yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note 4] cylamanae:
I believe it used an exploit in Sense UI not 100% sure any more I think jcase would be the person to ask about that... though ill try weaksauce quick. which it just crashed just right after the disclaimer.
[AT&T Samsung Galaxy Note 4] hsbadr:
Google Chrome < 40.0.2214.109

Hope this helps...
[AT&T Samsung Galaxy Note 4] Stryke_the_Orc:
I'm no exploit developer, nor do I play one on TV, but a flash vulnerability is probably far over-reaching and overcomplicated. In order for flash to be used to grant you root, you need to be able to elevate it to a system level process. Seeing as its no longer supporting Android, and not included in any stock OEM firmware, you have to either install as a normal app, or sideload into /system which, last I knew, required root priveleges. In either case, you're potentially exploiting the device to elevate an app to exploit the device. Personally I think the Gear VR route is probably the most likely to yeild results as the apps for that device speak at hardware level with your device.

I could be wrong, but jm2c...
[AT&T Samsung Galaxy Note 4] swear0730:
I apologize in advance, not trying to hijack the thread but 90% of the people on this board are too young to remember the ad that originated this.

I'm not a Doctor, but I play one on TV Commercial 1986 with Peter Bergman Vicks Formula 44:

https://www.youtube.com/watch?v=ts0XG6qDIco
[AT&T Samsung Galaxy Note 4] scarygood536:
How is this on topic? you know better as you explicitly apologized before. Keep on topic or dont post. It's little off topic post like this that blow up a thread up.

People who post other devices root method programs, research the cve that was used and post it with it. It will help form a what was patched and what wasnt patched on our device. This can also ease congestion of unusable cve exploits. Then we can get possibe cve exploits and see what we can combine with what to be able to write to /system.

As a request to the OP to maybe post what methods were tried and cve that our device os vulnerable to and ones that are comfirmed patched (as the thread progresses). Just to have some organization in the thread to atleast make it more appealing for people who want to help,but dont have time to look through the forum to get caught up.

Sent from my bandaid smelling s-pen
[AT&T Samsung Galaxy Note 4] Surge1223:
So when I send commands via qseecom send cmd function I always get a fault and unsupported qseecom client messages. I wrote a test binary that uses the qseecom listener service to register a few libraries just for fun, then I added the ability to enter a custom library to load..

shell@jfltevzw:/data/local/tmp $ chmod 755 test
shell@jfltevzw:/data/local/tmp $ ./test
mypid 31410
myuid 2000
Enter the file name:
/data/local/tmp/libexploit.so
Loading libs
Lib loaded, getting dlysm
255|shell@jfltevzw:/data/local/tmp $

This is dmesg output. If anyone has any ideas to elevate my uid to 1000 using a library or registering a qseecom service then let me know

