[Samsung Galaxy Note 9 (Snapdragon) ROMs, Kernels, ] Qui Peccavit:
Custom TWRP Recovery and Magisk Root for the Samsung Galaxy Note 9 SM-N9600 - [2/2]

​

Up to this point, there were no negative consequences of OEM unlocking the bootloader, enabling USB debugging and so on. The Replay Protected Memory Block (RPMB) fuse was blown and the warranty flag changed from 0x0 to 0x1 (0x30C), but since manufacturers cannot lawfully deny warranty repairs if a user's modification did not cause the failure, there were no real consequences: both Current Binary and System Status remain official and applications as well as the system continue to receive Over-the-Air (OTA) updates.

Unfortunately, manufacturers and service providers feel entitled to controlling their customers' property to a degree way beyond what is necessary to ensure hardware stability and network integrity, crippling/removing ever more functionality, such as USB drive mode, Fastboot Mode (no longer available on SAMSUNG) or the possibility to delete bloat- and spyware. In order to disencourage device owners from unlocking their phones' full functionality, the unholy trinity formed by GOOGLE, manufacturers and carriers punishes the use of custom ROMs, rooting and other modifications of the phone by no longer providing OTA updates, and some applications might stop working altogether.

If you do not feel like checking for system updates (latest firmware) and flashing them manually every month, you might want to stay clear of any of the following customisations. Those who think that the advantages of root and super user access are worth a couple minutes every month, fasten your seatbelts as we are getting into medias res.

There are two variants for rooting: one uses the Team Win Recovery Project (TWRP, a modified recovery.img) in combination with a patched boot.img to get the job done. The second approach consists in patching the firmware's AP file with Magisk Manager and flashing it to the phone without any custom recovery. If you encounter problems when going the TWRP route, re-flash the stock firmware, jump to section (d02) and continue from there.

C - Custom Recovery by the Team Win Recovery Project (TWRP)

This is not necessary when a Magisk-patched AP firmware file is flashed onto the phone with Odin. To do so, leapfrog this TWRP section and continue with (d02).

c01.) Boot the Phone into Download Mode

Connect a USB cable to the PC, but not yet to the phone. Turn off the phone and wait 10 seconds. Now, while holding the phone's [Volume -]+[Bixby] buttons pressed, connect the USB cable to the phone. When a light blue screen with a warning message appears, release the buttons and then press [Volume +]. A white down arrow indicates that the device is now in Download Mode. Another way to get there: connect the phone and PC via USB cable, open an administrator's command prompt in Windows and enter ADB reboot Bootloader or ADB reboot Download.

c02.) Replace the stock Recovery Interface with TWRP's Custom Recovery GUI

In Odin on the PC, the field in the upper left corner that indicates the virtual COM: port that the phone connected to will light up in blue. Click the [AP] button to load the WETA «TWRP...Recovery.tar» file into the AP slot, which is CanMan1's tar.md5'ed version of @root@'s updated kernel image. In case future updates (eg. for Android Q) come in .img format, XD-compress it into .tar format first. On the left side at the top in Odin, above the log text field, switch to the [Options] tab and deactivate ([ ] uncheck) Auto Reboot. Only F. Reset Time should be marked, everything else unchecked. Switch back to the [Log] tab and press the [Start] button. When the flashing is done, Odin will display a green rectangle with the word «Pass» in the upper left corner.

c03. Reboot into Recovery Mode

If you booted back into Android's normal phone GUI right after flashing TWRP, the system would automatically restore stock recovery and the entire operation would have been in vain. Consequently, it is indispensable to boot directly into Recovery Mode after exiting Download Mode:

After flashing TWRP, the progress bar on the phone has reached the right border of the phone and a green square with the word «Pass» in Odin tells you that the flashing procedure was successful. You can now disconnect the USB cable and close Odin. Subsequently, hold down the [Vol -]+[Power] buttons on the phone for seven seconds and as soon as the screen turns black, immediately press [Vol +]+[Bixby]+[Power]. When the phone vibrates, it should show the word «Recovery» in tiny yellow letters at the top of the screen. Give it a minute to load the custom recovery (TWRP) you just flashed and then we can take charge of the drama's final act.

D - Initiate the Rooting Process

d01.) Installing a modified Boot Image via TWRP

In recovery, on the TWRP home screen, execute the following steps in the indicated order:

[Keep read only], which will take you to a screen with eight grey buttons.

[Wipe] - [Format Data] - type «yes» - tap checkmark in the lower right corner.

◅ | ◅ back to TWRP's main screeen with the eight grey buttons.

[Mount] and make sure that Data, Micro SD Card and USB OTG are selected (so that you can install files from there) and that the system partition is mounted read only.

◅ back to the TWRP main screen.

[Install] and at the bottom left, select Storage (in my case SD card).

[Install] all modifications that are not system relevant, eg. audio files and the like. Swipe from left to right at the bottom after adding the last .zip file to the queue. Examples that I used for testing:

- «Ainur Sauron [Mk III] ... .zip»

- «AM3DZirene Sound Port = am3dzs_... .zip»

- «Audio Modification Library ... .zip»

- «Audio Compatibility Patch ... .zip»

- «James DSP Manager = jdsp ... .zip»

These particular mods I prefer to install as Magisk modules later, but if there are things you want to flash that are not available as Magisk modules; this is where they come in.

