yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note 4] cstayton:
you wont be able to traverse the directory since this is a partition and i have doubts that even with root you will be allowed to mount it as any other folder or file system.

first you would need to root your device with kingroot

then with the device connected to your PC

start an adb shell and enter the "su" command

the system partition is /dev/block/mmcblk0p24
[AT&T Samsung Galaxy Note 4] drivel2787:
Do you want me to attempt to mount this?

mount /dev/block/mmcblk0p24
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
you'll need a bit more than that. but I would think something like this may work.

mkdir /tmp/test

mount -fs ext4 /dev/block/mmcblk0p24 /tmp/test
[AT&T Samsung Galaxy Note 4] drivel2787:
So just attempt this and see if it successfully mounts and report back, that is all you need me to do?
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
pretty much. or some variation of that mount command. if it does mount then cd to /tmp/test and see is you are able to make any changes. see if the root files in there match the root files in /system. if so then try creating a file. maybe try dropping supersu apk into the app folder. then reboot and see what shows up in /system after the reboot. Good luck and thank you for attempting.
[AT&T Samsung Galaxy Note 4] drivel2787:
Ok... Be back in a flash... Literally :p
[AT&T Samsung Galaxy Note 4] bickfordman:
Does kingroot work on the dev edition?
[AT&T Samsung Galaxy Note 4] Jaytronics:
Here is a thought. We want su installed. But we can not because Kingroots app Kinguser was installed as a system app. So, go to Titanium Backup. Turn Kinguser into a user app. Now, we can nit install su binary because Kinguser installed its own binary? Where is that installed? Can we remove it after turning Kinguser into user app? Can I uninstall its binary through terminal emulator.

Sent from my SM-N900V
[AT&T Samsung Galaxy Note 4] drivel2787:
I get the following so far.....

1|root@trlteatt:/dev/block # mount -fs

mount -fs

mount: invalid option -- f

mount: invalid option -f

1|root@trlteatt:/dev/block #

Tried what was said above..
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
I found a site that state the fs option doesn't exist in android. it said to use -t. try

" mount -t ext4 /dev/block/mmcblk0p24 /tmp/test"
[AT&T Samsung Galaxy Note 4] drivel2787:
I made a different location temp folder and did the same thing

1|root@trlteatt:/ # mount -t ext4 /dev/block/mmcblk0p24 /storage/sdcard0/Kingroo

t/Test

lk0p24 /storage/sdcard0/Kingroot/Test <

Looks like it worked, didn't come back with an error message. If I attempt to run the same command again I get the following:

root@trlteatt:/storage/sdcard0/Kingroot/Test # mount -t ext4 /dev/block/mmcblk0p

24 /storage/sdcard0/Kingroot/Test

ev/block/mmcblk0p24 /storage/sdcard0/Kingroot/Test <

mount: Device or resource busy
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
Awesome. What do you see if you

"ls /storage/sdcard0/Kingroot/Test" ?

if there are files sililar to /system can you "cd /storage/sdcard0/Kingroot/Test" then try making a file. i would try "touch test.file"
[AT&T Samsung Galaxy Note 4] drivel2787:
The contents are similar

