yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note 4] Jaytronics:
Are there any Devs that are good at reading and writing binary? I'm thinking that if someone was to make a mock OTA update file and attempt to load it and could read the processors I/O, then it would be possible to find the signature keys. Also, use the current OTA as it allows the OS to move back to KK. I wonder how fast I could learn ADB and binary. Lol!

Sent from my SM-N900V
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
I can guarentee you 100% you won't get they keys there is a reason the bootloader has not been crackdx since the note 2 these are not something that can be so easily obtained

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
Question. I am still on lolipop so i haven't tried but seeing as android is basically linux. When we obtain root even though its temp can we or has anyone tried mounting all the partitions in /dev to other location to see whats what and whats editable? I would think as root you could just mount and edit the system partition. Assuming you can find which partition is actually the system part.
[AT&T Samsung Galaxy Note 4] CJ74753:
I don't believe I am just seeing the "Updated" apks, such as Evernote. I can do anything I want, but upon reboot that bloat is back. Any idea how the /efs partition isn't restored if you change file permissions to 0644?
[AT&T Samsung Galaxy Note 4] terpin32:
delete this if it does help with anything but i was listening to an podcast and they were talking about root and they used an camera app to help install su apk like i said just remember hearing something about it

keep up the good work guys!
[AT&T Samsung Galaxy Note 4] cstayton:
my guess (just speculation at this point) is that the only partition that is :Handled" by the initramfs methods (if that truly is the case) is the system partition (I believe it is mmcblkp026 not sure tho) this would likely make sense due to the fact that if the /EFS partition was also hadled then making changes thru "Secret codes" would also be replaced on reboot meaning that if you borked your IMIE all it would take to fix it is a reboot and from experience we know this is not the case.
[AT&T Samsung Galaxy Note 4] cstayton:
Your theory is sound and does (to some extent bare a little further research):

Now to explain what i mean by further research: I have been developing ROMS since the early days of Windows mobile (long before android or iPhones) the original process of packaging and pushing a "ROM" to the mobile device involved several binary edits as you had to move your custom ROM into the exact location within the install package, part of the other issue is that your ROM had to be the EXACT same number of bytes as the OEM thus preventing you from adding to stock unless you removed the exact same number of bytes from your build.

Now as far as the theory being sound here is my explanation for that:

IF (and it's a big IF) we were to compare for instance the BL from a Tmobile note4 to that of ours and determine exactly (and I mean EXACTLY) where the binary portion was that contained the "Keys" and that portion was EXACTLY the same byte size then "In Theory" we could insert the "Keys" from our BL into the Tmobile BL and flash it on our device which since the keys would be correct would not balk at doing so.

Now for the explanation as to why this wont work:

In order to insert our keys into the Tmo BL they litteraly would have to be byte for byte identical or every single byte in the entire BL would be offset and this would in turn cause the flash to fail. And in the event it didn't fail the BL memory space would be offset by the exact same number of bytes and would likely brick your device.
[AT&T Samsung Galaxy Note 4] CJ74753:
The strange thing is if you edit /efs/FactoryApp with permission 0775,which is default, pressing the power button causes the phone to completely shut off, no power menu is shown. Changing it to 0644 yields a working power menu, but selecting any of the files to edit shows each file is blank. But I don't understand the fs enough to know a lot so I was just throwing that piece of information out there.
[AT&T Samsung Galaxy Note 4] :
I'm on 4.4.4

I froze all the bloat after the very first boot. Later, after successfully running kingroot, i used root explorer to go in and delete the apks and their associated odex files - both in system/app and system/priv-app. After a reboot, it was all there again.

Running Adaway to put a new hosts file in system/etc also restored the original hosts file after reboot. I was hoping files in system/etc would be more modifiable, but apparently not as Dr. Ketans sound mod apks that modify mixer_paths.xml also reverts.

