yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Yes.

There are two requirements to support rooted stock firmware and encryption:

- You MUST use the stock kernel binary. Custom kernel binaries are blocked by TIMA, which handles encryption.

- You need to change "ro.config.tima" in the system build.prop to 0. This doesn't entirely disable TIMA, but seems to relax the encryption requirements a bit(less salting?) which will allow a modified ramdisk to work properly. It's slightly less secure, but still more secure than going unencrypted :P

Notes: You will need to wipe /data initially after making the build.prop change. You'll need to disable dm-verity after modifying /system. If you installed a custom kernel before you should reflash the entire firmware as the kernel installer likely deleted the TIMA trustlet binary. Some success was had before with getting custom kernels past TIMA by killing the TIMA service soon after boot, but this had the tendency to brick the data partition. Perhaps in future...

Edit: attached a flashable zip to make the build.prop change from TWRP
[Samsung Galaxy S7 Questions and Answers] forocarlos:
Hey , thanks a lot for the info and the file . I learned more from it than 2 days on the internet struggling with this "issue"!

Actually I already tried another way and it worked!

I'll try to explain for the record.

I just installed TWRM and formated /data (not wiping. cause you have to write a file there afterwards) and from there I opened the terminal of TWRM and created /data/.magisk (as in magisk FAQ is explained) with KEEPFORCEENCRYPT=true in it . Then installed a rom (ambasadii's one with magisk 13.6 root ) and... that's it. it worked.

Afterwards i did a lot of automatic tasks of secure network daily backups since when you're encrypted it's kind of easy to f^ckup the system and lose everything and now I'm happy.

Probably i was lucky since the kernel probably is the stock one as you said in this ROM.

I still have to try more stuff to be sure everything is working and the data is safe (safe enough at least)

one question:

do you think it would work if i activate dm-verity or this firmware and or magisk modify the ramdisk (so it wont.) :cowboy:?
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
dm-verity likely won't work on a custom ROM(unless the ROM maker specifically re-signed it, but that's unlikely and bloody difficult). Making any changes to /system (including the build.prop tweak I mentioned!) will necessitate disabling it and there are a bunch of changes in custom Roms. Ambasadii's nougat ROM does indeed make use of the stock kernel and most likely has the TIMA prop already toggled. So an ideal setup I think. The data should be pretty solid provided the TIMA trustlet never goes missing(encryption keys basically self-destruct, which bricks the partition :P )

EDIT: You also might want to check in TWRP if the data was genuinely encrypted. Android generally won't complain if it isn't. If TWRP can mount it it isn't encrypted.
[Samsung Galaxy S7 Questions and Answers] forocarlos:
checked.

/data unmountable.

So wrapping things up:

- Magisk root

- CTC passed

- Encryption

- Custom Rom

- Lastest Nougat

:good::good::good::good::good:

the only thing left is figuring out how to update the rom without losing data or everything actually.
[Samsung Galaxy S7 Questions and Answers] charliebigpot:
Hey, have you figured out a way of updating without losing data?
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Little late sorry, but if you keep the TIMA prop disabled you can flash the full firmware with HOME_CSC and it will keep the data. Just reflash twrp after it does the update(needs full reboot into stock recovery first to finish update) and flash the TIMA zip in this thread with a root zip.
[Samsung Galaxy S7 Questions and Answers] michaelbrender:
Step-by-Step-Guide to a S7 with Nougat+Root+Magisk+Encryption

Hi there,

I am glad that there is a way to use Nougat, Root and Magisk on an encrypted S7. For the last months I have tried every so-called-solution (TWRP, CF-AutoRoot, reflash Stock boot.img, Helios' Stock kernel) but always ended up in bootloops or an unencrypted device.

Can someone provide me with a step-by-step-guide how to achieve a rooted-magisked-encrypted S7 running Nougat?f I am now running unrooted stock 7.0 with VIA CSC, Build G930FXXU1DQH9.

