root@LGwebOSTV ~

OLED77C1PUB · webOS 6.5.3-47

29 Oct 2026. Local set, owner present. Homebrew Channel was installed with SlopBro. Promo shelves, ad programs, and the telemetry uploaders were switched off afterward. Firmware packages stayed on disk.

Linux LGwebOSTV 4.4.84-229.kcl4tv.6 #1 SMP PREEMPT Sat Sep 13 08:10:48 UTC 2025 aarch64

02 what answered

The set was on the LAN. Ping was about 4 ms with no loss. It advertised itself as [LG] webOS TV OLED77C1PUB. UPnP also answered as WebOS/1.5, WebOS/4.0.0, and WebOS/4.1.0. Those strings are service versions, not the OS.

Developer Mode 1.12.2 was installed. The key server was serving the developer key. A shell as prisoner was not opened. The passphrase stayed on the TV.

03 which root

The 2017 set in the other log is webOS 3.9, and DejaVuln still applied there. This C1 is webOS 6 on software 03.53.45. The same number is past every older public method.

A failed software root is described by Homebrew as leaving the set as it was. The brick cases are later changes: writing the kernel or rootfs, and marking files immutable. No C1 report found in this pass was a permanent brick from a failed root attempt. A wrong Homebrew build on a C1 at 03.33.11 left SSH dead for about a day, then recovered. A US 77-inch G1 on this same firmware launched SlopBro’s apps and never fetched the page. That report did not describe a brick.

The G1 and this C1 share HE_DTV_W21O_AFABATAA, software 03.53.45, and webOS 6.5.3-47. The G1 report used SlopBro v0.0.5, which GitHub still marks as Latest. v0.1.0 is a pre-release from 27 Sep 2026, commit 21023d56, message “add workaround for LG’s patch attempt.” That difference was the reason to try v0.1.0 here, not a promise the G1 would follow.

04 the run

SlopBro v0.1.0 was run from that commit. Flags were --debug, --webos-version 6, and an explicit LAN address for the computer so the script would not guess. The default fake-service-path workaround was left on. Developer Mode’s SSH was up and was not used. Pairing was the on-screen Allow.

The script’s first webOS 6 candidate that was installed was com.webos.app.adoverlayex. It launched, and the TV fetched all four tracked files about a second later: index.html, autoroot.sh, package.json, main.js. The launch returned true. No crash toast.

Homebrew’s own screen showed rooted, with telnet on. Port 23 accepted a connection with no login and returned uid=0(root) gid=0(root) on the kernel above. Port 22 was still refused. Developer Mode was removed after that. /var/luna/preferences/devmode_enabled remained, which is the persistence marker. It was not installed again.

Quick Start+ was off before the reboot that keeps Homebrew. That part matches the SlopBro and Homebrew notes: an OLED can look off while the pixel refresher is still running.

05 the US report

The comparison was posted on SlopBro issue 7. That issue is a US OLED77G1PUA, same platform and firmware, where the overlay apps launched and never requested the page. This C1 did request the page, on v0.1.0, through the app and parameter the script already chooses for webOS 6. v0.0.5 was not re-run here, so the note does not claim the workaround is what changed the result. Addresses and the client key were left out of the comment.

06 ads and telemetry

lg-webos-ad-killer was the fit. Its author had already run it on an OLED55C16LA, webOS 6.5.3. It bind-mounts a filtered home layout and an exit stub over selected programs. It does not delete packages. The copy used hashed to b7955ed3ac075dff56ce0b620097b0c59b41fbc2f2034e13e3480376de4de75b.

The dry run completed. Profile ads was applied, not privacy. Privacy also stops voice, Alexa, ThinQ, and music recognition. Those were left running. A previous copy of the settings files was saved at /home/root/debloat-backup before the write. The hook is /var/lib/webosbrew/init.d/ad-killer, so the stubs come back at boot. The mounts themselves do not survive a reboot without that hook.

Home rows removed from the layout, not from disk:

Prime, browser, content preview, editor’s picks, games, inline ad banner, both LG recommendation rows, Life on Screen, the Live TV row, recommended, sports alerts.

The script refuses to continue if the Apps row or the home dashboard row would be removed. This run finished, so those two stayed. Live TV as an app was not deleted.

Both setSystemSettings calls returned true, and a second read matched the table. Firmware-update hosts were not blocked. Opening the Content Store or a streaming app still talks to that service. A mic command can still leave the set, because voice was not part of this profile.

07 OmarchyTV

com.omarchytv.home 2.13.1 was already installed under the developer app path. The in-app banner still says 2.13.0-beta. Number 8 on the remote was already a quick-access slot for it.

On a rooted set the boot behavior is a setting, not a separate machine. Workspace 5, All OmarchyTV settings:

• Open when the TV starts writes an empty flag at /var/lib/omarchytv/boot and a Homebrew hook at /var/lib/webosbrew/init.d/omarchytv. That hook was present after the switch was turned on.
• Home button opens OmarchyTV is a second flag. Home from inside OmarchyTV still reaches LG Home.
• Keep loaded in the background adds the app id to KeepAlive in /home/root/memorymanager-conf.json and restarts memchute.

The third switch showed “rooted TV only” and, on click, asked for root and Homebrew Channel. Homebrew exec was already working: the boot flag and the hook existed. The keep-loaded probe is one shell command whose last step reads the override file. That file does not exist until the switch has been on once, so cat exits 1. The app treats a failed Homebrew command as “not rooted.”

/usr/sbin/memchute does contain the override path, and /etc/palm/memorymanager-conf.json was readable. Its KeepAlive list was com.webos.app.livehbbtv, com.webos.app.livedmost, com.webos.app.liveibb. The override was written as a copy of that file plus com.omarchytv.home, and memchute was restarted. The probe command inside the app was changed so a missing override is not a failed command. After OmarchyTV is opened again, the switch should read on.

08 left in place

Nothing in this log writes the kernel, rootfs, or another signed partition. That is the change RootMy.TV’s warning says bricks a set.

09 sources

• SlopBro · v0.1.0 · 21023d56 · 27 Sep 2026
• C1 confirmations at 03.53.45 · updated 26 Oct 2026
• US 77-inch G1, same firmware, page never fetched
• comparison posted from this set
• DejaVuln already failed on 03.53.45
• CanI.RootMy.TV
• faultmanager-autoroot · webOS 6 called patched 24 Aug 2025
• webOS Homebrew rooting · the January 2025 “no patches” line is older than the tool readme
• root exploits
• crashd · W21O patched at 03.40.85
• do not write signed partitions
• lg-webos-ad-killer
• OmarchyTV webOS install notes
• Homebrew Channel · 0.7.3

The background is one Three.js quad and a fragment shader (r170, MIT, CDN). No passphrase, key, serial, ZIP code, or network address is in this log.