1. Download the #1 Android News App:   EarlyBird - News for Android
    Dismiss Notice

[ROOT] LG Intuition & LG Spectrum ICS

Last Updated:

  1. jcase

    jcase Well-Known Member

    Source: [Exclusive] Here's How To Root The LG Intuition And LG Spectrum On ICS

    If you find this useful please follow me (jcase) on twitter ( https://twitter.com/teamandirc/ ).

    Here you go, root for both the new LG Intuition and the LG Spectrum running ICS. The vulnerability is a simple permission bug allowing us to setup a symlink to local.prop (yes yet again). While the bug is the same, the procedure is slightly different, so I will have the instructions separate.

    With the LG Intuition, they did seem to attempt to mitigate this attack. Not by setting correct permissions, but by dropping adbD to the shell user if it runs as root, even if ro.kernel.qemu=1 is set. They failed, they give us enough time to run one command before dropping the root privileges, in our case a script to root the phone.

    LG Spectrum ICS Root (for the leaked ICS rom):
    Expect this to be patched in the release rom. Leaked ICS rom has locked bootlaoders, ie no recovery at this point.

    Files needed:
    su ( http://dl.dropbox.com/u/8699733/lgroot/su )

    adb shell

    $ rm /data/vpnch/vpnc_starter_lock
    $ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
    $ exit

    adb reboot

    adb wait-for-device shell

    $ echo 'ro.kernel.qemu=1' > /data/local.prop
    $ exit

    adb reboot

    adb wait-for-device remount
    adb push su /system/xbin/su
    adb shell

    # chown 0.0 /system/xbin/su
    # chmod 06755 /system/xbin/su
    # rm /data/local.prop
    # rm /data/vpnch/vpnc_starter_lock
    # reboot

    Once rebooted, install Superuser from the market and enjoy.

    LG Intuition Root

    Files needed:
    su ( http://dl.dropbox.com/u/8699733/lgroot/su )
    lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )

    adb push su /data/local/tmp/su
    adb push lgroot.sh /data/local/tmp/lgroot.sh

    adb shell

    $ chmod 777 /data/local/tmp/lgroot.sh
    $ rm /data/vpnch/vpnc_starter_lock
    $ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
    $ exit

    adb reboot

    You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.

    adb wait-for-device shell

    $ echo 'ro.kernel.qemu=1' > /data/local.prop
    $ exit

    Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.

    adb reboot
    adb wait-for-device /data/local/tmp/lgroot.sh

    (Here is where you may have to unplug/replug, but only after the second command has ran).

    adb wait-for-device shell

    $ su
    # rm /data/local.prop
    # rm /data/vpnch/vpnc_starter_lock
    # reboot

    Once rebooted, install Superuser from the market and enjoy.

    castorpollux likes this.
  2. castorpollux

    castorpollux New Member

    After I run the command adb wait-for-device /data/local/tmp/lgroot.sh it does its thing for a second and looks like it worked. Then I type adb wait-for-device shell and instead of the $ with a cursor I get a line that reads (root@android;/ #) with a cursor and I can't run the su command. I've gotten stuck at this point and hard rebooted my phone several times with identical results. No matter what I try I get this. It looks like it has root access but it won't write the SU binaries to the phone. What should I do from here?
  3. jcase

    jcase Well-Known Member

    If that is the case, then you have the firmware I haven't gotten a chance to look at yet it seems.

    Run the script manually while at the # by /data/local/tmp/lgroot.sh

    then continue
    castorpollux likes this.
  4. castorpollux

    castorpollux New Member

    Two things. 1) I love you. 2)You're a ****ing genius. Thank you very much, it worked like a charm. I have a rooted, overclocked, themed, busyboxed, and incredibly huge phone.
  5. castorpollux

    castorpollux New Member

    P.S. Since you haven't had a chance to look at this firm-a-ware, I can confirm that it doesn't hang at either of the two spots where the tutorial says it may need an unplug/replug. It just goes like butter until the second time it needs that script. Again, thanks a million.
  6. cahyman

    cahyman Member

    how many overclocked? did u try to install cmw?
  7. admiral ackpoux

    admiral ackpoux Well-Known Member

    just wanted to double check to make sure the su file and lgroot file need to go in the sdk

    also thank you for getting this done was going to have dan look at the inuition but got swamped at work thanks for getting this done
  8. admiral ackpoux

    admiral ackpoux Well-Known Member

    getting an issue with

    echo 'ro.kernel.qemu=1' > /data/local.prop

    saying permission denied, and just curious if anyone is having as much of an issue with this as I am. I always seem to have bad luck with adb
  9. chavist

    chavist Member

    I really want to try this out, but I dont understand ADB basics like trying to open the command screen.LOL :)
  10. chavist

    chavist Member

  11. almyz125

    almyz125 New Member

    Still works even after the update.
  12. rokky

    rokky Member

    Not sure which update almyz125 refers to, but I just got the phone activated this past weekend (eBay, $196, top condition - no contract renewal or loss of unlimited data plan - WOOT), but I got several updates pushed in succession, and latest software version shows as VS95011B.

