[Samsung Galaxy Note FE Guides, News, & Discussion] hhspiny:
Was not comfortable exposing TWRP, Rooted phone without encryption. Averge Joe who knows TWRP can easily get into my phone. I also needed Verizon VoLTE which requires TWRP/Root. hence the research and results of the guide below.

Should applicable equally to S7/S8/N8

All instructions were taken from following threads.

N935F TWRP

S7 Encryption

Verizon CSC VoLTE

S7 CSC Selection

Start with a stock N935F/DS XME CSC and Verizon Sim Card already activated and provisioned for VoLTE

Although N935F/DS does not support CDMA, it does have all verizon LTE, can be used fully with VoLTE enabled

Basic Setup -- enable optional encryption

0. Copy files extracted from TWRP_Root.zip (attached) into SD card. insert SD card with Verizon Sim Card. Download TWRP image from N935F TWRP

1. Ensure RMM is not enabled

-- boot to download mode (vol down+home+power), if "RMM State: Prenormal", then you need keep phone on, connect to internet, wait for 168 hrs

2. If already on Stock ROM then skip to 3 below, otherise

-- Flash via ODIN Stock Rom, in ODIN, turn off auto-reboot, use CSC not HOME_CSC.

-- when finished, push vol. down+home+power until screen turns black

-- right when screen turns black, immediately re-push and hold vol. down+home+power again to get into download mode again

-- this is to avoid reboot the phone and potentially trigger RMM again

3. Flash via ODIN TWRP 3.2.1-0 (turn off auto-reboot) via AP

4. Disconnect USB, hold home+vol. down+power to exist download mode, when screen becomes blank, immediately hold vol.up+home+power to boot to TWRP

5. Install RMM-State_Bypass_Mesa.zip -- to fix RMM first

6. Format data partition

7. Install tweakpro-tima.zip -- to allow encryption

8. Install no-verity-opt-encyrpt-5.1.zip -- to diable verty and disabling enforce encryption. allow to choose encryption or not during initial setup

9. Format data partition !!

11. Reboot and run through setup wizard

-- when asked to "activating device protection features" it is asking if you want to encrypt the phone i.e. the data partition

-- set a PIN/password to enable. TWRP won't be able to read or backup data partition anymore (not possible on samsung devices)

you might still be able to use "adb pull /dev/block/dm-0 /tmp/dm0backup.img" to back up to PC, and use "push" to restore

12. Reboot once, and then reboot to TWRP. verify encryption was enabled a). ask for boot PIN/password b). can not mount data partition in TWRP

13. Install Magisk-v16.0.zip through TWRP.

-- Magisk must be installed AFTER encryption has been enabled via initial setup process.

-- with Magisk installed, data won't be encrypted even if you activate the device protection features during setup

[OEMXME-RMM-ENCRYPT-ROOT-SYS02]

14. reboot to system. Open Magisk Manager, and verify SafteyNet pass

15. download estrong file manager, turn on root access

16. open /system/built.prop to make sure/set

ro.security.vaultkeeper.feature=0

ro.config.tima=0

17. download "CSC feature expert for samsung"

DisableAntiMalware = TRUE

=== Profit, now you have a RMM removed, verity disabled, rooted, encrypted NoteFE===

=== NOTE: if ecryption was enabled, and you need to reset phone or format data partition:

-- once Magisk is installed, data partition will not be encrypted anymore during intial setup

-- if you want to encrypt, need to uninstall Magisk (zip included), setup phone, and install Magisk again

=== Optional - 1 ====

Enable Verizon VoLTE only, without installing US CSC

1. rename /system/csc/customer.xml to customer.xml.bak

2. copy vzw_customer.xml (attached, was extracted from S8 VZW CSC) to /system/csc/customer.xml and set chmod 755 (rw-r-r-)

3. download "CSC Features Expert for Samsung" (these are not neccessary, just good to have)

Message_DisableSmsToMmsConversionByTextInput = TRUE (disable auto convert long sms to mms)

Setting_CustNetworkSelMenu4 = LTEONLY	(enable LTE only network mode)

SystemUI_SupportDataUsageViewOnQuickPanel = TRUE (data usage shown in quick panel)

Wifi_SupportAdvancedMenu = TRUE	(advanced wifi options)

Wifi_SupportMobileApOnTrigger = TRUE

====== Optional -2 ====

Install US CSC and enable Verizon VoLTE. (it is safe to apply this after applying Option - 1 above "Enable Verizon VoLTE only without installing US CSC"

-- not needed to enable VoLTE, but might be needed to enable WifiCalling. I have not tested

-- this does mess with system files, and deletes all original CSC files under /system/csc and replace with /system/omc structure

-- might lose some dual sim functions, I only found one so far: native phone/contact app does not support dual sim

a). download CSC_selection v1.3.0 from S7 CSC Selection

b). replace updater-script and csc_script.sh with ones attached

c). copy to sd card and flash via TWRP

-- select XAA and XAA, DO NOT select VZW (in VZW CSC many dual sim functions gets messed up)

-- during flash, stay away from CSC tweaks that are related to phones. "Enable LTE only" is safe

d). after finish, DO NOT Reboot yet

e). rename /system/omc/XAA/customer.xml to customer.xml.bak and copy /system/omc/VZW/customer.xml to /system/omc/XAA/customer.xml

f). reboot

==== To upgrade ROM in future if you selected encryption ===

- Flash the latest full stock firmware package but this time use HOME_CSC

- Let it reboot into stock recovery and do the upgrade process.

- It should end up on the secure Startup page asking for your password. No password will work at this point because your data was encrypted in TIMA state "0".

- Reboot to download mode and flash TWRP.

- Reboot to TWRP

- Flash the TIMA prop and verity zips.

- Reboot into to Android (password should work now)

- Let it finish the upgrade.