[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
To further learn about the topic at hand I've been digging at this a bit. I'm focused on the bootloader as well as root. Now I'm no expert and probably could be wrong on somethings but here's what I'm finding out.

I'm almost positive Samsung uses the (dm-verity) kernel feature introduced into Android 4.4 Kitkat. (Reference)

Now upon decompiling the bootloader (I believe is aboot.mbn) I've found the same SMC (Secure Monitor Call) that Dan R. exploited HERE, but who knows if this is even exploitable because this is about 21 months old and could have been addressed by Qualcomm since. I believe our device uses the same QFuses like the aforementioned with finding this string "[TIMA trusted boot]: SMC call to set the warranty violation fuse failed\n" . I'm not sure if this FUSE is blown from the factory to disable an "oem unlock", or if it's NOT blown to disable an "oem unlock". I say this because Dan's work on the Motorola has the latter and the Galaxy S4 was the opposite and hence Bootstrapping. But then again this could just be the KNOX trip though...

BOOT PROCESS

This is how I understand the process, I could be wrong since this is what I've collected from a short time frame. This could be useful so I'll leave this here and change it as I find corrections. Without a process to understand you can never have a starting point for an exploit.

TrustZone (TZ.mbn)

Bootloader (aboot.mbn)

Secondary Bootloader (sbl1.mbn)

If we are to find any kind of exploit for ROOT I believe we'll have to go though the bootloader since we are dealing with dm-verity on a locked bootloader. So

BLOCKS/PARTITIONS

Again, important for knowing. I've added the corresponding file names next to the blocks/partitions to which I believe they belong to.

cat /proc/partitions
major | minor | #blocks | name | [description] | (firmware file)

7 0 3150 loop0
7 1 26019 loop1
7 2 21861 loop2
7 3 31217 loop3
7 4 15624 loop4
7 5 67631 loop5
7 6 67631 loop6
7 7 26019 loop7
253 0 1048576 vnswap0
179 0 30535680 mmcblk0
179 1 19456 mmcblk0p1 [apnhlos] (NON-HLOS.bin)
179 2 66464 mmcblk0p2 [modem] (modem.bin)
179 3 512 mmcblk0p3 [sbl1] (sbl1.bin)
179 4 512 mmcblk0p4 [sbl1bak]
179 5 64 mmcblk0p5 [dbi]
179 6 32 mmcblk0p6 [ddr]
179 7 2048 mmcblk0p7 [aboot] (aboot.mbn)
179 8 512 mmcblk0p8 [rpm] (rpm.mbn)
179 9 512 mmcblk0p9 [tz] (tz.mbn)
179 10 4096 mmcblk0p10 [mdm1m9kfs3]
179 11 6144 mmcblk0p11 [pad]
179 12 10240 mmcblk0p12 [param]
179 13 14336 mmcblk0p13 [efs]
179 14 4096 mmcblk0p14 [mdm1m9kefs1]
179 15 4096 mmcblk0p15 [mdm1m9kefs2]
179 16 4 mmcblk0p16 [mdm1m9kefs3]
179 17 17408 mmcblk0p17 [boot] (boot.img)
179 18 19456 mmcblk0p18 [recovery] (recovery.img)
179 19 4084 mmcblk0p19 [fota]
179 20 1024 mmcblk0p20 [misc]
179 21 8 mmcblk0p21 [ssd]
179 22 8192 mmcblk0p22 [persist] (persist.img.ext4)
179 23 9216 mmcblk0p23 [persdata]
179 24 3891200 mmcblk0p24 [system] (system.img.ext4)
179 25 512000 mmcblk0p25 [cache] (cache.img.ext4)
179 26 25935852 mmcblk0p26 [userdata]
179 32 4096 mmcblk0rpmb
179 64 31259136 mmcblk1
179 65 31255040 mmcblk1p1
254 0 3150 dm-0
254 1 26019 dm-1
254 2 21861 dm-2
254 3 31216 dm-3
254 4 15624 dm-4
254 5 67630 dm-5
254 6 67630 dm-6
254 7 26019 dm-7

FIRMWARE DE-COMPILING

I will add more info as I find it. I'm a novice when it comes to using a decompiler and will probably NOT be the guy to find a solution, but I do want to contribute. I'd really like someone with more linux-based knowledge to chime in and school me on the .mbn format so I could understand it a bit more. Here's what I've found thus far:

[IMG="TrustZone Strings"]http://shortbusriders.com/XDA/tz.jpg[/IMG]

You may have to 'Open in New Window' to view image

My questions on some of these findings:

What are the blocks/partitions labeled as loop and dm used for?

Is it possible to edit the build.prop after extracting the RAMDISK in boot.img then rebuild and flash in ODIN? If no, then I'd like to know to WHERE it would error.

More to come... working as you read :)

More literature...

Azimuth Security.

Personal side notes & Acronyms I've recently had to learn:

TIMA = Kernel Integrity Monitoring (Referenced in aboot.mbn)

GPT = GUID Partition Table (Referenced in aboot.mbn)

SCM = Secure Call Monitor

QSEE = Qualcomm Secure Execution Environment