GetMeIn : One time rooting/jailbreaking tool for webOS LG TV's

Search This thread


Senior Member
Apr 2, 2012
Does anyone know any way to install WebOs 4.0 apps (ipk) on WebOs 1.4 devices? Can I change the version number to fool the LG store?

I want to install Disney + or HBOMAX on my old LG TV, even if I have to root it. I have been trying to find IPKs all over the internet but I can't find them anywhere.

It seems to me the most absurd thing that state-of-the-art hardware is required to access Streamings that can be played on any pc or android device. If Netflix and Amazon can be in a WebOs 1.4 because not Streamings like HBOMAX or Disney +, obviously it will not have 4K or HDR but at least watch the series in basic 1080p format.


New member
Oct 29, 2022
Interesting thread. I've been working through trying to get access. Currently failing after authenticating over SSH. I get the error message PTY allocation failed on channel 0.

Any ideas how I could get past this?


Feb 21, 2013
Hi! Do you solve this problem? I have the same.
Open telnet and run this commands. And password now "alpine"

        sed -r 's/root:.?:/root:xGVw8H4GqkKg6:/' /etc/shadow > /tmp/shadow
        chmod 400 /tmp/shadow
        mount --bind /tmp/shadow /etc/shadow
        sed 's/root:\*:/root:x:/' /etc/passwd > /tmp/passwd
        chmod 444 /tmp/passwd
        mount --bind /tmp/passwd /etc/passwd


New member
Nov 27, 2022
managed to root TV but cannot seem to SFTP in Winscp to edit start-devmode-sh file for perm root. Oddly Homebrew app doesnt show root either
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 47
    Hello XDA,

    After a long thinking i've decided to create a root or jailbreak tool for LG's awesome webOS, today am stating this thread to release this new root tool, but before that! am gonna ask you for some logs from webOS 3.5 and lower.

    Everyone in this thread must know about webOS if not do your homework then get back again, LG did a great work on this operating system after HP and Palm's versions. they even supported Raspberry Pi module B. but webOS OSE aka Open Source Edition is really different from TV's version.

    LG think about Security and frequently release updates that doesn't have anything new except some patches to close down known holes, one of my favorites was a directory traversal that can replace in tv files and binaries during install (partially closed recently).

    let'stake a look at LG's partition filesystem types, on tv's they chooses to use ext4 for writable partitions (/var, some of /mnt/lg/*, /home and /media) everything else is using squashfs which is a read only compressed filesystem you cannot modify it.

    If you can dump the squashfs partition unshquash it then recompress you will face another problem of hashes and crc checks (checkout the update binary for more details) if you dd it back to block device without kernel and/or bootloader patches. so this is not gonna just work easily.

    What we can really do it play on the RW parts of the system, one of the design flaws on webOS is the devmode aka Developer Mode, they ship it in a Read Write partition so that's easy to be modified.

    To do that you must have root access or some powerful exploits to achieve your goal.

    This method is using memory access vulnerability to get root and then jailbreak the tv. i ported some parts of the other root thread even if some are not even needed.

    To jailbreak connect to your tv via prisoner user after uploading GetMeIn binary into it then :

    chmod +x GetMeIn

    if root succeed and you saw some errors do this :
    mkdir -p /media/cryptofs/root/etc
    mkdir -p /media/cryptofs/root/lib

    After that just reboot and enjoy your root with same ssh key, or use password "alpine".

    there is some old pictures attached, i did some modifications after those.

    Hope this is good enough.:angel:
    What would be a good reason to root a smart tv? What can I do afterward?

    To use this GetMeIn webOS Jailbreak tool please create a developer account on LG's developer portal, install developer mode application on your TV and connect with your recently created account.

    Open dev mode app please set the Dev Mode Status to ON and Key Server to ON.

    grab your ssh key with ares then connect to your tv using ssh :

    [email protected]:~# ssh -i ~/.ssh/webOS_TV [email protected] -p 9922
    when you get connected you just follow the steps on the thread.

    Please test and share back screen shouts and logs from tv in both cases failure or success.

    I need informations from your webOS v 3.5 and lower, TV model and webOS version and some commands from the tv.

    okay first of all create a dir named logs :

    mkdir logs

    TV Infos :

    cat /var/run/nyx/device_info.json > logs/device_info.json
    (delete your nduid serial number and mac addresses)

    webOS Infos :

    cat /var/run/nyx/os_info.json > logs/os_info.json

    cat /proc/cpuinfo > logs/cpu.log

    ls -arls /var/log/ > logs/logdir.log

    ls -arls /usr/lib/ > logs/libsdir.log

    ls -arls /proc/ > logs/procdir.log

    ls -arls /dev/ > logs/devices.log

    In case the jailbreak works restart and run this additional commands :

    mount > logs/mounts.log

    i think that's everything i need, upload the logs dir somewhere and put a link here.
    any news for support of new webOS versions ?

    testing some other bugs with help of some great ppl from this topic. will let you know sooner

    can u tell a bit more?
    how can one use these endpoints?

    btw, can this be any help to u:

    ---------- Post added at 06:54 PM ---------- Previous post was at 06:46 PM ----------

    awesome work man, long waited for this...
    Oh yes i saw that on github before and the replay after you clarified this. i will checkout if there is some hidden API Calls and let you know.

    You can control the TV with the endpoints, basically the LG app works like that, that it sends commands to those endpoints. There are various apps and plugins which already use them, you can simply use them with a http client.
    This link which you provided only has the documented endpoints, but there are lots more which are undocumented. Those undocumented could be used to get even more control over the TV and maybe allow more access to the TV. And to find those undocumented endpoints someone needs to have access to the root file system, which was achieved here :)
    I suppose there should be some kind of JSON file on the file system which has all of them listed + the parameters which they accept...
    Thank you you clarified this, i did not knew it's the same thing before i read your replay then i remember.

    still haven't rooted yet but will do this weekend.
    hope we can magisk or something so we can have adblocks etc..
    Yes just replace /etc/hosts file and you're done :)

    Thank you very much for this GREAT work :)
    I have only one question [well now that i think about it its 2 :-/ ]

    1. Will there be a way to revert back to original boot loader/mode [e.g. i dont want to brick my T.V. ]
    2. Do you think we will have an easier automated way todo it [e.g. insert a USB Thumb drive restart the T.V. and vualla it is rooted ?]

    Again ,Thank you very very much :)
    1. Actually yes and the whole process does not even change the original filesystem we just change one original file and add other things that does'nt harm the webOS. I will upload new version that take a backup first and make --restore argument to unjailbreak
    2. I think there may be a way :)