yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note5] droidvoider:
I tried to follow your instructions a few times in the past using Marshmallow 6.01 but I had two major problems. One is the SuperSU is blocked as an app now "outright blocked" and the second major problem is I can't flash that kernel you have in the Odin directory. (Honestly I been putting it in the BL spot and I'm not sure where in Odin it is supposed to be placed).

Tell me what try please!! I need some kind of Kernel that will flash to Android 6.01 w/Nov Security Patch.. I used EZ Package Disabler Pro version 2.55 and I disabled so much stuff on my phone it kept giving me the crash messages>OK. Then I used "adb install SuperSU.apk and presto I got past the banned app list problem... (SuperSU can't find the binaries but it does launch now!!)

I need access to the /System partition, duh right.. I need direction

Notes: I tried the following root tools.. (Warning: Phone gets HOT as soon as you install these, I installed at same time they took 18% battery in just over 30 minutes)

bltrootv7.apk

KingRoot-4.9.7_LeopardMan.apk

OneClickRoot.exe <==== I tried this on a test Windows machine which is resetting right now but to be honest I don't think it did anything malicious, which was a new experience.
[AT&T Samsung Galaxy Note5] KennyLG123:
This wont work on MM 6.0.1. It was put together to work on lp 5.1.1 depending on what version odin its ap or pda slot.. This device is designed to lock up if a exploit is noticed. For what you tried you got lucky...they are working on something but your have to wait. Maybe read up a bit on this device in the mean time...
[AT&T Samsung Galaxy Note5] droidvoider:
I chose this name because I've effectively killed more droids than most people owned. Typically when I'm trying to root something I brick it so I try to be cautious. KennyLG123 can you explain to me what is going to happen so I can try to avoid it?

My next line of thinking is this.. The script you guys are using does a bunch of **** like creating directories it's not supposed to, etc.. Then it does it's commands. I see this type of stuff in most scripts, for example Dirtycow. (I won't try Dirtycow on my Note 5 it can do a loop on the network settings and never enter recovery again).. But the point is many of these scripts install stuff, make directories and generally piss the system off.. My idea is to disable so many packages the phone is crapping itself and then roll out scripts on it's ass. I just have this feeling I can trip it up, mount the partition or allow me to fire su from the sdcard.. something

words? help me brick this otherwise perfectly working phone already will you? lol

---------- Post added at 09:19 PM ---------- Previous post was at 09:15 PM ----------

Maybe I will take your advice and do a ton more reading before continuing.. It isn't helping anyone to efuse my phone.
[AT&T Samsung Galaxy Note5] KennyLG123:
Ya but as of right now there is nothing that will root this device... Teather root will only go so far on lp but i would hold out and see what happens down the line.... I got this device in case i need a stock phone.. I stick with exynos chips on samsungs until that changes in the future. But i would study this a bit more so you dont end up with a paper weight...lol or if you had the option to sell the att model and buy a international model thats unlocked..
[AT&T Samsung Galaxy Note5] jxlee0215:
Pretty sure it's right xposed. Can u send link to which one you're talking about just to confirm. Read in thread someone was able to use xposed with flash fire and hotboot the modules. Just really need xposed for YouTube ad blocking unless there something else I can use. Been using Adguard for ads.
[AT&T Samsung Galaxy Note5] Skull97:
Here: https://xdaforums.com/xposed/unofficial-xposed-samsung-lollipop-t3180960
[AT&T Samsung Galaxy Note5] droidvoider:
Ok guys I have abandoned trying to root my SM-N920A after some great advice here. (Package Disabler made my phone great again and also I will just move this thing to T-Mobile in a few months)..I have more notes on causing crashes somewhere but here's what I was working on if anyone needs an error to try and leverage

Android 6.01 with Nov 2016 security update.. (PK1 was flashed with Odin)

shell@noblelteatt:/system/bin $ wm screen-capture root true

Error: bad number java.lang.NumberFormatException: Invalid int: "root"

shell@noblelteatt:/system/bin $ wm screen-capture -99 true

java.lang.SecurityException: Only system can call setScreenCaptureDisabled.

