Explained: Rooting The LG G5 (H850 EU only)

The G5's Always On Display is great especially when you plug it in. Beautiful David Hamilton photo to accompany your dreams all night.
The G5’s Always On Display is magnificent. Beautiful David Hamilton photo to accompany your dreams all night.

Required background information

Android phones have 3 system levels:
system
recovery
bootloader
Each level can modify the level above it. So in order to modify system, you need to first make recovery do your bidding. And to do that, you need to unlock the bootloader.

In Android phones, internal storage is split up into partitions:
/boot: contains the Linux kernel and ramdisk. SuperSU and no-dm-verity will patch the files here.
/system: Android.
/data: Apps and settings are installed here. A factory reset just wipes this partition.
/recovery: recovery system goes here. We will flash TWRP onto it.
/cache: amongst other uses, LG’s Software Update downloads OTAs here.

Android platform tools:
adb: works in recovery and Android (if Development Mode is enabled and USB mode is not Charging Only)
fastboot: works in bootloader
adb reboot (bootloader or recovery) – Totally great! Now you don’t have to fiddle with button combos to get into recovery.
adb push/pull – really easy way to get/put files on phone’s storage. Uses MTP
fastboot flash (image) – flashes a certain partition with whatever image file you have on the computer.

LG G5’s recovery button combo:
Hold Volume Down+Power.
When you see the LG logo, let go of Power and press it down again (keep it pressed).
Keep holding both buttons.
It will ask you if you want to factory reset. Say yes only if you want to lose your data.

Backup

You will lose all your data. Get it off the phone.

Bootloader

First you must unlock the bootloader. Follow LG’s instructions here.

After you do this, from now on whenever you boot your phone it will say “Your device software can’t be checked for corruption”.

Recovery

Now that the bootloader will let you flash something onto it, you can change the recovery. The stock recovery only displays an Android with an open stomach – you can’t do anything on it. Download TWRP for the LG G5 here.

With your phone plugged into your computer and USB debugging enabled, type:
adb reboot bootloader
The phone will reboot into a black screen with some small text that includes “Welcome to Fastboot Mode”:
fastboot flash recovery twrp-3.0.2-0-h850.img
Upon reboot, the G5’s system will find that the recovery has been flashed, and will restore the old version. You don’t want that. So send TWRP to the phone again and tell the phone to boot directly into it:
fastboot boot twrp-3.0.2-0-h850.img
When booted, TWRP will automatically patch /system so that it won’t try to overwrite TWRP on the next boot.

System

Put a microSD into the LG G5, because /data (internal storage) is encrypted and TWRP can’t read/write to it. That’s why we’re going to wipe /data later and patch Android to not use encryption.

OK, now you’re in TWRP. It’ll ask you to swipe right if you really want to allow system modifications. After you swipe right, you need to flash no-verity-opt-encrypt.zip or else you won’t be able to boot into Android again, only into the bootloader/recovery.

Backup your /boot and /system partitions. Tell TWRP to save the backup to the microSD card.

Download SuperSU and no-verity-opt-encrypt.zip, and use adb to push these files from the computer onto the G5’s microSD over USB.
adb push no-verity-opt-encrypt.zip /external_sd
adb push SuperSU.zip /external_sd

Install SuperSU.zip and no-verity-opt-encrypt.zip using TWRP. These will modify the /system and /boot partitions, which is why we backed those up earlier.

Go to Wipe->Format Data. Don’t Swipe to Factory Reset – it’s not the same thing. It removes all the files in /data but it can only do that if it can read/write /data – which it can’t at the moment.

Congratulations. Just Reboot->System.

If you ever get stuck at a white screen that says “Encrypting”, boot back into TWRP and Wipe->Format Data. And make sure you flashed no-verity-opt-encrypt.zip.

Rooted

This is what we’ve all been waiting for.

Hate Facebook/Instagram/Evernote? Want to get rid of those stock apps? They’re in /data/data.

Hate ads in free apps and websites? Install Adaway. Of course, you won’t find it on the Play Store 😉

Wifi passwords are stored in plaintext in /data/misc/wifi/wpa_supplicant.conf

Install TitaniumBackup. it’s so much more flexible than backing up /data, because you can transfer your apps+data into a totally different ROM, like Cyanogenmod.

Leave a Reply

Your email address will not be published. Required fields are marked *