How to Running Recowvery, Flashing TWRP Recovery and Root LG V20 (H918, H830, US996).

Flashing TWRP & Root LG V20. Once you have successfully unlocked bootloader on LG V20, it's time to flash or install TWRP recovery nd root this device. By installing TWRP recovery on Android device the user will get some benefits. For example; the user will able to install a custom ROM and custom kernel to get the faster and better performance on their LG V20 device, The user can block ads from running Apps, the user can automatically applications run at background and it will increase performance and battery life, of course, you can run Titanium Backup to restore all apps and data, and much more fun. 

But there is a little problem when the LG V20 user wants to flash TWRP on their device. We know that installing TWRP recovery directly via fastboot is restricted by a secure system. Therefore this guide will help the LG V20 user to install TWRP using Dirty Cow exploit and using recowvery exploit. If you can understand all of the step below, this would be easy to do. Before we proceed this guide, I would be appreciated to developer jcadduono at this threat.

http://forum.xda-developers.com/v20/development/h918-recowvery-unlock-v20-root-shell-t3490594

This threat for providing a workaround to install TWRP recovery on LG V20 using the Dirty Cow exploit and using recowvery exploit.

Warning :

• Rooting LG V20 device may void phone warranty.
• This guide may cause your LG V20 bricked if you do not follow all step correctly.
• Flashing TWRP will erase all data and installed App, therefore make sure to backup completely your phone.
• The process will take a while, make sure your battery fully charged or at least has 75% - 80% of battery capacity.  

Unlock Bootloader.

There is a different method to unlock bootloader for each LG V20 versions.

1. Unlock Bootloader LG V20 for H918 (T-Mobile) and H830. Here

http://guidebelajar.blogspot.com/2016/12/guide-to-unlock-bootloader-lg-v20-h918-h830.html

2. For LG V20 US996 (U.S. Cellular) - Here

http://guidebelajar.blogspot.com/2016/11/guide-how-to-unlock-bootloader-on-LG-V20-US996.html

Prerequisite.

1. Make sure ADB and fastboot installed on your computer, You can get ADB and fastboot for windows or mac here. extract all file in the same folder. for example c:\adb

http://forum.xda-developers.com/android/software/host-tools-t3402497

2. Download LG USB driver.
• Windows - Here

http://redirect.viglink.com/?format=go&jsonp=vglnk_148221033046416&key=f0a7f91912ae2b52e0700f73990eb321&libId=iwx018a701000n4o000DA1bhr14rgwlxii&loc=http%3A%2F%2Fforum.xda-developers.com%2Fv20%2Fdevelopment%2Fh918-recowvery-unlock-v20-root-shell-t3490594&v=1&out=http%3A%2F%2Ftool.lime.gdms.lge.com%2Fdn%2Fdownloader.dev%3FfileKey%3DUW00120120425&title=%5BH918%7CUS996%7CH830%5D%20recowvery%2C%20unlock%20your%20V20%E2%80%A6%20%7C%20LG%20V20&txt=http%3A%2F%2Ftool.lime.gdms.lge.com%2Fdn%2Fdow...%3DUW00120120425

• Mac - Here

http://redirect.viglink.com/?format=go&jsonp=vglnk_148221033837117&key=f0a7f91912ae2b52e0700f73990eb321&libId=iwx018a701000n4o000DA1bhr14rgwlxii&loc=http%3A%2F%2Fforum.xda-developers.com%2Fv20%2Fdevelopment%2Fh918-recowvery-unlock-v20-root-shell-t3490594&v=1&out=http%3A%2F%2Ftool.lime.gdms.lge.com%2Fdn%2Fdownloader.dev%3FfileKey%3DUW00320110909&title=%5BH918%7CUS996%7CH830%5D%20recowvery%2C%20unlock%20your%20V20%E2%80%A6%20%7C%20LG%20V20&txt=http%3A%2F%2Ftool.lime.gdms.lge.com%2Fdn%2Fdow...%3DUW00320110909

3. Download TWRP Recovery for your LG V20 versions.
• H918

http://redirect.viglink.com/?format=go&jsonp=vglnk_148223838598329&key=f0a7f91912ae2b52e0700f73990eb321&libId=iwx018a701000n4o000DA1bhr14rgwlxii&loc=http%3A%2F%2Fforum.xda-developers.com%2Fv20%2Fdevelopment%2Fh918-recowvery-unlock-v20-root-shell-t3490594&v=1&out=https%3A%2F%2Fbuild.nethunter.com%2Ftest-builds%2Ftwrp%2Flge%2Ftwrp-3.0.2-1-h918.img&title=%5BH918%7CUS996%7CH830%5D%20recowvery%2C%20unlock%20your%20V20%E2%80%A6%20%7C%20LG%20V20&txt=https%3A%2F%2Fbuild.nethunter.com%2Ftest-bui...0.2-1-h918.img

• H830.

http://redirect.viglink.com/?format=go&jsonp=vglnk_148223840091131&key=f0a7f91912ae2b52e0700f73990eb321&libId=iwx018a701000n4o000DA1bhr14rgwlxii&loc=http%3A%2F%2Fforum.xda-developers.com%2Fv20%2Fdevelopment%2Fh918-recowvery-unlock-v20-root-shell-t3490594&v=1&out=https%3A%2F%2Ftwrp.me%2Fdevices%2Flgg5h830.html&title=%5BH918%7CUS996%7CH830%5D%20recowvery%2C%20unlock%20your%20V20%E2%80%A6%20%7C%20LG%20V20&txt=https%3A%2F%2Ftwrp.me%2Fdevices%2Flgg5h830.html

