yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note5] Delgoth:
Well Post # 57, was supposed to be testing how to install a pre rooted system. So maybe an action for wiping systemless root is need while flashing.

But in Post #57 we were flashing a TMobile ROM that was supposed to be able to work. Have you tried flashing an AT&T 5.1.1 System image with FlashFire overtop of the 4APL1 firmware?

Because once you complete all the steps from Post #51, you will have a device that if normally rooted and you will have access to the whole system. How you want to customize it from there is technically up to you. Being on Factory Mode, you can actually use the Secret Codes from the dialer menu on the Factory Binary. So you can enter service mode and setup the network connection if it doesn't work. You can change a lot of settings in that build.
[AT&T Samsung Galaxy Note5] tivo559:
I followed delgoths instruction 1 thru 15 got to 5.1.1 factory Binary but forgot to grab a 5.1.1 ROM so I used odin to flash 4CQB2

Yes it should be. i have the link still it was a androidfilehost site but I got to everything thru delgoths posts on here

Edit https://xdaforums.com/att-galaxy-no...-firmware-n920aucs4cqb2-t3581129/post71641604 I found it here

---------- Post added at 12:26 PM ---------- Previous post was at 12:19 PM ----------

No i havent i forgot to grab a rom before i tried got a little too excited at thought of root access and jumped the gun

Ya I figured I could run used codes but my phone is only Internet source currently and didn't have or know any codes but now I know that I'm going to play around a bit later and see what I can do or if I can get a custom ROM put on

I tried rooting using wondershare mobile go but it failed every time

Edit would I need to flash a 5.1.1 stock img before trying to root or can I sideload flashfire and root (not sure if FF would work since needing root access)

---------- Post added at 12:38 PM ---------- Previous post was at 12:26 PM ----------

Is this essentially what I need to do use kinoroot to get factory Binary rooted so I can us FF to flash a pre rooted 5.1.1
[AT&T Samsung Galaxy Note5] Delgoth:
Need to use Wondershare MobileGO
[AT&T Samsung Galaxy Note5] tivo559:
I tried when on FB but it didnt work it failed everytime
[AT&T Samsung Galaxy Note5] tivo559:
At&t says root is possible
[AT&T Samsung Galaxy Note5] Delgoth:
But how did it fail? Did you follow the steps of Post #51 exactly? gmlai said he was able to complete all the steps and root his device on the Factory Binary multiple times. So I'm kind of lost as to why it would fail for you.
[AT&T Samsung Galaxy Note5] tivo559:
Cuz I messed up and missed a step i noticed after I reread everything about to try again so I'll update in a few hours
[AT&T Samsung Galaxy Note5] tivo559:
Hey gmlai how did you get wondershare mobile go to root i keep trying on the factory binary 5.1.1 but it always says failed? Am i supposed to be in dl mode or not i tried both but device doesnt link in dl mode
[AT&T Samsung Galaxy Note5] gmlai:
Hi, did you follow instructions from test 2?

Nice, keep you device on, do not go to download mode!
[AT&T Samsung Galaxy Note5] tivo559:
Pp
[AT&T Samsung Galaxy Note5] Delgoth:
After some more looking around for a relevant similar method. I believe what needs done for those that updated past the 3BPH4 firmware, is to translate the method used

HERE

to root the SM-G900A using the "new method" updated 03-04-2017.

The S5's factory binary is based on KitKat and uses TowelRoot to obtain root, which we already know will not work on LP or newer firmware. But we already have found a tool that will indeed root the device on the LP based combination. So that part is good as long as MobileGo installs su binaries as expected. But taking a look at their "old method", they use install KingoRoot & KingRoot even though the tools will fail at rooting. This is because, letting the apps fail their process still installs the needed su binaries for the process to work. So there is some merit to those steps.

** The point to take away here is that in the "new method", the combination firmware was flashed. The Combination firmware was then rooted. Then a custom rooted stock rom was made [I've never seen "no-ship" firmware that wasn't a Factory Binary or Eng Binary], and flashed using Flashfire on the combination firmware.

** The method described in the above linked thread is almost identical to what I was trying to get at in my "Test#2". I just don't know how the firmware is to be modified and put together. Or if the Combination File needs modified before flashing & rooting in order to allow the Flashfire Actions to work when flashing a stock system on the Note 5.