at android.os.Parcel.readException(Parcel.java:1620)

at android.os.Parcel.readException(Parcel.java:1573)

at android.view.IWindowManager$Stub$Proxy.setScreenCaptureDisabled(IWindowManager.java:2550)

at com.android.commands.wm.Wm.runSetScreenCapture(Wm.java:120)

at com.android.commands.wm.Wm.onRun(Wm.java:95)

at com.android.internal.os.BaseCommand.run(BaseCommand.java:47)

at com.android.commands.wm.Wm.main(Wm.java:46)

at com.android.internal.os.RuntimeInit.nativeFinishInit(Native Method)

at com.android.internal.os.RuntimeInit.main(RuntimeInit.java:257)

130|shell@noblelteatt:/system/bin $ mount -o rw,remount /system

mount: Permission denied

255|shell@noblelteatt:/system/bin $ toybox mount -o rw,remount /system

Segmentation fault

139|shell@noblelteatt:/system/bin $
[AT&T Samsung Galaxy Note5] JeSTeRH4CK3D:
OH crap. thats not good at all. question...........did it lock up the phone? meaning hard brick.

---------- Post added at 05:33 PM ---------- Previous post was at 05:31 PM ----------

just a update. i erased EVERYTHING. im starting from square 1.......i had to have missed something. it shouldn't be this hard to break into a damn phone. i break into linux boxes all the time but this damn phone.........
[AT&T Samsung Galaxy Note5] MrMike2182:
It appears as if he wasn't root.. Shouldn't you see # and not $?
[AT&T Samsung Galaxy Note5] JeSTeRH4CK3D:
yes # if you see $ your temp but not fully rooted like eng. kern temp
[AT&T Samsung Galaxy Note5] droidvoider:
No that is a user caused crash from adb shell by entering that command which I found of special interest because it is screen capture so I thought I could do something with it. I really just started looking at CVE proof of concepts on github. I honestly think the timing is more right for you guys on 5.11 but I'm up here on 6.01.

Anyway I'm getting smarter everyday. I am a noob but I am working so hard to change that.

(Guys don't pm me I don't have root yet and when I do I promise it will be on the forums within an hour of me finding it)
[AT&T Samsung Galaxy Note5] killernos:
I haven't downgraded yet haven't had the time, I was thinking could me not do chainfire systemless root, we have root access for flashfire, could we not use this method to either flash the systemless root, or try to update to 6.0.1 and see if we have root, just been thinking about this method the last few days. I was also thinking is there any way we could flash the systemless root zip without root.
[AT&T Samsung Galaxy Note5] droidvoider:
I think we were a little too fast to judge. First of all I flashed the boot.img from the previous version to my phone and it runs great! Some errors originally in logcat seem not to be there on reboot now? So then I tried flashing recovery.img from previous firmware. success!! PJ1 in recovery screen now. So then I tried unpacking the kernel with Assayyed kitchen, disabling dm verity and one other option. (not deknox, I am trying to perserve warranty bit!)... It flashes!

I haven't booted my phone with an altered kernel. ERROR, NO SACK FOUND! I flashed the PJ1 boot.img unmodified back without attempting boot, I need to try this on my tab4 first and then try to get 6.01 on another android to try it there too. (phone was 750 dollars or something like that)
[AT&T Samsung Galaxy Note5] TechNyne66:
PJ1 is sprint. Are you sure you have a N920A? If so this confirms a theory we have. If you do have a N920A can I get this kernel to test myself?
[AT&T Samsung Galaxy Note5] droidvoider:
I am 100% positive I have an N920A and I download N920A_N920AUCS3CPJ1_ATT_USA_v6.0.1.zip. (the problem is the BL file is corrupt, I can recover param.bin and cm.bin but not sboot.bin

(If anyone has the BL file from PJ1 I need it!)