<7>[35254.625396] test: unhandled page fault (11) at 0xc132156f, code 0x00d
<1>[35254.625396] pgd = da094000
<1>[35254.625457] [c132156f] *pgd=8141141e(bad)
<4>[35254.625609]
<4>[35254.625640] Pid: 27599, comm: test
<4>[35254.625640] CPU: 0 Tainted: G W (3.4.0-1151670 #1)
<4>[35254.625640] PC is at 0xb6fc9006
<4>[35254.625640] LR is at 0xb6fc9003
<4>[35254.625670] pc : [<b6fc9006>] lr : [<b6fc9003>] psr: 000d0030
<4>[35254.625670] sp : be858830 ip : 6bcf4001 fp : be85892c
<4>[35254.625670] r10: 00000000 r9 : b6fc9881 r8 : 00000001
<4>[35254.625670] r7 : b6fdbbb1 r6 : b6fda7eb r5 : 00ab22c4 r4 : be858880
<4>[35254.625670] r3 : 00000000 r2 : be858a5f r1 : 00ab22c4 r0 : 00000000
<4>[35254.625701] Flags: nzcv IRQs on FIQs on Mode USER_32 ISA Thumb Segment user
<4>[35254.625701] Control: 10c5787d Table: 9b59406a DAC: 00000015
<4>[35254.625731] [<c0014560>] (unwind_backtrace+0x0/0x11c) from [<c0019fa0>] (__do_user_fault+0xcc/0x148)
<4>[35254.625731] [<c0019fa0>] (__do_user_fault+0xcc/0x148) from [<c001a3b4>] (do_bad_area+0x48/0x78)
<4>[35254.625762] [<c001a3b4>] (do_bad_area+0x48/0x78) from [<c001a4c4>] (do_sect_fault+0x8/0x10)
<4>[35254.625762] [<c001a4c4>] (do_sect_fault+0x8/0x10) from [<c0008530>] (do_DataAbort+0x180/0x1ac)
<4>[35254.625792] [<c0008530>] (do_DataAbort+0x180/0x1ac) from [<c000e574>] (__dabt_usr+0x34/0x40)
<4>[35254.625792] Exception stack(0xc4e0ffb0 to 0xc4e0fff8)
<4>[35254.625792] ffa0: 00000000 00ab22c4 be858a5f 00000000
<4>[35254.625823] ffc0: be858880 00ab22c4 b6fda7eb b6fdbbb1 00000001 b6fc9881 00000000 be85892c
<4>[35254.625823] ffe0: 6bcf4001 be858830 b6fc9003 b6fc9006 000d0030 ffffffff
<4>[35254.626067] QSEECOM: qseecom_release: data->released == false
<3>[35254.626067] QSEECOM: qseecom_release: Unsupported clnt_handle_type 4
<6>[35254.961028] !@Sync 1174
[AT&T Samsung Galaxy Note 4] spexwood:
This IS on topic since I'm trying to contribute to the rooting process as best that I can with my inability to do what the devs are doing to actually exploit root.

When I got my Note 4, I used CyanogenMod's Helium to restore all my apps and their data to my phone. In order to do it, you have to connect your phone (if not rooted) to your pc first, with USB Debugging on, and let the pc version of Helium do something to your phone to enable the ability to restore apps. After that, you can restore your apps and data, including text messages, etc.

The thing is, non-system apps are stored in root/system/data/apps, while system apps (and bloatware) is stored in root/system/apps. Does System/data/apps require root access to manipulate? Is that what Helium is doing? Enabling some sort of permission to write to this directory?

I'm not sure exactly what Helium does when you plug the phone into your pc, but it ACTS like it gains temporary root (only ACTS like it... not saying it does because I know it isn't). Anyways, maybe looking at Helium could help somehow? Probably not, but just trying to spark another idea lol.

Edit: let me reiterate because I know someone's going to get on me about it. I know Helium isn't actually gaining temp root. I KNOW.

But the way it acts is like it's trying to do something hacky to allow it to write to system/data/apps. That's all I meant. Please don't flame me. I know a lot about Android (been rooting and installing custom roms and kernels since Cupcake), so I do understand what root is. I just know only a limited amount of programming... definitely not enough to hack Android to gain root.
[AT&T Samsung Galaxy Note 4] Stryke_the_Orc:
No, root permission is not needed for /data/app directory, if that directory had root access it would be disastrous for a multitude of reasons.
[AT&T Samsung Galaxy Note 4] spexwood:
I didn't think it did bc then the user couldn't install apps unless they had root, thus making the phone be pretty useless except for calls and texts. All I know with Helium is that it acts like it does something Superuser-like, and I was thinking that maybe it could be helpful somehow. I'm kind of doubting it though, but just can't figure out why it needs to connect to the pc version with USB Debugging enabled in order for it to do anything. (And the backups aren't on the pc either).
[AT&T Samsung Galaxy Note 4] funnycreature:
Has anyone seen this website: https://www.myandroidrooting.com/root-galaxy-note-edge-att-sprint-t-mobile-verizon/