10|root@trlteatt:/ # ls /storage/sdcard0/Kingroot/Test

ls /storage/sdcard0/Kingroot/Test

CSCVersion.txt

SW_Configuration.xml

VODB

app

bin

build.prop

cameradata

container

csc

csc_contents

etc

fonts

framework

hidden

kern_sec_info

kroot_20150514104931.txt

lib

lost+found

media

preloadedkiosk

preloadedsso

priv-app

sipdb

tima_measurement_info

tts

usr

vendor

voicebargeindata

wakeupdata

xbin

root@trlteatt:/ #

root@trlteatt:/ # cd /system/

cd /system/

root@trlteatt:/system # ls

ls

CSCVersion.txt

SW_Configuration.xml

VODB

app

bin

build.prop

cameradata

container

csc

csc_contents

etc

fonts

framework

hidden

kern_sec_info

kroot_20150514104931.txt

lib

lost+found

media

preloadedkiosk

preloadedsso

priv-app

sipdb

tima_measurement_info

tts

usr

vendor

voicebargeindata

wakeupdata

xbin

root@trlteatt:/storage/sdcard0/Kingroot/Test # touch test.file

touch test.file

root@trlteatt:/storage/sdcard0/Kingroot/Test # ls

ls

CSCVersion.txt

SW_Configuration.xml

VODB

app

bin

build.prop

cameradata

container

csc

csc_contents

etc

fonts

framework

hidden

kern_sec_info

kroot_20150514112103.txt

lib

lost+found

media

preloadedkiosk

preloadedsso

priv-app

sipdb

test.file (it created it) --------------------------------------------------------------------------------------------------------HERE:good:

tima_measurement_info

tts

usr

vendor

voicebargeindata

wakeupdata

xbin

root@trlteatt:/storage/sdcard0/Kingroot/Test #
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
Again. Awesome. I would definitely suggest creating a file in the app folder and see if it shows up in /system/app after a reboot. if so... its a matter of getting supersu installed to that block part correctly. I don't think its as easy as copying the apk into system but if we can edit what gets loaded on boot that will make a huge difference.
[AT&T Samsung Galaxy Note 4] drivel2787:
ceated test.file under /system/app it allowed me to do so

rebooted

File is not under /system/app
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
Damn.
[AT&T Samsung Galaxy Note 4] drivel2787:
My exacty thoughts LOL.
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
If you reroot and remount the block24 is the file still in there?
[AT&T Samsung Galaxy Note 4] cstayton:
this would be expected since once you mount the partition it is ow effectively an initramfs. this is further proof that the /system partition is an initramfs file system.
[AT&T Samsung Galaxy Note 4] drivel2787:
It is not.

---------- Post added at 04:55 PM ---------- Previous post was at 04:42 PM ----------

Anyone have any other ideas before I flash back to Lollipop?
[AT&T Samsung Galaxy Note 4] psyciatrichelp:
My only other thought at the moment without playing with it myself is to try and mount other partitions and see if any of them contain similar files to /system. or seeing if you can modify files in other partitions and see what sticks after reboot. I will definitely explore this further myself when I have an opportunity.

Thanks for trying.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Would you copy and paste the output of doing the following?

# Do Kingroot
# Get adb shell
su
mkdir /storage/sdcard0/Kingroot/test
mount -t ext4 -o rw /dev/block/mmcblk0p24 /storage/sdcard0/Kingroot/test
touch /storage/sdcard0/Kingroot/test/test.file
ls /storage/sdcard0/Kingroot/test/test.file
mount
# Reboot
# Do Kingroot
# Get adb shell
su
mount
# (Above line is not a typo)
mount -t ext4 /dev/block/mmcblk0p24 /storage/sdcard0/Kingroot/test
ls /storage/sdcard0/Kingroot/test/test.file

Then something else to also try is the output from above but after the very first "su" do:

setenforce 0
[AT&T Samsung Galaxy Note 4] FiniteTime:
Thanks DroidHelp101!

Now that is interesting. Selinux enforcing doesn't want to change and explicitly setting 'rw' when mounting doesn't make a change.

For both I'm not sure what kind of protections would do that. Not sure why it lets you mount as rw but isn't actually rw. Hoping the restrictions are in the kernel, since some kind of microcontroller or security cpu restricting write access to specific areas would be way more difficult.

I'm thinking the focus should be on disabling selinux or getting selinux into permissive mode. Then it's just finding where the restrictions are in memory to modify them (not to say that a kernel module isn't better/easier, I'm just more familiar with memory stuff than kernel modules).

A test of selinux being disabled is Surge1223's suggestion of using devmem2.

Use devmem2 to read address 0xC01C16C0 confirm it gives 0x1A000002 then write 0x0.

A longshot but, mind trying this after getting root with Kingroot [MENTION=6157272]DroidHelp101[/MENTION] ?:

http://www.xda-developers.com/easily-change-your-android-selinux-mode/

EDIT: Also:

setprop ro.build.selinux 0

EDIT 2:

Another way to try to run commands:

su --context u:r:system_app:s0 -c "su 0 setenforce 0" < /dev/null
su --context u:r:init:s0 -c "su 0 setenforce 0" < /dev/null
su --context u:r:kernel:s0 -c "su 0 setenforce 0" < /dev/null

Then seeing if "getenforce" shows permissive.