This PJ1 boot.img is just from the firmware I downloaded and I use the PK1 pit because you can't repartition, yet, I will get past all of this somehow.

https://xdaforums.com/showpost.php?p=71163947&postcount=4

You can unpack that kernel with Assayyed Kitchen for Windows or CarlivImageKitchen64. With Assayyed snatch the boot.img out of the work folder after is repacked. (it packs it into system.img, we don't want that)

I have flashed PJ1 boot.img and PJ1 recovery.img to my phone now and it is running fine. I have suspicion that I can keep flashing the .img files using heimdall for Ubuntu and downgrade. But it isn't my mission so unless someone gives me the BL file for PJ1 I won't test that theory very soon. (hmmm it is on my mind though. I can try to do this with PB2 firmware 1 .img file at a time)
[AT&T Samsung Galaxy Note5] MrMike2182:
I tried to downgrade using heimdall and it wouldn't go.. I even bought an octopus box to manually flash and it still refused to do it!! I did find a code to use in the phone pad after messing around with it on QPST and I see this. Doesn't want to let me change it yet but I'm still working on it.
[AT&T Samsung Galaxy Note5] droidvoider:
Thanks for your post MrMike2182 do you mind if I ask which firmware version you are on? If you're brave you can try extracting the boot.img from the previous firmware version AP file and the .pit file from your current version of firmware located in the CSC file. Take these two files into heimdall-frontend, load your pit file then click <add>, then select BOOT in the pull down menu, then load up the boot.img you extracted, then flash and pray. (i use 7z x N920Afirmware.tar.md5 on the command line to extract in Ubuntu) **** Pretty risk, you might want to reply back version and let's have a look ****

Next thing I've done so far is used the same process to flash the recovery.img (again these are the .img files I extract from the tar.md5 files).. If you have success/fail please list your firmware version so I can get an idea of scope. I am trying to dig into kernel development, there are references to start from we just need to customize them for the N920A. I am on baseband ending in PK1 with Nov 1st, 2016 security patch, but not really of course I'm running the PJ1 kernel + recovery images.
[AT&T Samsung Galaxy Note5] MrMike2182:
I'm working on the Verizon Note 5 and I've done quite a bit including using console root kernel but they really have this thing locked down! I'm thinking about taking it apart using my heating gun to get the back off and flashing the memory manually but that's probably going to break it lol.. The octopus box is currently using a USB wire to do the flashing and it only allowed me to downgrade from firmware 3BQA1 to 3PI1 after that it fails and won't go any further. Originally I was working on the AT&T Note 5 but it broke and they refused to uphold the warranty so I switched to Verizon but they're both the same anyway and once one of us figures something out I'm pretty sure it'll work for both carriers.
[AT&T Samsung Galaxy Note5] droidvoider:
Unfortunately our phones are not similar enough for me to really help you what you need is the Verizon guys. If you start a thread and send me a private message with the link I will help out with what I can including helping you get started on your own in the Verizon section if no one is helping there now. If you're a programmer you can work your way through this.

Looked at your situation and if you can downgrade to that version I'd say do that and hold out for awhile because people are working on root, when a Note 5 is rooted with dirtycow I think it's an easy thing to do it for the rest. CVE-2016-5195 is on github, make sure you have your phone plugged in when you 'make'

N920VVZW3BPI1 --- Security Patch: 09/26/2016 --- "Should be vulnerable to dirtycow cve-2016-5195"

Verizon isn't making it easy to see what they patch unless it is just Google's patch. I found a blog around this time where they were focusing on an unrelated cve here that you can try to gauge where they are at in updating CVE vulnerabilities. Google had updates on Sepetember 2016 days 1, 5 and 6, but Verizon updates on the 26th for Pl1. What I'm saying is that downgrade you can maneuver gives you power and makes available to you a vulnerability that I know people are trying to get root with, also have gotten root on other devices I believe htc one.