I can't tell if it's legit or not but they don't list the file for the AT&T model.
[AT&T Samsung Galaxy Note 4] Volvogia:
I get that notification all the time. Dont believe that it has anything to do with the NK3 Update. I got that notification this morning on my way to work even after taking the NK3 update. I have gone into the Applications section and looked at every single update app installed on the phone and the phone does not let me disable them. So I believe you just have not got the update yet, but you could maybe by going and seaching manually. My girlfriend has the AT&T Note 4 also and she has not got any notification about updating her phone to NK3 yet. Now the Fakedebuggerd issue, your guess is as good as mine. No clue if it has been patched or not. Hoping no lol. I hope allenjthomsen can help also but looking back through this thread I believe he is working with the N1E update software and not the NK3 so us that took the update or got forced to take it, may be out of luck unless the exploit he has us testing later on works for both softwares.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Sorry you got the update :(, but if you wanted or if anyone else with the update, mind trying to flash N1E? Just make sure you have a stock NK3 to restore, if that's necessary (I'm not sure if it is, but just in case). :confused:
[AT&T Samsung Galaxy Note 4] Simsron1:
You should be able to flash back, that's my guesstimate.
[AT&T Samsung Galaxy Note 4] Volvogia:
To be honest, I would love to try and confirm this with everyone but unfortunately I cant. I do not have any type of insurance on my phone. Im paying for it on the AT&T Next plan through a employee account set up by my girlfriend who works at a AT&T corporate store. Only got this phone. No back ups at all so if something happens to this phone then im SOL. I hate being the one saying I cant because I basically feel as if im saying "no, im not going to test that! You do it and risk your phone and try!" I honestly dont mean it that way at all. I dont know enough about all this to go and test all of it. Every phone I have had, had a unlocked bootloader with a 1 click root method. This is the 1st phone I have had that I have been stuck with a looked bootloader. This whole thread and situation is a learning situation for me.

"guesstimate" :p.
[AT&T Samsung Galaxy Note 4] windstrings:
Wonder if it even matters for Verizon since you can't get in any way at this point.
[AT&T Samsung Galaxy Note 4] Xak:
No i dont know
[AT&T Samsung Galaxy Note 4] allenjthomsen:
As long as it is 4.4.4 you should be able to flash back to previous build it is unverified

i cannot continue my work until this is verified i donnot want to brick anyones phone
[AT&T Samsung Galaxy Note 4] mlin:
To clarify, you need someone to check if they can roll back via Odin to the previous version of 4.4.4 before the recent update?
[AT&T Samsung Galaxy Note 4] allenjthomsen:
Yes but i donnot wish to make someone brick device because it is unkown if it is possible
[AT&T Samsung Galaxy Note 4] mlin:
From my past experiences, if roll-back protection is implemented, then ODIN will simply fail. As long as its official software, I can't imagine it would brick the device. FWIW I'm on Verizon and have not taken today's OTA yet.
[AT&T Samsung Galaxy Note 4] allenjthomsen:
Can you check and see for Verizon I will in the end also try to get you guys root
[AT&T Samsung Galaxy Note 4] hnic32:
i'll test it out. I also don't have an insurance as i paid full price because im on the go phone plan. However, ive never had a Samsung phone that i couldnt bring back. I like living on the edge!
[AT&T Samsung Galaxy Note 4] FiniteTime:
You're awesome hnic32! Hope it works :good::highfive:

Even if NK3 users can't flash back to NIE, they should be able to flash NK3 if anything.
[AT&T Samsung Galaxy Note 4] hnic32:
That's what im thinking too.
[AT&T Samsung Galaxy Note 4] torreon902:
im doing it right now

---------- Post added at 01:13 AM ---------- Previous post was at 01:09 AM ----------

just did it.. you can go back!!!!! :good:
[AT&T Samsung Galaxy Note 4] dabl198327:
This is progress I love seeing!
[AT&T Samsung Galaxy Note 4] mlin:
I can check for Verizon later, maybe tomorrow.