    I had a heck of a time getting this to work at first because the repeated instructions here leave out a key word:

    "Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.

    adb reboot
    adb wait-for-device /data/local/tmp/lgroot.sh "

    That 2nd line needs to be:
    adb wait-for-device shell /data/local/tmp/lgroot.sh

    Better yet, I strung the 2 commands together with logical and ("&&") to take care of timings:

    adb reboot && adb wait-for-device shell /data/local/tmp/lgroot.sh

    The "&&" keeps the 2nd command from running until the 1st completes, and only if it succeeds. Old shell scripting technique.


    P.S. Anyone else having issue with the Intuition home screens not rotating to landscape mode even though the individual apps do it just fine when opened? Very annoying with Gmail and calendar widgets that have text - reading them sideways is not fun.
    thegumbyman likes this.
  13. captc2002

    captc2002 New Member

    I can verify that this rooting method works with the Intuition after the latest OTA, 11B. Rokky's instructions are critical. You have to add the word "shell" to the line and the && trick is totally the bomb.

    I've only ever done one-click rooting, but that isn't an option after the update. Bin4ry's script (2.7) won't work. The method in this thread, however, does.

    Anyone who, like me, is intimidated by executing commands in shell should know: it is scary. I used the Windows version of adb because I am still adapting to the Ubuntu world of package installation. However, inside the shell, there's the familiar $ and # prompts. On the other hand, don't worry. If you mess up, you won't brick your phone. The root will simply fail and your phone will still work just fine. You can try again. Trust me. I messed up the first two times, but went back and redid each step + Rokky's tip at the very end. It is easier if you cut and paste the first post (thank you!) into a text editor and then cut and past Rokky's into the proper location, pasting over the code with the missing word.

    If you do that you will have clear directions and everything will be right as rain.

    Once you root, download Supersuser and select the option of preserving root from OTA. This option does the same thing as Root Protector.

    If anyone needs help, I can post the directions that cobbled together on adb installation, the script listed here, and the critical modifications made by Rokky.

    The Intuition is not the most popular of phablets, but if you are on a budget and need the bigger screen because you can't read the tiny type or are sick of having to scroll back and forth, then the LG Intuition works well. Rooting it will allow you to freeze programs (using Titanium Backup) and dump bloatware.

    So the moral of the story is: It's okay to be scared, but you can root this phone using these directions and it is totally worth it.

    thegumbyman likes this.
  14. thegumbyman

    thegumbyman New Member


    I'm going to try this when I get home from work tonight. I had my Intuition rooted shortly after I got it in November last year. Then the OTA broke my root. I wish I would have know about the Superuser option, so thanks for that, too! It would help me a lot if you could post your modified code with the additions from Rokky (nice work!). I only wish this phone was more popular and had more developer support. It really is a BEAST for the price.

    It worked! I had a heck of a time getting ADB to recognize it as a device. Took me an hour to figure out that I turned off USB Debugging when I wasn't rooted any more! Thanks guys!
  15. Cab414

    Cab414 New Member

    I have this same problem but don't know where to insert the above script? Anything I enter just drops down with the # sign again. I am so close with this just cant get superuser binaries to phone.
  16. Cab414

    Cab414 New Member


    What did you do to resolve this? I know it's been a while, but if you can remember I would appreciate the help.
  17. wolfdogg

    wolfdogg Well-Known Member

    he is saying just run that command from the root prompt, which is indicated by the # symbol, as opposed to the $ symbol which is not root, but is user prompt. So if you have a root prompt, i.e. the hash symbol #, then run the script directly from the root prompt, i.e. [HIGH]# /data/local/tmp/lgroot.sh[/HIGH]

    i have the newer firmware as well, just did this today. i ran into a problem when i installed superuser from clockworkmod, it was complaining about su or superuser something or another, and kept erroring out, i used 'root checker basic' from the market to verify that it hadnt been rooted. i kept thinking it was a mistake with the adb kit, but it wasnt, because after i finally deciced to install the other superuser from the market from chainsd, it worked, and root checker verified this. im good to go now.

    To get ADB to recognize device [HIGH]adb devices[/HIGH] you need the driver, correct drivers for intuition are currently located here. LG LGVS950 Support: Find Manuals & Warranty Info | LG USA
  18. mani2263

    mani2263 New Member

    I installed 2nd init-recovery on my rooted LG Optimus LTE II. After that i tried to restore my apps etc after wiping out my delvick cache & phone cache using an file update.zip.
    Now when i restarted the phone it shows

    [420] Fastboot mode started
    [420] udc_start()

    when i attach usb cable, it further shows

    [80690] reset
    [80690] portchange

    and never loads lg device driver. when i restart the phone using key combo to go to phone bootloader. then it loads the driver.
    please guide me how to recover my phone????
  19. rickythegreat

    rickythegreat New Member

    after i root my phone now it all slow down did it happen to anybody else than me and if not and you think i did something wrong please tell me
  20. thurmanbr549

    thurmanbr549 New Member

    PLEASE HELP!!! when you save the files where do you save them to and how???
  21. merman54

    merman54 New Member

    Trying to root my wife's Intuition. I am not a developer, but I have done this stuff before. Fairly new to ADB though.

