yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note5] Delgoth:
Well then on Binary 4, my best bet to you is:

Step.1) Flash this Boot.img through the AP Slot in ODIN and tell me if you have ADB Root shell after you boot up: https://drive.google.com/open?id=1wQSwJWsDfDlaKPEfmZZWPhQdxjTqb4Nc

Someone purchased it online, it looks legit like it could be the MM Eng Kernel for this device. But it won't boot on a Binary 3 Device. And it might not boot without the Factory Combination Firmware installed as well.

Step.2) You can Install the binary 4 combination file "4APL1": https://drive.google.com/open?id=0B4PoJYLnmv1BZG83UHJBbF9Ua00 , In order to downgrade back to Lollipop. In which you can then root Lollipop.

I'd really like to know if that ENG boot.img is legit. The Binary 3 ENG Kernel is LP based. Serves to reason the Binary 4 ENG Kernel would be MM.

That is, if it isn't the combination firmware kernel in disguise.
[AT&T Samsung Galaxy Note5] JELASCO:
Step.1) doesnt work.
Stuck at the startup!!!

Step.2)I dont know yet but If is that possible to downgrade 5.1.1 and then upgrade to 6.0.1 without losing root?!! I will try because I found something might be useful..
[AT&T Samsung Galaxy Note5] Delgoth:
Where did you find all that?
[AT&T Samsung Galaxy Note5] JELASCO:
My phone was rooted and has multilanguage in it(Before) So I did a little search but there is not much on google just find these. hope its gonna help. i dont know how to adb. gonna upload and share those files here asap.

I dont have time to upload but I found the link. and I also did search about adb tried to download but I got signature fail.

LINKS:

SM-N920A 6.0.1 : https://goo.gl/gSeosh (I dont know why it says arabic but must be multilanguage and root)

ADB: https://goo.gl/PTXTW3 (Change with this)

.
[AT&T Samsung Galaxy Note5] Delgoth:
Does either of these have the "crootungkick" file in them? The first link you gave seems to be a 3GB firmware. It doesn't seem like all the files you had in the screenshot are included.
[AT&T Samsung Galaxy Note5] jdurbins3:
Hey Delgoth,

I have baseband version N920AUCS4EQL1

Build number:NRD90M.N920AUCS4EQL1

Pretty recent security patch, December 7, 2017.

Any chance of rooting this? I don't care about downgrading OS versions to 5.1.1 or 6.0.1 Don't care about teathered or unteathered, or even tripping KNOX. Can any of you guys point me in the right direction? Would never have got this phone if I realized it would be so hard/impossible to root.

Thanks in advance.
[AT&T Samsung Galaxy Note5] 3laccheart:
Custom binary

Please help! On Binary 4 I have flashed back to 6.0.1 through Odin then went to combination cpl1 and am now stuck. I've even tether root on custom binary but What fIle can I use to have fully functional 5.1.1? I will settle for lag and tether root as long as I can do away with this contact ATT message that won't allow me to Hotspot because i have cricket sim. Any assistance would be massively appreciated.
[AT&T Samsung Galaxy Note5] Badbrane:
I just figured this out myself a few days ago and just recently made a how to. Here is a Link https://xdaforums.com/att-galaxy-note5/general/att-note-5-native-tether-hotspot-root-6-t3737394 Native hotspot and tethering for att phone. im using straight talk, so im assuming it will work for cricket as well. hope it helps
[AT&T Samsung Galaxy Note5] Delgoth:
I've heard of someone using both KingoRoot and Wondershare Mobile Go to root 5.1.1 (WS Mobile Go has been reported to do a tethered root on 6.0.1). I've also heard that you can install a rooted system image overtop of the Binary Combination Firmware system.

Basically, with the Factory Binary Firmware you should be able to flash any 5.1.1 system image for the device when using the Combination Kernel. It has DM-Verity disabled for a lot of it, so you can mix and match pieces of firmware to a degree.

Message [MENTION=3962799]lownslow200sx[/MENTION] he is the Bootloader v4 guy (Binary 4). All my work was on a Binary 3 device.
[AT&T Samsung Galaxy Note5] Delgoth:
Check my post at the top of this page Post #31, it should have the link for the first firmware needed. After that see the post above this one.
[AT&T Samsung Galaxy Note5] NeroDrakovich:
Binary 2