Awesome, I know some of the last few updates on the vzw S5 didn't have roll back protection either. Maybe its Samsung's way of throwing us a bone.
[AT&T Samsung Galaxy Note 4] hnic32:
That's a hurdle cleared.
[AT&T Samsung Galaxy Note 4] b3asty:
This thread is getting me all worked up. I need a towel.
[AT&T Samsung Galaxy Note 4] tee00max:
So I have to go back and do some ready because I am seeing there are some progress steps being made. I don't want to get all excited.
[AT&T Samsung Galaxy Note 4] thanitos:
There's no file because it won't work on our phone, is cf auto root, it's in the file path name in the picture
[AT&T Samsung Galaxy Note 4] funnycreature:
So it's basically just click bait in the heading? Bummer....
[AT&T Samsung Galaxy Note 4] Jspex:
Just a thought. Has anyone contacted hashcode to find out how the kindle fire hd's are rooted. Amazon locks down the bootloader pretty strong on those. From the root process I just followed last night it looks as if they were able to inject root durring an adb recovery process.
[AT&T Samsung Galaxy Note 4] tedkord:
Actually, I just checked and there is a file for the VZW version. I didn't think there was, either. But my understanding is that with a locked bootloader, CFAuto will probably brick your phone. I'm sure someone here knows better than I do.
[AT&T Samsung Galaxy Note 4] graydiggy:
That is likely for the dev edition.
[AT&T Samsung Galaxy Note 4] deathshead:
Does anyone READ before posting?

Can OP add a disclaimer to his post strongly discouraging anyone re-posting the same developer edition

files for the 59,0000000000th time?

*ANY ROOT PROGRAMS CURRENTLY AVAILABLE DO NOT WORK - THOSE ARE FOR THE VERIZON DEVELOPER EDITION*

If this changes stay tuned to this thread for updates.

(sorry but I think we are all getting tired of seeing the same DE edition cf Auto root, towelroot, etc which do not pertain the the retail

VZW/ATT Note 4 devices.)

And now back to your regularly scheduled topic. :)
[AT&T Samsung Galaxy Note 4] tedkord:
Maybe it is for the dev edition, I don't know. What I do know is the file says it's for the SM-910V, and the dev edition model number is SM-N910VMKEVZW. And that I didn't see the file for the 910V there the last time I looked (admittedly, some time ago).

I won't try to participate or help anymore. Sorry to inconvenience you.
[AT&T Samsung Galaxy Note 4] manbat:
Suggests using CF-Autoroot.....which will not work on ATT Note 4 or retail VZW Note 4...

Sent from my SM-N910V / VZW Note 4 DE / Factory Bootloader Unlocked / Rooted / Custom Kernel-ed / TWRP 2.8.4.0.trltevzw
[AT&T Samsung Galaxy Note 4] funnycreature:
I'm so sorry! I completely forgot that this thread is about the Note 4 not the Note Edge :silly:... But either way, it seems that this method won't work since they're so similar, right? Again, my apologies, and I didn't mean to derail the thread again.
[AT&T Samsung Galaxy Note 4] Stryke_the_Orc:
Just a guess, but it's probably rebuilding the file system to mimic the apps being restored. This doesn't require root either, and running from the PC version may be the only supported version that handles the process.
[AT&T Samsung Galaxy Note 4] Stryke_the_Orc:
Also, before any more butt-hurt gets spread, let's drop the dev edition chatter, thanks.
[AT&T Samsung Galaxy Note 4] PaulPizz:
Your creating an inconvenience to the whole thread. All of this has been spoken about multiple times. READ!
[AT&T Samsung Galaxy Note 4] Simsron1:
Alright guys let's get this together. I don't even have to read the previous page to know the argument is uncalled for. I understand this is a stressful time right now, but we need to stay together on this. Alright? So drop it, and let's get back on track. Let's stay professional about this.
[AT&T Samsung Galaxy Note 4] Surge1223:
How about we do like this. No questions that don't deal with code allowed, just development or attempted development

For example,

Not Acceptable:

Will this help? Will this cve work? Is this patched?

