yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note 4] gatesjunior:
I think I understand what it is you are trying to say, that it will warn or flag or just not work with dm-verity checking, but will not revert. So I believe Samsung and possibly others have taken this to a new level. I would understand on a reboot changes getting reverted and the bootloaders involvement with this, but how do you explain things being restored back to original state, including date and time stamps without any reboot happening. Actually changes while you are using it. Things you have modified are put back to original state and files that you added are removed on the fly and everything goes back to its original state without any reboot happening.

Is it an initramfs being used and then just remounted ? There is a lot we are trying to figure out with this. I have not seen anyone provide any evidence either way of what is causing this and how it exactly works. If you have that kind of information, I would be more than happy to discuss this with you.
[AT&T Samsung Galaxy Note 4] elliwigy:
so do you geel the dm verity is different on the s6/s6 edge then on the note 4? I would think the siccess they had on the note 4 would encourage them to continue with the s6 and edge..

unless idler found a way to modify or disable dm verity so it fails but does not revert back? basically ignoring dm verity.. my point was, maybe having a look at what idler said and exploit for the s6 and s6 edge a bit closer can help?

im no coder or kernel dev by any means but i do understand what dm verity is by the reads youve posted.. good stuff!
[AT&T Samsung Galaxy Note 4] eklipz3:
Where actually is dm-verity located because I mess with software somewhat, not so much Android but I'd like to start and see if I might be able to figure this monster out I'm retired and have nothing but time, I just need to know where to start, thanks for any help.

Sent from my VS985 4G
[AT&T Samsung Galaxy Note 4] gatesjunior:
Guys, we have taken this into a chat session and he and I are looking at kernel logs. One of us will report back in a while.
[AT&T Samsung Galaxy Note 4] heXacode:
The S6 and Edge both have dm_verity and write protection. It's no different than what the Note 4 has too. Tearing apart ping pong root or Kingroot to see what methods they used is a vital key on how root is permanent.

I noticed one thing from Kingroot from digging around in the apk. I saw the word "insmod". Insmod is part of a command line used in shutting off write protection from a kernel module. I'm still investigating how Kingroot is using this on the kernel module side.

Here's a link on how the M8 users and other users are turning write protection off.

Same link I posted on another post but here it is again...

http://xdaforums.com/showthread.php?p=51543139

---------- Post added at 07:03 PM ---------- Previous post was at 07:01 PM ----------

Yes everything you said is basically what I'm talking about to begin with.
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
How much do we know about perma root methods for tmobile and sprint note 4s? The hardware differences should be minimal from the att and verizon versions. Out side the locked bootloader how does the tmobile version bypass write protect on their 4.4.4? If its a samsung thing other hardware vesions should have the same features so how are they able to obtain permanent root? Assuming they can on the stock rom.
[AT&T Samsung Galaxy Note 4] zxz0O0:
Well if that's the case, have you tried getting in touch with idler1984. He is usually very supportive.

I checked the kernel source today, seems the write protection is enforced in the emmc controller but there is kernel code to modify the read-only flag. You can try compiling a kernel module and see if you can do something.

Seems the changes are written to a cache but not flushed to the storage due to write protection. After some while the cache will get cleared and changes reverted.
[AT&T Samsung Galaxy Note 4] heXacode:
I'll see if he can at least visit this thread and chime in on what we are discussing. [MENTION=3669069]idler1984[/MENTION] I'll send him a message as well.

Did you see this in kernel source?

MMC_MUST_PREVENT_WP_VIOLATION

I'm not at my laptop now to look into that but that's suppose to be in the kernel and is suppose to be modified to overcome the WP issue.
[AT&T Samsung Galaxy Note 4] zxz0O0:
You realize that this is HTC and has nothing to do with Samsung? They are not using the same write protection.
[AT&T Samsung Galaxy Note 4] heXacode:
Yes I'm fully aware of that but they did the same thing we are looking into. They had only temp root and had to get WP disabled for permanent root. I'm not saying copy off everything what they did but look at how they dealt with WP and use some of their info to understand it on the Samsung side.
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Yea i am very curious if [MENTION=711482]beaups[/MENTION] Would be willing to share any information regarding WP. After all he is a god in the HTC world considering him and [MENTION=2376614]jcase[/MENTION] have released S-Off exploits for the past few years.
[AT&T Samsung Galaxy Note 4] gatesjunior:
Well, this is all good as long as they are not looking for signed kernel modules and or specific ones only..
[AT&T Samsung Galaxy Note 4] heXacode:
Did you guys have any luck with the kernel logs?

