[LG V20 Guides, News, & Discussion] Darnrain1:
STANDARD DISCLAIMER: I am not responsible for any damages caused to your phone. Use this guide at your own risk there is no warranty or guarantee.

I only know how to do this in Linux in the terminal. This has only been done on Stock Oreo 8.0, may not work on Nougat never tested. This mod will speed up your phone. We are going to remove a very small program "rctd" that's buried in the phones boot image file. Also there is an antivirus scanner burred in the boot image, it slows the phone down by scanning every file.

This guide is my notes on what I did to remove LG RCT from my H910 Lgv20. But you can use this guide to remove LG RCT from your Lgv20.

guide updated on 6-28-22

Requirements:

Root/Twrp

Lgv20

Stock Oreo 8.0

Linux

You can just copy and paste the commands in the Linux terminal.

In the Linux terminal paste:

install: abootimg

Ubuntu: sudo apt-get install abootimg

Arch: yay -S abootimg

install: fastboot & adb

Ubuntu: sudo apt-get install android-tools-adb android-tools-fastboot

Arch: sudo pacman -S android-tools

Reboot phone into twrp. Connect phone via usb cable. In the Linux terminal paste:

sudo su

mkdir /tmp/test

cd /tmp/test

Get your boot.img

adb shell dd if=/dev/block/bootdevice/by-name/boot of=/tmp/boot.img

adb pull /tmp/boot.img /tmp/test

sync

ls

the boot.img should be on your computer in /tmp/test/

You can unplug the usb cable from the phone. But stay in twrp we will need that later.

abootimg -x /tmp/test/boot.img

mkdir /tmp/test/initrd

cd /tmp/test/initrd

cat ../initrd.img | gunzip | cpio -vid

Going to remove rctd and lge_fota updates & comment out LG RCT access also going to comment out lge_handle_panic. And comment out triton service. You should be able to just copy all and paste all at once. Also I found a speed tweak by changing dalvik.vm.dex2oat-Xmx=512m to dalvik.vm.dex2oat-Xmx=256m will increase speed of phone.

rm /tmp/test/initrd/sbin/bnrd
rm /tmp/test/initrd/sbin/rctd
rm /tmp/test/initrd/sbin/lge_fota
sed -i '605 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '964 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '20 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '790 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '1029 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '1057,1058 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '1067 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '10 s/^/#/' /tmp/test/initrd/nonplat_seapp_contexts
sed -i '485 s/^/#/' /tmp/test/initrd/nonplat_property_contexts
sed -i '1343 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '129 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '133 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '137 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '141 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '145 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '7,13 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '17 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '19,29 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '32,33 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '83,105 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '232,233 s/^/#/' /tmp/test/initrd/init.elsa_core.rc

you can check to make sure it worked with this command

clear
ls /tmp/test/initrd/sbin/bnrd
ls /tmp/test/initrd/sbin/rctd
ls /tmp/test/initrd/sbin/lge_fota
sed -n 605p /tmp/test/initrd/nonplat_file_contexts
sed -n 964p /tmp/test/initrd/nonplat_file_contexts
sed -n 20p /tmp/test/initrd/nonplat_file_contexts
sed -n 790p /tmp/test/initrd/nonplat_file_contexts
sed -n 1029p /tmp/test/initrd/nonplat_file_contexts
sed -n 1057,1058p /tmp/test/initrd/nonplat_file_contexts
sed -n 1067p /tmp/test/initrd/nonplat_file_contexts
sed -n 10p /tmp/test/initrd/nonplat_seapp_contexts
sed -n 485p /tmp/test/initrd/nonplat_property_contexts
sed -n 1343p /tmp/test/initrd/nonplat_file_contexts
sed -n 129p /tmp/test/initrd/init.msm8996_core.rc
sed -n 133p /tmp/test/initrd/init.msm8996_core.rc
sed -n 137p /tmp/test/initrd/init.msm8996_core.rc
sed -n 141p /tmp/test/initrd/init.msm8996_core.rc
sed -n 145p /tmp/test/initrd/init.msm8996_core.rc
sed -n 7,13p /tmp/test/initrd/init.elsa.power.rc
sed -n 17p /tmp/test/initrd/init.elsa.power.rc
sed -n 19,29p /tmp/test/initrd/init.elsa.power.rc
sed -n 32,33p /tmp/test/initrd/init.elsa.power.rc
sed -n 83,105p /tmp/test/initrd/init.elsa.power.rc
sed -n 232,233p /tmp/test/initrd/init.elsa_core.rc

This is what it should look like. If not, then do not flash the modded myboot.img. I am not 100% sure all Lgv20 boot images are the same. I am 99% sure they should be the same, but just in case.