Acceptable:

Using the below code I can successfully set perms to execute a binary but how would I be able to redirect the output to blah blah blah?

public void run() {
final String localPath = "/data/data/com.samsung.sucks/exploit/test";
exec("/system/bin/chmod 777" + getFilesDir() + "/test");
exec("sh " + getFilesDir() + "run.sh " + localPath);
// Selinux makes us use /data/data/ path to execute binaries on Lollipop
output("Selinux sucks...");
String output = exec(localPath);
output(output);
}

(note: I'm not actually asking for an answer to the above, I'm well aware of how to, I'm just using it as an example)

Im not trying to be mean but a lot of the non acceptable questions are readily answered by Google. And if not then someone should push the latest stock vzw or att n4 kernel to git for easy reference. Actually if someone links me to the latest source I'll do it.
[AT&T Samsung Galaxy Note 4] burtonboarder:
Would the FCC agreement regarding carrier unlocking phones that is now live be of any use? I guess I should specify the actual process of the unlock.
[AT&T Samsung Galaxy Note 4] manbat:
Covers SIM unlock...not bootloader...

Sent from my SM-N910V / VZW Note 4 DE / Factory Bootloader Unlocked / Rooted / Custom Kernel-ed / TWRP 2.8.4.0.trltevzw
[AT&T Samsung Galaxy Note 4] burtonboarder:
I see. In that case disregard my uneducated comment
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Android Futex Requeue Kernel Exploit CVE-2014-3153. http://cxsecurity.com/issue/WLB-2015020047?noredirect=1#noredirect
[AT&T Samsung Galaxy Note 4] StayingSober:
Anyone feel free to correct me if I'm wrong, but just reading thru the beginning of this gives me the impression it won't work [emoji20] due to the line:

"This module exploits a bug in futex_requeue in the linux kernel.

Any android phone with a kernel built before June 2014 should be vulnerable."
[AT&T Samsung Galaxy Note 4] scottjoshuac:
TowelRoot

A quick search reveals shows that this is the same exploit that TowelRoot utilizes.

duckduckgo(.)com/?q=CVE-2014-3153&ia=about

"Software description: CVE-2014-3153 aka towelroot (C)."
[AT&T Samsung Galaxy Note 4] EMDrNote:
This doesn't mean we can't flood their executive offices with phone calls about it. It's all about the time of the people they pay most. If the senior executive team is spending time daily on the phone with one of us or their inbox is full of call about this such that it slows then down, things will change quick. The key is getting as many of those well guarded numbers as possible before launching an old school DOS on them.
[AT&T Samsung Galaxy Note 4] mynameherebro:
Whining like a baby is not going to get root... Facts are these. We need to stay on topic. So please stop railroading the thread.

What we need is simple for words sake..

1) An exploit that allows for system or root access.

2) Developers able and willing to program the exploit into an easy enough interface to use.

3) The thread to stay on topic regardless of hurt feelings or bruised egos.

As per the comment before this one.. It needs modified because DOSing people/companies into submissive behavior is called internet terrorism.... [MENTION=6311911]EMDrNote[/MENTION] Please advise and think of your words more carefully.

Please stay on topic...
[AT&T Samsung Galaxy Note 4] EMDrNote:
If it were a true DOS I suppose you could consider it "terrorism," however, simply suggesting a group of people call to express dissatisfaction and to target those calls to people that matter instead of their pawns is simply strategic advocacy. We've been working on exploits for over four months now without success. While I agree we can achieve root, a longer term solution is to simply bring these companies to a clearer understanding of their most loyal and interested customers. People on here are likely to be the influential ones amongst their acquaintances and professional colleagues when it comes to mobile technologies. We've been fighting these fight with utmost dignity, while they've taken the guerrilla approach with encryption and the like. Instead of taking this sitting down at our computers, perhaps it's time we stand up to these ignorant buffoons.
[AT&T Samsung Galaxy Note 4] scoder:
You may view locking bootloaders as ignorant, but from a corporation's standpoint, it is to protect their intellectual property. Developer editions, created by companies to allow people like us to tinker, are available. These contain a Google experience because the companies do not want to include their IP-protected software, and they understand that the people that purchase those devices don't want TouchWiz, Sense, etc. Taking it up with executives will not get you what you want, and promoting the idea of DDOS attacks is counterproductive and against the law. They already offer you an alternative, they will not budge on their current model because you chose to purchase a subsidized carrier phone instead of a full retail dev model.
[AT&T Samsung Galaxy Note 4] 4NDROID4LIFE:
Say at&t pushes out lollipop tomorrow. Will you take it knowing that it might make achieving root impossible. Take it or stay on KitKat and wait for root?