Are you using adb to get last_kmsg and dmesg.txt to see what is making the device reboot, after rooting, and reverting changes?

I like to work with you guys on this if that isn't an issue. I've spent quite a few hours last night and today checking things out. I haven't done a last_kmsg or dmesg.txt yet since you guys were gonna do a log on the kernel.
[AT&T Samsung Galaxy Note 4] heXacode:
Go message him and ask if he wouldn't mind chiming in on some of this stuff in this thread. The more of these guys to chime in or help the better.
[AT&T Samsung Galaxy Note 4] gatesjunior:
Well, we did a live capture, which IMO is better to see what is going on while it is happening, such as things being reverted while it is running. So we captured the /proc/kmsg live and were looking at it several times. The obvious thing that shows up is the following:

http://xdaforums.com/showpost.php?p=58644409&postcount=918

Same thing essentially that [MENTION=3669069]idler1984[/MENTION] was running into.
[AT&T Samsung Galaxy Note 4] patt2k:
Sorry for little off topic I usually read here many threads,is write protection possible to be turned off? like on other phones? I read you guys said not many phones have it so I am wondering if anyone ever achieved it so I can understand the situation little better :D :good:
[AT&T Samsung Galaxy Note 4] RocknSteve:
Please read. They're working on it.
[AT&T Samsung Galaxy Note 4] patt2k:
I did read I know what they are working on I just want to know if it was achieved on other phones previously,meaning if it's possible to do it :) that's all cheers
[AT&T Samsung Galaxy Note 4] rajeev2liz:
I guess there is a root method available for at&t note 4, the only thing is you cant do a full reboot or you will loose it. Soft reboot is ok I guess that can be a good thing it means root is getting closer than expected
[AT&T Samsung Galaxy Note 4] elliwigy:
anything is possible...
[AT&T Samsung Galaxy Note 4] rajeev2liz:
AT&T Root is here

Is everyone tracking that there a way to root your AT&T note 4. It's by gates junior, I did it today and it works like a charm the only downside is you can't do reboot or you will loose root soft boot works fine. The only think I really did so far is use titanium backup to remove all the bloat.
[AT&T Samsung Galaxy Note 4] DeathLord..:
Glad ya found it but where have you been? He gave a us temp root about a month ago. Lol.
[AT&T Samsung Galaxy Note 4] heXacode:
I remember that post now. Don't know how I overlooked it to see if anyone had done logs for the kernel. I'm curious if he stopped working on this or got further than we know about. I'll keep doing more research about WP especially when HTC M8 and Moto X folks had to deal with it.

HTC M8, Moto X, Moto Maxx, and possibly others dealt with WP being enabled.

Actually, Team Keen (Kingroot) gave us temp root and that was by pure accident since it was only for the S6 and Edge.
[AT&T Samsung Galaxy Note 4] ODSTZ3RO:
?????? Kingroot isn't by gates junior and it wasn't intended for the note 4. Damn he beat me ^
[AT&T Samsung Galaxy Note 4] heXacode:
Deleted.
[AT&T Samsung Galaxy Note 4] ODSTZ3RO:
Yeah I know that's why the question marks were first it just happened to give out an emoji instead of a question mark. I keep thinking there's been further progress but its just someone saying the same thing someone else said a few posts back. Ooo well ,back to spectating I guess.
[AT&T Samsung Galaxy Note 4] scottjoshuac:
Crazy thought here... but could different exploits be made when using ART vs DALVIK? Maybe ART handles the execution of code differently than DALVIK? Stupid idea or worth looking in to?
[AT&T Samsung Galaxy Note 4] Xak:
I don't know about you guys but this post made me cry a little. >.- I know he is a new guy but everyone please read up before you post.
[AT&T Samsung Galaxy Note 4] liquidaluminum:
!?

Why u no can read?
[AT&T Samsung Galaxy Note 4] heXacode:
I apologize. The way you worded it sounded like you didn't know either.
[AT&T Samsung Galaxy Note 4] jcase:
So, we can not share anything in regards to WP that would help you.
[AT&T Samsung Galaxy Note 4] Surge1223:
Yes this is what I've been saying. The thing is, in order to load unsigned kernel modules they have to disable lkmauth, and to do that you have to be able to have access to /dev/mem. Currently their sepolicy doesn't allow for access to /dev/mem, but as I have successfully done on the s4 with lollipop, you can load a new sepolicy via /data/security dir, and reload selinux props and have access. I don't have a note 4 or I would have tried all this already.
[AT&T Samsung Galaxy Note 4] zxz0O0:
Alright, this seems logic. I checked the modules if they use the 'official' way of signed kernel modules (which they are not). I did not know of this lkmauth.