The only thing that has worked for me is Dr. Ketan's sdcard fix, that allows to write to sdcard in kitkat. That is the only item that has stuck for me of the things I have tried.
[AT&T Samsung Galaxy Note 4] cstayton:
this would definetly point to the initramfs scenario meaning in order for root to "Stick" we would need modifications to kingsroot or whatever perm root method is used to write directly to the mmcblkxx partition rather than the /system folder (which is nothing more than volatile RAM space.)
[AT&T Samsung Galaxy Note 4] drivel2787:
Same case for me, any changes made were reverted on reboot. I used King to temp root, removed all traces of knox, then actually attempted to convert and install SuperSu but it would not install. Just said that the install failed and to try again.
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
Not trying to repeat but with temp root is there any way to mount /dev/block/mmcblkxx partitions to see which is actually system and see if changes to that partition stick (loaded into initramfs on boot)?
[AT&T Samsung Galaxy Note 4] Jaytronics:
To get SuperSU working somewhat correct. You need to have Kingroot and SuperSU installed. Do not Root with Kingroot before installing SuperSu. What you do is start the Kingroot Rooting process. As soon as or just before it hits 22%, hit your home button. Go straight to the SuperSU app. If it fails, go back home and hit the SuperSU app again. Keep doig this until it works. Then you will be prompted to install the su binaries. This will fail. I am trying to see what if any time frame and limitations there is during the full Rooting process to get su binaries to install. Also, my guess on the whole random but definitely going to reboot process is that thee is something in the OS that has a Root trip fuse that causes it to do the whole reboot thing randomly. Now, it is jot exactly randomized. It does have to follow some sort of timer. But I believe that Verizon wants us to think it is random to throw the Devs off track. Maybe, someone can compare the S6 OS with ours to see what extra code is here or active in our devices. I believe the forced reboots are a last ditch attempt to discourage the Devs a little. And cause them to not be able to find the actual Root method.

Also, I believe that the timer thing is not going to be in a Verizon app. It would be in an imperative system app. Something that should not be moved. But could be changed.

Sent from my SM-N900V

---------- Post added at 03:32 PM ---------- Previous post was at 03:20 PM ----------

Catlog and Logcat Extreme might be of help to pin down the timer. After root these apps or others like them will run up to shut down. So there may be a clue in there. I apologize for blasting out what may be silly ideas. If they are.
[AT&T Samsung Galaxy Note 4] shadowtuy:
i

That is exactly what i thought it was (regarding the timer). It's about 15 minutes from after the root process has finished to the phone restarting by it'self. Maybe we could set a timer by it? I wonder if the time would change on what the root access was for. If it was Verizon trick to make it look random would the times be by a pattern?
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
Borked my IMEI 2 days ago. *#9090# and chose option 1. Wiped mine completely WITH no fix. Had to send my phone in for warranty. DO NOT enter that menu! So I can say a reboot will not restore that information.
[AT&T Samsung Galaxy Note 4] :
Same. Tried to install supersu via the apk, no dice, and also through the ADB methods discussed. Failed.

On another note, did Chainfire release a CFRoot for the Verizon model (or was that just for their dev edition)? Perhaps, in all his experience across kernels and devices, he has some idea of how it can be done.

https://autoroot.chainfire.eu/

Edit:

Well, after reading the last 10 or so pages of Chainfires CFRoot thread here on xda, I can see many requests for root on Note 4, and Note 4 edge devices. Anyone submitted for the AT&T variant?
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
Sry that has been discussed maybe over 1,000 times dev only

Sent From The EDGE

---------- Post added at 08:42 PM ---------- Previous post was at 08:39 PM ----------

Also before anyone asks

V root, I root, Kingo, towel root, framaroot. Stump root, ping pong root I'm sure I've missed some do not work

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] drivel2787:
[MENTION=631273]Chainfire[/MENTION] since the AT&T Note 4 has obtained temp root, would you know any way to by-pass the write protection on the device and/or install a permanent root solution? Your CF Auto root is it only for the Dev Verizon Note 4, or was it released for the retail as well?
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
I already answered That dev edition only if I need to explain why locked bootloader will not alow you to. Flash anything such as cf auto root no unsigned kernel no unsigned roms which require keys that Samsung will Never release