Google CVE

https://source.android.com/security/bulletin/2016.html
[AT&T Samsung Galaxy Note5] MrMike2182:
Yes I know about a lot of the things regarding the phones, kernels, security, roms and what not. I'm also already working in the Verizon thread and have been for awhile it's just better to come here and grab/check information and give information in case it helps.
[AT&T Samsung Galaxy Note5] droidvoider:
Mike I'm sorry I can see that you are very active and know your stuff but I was just tired eyed from reading about the kernel. Awesome to have you contribute here as well! When I flashed boot.img to my phone with heimdall it was a fully setup phone using AT&T firmware N920AUCS4CPK1 Nov 1st, 2016 security patch (which is patched for dirtycow). I rebooted to download mode then flashed just the "extracted" boot.img from N920AUCS3CPJ1 using heimdall for Ubuntu that I downloaded from github and compiled myself a couple days ago. Then after playing with my phone some, after an idea from Delgoth from this forum actually, I decided to try recovery.img from previous version also which flashed flawlessly and that's where I sit, phone runs great. Shows PJ1 in recovery, PK1 everywhere else. (dirtycow works, kernel unpatched)

No time to test this right now:

I am pretty sure that prior to flashing the previous version firmware PJ1 boot.img I couldn't flash the previous version PJ1 recovery.img. But after flashing PJ1 boot.img it allowed PJ1 recovery.img. But I am not interested in flashing the PK1 boot.img back to my find to find out. I definitely don't want to get stuck there. I don't have PJ1 firmware BL file it is corrupt from every available download I've found. So I'd have to try to inch back to PH4 this way, I will test it eventually right now I'm on the kernel.
[AT&T Samsung Galaxy Note5] MrMike2182:
I'm a bit confused at the top of your message you said you flashed PJ1 and then at the bottom you said you don't have it because they're corrupt everywhere.. Which did you need because I have lots of firmware on my server and mine might work.
[AT&T Samsung Galaxy Note5] droidvoider:
No my installation consists of all files from PK1 firmware EXCEPT boot.img and recovery.img are from PJ1. This allowed me to be vulnerable to dirtycow but also it made me realize that even if I can't touch the bootloader I own the kernel!

The previous firmware PJ1 archive only is missing the BL file, the other 3 files CSC, AP, CP are all fine. The AP file houses boot.img and recovery.img. So I extracted just the boot.img and recovery.img files from the AP file out of the PJ1 firmware. Then using heimdall flashing tool for Ubuntu + heimdall-frontend, I flashed the unpacked boot.img (directly without repacking to a tar file) directly ontop of my valid PK1 installation and yes it runs smooth. (as a reminder I used the PK1 pit file to avoid (pit) message in download mode. The boot.img contains the kernel so when my phone booted up and ran normally I was very happy. What's more, now my kernel is effectively 'unpatched' so I am now vulnerable to dirtycow! The recovery contains a copy of the kernel so now there is no way in hell my system can repatch itself!

New idea for root!

If I put a read only text file in a /data/data/<debugable app>/ directory then patch the file with dirtycow the Note5 reboots without even putting a message in logcat. But you can patch things in root directory / and also /system/bin/ .... It would be a little funny to patch /system/bin/reboot to be a "take root" program. I think it would run under the context of the deep system somewhere, although no logcat at all so.. It would be brave but interesting
[AT&T Samsung Galaxy Note5] MrMike2182:
With the box I have I can pretty much flash any boot.img I want and certain cm.bin and cache, sboot.bin and modems but they have to be from different firmwares the only problem I'm noticing with my box is when I go to flash a downgraded system image THAT'S where it suddenly gives me the red letters on the black background on the download mode screen pretty much letting me know it failed.. The interesting thing is that using this box to do this makes the phone think it's upgrading and I never lose any of my settings if it fails I just hold the power and volume down button until it reboots and when it does it goes right to the upgrade failed download mode and all I have to do is flash whichever filed failed with one that'll pass and then it just reboots to android is upgrading and then right back to my home screen with all my settings still there which is cool because I was getting tired of factory resetting all the time before I had this flashing box.
[AT&T Samsung Galaxy Note5] droidvoider:
So I've got the answer now guys, well most of it. The recovery/boot/bootloader are all signed (maybe even as simple as this publicert.pem file I'm staring at)... But, that doesn't even matter because we are extracting the boot.img signature and all! I can make changes in human readable format, such as editing default.prop or altering init.rc. Then I can pack it all back up "completely signed" and feed it to my phone!!

Samsung made if difficult but not impossible. I am not convinced I can create kernel in a reasonable time frame alone. (Mostly I'm terrified to boot with a modified kernel without taking a really close look at stuff).. But I know in my heart of hearts it is this simple. I got the keys to my phone from my phone.