- On Android 8.0 Oreo: [Install] «RMM_State_Bypass_Mesa_... .zip» (not necessary on Android 9.0 Pie). -

[Install] «Disable_Dm_Verity_ForceEncrypt_... .zip».

◅ | ◅ [Reboot] into [Recovery].

After having booted back into TWRP, [Keep read only] if the button is still displayed, otherwise continue.

[Install], [Select Storage] and then in the bottom right corner, switch to [Image].

Choose the modified boot image of your preference. This could be the «magisk_patched.img» that Magisk Manager created based on your particular firmware, but which often results in a bootloop later on. Should that happen, reboot into TWRP once more and choose the general «WETA_Boot_ ... .img» instead.

Select ◉ Boot as the partition to which the .img file will be applied and swipe from left to right to confirm the modification.

Reboot into System, i.e. into the ordinary Android GUI.

Be patient, it takes a while for Android to launch. In my case, The SAMSUNG name was pulsating for 11 minutes before «installing Applications», and after another minute, the white «Let's go» screen let me finally specify my preferred language.

Fixing Bootloops: if you made a mistake, used the patched «magisk_patched.img» as the boot image or simply forgot something, your phone may repeatedly turn off and on again, displaying «Kernel» in tiny yellow letters at the top of the screen but never going anywhere. No reason to panic, but to read this article. If you are stuck in a bootloop, it is sometimes sufficient to hold down [Vol -]+[Power] for seven seconds, boot back into TWRP and flash WETA's boot image instead, for instance. In some cases, you may have to re-flash the stock firmware and start over, but now that you know how it's done, it's a matter of half an hour.

When you see the SAMSUNG logo pulsating continuously, go pour yourself a drink and after ten to twelve minutes, Andoid should greet you with an invitation «Let's go» to initiate the first-time user setup procedure. Configure your language, time zone and so on, and then reboot the device once more into the normal Android GUI. This is in order for the external SD card to be recognized correctly again, which Android pretends has been corrupted when it is loaded the first time after flashing the modified boot.img in TWRP.

d02.) Flashing a modified AP Firmware File with Odin

If you have not patched the AP file of your firmware package with Magisk Manager, or if you prefer to flash a modified boot.img in the TWRP custom recovery, execute the steps from section (C) to (d01) and then continue with (E).

If you are on a clean, fresh stock firmware, boot the phone into Download Mode, load the modified AP file of your firmware package (the one you patched with Magisk Manager in paragraph (b06) above) into the AP slot, flash, done.

If the firmware that is currently on the phone is a hodge-podge of previous attempts and experiments, load the other files into Odin, too, before you press [Start]. Remember that the CSC … will make tabula rasa (blank slate) and erase everything on your phone; if you want to keep your installed apps, etc., load HOME_CSC … into Odin's CSC slot for flashing.

E - Complete the Rooting Process

e01.) Disable Google Play Protect

Since some of the apps that will be used during and especially after the jailbreaking of the phone, we need to stop the search engine and spying behemoth from messing with sideloaded apps. In order to do so, enter the device's Settings | Play Store | Settings ( ⁞ in the upper left corner) | Play Protect | Settings (۞ in the upper right corner) | Scan Device for Security Threats (turn off). You get to the same setting via Settings | Google | Security | Google Play Protect | Settings (۞ in the upper right corner) | Scan Device for Security Threats (turn off).

Subsequently, turn off Play Protect notifications, too: either Settings | Apps | Google Play Store | Notifications | High Priority (turn off) - or - Settings | Notifications | See all | Settings ( ⁞ in the upper right corner) | Show System Apps | Google Play Store | High Priority (turn off).

e02.) Enable the Developer Options

Navigate to Settings | About Phone | Software Information and tap seven times on Build Number until a toast message announces that «you are now a developer».

e03.) Disable Apps Verification

Under Settings | Developer Options, turn off Verify Apps over USB.

e04.) Install Magisk Manager

With the My Files file manager in the SAMSUNG folder (or any other file explorer), navigate to where you stored the Magisk Manager .apk, for example on the external SD card. Grant the file explorer the necessary permission to install apps from unknown sources.

e05.) Install Magisk Mask

After having installed Magisk Manager and any updates from within the app, open it and tap on the upper [Install], [Install] to set up Magisk choosing the «Direct Install» option. After yet another reboot of the phone into the normal Android GUI, your phone is rooted.

You will now want to open the menu in Magisk Manager's top left corner to [Download] the Magisk modules that suit your needs and taste.

​

F - Keeping a rooted Phone up to Date

It would be a terrible trade-off if one had to accept the arrogant impertinence with which Google, manufacturers and carriers punish and harass the owners of rooted phones, cutting us off security patches and updates (although «security» is the major pretext for their anti-root stance), bug fixes and new or improved features. For this reason, no custom ROM flashing or rooting guide can be considered to be complete until it presents a reliable procedure for obtaining those goodies on the optimised device. Of course, wiping the data partition and starting over from scratch every month is not an acceptable answer to this question ― there must be a better way.