I've been following the status of this phone for a while now waiting for a usable, everyday root. It seems like you have found a way to finally do that, so thank you for your hard work. Before I attempt anything, I'd like to ask for instructions for my specific model while you're still offering advice. My build number is MMB29K.N920AUCU2BPE6. You said earlier that Binary versions 1 and 2 have always been able to attain the untethered root, and I assume the Binary 3 instructions are the ones to use, but I would simply like some confirmation. If the instructions are already written out entirely for my version, please point me to them. Thank you again, Delgoth.
[AT&T Samsung Galaxy Note5] jdurbins3:
Well, I flashed the combination binary firmware, and was successful through ODIN, but it stalls out on the splash screen that just says FACTORY BINARY with the rotating gears. I tried then flashing a 5.1.1 build but get the error SW REV CHECK FAIL Device: 4 Binary: 1. Did I get the wrong 5.1.1 firmware? I'm assuming the combination binary also should boot up past the splash screen correct? Tried multiple times with the same result...
[AT&T Samsung Galaxy Note5] Delgoth:
No the factory binary just takes a long time to boot up on the initial boot.

I normally flash it with the options to, Repartition and Nand Erase All, checked in ODIN. When I flash this firmware. Just to make sure the device is wiped clean before starting. Since the factory binary doesn't have a user enterable recovery mode.
[AT&T Samsung Galaxy Note5] Delgoth:
For binary 2 devices they've only ever had 5.1.1 installed max. You can root 5.1.1 using KingoRoot or Wondershare Mobile Go. And then I have this link to "SuperSuMe v6.7" from my google drive: https://drive.google.com/open?id=1Uv_JCvX0VWqXimOrbKtVe3_gq2zjFIqE

To be honest I've never really messed with a Binary 2 Device. Originally the problem with Bootloader v3 Devices, was that MM comes with Binary 3. At the time a year ago until I put the combination firmware out, this forum had no way to downgrade from MM back to LP in order to root their device. And most people were on the binary 3 updates. Nowadays everyone moved on to Nougat and I haven't found a real way to get the v4 Bootloader as rooted as the v3.

Because I found the ENG Sboot for Binary 3, which allows the end user to flash the binary 2 eng kernel and root untethered.

The reason why I haven't spelled out in simple directions how to root the device is because a lot of this is niche information. We need more people that understand what is going into rooting the device. I want people to ask more questions and find more answers.

Plus I no longer have a Note 5. Have all the work still. Just not the device. I haven't been able to continue working on ADB scripts.

With the Eng Kernel and Eng SBoot, it is possible to setup SuperSu via the command line. I was just never able to get it to work on the launcher's end of things.
[AT&T Samsung Galaxy Note5] jdurbins3:
I see. My problem was I never wiped the device. Once I did that, the combination firmware loaded up. However, I was still not able to downgrade to 5.1.1. Kept getting that binary version error, no matter what LL build I flashed. I ended up flashing the PK1 firmware so I have a stable, working 6.0.1 build now, but still would like to get to LL. Is there any Lolipop firmware that would work with binary 4? Should I be able to downgrade to lolipop regardless of the binary version if I have the combination firmware installed first?

Sorry if these are all noob questions, Ive never dived much into rooting this much, with the exception of one-click root style programs. But Im trying to learn and absorb all that I can. Its fascinating to me.

Thanks again for doing all of this. Your knowledge on this subject is invaluble.
[AT&T Samsung Galaxy Note5] Delgoth:
With the full factory binary loaded up, you should be able to flash just the AP file from a stock LP firmware. Does that work?
[AT&T Samsung Galaxy Note5] jdurbins3:
Unfortunately it is still not working. I loaded up the combination binary, loaded AUCS4_ENG BOOT, both through the AP slot in ODIN. I attempted to flash both OGG and OJ1 builds at separate times. Tried flashing the entire OS with all 4 files, and alternatively just the AP file. The operation fails and my phone displays SYSTEM REV. CHECK FAIL. DEVICE:1 BINARY:0. Not sure if I'm doing something wrong or this is another snag. This is attempting to downgrade from PK1 firmware on binary 4. Any other insight?
[AT&T Samsung Galaxy Note5] Badbrane:
my experience is the same anything below binary 4 shows an error except

COMBINATION_FA51_N920AUCU4APL1_CL6053901_QB1181668 6_REV00_user_mid_noship and N920AUCE2APB2.tar still testing for other files that work.
[AT&T Samsung Galaxy Note5] Delgoth:
Right there you should be able to use ADB Root if you can flash the PB2 ENG Kernel and that combination firmware.

Once on Binary 4 you will not be able to flash a full firmware package if it is Binary 3 or lower. That is why Flashing the full firmware always fails.

That's crazy. Does it always fail and say Device:1? In that instance you're device thinks it is still on Binary 1. If you're device says 1 like that. I'd try and flash a Binary 1 Firmware really.

