rootmytv / rootmytv.github.io

RootMyTV is a user-friendly exploit for rooting/jailbreaking LG webOS smart TVs.

Important

RootMyTV is unlikely to work on your TV. Find out why.

RootMyTV is a user-friendly exploit for rooting/jailbreaking LG webOS smart TVs.

It bootstraps the installation of the webOS Homebrew Channel, and allows it to run with elevated privileges. The Homebrew Channel is a community-developed open source app, that makes it easier to develop and install 3rd party software. Find out more about it here.

If you want the full details of how the exploit works, skip ahead to our writeup.

Is my TV vulnerable? (short answer: no)

The vulnerabilities used by RootMyTV (both v1 and v2) have been patched by LG. RootMyTV is unlikely to work on firmware released since mid-2022.

Important

If you get a "Denied method call "download" for category "/"" error, your TV is patched. If your TV reboots but Homebrew Channel is not installed, it is likely patched. Firmware downgrades are no longer possible without already having root access.

The following table lists the first webOS version for each year's models that is known to not support RootMyTV:

TV model year	Base webOS version	RootMyTV patched since webOS version
2016	3.0	3.4.2
2017	3.5	3.9.2
2018	4.0	4.4.2
2019	4.5	4.9.7
2020	5	5.4.0
2021	6	6.3.0

If your webOS version is equal to or greater than the version in the "patched since" column for your TV's model year, your TV is not vulnerable to RootMyTV. While these versions and newer are definitely patched, older versions may or may not work. RootMyTV never worked on webOS versions prior to 3.4.0 or any TVs that came with webOS 1, 2, 7 (22), or 8 (23).

More information about webOS version numbers

Depending on the year a TV was released, it uses a certain range of webOS version numbers.

The versions before 2016 and after 2019 are easy to understand, since the first digit is used only for a single year (e.g., every 6.x.y version is for a 2021 TV).

However, LG did something unusual in 2017 and 2019 by not using a new first digit. TVs from 2017 and 2019 started from webOS versions 3.5 and 4.5, respectively. For example, TVs released in 2016 will have webOS versions equal to or greater than 3.0.0 and less than 3.5.0; TVs released in 2017 will use 3.5.0 up to (but not including) 4.0.0; and so on.

Note that when trying to determine when a given webOS version was released, you should only compare it with version numbers from the same model year. For example, it is safe to assume version 3.4.1 was released after 3.3.0. But version 3.4.2 could have been (and in fact was) released after version 4.0.0.

With webOS 7 in 2022, LG started using the marketing name "webOS 22"; the same applies to webOS 8 ("webOS 23").

Note

This versioning refers to the "webOS TV Version" field in the settings menu, not the "Software Version" field.

If you want to protect your TV against remote exploitation, please see the relevant section of our writeup and/or apply the latest firmware update for your TV.

Usage Instructions

Step Zero (disclaimer): Be aware of the risks. Rooting your TV is (unfortunately) not supported by LG, and although we've done our best to minimise the risk of damage, we cannot make any guarantees. This may void your warranty.

1. (Pre-webOS 4.0) Make sure "Settings → Network → LG Connect Apps" feature is enabled.
2. Developer Mode app must be uninstalled before rooting. Having this application installed will interfere with RootMyTV v2 exploit, and its full functionality is replaced by Homebrew Channel built-in SSH server.
3. Open the TV's web browser app and navigate to https://rootmy.tv
4. "Slide to root" using a Magic Remote or press button "5" on your remote.
5. Accept the security prompt.
6. The exploit will proceed automatically. The TV will reboot itself once during this process, and optionally a second time to finalize the installation of the Homebrew Channel. On-screen notifications will indicate the exploit's progress. On webOS 6.x Home Screen needs to be opened for notifications/prompts to show up.

Your TV should now have Homebrew Channel app installed.

By default system updates and remote root access are disabled on install. If you want to change these settings go to Homebrew Channel → Settings. Options there are applied after a reboot.

For exploiting broken TVs, check out the information here.

Why rooting

• Unlimited "Developer Mode" access

  • While LG allows willing Homebrew developers/users to install unofficial applications onto their TVs, official method requires manual renewal of "developer mode session", which expires after 50 hours of inactivity.
  • Some of the amazing homebrew that has been built/ported onto webOS would likely never be accepted onto LG's official Content Store.

