RootMyTV.github.io

RootMyTV.github.io copied to clipboard

After trying basically everything on the web to downgrade & root my tv I finally found a working solution here (just translate with ur browser):

Original Guide Guide translated by pbatard (You will still need the Original Guide to get the .ipk files)

As we now know, the Guide should work with 2019/2020 and even older LG TV's. Thanks to @pbatard for translation and clarify.

it works!

i think it works. step 9 of the guide (Go to the Homebrew channel, the application will prompt you to reboot, press restart. That's all, the root is received;) didnt prompt me for a reboot. i have ssh and telnet access.

I can't seem to download telnet via homebrew. Is there anyway you can provide me with the IPK?

Thanks for that guide, it's working for me. Will this continue to work after the Dev timeout runs out? Is an LG update block needed after that, to stop it from breaking?

[UPDATED 2022.12.01 to add the local touch /var/log/crashd/"x;telnetd -l sh" alternate method]

Confirmed that it worked for me on an OLED CX with firmware 04.40.20.

Here is a rewriting of the guide linked by @cowl0ver above, with some slight clarifications for items I had trouble with as well as an alternative local method to run the "crashd exploit":

1. Get developer mode by registering an account here.
   It is possible that you may have be forced to use a mail using a .com domain for registration to work (e.g. gmail.com). You will have to accept a bunch of agreements... which you won't read.

2. Install the ThinQ App on a mobile device, and log onto it using your developer account. This is needed because LG stupidly forces you to go through this step to accept extra licenses, before you can log on to developer account on the TV. Why they can't just produce the additional licenses on the TV, or with the initial registration, and make you accept them there is beyond me!

3. On the TV (for CX models), go to All Settings → General → Additional Settings and set Quick Start+ to disabled. This is needed to ensure that the TV goes through a complete reboot when requested.

4. Install the Developer Mode App from the LG Content Store on the TV and validate that you can log in to your developer account (if you didn't do step 2, you may find that it won't let you, so please do that). Take a note of the IP address and passphrase and, on the left handside, enable Dev Mode Status and Key Server as shown in the picture below, as Dev Manager won't be able to connect to the TV otherwise:

   

5. Install the latest Dev Manager on a PC and launch it.
   Click the Add Device button in Options and fill in the fields Host (with the IP address and Passphrase you got from the TV).

6. In Dev Manager, install the Homebrew Channel 0.5.1 application (that should be listed in the main window) onto the TV.

7. • METHOD 1 (Recommended, as this is the one from the official #rootmytv Discord channel):
     • Still in Dev Manager, click on "terminal"
     • Type the following command then press enter:
       touch /var/log/crashd/"x;telnetd -l sh"
   • METHOD 2 (If the above doesn't work. This requires running external code from a remote server, which is always a potential security risk):
     • On the TV, launch Homebrew Channel (which you will now see in the LG App bar).
     • Click the "Settings" gear icon and select Add repository. Enter https://repo.webosapp.club as a new repository.
     • Go back to the main Homebrew Channel, you should now see a Run telnet/root.telnet application in the list of apps proposed
     • Run root.telnet from the repository.

Either of the above will run the "crashd exploit" and start a telnet server with root access on the TV.

8. Connect to the TV via telnet (port 23) using the same IP address as the one you use previously and enter the following commands exactly (Don't worry if you see library warnings being reported when running the commands, the commands are still being executed fine):

unset LD_PRELOAD
/media/developer/apps/usr/palm/services/org.webosbrew.hbchannel.service/elevate-service
mkdir -p /var/lib/webosbrew/init.d
cp /media/developer/apps/usr/palm/services/org.webosbrew.hbchannel.service/startup.sh /var/lib/webosbrew/startup.sh
rm -rf /var/luna/preferences/devmode_enabled && mkdir -p /var/luna/preferences/devmode_enabled

9. IMPORTANT: On the TV, delete the Developer Mode app. You must do this or else, as @Merri1 commented below, ssh will not work.

10. In telnet type reboot to reboot the TV.

11. Once the TV has rebooted, go to Homebrew channel again, and click the settings gear icon. You should see a greyed out Root status ok indicating that Homebrew channel has root access. Now you can enable the SSH Server by toggling its switch. Once you have done that, click the System reboot paragraph of text (bottom left) to reboot the TV.

12. From now on, an ssh server with root access will be enabled every time you start the TV. 😄
    You can SSH into your TV using the username root and password alpine on port 22 (default SSH port).

13. After this, you can turn on Quick Start+ again if you wish and set other Homebrew channel settings as needed.

Very Good [pbatard]!

10. Connect to the TV via telnet (port 23)

Alternative? (ssh?) I'm using a mac with monterey and telnet is not working..