I haven't tested the UCS4_ENGBoot. I don't know if it is a nougat kernel, a lollipop kernel, or a marshmallow kernel. So that could lead to failed flashes if you don't have the right system image installed and bootloader.

You can root the binary 4 combination file with something like kingoroot. It is not ideal BUT, then you'd be able to install Flashfire.

You could use Flashfire to flash over a stock system image, or a pre rooted system image for Lollipop.
[AT&T Samsung Galaxy Note5] Badbrane:
I will have to look into that myself. Im pretty content just having native hotspot and tethering on this att lockLoader, im on straight talk atm. Also ive been able to upgrade to nougat and keep hotspot, with a few minor bugs here and there. I'll keep in contact if i gain any leeway. Thanks for the tip on flashfire, going to try a few more things in the next couple of days.
[AT&T Samsung Galaxy Note5] gmlai:
Hi Delgoth, I've just done your first 15 steps.

My N920A moved from android 7 (N920AUCS4EQD1) to 5.1.1.

Do you need me to try step 16?
[AT&T Samsung Galaxy Note5] Romain_89:
Hi [MENTION=3254678]Delgoth[/MENTION], I'm on N920AUCS4EQF1, your test work for it ?
[AT&T Samsung Galaxy Note5] Delgoth:
So now that you're on 5.1.1, did you flash the UCS4 eng file then? That means that eng boot is really a boot.img for android 5.1.1.

Did you try and open an ADB shell after you took the screenshot on 5.1.1? Was it root or user shell?

Did you notice how you have a permissive selinux build now? That means it should be a piece of cake to root the device on 4APL1 with that setup.

Make sure to quote or mention me please.
[AT&T Samsung Galaxy Note5] gmlai:
Yes, I did.

Look at my PC screenshot.

I don't know how to verify :(

I need step-by-step directions.
[AT&T Samsung Galaxy Note5] Delgoth:
To verify, look back at the 2 screenshots you posted from the about device menu. The one from 5.1.1 you will see where it says towards the bottom that SELinux is running in permissive mode.

Lol. You already verified previously. No worries there. I have a test Im going to write up and post sometime today. I also have to paint my bedroom today. So bare with me a little.

But I have an idea for using flashfire on the 4APL1 combination firmware to get untethered root. Let me write up some instructions. I think it will work though.

EDIT:

1. Just to be clear. gmlai stated they flashed the file I hosted labeled, UCS4_ENG BOOT.tar

2. Gmlai also stated that particular boot.img file booted up with the Binary 4 Combination Firmware.

3. This means that ucs4_eng boot IS NOT A TRUE ENG KERNEL, and is also a Lollipop Kernel. So it won't boot with MM or Nougat builds.

4. Currently the file seems to be confirmed as merely being the same boot.img that ships with the 4APL1 combination firmware.

5. This file will still be needed however when performing the second test I am writing up.

6. Thank you for your efforts in testing. I may not have the device anymore, but I want to help still. I have seen pictures of what I'm writing up, it worked then, so it should still work now.

7. I haven't gotten root to work past the command line on 6.0.1 builds. Never tried Nougat last year. But I've gotten 5.1.1 on the N920A fully rooted untethered with the v3 bootloader. And I've seen it done for the v4 bootloader, I just have to get the directions right from the explanation I was given.

8. Full root is still available only for 5.1.1 builds as far as I'm aware. Unless someone is kind enough to spend some favors to acquire the actual eng builds or high debug level factory binaries.

*******

EDIT OF THE EDIT: Im trying to get the steps written, but I need to figure out which system.img to use in the test. I dont want something bad to happen because I just picked a build and rolled with it willy nilly. Im sorry Its not posted yet.
[AT&T Samsung Galaxy Note5] gmlai:
Here I am, on binary 4.

I tried to root via Kingoroot APK and failed. Then I tried via Kingoroot from PC and succeeded, but if I reboot I'll lose root.

Unfortunately , FlashFire only works with either SuperSU, Magisk or CM SU.

I am now trying to replace Kingo with SuperSU...
[AT&T Samsung Galaxy Note5] Delgoth:
I think this may be why [MENTION=3962799]lownslow200sx[/MENTION] preferred to use Wondershare MobileGo. He showed me screenshots of 5.1.1 being rooted. He said his device can reboot as normal while maintaining root.

SuperSUme is supposed to work fantastic at replacing Kingo with SuperSU. I was also informed that Wondershare MobileGo can do a tethered full root on Binary 4 6.0.1 builds.

Now that I'm awake and I have the morning free. I'm going to work on adding some details, screenshots, and further insights to Test #2. I didn't get it finished the way I wanted to post it last night. Give me a couple hours and I should have some more meat.
[AT&T Samsung Galaxy Note5] gmlai:
SuperSUme does not work :(

Wondwrshare Mobile Go is the way, it works and is very fast :) :good:

My FlashFire works now...