• Lower level user/application access

  • This allows willing developers to research webOS system internals, which will result in creation of amazing projects, like PicCap (high performance video capture used for DIY immersive ambient lighting setups), or access to some interesting features like customization of system UI, remote adjustment of certain TV configuration options, and others.

FAQ

Is it safe?

While we cannot take any responsibility for Your actions, we have not encountered any bricks due to rooting. If you only use trusted software from official Homebrew Channel repository, then you should be safe.

Will this void my warranty?

This is not a legal advice. At least in the EU, rooting and other software modifications are generally deemed to be legal and should not be a basis for voiding your warranty.

How do I get rid of this?

Factory reset should remove all root-related configuration files.

We don't have a convenient tool for root removal without factory reset, though a knowledgable person may be able to remove our customizations manually.

Are system updates possible?

While updates are technically possible, if LG patches the exploit, you might end up "locked out" and unable to re-root your TV if you somehow lose access. We also can't predict how future updates will affect our techniques used to elevate and operate the Homebrew Channel app.

Will this break Netflix/YouTube/AmazonVideo?

No. This does not break or limit access to subscription services or other DRMed content.

However, staying on very old firmware version (which may be required for keeping root access persistent) may limit Your access to LG Content Store application installs, updates, or (rarely) launches. Workarounds for this are in the works.

How do I update from RootMyTV v1? (released 2021/05)

If you are not going to update your TV Software Version to the one that is already patched (most 4.x+ released after 2021/06) there is no need to update. New chain does not bring any new features - the most sensible thing you can do is to update your Homebrew Channel app.

If you are already rooted on downgraded/pre-2021-06 firmware version and want to upgrade further, doing an official software update will remove existing root files and homebrew applications. Running RootMyTV v2 then will reenable root access again. You will need to reinstall removed applications yourself.

If you know what you are doing and want to persist installed applications, you need to remove /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh file right before an update (without rebooting inbetween), and then run RootMyTV v2 right on first boot after software update.

I quickly turned my TV on and off and it's really angry about Failsafe Mode

If "Failsafe Mode" got tripped on your TV and it's showing angry notifications, go to Homebrew Channel → Settings, switch "Failsafe Mode" off and press "Reboot".

"Failsafe Mode" is a mode where none of our system customizations are enabled and only an emergency remote access server gets started up.

This mode gets enabled automatically when the TV crashes, gets its power removed or is shut down during early system startup. In order to reduce chances of that happening we recommend enabling "Quick Start+" setting in webOS System Settings General tab. This will make the TV only go to "sleep mode" (which doesn't take much more power) instead of doing a full shutdown, and will not need to restart our services on every suspend. This will also make TV startup much faster.

I want to run some commands as root during boot!

Our startup script runs all executable files in /var/lib/webosbrew/init.d on boot (via run-parts - filenames may only contain a-zA-Z0-9-_ letters!) - create your own scripts there.

Create any customizations there and do not modify existing RootMyTV/Homebrew Channel scripts, since these may be overwritten on future updates.

If you are a homebrew developer - create a symlink to a script in your own app path there, and do not copy over anything there.

I want to support you financially!

If you want, you can support this project via GitHub Sponsors - see "Sponsor" button in upper right corner.

Post-Installation Advice (IMPORTANT!)

1. Don't update your TV. While updates are technically possible, if LG patches the exploit, you might end up "locked out" and unable to re-root your TV if you somehow lose access. We also can't predict how future updates will affect our techniques used to elevate and operate the Homebrew Channel app. "Block system updates" option in Homebrew Channel will disable firmware update checks. Make sure "Automatic system updates" option in webOS System Settings is disabled as well.

2. It is required to remove "Developer Mode" app before rooting. Otherwise it will interfere with the startup script used to bootstrap the jailbreak. SSH service exposed by Homebrew Channel is compatible with webOS SDK tooling.

3. If you need remote root shell access and know how to use SSH, you can enable it in Homebrew Channel settings. Default password is alpine, but we recommend setting up SSH Public Key authentication by copying your SSH Public Key over to /home/root/.ssh/authorized_keys on the TV. This will disable password authentication after a reboot.

   GitHub user registered keys can be installed using the following snippet:

   mkdir -p ~/.ssh && curl https://github.com/USERNAME.keys > ~/.ssh/authorized_keys

   Alternative option is Telnet (can be enabled in Homebrew Channel → Settings → Telnet) though it is highly discouraged, since this gives unauthenticated root shell to anyone on a local network.