Thanks in advance!
[Samsung Galaxy S7 Questions and Answers] protoplasm:
A step by step for this would be great.

i tried several variations of the proposed methods and did not succeed in any way, please clarify :)

i tried these variations, and many many more:

flash stock

reboot

flash twrp

wipe system

format data

terminal: KEEPFORCEENCRYPT=true >> /data/.magisk

flash ambassadi rom, dirty flash, magisk root, wipe cache

reboot

set fingerprint & password + fast encrypt

bootloop

format data

wipe sys caches

terminal: KEEPFORCEENCRYPT=true >> /data/.magisk

flash ambassadi rom, clean, magisk root, wipe cache

reboot

set fingerprint & password

reboot

encrypt

bootloop

flash stock

reboot

set fingerprint&pw

reboot

flash twrp

tima

format data

magisk

no-veri opt enc

reboot

set up fingerprint + pw

reboot

encrypt

unsucessful but bootable

The most sucess i had with the stock rom, though i dont remember how exactly. I didnt take my password, which i suspect to be a verification error since the password was the right one

On the batman rom the ui hanged itself on first encrypted startup.

On ambassadi rom i got into bootloop every time.

Did i miss something??
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Regarding stock rooted encryption there are some notes, in addition to the requirements in my post above(stock kernel etc):

- Samsung's encryption never handles post setup encryption that well. At least from my experience. You need to be encrypted from the get-go. This implies re-wiping data the moment you're finished flashing the custom ROM as TIMA won't encrypt unless the partition is blank(which it won't be with the leftover magisk config file).

- The TIMA prop must be changed before first boot. Data encrypted with prop in either state is incompatible with data encrypted during the other state. State "1" bootloops on rooting. State "0" allows it.

So for stock the step-by-step would be:

- Flash full stock and use CSC(NOT HOME_CSC), let it reboot to the initial setup screen. This is important to apply the CSC settings from the firmware package, which if not done will result in an unusable secure keyboard and cause various other issues.

- Flash TWRP

- Flash the TIMA prop zip in the post above

- Flash a verity disable zip which DOESN'T disable Force Encryption. For convenience I have attached a modified version which doesn't.

- Format /data

- Reboot into setup and run through the wizard.

- Reboot back to TWRP and flash a root solution like Magisk. Don't worry about force encryption now as the data partition should be encrypted already by this stage. Magisk should revert to the /cache workaround.

To update:

- Flash the latest full stock firmware package but this time use HOME_CSC

- Let it reboot into stock recovery and do the upgrade process.

- It should end up on the secure Startup page asking for your password. No password will work at this point because your data was encrypted in TIMA state "0".

- Reboot to download mode and flash TWRP.

- Reboot to TWRP

- Flash the TIMA prop and verity zips.

- Reboot into to Android (password should work now)

- Let it finish the upgrade.

- Reboot to TWRP and flash your root solution.

These are the basic processes which worked for me.
[Samsung Galaxy S7 Questions and Answers] xbizkuit:
when first reboot into TWRP wich option should get? "keep read only" or "allow modifications"?

if I select "allow mods" when I try to flash TIMA.prop file I get an error about mount\data

is it necesary to format data before?

thanks
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Actually the TIMA prop zip doesnt even need data. Not sure why I made it try to mount, but any error about mounting can probably be ignored. It modifies /system so you should swipe to allow.
[Samsung Galaxy S7 Questions and Answers] xbizkuit:
First of all, thanks for your reply and for your small guide

What I did was flash lastest full stock official rom from sammobile with odin and let it reboot to the initial setup screen

Reboot to download mode and then I flashed TWRP also with odin and reboot manually to recovery

When first time entered into recovery just selected "allow modifications"

After I flashed the TIMA prop zip and verity disable zip modified version

In both cases, I received error messages about mount/data on the screen but the installation seems to be complete

Finally format/data, reboot and complete the wizard and the installation

The last step, reboot again into recovery and flash magisk v14

At the end of this procedure, all seems ok, magisk is running, safetynet test is OK, superuser is OK and root apps with no problem

Also a couple of mods flashed with recovery (zero camera mod and sound mod by zubi) gave me error messages about format/data but both of them were done

So, the question is how can I check now if my phone encryption is OK and working ??

The only thing seems not work is the OTA firmware updates, it doesnt work, error message about modified phone

I tried to hide root with magisk for the apps in relation with the ota updates but no work for me

Is there any solution for that??