---------- Post added at 02:39 PM ---------- Previous post was at 02:30 PM ----------

There isn't a "system.img" but a "system" folder into the Rapture ROM (zip file).
[AT&T Samsung Galaxy Note5] Delgoth:
The Pro Version is probably necessary then, which does indeed suck.

But AWESOME! MobileGo is the way to go then! I will change the instructions when I edit them in a few. But can you post a screenshot of the contents of the rom zip folder please!? [MENTION=371913]gmlai[/MENTION] you're doing great so far keep it up please! These are the kind of responses I need.
[AT&T Samsung Galaxy Note5] gmlai:
Here are the screenshots of the zip...
[AT&T Samsung Galaxy Note5] Delgoth:
Woop. Thanks. I'm almost done editing my post.
[AT&T Samsung Galaxy Note5] gmlai:
I don't want to bother you, but I'm curious...

What does imply this? Can I flash this ROM and root it? And then upgrade firmware via FlashFire while keeping root?

I'm not going to experiment myself as I'm waiting to give you feedback about test you're thinking of... :)

Thanks a lot my friend
[AT&T Samsung Galaxy Note5] Delgoth:
Dude, you are Not bothering me. But....

4CQB2 is a Nougat Build. To root that build with all official software would require an exploit of some kind. The recovery image present in that download does indeed seem to disable the DM-Verity Check that prevents booting. All I know about it personally, is that lownslow200sx used it when he flashed a TMO Modem to his N920A and broke his Device Root Key. It allowed his device to boot up so that he could restore an EFS backup he had made while rooted before.

Which is why once you get FlashFire running you should totally backup the whole thing up just in case. But lownslow200sx and myself feel something is different about it. As if it's the recovery image from a Combination File. What all it will allow to do be done with Nougat builds, is still to be researched and tested. Try out somethings if ya want.

Test #1 and Test #2 are updated now. Screenshots Added. Let me know what happens.

EDIT: [MENTION=371913]gmlai[/MENTION] as far as Implications about it go though, it is interesting that the DRK error popped up after flashing a modem from another carrier. As if to prove I was correct when I said the Radio was the first thing that boots when the device is powered on. Which means I might be right as well about how the modem/baseband plays a main role in the root-ability of this device.

* I seem to remember reading about how Samsung Manufactures the Motherboards, and then ships them to Qualcomm to install the Radio Hardware & Firmware. Qualcomm ships them back, and THEN Samsung loads its Firmware into the internal memory. The Baseband used to be what allowed/disallowed root back in the early days of the Galaxy S lineup often times.

** This makes me think that The Radio Firmware is the only part of the device that is truly persistent. I've heard of people having DRK errors before, but they never explained how it really got that way in the first place. So apparently the Modem Firmware is heavily tied to Device Root Key. The Radio user also has its own OS and memory location.

*** Considering the Galaxy S7 and S8 have universal modem hardware (World Phones), but the Galaxy S6 line devices/variants, including the Note5, each have different radio hardware installed. Makes me think Qualcomm has full control over the Radio Chip, Samsung has none or very little, and that the Cell Processor firmware is at least 50% responsible for locking the device. I might be way off there, but I still feel I'm at least in the ball park.
[AT&T Samsung Galaxy Note5] gmlai:
My first try was unsuccessfully :(

I soft bricked my Note so had to restart from test 1 and now I've just rooted it (step 5 of test 2).

I tried to flash the Rapture ROM zip using FlashFire as-it-is using option "Flash ZIP or OTA" and restore backup (I choosed Fastboot type). I only got a black screen and the notification led on.

I will try later as I have to understand how to use FlashFire and if I have to repack the zip first. See you soon :)
[AT&T Samsung Galaxy Note5] Delgoth:
I will look into Flashfire some more as well. There are a lot of ways to use Flashfire. I've asked lownslow200sx to put his two cents in here, since he was the one that got this to work. Those screenshots I attached to test#2 are screenshots he sent me.

EDIT:

1. I feel it might be necessary to turn off the "preserve recovery" option that is listed in the reboot action that comes with flashing a zip/ota. It says to use that if you have a custom recovery, which we don't have. So that option won't do anything. And having the device possibly replace the stock combination recovery with itself is totally acceptable I feel.

2. The "mount /system read/write" option for flashing a zip/ota, does seem necessary because we are trying to replace the contents of /system.