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] drivel2787:
Sorry was typing apparently same time you were answering :) Maybe with his knowledge though he may know an alternative way to by-pass the write detection. Just looking for input from recognized developers to try and help the thread.
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
It's all good just trying to educate what I do know I've worked on these phone since the note 2 well Sammy phones at least and before that was on multiple phones all the way back to the first Android phone th g1 so I know a bit about these things I've also have a note 2 rom as well helped out on the note 3 Baja rom (themes and some scripts for various other things) I think getting past write protections will require kernel lvl hack which may be something the devs can get past but with locked bootloader it looks bad but I do know one of the devs surge1223 I've seen what he can do first hand and it's amazing I'd put all my faith in him being the one to. Crack. It

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] drivel2787:
I've seen him in the threads. Good to know. Appreciate the knowledge and background information.
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
No problem any questions or ideas are always welcome you never know what could happen

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] SacrificedWalrus:
One thing I found is that if you kill the surfaceflinger (system) process, the device does basically a half reboot. It goes back to the Samsung boot animation and then the AT&T logo (on the SM-N910A of course) and simulates a reboot. This allows you to utilize apps such as AdAway, Xposed, etc. and retain root. This of course is still reverted if the system crashes and/or you reboot normally, but this could possibly help if some tools you may need require reboot or determining exactly when the system reverts itself. I'll keep looking some more and see what I find
[AT&T Samsung Galaxy Note 4] SacrificedWalrus:
Looking that that website they say: "Enable verified boot in the devices's fstab file." so my assumption is we can edit the /etc/vold.fstab file to change mounting at startup. I have no idea if this will stick, but I'll give it a shot and see what happens.
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
I don't see that process on a vzw phone where did u find it?

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] SacrificedWalrus:
I ran the command "ps su" to find all processes with the letters su and surfaceflinger was one of the results. This was after I ran KingRoot, have no tried finding it before.
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
Strange I kill that process and phone stays booted

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] jorgasm209:
I found this interesting... but need someone much smarter than me to take a look at the code. This is the code that disable write protection kernel module by [MENTION=4684315]flar2[/MENTION] was based upon. It's an interesting read and may provide a vector we need to disable write protection at the kernel level using a .ko module. Suterusu
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
Also been proven not to work

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] jorgasm209:
Someone wrote a kernel hijack using Suterusu code in an attempt to create a custom kernel module that was compatible with our phones and tested it? Sorry I must have missed that post/thread.
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
Yes the method flar2 used was said to been tested and not working I dont remember the exact post it was a while back

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] tekjester:
The "signature" is just a hash. Factoring that algorithm to find the hashing key, which is likely 2,048 bits, is essentially impossible. We'll be on the Galaxy Note 21 by the time it happens! :)
[AT&T Samsung Galaxy Note 4] jorgasm209:
I know the exact module and even perhaps [MENTION=4684315]flar2[/MENTION] method may not be viable, however the link I posted was not for the module, but the original hijack code flar2 based his own code from. The author states his hijack code should work on 3.x.x kernels. Of course we need our own method and leveraging code... but some of the work he has done with root kitting and kernel hijacking may be helpful or at least give someone some ideas on a write protection workaround / disable intramfs.
[AT&T Samsung Galaxy Note 4] CJ74753:
I can confirm this, just killed the pid for SurfaceFlinger and my phone does a quick boot and keeps root.
[AT&T Samsung Galaxy Note 4] Jaytronics:
I have been reading up on this SurfaceFlinger. And as I am understanding its job in the system, I am thinking that your phones did not even part reboot. SurfaceFlinger is a system tool that translates the OS and all apps data into a language that the video card processor can understand. Also a slight off topic on SurfaceFlinger, it seems as though it is known as a battery hog. Though I am only repeating what I had just read.

