Will go into more detail after I get home tonight.
Another LG Root:
Found to work on most GSM LG G3's, and my Korean LG Flex. I suspect it is wide spread among LG devices.
I was recently pointed to an odd bootmode and service on the LG G3 by "IOMonster". This bootmode is called bnr recovery (backup and restore?). It is accessed with adb reboot --bnr_recovery or adb reboot --bnr_recovery-s.
Whats so special? System and data are both mounted RW in this mode, and a backup service is running.
/sbin/bnr will watch the /temp dir (which is owned by shell user!) for various files, these files are used to command the bnr daemon/service to do nifty things. One of those nifty uses is untaring a file to /. Since system is mounted RW ... we can just dump su into system from a tar.
This tarball contains su, daemonsu and install-recovery with the proper permissions and paths set:https://drive.google.com/file/d/0B-idfoGaBodCZEQ5Zy1nQmE5YW8/edit?usp=sharing
adb reboot --bnr_recovery
adb push start_restore /temp/start_restore
adb push start_restore /temp/start_restore (bnr wants it pushed twice)