I'd try running the setprop, setenforce, mount, touch, and other commands with each context to see if that makes a difference. Do the "setenforce" and "setprop" commands first, to see if we can get selinux into permissive mode.

Other contexts:

u:r:init_shell:s0

u:r:samsung_app:s0

u:r:healthd:s0

u:r:thermald:s0

u:r:ueventd:s0

u:r:vold:s0

u:r:zygote:s0

(Got the above contexts from looking at what contexts were for the root user in the SELINUX_CONTEXTS.7z file from this post: http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post58318449#post58318449 )
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Notta my friend, Half the commands didnt go through

root@trlteatt:/ # setprop ro.build.selinux 0

setprop ro.build.selinux 0

root@trlteatt:/ # getenforce

getenforce

Enforcing

root@trlteatt:/ # su --context u:r:system_app:s0 -c "su 0 setenforce 0" < /dev/n

ull

-c "su 0 setenforce 0" < /dev/null <

root@trlteatt:/ # getenforce

getenforce

Enforcing

root@trlteatt:/ # su --context u:r:init:s0 -c "su 0 setenforce 0" < /dev/null

su --context u:r:init:s0 -c "su 0 setenforce 0" < /dev/null

root@trlteatt:/ # getenforce

getenforce

Enforcing

root@trlteatt:/ # su --context u:r:kernel:s0 -c "su 0 setenforce 0" < /dev/null

"su 0 setenforce 0" < /dev/null <

[-] Unsupported context: Operation not permitted

1|root@trlteatt:/ # su --context u:r:kernel:s0 -c "su 0 setenforce 0" < /dev/nul

l

"su 0 setenforce 0" < /dev/null <

[-] Unsupported context: Operation not permitted

1|root@trlteatt:/ # su --context u:r:init_shell:s0 -c "su 0 setenforce 0" < /dev

/null

0 -c "su 0 setenforce 0" < /dev/null <

[-] Unsupported context: Operation not permitted

1|root@trlteatt:/ # su --context u:r:samsung_app:s0 -c "su 0 setenforce 0" < /de

v/null

s0 -c "su 0 setenforce 0" < /dev/null <

[-] Unsupported context: Operation not permitted

1|root@trlteatt:/ # su --context u:r:healthd:s0 -c "su 0 setenforce 0" < /dev/nu

ll

c "su 0 setenforce 0" < /dev/null <

[-] Unsupported context: Operation not permitted

1|root@trlteatt:/ # su --context u:r:thermald:s0 -c "su 0 setenforce 0" < /dev/n

ull

-c "su 0 setenforce 0" < /dev/null <

[-] Unsupported context: Operation not permitted

1|root@trlteatt:/ # su --context u:r:ueventd:s00 -c "su 0 setenforce 0" < /dev/n

ull

-c "su 0 setenforce 0" < /dev/null <

[-] Unsupported context: Operation not permitted

1|root@trlteatt:/ # su --context

su --context

root@trlteatt:/ # su --context u:r:vold:s0 -c "su 0 setenforce 0" < /dev/null

su --context u:r:vold:s0 -c "su 0 setenforce 0" < /dev/null

[-] Unsupported context: Operation not permitted

1|root@trlteatt:/ # su --context u:r:zygote:s0 -c "su 0 setenforce 0" < /dev/nul

l

"su 0 setenforce 0" < /dev/null <

root@trlteatt:/ # getenforce

getenforce

Enforcing

root@trlteatt:/ #
[AT&T Samsung Galaxy Note 4] FiniteTime:
[MENTION=6157272]DroidHelp101[/MENTION]

Hmm well that is interesting. And difficult. This selinux thing is definitely complicated.

Have to do more research.
[AT&T Samsung Galaxy Note 4] Xak:
Please use pastebin when sharing logs and lines of code. When you copy and paste the logs on posts one post can fill up pages and be annoying to readers. Here is the link to pastebin http://pastebin.com/.

