[LG V50 ThinQ Guides, News, & Discussion] en11gma:
is there a way to root or downgrade and then root my sprint lg v50 running v450p20f?

i can switch to a different slot and it will show 450p20e
[LG V50 ThinQ Guides, News, & Discussion] shreddocaster:
I am also wondering, as I would like to root my sprint v50 on the August security patch.. I think you can try crossflashing the Verizon kdz and go from there. I haven't had to time to figure out the process. Please let me know if you try it or learn of a better way.
[LG V50 ThinQ Guides, News, & Discussion] en11gma:
Im to scared to crossflash.

someone else is going to have to let me know :)

still a very good phone.

wish it was rooted

volte would be great.

tmobile is killing 3g frequencies in January 2021 so i not sure how this phone is going to work as this is the ferquency it switches to when you make a voice call. It does switch back to LTE after voice call (3g) ends.
[LG V50 ThinQ Guides, News, & Discussion] P.U 93:
Thanks. But i used 'v50g8 root3' to root exploit for lg v500m20f but, i install twrp and re-wipe magisk 20.4 then "adb reboot recovery" it will restart and bootloop. It can't enter TWRP, please help.