Thanks for all and very appreciated for your help

And sorry for my english hehe
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
If the recovery is giving errors about /data mount then the phone is encrypted. TWRP simply cannot work with Samsung encryption at all at the moment. Also: If there is no "Encrypt" option for the internal storage in the Security section of the settings app, then the device is encrypted(There may still be one for the external SD). There's no way I know of to fool OTA into working, I've always just fully flashed the latest firmware. Samsung firmware is really easy to get so I've never really looked into using OTAs to update. They'd probably fail horribly anyway due to the modified system in which case the OTA tool is probably correct to block the update. (Newer Android standard requires updates to be done via raw block writes so dm-verity remains intact. Could lead to corruption if done wrong...)
[Samsung Galaxy S7 Questions and Answers] xbizkuit:
OK so it seems my phone is finally encrypted and rooted!!!

anyway, I forgot about OTAs and I´ll continue installing updates manually,

so can I flash the full firmware with HOME_CSC without losing the data?

Only reflash TWRP after the update and flash the TIMA prop zip ???

Thank you very much for your help!!!
[Samsung Galaxy S7 Questions and Answers] protoplasm:
Thank you CurtisMJ! It finally works!
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Whoops. Didn't see those were questions. Yes, full flash with HOME_CSC will keep data intact. The TIMA prop will need to be in state "0" to decrypt, so yes again, reflash TWRP and the TIMA and verity zips and you should be good. Just make sure to have "Auto Reboot" checked in Odin. It will do some stuff in stock recovery first (including a screen with "Erasing..." Don't worry! It's just cleaning up the working files in /cache ;) ).
[Samsung Galaxy S7 Questions and Answers] xbizkuit:
Thanks again mate!!!!!!
[Samsung Galaxy S7 Questions and Answers] WyRmiE:
WyRM

Hello Guys

Do you think it would work also on Note8 ?

Im stuck on step when i flash 2 files via TWRP, it shows erros with cant mount Data because it is already encrypted somehow, it wouldnt be issue as you said as it does to system.

But when i finish the installation of the Firmware and came back to TWRP for flashing Root solution it is encrypted and cantbe flashed.

Any idea?
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
That sounds about right actually. The data is supposed to be already encrypted by the time you flash root. TWRP on the S7 and it appears any recent Samsung device cannot decrypt the stock ROMs encryption. The root solution should revert to using the cache workaround. Both Magisk and SuperSU support this setup. Just flash and ignore the /data mount errors.
[Samsung Galaxy S7 Questions and Answers] sammydoro:
[MENTION=5278223]CurtisMJ[/MENTION]

Thanks a lot.

Just encrypted with your method - worked like a charm.
[Samsung Galaxy S7 Questions and Answers] SameerAhmed:
Worked on an S8 (Nougat)!

This worked like a charm on an S8 (SM-G950FD) running Nougat (stock, with Magisk root) and Xposed v88.2 (official, not systemless). Thank you very much!
[Samsung Galaxy S7 Questions and Answers] Senliast:
Is this encryption less secure, then normal encryption on official unmodified unrooted firmware? Is there anyway to bypass this encryption?
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Samsung's default setup was more secure than the standard Android implementation. At most it falls to the same level now. So still not possible to bypass without the password.
[Samsung Galaxy S7 Questions and Answers] :
data can be encrypted with custom ROMS? I want to install Hellios ROM and have the data encrypted.
[Samsung Galaxy S7 Questions and Answers] sammydoro:
I tried to upgrade from magisk v14.x to v15.

The result was the pulseing SAMSUNG boot-logo but phone didn't boot.

So I had to reinstall with magisk v14.

Any ideas?
[Samsung Galaxy S7 Questions and Answers] andrei1412:
Hi. I can't update. First steps for installation worked fine! But when i followed your steps by flashing the new december security firmware, i get error at bootup "unsuccessful verification / integrity check failed" (translated from my native language"
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Hello, I dont use this device anymore so I haven't kept up with updates but it looks like Samsung increased the security. Unfortunately its possible the system wiped it's encryption keys from the looks of the message(would need the English one to be sure). I'm not sure what can be done at this point. Downgrading to an older firmware(would need to skip the BL package as it probably wont flash) might allow the data to be accessed again (make as if it's an "update", or "downdate"... I guess). I might dig up the device and try to get encryption working on the Decemeber update but the methods mentioned in this thread took a lot of trial and error so it might not be possible anymore.

Just so everyone sees:

BACK UP YOUR DATA IF YOU ARE TAKING THE DECEMBER UPDATE! ENCRYPTION MIGHT BREAK!
[Samsung Galaxy S7 Questions and Answers] andrei1412:
Just to clarify first boot-up without flashing twrp everything like you said it ask me for encryption key. I go like you said flash twrp and then the next steps, but then it shows error and at the bottom the option to factory reset (if i press on the button nothing happens).