• US996

http://redirect.viglink.com/?format=go&jsonp=vglnk_148223839486530&key=f0a7f91912ae2b52e0700f73990eb321&libId=iwx018a701000n4o000DA1bhr14rgwlxii&loc=http%3A%2F%2Fforum.xda-developers.com%2Fv20%2Fdevelopment%2Fh918-recowvery-unlock-v20-root-shell-t3490594&v=1&out=https%3A%2F%2Fbuild.nethunter.com%2Ftest-builds%2Ftwrp%2Flge%2Ftwrp-3.0.2-1-us996.img&title=%5BH918%7CUS996%7CH830%5D%20recowvery%2C%20unlock%20your%20V20%E2%80%A6%20%7C%20LG%20V20&txt=https%3A%2F%2Fbuild.nethunter.com%2Ftest-bui....2-1-us996.img

4. Download recowvery binaries (download all of these)

https://build.nethunter.com/android-tools/dirtycow/arm64/

5. Download the latest SuperSU from the official website.

https://download.chainfire.eu/897/SuperSU/BETA-SuperSU-v2.67-20160121175247.zip

Running Recowvery on LG V20.

1. Enable USB debugging.
2. Enable developer options.
3. Turn off your LG V20, once it completely shut down then connect LG V20 to the computer via USB cable.
4. Now, go to the ADB and fastboot directory. for this, we copy them at c:\adb
5. Open command windows in this folder, How to do it?
• Press and hold the shift key on the keyboard, then right-click mouse anywhere on empty space.
• Now, click Open command window here
6. Once command prompt windows already open, type the following command at prompt to forced LG V20 reboot into bootloader.

• adb reboot bootloader

7. Now type the following command to check the connection between LG V20 and the computer.

• fastboot devices

8. Now, type the following command to run recowvery. Type it one by one
• adb push dirtycow /data/local/tmp 
• adb push recowvery-applypatch /data/local/tmp 
• adb push recowvery-app_process64 /data/local/tmp 
• adb push recowvery-run-as /data/local/tmp
9. Command above will save recowery to temp folder on the computer, then type the following command to pushing 
• adb shell 
• $ cd /data/local/tmp 
• $ chmod 0777 * $ ./dirtycow /system/bin/applypatch recowvery-applypatch
10. Wait for completion
• $ ./dirtycow /system/bin/app_process64 recowvery-app_process64
11. Wait for completion, your phone (LG V20) will look like it's crashing
• $ exit
• 
  
• adb logcat -s recowvery
12. Wait for it to tell you it was successful, Then press CTRL + C
• adb shell reboot recovery
13. Wait for LG V20 to boot up again, your recovery will be reflashed to stock.
• adb shell 
• $ getenforce
14. It should say Permissive, adjust source and build for your device!
• $ cd /data/local/tmp 
• $ ./dirtycow /system/bin/run-as recowvery-run-as 
• $ run-as exec ./recowvery-applypatch boot
15. Wait for it to flash your boot image this time.
• $ run-as su
• #
16. Play around in your somewhat limited root shell full of possibilities
• dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery
• where twrp.img is your TWRP file name
• for example
• dd if=/sdcard/twrp-3.0.2-0-beta4-h918.img of=/dev/block/bootdevice/by-name/recovery
17. All command above will flash TWRP recovery on LG V20.
18. You can read completely instruction step 8 until step 16 at this link.

https://github.com/jcadduono/android_external_dirtycow#running

19. Finish

Flashing TWRP & Root LG V20.

Now we have got the permissive shell in adb, then we will have access to the partitions via dd. We will transfer TWRP to internal storage using MTP, 

1. Rename TWRP at prerequisite file above to twrp.img
2. We would run recowvery now, If you've rebooted since doing that, you will need to go back and do that again.
3. Type the following command below.
• adb push twrp-3.0.2-x-xxxx.img /sdcard/twrp.img 
• adb shell 
• $ run-as exec dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery 
4. wait for it to complete. then type
•  $ reboot recovery
5. You should be inside TWRP now.
6. Just swap yes, if TWRP asks you to enable system modifications.

Turn off forced encryption.

this step will turn off forced encryption at boot and allow you to boot a modified system. If you're flashing SuperSU.zip, it will also do this for you so this won't be necessary. Download the latest Zip from here.

https://build.nethunter.com/android-tools/no-verity-opt-encrypt/

Flash SuperSU.

• You can flash SuperSU by flashing zip file from prerequisites file above, it will root LG V20 device.
• If you don't flash either no-verity-opt-encrypt or SuperSU, you will probably end up in a horrifying never-ending boot loop of "corruption"!
• Now, use Titanium Backup with SuperSu.
• Format Data via button on the Wipe page in TWRP, it will disable encryption after flashing SuperSU or the no-verity-opt-encrypt zip

Once all step above is done it's time to get full TWRP functions on LG V20 device. for example Backup and restore. Finish. Thank's for your attention. Good Luck.