4. It is recommended to have "Quick Start+" functionality enabled. This will make shutdown button on a remote not do a full system shutdown. If you quickly turn the TV on and off without Quick Start+, our "Failsafe Mode" may get triggered (which is there to prevent startup scripts bricking the TV) which will go away after switching relevant switch in Homebrew Channel Settings.

Troubleshooting

In case of any problems join the OpenLGTV Discord server and ask for help on #rootmytv channel, ask on our #openlgtv:netserve.live Matrix channel, or file a GitHub issue.

Before asking for support, please consult our Troubleshooting guide.

Research Summary and Timeline

RootMyTV is a chain of exploits. The discovery and development of these exploits has been a collaborative effort, with direct and indirect contributions from multiple researchers.

On October 05, 2020, Andreas Lindh reported a root file overwrite vulnerability to LG. On February 03, 2021, Andreas published his findings, demonstrating a local root exploit against the webOS Emulator (a part of LG's development SDK). LG had boldly claimed that this issue did not affect their devices, and that they were going to patch their emulator.

On February 15th, 2021, David Buchanan reported a vulnerability in LG's "ThinQ login" app, which allowed the app to be hijacked via a specific sequence of user inputs, allowing an attacker to call privileged APIs. On March 23rd 2021, David published a proof-of-concept exploit, which enabled users to gain root privileges on their LG smart TVs. This was made possible by combining it with the local root vulnerability previously reported by Andreas (Yes, the same one that LG said did not affect their devices!).

Around March 28th 2021, Piotr Dobrowolski discovered a similar vulnerability in the "Social login" app, which is present across a wider range of webOS versions. More importantly, this exploit could be easily triggered over the local network, using SSAP (details below), making it much more reliable and user-friendly.

At time of writing, the code in this repo is the combined work of David Buchanan (Web design, initial PoC exploit) and Piotr Dobrowolski (Improved "v1" exploit implementation, writeup, and "v2" research and implementation).

We would like to thank:

• Andreas Lindh for publishing his webOS research.

• The wider webOS community, particularly the XDA forums and the OpenLGTV discord.

• All the contributors (present and future) to the Homebrew Channel, and development of other homebrew apps and software.

• LG, for patching symptoms of bugs rather than underlying causes...

Historical Information

At the time of writing the original exploit (RootMyTV v1 - 2021-05-15), all webOS versions between 3.4 and 6.0 we tested (TVs released between mid-2017 and early 2021) were supported by this exploit chain. Around June-July 2021 LG started rolling out updates which added some minor mitigations that broke our original exploit chain.

When RootMyTV v2 was released (2022-01-05), all webOS versions between 4.x and 6.2+ we tested (TVs released between early 2018 and late 2021) were supported by the v2 exploit chain.

Some versions between 3.4 and 3.9 may be supported by RootMyTV v2, but your mileage may vary.

The Technical Details

Background

webOS, as the name suggests, is a Smart TV operating system mostly based on web technologies. Applications, both system and external are either run in a stripped down Chromium-based web browser ("WebAppMgr") or in Qt QML runtime. Almost all system and external applications run in chroot-based jails as an additional security layer.

"Web apps", outside of standard web technologies, also get access to an API for communicating with "Luna Service Bus". This is a bus, similar to D-Bus, used to exchange messages and provide various services across different security domains. Bus clients can expose some RPC methods to other applications (identified by URIs luna://service-name/prefix-maybe/method-name) which accept JSON object message as their call parameters, and then can return one or many messages. (depending on the call being "subscribable" or not)

While Luna bus seems to have extensive ACL handling, considering the history of webOS IP transfers, seems like not many engineers fully understand its capabilities. Part of the bus is marked as "private", which is only accessible by certain system applications, while most of the other calls are "public" and can be accessed by all apps.

Unexpectedly, one of the internal services exposed on a bus is "LunaDownloadMgr" which provides a convenient API for file download, progress tracking, etc... Said service has been researched in the past and an identity confusion bug leading to an arbitrary unjailed root file write vulnerability has been publicly documented.

This in and of itself was not very helpful in production hardware, thus we needed to find a way of calling an arbitrary Luna service from an application with a com.webos. / com.palm. / com.lge. application ID.