Thanks
[AT&T Samsung Galaxy Note 4] Surge1223:
Selinux doesn't really matter much at this point. You don't even need Permissive you really just need access to /dev/mem. So while it's great you guys are all working together, I think you should focus on what matters at this point in time

TL ; DR worry about selinux after permanent root
[AT&T Samsung Galaxy Note 4] heXacode:
I agree. SElinux can be changed after full root. It is the least of out worries while obtaining full root. It can be changed to permissive mode by an app later.
[AT&T Samsung Galaxy Note 4] DroidHelp101:
My apologies if some one has covered this already, what is this all about and could it be part of our problem?

Edit

I was able to add .bak to all the files, after a reboot the files were replaced but the ones I renamed with .bak remained. Still had to temp root after a reboot
[AT&T Samsung Galaxy Note 4] FiniteTime:
Huh, sorry if I misunderstood but I thought the steps were:

1. Get access to /dev/mem (which requires selinux disabling)

2. Which would allow modifying the part of memory that controls write protection

I mean steps could be:

1. Somehow load kernel module that lets one load unsigned kernel modules

2. Load kernel module that removes write protect

But I guess that would depend on loading selinux being harder than loading a kernel module that lets you load unsigned modules (assuming the "/dev/mem -> selinux -> modify memory to remove write protection" method actually makes sense)
[AT&T Samsung Galaxy Note 4] Surge1223:
Getting access to /dev/mem doesn't require selinux disabling, just a modification of selinux policy and even that isn't a full requirement (on s4 lollipop I'm still able to access /dev/mem with selinux enforcing) I'm just assuming you don't already have access to /dev/mem but if you do it should have the perms chmod 660 and owned by root. Either way, access to /dev/mem to load modules would be a huge step forward.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Oh ok. So let's find out what the permissions are.

[MENTION=6157272]DroidHelp101[/MENTION]

Mind pasting the output of:

su
ls -l /dev/mem
ls -lZ /dev/mem

If not I guess changing selinux policy hopefully is possible (I just figured it was more straightforward to set to permissive than tweak just the part we need, but whatever works).

[MENTION=4939386]Surge1223[/MENTION]

You think the only way forward for removing write protection is a kernel module? Or the best? As in, would editing memory or other methods work?
[AT&T Samsung Galaxy Note 4] alienundies:
Maybe make sure that the goup and owner are the same with chown?

Ie.. root.root

This is probably useless now and passed up to far.
[AT&T Samsung Galaxy Note 4] brewmeister:
maybe this can help? http://xdaforums.com/devdb/project/dl/?id=12178
[AT&T Samsung Galaxy Note 4] DroidHelp101:
root@trlteatt:/ # ls -l /dev/mem

ls -l /dev/mem

/dev/mem: No such file or directory

1|root@trlteatt:/ # ls -lZ /dev/mem

ls -lZ /dev/mem

/dev/mem: No such file or directory

1|root@trlteatt:/ #
[AT&T Samsung Galaxy Note 4] vonerk:
Try this with memcg instead of mem
[AT&T Samsung Galaxy Note 4] DroidHelp101:
root@trlteatt:/ # ls -l /dev/memcg

ls -l /dev/memcg

/dev/memcg: No such file or directory

1|root@trlteatt:/ # ls -lZ /dev/memcg

ls -lZ /dev/memcg

/dev/memcg: No such file or directory
[AT&T Samsung Galaxy Note 4] alienundies:
Has anyone tried replacing a file in memblock24?

What I have read is, it doesn't check the file, it just checks what should and should not be there. If you were to put.. say superuser in place of another app. Ie... Delete calculator and rename supersu to calculator, Will it stay? And if so will it replicate it after reboot?
[AT&T Samsung Galaxy Note 4] DeathLord..:
I am curious if anyone has looked into your suggestion.

I strongly believe root is closer than ever before. I have seen post that explained in full detail how and why the bootloader is locked with write protection.