I flash back full stock as root was required for s health but anyway i will not use it anymore.

Off topic: what phone you use now, just for curiosity?
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
An HTC U11. I'm downloading the December update now but if it's the message I think it is, encryption may not be possible on stock anymore.
[Samsung Galaxy S7 Questions and Answers] Tomiie:
Hey Curtis. Have you tested and verify if the update breaks encryption?

I'm planning to upgrade to the January update.
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
I admittedly didnt get around it. The download failed and I sort of gave up after the 3rd try. Third world internet problems... I'm trying again with the January update, but as long as you back up the worst that can happen is being left without encryption I guess?
[Samsung Galaxy S7 Questions and Answers] Tomiie:
I guess I was hoping to dirty flash. Lol. It can a pain to reinstall the apps with Titanium Backup. Those secured apps esp from the banks require you to relogin and complete their whole registration process again.
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Yeah it looks like encryption fails on the newer firmware based on some kind of verification check. Looks they don't do that encryption key wipe they do when you mess with TrustZone binaries though so at least it seems flashing an older ROM might restore access (Not sure if a newer BL will boot an old one though). Well that's a shame.
[Samsung Galaxy S7 Questions and Answers] Tomiie:
I am successfully running the December update (G930FXXU1DQL5) with encryption. It was a full wipe when I installed it though.

That's why I was wondering if I could just dirty flash the January update.
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
If you're running it now then yes you can dirty flash. Using the HOME_CSC package in Odin keeps data. Are you rooted?
[Samsung Galaxy S7 Questions and Answers] Tomiie:
Yup. Rooted with SuperSU and Xposed. Do you mean something changed in the December 2017 update so firmwares prior to that would have issues?

Google did the same for the December 2016 update. Systemless Xposed v86.2 stopped working. I had a good run during the Pokemon craze. Lol.
[Samsung Galaxy S7 Questions and Answers] CurtisMJ:
Yeah. Looks like a wipe is needed before encryption works on the newer firmware? Weird.
[Samsung Galaxy S7 Questions and Answers] Tomiie:
I'll backup first and try dirty flashing from December 2017 to January 2018 update. I'll report back, probably this weekend when I have some time.
[Samsung Galaxy S7 Questions and Answers] blaukraut:
If I understand you correctly, you guys managed to get encryption working on a rooted Nougat device? Does this work with the Superman Rom for the S7?
[Samsung Galaxy S7 Questions and Answers] andrei1412:
Now i'm on this ROM: https://xdaforums.com/galaxy-s7/development/rom-dqd2-devbase-v4-1-multi-csc-safe-t3592914

Encryption works perfectly and i can update it too when dev release new versions without wiping /data/.
[Samsung Galaxy S7 Questions and Answers] Tomiie:
Just to update that dirty flash worked, G930FXXU1DQL5 to G930FXXU2DRB7.
[Samsung Galaxy S7 Questions and Answers] xbizkuit:
working flawless for months in a s7 edge

will this trick work in a s8?????
[Samsung Galaxy S7 Questions and Answers] xbizkuit:
Did you tried this method on a S8 running oreo???
[Samsung Galaxy S7 Questions and Answers] SameerAhmed:
Works on S8 Oreo as well!

Yes, it does. I followed the same steps after upgrading to Oreo and it works just as well. I've got Magisk v16.0 with Xposed 90.1-beta3 (Systemless) installed on SM-950FD.
[Samsung Galaxy S7 Questions and Answers] xbizkuit:
- Flash full oreo stock from sammobile and use CSC, let it reboot to the initial setup screen.

- Flash TWRP

- Flash the TIMA prop zip from [MENTION=5278223]CurtisMJ[/MENTION]

- Flash verity disable zip from [MENTION=5278223]CurtisMJ[/MENTION]

- Reboot into setup and run through the wizard.

- Reboot back to TWRP and flash Magisk v16

It works!!! S8+ exynos with oreo, rooted and encrypted!!

Thaks again [MENTION=5278223]CurtisMJ[/MENTION]
[Samsung Galaxy S7 Questions and Answers] danielwbn:
Hey people,

I'm getting mixed signals from my phone on whether it is now encrypted or not and I would like to know how to find that out for sure.

My goal is to have a stock rom on my S7, rooted, with encryption.