I installed telnet via homebrew and my tv is now rooted :)

Very Good [pbatard]!

10. Connect to the TV via telnet (port 23)

Alternative? (ssh?)

I'm using a mac with monterey and telnet is not working..

Super nice, finally managed to install homebrew on my old LG :)

11. On the TV, delete the Developer Mode app. if I do this then it is removed homebrew channel after reboot!

p.s. in my case, to connect with telnet, I don't have to use any port. But simply write: telnet 192.168.1.124 (no 22, no 23 port) and everything works (except the problem in step 11)

11. On the TV, delete the Developer Mode app. if I do this then it is removed homebrew channel after reboot!

p.s. in my case, to connect with telnet, I don't have to use any port. But simply write: telnet 192.168.1.124 (no 22, no 23 port) and everything works (except the problem in step 11)

The telnet port 23 is the default, so the telnet client is likely guessing the correct port when you connect. It wouldn't work without the correct port. It's just filling it in for you.

If deleting the Developer Mode all removes homebrew, then I believe the root isn't working correctly. Perhaps before you delete it you should go into the Homebrew app settings and check the box for disabling updates. I don't know if that will change anything, but it is something that I myself did before deleting Developer Mode.

Worked on my C9 with firmware 05.30.11. Did not have to do step 2. Btw for Telnet on Windows you can use Putty.

Works on my 48A1 that was on latest firmware 03.33.11 webos 6.3.1

Working on OLED55C97LA Firmware: 05.30.11

Hi, great tutorial but on start up I get a failsafe mode - a crash has occured duuring previous startup.

This happens everytime, am I missing something?

Cheers

Working on OLED65BX9LB WebOS TV Version: 05.4.1-903 Firmware: 4.40.18

Confirmed working on nano79655pc

Hi, great tutorial but on start up I get a failsafe mode - a crash has occured duuring previous startup.

This happens everytime, am I missing something?

Cheers

same happens to me aswell! just activated quick start+ to avoid the error and the following 2nd boot. I will try to debug the error if I have some time... most likely not before christmas ;)

Another working device OLED65C11LB Firmware: 03.33.11 This is a 2021 model I guess. Listed on 29.04.2021

Today I rooted my C2 using crashed method on firmware 03..21.30. I have root acces, but unfortunately ssh server is not working, only telnet. I rested my tv several times, but each time same problem. Does anyone else have the same problem?

Today I rooted my C2 using crashed method on firmware 03..21.30. I have root acces, but unfortunately ssh server is not working, only telnet. I rested my tv several times, but each time same problem. Does anyone else have the same problem?

@EMP83 I had the same problem on my first attempt. Did you remove the developer mode app at step 9? I missed that the first time around and after repeating the guide with that step, SSH and root access are working fine.

Works perfect on my OLED77C26LD webOS TV-version 7.1.0-43 (mullet-maria) Softwareversion 03.10.43

I think that is the version I'm still on now. Will have to check when I'm back from work. I have the above from a pic. on my phone :)

Working without issues with method no. 1 SM8600PLA F/w 5.30.15 WeboOS TV 4.9.7-12

Didnt work,

LG CX OS 5.4.1-15 FW 40.40.20

Upon reboot the hbchannel root is greyed out says "unelevated". cant seem to re run the sequence. Neither terminal or telnet allow commands to be run. "Permission Denied"

"An error occured during installation: Unable to exec luna-send-pub: Error: connect ECONNREFUSED 127.0.0.1:9922"

Any help would be great, thanks.

Works using method one. tv 65UQ91006LA UQ91006LA webos 7.2.0-43 (mullet-marine)

Firmware version on uq9100?

i cannot connect to my tv and i did everything exactly heres what i got: also i am connected to wireless and not wired because we do not have wired network.

Worked for me. 75QNED826QB Firmware 3.11.51 After the deed was done, I upgraded the firmware to 3.20.## and it still worked - still root.

Working on OLED65BX9LB WebOS TV Version: 05.4.1-904 Firmware: 4.40.19

Thanks it worked on even after giving Failsafe mode error after rebooting in Step 11. FW: 03.11.35 Webos: 7.1.0-63 (mullet maria)

After doing the steps above and enabling SSH, Telnet, "Block System Updates" and "Failsafe mode" i am not able to connect via Telnet or SSH. The Root status is "ok" and installing apps etc. works, but now i am not able to connect to it from my PC in any way. After disabling "Block system updates" again i was able to install the Developer Mode-App again but i am still not able to connect via Telnet. Even disabling, rebooting and enabling SSH and Telnet did not work. Does anybody know how this could work?

Model: OLED77C22LB webOS Version: 7.2.0-44 (mullet-marine) Software Version: 03.21.30