[LG G5 Questions & Answers] bennylava:
So I've made it to all the way to dirtycow, and it's time to use this exploit to gain control so I can flash TWRP recovery. I'm following the guide linked below. I'm somewhat intimidated by giving all these commands, as I don't know what most of them do. So I'll just post it up, and place my question in bold italics to the right of each command I don't understand. Hopefully someone here can clear it up for me. From the guide in the link:

adb push dirtycow /data/local/tmp

adb push recowvery-applypatch /data/local/tmp

adb push recowvery-app_process64 /data/local/tmp <-- I think I understand all this. You just put

adb push recowvery-run-as /data/local/tmp all these files in a folder somewhere and

cd to that folder then start using adb to push them to the phone right?

adb shell <-- Switching to a different shell? Weren't we already using the adb shell? Why do this?

$ cd /data/local/tmp <-- Why are we doing this?

$ chmod 0777 * <-- No idea what this is

$ ./dirtycow /system/bin/applypatch recowvery-applypatch <-- Didn't we do all this with the adb push stuff above?

"<wait for completion>"

$ ./dirtycow /system/bin/app_process64 recowvery-app_process64

"<wait for completion, your phone will look like it's crashing>"

$ exit

adb logcat -s recowvery <-- I understand this because I understand using

"<wait for it to tell you it was successful>" adb to issue commands to the phone

"[CTRL+C]"

adb shell reboot recovery

"<wait for phone to boot up again, your recovery will be reflashed to stock>" <-- Ok no problem

adb shell <-- Again, I thought we were already using the adb shell for all this

$ getenforce <-- No idea...?

"<it should say Permissive, adjust source and build for your device!>"

$ cd /data/local/tmp <-- Same question again I guess... the guide never said to place anything in there

$ ./dirtycow /system/bin/run-as recowvery-run-as

$ run-as exec ./recowvery-applypatch boot

"<wait for it to flash your boot image this time>"

$ run-as su <-- I think I understand this.. Super User. Run the next thing as root. Correct?

(You need to rename the twrp img to "twrp.img" and put in the root of your internal storage, OR you can use this adb push command. The next two steps wont be neccessary if already done so.) <-- Ok that won't be a problem I'll just use the adb push command

adb push twrp-3.0.2-x-xxxx.img /sdcard/twrp.img <-- No problem here

adb shell <-- same question as before - Thought we were already using the adb shell?

run-as exec dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery

"<wait for it to complete>" <-- Sounds like it's going to install TWRP now I guess..

$ reboot recovery <-- I understand this.

---

You should be in TWRP now, <-- OK Great finally!

flash supersu and the verity 4.1 zips. <-- How exactly? More adb push commands? I'm a pretty big newb, I honestly don't know what to do here. Fastboot flash? It knows how to unpack a .zip and exactly where to install everything?

[Format Data] will remove internal storage encryption. so back up everything you need to with nandroid. lg backup, or titanium. (So i saw that they have updated verity zips but i just used 4.1)

I prefer lg backup, its easiest. <--I don't need to save anything

After you format data reflash supersu and verity zips for the hell of it. (you dont have to i dont think but i just did anyway) <-- Since you don't have to, I'm not going to do this. So I guess I should have already put Lineage 17 on my SD card by now? And since I'm already in the TWRP custom recovery, I can just tell it to install Lineage... Correct? If I find that after I've completed all these steps, I'm not in TWRP recovery, do I just power off the phone and hold Volume Up while plugging in the USB C connector, as normal? To get me into TWRP.

Thank you and your help is greatly appreciated!