Edit: I confirmed that I can NOT flash sboot.bin from the previous version using heimdall, same ol Binary 4, Device 3. I still own the kernel though
[AT&T Samsung Galaxy Note5] droidvoider:
If anyone still needs a kernel I need to know which version and I will compile it for you. I only have sources for OJ1 = original release Lolipop, OGG = Lolipop later release and PE6 one of the earlier releases of Marshmallow. We can likely mix/match stuff by unpacking the kernels if you wish adding binaries, you have to dd it in or whatever (must have root right now). Pretty much anything I build you will be better than engineers kernel I would suspect.
[AT&T Samsung Galaxy Note5] JeSTeRH4CK3D:
I'll test anything MM.
[AT&T Samsung Galaxy Note5] droidvoider:
Jester which baseband version is your system.img? Why right? As far as I understand the secure storage binaries need to match and they are in the system.img, actually built on boot I believe. For example I am on PK1 and I can use the boot.img from PJ1 and it's the same secure storage binaries. But if I flash PE6 boot.img I get a rapid repetitive message regarding secure store binaries mismatch.

I am sidetracked slightly as I had a few questions about how to compile a dirtycow hack tool. So I put up a how to do that. In addition I am committed to finishing this a dirtycow tool which checks to see if a list of files match, if not it replaces all of them. When that's all done it reloads init. (beginning of a root kit). I think if I get this type of a tool in the hands of our willing researchers we can get a lot farther. The hard thing is I need to keep lines of code to a minimum so it fits inside toolbox.c, dumpstate.c and etc. almost done i think
[AT&T Samsung Galaxy Note5] JeSTeRH4CK3D:
PHA
[AT&T Samsung Galaxy Note5] dezborders:
[MENTION=5254272]TechNyne66[/MENTION]. Have you looked at the leaked Nougat update yet?

Someone asked if it was the official release or a leaked test build... that got me to wondering if the sboot might be less locked down that on MM
[AT&T Samsung Galaxy Note5] TechNyne66:
Looks like an official for international models.
[AT&T Samsung Galaxy Note5] dezborders:
It's AT&T specific with bloatware ... What do you mean by international ?
[AT&T Samsung Galaxy Note5] droidvoider:
SM-N920I which boils down to not you yet
[AT&T Samsung Galaxy Note5] shaftmeister:
Do not use with newer n920a

This process bricked my phone.

Thankfully xda forums are the best and i found a guide to unbrick it.

If needing info let me know will let you know how.

No disrespect to poster :)
[AT&T Samsung Galaxy Note5] jxlee0215:
is there a way to reboot without pc. last time my phone ran out of battery, and after i charged i couldn't get pass the boot logo. hence my phone was useless till i got home on the pc
[AT&T Samsung Galaxy Note5] TechNyne66:
No this is the big issue we can't overcome.
[AT&T Samsung Galaxy Note5] Nektopoli:
I'm on an AT&T branded Note 5 [SM-N920A](N920A UCS3BPH4).

Am I currently out of luck when it comes to rooting, installing TWRP and flashing 7.1 ?

Phone is stock except for being carrier unlocked, I'm on T-Mobile.

NP
[AT&T Samsung Galaxy Note5] Imperialized:
Anyone else having this issue? I even cleared cache and factory reset. All files (and some additional Odin attempts have failed.

Here is SS:

[IMG="https://i.imgur.com/2Yaj4Tk.png"]https://i.imgur.com/2Yaj4Tk.png[/IMG]
[AT&T Samsung Galaxy Note5] droidvoider:
Delgoth I believe is on PH4?? he has limited root? Check out some of his posts. Just so you know it doesn't matter which carrier you are with currently you still have an AT&T Note 5. If it is possible to have your phone flashed to T-Mobile it would only be possible through T-Mobile. I doubt that their keys will work with the AT&T model, but it is conceivable they have a master unlock.

Your results can be achieved in so many ways.. The first that comes to mind is you are trying to downgrade to a lower binary firmware version. In fact, I believe, we are all having this problem and it is one of the things I am working to conquer. (that along with actual root) and I feel like I am close now.