    I am running Software version VS950022B, Build number JZO54K.

    I am getting an "access denied" error when on this step: $ rm /data/vpnch/vpnc_starter_lock

    Here is what I have done so far:

    C:\Android_dev\adt-bundle-windows-x86_64\sdk\platform-tools>adb devices
    adb server is out of date. killing...
    * daemon started successfully *
    List of devices attached
    d5e57124 device

    C:\Android_dev\adt-bundle-windows-x86_64\sdk\platform-tools>adb push su /data/lo
    3870 KB/s (380532 bytes in 0.096s)

    C:\Android_dev\adt-bundle-windows-x86_64\sdk\platform-tools>adb push lgroot.sh /
    32 KB/s (164 bytes in 0.005s)

    C:\Android_dev\adt-bundle-windows-x86_64\sdk\platform-tools>adb shell
    shell@android:/ $ chmod 777 /data/local/tmp/lgroot.sh
    chmod 777 /data/local/tmp/lgroot.sh
    shell@android:/ $ rm /data/vpnch/vpnc_starter_lock
    rm /data/vpnch/vpnc_starter_lock
    rm failed for /data/vpnch/vpnc_starter_lock, Permission denied
    255|shell@android:/ $

    Any ideas? Thanks!
  22. KingChoad

    KingChoad New Member

    You can use the Chinese method live I have,its on click root so you wont need the adb command prompt ive gotten so upset because I didn't know where to put the files..
  23. wolfdogg

    wolfdogg Well-Known Member

    i was running into the same problem as KingChoad,
    running Software version VS950022B, Build number JZO54K,

    i felt pretty stupid running the chinese rootmaster downloaded from xda devs, and even more stupid clicking buttons that i couldnt read, however, 'root checker basic' app that i have on my phone now reports i have root access, where it reported that i didnt shortly before.

    i wanted to tell others who wanted to try this program for their Intuition,

    install the chinese program by clicking the button that gets it to install, usually the lower right buttons. once its on your system, you need your phone connected (not sure what drivers, i have universal adb driver on mine), then once it installs, the program launches, or you can launch it from either your start menu, or your desktop, its all in chinese.

    once you have the program open, it shows a connnect usb symbol, connect if you havent yet, once you get the program up, heres what i did.

    theres a green button on the right, and i think it said root, i clicked that, and either before, or after that, i saw the app also come up on my phone screen, once i clicked it, it rebooted my phone.

    after it rebooted, i saw the chinese program still open on my desktop. STOP HERE. i see it now has a green button on the right, and another button on the left now says ROOT, its a white button. this is where you STOP. see screenshot where you need to stop

    how do you print screen
    it means its rooted, and if you click the Green button (that doesnt say root), im pretty sure you will unroot it. i think its safe to close the program now, and see what other kind of damage may have incurred.

    maybe our phones have turned into a communist slave machine, i dont know.
  24. wolfdogg

    wolfdogg Well-Known Member

    ok i was able to successfully check off the 'ota survival' option in chainsd superuser, this time it was successful, so once again, moving forward.

    i can tell you this, the chinese program installed two new apps, one i recognize as the one that did the work rooting, the other plainly says 'superuser', and is blue.

    this superuser was the program that came up when i checked 'ota survival' where i expected chainsd's to come up. i saw some chinese writing to my fear, then i realised its just because i was running the chinese superuser. those programs are now coming off my system. more later........

    EDIT, ok from the applications menu, i was able to remove the program that had a chinese icon, which was the one that did the rooting. but the otherone called superuser i wasnt able to remove yet.

    i removed my chainsd just incase, before i did this, since the name was the exact same 'superuser' i thought maybe it just want showing up in the installed app list because of this, but aftyer removing chainsd and reboot it still didnt show up in installed apps, it just showed up in 'all' apps. the only thing i was able to do was disable it, in application menu (all). hopefully it will no longer be set as the default superuser program.

    will reinistall another superuser either CW, or chainsd now.
  25. wolfdogg

    wolfdogg Well-Known Member

    ok i was now able to run $su from adb shell, and it dropped me right to root user

    then i went straight for that starter lock just for kicks
    got that bastard moved out.
    note, it jumped right back in there within about 20 seconds.
    so this time i tried something different
    for some reason it doesnt show up as a symlink yet, so im not worried about it. continuing on for the heck of it, i guess i sort of want to see what happens when i continue on with the original method to see if theres any benefit in the end.
    now after reboot
    looks like indeed the su file is gone.
    going to add it back.
    exit shell first, then do an adb push
    now im going to take a peek at starter_lock before removing it
    still looks the same.
    lets see if it stays gone when i remove it, not sure if that matters or not though
    waited 20 seconds, did an ls and its back.
    what does that mean, BAD or GOOD? ANYBODY?
    now while in adb shell still
    EDIT: well my phone is still rooted, i was able to get into busy boy, and update it, and enjoy the new rooting.

    now if i can just figure out how to deverizonitize this phone, since i have yet to find any roms for it.

Share This Page