Any way, the system may look to be rebooting. But what it seems like to me, is essentially you shut the driver off and the screen shut down along with some attached processes. Then the system says hold on a sec, this needs to come back online due to that processes su status. This is my take on the whole scenario. If I am wrong, please correctme. Any way, here is a url to info on it.

http://stackoverflow.com/questions/5699107/android-surfaceflinger
[AT&T Samsung Galaxy Note 4] mrkhigh:
With temp root, can you not then use chainfires new tool fireflash and inject permanent root with the Odin files? Sorry for the noobishness of this question I'm just reading up on the note 4 and this makes sense to me.
[AT&T Samsung Galaxy Note 4] CJ74753:
I'm 99.9% sure it is rebooting. When I kill the PID for it, I loose all recently opened apps, my Wifi disconnects due to "Factory Mode" is enabled via efs. It loads the entire boot logo and all so I'm thinking its not just shutting the driver off and bringing it back online.

EDIT: Well you maybe correct on this. Running the uptime command in terminal shows the phone has been running for close to 2 hours. So I think it's doing what is called a "hot boot", so it's just restarting the entire gui processes and threads.

I believe this is a no go due to the fact that the "signature" of the ODIN file is not what the system knows it should be. The signature tells ODIN it's not a signed Samsung file. (From what I understanded.)
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
Not without supersu

Sent From The EDGE

---------- Post added at 01:47 AM ---------- Previous post was at 01:45 AM ----------

It is rebooting you can install busy box and a soft reset app from. The playstore and keep root that way as well install whatever need a reboot such as xposed with whatever module u like and hit the soft reset button in the app. It will restart the os without a full boot and you retain root

Sent From The EDGE

---------- Post added at 01:49 AM ---------- Previous post was at 01:47 AM ----------

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] Surge1223:
As far as the kernel bit goes, the address that verifies module integrity should be the physical address of 0xC01C16C0 so this is the address to patch to 0x0.

An easy way to confirm is using devmem2. So what would have to be done is to devmem2 w that address and confirm it spits out 0x1A000002 and the overwrite it to 0x0.

Problem is that sepolicy currently restricts access to /dev/mem so a "hacked" sepolicy would need to be used to allow dev/mem access to do all this.

Even after all of this then someone would need to write a module to allow write access to system for changes to be saved so in theory this is all sound, in practice would require all those things I listed (and yes I confirmed the addresses I wrote above myself for the nj5 kk kernel I believe)
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
The question is is all that possible to be done and if so I'm guessing it would take long time

Sent From The EDGE
[AT&T Samsung Galaxy Note 4] FiniteTime:
Huh, /dev/mem has been taken out of Fedora and Debian at least, interesting that it's still present in Android. I did not know that.

Well, barring some new security magic, at least on regular Linux, root should have no problem changing a running selinux policy. Quick google seems to indicate that a reboot is required to disable selinux, but changing to 'permissive' mode might not.

If one has access to memory, after neutralizing selinux, is a kernel module the most straightforward way to disable write protection?

The write protection part is the part that I understand the least, but since apps and logs and whatnot all are getting written constantly, seems like somewhere in memory the write protection 'switch' for say system should exist.

Disable write protection on /system, do that pushing su or SuperSU install, then reboot. Write protection would be enabled again after the reboot, and I suppose it could get tricky if the location in memory of the write protection 'switch' is possible to change, so maybe a kernel module is the best way to get persistent disabling or control of write protection?

EDIT:

Yeah, I've seen people recommend this command, "setenforce"

To change enforcing mode at runtime, you can run the setenforce command from an adb root shell, e.g.:

# Check current enforcing status.
adb shell getenforce
# Switch to enforcing.
adb shell su 0 setenforce 1
# Switch back to permissive.
adb shell su 0 setenforce 0

from http://seandroid.bitbucket.org/GettingStarted.html

Also https://rbgeek.wordpress.com/2012/08/06/how-to-disable-selinux-on-centos-without-rebooting/

Anyone want to try that? Probably is some simple reason why it won't work but I couldn't say what.