EDIT: I just realized, in my instructions for test #2, I never specified to install SuperSu from the playstore, after rooting/finishing test#1, in order to get Flashfire working correctly. Ive edited those instructions. While FF may operate with MobileGO's root. FF was designed for use with SuperSu specifically. Does this change anyone's results?

EDIT2, instead of double posting

So yeah I'm back on this after a couple days. I had errands today so I lost a few hours. But I have a couple decent size files to download, and my net speed is not always the most consistent. I got about 2 to 2.5GB to download and I can think I can finagle the modifications to the combination firmware to make it more, "non service mode".

Instead of flashing a T-Mobile Rom, we are going to use an AT&T rom this time.

Give me some time to download the files.
[AT&T Samsung Galaxy Note5] gmlai:
Hi Delgoth. I'm happy to hear from you again :)
[AT&T Samsung Galaxy Note5] Delgoth:
Oh I'm still here. Prolly can't leave, and that's not a bad thing :D

This rabbit hole keeps getting a little deeper, day by day. It is looking like I might need to recompile some things in order to do what I really wanted. The thread I posted above does show steps on the order of operations on how to flash using FlashFire. The whole method is the same, but with different firmware files. Our firmware being used are not quite so synergistic as the G900A.

Once I get the Factory Binary unpacked, I can look it over and see what might fit together. But the firmware is proof that 5.1.1 can be compiled to run on the v4 Bootloader. If dirtycow was applicable here, I would have a huge head start. But I have ideas about how to get the same results without dirtycow since the Combination Firmware is SE Permissive.
[AT&T Samsung Galaxy Note5] tivo559:
I have been messing around and can root phone fully using dr.fone from wondershare which installed SU but cant flash the rapture mod and get it to work other than FB i tried many times different ways and sucessfully achieved root each time so if i cam find a binaey 4 version of 5.1.1 (if it exists) i think itd fully work. also the xposed framework files didnt work for the att note 5 when i tried to flash either
[AT&T Samsung Galaxy Note5] Delgoth:
I think I've decided flashing the whole Rapture ROM will not work, unmodified. And I haven't tried figuring out how to modify the flashable zip yet.

To get some information about this Dr. Fone Program though, and the SU binary it installs to your phone, can you install Terminal Emulator or Termux.

Once installed, can you navigate to the folder where SU is installed to, hopefully "/system/bin" or "/system/xbin", I don't know if Dr.Fone or MobileGo installs System or Systemless Root. And then get the help/usage text for the binary.

I would love to know if those programs actually install Chainfire's SuperSU binary, or just a standard SU binary compiled for ARM Linux. This actually makes a big difference, at least in my eyes. Because SuperSU is not standard Linux SU. Both may allow you to use a Command Line Interface to run commands in the context of Root, but CF's SuperSU is customized to a degree we don't understand, and will never be told about. Linux SU, is what allowed the Galaxy S8 to be rooted in the ENG firmware. Because I highly doubt Samsung used Chainfire's version of SU in their engineering firmware.

While SuperSU gives us most of the Root ability we've come to know in Android. It only works in contexts he programmed it to. And it only works as a daemon anymore. And the daemon requirement is what restricts A LOT of devices from using it in the first place. At least in the cases of locked down devices such as the N920A. Chainfire's SuperSu is great and all. But SuperSU is NOT what gave me my initial CLI root in the "su" context on the 3APH1 Combination Firmware.

I still have a feeling those programs are using some version of SuperSu however. It's just that getting SuperSu by CF to work, takes a lot of modifications to the Android system to get working initially. The SU binary I had on the v3 Bootloader gave an unstable root terminal without any setup whatsoever. Just as they explained in the process of Rooting the Galaxy S8. I wish I had their help when I started this project. I was in their situation almost a year before it happened to the SamPWND team. But nobody believed me because I'm still not as known as a lot of others around here. And now the v3 Bootloader is obsolete for most users. So is DirtyCow.

EDIT: I'm working on a way to modify the 4APL1 firmware in order to make it, Less, Factory Binary, and More, Stock Samsung. Because you are correct, there are no 5.1.1 builds for the v4 Bootloader.
[AT&T Samsung Galaxy Note5] gmlai:
Hello Delgoth, after some time on a MM stock rom, today I flashed the Combination ROM again. Then I rooted the Note with MobileGo.