Step #0 - Getting in (index.html)

In order to gain initial programmatic control of the TV GUI, an interface called "LG Connect Apps" can be used. Its protocol, called "SSAP" (Simple Service Access Protocol), is a simple websocket-based RPC mechanism that can be used to indirectly interact with Luna Service bus, and has been extensively documented in various home-automation related contexts. We use that to launch a vulnerable system application which is not easily accessible with normal user interaction.

Step #0.1 - Escaping the origins

SSAP API is meant to be used from an external mobile app. For the sake of simplicity, though, we wanted to serve our exploit as a web page. This lead us to notice that, understandably, the SSAP server explicitly rejects any connections from (plaintext) HTTP origins. However, there was an additional exception to that rule, and seemingly the authors wanted to allow file:// origins, which present themselves to the server as null. Turns out there's one other origin that can be used that is also reprted as null, and that is data: URIs.

In order to exploit this, we've created a minimal WebSocket API proxy implementation that opens a hidden iframe with a javascript payload (which is now running in a data:/null origin) and exchanges the messages with the main browser frame. This has been released as a separate library.

Step #0.2 - General Data Protocol Redirection

There's a minor problem with establishing the connection with the SSAP websocket server. While we all believe in utter chaos, we don't feel very comfortable with serving our exploit over plaintext HTTP, which would be the only way of avoiding Mixed Content prevention policies. (by default, https origins are not allowed to communicate with plaintext http endpoints)

While some newer Chromium versions do allow Mixed Content communication with localhost, that was not the case when Chromium 38 was released (used in webOS 3.x). Thankfully, it seems like the system browser on webOS 3.x is also vulnerable to something that has been considered a security issue in most browsers for a while now - navigation to data: URIs. Thus, when applicable, our exploits attempts to open itself as a data: base64-encoded URI. This makes our browser no longer consider the origin being secure, and we can again access the plain-http WebSocket server.

Mitigation note

An observant reader may have noticed that the service we use is meant to be used remotely. While the connection itself needs a confirmation using a remote we highly recommend to disable LG Connect Apps functionality in order to prevent remote exploitation. However, this option seems to only be present on webOS versions older than webOS 4.x - in such cases the only solutions are to either keep the TV on a separate network, or disable SSAP service manually using the following command after rooting:

luna-send -n 1 'palm://com.webos.settingsservice/setSystemSettings' '{"category":"network","settings":{"allowMobileDeviceAccess":false}}'

Step #1 - Social login escape (stage1.html)

Having some initial programmatic control of the TV via SSAP, we can execute any application present on the TV. All cross-application launches can contain an extra JSON object called launchParams. This is used to eg. open a system browser with specific site open, or launch a predetermined YouTube video. Turns out this functionality is also used to select which social website to use in com.webos.app.facebooklogin, which is the older sibling of com.webos.app.iot-thirdparty-login used in initial exploit, present on all webOS versions up until (at least) 3.x.

When launching social login via LG Account Management, this application accepts an argument called server. This turns out to be a part of URL that "web app" browser is navigated to. Thus, using a properly prepared launchParams we are able to open an arbitrary web page (with the only requirement being that it's served over https) running as a system app that is considered by LunaDownloadMgr a "system" app.

Step #2 - Download All The Things (stage2.html)

Since we are already running as a system application, we can download files (securely over https!) into arbitrary unjailed filesystem locations as root.

We use that to download following files:

• stage3.sh → /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh - this is the script executed at startup by /etc/init/devmode.conf as root, in order to run developer mode jailed SSH daemon.
• hbchannel.ipk → /media/internal/downloads/hbchannel.ipk - since our end goal is intalling the Homebrew Channel app, we can also just download it during the earlier stages of an exploit and confirm it's actually downloaded.
• devmode_enabled → /var/luna/preferences/devmode_enabled - this is the flag checked before running start-devmode.sh script, and is just a dummy file.

Step #3 - Homebrew Channel Deployment (stage3.sh)

stage3.sh script is a minimal tool that, after opening an emergency telnet shell and removing itself (in case something goes wrong and the user needs to reboot a TV - script keeps running but will no longer be executed on next startup), installs the homebrew channel app via standard devmode service calls and elevates its service to run unjailed as root as well.

2021/06: The Old-New Chain (RootMyTV v2)

Around 2021/06 LG started rolling out a patched version which involved some fixes for the tricks we used in this chain:

• Certain applications we used for private bus access have their permissions limited to public
• LunaDownloadMgr now checks target paths against a list of regular expressions in /etc/palm/luna-downloadmgr/download.json
• start-devmode.sh script is now shipped with a signature and is now verified using openssl on each boot
  • This one had an interesting side effect - it took approximately a month for LG to roll out a new Developer Mode application with signed start-devmode.sh, during which time updated TVs were unable to use developer mode at all.