Sent from my D850 T-Mobile SIM
[AT&T Samsung Galaxy Note 4] lanimul:
Take update. Coming from Nexus 5..i chose to give up root/unlocked bootloader when I bought my note4 couple weeks ago for its better features. We all made the choice, so go outside and play. ☺
[AT&T Samsung Galaxy Note 4] holywhitebread:
That still won't make a difference.
[AT&T Samsung Galaxy Note 4] spexwood:
As long as any app can write and delete stuff to/from the external sd card (which you're supposed to be able to), then I'll take Lolipop even if we never get root. That's all I care about right now. Kitkat's security is absolutely stupid.
[AT&T Samsung Galaxy Note 4] mynameherebro:
Agreed I feel it should be user choice to delete things from external SD and think it's kind of lame that the option has been disabled. That is one feature I'd lIke back.
[AT&T Samsung Galaxy Note 4] TechBSwift:
I'm sorry, I thought this thread was about root, and contributing meaningful code to assist with finding root.

Can you guys please take your pointless conversations else where. Let's stay on topic
[AT&T Samsung Galaxy Note 4] windstrings:
Use the Samsung stock file manager
[AT&T Samsung Galaxy Note 4] scottjoshuac:
Potential exploit

Disclaimer: I'm not a programmer, hacker, developer, extra...

However, I am trying to contribute where I can. I have an ATT Note 4 that I'd be willing to test things on.

I was searching around for some exploits and I came across this article ...

hxxp://thelittlehacker(.)in/daily-news/google-play-browser-flaws-expose-android-devices-remote-code-execution/

It appears that this exploit is on 4.4.4 - 5.0. I did a search before I posted this and haven't found anything pertaining to the Note 4. I'm downloading metasploit now and I'm going to try it and post my results.

CVE-2014-6041

Edit, I just realized this doesn't actually exploit for root. Sorry for a "junk" post, I'd delete it if I could
[AT&T Samsung Galaxy Note 4] Xak:
I saw a video on YouTube channel by XDA TV leading me to a post on the XDA Portal that mentions US phone owners can now get their phone "freed" I am guessing this means bootloader unlocked you just have to have paid you phones bill or contract to own the device completely. Then you have to contact the carrier and they can unlock it from what I understand unless I read that wrong. If we can get a dev with an AT&T SAMSUNG GALAXY NOTE 4 to do that we can most likely right root root access.
[AT&T Samsung Galaxy Note 4] Venom0642:
Not the bootloader my understanding is unlock it for use on any carrier provider, if it was the bootloader believe me everyone here would be rooted..

Running On New Deadly Venom Note 4 v1.0
[AT&T Samsung Galaxy Note 4] waco2hot33:
I'm gonna assume that it's just carrier unlock not bootloader unlock also !!
[AT&T Samsung Galaxy Note 4] raduque:
I'm afraid you are guessing wrong. It means SIM unlock.

I'm just going to say it right now, short of the government fining AT&T eleventy trillion dollars, they aren't going to offer bootloader unlocks for any device.
[AT&T Samsung Galaxy Note 4] spexwood:
Sim unlock makes sense since you can only have the phone unlocked once the phone is paid off. If you SIM unlock before paying off the phone, you can jump ship and switch carriers before paying for the phone 100%.

If it was bootloader unlock, then it wouldn't matter whether you waited until the phone was paid off or not. Once the bootloader is unlocked, you'd still be using ATT and would still be paying ATT's bills.

(I was tired when typing this, so forgive me)