I am curious if any of XDA strong devs have researched it.
[AT&T Samsung Galaxy Note 4] jasonstackhouse:
You talking about this block?
[AT&T Samsung Galaxy Note 4] kickstand77:
Intresting indeed

h t tp://securityintelligence.com/android-keystore-stack-buffer-overflow-to-keep-things-simple-buffers-are-always-larger-than-needed/#.VV72qWdFBrQ[/url]
[AT&T Samsung Galaxy Note 4] JOSHSKORN:
Isn't that for Android 4.3? We're on either Android 4.4.4 or Android 5.0.1, granted current root exploits work for Android 4.4.4 only.
[AT&T Samsung Galaxy Note 4] alienundies:
Haha. Nice pointer.

Yes. That's the one.
[AT&T Samsung Galaxy Note 4] Tone Capone:
How is the Developer Edition identified? Is it in a file some place, or a pin hardwired on a board?

I ask because I am wondering if a regular Note 4 could be loaded w/ the DE bootloader if it thought that it was a DE.

Thanks for entertaining my noob question.
[AT&T Samsung Galaxy Note 4] bghouse10:
No it cannot & it has already been asked & answered before....
[AT&T Samsung Galaxy Note 4] Tone Capone:
I appreciate the response. Could u point me to where it was answered? I could not find anything about how the DE is identified. Thx.
[AT&T Samsung Galaxy Note 4] bghouse10:
Here is a link for the search I just did, it pulls up over a half dozen threads....

http://xdaforums.com/sitesearch.php?q=NOTE 4 DE bootloader be used to obtain root on retail edition
[AT&T Samsung Galaxy Note 4] JOSHSKORN:
If I remember correctly, if you remove the back cover (and possibly the battery as well), there is some sort of model number there. Check that and Google yours to see what it is. I'm not sure if it says Developer Edition or not.
[AT&T Samsung Galaxy Note 4] spexwood:
He wasn't asking whether or not he has the Dev Ed. He was asking what made a Dev Ed a Dev Ed in tge first place and if it was possible to copy that difference (like a bootloader or something) to a non Dev Ed phone.

In other words, turn a non Dev Ed Note 4 into a Dev Ed Note 4.

I don't know the fine details of all this stuff, so I can only think in terms of large scale theory. So in theory, if it was just software, then it would be possible. But from what I've been learning about this phone, it's all probably bootloader related, and we can't change the bootloader even with temp root.
[AT&T Samsung Galaxy Note 4] JOSHSKORN:
This will probably sound silly, but who remembers write protection on 3.5" disks? Is there any physical difference between retail and DE phones, like a write-protect cover?
[AT&T Samsung Galaxy Note 4] Kyuta Syuko:
As far as I know there is no hardware difference between the retail Note 4 and the Dev Edition Note 4. The only difference I know of is the unlocked bootloaders in the Dev Edition.
[AT&T Samsung Galaxy Note 4] KohanTech:
What about jtag'n the DE firmware? I know very little about it. Maybe hooking up to the access points under the battery cover?
[AT&T Samsung Galaxy Note 4] Jaytronics:
Here is a good one. Where can the pin out for the Note 4 chipsets be found? If we had the ability to identify the pins on all the major chips in this device. Like what was stated before. There is a possibility that one could tell the system to accept a rewrite of anything and everything. The problem is, that for some bulls#!+ reason. We the consumers do not have the right to know this information at times. Fact of the matter is, all these pbones, tablets and phablets do pretty much the same thing. Yet, these corporations have this asinine hold out on us as if we are nothing. Yet without us they are nothing. Any way, someone get me the schematics to this phones entire chipset. Then maybe we can do some damage.

Sent from my SM-N910V
[AT&T Samsung Galaxy Note 4] Tone Capone:
I will try to pose my question differently...

We all know that trying to ODIN the DE bootloader to a retail Note 4 will not work. So, my question is what check happens (I assume within the bootloader code) so that it doesn't work? I thought maybe it was a part number check of some sort...but what info is actually used, and where on the device is that particular info stored?

