[Android Q&A, Help & Troubleshooting] droidvoider:
Are you up for testing the theory at your own risk? First we need a copy of the boot.img and recovery.img from your current baseband these are located in the AP file. If you're ok with flashing that entire file again it will reverse what we do in our test. If you would prefer an Odin flashable tar.md5 with only your boot.img / recovery.img then please upload and link your AP file for me. I would make you a nice little odin flash file for quickly switching between.

1. Download the files from that link for PJ1 boot.img and recovery.img Odin flashable zip.

https://xdaforums.com/showpost.php?p=71793750&postcount=6

2. I also linked Odin on that same thread above further down

https://xdaforums.com/showpost.php?p=71793750&postcount=7

3. By the way this thread I'm linking is if you get the error screen, it's no big deal

https://xdaforums.com/att-galaxy-note5/help/solution-samsung-note-5-sm-n920a-error-t3545600

4. Backup, prepare to have to flash your phone i.e. acquire and test your current firmware SYSTEM|ABOUT

5. Let's disable some app that you hate.. See my thread on using dirtycow with Note 5 to disable apps (top post, top section only)

https://xdaforums.com/att-galaxy-note5/general/disable-att-apps-samsung-sm-n920a-maker-t3553840

(lower section is not using dirtycow exploit just the top, the included binaries)

6. Flash the file we downloaded in step 1, reboot and get logcat going. You don't want to feel heat from you phone, it's never happened to me with this process but with others it has. You do not want fast battery drain.

7. if it didn't boot that's it replace your files. If it did boot keep an eye on your phone then try to disable something.. error error error crash is a great sign it's not working, it won't say success if there wasn't a success. (some actions such as set permissive are successful and still disallowed, but this is never true of 'pm disable')

On topic:

I have a new idea I mostly worked on while away. I built cmd_list.txt to take the files inside boot.img repacked by Assayed kitchen to be 'prerooted' .. This is all the files init, contexts, init.rc watchdog, adbd, you name it.. files inisde /sbin and /bin basically..

I only ran it once so far but I think I am blocked on some of these even with elevated privs. dirtycow can patch memory also I just don't know how yet but I think that's where we might need to be. I am going to try a few more times, change contexts.. Maybe patch a couple running binaries (not many) then I will leave it to you guys..

1. Killing your system is the goal so if your phone dies reboot and cheer

2. Patching the right binary could just work

3. Moving this process out of toolbox.c could work! So if you patch another binary with some code then just call it in cmd_list.txt, pow root

4. Be creative, I will write more code at every chance..

5. Try not to call /init like I did in the example on the first attempt, see if it will reload on it's own we don't want two inits

this type of work takes great consideration to not brick your device.. as we developers well know, even then we still have mishaps

https://drive.google.com/open?id=0B-fnF5v-xg6OU3JVZFltb1g2OXc

around a little today then gone again for a couple days, please share successes

update on logs: I can just view my logs I don't know if that's because I set shell or not.. the kernel address is in the log I think that's a know issue, has a CVE

adb shell cat /proc/last_kmsg <--- see last entry "Starting kernel at"

and

adb shell dmesg