[working] root OLED C9 (possibly others too) with newest Firmware (05.30.10 - 9/28/2022)

[cowl0ver]

After trying basically everything on the web to downgrade & root my tv I finally found a working solution here (just translate with ur browser):

Original Guide
Guide translated by pbatard
(You will still need the Original Guide to get the .ipk files)

As we now know, the Guide should work with 2019/2020 and even older LG TV's.
Thanks to @pbatard for translation and clarify.

[JIEgOKOJI]

it works!

[felixmxr]

i think it works.
step 9 of the guide (Go to the Homebrew channel, the application will prompt you to reboot, press restart. That's all, the root is received;) didnt prompt me for a reboot.
i have ssh and telnet access.

[aresbrutus]

I can't seem to download telnet via homebrew. Is there anyway you can provide me with the IPK?

[Rogerthis]

Thanks for that guide, it's working for me.
Will this continue to work after the Dev timeout runs out?
Is an LG update block needed after that, to stop it from breaking?

[pbatard]

[UPDATED 2022.12.01 to add the local touch /var/log/crashd/"x;telnetd -l sh" alternate method]

Confirmed that it worked for me on an OLED CX with firmware 04.40.20.

Here is a rewriting of the guide linked by @cowl0ver above, with some slight clarifications for items I had trouble with as well as an alternative local method to run the "crashd exploit":

1. Get developer mode by registering an account here.
   It is possible that you may have be forced to use a mail using a .com domain for registration to work (e.g. gmail.com). You will have to accept a bunch of agreements... which you won't read.

2. Install the ThinQ App on a mobile device, and log onto it using your developer account. This is needed because LG stupidly forces you to go through this step to accept extra licenses, before you can log on to developer account on the TV. Why they can't just produce the additional licenses on the TV, or with the initial registration, and make you accept them there is beyond me!

3. On the TV (for CX models), go to All Settings → General → Additional Settings and set Quick Start+ to disabled. This is needed to ensure that the TV goes through a complete reboot when requested.

4. Install the Developer Mode App from the LG Content Store on the TV and validate that you can log in to your
   developer account (if you didn't do step 2, you may find that it won't let you, so please do that).
   Take a note of the IP address and passphrase and, on the left handside, enable Dev Mode Status and Key Server as shown in the picture below, as Dev Manager won't be able to connect to the TV otherwise:

   

5. Install the latest Dev Manager on a PC and launch it.
   Click the Add Device button in Options and fill in the fields Host (with the IP address and Passphrase you got from the TV).

6. In Dev Manager, install the Homebrew Channel 0.5.1 application (that should be listed in the main window) onto the TV.

7. • METHOD 1 (Recommended, as this is the one from the official #rootmytv Discord channel):
     • Still in Dev Manager, click on "terminal"
     • Type the following command then press enter:
       touch /var/log/crashd/"x;telnetd -l sh"
   • METHOD 2 (If the above doesn't work. This requires running external code from a remote server, which is always a potential security risk):
     • On the TV, launch Homebrew Channel (which you will now see in the LG App bar).
     • Click the "Settings" gear icon and select Add repository. Enter https://repo.webosapp.club as a new repository.
     • Go back to the main Homebrew Channel, you should now see a Run telnet/root.telnet application in the list of apps proposed
     • Run root.telnet from the repository.

Either of the above will run the "crashd exploit" and start a telnet server with root access on the TV.

8. Connect to the TV via telnet (port 23) using the same IP address as the one you use previously and enter the following commands exactly (Don't worry if you see library warnings being reported when running the commands, the commands are still being executed fine):

unset LD_PRELOAD
/media/developer/apps/usr/palm/services/org.webosbrew.hbchannel.service/elevate-service
mkdir -p /var/lib/webosbrew/init.d
cp /media/developer/apps/usr/palm/services/org.webosbrew.hbchannel.service/startup.sh /var/lib/webosbrew/startup.sh
rm -rf /var/luna/preferences/devmode_enabled && mkdir -p /var/luna/preferences/devmode_enabled

9. IMPORTANT: On the TV, delete the Developer Mode app. You must do this or else, as @Merri1 commented below, ssh will not work.

10. In telnet type reboot to reboot the TV.

11. Once the TV has rebooted, go to Homebrew channel again, and click the settings gear icon. You should see a greyed out Root status ok indicating that Homebrew channel has root access. Now you can enable the SSH Server by toggling its switch. Once you have done that, click the System reboot paragraph of text (bottom left) to reboot the TV.

12. From now on, an ssh server with root access will be enabled every time you start the TV. 😄
    You can SSH into your TV using the username root and password alpine on port 22 (default SSH port).

13. After this, you can turn on Quick Start+ again if you wish and set other Homebrew channel settings as needed.

[cambiass]

Very Good [pbatard]!

10. Connect to the TV via telnet (port 23)

Alternative? (ssh?)
I'm using a mac with monterey and telnet is not working..

[AdamDempsey]

I installed telnet via homebrew and my tv is now rooted :)

Very Good [pbatard]!

10. Connect to the TV via telnet (port 23)

Alternative? (ssh?)

I'm using a mac with monterey and telnet is not working..

[DedaDev]

Super nice, finally managed to install homebrew on my old LG :)

[cambiass]

11. On the TV, delete the Developer Mode app.
if I do this then it is removed homebrew channel after reboot!

p.s.
in my case, to connect with telnet, I don't have to use any port. But simply write: telnet 192.168.1.124 (no 22, no 23 port)
and everything works (except the problem in step 11)

[coolfizzin]

11. On the TV, delete the Developer Mode app. if I do this then it is removed homebrew channel after reboot!

p.s. in my case, to connect with telnet, I don't have to use any port. But simply write: telnet 192.168.1.124 (no 22, no 23 port) and everything works (except the problem in step 11)

The telnet port 23 is the default, so the telnet client is likely guessing the correct port when you connect. It wouldn't work without the correct port. It's just filling it in for you.

If deleting the Developer Mode all removes homebrew, then I believe the root isn't working correctly. Perhaps before you delete it you should go into the Homebrew app settings and check the box for disabling updates. I don't know if that will change anything, but it is something that I myself did before deleting Developer Mode.

[malloy139]

Worked on my C9 with firmware 05.30.11. Did not have to do step 2. Btw for Telnet on Windows you can use Putty.

[Michae11s]

Works on my 48A1 that was on latest firmware 03.33.11 webos 6.3.1

[apedance]

Working on
OLED55C97LA
Firmware: 05.30.11

[Bankysmithdev]

Hi, great tutorial but on start up I get a failsafe mode - a crash has occured duuring previous startup.

This happens everytime, am I missing something?

Cheers