Root the LG 43UR7550PSC

Root webOS 10.3.1 (firmware 33.31.61) with SlopBro launched through voiceweb, then swap the telnet root shell for SSH.

Unmodified SlopBro launches an ad-overlay app on webOS 10. On this set that app accepts the launch but never loads the page, so nothing installs. Pointing SlopBro at com.webos.app.voiceweb instead installs Homebrew Channel.

Tested

25 October 2026 — Homebrew Channel 0.7.3 survived a reboot, and SSH as root returned uid=0(root).

Rooting is unsupported by LG, can void the warranty, and a bad change afterwards can brick the TV. Never reinstall the LG Developer Mode app on a rooted TV — a later boot can wipe /media/developer, taking Homebrew Channel with it.

Applies to


Model	`43UR7550PSC`
Firmware	`33.31.61`
webOS	`10.3.1` (marketed as webOS 25)
OTA ID	`HE_DTV_W23P_AFADATAA`
SoC	`k8lpn`

Other 2025 sets on the same firmware root with stock SlopBro via com.webos.app.adoverlayex. If that works for you, skip the edit in step 1.

You need: a Linux/macOS PC with Python 3 and git on the same LAN as the TV, plus both IP addresses. The examples below use:

TV: 192.168.1.6
PC: 192.168.1.8 (its Wi-Fi/LAN address — not a Docker 172.17.x or Tailscale 100.x address)

Root it

Clone SlopBro and put voiceweb first

git clone --depth 1 https://github.com/throwaway96/slopbro.git
cd slopbro

SlopBro launches the first installed app in TARGET_APPS that matches the webOS version. voiceweb is already listed, but only for webOS 11. Move it to the top and add 10:

slopbro.py

TARGET_APPS = [
    ("com.webos.app.voiceweb", "URL", [10, 11]),
    (
        "com.webos.app.adoverlayex",
        "interactiveUrl",
        [3, 4, 5, 6, 7, 8, 9, 10],
    ),
    # leave the remaining entries as they are
]

Keep the parameter name as is: voiceweb reads URL; the overlay apps read interactiveUrl (and ignore it on this TV).

Run SlopBro

--webos-version is the major version from the TV's settings screen — 10 for 10.3.1, not 25.

python3 -u slopbro.py --debug --local-ip 192.168.1.8 --webos-version 10 192.168.1.6

Accept the pairing prompt on the TV if one appears (the key is saved as <tv-ip>.key and reused).

Done when:

the log names com.webos.app.voiceweb, and
the TV has requested all four files: index.html, autoroot.sh, package.json, main.js.

The TV then reports the service launched and installs Homebrew Channel 0.7.3 (org.webosbrew.hbchannel). After the four files are fetched the PC can stop; the rest runs on the TV.

Remove Developer Mode, then reboot

If the Developer Mode app is installed, uninstall it before the first reboot.

Uninstall Developer Mode.
Turn Quick Start+ off.
Reboot from the TV menu (it drops off the network for about a minute).

Telnet on port 23 is now a root shell; SSH is still closed:

telnet 192.168.1.6      # then: id → uid=0(root)
ls /var/lib/webosbrew   # init.d  startup.sh

Switch from telnet to SSH

In Homebrew Channel → Settings, enable the SSH server and disable telnet, then reboot. These switches only take effect on the next boot.

Host	Port	User	Password
TV LAN IP	`22`	`root`	`alpine`

ssh root@192.168.1.6 id     # uid=0(root)
nc -zv 192.168.1.6 23       # should be refused

Replace the default password with a key

Copy your public key from the PC, then reboot the TV once more. With authorized_keys present, the startup script stops setting the alpine password.

cat ~/.ssh/id_ed25519.pub | ssh root@192.168.1.6 \
  'mkdir -p /home/root/.ssh && chmod 700 /home/root/.ssh &&
   cat >> /home/root/.ssh/authorized_keys && chmod 600 /home/root/.ssh/authorized_keys'

Verify

ssh root@192.168.1.6 '
  id
  ls /var/lib/webosbrew
  ls /media/developer/apps/usr/palm/applications | grep hbchannel
'

Expect uid=0(root), init.d and startup.sh, and org.webosbrew.hbchannel — all without a password prompt.

Troubleshooting

Symptom	Cause	Fix
Log shows `adoverlayex`, then hangs on "waiting for all tracked files"	Launch succeeded but the app ignored the URL	Put voiceweb first in `TARGET_APPS`; kill any old SlopBro holding port 8080; rerun
TV never connects back to the PC	Wrong `--local-ip`, or different networks	Use the PC's Wi-Fi/LAN address, not Docker/Tailscale
`--webos-version 25` finds no app	25 is the marketing name	Use `10`
`tinybrowser` shows the page, then stops	It can render HTML but can't fetch the other files	Use voiceweb
`returnValue: true` but no Homebrew Channel	webOS only accepted the launch	The TV must fetch all four files; fetches from the PC or `curl` don't count
Port 22 closed after the first reboot	SSH isn't enabled yet	Use telnet (23), enable SSH in Homebrew Channel, reboot
Port 22 closed during boot	SSH starts with Homebrew Channel's startup script	Wait until the LG logo is gone and the TV answers ping
No SSH key in Homebrew Channel settings	0.7.3 doesn't generate one; Dev Mode keys are rejected	Log in as `root` / `alpine`, then add your own key
Homebrew Channel vanished after a reboot	Developer Mode app wiped `/media/developer`	Uninstall Developer Mode and root again

Why not RootMyTV, faultmanager-autoroot, or Dev Mode SSH?

RootMyTV was patched in 2022 and never supported webOS 7+.
faultmanager-autoroot refuses to run on webOS 10.1 and later.
Developer Mode SSH is not root. It is user prisoner on port 9922, in a jail with no su and no /var/lib/webosbrew. The on-screen passphrase unlocks a private key (it isn't the SSH password), modern OpenSSH needs ssh-rsa re-enabled for its host key, and ares-shell can fail because /etc/profile doesn't exist in the jail. WebOS Dev Manager handles the quirks if you need it — but you don't for rooting.

Root the LG 43UR7550PSC

On this page