{"id":24365913,"url":"https://github.com/throwaway96/faultmanager-autoroot","last_synced_at":"2025-04-05T08:03:43.719Z","repository":{"id":271037513,"uuid":"912220451","full_name":"throwaway96/faultmanager-autoroot","owner":"throwaway96","description":"Exploit to root webOS 4.0+ TVs and set up Homebrew Channel","archived":false,"fork":false,"pushed_at":"2025-03-08T18:17:37.000Z","size":1656,"stargazers_count":176,"open_issues_count":1,"forks_count":10,"subscribers_count":10,"default_branch":"main","last_synced_at":"2025-03-28T20:12:41.954Z","etag":null,"topics":["jailbreak","root","webos","webos-tv"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/throwaway96.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"throwaway96","ko_fi":"throwaway96"}},"created_at":"2025-01-05T00:11:04.000Z","updated_at":"2025-03-28T13:58:43.000Z","dependencies_parsed_at":"2025-01-05T01:30:14.823Z","dependency_job_id":null,"html_url":"https://github.com/throwaway96/faultmanager-autoroot","commit_stats":null,"previous_names":["throwaway96/faultmanager-autoroot"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/throwaway96%2Ffaultmanager-autoroot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/throwaway96%2Ffaultmanager-autoroot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/throwaway96%2Ffaultmanager-autoroot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/throwaway96%2Ffaultmanager-autoroot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/throwaway96","download_url":"https://codeload.github.com/throwaway96/faultmanager-autoroot/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247305930,"owners_count":20917207,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["jailbreak","root","webos","webos-tv"],"created_at":"2025-01-19T00:02:38.905Z","updated_at":"2025-04-05T08:03:43.696Z","avatar_url":"https://github.com/throwaway96.png","language":"Shell","funding_links":["https://github.com/sponsors/throwaway96","https://ko-fi.com/throwaway96"],"categories":["Shell"],"sub_categories":[],"readme":"# faultmanager-autoroot\n\nThis is a tool to root and automatically install\n[Homebrew Channel](https://github.com/webosbrew/webos-homebrew-channel) on\nLG TVs with webOS 4.0+. It uses a vulnerability in `faultmanager`\n[discovered by buglloc](https://ut.buglloc.com/webos-jailbreak/).\n\nThis vulnerability is present in webOS 4.0 through 9. The vulnerable service\nwas introduced in webOS 3.5, but this exploit will not work on that\nversion. (I have not checked whether the underlying vulnerability\nis present. You can use\n[dejavuln-autoroot](https://github.com/throwaway96/dejavuln-autoroot) instead,\nas DejaVuln has not been patched on webOS 3.5.)\n\n\u003e [!NOTE]\n\u003e Use [CanI.RootMy.TV](https://cani.rootmy.tv/) to determine whether your\n\u003e firmware is vulnerable.\n\n**Please do not create GitHub issues asking whether a specific version is\nrootable or reporting that you successfully rooted some version.** The latest\ninformation is available at [CanI.RootMy.TV](https://cani.rootmy.tv/).\n\n## Patch status\n\n\u003e [!WARNING]\n\u003e LG has started rolling out patched firmware. Do not update your\n\u003e firmware if you want to be able to root your TV.\n\nAs of 2025-03-08, I am only aware of patched *prerelease* firmware.\n\nTo avoid prerelease firmware, don't mess with the \"NSU Mode\" setting in\nthe Instart menu (which is not recommended anyway).\n\nI expect to see patched firmware for most webOS 5+ OTAIDs start being released\nrelatively soon. However, webOS 4.0 probably won't be patched, and I don't\nknow whether webOS 4.5 will be.\n\n## Instructions\n\n1. Set up\n   [Developer Mode](https://webostv.developer.lge.com/develop/getting-started/developer-mode-app).\n2. Connect to the TV with an SSH client. (If you need help, see the\n   [crashd guide](https://gist.github.com/throwaway96/e811b0f7cc2a705a5a476a8dfa45e09f#alternative-clients).\n   [Dev Manager](https://github.com/webosbrew/dev-manager-desktop) should\n   also work.)\n3. Download `autoroot.sh` to any writable directory (e.g., `/tmp`).\n4. Run `autoroot.sh` (e.g., `sh /tmp/autoroot.sh`).\n5. Wait for the `Payload complete` message; the script should exit soon after.\n6. **Before rebooting**, uninstall the LG Developer Mode app.\n\n**Do not** install the LG Developer Mode app while the TV is rooted!\n\n## Example\n\n```sh\ncurl -L -o /tmp/autoroot.sh -- 'https://raw.githubusercontent.com/throwaway96/faultmanager-autoroot/refs/heads/main/autoroot.sh' \u0026\u0026\nsh /tmp/autoroot.sh\n```\n\n## Settings\n\nThe `autoroot.sh` script accepts certain command line options:\n\n* `--debug` or `-d` - Enables additional logging.\n* `--telnet` or `-t` - Makes a root shell available via telnet on port 23.\n  Note that this won't work on webOS 9 (24), which does not have `telnetd`!\n* `--leave-script` - Don't rename `start-devmode.sh` with invalid signature.\n  You almost certainly won't need this, but it's documented here for the sake\n  of completeness.\n\nIf there is a file named `hbchannel.ipk` in the same directory as\n`autoroot.sh`, it will be installed. Otherwise, the latest Homebrew Channel\nIPK will be downloaded and installed.\n\n## Troubleshooting\n\nCheck the log files. They are named `autoroot.log` and `autoroot-payload.log`.\n\nOn webOS 8/9 (webOS 23/24), you may have to try multiple times; it seems that\nrestarting `appinstalld` does not reliably make it detect the existence of\n`devmode_enabled`. May also apply to webOS 7.\n\nIf the toast and/or log says \"Rooting complete\" but you don't see Homebrew\nChannel, reboot the TV. Make sure Quick Start+ is disabled.\n\nIf you get an error installing the IPK (e.g., `errorCode` -5), make sure your\nTV's date is set to something reasonably accurate.\n\n## Support\n\nYou can find more information at [webosbrew.org](https://www.webosbrew.org/).\n\nIf you need help rooting your TV, try the\n[OpenLGTV Discord](https://discord.gg/hXMHAgJC5R). Before you ask a question,\ncheck the FAQ (#faq) to see if it is answered there! Attach your `autoroot.log`\nand `autoroot-payload.log` (if present) when asking for help.\n\n## Credits\n\n* The vulnerability in `faultmanager` was discovered by\n[@buglloc](https://github.com/buglloc)\n([Andrew Krasichkov](https://buglloc.com/)).\n\n## License\n\nThis program is free software: you can redistribute it and/or modify it under\nthe terms of the GNU Affero General Public License as published by the Free\nSoftware Foundation, either version 3 of the License, or (at your option) any\nlater version.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY\nWARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A\nPARTICULAR PURPOSE. See the GNU Affero General Public License for more details.\n\nYou should have received a copy of the GNU Affero General Public License along\nwith this program. If not, see \u003chttps://www.gnu.org/licenses/\u003e.\n\nSee `COPYING` for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthrowaway96%2Ffaultmanager-autoroot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthrowaway96%2Ffaultmanager-autoroot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthrowaway96%2Ffaultmanager-autoroot/lists"}