Well, MobileGo installs Chainfire's SuperSU v2.78. I can not update it from store, as it isn't intalled, but only by downloading the last apk.

I flashed Raputure again with FF, but no luck.

What if I flash, over the Combination, a LP stock ROM using Odin without the BL part?

EDIT

Well, I got an error (se attached immage).
[AT&T Samsung Galaxy Note5] Delgoth:
That would be due to the system.img in the LP Stock rom, I'm so surprised though that you're device is saying Device 1:Binary 0 however. That is the not the error message I used to get when flashing a Binary 2 Rom over a Binary 3. I wonder if it checking the aboot. Or the exynos equivalent of. Maybe not, but it does not seem to be checking the same flags as before. I would always get Binary 2: Device 3 because I currently had a binary 3 firmware installed and was trying to flash a binary 2. That error message is unique, at least to me.

Can you flash the userdata.img from the LP Stock ROM successfully? We are going to have to edit the system.img of the combination firmware in order to add things from the Stock Rom I believe.

The userdata.img is not included with the combination firmware, and I think that may work fine.

Really, we want nothing from the LP Stock except the system apps, and other apps that come along with it. Because the Combination Firmware should allow for cellular service, and if it ill-configured for your network, the service mode menu is available to configure the network. The modem that comes with the combination firmware should also be carrier unlocked for GSM networks as well. It's just that the factory binary contains nothing from the stock experience otherwise really.
[AT&T Samsung Galaxy Note5] gmlai:
I would try but I don't know where to find the userdata.img (the stock ROM is made by only 4 files: BL, AP, CP and CSC ).

Anyway, how should I flash the userdata.img? (Odin, FF).

Yesterday I tried another experiment: I flashed a MM stock ROM over the Combination with Odin, using only the BL and AP parts, leaving out CP (modem) and CSC (configurations/restrictions for the ATT network).

Well, I got a working device with full bands access (apparently): GSM, 3G and LTE. One drawback: dialer (secret) codes do not work.

EDIT

Found userdata.img into the AP file of MM roms.

APs of LP only contain boot.img, recovery.img and system.img.

So I made a tar with only the system.img and flashed it.

I got the same error as in post #99
[AT&T Samsung Galaxy Note5] Delgoth:
Yeah the modem from the combination firmware is unlocked, you should be able to take you device anywhere with it. As for the userdata.img, that was my bad it's been awhile since I've had a Note5 and I guess it is showing now. That's why I need help doing this stuff. I remember [MENTION=7945178]droidvoider[/MENTION] having a great deal of success using different userdata images when he was working also working on the MM root method.

The dialer codes usable before are enabled from the system apps present on the combination firmware. That is my best guess as to why. I noticed that too.

As for editing the system.img of the combination firmware though, since that rom can be rooted, I think it should be possible to actually copy over the system apps directly to "/system". Basically running the system partition from both a stock and the combination rom. I guess in LP the /data partition is not populated until the initial boot process.

Maybe I should gather all the PM's I have between droidvoider and myself on the progress made by him on MM, and post them. Maybe someone will have some bright ideas then. Since we have the recovery.img that bypasses dm-verity on MM, the only thing stuck is sepolicy. And I'm no expert on that.

Here is the thread on using Dirtycow to root MM. https://xdaforums.com/android/help/injecting-root-setting-selinux-stages-t3573036

There is a lot of great information there, that probably applies in part to LP as well. I will gather the PM's and see what we can do. Because as it stands without a device of my own, my best suggestion is to use the rooted combination firmware and copy over as much of the stock LP files as we can fit in the partitions to see what will boot and what won't. It will be a lot of trial and error. The next best bet is to start where droidvoider & I left off with the Greyhat Root Console. Because the console was used by another project to root 32bit phones completely. But we are working on a 64bit device.
[AT&T Samsung Galaxy Note5] JELASCO:
Yes. I dont know if you already downloaded and check but it was in those zip files.
[AT&T Samsung Galaxy Note5] Delgoth:
My home internet is kinda slower. So a 3GB file might take me like overnight or something. I've been looking for the crootungkick & tungkick root files for awhile. Just to even see what they were. I had an archive of the tungkick root files. But it was password protected and no one could give me a password on it. I'm not willing to invest the time and effort to break that password down either.