Most of these mitigations are too trivial to work around, thus we still consider this chain unfixed.

• There are still applications on the system that are vulnerable to XSS attacks with private bus permissions
• Regular expressions used to verify target paths are too broad, and thus still allow us to write to relevant paths
• There are multiple paths that are executed during bootup, so we don't even need to use start-devmode.sh

Our initial estimate for fixing these issues in our chain were "a couple of hours" - patches theorized on our side on 2021/05/27 turned out to be correct, but due to some strategic choices and lack of personal time, we decided to postpone testing and release for a couple of months. Sorry. :)

rootmytv.github.io's Issues

I can’t connect LGTV via PC

Hi, days ago I rooted my leg tv and it work, and I need a tool called Magic4pc to use my tv magicstick to control my pc, but I don’t know how to connect my pc and tv on same internet, I tried CLI tool u can see on pictures.
Btw, thx for helping !

Denied method call

Hi!
Recieved this error, connected apps are turned on.

Firmware:

How to get rid of 'Failsafe mode! Open telnet and remove /var/luna/preferences/webosbrew_failsafe'?

QuickStart is already enabled.

Is this reverseable?

Can I fully "unbrew" my TV if I want to?

Stopped working on OLED CX Models

As reported by users in the version tracker, the exploit was working fine in CX TVs until: WebOS Version 5.3.0-22 and Software Version 04.30.55.

But when WebOS Version 5.3.0-2206 and Software Version 04.30.61 kicked in, it stopped working.

[REQ] Mock WebOS version

Hi,
I was wondering it if could be possible to make the TV believe it is running a different WebOS version. It could be useful to try newer packages from the LG Content Store, for example, since I'm quite sure that a lot of packages aren't really incompatible between different versions (e.g. my 2019 C9 is running webos 4.9 and LG decided not to make Stadia and Geforce Now available below webos 5.0).

TIA

WebSocket connection failure

Status: working
TV Model: 32LJ600B-SA
webOS Version: 3.8.0-61409 (dreadlocks2-dunggir)
Software Version: 05.80.40

an update later...

Status: not working (asks if LG Connect Apps is enabled)
TV Model: 32LJ600B-SA
webOS Version: 3.9.0-63004 (dreadlocks2-dudhwa)
Software Version: 06.00.04

Originally posted by @SergioVJr in #2 (comment)

This sounds quite interesting.

Could you please elaborate on that a little bit? Have you taken a look at docs/TROUBLESHOOTING.md?
Did you make sure LG Connect Apps is enabled in settings, and that the TV responds on http://localhost:3000?

Version Support Tracker (v2)

The purpose of this issue is to track which TV models, and firmware versions, the exploit is working against.

If you are having trouble getting the exploit to work, please contact us on discord and/or open a separate issue.

At a minimum, please specify your webOS version, software version, and TV model - feel free to add any other details you think are relevant.

You can find your "webOS Version" under Settings > General > About This TV > TV Information > webOS TV Version

You can find your "Software Version" under Settings > General > About This TV > Software Version

IMPORTANT: Please don't get webOS version and software version mixed up!

---

Tip: all required info can be extracted using the following command executed via SSH/Telnet on a rooted system:

grep -h -E '"(hardware_id|core_os_release|product_id|webos_manufacturing_version)"' /var/run/nyx/*

NAND Dumper ? (LG OLED C9)

Any chance I can do a full nand dump?

Im a bit worried to brick the TV when messing around to much with the OS via SSH.

Are there any other recovery options such as:

• boot loader
• recovery partiotion
• etc ?

Thanks for your help.

Amazing work btw <3

[webOS 3.9.0] Halts on Stage 1

the script halts after that and screensaver turns on later

Brightness control

I'm using a the LG UP7000 TV as a monitor. Because it's not technically a monitor it doesn't have support for brightness control or DDC/CI. I would like to be able to easily change the brightness without using the remote and webOS's slow and complicated UI. Any ideas on how I could achieve this? Is there a way I can execute some script on the TV over SSH every time I need to change the brightness?

