[Samsung Galaxy Note 9 (Snapdragon) ROMs, Kernels, ] Qui Peccavit:
Custom TWRP Recovery and Magisk Root for the Samsung Galaxy Note 9 SM-N9600 - [1/2]

Please accept a sincere apology ...

... for the delay in typing up a résumé of the information contained in this thread. Live in third world democratorships has its particular challenges. Nevertheless, since there seem to be folks who continue to encounter difficulties with the rooting process, maybe a step-by-step guide can still be of some use.

The Problem

The many contradictory statements throughout this thread can make the task of flashing a $1000 device look daunting, and five-word answers without reference or background information do not help much to instil confidence either. Nevertheless, if an ignorant n00b like your humble servant could do it without converting our fool's brick into a literary one, so can you. ;)

On the other hand, formatting a tutorial in BB Code can lead to not seeing the forest behind all the trees. Consequently, if a child of a lesser god may be so bold as to call upon the technically brilliant minds to provide an equally brilliant tutorial, please do not hold back with your criticism and corrections of the procedure, grammar and orthography, to avoid having to answer another 600 posts before Android 10 Q is released. Your suggestions and improvements will be integrated here, enabling future readers to find all the relevant information in one place. Some moderator may want to consider moving this guide to the first page, enabling people to see it before having dug through 64 pages of the thread. :)

The Request

No flashing/rooting guide is complete without the necessary information on how to obtain security patches, updates or purchased apps afterwards. Your mileage may vary depending on the carrier/jurisdiction/region/country you live in and the firmware you use, but in my case, the latest security patch has brought new problems that did not exist before.

I am going to look into the matter as soon as time and workload permit it, but if somebody has already figured out how to do any of the following, sharing it would be a nice gesture:

Where and how to obtain OTA files for flashing in a reliable manner, i.e. sources like those for full firmware packages or the like.

The procedure for applying updates in a manner that preserves/reinstates the root privileges, installed apps and their configuration settings and data on the phone.

A way to backup anything purchased from SAMSUNG's Galaxy Store (fonts, themes, etc.) to an external SD card or PC before and without Root, in order to be able to copy them back when it is no longer possible to configure a SAMSUNG account or access the Galaxy Store.

There are ways to get the second and third point done, but I need to investigate and experiment more before publishing a solid solution that works reliably for everyone. If anyone has discovered a stable procedure or can provide pointers to relevant info on the topics, that would save me some of the legwork and thereby reduce the time until it can be updated below. :D

The Phone

The information in this thread is for the SAMSUNG Galaxy Note 9 with SnapDragon SD-845 processor and the model number SM-N9600. There are similar guides for the variants with Exynos processors and other models, but the files and instructions presented here will not work for them and vice versa.

All modifications to mobile phones require an unlockable bootloader. Devices whose bootloader is permanently locked cannot be flashed or rooted. This means that Note 9 versions produced for the North American market cannot be freed of their shackles. Consequently, the answer to questions à la «will this work on [other variant than SM-N9600]», for example the SM-N960U, is and will probably remain «no» — stop repeating the question. If you do not want to believe it or are hoping for a miracle, search the web for «[your model] [OS version] Root» every two months and create a separate thread for your particular device, instead of asking here.

With this clarification out of the way, we can continue on our path to developing a rooting tutorial for the SAMSUNG Galaxy Note 9 SM-N9600.

​

A - The Tools

The following hard- and software was used during the process. Some are optional, but in case you are interested in say, enhanced audio drivers, grab and copy them to the respective locations before you begin the procedure. Visitors who prefer to keep Android 8.1 Oreo on their phones can download the required software from the Download tab at the top of this thread's first post. However, since most people's phones are running Android 9.0 Pie by now, we will concentrate on Google's current operating system.

The hard- and software needed to free the SM-N9600 from the yoke of patronization by manufacturers and carriers is the following:

Hardware

An external microSD memory card, preferably one with A2 rating, plus (optional, to be prepared for all eventualities) a microSD card reader for the Mac/PC. Without Android NTFS drivers, the Galaxy Note 9 does not detect NTFS formatted media, therefore you want to full-format the microSD card to exFAT with an allocation unit size of 1 MB.

If your phone does not have a slot for a memory card on the SIM card tray, an On-the-Go (OTG) capable USB 3.1 memory stick with a USB-C plug might do. A phone's USB-C port only aliments low-power memory sticks; if you try to hook up a USB hard disk, it will need an external power supply.

A bi-directional USB-C to USB-A data transmission cable that is USB 3.1 Gen. 2 (or later) compliant. Never skimp on memory or cables; invest in high quality products and thank me later.

PC Software

GOOGLE's Android Debug Bridge (ADB). If you do not feel like installing the entire Android Studio, you will want to at least get its command line tools.

SAMSUNG's SamFirm firmware download tool.

SAMSUNG's Odin firmware flashing software.

Extraction tools for the .lz4 file format, such as 7-Zip ZS, Assayed's Kitchen APK, ROM & System File Editor, Brotli Multiplatform Plugin, Get File Compression,

LZ4 by Yann Collet, Lz4Tools, LZ4X by Ilya Muravyov, smalLZ4 or TC 4 Shell.

RarLab's WinRAR or another file compression software that can natively extract .img, .md5, .tar and .apk files. I bought my WinRAR licence 20 years ago for some 3.x version, and an e-mail to customer service was all it took to get it extended/renewed for 4.x and 5.x.