I recently flashed the latest stock oreo build with odin, I don't remember if I let it boot once before the next step, but I think I did (I read this thread only after I did this)

Then, I installed TWRP via odin, booted into TWRP, formated /data, copied the magisk v16.0 installer zip to the now mounted /data and installed it.

Next, I booted the phone and set up all my accounts and apps.

Finally, I looked into how to get Samsung Health running on the rooted phone and manually set the ro.config.tima property in build.prop to 0 (and I still have no trouble restarting the phone).

The result is, that the phone is rooted, TWRP can not mount /data anymore (which seems to be a hint that the phone is encrypted), but in the android settings, I still have the option to encrypt the device (right above the option to encrypt the sd card).

Does anyone know how to check if the phone is now encrypted or not?
[Samsung Galaxy S7 Questions and Answers] mobileanimal:
Hi all. I had a S7 G930FD running the stock ROM / Nougat with encryption working after disabling TIMA and Verity. Now I have a new S8 G950FD with BL4. I can't get /data to encrypt with TIMA and Verity disabled with the stock ROM. I even tested leaving forced encryption on, but the phone won't boot that way - just hangs at the Samsung logo. When I try to encrypt through settings, the phone just reboots with unencrypted /data after a few minutes on the "Encrypting..." splash screen. I went through all the standard procedures, and even tried after a flashing the stock ROM with just disabling TIMA and Verity/Force enc, format then wipe /data.

Any ideas?
[Samsung Galaxy S7 Questions and Answers] rucola21:
How to get magisk root encrypted stock rom on galaxy s7

The solution from [MENTION=5278223]CurtisMJ[/MENTION] works beautifully on the Android Oreo Stock ROM from 06/2019 (build number G930FXXS5ESF1 for me). I did just test a fresh installation, not the updatee.
[Samsung Galaxy S7 Questions and Answers] A.L.P.H.A.:
Hi, will these work for OnePlus devices ? I am really having a hard time having a work profile setup inside my Syberia rom.
[Android Q&A, Help & Troubleshooting] Robjodicarter:
Ok so plain and simple how do I go about rooting my at&t (non hotspot having pile) s6 so I can use the hotspot. I'm not really savvy with this. I have tried the one click root deals and none of them work, well most. And I'm running nougat. Any help would be appreciated. I live in gresham Oregon if you close and can help let me know. Thank you all in advance if you reply.

Rob
[Android Q&A, Help & Troubleshooting] zelendel:
If I remember right there is not root for that version of the device, due to its locked down nature.
[ZTE Axon 7 Questions & Answers] Lukester852:
I was on lineage and reverted back to stock. I thought I was on the stock recovery until I couldn't update to B32. Is there anyway to unlock it again or am I just stuck at this point?
[ZTE Axon 7 Questions & Answers] lafester:
Just unlock silly. Why do you think you are stuck?
[ZTE Axon 7 Questions & Answers] Lukester852:
From my understanding you have to have the stock recovery to unlock the phone again. Is that not the case? I tried unlocking through EDL and miflash using the Fastboot_Unlock file, but the phone wont turn on after that so I have to re-flash .
[ZTE Axon 7 Questions & Answers] lafester:
No idea. Would never lock unless selling or returning. Still confused why you are stuck. You are not able to flash recovery with twrp or unlock in fastboot?
[ZTE Axon 7 Questions & Answers] Lukester852:
I locked the boot loader in order to use android pay at the time. The current recovery doesn't have twrp. maybe ill try using abd and the command prompt instead of using axon7tool and miflash.
[ZTE Axon 7 Questions & Answers] Choose an username...:
Use miflash and flash a full system zip. should work
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] myteematt:
I have searched already and haven't found reviews of the new cooked and stock roms out there that we all use and love. If your flash happy like myself you would love to here unbiased reviews of the roms and I don't mean whats in the exisiting threads for each rom that have complaints, rants, and flaming. If anyone else would like to jump on this please let me know or just start reviewing the roms yourselves and the mods will hopefully start a sticky for reviews. Thanks and to all the great chefs keep up the good work.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] peterfnet:
dutty's roms are quite nice. They've got the basics. You'll probably need to install a few things for personal needs, but not too much.

For example, I always install HTC's Task manager. But he took it out since some people liked the WKTask (eww).

I've tried a few random others, and some pack in too many apps

**Edit for links** http://duttythroy.lives-in.eu/

->Current thread for V4 http://xdaforums.com/showthread.php?t=361544