Used Qwen 3.8 flash next on underspeced PC to Root and gut LG TV of spy and adware

I post this because I was honestly quite impressed by the capabilities of this model from a opencode harness and wanted to share my experience. So i've been playing about for a bit wit Strata and Qwen 3.8 flash for a bit and was looking for a new kind of test. One that would also (if succesfull..) give a real life benifit. And since I also like a bit of danger. I thought lets put my spying LG tv on the line since I am to lazy to root and block it myself. It was also something that is in a bit of a gray area although fully legal here in the EU. Actually what LG is doing is borderline illegal here but no authorithy has the balls to do anything about it... Anyway this was the beginning of the context used: Context: LG webOS Spyware & Ad-Free Project (Root Escalation) Recently, there has been breaking news that TV manufacturers are doing deep content inspection and listening in on every conversationyou have around your TV to better target you for ads. We are trying to fight back as consumers against these practices, which are of questionable morality and also technically illegal in the EU. We have already had great success taking back our bought-and-paid-for Android devices via ADB. They were easy to root and sanitize to be like a stock Android TV without all the spy software. However, some of us are not so lucky and have an LG TV, which runs a proprietary OS (although it is Linux under the hood). So far, there has been no luck rooting and stripping out the unwanted spy and adware in the OS of a device that was not sponsored, but paid for in full by the consumer. There is a spark of hope, though. Via developer options, there is a (maybe sandboxed) remote terminal in some kind of userspace. So we just need to do a privilege escalation to be able to further probe the system. The next step will be to find a way to make a root survive a TV reboot. Then we could either remove the spy and ad software from the packages or at least have a script that stops those things from starting, as well as disable auto-update. Long term, we need to reverse engineer the TV OS or extract hardware blobs to make it Android TV compatible. For now, the first action is root escalation. Objective Gain root/terminal access on an LG webOS TV, bypass proprietary restrictions, and eliminate telemetry/adware packages or block them via system modifications. Find out if flashing android TV is going to be feasable in the future At first it questioned the ethics of my request but my framing it as just fidling with a product of I own outright conviced it to help. I gave it further instructions in the context file: Connection Strategy (webOS Developer Mode / SSH) Under the hood, LG webOS Developer Mode opens an SSH server (similar to webOS Dev Manager). We must connect via SSH using the built-in developer credentials. Connection Parameters: Protocol: SSH Target IP: 192.168.1.*** Port: 9922 User: prisoner Authentication Key / Passphrase: **** Agent Instructions & Action Plan Step 1: Initialize Connection & Verify Terminal Access Test SSH handshake with fallback flags for legacy key types (ssh-rsa):ssh -p 9922 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa prisoner@$TV_IP Step 2: System Probing & Privilege Escalation Once inside the userspace shell via prisoner: Check system privileges and architecture (id). Inspect running processes (ps) to map out telemetry and content inspection hooks. Search for local privilege escalation (LPE) vectors or known webOS kernel/service exploits. Log any working exploit in exploit.md in your working folder (where context.md resides). Make a full backup of the current state in your working folder. Step 3: Persistence & Mitigation (Use public security documentation and webOS community resources for reference) Find a way to make root access survive reboots. Log attempts in persistentRootAttempts.md. Save success report in workingPersistence.md. Be sure to roll back changes after success or a failed attempt. Step 4: Neutralize Telemetry (Use online resources for reference) Locate and identify the telemetry software binaries/services.Attempt to remove or disable the telemetry software. Log attempts in removeTelemetryAttempt.md. If removal fails or breaks functionality, write a startup script that kills telemetry processes when launched. Report the confirmed procedure in successfulTelemetryRemoval.md. Step 5: Neutralize Ads Plan a method to remove obtrusive ads from the home screen UI. Log attempts in removeAdsAttempt.md. When successful, report the working procedure in successfulAdRemoval.md. Step 6: Lock Current State (Disable Updates) Disable auto-updates to prevent patching of the exploit vector. When successful, report the working procedure in successfulUpdateDisabled.md. Step 7: Documentation & Sharing Combine the working procedures from all steps (including initial connection setup, ensuring sensitive credentials are removed) into a clean wayToPwnLG.md file for sharing on GitHub. Step 8: Android TV Port Exploration Investigate whether original hardware blobs/drivers can be extracted to support porting or running an Android TV build on the hardware. Create a feasibility study and plan. Step 9: write a noob friendly script and guide for *nix and windows to do it in one click It went ahead and rooted the TV suprisingly fast via a known exploit. It ignored all clear instructions about rolling back changes and making backups though.... It went a bit overboard and became an overachiever by also patching the exploit for security so no one else could do root escalation. This move turned out to shoot me in the foot because it also meant the homebrew shop (who uses that escalation everytime it launches) would no longer work. Luckely the SSH server with root privilages stayed up so it was in the end able to correct its own mistake. It did all this in short order it was quite impressive to watch and reading all the docs and then trying this exploit myself would probably cost me the same amount of time and a headache haha. I dunno if anyone is interested but here is the repo it came up with: https://github.com/switchboy/pwnLG As for the hardware used: Ryzen 7 3700x with 32GB of system ram RTX 2070 Super 8GB of VRAM about a 120GB of NVME SSD space 25~ tokens/s and almost 100% GPU use all the time which is really impressive! submitted by /u/Switchboy1 [link] [comments]

Source: r/LocalLLaMA | 2026-10-28

Related