3. According to Flashfire, if you are flashing a custom firmware, you should add a wipe action before the flash zip action. I think technically the rapture rom counts as custom firmware. The default wipe action will wipe /system, 3rd party apps, and dalvik cache. I'm assuming by its description, that 3rd Party Apps refers simply to /data

4. In the wipe action, "dalvik cache" more than likely needs wiped before the device can boot. Since you're switching system apps entirely in some cases. "System" could stand to be wiped as well I feel, because otherwise there will remnants of the factory binary leftover that could cause the device not to boot. Service Mode apps and the like that only work with the full combination firmware.

5. But I'm not sure if the 3rd party apps option will completely wipe /data or not. Like Flashfire says, not wiping it may allow you to boot without losing any apps, or wiping it may ensure your device doesnt boot. Its a 50/50 either way depending on the start and end conditions according to the description.

[MENTION=371913]gmlai[/MENTION] I will go look around at other people's use of Flashfire and see what else I can find. These observations here are just based on what we are trying to do in the first place.
[AT&T Samsung Galaxy Note5] gmlai:
I tryied changing all sensible options with no luck :(

I can't think of a way to succeed.
[AT&T Samsung Galaxy Note5] Delgoth:
Did you try without wiping 3rd party apps with all other options?

And what happens if you don't restore the boot.img? Technically iB4STiD states his rom comes with no kernel, and that flashing his rom zip shouldn't need boot.img to be restored. Reading his OP in his thread.

Although what if it is the boot partition that needs backed up and restored. Not the boot.img itself.

I'm almost starting to think something else amiss entirely now. As if it is not the method at all.

It would be nice to have [MENTION=3962799]lownslow200sx[/MENTION] chime in. But he said he put his N920T motherboard back into his device. We would have to change it back out to the N920A board before he could test it again. We will see and I will keep looking.
[AT&T Samsung Galaxy Note5] gmlai:
I tryed both ways and got the same result.

I have to try this one.

Another try could be to flash only the boot.img via Odin, but I don't know how to.
[AT&T Samsung Galaxy Note5] Delgoth:
I think one of the easiest ways to make an ODIN flashable tar file for just the boot.img would be to make a copy of the 4APL1 firmware tar file, and in the copy, delete all the files from it except for boot.img

You can then flash that tar in the AP slot of ODIN.

Or you can read this guide here by rwilco12 to learn how to make an ODIN tar from scratch.

Based on the way that guide is written, I wonder what using the Flash Firmware option would do in FlashFire versus using the Flash Zip/OTA option.
[AT&T Samsung Galaxy Note5] Romain_89:
Hi, I make operations in test 1 and 2 but I'm stuck on Factory Binary mod. When I flash the Rapture Rom with Flash fire it's stuck on "installing rom". Any solution ?

EDIT : Finally the rom has been installed but now I've the "User Fault Not Kernel Panic" Screen
[AT&T Samsung Galaxy Note5] Delgoth:
What options did you use in order to flash the rom and make it go through? Is it the same error screen as gmlai posted screenshot of?
[AT&T Samsung Galaxy Note5] Romain_89:
I select "Flash ZIP or OTA" with options "Mount /system read/write" and Wipe System data, 3rd party apps, Dalvik cache and Keep internal storage exclude. My phone reboot after the installation on the screen "User Fault not Kernel Panic" it's similar as gmlai but a little different.

EDIT : I succeeded to get the screen "Forced Upload by Key Pressing" and there is a message in yellow "Please uncheck Auto Reset option of RDX! !" but there isn't this option in the combination file.
[AT&T Samsung Galaxy Note5] tivo559:
[/IMG]So the 1st step works
[AT&T Samsung Galaxy Note5] Romain_89:
Yes but I can't use my device normally in Factory Binary mode
[AT&T Samsung Galaxy Note5] tivo559:
ibb. co/ i5HHGH

ibb. co/ jg6PVc

---------- Post added at 08:25 PM ---------- Previous post was at 08:18 PM ----------

Ya I had that issue too so I used recovery img to got to 6.0.1
[AT&T Samsung Galaxy Note5] Romain_89:
Wich recovery img do you use ?
[AT&T Samsung Galaxy Note5] tivo559:
N920AUCS4CQB2 I found on this thread or related one pm me and I can link to drive
[AT&T Samsung Galaxy Note5] Romain_89:
Pm send thanks
[AT&T Samsung Galaxy Note5] tivo559:
Did you get link
[AT&T Samsung Galaxy Note5] Romain_89:
Yes thanks
[AT&T Samsung Galaxy Note5] gmlai:
Hello tivo559, I am glad to read you went on. Please, tell me...

1) Did you use the the 4CQB2 ROM from post #51?

2) Can you write down step-by-step directions?