Certificate error (-201)

Hi ;

TV Model : 49SJ800V
Firmware : 06.00.25

I'm trying every combination ( Change Country , time and date , downgrade firmware to 05.80.35, etc ) but
Unable to Load -201 certificate error everytime.

How to fix this issue ??

Modifying Home Screen to remove ads/recommendations

EDIT:
I have made a lot of progress and successfully removed ads and the AI Board at the top of the screen. I am continuing to work on this. When I have finished customizing the home screen to my liking I will share the script either with a pull request here or with my own repo.

Are there any information about CPUs used in LG TVs ?

Are there any information about CPUs used in LG TVs ?
I know they use arm but some informations about architecture and frequency will be nice.
Thx

Jailbreak not working

Hey, so I was trying to jailbreak my webos tv, and I got this. I asked someone and he told me that my webos is too old. But when I go to settings and about tv, I only see software version (there isn’t webos version) so I really don’t know what’s going on. And is there a jailbreak for older webos versions? Thank you

Service does not exist com.webos.service.downloadmanager

Errors out on my TV UF830V at "Service does not exist com.webos.service.downloadmanager" running web OS 4.26.35

SSH credentials?

Hi!

Maybe I didn't read correctly, but you mention that "alpine" is the default SSH password. But... What is the username?

I tried various things to login with "alpine" as a password but I always get a "permission denied" error... Can you help me please?

Block updates even in failsafe mode

Hello.
As for now, the situation with updates is getting worse and worse, while there is no universal way to block these updates except on the TV itself, taking into account the fact that hbc is still loaded in failsafe mode and given the relative safety of update blocking commands, I propose to introduce (as an option for example) the ability to load update block script even in failsafe mode.
One of variant to block updates:

mount --bind /bin/false /usr/sbin/update
pkill -9 -f /usr/sbin/update

brr. posted in wrong section

alternative to "GitHub Sponsors"

Hi

I would like to thank you very much for your work. I love Youtube without advertising. For me is ad-blocking a killer feature.

I would like to give you some money but not trust Microsoft/GitHub with my data. Can I donate Crypto? Or is there a direct PayPal link? I would be happy about GitHub Sponsors alternatives.

Version Support Tracker (v1)

The purpose of this issue is to track which TV models, and firmware versions, the exploit is working against.

If you are having trouble getting the exploit to work, please contact us on discord and/or open a separate issue.

At a minimum, please specify your webOS version, software version, and TV model - feel free to add any other details you think are relevant.

You can find your "webOS Version" under Settings > General > About This TV > TV Information > webOS TV Version

You can find your "Software Version" under Settings > General > About This TV > Software Version

IMPORTANT: Please don't get webOS version and software version mixed up!

App Update not possible

Hello,

Since i rooted my C9, i can't updates on the standard apps like netflix etc. Is there a way to solve this?

Thanks

Failsafe after stage3 reboot on update from v1

Hi!

I’be updated from RootMyTV v1 to v2, and after stage3 I’ve clicked “reboot now” on “homebrew channel was installed” toast.
After reboot I’ve got “failsafe mode” notification, but failsafe mode file wasn’t present.

maybe reboot on homebrew channel installed happened too fast, and failsafe mode was triggered either by leftovers from older script which was still in start-devmode.sh when stage3 reboot happened?

"board_type": "K5LP_DVB",
"hardware_id": "HE_DTV_W19P_AFADABAA",
"product_id": "50UM7300PLB",
"core_os_release": "4.9.5-8",
"webos_manufacturing_version": "05.20.08",

Running binaries (copies via SCP) such as htop etc does not work

first of all, thanks for the wonderful easy rootmy.tv, after downgrading my LG C8 LLA it worked perfectly. Nice job!
my problem - not really related to rootmy.tv:
I have tried to copy some binaries from my rpi4 via SCP to my LG TV (to /home/root/). when I try to execute them, like with ./htop I receive "file not found". If I do "ls" the files are there...
If I copy any binary from LG to my RPI4, like /usr/bin/aplay, it works on the RPI4, but not otherway around. I am trying to understand why? Are the binaries signed by chance or similar?
/proc/cpuinfo:
RPI has ARMv7 Processor rev 4 (v7l)
LG has ARMv7 Processor rev 2 (v7l)

The process stops with Denied method call "download"

The screen shows the following message:

start-devmode.sh: Downloading from https://rootmy.tv/files/stage3.sh...
err: {"returnValue":false,"errorCode":-1,"errorText":"Denied method call \"download\" for category \"/\""}

Thanks for your efforts.