That was what I was trying to find the answer to, but came up empty.
[AT&T Samsung Galaxy Note 4] scarygood536:
Well specifically the 'aboot' partition is different. Literally DE devices are made with the retail. They are taken of the line, brought in a room and flashed with the DE firmware which is the same as retail except the "ABOOT". This partition is coded specifically with the device id and encrypted with SHA256 encryption. This is why if you buy a developer edition phone you should back up your aboot, because their isn't another one like it. IF you flash a retail firmware by accident you now have a locked boot loader. I believe people with developer edition devices need to remove the aboot before they flash stock firmware (which they can do because they can odin unsigned code until they lock there bootloader). Read this There is no way to flash the DE aboot on retail without knowing how samsung signs it. Which will NEVER happen.
[AT&T Samsung Galaxy Note 4] Black89:
I have the ic pinout if you tell me what signals you need I can get them to you. I'm assuming jtag? Problem is they likely made the balls on the center of the msm so you can't get to them from the side. I have soldered to bga balls on the side if ic before. For production on secure devices they delete all test points, resistors, or capacitors that any of these signals went to. Part of security protocol. I don't know about Samsung just worked for others. So if I can only get you the pinout I don't think it would be much help. If they left the jtag connector test points or something the schematics may.
[AT&T Samsung Galaxy Note 4] Jaytronics:
http://gsmserver.com/item/boxes-and...ctivated-with-optimus-cable-set-plus-jig-set/

http://octoplusbox.com/en/features/models/

Sent from my SM-N900V
[AT&T Samsung Galaxy Note 4] scarygood536:
and with that pricetag they don't even offer free shipping. Not sure if this is going to be a popular route. We should stick to trying to come up with ideas to disable WP without extra hardwar
[AT&T Samsung Galaxy Note 4] bghouse10:
I agree, buuut I would be willing to throw in a $20 if there was certainty it would give us perm root. Just sayin...;)
[AT&T Samsung Galaxy Note 4] cstayton:
Reading thru the list of supported Samsung devices the Note4 series is not listed so likely wouldn't work
[AT&T Samsung Galaxy Note 4] Venom0642:
Lol this damn phone is so tightly locked ? that not even Superman can break thru it lmfao ? had to get it off my chest.

Running On New Deadly Venom Note 4 v3.0
[AT&T Samsung Galaxy Note 4] heXacode:
Actually it is listed but it's a bad route to go.

Who knows what it's capable of doing for the Note 4 as far as rooting. Plus, let's say it miraculously does what we need. How would it benefit everybody else who doesn't have the Octoplus? You would be the only one with a rooted phone with the help of the OctoPlus.

Makes no sense to try this.
[AT&T Samsung Galaxy Note 4] Venom0642:
[MENTION=3508760]heXacode[/MENTION] my wife laughs ? at me I get the Note 4 , then SG6 comes out i root it for her and she looks at me and goes haha ? , i am all good though but it's hilarious.

Running On New Deadly Venom Note 4 v3.0
[AT&T Samsung Galaxy Note 4] reydarz:
According to this Octoplus does support our phone:

http://octopusbox.com/eng/news/details/472
[AT&T Samsung Galaxy Note 4] cstayton:
Hmm I saw the 900 and 920 must have missed the Note4
[AT&T Samsung Galaxy Note 4] heXacode:
Lucky. My wife won't let me do anything with her S5. She doesn't want it more "confusing" than it is already.
[AT&T Samsung Galaxy Note 4] eklipz3:
I have the z3x box and it's a no go with it and I believe those boxes are similar, could be wrong though.

Sent from my VS985 4G
[AT&T Samsung Galaxy Note 4] borijess:
So the att s6 is already rooted? How can this happen? It's not locked as tight as the note 4? What's going on here? That's a damn shame.
[AT&T Samsung Galaxy Note 4] Venom0642:
Man where you been at SG6 and Edge AT&T, Verizon and most of all the other ones from all other providers has been rooted maybe more than a month or so.

Running On New Deadly Venom Note 4 v3.0
[AT&T Samsung Galaxy Note 4] borijess:
Why did they lock the note 4 so tight?:banghead:
[AT&T Samsung Galaxy Note 4] tbparkey:
You buy it and if it works I'll send you my phone and $50 bucks for rooting. I bet you would make some money on the deal.
[AT&T Samsung Galaxy Note 4] JOSHSKORN:
Has anyone ever thought of looking for firmware on this said device and trying to extract info from it?