I created some test kernel module with an idea to disable wp but I guess with lkmauth it's useless. By the way, the exploit used by kingroot also allows code execution.
[AT&T Samsung Galaxy Note 4] FiniteTime:
We could possibly set you up with someone where you could remote in and try stuff. In the brainstorming thread we tried to get info on /dev/mem and there wasn't a file named that way. Is not seeing it due to permissions? Since if we can write to memory then that small c memory writing tool should work, regardless if there's a /dev/mem right?
[AT&T Samsung Galaxy Note 4] heXacode:
Do you have anything we could use to work with and/or modify alongside?

I pulled sepolicy out of the root of system. I'm gonna need Android Studio to read it and to modify it, correct?

Also, isn't SELinux suppose to be set to permissive first with "setenforce 0" before we can get a full read on kmem and mem in /dev?
[AT&T Samsung Galaxy Note 4] siriom:
gatesjunior already managed to set selinux to permissive .. its a couple of pages back...
[AT&T Samsung Galaxy Note 4] FiniteTime:
Quoting from other thread as the tool to use was mentioned: devmem2
[AT&T Samsung Galaxy Note 4] DeathLord..:
Great Respect for all working on this. Thought all efforts died but I see there is still life. :)
[AT&T Samsung Galaxy Note 4] Yousef_Muslih:
Apologies it's deleted
[AT&T Samsung Galaxy Note 4] elliwigy:
doesnt help.
[AT&T Samsung Galaxy Note 4] Chad_Petree:
How does this affect us? :( Back to square one?

Samsung to start rolling out Android 5.1.1 Lollipop update to Galaxy Note 4 by the end of July

http://www.sammobile.com/2015/06/01...p-update-to-galaxy-note-4-by-the-end-of-july/

"Many Galaxy Note 4 users are impatiently waiting for Samsung to release Android 5.1.1 Lollipop update for the device. Well, here’s some good news for those guys. According to our highly placed sources, Samsung is planning to release Android 5.1.1 Lollipop update to the Galaxy Note 4 by the end of July. As usual, we will be the first ones to show you the upcoming ROM running on the actual device."
[AT&T Samsung Galaxy Note 4] DroidBlaze:
Just don't take the update until someone confirms you can safely downgrade back to kitkat through Odin.
[AT&T Samsung Galaxy Note 4] Kyuta Syuko:
Don't forget that AT&T has to put their grubby hands on it too so chances are we won't get it till late in the year (maybe around October/November) or even next year.
[AT&T Samsung Galaxy Note 4] 760hacker:
By then I'll have a new device running android M
[AT&T Samsung Galaxy Note 4] cuhrazy:
Like the note 5
[AT&T Samsung Galaxy Note 4] elliwigy:
lol id wait to see if its write protected before ever getting a note..
[AT&T Samsung Galaxy Note 4] heXacode:
[MENTION=3178012]gatesjunior[/MENTION] [MENTION=4939386]Surge1223[/MENTION] [MENTION=2260077]Android.Ninja[/MENTION] (where the heck is he?) [MENTION=3975929]zxz0O0[/MENTION] [MENTION=3669069]idler1984[/MENTION]

Here's part of a conversation I had with idler1984 concerning write protected on MMC controller...

"MMC has 3 types of WP, permanent, one-time and user mode. One-time means it is set and keeps read-only during that power-cycle, and is exactly the type note 4 bootloader uses. We can't reset it in the same power cycle, and when you restart the device bootloader kicks in again. Tripping knox bit will stop bootloader from doing so, but it means nothing since it trips knox bit, which is the whole purpose of getting root in run-time. Samsung only did this on note 4 per my observation so far."

Looks like this is going to be more difficult than anticipated.

So I ran this:

cat /proc/partitions

It wasn't mapped out so I ran this:

ls -l /dev/block/platform/msm_sdcc.1/by-name/

Looking at the mapped out partitions I'm assumming the "write protection" is in:

or....

