[Galaxy Note5 Q&A, Help & Troubleshooting] Rezasdemon:
You would need to decompile the app for that and even still smalli or what ever it outputs is gunna take some time to sift thru and there are still signatures verified online so if the app is repacked the signature wont be accepted by any official servers and im sure samsung pay relies on official connections to servers for validating creditcards and their whole api etc so even you have some hacked apk that kills the connection to these servers you would still need to have a response server running locally that can return the same values as the official one and i assume there is tons of crap blocking that path too encryption being one packets etc just not worth the time and highly unplausible as it will not make real transactions cause your cc wont be verified by propper channnels see google for freedom.apk a old app that exploited app play service api calls by redirecting them to a middle man service which fed success messages to the apps for microtrans im thinking the only way were gunna exploit this at this point is goin back to 5.1 and waiting for a stagefright exploit or finding some way to make a app that exploits stagefright to get system user on marshmallow them using that patch the runtime check systems or exploit them which requires another exploit then installs su but marshmallow will need dissecting first as for just tripping knox and bypassing the app check im not super positive on whether or not thats possible but you would have to do so without fking the original app signature up so id say not gunna happen.

As for your bypass if you had anything it could have been an exploit in a older version which they may have patched i remember when they first added it to the phone it had notes of not being fully implemented maybe softing thru a older binary will reveal the changes security wise but i dont have time nor the propper experience to do that stuff im just a simple c++/c#/ unityscript/java/ website langs programmer with a little computer structure and logic classes and a bit of asm dabs just the easy stuff like hooks and bypassing code.

This is depressing i really want root but i wont lose the ease of spay nor am i willing to damage my phone. What bs $amsung to say dev friendly bootloader then play the apple card its bad enough they have no memory card or ir blaster or removable battery on note 5 but then to hard code a efuse and bust my nutz over root access which i need to bind port 80 and to block me from messing with my iptables or my adapter settings saying i need to pay 40 extra for some tethering which is purely a software bridge between physical adapters that you already paid for unlimited data on just to get 10gb of hotspot wtf lol ive had to find alternatives to everything i do devwise so i dont break this phone if anyone is just wanting root for a tethering bypass you can just use pda.net it works perfect thru usb tether root free and its nice for the price

---------- Post added at 11:31 AM ---------- Previous post was at 11:04 AM ----------

Oooouh just an idea and itll not be easy but maybe if we find out what the samsung app is using to reference the knox counter then maybe we could emulate that instead of everything else like some function might be called like this

If (knox->CheckKnoxBit ())

Maybe we can access this api or function and patch or rewrite it this is assuming what ever accesses the knox counter is external of the app requesting it it would have to be a seperate process so not to interfere with the spay sig

So to do that the process would be like this

Flash stock marshmallow

Root tripping knox cause if you can bypass the counter who cares if its broke (this would need custom boot image)

Patch knoxcounter reference function (what ever holds the call to return the knox counter value )

Now when spay loads when it references the counter have your patch return all good and spay should continue as normal but this will require intense dev work and reverse engineering