ls: cannot access '/tmp/test/initrd/sbin/bnrd': No such file or directory
ls: cannot access '/tmp/test/initrd/sbin/rctd': No such file or directory
ls: cannot access '/tmp/test/initrd/sbin/lge_fota': No such file or directory
#/dev/block/platform/.*/by-name/rct u:object_r:rct_block_device:s0
#/dev/rct u:object_r:rct_device:s0
#/(system/vendor|vendor)/bin/triton u:object_r:triton_exec:s0
#/sys/devices/system/cpu/triton(/.*)? u:object_r:sysfs_triton:s0
#/dev/triton:io u:object_r:triton_device:s0
#/dev/socket/bnrd u:object_r:bnrd_socket:s0
#/dev/socket/ccmd u:object_r:ccmd_socket:s0
#/system/bin/ccmd u:object_r:ccmd_exec:s0
#user=_app seinfo=platform name=com.lge.rctprovider domain=platform_app type=app_data_file
#sys.lge.rooted u:object_r:system_prop:s0
#/sys/module/lge_handle_panic/parameters/gen_modem_panic u:object_r:sysfs_gen_modem_panic:s0
# write /sys/module/lge_handle_panic/parameters/cancel_boot_lockup_detect 1
# write /sys/module/lge_handle_panic/parameters/pause_boot_lockup_detect 1
# write /sys/module/lge_handle_panic/parameters/pause_boot_lockup_detect 0
# write /sys/module/lge_handle_panic/parameters/cancel_boot_lockup_detect 1
# write /sys/module/lge_handle_panic/parameters/powerctl_lockup_detect ${sys.powerctl}
#service triton /system/vendor/bin/triton
# class main
# user root
# group system
# socket triton-client stream 660 system system
# disabled
# oneshot
# start triton
# write /sys/devices/system/cpu/triton/debug 16
# write /sys/devices/system/cpu/triton/enable 1
# write /sys/devices/system/cpu/triton/enforce 0
# write /sys/devices/system/cpu/triton/cur_policy 0
# chown system system /sys/devices/system/cpu/triton/enable
# chmod 664 /sys/devices/system/cpu/triton/enable
# chmod 600 /sys/devices/system/cpu/triton/aevents
# chmod 600 /sys/devices/system/cpu/triton/bevents
# chown system system /sys/devices/system/cpu/triton/cur_policy
# chmod 664 /sys/devices/system/cpu/triton/cur_policy
# chmod 664 /sys/devices/system/cpu/triton/debug
# chown system system /sys/devices/system/cpu/triton/enable
# chmod 644 /sys/devices/system/cpu/triton/enable
#service fg-dump /vendor/bin/sh /vendor/bin/fg_dump.sh 10 /data/logger/fg.log
# user root
# group root system
# class main
# disabled
# oneshot
#on property:persist.service.fg.enable=0
# stop fg-dump
#on property:persist.service.fg.enable=1
# restart fg-dump
#on property:persist.service.fg.enable=2
# restart fg-dump
#on property:persist.service.fg.enable=3
# restart fg-dump
#on property:persist.service.fg.enable=4
# restart fg-dump
#on property:persist.service.fg.enable=5
# restart fg-dump
#on property:persist.service.fg.enable=6
# restart fg-dump
#on property:persist.service.fg.enable=99
# restart fg-dump
# setprop ro.ssbd.session /dev/block/bootdevice/by-name/eksst
# export HALLIC_STATUS_PATH /sys/class/switch/smartcover/state

continue making the myboot.img

find . | cpio --create --format='newc' | gzip > ../myinitd.img

cd /tmp/test

nano bootimg.cfg

delete the first line move everything up one line

bootsize = 0x19b15d3

ctrl-x y enter

make the modded myboot.img file

abootimg --create myboot.img -f bootimg.cfg -k zImage -r myinitd.img

plug usb cable back into phone. Phone should still be in twrp.

Going to write all zeros to fota and rct device. Updates and LG RCT devices we don't need them. And going to remvoe the dumpstate file it saves the logcat logs to the eMMC drive and slows down the phone a lot. The logcat files will still be saved to ram up to 4M but they will be deleted when you restart or it runs out of ram. This will speed up the phone removing dumpstate. Also there is a speed tweak need to change five lines in the build.prop file.

Note: If you have already used Auto_Debloat you may get some error messages file not found that's okay. It just means Auto_Debloat took care of the files for you.

mkfs.ntfs /dev/block/bootdevice/by-name/fota
mkfs.fat /dev/block/bootdevice/by-name/rct
adb shell umount -l /system
adb shell mount /system
adb shell rm /system/vendor/bin/subsystem_ramdump
adb shell rm /system/bin/dumpstate
adb shell rm /system/etc/init/dumpstate.rc
adb shell rm /system/bin/ccmd
adb shell rm /system/vendor/bin/triton
adb shell rm /system/vendor/bin/fg_dump.sh
adb shell mount /persist
adb shell rm /persist/rct
adb shell rm /persist/rct.cfg
adb shell umount -l /persist
adb shell umount -l /system

wipe dalvik cache and cache

reboot phone into bootloader aka fastboot from twrp

fastboot flash boot myboot.img

fastboot reboot

exit out of root user

exit

You can unplug usb cable now done.

And that is what I did to remove LG RCT from my Lgv20 phone. One thing to note is that you can not flash a new kernel to the boot.img or you will loose the modded boot.img everything will be reset back to default. If you need to flash a Kernel then just mod the boot.img again afterwards.

If for some reason your phone does not boot anymore, we are going to flash the original boot.img

Power off the Lgv20, or remove battery. Hold volume down while plugging in the usb cable.

sudo su

cd /tmp/test

fastboot flash boot boot.img

fastboot reboot

exit out of root user

exit

done