I'd be happy to hear if anyone has successfully gotten the Greyhat Root Console to work on their unrooted device running the Binary 4 Combination Firmware, and what, if any, errors showed up. It'd have to be compiled for 5.1.1 instead of 6.0.1, but the instructions are included.
[AT&T Samsung Galaxy Note5] JELASCO:
I have a lot of time but dont have that much knowledge to play with codes. already tried. not worked for me. When reboot the phone it stucks on Note 5 screen. I will upload the file for you in afew hours! :good:

Here you go:

Crootungkick https://www.dropbox.com/s/u06pcd04tpzhnx7/crootungkick.tar?dl=0
[AT&T Samsung Galaxy Note5] droidvoider:
Hey guys I am back able to work on the Note 5 again but it will be a few days while I get back moving again. I will first play with the combination files to see if I can clearly document a step by step to obtain a rooted 5.11 for those of us stuck on binary 4. If I can't do that I will hopefully document a process to debloat the PK1 Dec 2016 firmware.

Question:

Has anyone been able to upgrade to Nougat, baseband N920AUCS4EQL1, and then downgrade back down to Marshmallow, baseband N920AUCS4CPK1? I haven't worked on the Note 5 in ages but it seems like those are the same binary, i.e., you should be able to downgrade from Nougat using Odin.

Be advised!: There's a binary 5 now, please notice the bold text N920AUCS5ERA2_N920AATT5ERA2. I think it is unlikely that I can help you get any root functions if you go beyond binary 4.

...even though att.com says there isn't a binary 5 it appears their website is note updated.. https://www.att.com/devicehowto/tut...tep_KM1127994?make=Samsung&model=SamsungN920A
[AT&T Samsung Galaxy Note5] JELASCO:
I did...

My Baseband version: N920AUCS4CPK1

Build Number: NRD90M.N920AUCS4EQL1

So how did this guy get a new firmware then? :confused: https://xdaforums.com/att-galaxy-note5/general/nrd90m-n920aucs5era2-february-2-2018-t3744635

New version here: https://androidfilehost.com/?fid=818070582850493691
[AT&T Samsung Galaxy Note5] droidvoider:
I think the att.com website is not correctly updated but possibly the Note 5 isn't being automatically updated with binary 5 builds?? I don't know honestly, I would never take a binary 5 build because the first thing I read about with Note 5 and Nougat is the fast draining battery problem again. That's the problem, Samsung uses some of the best available hardware to build their devices but then loads them down with so much garbage you can't even realize it!! My personal phone is on PK1 but I downgrade to PJ1 boot.img then use dirtycow to disable apps (documented in this section)...

Anyway I wouldn't upgrade to binary 5 build or allow the AT&T auto updater update your phone to any version beyond NRD90M.N920AUCS4EQL1 if you are interested in root like power. If you are running a Nougat binary 4 I am betting they haven't fixed the problem where you can reinstall a system app from backup to cause it to fail such as the updater.. If I remember right updating is (com.ws.dm and com.sec.android.soagent)
[AT&T Samsung Galaxy Note5] droidvoider:
I just want to mention lowandslow200sx root method worked great! Thanks to Delgoth for documenting this method and personalizing it with his ideas!!! This is a lot of root based horsepower for those of us trying to take down dm verity / install twrp and get rid of this persistent bootloader + encrypted partition nightmare. Obviously after doing this my phone doesn't work as a phone any more. But I have super powers, see the attachment!! :D

I have only just begun playing with this much rooting power so I have literally tried nothing. I will report back if I get the phone to a new place not outlined by Delgoth. Thanks again buddy this is fun!!
[AT&T Samsung Galaxy Note5] woodntuliktano:
Amazing Work

After soft bricking my phone well over 30x in the last few days in various attempts to do my part and help find that missing file it needed or the possible booting configuration pattern for the T-Mobile Rapture Root I can finally say my N920A Bootloader V4 is finally rooted with this new ODIN Flash Method. I suggest no one make the simple mistake I did and leave ODIN open just cause the BL takes awhile to load in case you feel you might have to re-flash it like I did. My phone kept rebooting constantly during the root process once I attempted to use another MTP connection from Wondershare Mobile Go. Took me a little bit to realize it with my 20 Screens scattered everywhere from this project. One question though on the last part, does that many any time our phone reboots we have to initiate the one-click root for every time going forward? I'm new to the one-click method, working as Google Contractor and using your personal phone with their data access means I wasn't allowed to have Root access on my own device for security reasons so I haven't rooted a phone since my 4.4.3 Galaxy Note 3 a good couple years back. Either way I appreciate all the effort if that's the only thing I got to worry about.
[AT&T Samsung Galaxy Note5] droidvoider:
Yes for the latter root method Android 6.01 each time you reboot you have to use the one click root feature again because the phone rebuilds /system each time it boots. It does this no matter if there was a root attempt or not it is how the phone is designed to work so it isn't easy to bypass. Even with root I can't simply build a kernel because it will soft brick and tell you there's unauthorized software on the device. So I need access deep into the chain of trust. To understand this clearly please see this description Nitay Artenstein and Gilad Goldman.

This is a FUN read on reversing and traversing into the bootloader code

https://hexdetective.blogspot.com/2017/02/exploiting-android-s-boot-getting.html
[AT&T Samsung Galaxy Note5] woodntuliktano:
Thats disappointing.. It's moments like these that are making me steer away from getting another Samsung... I've had countless ones over the years and I always loved them cause they amazing abilities to customize and design something of your own in various ways but each one they put out they just keep making them closer and closer to Iphones which is what many of us wanted to avoid in the first place.. I'm still keeping faith I may finally receive my Saygus v2 I pre-ordered years ago as a start-up project.. some day..
[AT&T Samsung Galaxy Note5] tivo559:
My girl got a new phone as such i will ise her old note 4 as my phone and commit this note 5 to finding root i feel were so close as me and gmlai and others have rooted our devices but cant get a rom that works yet

---------- Post added at 03:09 PM ---------- Previous post was at 03:03 PM ----------

When i last rooted i install supersu from the official page not thru FF IDK if that makes difference (like if FF changes anything upon install) but i was able to get into device and read the build.prop and other files not normally accessible i stupidly didnt try to edit tho so not sure if truly rooted in that sense

Edir: ps also xposed didnt install for me either i tried the one you listed as well as one from the xposed xda but no luck so far
[AT&T Samsung Galaxy Note5] droidvoider:
Factory Binary root method is persistent SELinux Permissive root, but what's that mean?

So far small experiments I have tried have proven that the chain of trust is still in tact even using the Factory Binary method on post 51. I can not alter the kernel (i.e. no flashing of unsigned boot.img) with anything other than the officially signed boot.img.. Has anyone altered the kernel persistently? If you have please share how you did it.

However, technically with this much root I can replace the kernel while it is running and reload it. Unfortunately, upon reboot it will give me the unauthorized software detected blue softbrick screen. This is because BL2, "bootloader 2", *is* the core OS and it will not let me wipe the bootloader. (THERE ARE TWO EXPLOITS FOR BINARY 4!!!) .. But to realize a working exploit to install a custom recovery, like twrp, will be an indeterminate amount of time "if ever". When/if an exploit is available we can easily implement it now with Delgoth / lowandslow200sx discoveries because not only does the factory binary offer persistent root it is also selinux permissive capable.

*** But I am not an all knowing genius we do this as a community so if you've found something be sure to share it!! ***

*** What you can do is install the factory binary, gain persistent root, setenforce 0 and then adb sideload apps using adb install app.apk ***

Custom roms Custom smroms

Personally I don't like custom roms because they are unstable, almost always have glitches and can't compare to a slimmed down version of the factory rom. When we do get access to the bootloader I will user SuperR kitchen to debloat and deodex the latest version of Nougat then put it back and provide downloads for all the Samsung + AT&T apk files so you can choose which apps you want! I have several Samsung devices between my wife and I, none of them are running LineageOS or a "custom rom", they all are running slimmed down factory firmware. A slimmed down factory rom is technically close to achievable now using the 2nd root approach in my sig by simply disabling the apps you don't like with pm disable!! Then load a custom launcher on your phone to achieve most things now. Also when you install things from Google Play you are installing with root power! (until you reboot)
[AT&T Samsung Galaxy Note5] gmlai:
I found out that GoMobile is a 5 day trial for each account.

So, if you create a new Windows account it will get a new 5 day trial, even if your other accounts' trial is gone.
[AT&T Samsung Galaxy Note5] sahebsingh:
help plz.... i have a AT&T note V with me n i have OEM unlock option so can i root my phone by turning it on ?