Luna call failed during installation

I cant install exploit on my tv
Picture:

OCR:
start-devmode.sh: Downloading from undefined... start-devmode.sh: Luna call failed: {sreturnValue":false,"errorCode":-1,"errorText":"Service does not exist: com.webosservice.downloadmanager."} Original start-devmode.sh overwrite failed, attempting v2 exploit... extra_conf.sh: Downloading from undefined„, extra_conf.sh: Luna call failed: ereturnValue":false,"errorCode":-1,-errorText":"Service does not exist: commebosservice.downloadmanager.1
WebOS: 2.2.3-2155
modelName : 49UF8507-ZB
sdkVersion : 2.2.0
firmwareVersion : 04.06.25
boardType : LM15U_DVB_EU

No root

Why doesn't it work?

LG C1 version 03.30.06

I went to the webpage and try to root the TV. However, after reboot I cannot find the homebrew app. How do I root the tv?

Index page is broken on Firefox for Android

Opening https://rootmy.tv on Firefox for Android navigates to data: URL which shows its internal "An error occured" page. (instead of throwing an exception / navigating properly like is the case on desktop Chrome / Firefox / webOS system browser)

This is obviously not an issue when it comes to usability of an exploit, but may be a little weird if we were to use https://rootmy.tv as PR-style link for people to share our project. (instead of linking to github repo...)

This should be fairly easy to fix by just executing initial redirection only if is_webos is true.

Release Checklist

• Complete all the readme/docs TODOs
• Add a FAQ section, maybe?
• Final proofreading
• Finalize exploit code - use final file paths, urls etc. (meta-todo: add TODOs for these... [DONE])
• Add a note to index.html that this is a "pre-release", ask people not to share widely yet (to be removed after initial testing).
• Delete the current RootMyTV.github.io placeholder repo
• Rename RootMyTV-WIP to RootMyTV.github.io
• Point the rootmy.tv domain at github pages, and configure the domain in the github settings.
• Do a sanity-check test installation
• Do a GitHub "pre-release" tag (v0.9?)
• Un-private the repo
• Get a few people to test it.
• Remove the pre-release note, do a v1.0 release tag
• Tell the world!

Additional:

• Fix mobile site layout
• Add note about reboots sometimes failing

[webOS 5.3.0] Reboots during stage 1 but nothing happens later

I have my LG running webOS 5.3.0-2206 (jhericurl-jasper). After initiating Stage 1 from rootmy.tv it says "your tv shall reboot in 5 sec", but after reboot nothing seems to happen.

Enclosed last what is displayed before reboot:

I've tried running it several times, with same result - except for one time when it immediately crushed and asked to check if my LG Connect Apps is enabled. It's weird because I don't even have such setting, or I wasn't able to find it anywhere 🤷🏻

65UJ6309 + RootMyTV v2 not working

No magic remote available, Key "5" won't work - according to owner
webOS: presumably 3.x
Software Version: 6.00.20 (latest fw)
LG Connect Apps enabled

Focus set at slider with arrow keys and OK button, but pressing on key "5" won't trigger exploit.
No error message is shown, browser stays at index page.

Video call with owner - apparently he didn't do anything wrong.

error 113

When browsing to rootmy.tv on my tv browser:

error 113 (net::err_ssl_version_or_cipher_mismatch): unknown error

Model/Type: 42LA602V-ZA
Software version: 04.28.17
SDK Version: 03.05

Date and time are correct.
No updates available.

Is there a workaround?

Firmware 05.20.35 no homebrew install

I know people have said a lower FW didn't work but wasn't sure on the TV models and I am on a newer version fw.

Not sure oif this is a version that can be modded the about TV only has software fw version not web os version, I hope this will be supported on V3 if not please let me know thanks.

Upgrade from unpatched firmware + RootMyTV v2 to patched firmware

If a TV running on pre-2021/06 firmware is rooted with v2 exploit, and then upgraded to Software after 2021/06 (including start-devmode.sh signature verification) our install script will think it's been launched from that, and not remove the leftover script, leading to system clearing /media/developer on every boot...

WebOS 2.2.3 support

Hello,

The page opens fine, I get the security prompt, and after accepting it's just a solid black browser page.
Can this method work on 2.2.3? How can I debug it?
Thanks!

Is it possible to change settings in the service menu?