Before the last firmware update, it was sufficient to flash the latest original firmware as explained in step (b11) above, only loading the HOME_CSC... instead of the CSC... file into the CSC slot: Turn off the phone for ten seconds and then boot it into Download Mode by holding [Vol -]+[Bixby] while connecting the USB cable. When the light blue screen appears, press [Vol +] to enter Download Mode. In Odin, load the AP, BL, and CSC files from the extracted firmware package into their respective slots, but instead of the CSC file, put the HOME_CSC into the CSC slot. Flash the package and you are done. The phone was still rooted and any themes, etc., that had been bought from SAMSUNG's Galaxy Store were still there, too.

If you are lucky enough to live in a country/region where consumer protection laws, the general mentality or other beneficial factors prohibit big business from behaving like a digestive exhaust pipe opening, congratulations. In my case, SPAMDUNG decided to kick up the art of being a jerk yet another notch, by not allowing users to sign into their SPAMDUNG accounts on a rooted phone: every time one tries to enter the user credentials (e-mail address and password) for one's SPAMDUNG account, it goes to the Legal Information page with the terms and conditions. After accepting those, a field at the bottom pops up, asking whether one would like to use biometrics for identification. No matter whether one chooses «not now» or «register», a black square appears between the two possible answers to the biometrics question, informing the user that «processing failed», with an error message in the white field at the bottom of the screen ...

Account

Unknown error

(DataNull0/A300103)​

After briefly displaying the error code above, one is automatically transferred back to the login screen with the e-mail/password fields and can play this silly «login loop» game ad infinitum.

Some people who also had this problem solved it with an updated kernel, but they were using TGP ROM for the N960FD. Others used a patched SPAMDUNG Account file, but that, too, will not survive an update. Downgrading to a previous firmware version, where SPAMDUNG still allowed to log in on a rooted phone, is not possible, because SPAMDUNG does not allow downgrading any more ― attempts to flash an older firmware version with Odin, even for a different carrier that has not released a newer one, stop after a few seconds with an error message.

The nonsense is caused by the SAMSUNG Experience Service app, but removing it from the phone results in all kinds of error messages popping up left and right. While the SPAMDUNG Obedience Malice is on the phone, it will interrupt anything and everything with nerve-killing notifications every 10 min. to 1 hour as of the moment one enters the account credentials in an attempt to log in:

Samsung account

To continue using services securely, sign in again.​

These notifications cannot be turned off in any of the usual ways. On top of them, SPAMDUNG tries to manipulate the user to bring the phone to a customer service centre, because it has been «seriously compromised» and will «no longer function correctly».

Looking around on the Internet in search of ways to at least get rid of the nerve-killing notification messages, the advice is basically the following:

Settings | Developer Options | Running Services | Samsung Experience | Notification Listener | Settings | Notification Access | Samsung Experience => turn this off.

Settings | Apps | ⁞ (upper right corner) | Show System Apps | Samsung Account => turn off Notifications, uninstall updates

Navigate to http://findMyMobile.Samsung.com. Login, accept the terms & conditions, reboot the phone, voilà.

After the latest firmware update, none of these suggestions work any longer, because the respective options have been greyed out or removed entirely.

SPAMDUNG notifications for Galaxy Store apps are different than the usual notifications from Android apps like Fakecrook or Doodle, therefore they cannot be silenced through the usual notification settings menu. To turn them off, ...

Settings | Apps | Galaxy Apps | Storage => [Clear cache] and [Clear data].

Open the SPAMDUNG folder and the Galaxy Apps therein.

Tap the ⁞ 'hamburger' menu (three vertical dots ⁞ to access more options) in the top right corner.

Tap «Settings», then «Notifications» and slide the button to «off».

SPAMDUNG's notifications should now no longer bother you, but without being able to log into one's account, it is not possible to re-download any previously purchased fonts, lock screens, themes or wallpapers. During my experiments, I paid for quite a bunch of them to test different approaches, so this is a bummer and won't stand. :mad:

A possible workaround would be to backup all the acquired items before rooting the device, but this obviously requires access to the hidden \.root and .\system folders before rooting, so that they can be copied back to the phone after rooting it.

I have not had the time to investigate all angles of this new chicanery, but I am working on it and will edit this section with an updated guide as soon as a stable solution for all eventualities crystallizes, please bear with me. Any hints or pointers to useful information will be appreciated. ;)

​

G - Troubleshooting

- [This section is reserved in case that questions remain despite the instructions].

​

H - Acknowledgements

All thanks and credits go to the fine gentlemen who work so kindly on behalf of the community: BBB, BlackMesa123, Ibuprophen, Klabit87, Mentalmuso, Mkh Mourad, TopJohnWu, Team WRP, ZackPtg5, anyone I might have forgotten and of course, the friendly people who are now hopefully going to rearrange and correct the procedure, grammar and orthography in the paragraphs above. :D

​