EDIT 2:

Along the lines of trying the above, previous mentions of setenforce posts:

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post58461153#post58461153

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post58350110#post58350110

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post58318449#post58318449
[AT&T Samsung Galaxy Note 4] JOSHSKORN:
Just throwing a(n) (potentially stupid) idea out there...

Has anyone tried using the King Root, then before rebooting, running Debloater to see if any different items are displayed and can be killed? Would there possibly be an item that would be displayed while having temp root that could lead to us NOT losing root after a reboot?

In effort to help keep this thread clean, I'll just click on the Thanks button if someone can answer the question. Thanks in advance.
[AT&T Samsung Galaxy Note 4] DeathLord..:
I read the links and it seems to be a good area to check. I am fairly new to android. I hope a Dev or someone with a lot of knowledge will atleast try this.
[AT&T Samsung Galaxy Note 4] Jaytronics:
If we were to be able to get the system into a full read write and execute status. And we were using a root file explorer. What would I be looking for? And what values need to be changed to what? Mind you. You would have to hold my hand through this. I am less than a child at this stuff. I say this because I have managed to root, install SuperSU. And give the whole OS full R/W/X. Well, not sure on X.

If you guys feel that maybe a PM session would be better for this. Then I'm OK with this. Another thing is there any interest in any of the Qualcomm files like init.qcom.early_boot_sh?

Any way, I am off to bed. I have to be up in two hours. But, don't hesitate to message me.

Sent from my SM-N900V

---------- Post added at 03:05 AM ---------- Previous post was at 03:00 AM ----------

By the way, After rooting and SuperSU and givi g Root privileges to several apps. My device has not reboot in 2.5Hrs. It is still going.

Sent from my SM-N900V
[AT&T Samsung Galaxy Note 4] CJ74753:
How were you able to successfully get SuperSU to install and run? Last I'd seen you had got it to install only partially. KingUser doesn't like my attempts to replace it. My phone has been running for almost 12 hours with root.

Any idea is a good one, if we keep the brainstorming up something will come through for us. Unfortunately the only difference when running debloater with and without root is 1 apk and that is the KingUser app. I find it odd that KingUser is uninstalled on reboot though. Has anyone questioned

why

KingUser is uninstalled after a reboot?

EDIT: Okay just read that KingUser is installed as a system app, hence forth the reason it is removed at bootup.
[AT&T Samsung Galaxy Note 4] cstayton:
unfortunately this is where the write protection comes into play (I believe) so doubtfull this would be an option, since i am on 5.0 i have not tested this tho
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
I will be able to try in 2 weeks when am no longer on call, but unless write protect is hardware driven having root even (temp root) should allow access to almost everything. From what I have gathered by most the discussions /system seems to be a initramfs that would be loaded from one of the block partitions at boot. since the block partition is never actually written too there are no changes made to the system and fresh unrooted system is loaded at boot. after boot the block partition isn't needed so it shouldn't be mounted. or if it is it should be mounted as read only. if we have root we should be able to remount the block partition as rw to somewhere else in the FS. like /tmp/mmblkxx. then see if we can make changes to that partition and see if those changes load into /system on boot.

Does that make any sense? I mean it is linux and with root you should be able to manipulate the heck out of the system.
[AT&T Samsung Galaxy Note 4] Jaytronics:
Yes, SuperSU is installed. However, the su binary. When I go the the SuperSU app and click on it, I get the message

"The SU binary needs to be updated. Continue?"

So, I hit continue. Next message is

"If you have a custom recovery like TWRP or CWM, that can be used to (try to) install the SU binary. This is recommended for HTC devices. How would you like to install the SU binary?"

The two options that are given are

"Normal" or "TWRP/CWM".

Neither one works. The next message is

"Installation failed!"

Please reboot and try again."

Sent from my SM-N900V
[AT&T Samsung Galaxy Note 4] drivel2787:
What needs to be done to test this? I'll flash my phone back to 4.4.4 and test right now
[AT&T Samsung Galaxy Note 4] Jaytronics:
Sent from my SM-N900V