I was trying to find answers on which blocks you guys were digging in so I can pull up the right one and see what idler1984 is talking about and move onto the next step of getting root in runtime. I have some info regarding it but not sure if it will even work or not.
[AT&T Samsung Galaxy Note 4] gatesjunior:
PM me the information you have when you get a chance.
[AT&T Samsung Galaxy Note 4] heXacode:
I rather keep everything out in the open. My info doesn't pertain to solving root issue. it's just little info I researched on different ways to attack write protection that other people have done.

I don't care for the bounty either if that's why you want to keep things secretive. You guys can have it all. I rather have us all collaborate together. We can ask to have the Dev only thread reopened to keep unwanted posts out.
[AT&T Samsung Galaxy Note 4] eklipz3:
It also says dm-verity disabled

Sent from my VS985 4G
[AT&T Samsung Galaxy Note 4] cstayton:
those posts are just in the eventuality we get permenant root and the insecure boot image is only if we get unlocked bootloader, if you read my OP in that thread it explains it all. sorry if it confused anyone.
[AT&T Samsung Galaxy Note 4] elliwigy:
if you check the original thread for it you will see what work was done on it but most likely not possible to use
[AT&T Samsung Galaxy Note 4] DaveKnowsAll:
My hacking days are back in the UNIX world and behind me now, so I am not much of a participant on this. However, the quote above begs the question of whether or not we can spoof the MMC controller into thinking that a power reset has occurred without actually rebooting the device. I have had a couple older devices where we needed to ground or short certain leads on the circuit board in order to trigger the load of a custom firmware. Maybe this is a possibility, to short out the MMC controller and make it "observe" a power cycle without receiving an instruction to re-establish write protect (this assumes that the default state is open). Just thinking out loud here. My initial conclusions are that if such a solution were possible, it would solve the problem of keeping our current root solution through an unlimited number of softboots no matter what we modified/wrote as root. But a hard reboot would still run the bootloader, and lock it back up.
[AT&T Samsung Galaxy Note 4] PaulPizz:
I noticed after rooting via kingroot and updating kinguser then doing a soft reboot the kinguser app becomes a system file in /system/app which is normal, but once you loose root over time or even after a full reboot the kinguser app is still in /system/app. It sticks even after all other mods and apps have been restored due to dm-verity. I'm curious on why this is...

If this has been asked or mentioned I apologize in advance. Instead of acting like a keyboard tough guy and trying to insult my intelligence please just direct me to where this info is located. Thanks
[AT&T Samsung Galaxy Note 4] elliwigy:
most to all apps you install from the play store are installed to system/app.. pre installed or necessary apps are typically installed to system/priv-app... problem is not installing the app its write protection..

the su binaries are written elsewhere and revert on a reboot.. kingroot technically is an installed apk that uses an exploit to root the phone but what is written and where is what doesnt work on reboot but the app remains
[AT&T Samsung Galaxy Note 4] PaulPizz:
Ohh.. I was under the assumption all that would revert back too... thank you for your time.!
[AT&T Samsung Galaxy Note 4] FiniteTime:
(Shortened the quote to just the part I'm replying to)

I've been thinking about this for the past few days. Seems like perma root is possible as long as Knox is tripped.

Maybe they could release a perma root that trips Knox for people that are okay with tripping Knox then people that don't want to trip Knox can continue waiting. Right now both people that are okay with tripping Knox and people that aren't okay with tripping Knox are waiting, at least one group could have permaroot.

Would you mind exploring that option heXacode with idler1984?
[AT&T Samsung Galaxy Note 4] elliwigy:
I think that basically means those that can unlock their BL can take advantage by using custom kernels with WP removed.. This process would trip knox. Therefore if you have a locked BL, you most likely cannot trip kox to remove WP.
[AT&T Samsung Galaxy Note 4] DeathLord..:
Truthfully everyone I am on contract but I so really don't care about tripping Knox. Thru out the years I have hard bricked, soft bricked shattered screens. I have always found tuts and videos to repair everything. This bootloader I have had no luck. So I am willing to trip it don't really care if I could have a permanent root. :)
[AT&T Samsung Galaxy Note 4] heXacode:
That's one route I'm looking at that idler1984 talked to me about. It won't make the other group happy but that's just the way it will be until we figure out how to get around WP in the MMC controller in aboot. That'll be the most difficult process.
[AT&T Samsung Galaxy Note 4] goodbye hppalm:
I don't care about tripping knox, love my note to be unlocked and free for what ican do with it
[AT&T Samsung Galaxy Note 4] patt2k:
I also don't care about knox at all (I have asurion if anything happens) people who only rely on samsung for warranty I could see reason caring about knox.
[AT&T Samsung Galaxy Note 4] DrPhant0m:
Is it accurate to say that permanent root could be achieved *right now* at the expense of tripping KNOX?

