[Samsung Galaxy S 4 Unified Development] LupineDream:
OF4 Firmware root!

Obtained by Team D3mons

Savage says Hi. Love LoopyD.

We've (or I've) obtained root on the Samsung Galaxy S4 Straight Talk variant OF4 firmware, which was thought not possible due to new Knox security updates preventing even the installation of a kernel. Here's my screenshots.

Original dev thread where I was editing and tinkering.

http://xdaforums.com/galaxy-s4/devs-only/s975l-tricking-knox-flash-t3279741

This was done by a hex edit hack available in Odin flashable form heree -> OneDrive link. Flash with Odin 3.07.

(My folder is a mess, do let me know if I uploaded the right one).

This Odin flash will flash to NB1 kernel hex-edit disguised as OF4, so the flash does not fai from download model, then apply towelroot I succeeded with its generic mod strings. Tap 3 times on towelroot to enable them, then simply press "Make it ra1n".

TWRP that works on this phone I haven't tested yet, but appearently jfttmo works.

Thanks:

Geohot, Chainfire, SAMMobile, and me! (Press Thanks when and if it worked and buy me a pop ;) )

Disclaimer: This trips Knox. Your warranty is now void (who cares, it's Straight Talk!) I'll see if Triangle Away I can make work once I get the money, I'll see about applying a lucky patch or something to get it to force-do our phone. Hopefully without a brick. But SuperSU will disable the KNOX notifications and security check.

Original dev thread where I was editing and tinkering:

http://xdaforums.com/galaxy-s4/devs-only/s975l-tricking-knox-flash-t3279741

Dev links:

Developer files:

PIT File for OF4

Vold.fstab for OF4

Dev important information

SM-S975L OF4 FIRMWARE MOUNT LOCATIONS AND ATTRIBUTES
root@jfltetfnatt:/ # cat /proc/mounts
---------------------------------------------
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
/sys/kernel/debug /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/secure tmpfs rw,seclabel,relatime,mode=700 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime, data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,discard,journal_checksum,journal_async_commit,noauto_da_alloc,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,discard,journal_checksum,journal_async_commit,noauto_da_alloc,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/apnhlos /firmware vfat ro,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/platform/msm_sdcc.1/by-name/mdm /firmware-mdm vfat ro,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/platform/msm_sdcc.1/by-name/efs /efs ext4 rw,seclabel,nosuid,nodev,noatime,discard,journal_checksum,journal_async_commit,noauto_da_alloc,errors=panic,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/persdata /persdata/absolute ext4 rw,seclabel,nosuid,nodev,relatime,data=ordered 0 0
/data/container /mnt/shell/container sdcardfs rw,nosuid,nodev,relatime,uid=1000,gid=1000 0 0
/data/media /mnt/shell/emulated sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023 0 0
tmpfs /storage/emulated tmpfs rw,seclabel,nosuid,nodev,relatime,mode=050,gid=1028 0 0
/dev/block/vold/179:33 /storage/extSdCard vfat rw,dirsync,nosuid,nodev,noexec,noatime,nodiratime,uid=1000,gid=1023,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /storage/extSdCard/.android_secure tmpfs ro,seclabel,relatime,size=0k,mode=000 0 0
/data/media /storage/emulated/0 sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023 0 0
/data/media /storage/emulated/0/Android/obb sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023 0 0
/data/media /storage/emulated/legacy sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023 0 0
/data/media /storage/emulated/legacy/Android/obb sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023 0 0
---------------------------------------------
SM-S975L OF4 FIRMARE PARTITION LIST FOR CHECK AND IDENTIFICATION
root@jfltetfnatt:/ # cat /proc/partitions
major minor #blocks name

253 0 512000 zram0
179 0 15388672 mmcblk0
179 1 12772 mmcblk0p1
179 2 52764 mmcblk0p2
179 3 128 mmcblk0p3
179 4 256 mmcblk0p4
179 5 512 mmcblk0p5
179 6 2048 mmcblk0p6
179 7 512 mmcblk0p7
179 8 512 mmcblk0p8
179 9 16896 mmcblk0p9
179 10 13952 mmcblk0p10
179 11 3072 mmcblk0p11
179 12 3072 mmcblk0p12
179 13 780 mmcblk0p13
179 14 780 mmcblk0p14
179 15 780 mmcblk0p15
179 16 2826240 mmcblk0p16
179 17 8192 mmcblk0p17
179 18 2119680 mmcblk0p18
179 19 6144 mmcblk0p19
179 20 10240 mmcblk0p20
179 21 10240 mmcblk0p21
179 22 10240 mmcblk0p22
179 23 6144 mmcblk0p23
179 24 3072 mmcblk0p24
179 25 8 mmcblk0p25
179 26 9216 mmcblk0p26
179 27 20480 mmcblk0p27
179 28 20480 mmcblk0p28
179 29 10219520 mmcblk0p29
179 32 1943552 mmcblk1
179 33 1942528 mmcblk1p1
---------------------------------------------
SM-S975L OF4 FIRMWARE MOUNT BLOCK POINTS (SYSTEM)
root@jfltetfnatt:/ # ls -l /dev/block/platform/msm_sdcc.1/by-name/
---------------------------------------------
lrwxrwxrwx root root 1970-04-30 23:54 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-04-30 23:54 apnhlos -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-04-30 23:54 backup -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-04-30 23:54 boot -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-04-30 23:54 cache -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-04-30 23:54 carrier -> /dev/block/mmcblk0p28
lrwxrwxrwx root root 1970-04-30 23:54 efs -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-04-30 23:54 fota -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-04-30 23:54 fsg -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 1970-04-30 23:54 hidden -> /dev/block/mmcblk0p27
lrwxrwxrwx root root 1970-04-30 23:54 m9kefs1 -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-04-30 23:54 m9kefs2 -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-04-30 23:54 m9kefs3 -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-04-30 23:54 mdm -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-04-30 23:54 modemst1 -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-04-30 23:54 modemst2 -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-04-30 23:54 pad -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-04-30 23:54 param -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-04-30 23:54 persdata -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 1970-04-30 23:54 persist -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-04-30 23:54 recovery -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-04-30 23:54 rpm -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-04-30 23:54 sbl1 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-04-30 23:54 sbl2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-04-30 23:54 sbl3 -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-04-30 23:54 ssd -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-04-30 23:54 system -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-04-30 23:54 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-04-30 23:54 userdata -> /dev/block/mmcblk0p2
---------------------------------------------

I hope all this helps. More info available upon request. I'll pull as much as needed for a cyanogen or autoroot build, since towelroot works. I don't have a linux system nor can spend the time building. I have school.