I wonder now that you guys (geniuses!) managed to root these TVs if it's possible to change some settings only available under the service menu (which requires a special remote control).

Linus Tech Tips made a video on how to disable TPC, which dims the screen when it detects static images for more than x seconds: https://youtu.be/hWrFEU_605g?t=577

It would be really nice to be able to change that without having to buy this special remote control :)

Thanks for the hard work!

Certificate error

Can I somehow upgrade now on a non-rooted TV?
When I try to open the rootmy.tv site, I get a certificate error 113. And the site does not open

Matrix Chat

It would be great if there was a Matrix chat for this project. Matrix is an open chat protocol, with the most famous and featureful client being Element. Its like IRC for the 21st century.

Many people, including me have dropped Discord in favour of Matrix, so can a room or space be made for Matrix Users?

You can sign up at element.io

P.S.
Spaces are similar to discord servers
Rooms are similar to discord channels, but rooms can be independent of spaces
Matrix rooms can be bridged to discord channels

Network disconnects on standby

I used WOL to turn my tv on (via alexa / home assistant). Since rooting this feature does not work anymore. I can see in my router that the tv is disconnected after turning off (standby).

I didnt changed any settings on my tv. This does not working since rooting. "Turn on via wifi" and "turn on via mobile device" is enabled, quick start is enabled.

Do you have any suggestions?

Styling on mobile devices

Slider looks broken on mobile devices. We can either shrink it down or hide it altogether.

Option to not install homebrew ipk

I tried running this locally with a modified stage3.sh that does not attempt to install the IPK - it attempts the exploit via third-party-login but hits a network error. I assume its because of my self-signed certificate. Is there any chance you can host a version that does not install this? I only want the shell..

[webOS 3.4.0] Halts on Stage 1

As reported on Discord

Connected apps enabled, prompts to install, tries to launch app but gets stuck in gray loading screen, then reboots.

[3.9] Multiple jumpstart scripts are created

HE_DTV_W17R_AFAAABAA, 06.00.10 Software Version.

Summary of a saga from: webosbrew/youtube-webos#30

Somehow "legacy" (v1) jumpstart script write errored out, while still writing a file properly, leaving a system with multiple jumpstarts, causing Failsafe Mode popup to show up on every boot.

update blocker not working ?

Upon turning on tv, I got an update notification ... and then before I was going to press NO not to update and just unblock whatever it blocks because of of the update I got a separate notification to run a failsafe mode script via telnet and had turned off tv...

Not sure what the process is here, I figured the blocker would have stopped the entire process.
So there was never a check for a new version, much less download and install attempt.

Will try to reread docs/wiki and see about this script (but the tv is off rn and even in fast boot mode I could never ssh/telnet inwhile it's off). I'd see on discord what's going on but I was banned bc one of my kids clicked those free nitro scams and of it spams servers the same ; result was a perm ban loll

Creating a systemd service

How do I go about making my own systemd service? If I drop a .service file in /home/root/.config/systemd/user and try a systemctl --user daemon-reload or systemctl --user start testing.service I just get a Failed to connect to bus: No such file or directory.

I cannot write to /etc/systemd/system either, as I just get the error Read-only file system, even after a mount -o rw,remount /.

Is this at all possible? Thank you for this project

SM8100 webos 5.20.15 not working

Tried to root my TV(ver. 5.20.15) but nothing happens after root(stated as successful) - no new app

Option to disable telemetry?

Would it be possible to add the option to disable all telemetry from the tv?
For example as a checkbox in the home-brew app ?

Old WebOS - doesn't work

No longer working (LGOLED65C9PLA - wos 05.20.15)

Hi,

The exploit is no longer working sadly, the script tells it was a success, then reboots, but after a reboot nothing happened.

Feature Request: App to install/use color profiles or save the existing one

Hello!

I'm new to this. I used this on an OLED LG TV. Definitely bought this for great/accurate color reproduction. My understanding is while I have my computer hooked up to the TV I can certainly use a custom color profile installed on the computer.

If there's room for ideas: I would suggest creating an app to use a custom color profile when using the TV standalone. I believe ICC profiles are a standard file format for this description. Color calibrators sometimes save color settings as a file that could then be consumed by this app (in theory).

I absolutely understand this is a volunteer project and am very thankful for the existing work done here. I love the DVD screensaver and adfree YouTube, and I'm looking at getting my collections of ROMs up to use the RetroArch app :-)

(Thank you!)