I'll cast my vote right now that I don't care about tripping knox, either. I plan on buying a Note 4 used, anyway... and I'm pretty sure that excuses me from a Verizon warranty.

Make it happen, cap'n! :good:
[AT&T Samsung Galaxy Note 4] siriom:
theres nothing to gain from tripping knox , most of the notes can be done with cr root . The people who work on this are after the glory and the pot , or in this case the pots , the note 4 and the note edge pots , as in ... the money and that happens only if they dont trip knox ?

If i wanted to trip knox i would have ....
[AT&T Samsung Galaxy Note 4] elliwigy:
that doesnt work on vzw and att.. in order to use other root methods like the one you suggested that requires an unlocked BL.

If it did work for att vzw then all the people posting they dont care about tripping knox would have done so already.

Therefore I feel your comment is baseless (or you have another variant that can be unlocked) especially considering people working on this have made it clear its not about the money.

To my knowledge the only way to trip knox is to mess with the BL/Kernel. Im curious to know what method is being looked at that would "trip knox" If the BL is locked on ATT/VZW.

I am pretty sure if it was easy gatesand team wouldve already provided it with a warning it will trip knox. I am not sure if Idler1984 meant his statement about it being possible with tripping knox was for unlockable variants of the Note 4 which its no secret for those devices...
[AT&T Samsung Galaxy Note 4] siriom:
Thats what im trying to say , why only look at a specific att or vrz fix with no monetary reward when you can dig for a general note 4 root with money attached?

You make more people happy and you get money ...

Why go for a vrz fix alone ?

or att fix ?

oh wait . cos you need it ?

my bad.
[AT&T Samsung Galaxy Note 4] elliwigy:
Actually i dont need it. i have a s6e on vzw...

if it could be done on vzw and att chances are itll work for other variants.. not to mention those who can unlock their BL already have the option for perma root.

Surely if they can find a way without tripping knox i cant imagine why it wouldnt work for other variants.

The vzw/att is key to breaking WP and surely would work in general for note 4s id imagine. So why focus on other variants that already have the option?
[AT&T Samsung Galaxy Note 4] heXacode:
Here's 2 routes I'm looking at... spoofing knox bit or spoofing OTA in stock recovery.

The 3rd one is out of my league for the moment. It will require a hardware person who knows their way around the motherboard to recycle the power for the MMC controller.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Hm yeah if the only way to trip Knox is to change/replace the bootloader and since the bootloader is locked on the AT&T Note 4 and Verizon Note 4 phones then that would be difficult. Is that really the only way?

Since if it is, yeah, spoofing the Knox bit could be a way but, that chicken-and-egg of how to get something to run early at boot to disable write-protect if you can't write. :eek:
[AT&T Samsung Galaxy Note 4] JOSHSKORN:
What if we turned Knox off using Debloater? (Admittingly, I haven't used Debloater but I'd used a previous method of running scripts to disable KNOX and OTA updates) I guess I'm lost on the purpose of tripping Knox.
[AT&T Samsung Galaxy Note 4] heXacode:
We can't change out the bootloader at all. That's off the table and not something we ever considered to begin with.

It's not the same thing. Knox bit is tied into the bootloader. We need to spoof it to intentionally trip it. The ones you disable in Debloater is not the same as the one we want to trip.

I'm waiting on idler1984 for additional info about aboot and boot from the MMC blocks before I go forward to the next step.
[AT&T Samsung Galaxy Note 4] Bicknasty:
You misunderstand what we mean by Knox in this scenario. Knox is enterprise security software by Samsung that provides a secure work environment within Android. The part of Knox we're talking about when we talk about it being tripped is a hardware fuse in the phone. If the phone attempts to boot an OS that isn't signed by Samsung's keys, then that fuse is blown and can never be reset. The Knox fuse, when untripped, allows for the use of Knox security features on a device. Using the debloater tool to disable Knox wouldn't change the interaction of the bootloader with the fuse.
[AT&T Samsung Galaxy Note 4] heXacode:
Exactly.
[AT&T Samsung Galaxy Note 4] FiniteTime:
What other ways are there to trip Knox?