Phone Firmware and Recovery Files

The latest original manufacturer stock firmware for your device. Enter *#12580*369# in the phone's dialer, jot down the four strings and search for the AP or BL string, paying special attention to CSC when comparing the results. Download the firmware that is currently on your phone or the latest one that is available for it, making sure it is compatible with your device and telephone carrier. Carriers or regions are usually identified by three letters, eg. VNZ for Vodafone New Zealand. Once you found the firmware that's currently on your phone, you know which three letters identify the compatible versions and can download the newest one available for your model from the sites that appeared in the search results, or by entering your model and the carrier code in SamFirm. If you use SamFirm, make sure that [✓] Check CRC32 and [✓] Decrypt automatically are activated when downloading with this software, and allow it enough time to decrypt its .enc4 file format afterwards. You want a little more than twice the firmware file's size of free disk space on your hard drive before beginning. Enter SamFirm /? for command line options.

While a device is not yet supported by Team Win Recovery Project's official TWRP custom recovery, one needs a modified version that has been adapted to the particular phone. Download the file with «TWRP ... Recovery» in its name.

Patches against Manufacturer and Operator Harassment

A patched boot image that can be obtained from the WETA custom ROM project. Look for a «boot.img» or the file with «Kernel» in its name.

A few patches against encryption, Knox Guard, Remote Monitoring & Management (RMM), Device Mapper Verity (DM-Verity) and other harassment with which manufacturers and network operators glege their customers on Android 8.1 Oreo and 9.0 Pie.

A kernel security policy switch, either for flashing or as an application to toggle the phone's SELinux state between 'enforced' and 'permissive' mode.

Magisk Mask and the Magisk Manager app.

Optional System Enhancements

Optional: Init.d Injector (or app) (needed for some scripts/apps that depend on it).

Optional: enhanced audio mods and drivers, such as Ainur Sauron, Viper 4 Android, the Audio Compatibility Patch, Audio Modification Library and the JamesDSP Audio Manager to juggle them all.

B - The Preparation

The following steps are necessary for any kind of modification of an Android phone's firmware, independent of the extent and method chosen further on.

b01.) Ensure a proper and stable connection between Phone and PC

Before engaging in firmware flashing of any kind, verify that the cellphone and the computer recognize each other, because without a stable connection while using the aforementioned tools, something could go irreparably wrong during critical operations.

b02.) Set the Android Debug Bridge (ADB) up on the Computer

Set the Android Studio or at least its command line tools up as explained in the third and fourth post in this thread. Verify that the ADB Devices command is properly answered by the phone.

b03.) Set Lz4, Odin and SamFirm up on the Computer

Extract the compressed «Odin» package into a subdirectory like C:\Program Files (x86)\Samsung\Odin (or similar). Right-click on the executable file there and under the [Compatibility] tab of its Properties, check Run the program as an Administrator. Subsequently, create a shortcut to the executable file in the Windows Start Menu or on the Desktop.

Do the same with Lz4 and SamFirm.

b04.) Extract the original Firmware and Recovery Files

Copy any and all downloaded archives of original stock firmware as well as custom ROMs or Recvery files into a ...\Phone Firmware subdirectory on the computer. Create a second subdirectory ...\Phone Flashing as a working folder, to avoid mixing up all the very similar file names of extracted firmware. We will copy/extract the .tar or .tar.md5 files that are about to be flashed to the phone into the ...\Flashing subdirectory one zipped package at a time, deleting them after having finished working with a particular archive to make space for the next one, thereby keeping things clean and tidy. To distinguish phone firmware files from other compressed archives on your computer, you might want to assign custom icons to them.

b05.) Extract the relevant Parts for Flashing from the Firmware Archive

Extract the compressed firmware archive with WinRAR or a similar software, which will result in five files AP_N9600….tar.md5, BL_N9600….tar.md5, CP_N9600….tar.md5, CSC_…_…_N9600….tar.md5 and HOME_CSC_…_…_N9600….tar.md5. Extract the AP_N9600….tar.md5 file in WinRAR to obtain several .img.lz4 files. Decrypt the .lz4 files in order to obtain the original boot.img, oem.img/vendor.img and recovery.img from your original stock firmware.

b06.) Patch the Image Files for your particular Firmware ROM

Copy AP_N9600….tar.md5, boot.img and Magisk_Manager_v….apk to your phone (internal storage) or to its microSD card (external storage). On the phone, navigate to Magisc Manager and install it. Subsequently in Magisc Manager, where it says «Magisk is not installed», tap on the upper [Install] link, then on [Install] again and under «Select Method», on «Select and patch a File». In the upper left corner, tap on the three horizontal lines to "Open from" and browse to the location of the AP_N9600….tar.md5 file to select it. The patched AP_N9600….tar output file is placed in \storage\emulated\0\Download\magisc_patched.tar, which means that Magisk Manager installed Magisk to your boot image and stored it in Phone(Internal Storage):\Download\magisk_patched.tar. Now patch the boot.img, too, and then copy both files to your PC. If you cannot find the files via MTP, you can pull them with Android Debug Bridge: ADB pull /sdcard/Download/magisk_patched.img.

b07.) Set up the Patches against Manufacturer and Operator Paternalism

Copy all the .img and .zip fixes and patches to the topmost directory of the microSD card, the equivalent of E:\> or F:\> on a PC (where it would be called «root directory»; do not confuse this with «root» on a mobile phone). Copy the patched boot_magisk_patched.img there as well. To err on the side of caution, you may want to use a different microSD card than the one you have your programs and documents or cherished music, pictures and videos on.

Unless being told otherwise in particular cases, do not decompress the patches, leave them zipped. Magisk and any optional audio drivers, etc., go onto the microSD card, too. Owners of phones without a memory card will have to try using USB sticks via OTG if the phone's internal storage turns out to be inaccessible during flashing.

b08.) