[Verizon Galaxy S 5 General] AptLogic:
Greetings from the AT&T S5 Forum!

We've recently discovered the usability of engineering firmwares in our journey to get root, as outlined here: https://xdaforums.com/att-galaxy-s5/general/guide-merry-christmas-heres-t3516196

Now, I'm here to try to bring this same method to you guys! With the help of [MENTION=1949695]jrkruse[/MENTION], here are the root instructions:

How it works:

These engineering firmwares are usually based on KitKat, and have their SELinux set to PERMISSIVE. This not only leaves the firmware very vulnerable to towelroot, but it also keeps SELinux from raining on our parade.

Thanks again to [MENTION=1949695]jrkruse[/MENTION] for the updated root instructions, and [MENTION=4770483]mohammad.afaneh[/MENTION] for the Safestrap! :)

Revised October 6, 2018.

Directions:

Before you get going, use this APK to check your eMMC chip's CID:

eMMC_CID_Checker_.apk[/SIZE][/B][/CENTER]

Your CID Number will be the first two numbers in the eMMC Box under "CID"

If the first two digits are "15," your bootloader is unlockable and you can install TWRP/AOSP ROMs.

If the first two digits are "11," your bootloader is not unlockable, but you can use rooted Lollipop ROMs that are based on TouchWiz (with the help of SafeStrap). You can also use non-rooted Marshmallow ROMs (based on TouchWiz) and flash mods with SafeStrap.

BACK UP YOUR STUFF NOW, YOUR STORAGE WILL BE WIPED!​

If your eMMC CID starts with "15," start here:

1. Download and unzip this file: EMMC_15_Root_Bootloader_Unlock S5_QB2_PB1.zip

2. Reboot the phone to Download Mode (Pwr +Vol Dwn+Home)

3. Use Odin 3.12 and load the "COMBINATION_VZW_FA44_G900VVRU2APA1_VZW2APA1_2572656_REV00_user_mid_noship_MULTI_CERT.tar.md5" firmware in the AP Slot

4. Flash and let the phone process the file. It will reboot twice and you should be dropped into Android within a minute and a half.

5. Copy the following files to your phone:

"RootS5" Folder and "EMMC_15_SafeStrap_QA1_6_0_1_MM_Bootloader_Unlock_AIO.zip",

and EMMC_15_VZW_QB2_STOCK_MAGISK_ROOT.zip

6. Use the File Manager (you can find it in the app drawer) to install Superuser.apk, Busybox.apk, tr_v2.apk, and SafeStrapKK.apk . Do not open anything yet.

7. Open towelroot and click "MAKE IT RAIN". It should tell you you have succeeded. Otherwise, reboot and try again.

8. Now open SuperSU and click "New User" to install it.

Once done, open SuperSU and update the SU binaries using the "NORMAL" method. It will tell you you need to reboot, but you can skip that. (If the Superuser install hangs for more than 5 minutes reboot phone and try to install it again.)

9. Now open the BusyBox app, grant SuperSU access and install BusyBox.

10. Now open SafeStrap, grant SuperSu access and click "install recovery". If the SafeStrap recovery fails to install, make sure BusyBox is installed by rerunning the BusyBox app (it will tell you if BusyBox is installed). If its not installed, click "install" again, reboot the phone, re-open SafeStrap and try to install recovery again

11. Once SafeStrap Recovery is installed click "reboot to SafeStrap Recovery".

12. Once in SafeStrap Recovery choose install and select EMMC_15_SafeStrap_QB2_6_0_1_MM_Bootloader_Unlock_AIO.zip

13. Install the zip. The phone will power off. Reboot the phone to TWRP Recovery with Pwr+VolUp+Home

14. You will now have an Unlocked Bootloader and TWRP recovery Installed. Now whoose Wipe > Advanced Wipe. Select Dalvik Cache; Data; System; Cache, and swipe the swipe to wipe bar. When done, click the back button, click Install, and choose:

EMMC_15_VZW_QB2_STOCK_MAGISK_ROOT.zip

You're done! You will have stock rooted Marshmallow QB2 Build installed with an unlocked bootloader and custom recovery.

If your eMMC CID starts with "11," start here:

1. Download and unzip this file: EMMC_11_ Root S5_QB2_PB1.zip

2. Reboot Phone to Download Mode (Pwr +Vol Dwn+Home)

3. Use Odin 3.12 and load the COMBINATION_VZW_FA44_G900VVRU2APA1_VZW2APA1_2572656_REV00_user_mid_noship_MULTI_CERT.tar.md5 in the AP Slot.

4. Flash and let the phone reboot. It will reboot to recovery and finish install then it will reboot and take about 20 seconds to boot.

5. Copy the following to the phone:

Root S5 Folder, EMMC_11_PB1_5_0_1_LL_Firmware_Bootloader.zip, EMMC_11_QA1_6_0_1_MM_Firmware_Bootloaders.zip, and the TouchWiz ROM you want to install.

6. Use the File Manager (you can find it in the app drawer) to install Superuser.apk, Busybox.apk, tr_v2.apk, and SafeStrapKK.apk . Do not open anything yet.

7. Open towelroot and click "MAKE IT RAIN". It should tell you you have succeeded. Otherwise, reboot and try again.

8. Now open SuperSU and click "New User" to install it.

Once done, open SuperSU and update the SU binaries using the "NORMAL" method. It will tell you you need to reboot, but you can skip that. (If the Superuser install hangs for more than 5 minutes reboot phone and try to install it again.)

9. Now open the BusyBox app, grant SuperSU access and install BusyBox.

10. Now open SafeStrap, grant SuperSu access and click "install recovery". If the SafeStrap recovery fails to install, make sure BusyBox is installed by rerunning the BusyBox app (it will tell you if BusyBox is installed). If its not installed, click "install" again, reboot the phone, re-open SafeStrap and try to install recovery again

11. Once SafeStrap Recovery is installed click "reboot to SafeStrap Recovery".

12. Once in SafeStrap Recovery, choose what firmware you want to be on:

Lollipop 5.0 Firmware=EMMC_11_PB1_5_0_1_LL_Firmware_Bootloader.zip

Marsmhallow 6.0 Firmware=EMMC_11_QA1_6_0_1_MM_Firmware_Bootloaders.zip

13. Install the firmware zip, and then flash a TouchWiz Lollipop ROM. (Here is the latest stock rooted Lollipop Rom: VZW_BPB1_ODEX_DEODEX_V9.zip). You may want to download a copy of the latest SuperSu zip, and flash if installing a Lollipop ROM that is not rooted. Remember that you cannot root Marshmallow ROMs, so do not try and flash the SuperSu zip on a Marshmallow Rom (you will softbrick if you do).

14. After you install any Lollipop ROM, you may need to reinstall SafeStrap Recovery. Most of the time you don't have to and SafeStrap can be reached by flashing the KitKat Kernel in Download Mode with ODIN. But, in some cases, when flashing a ROM that flashes a system.img instead of a system folder, you may lose SafeStrap during install. This will be the case if you install the above ROM. You can reinstall it after the ROM is booted up. A Safestrap-G900V-4.04_LL_MM.apk is included that will flash a version of SafeStrap that will allow you to reboot to SafeStrap Recovery without flashing a KitKat kernel in Odin. Install BusyBox again from the BusyBox App in the RootS5 Folder. Install Safestrap-G900V-4.04_LL_MM.apk and make sure to grant SuperSU access. It may take a few seconds to prompt. If SafeStrap is not installed, click "Install Recovery". If Safestrap is still installed click on "Uninstall Recovery", close the app, and reopen it. It should say recovery is not installed. Now click on "Install Recovery". If this doesn't work, reboot the phone and try again. Once installed, you can just click reboot to SafeStrap from the SafeStrap app and you will reboot straight to SafeStrap. Remember to flash the appropriate Kernel when leaving SafeStrap!

Download and place these on your device:

LL_KERNEL_SS-FF_Flashable.zip, and

MM_KERNEL_SS-FF_Flashable.zip

If something goes wrong you can usually get back to SafeStrap by simply rebooting the phone to Download Mode and flashing NI2_stock_kernel.tar.md5. When the phone reboots, watch for the SafeStrap splash screen and enter SafeStrap.

WARNING: Do NOT change ANY boot options in SafeStrap. ROM slots cannot be used, so you must flash to the Stock ROM slot EVERY TIME OR YOU WILL SOFTBRICK. Some functions don't work in SafeStrap, like choosing an image file to flash directly. All image files must be flashed via zip file.

For CID11 users that have followed the above instructions and want to use Marshmallow:

QA1_MM_Firmware_With_QA1_Bootloader_CAUTION.zip=Marshmallow Firmware (use if flashing a MM TW ROM other than the one posted below). Just remember there is no root for Marshmallow ROMs, but having SafeStrap installed gives you the ability to do things like flash debloat Scripts, Mods, etc and the ability to go back to a rooted Lollipop ROM without going through the root process all over again. Simply flash the Lollipop ROM and EMMC_11_PB1_5_0_1_LL_Firmware_Bootloader.zip.

Here is a special ROM that includes SafeStrap, so you can flash a Marshmallow ROM and still be able to use SafeStrap to flash things. You will not have root but you can still access SafeStrap. VZW_QB2_STOCK_SAFESTRAP_ONLY_V1.zip More Instructions about this can be found HERE

When using a MM ROM, it is necessary to flash the KitKat Kernel with Odin to enter SafeStrap. When leaving SafeStrap, make sure to flash MM_KERNEL_SS-FF_Flashable.zip which is necessary to leave SafeStrap (This zip will be placed on storage automatically with the above ROM and you also download it in instructions above.) Just navigate to the .MM_KERNEL_SS-FF folder located on both Internal and External storage.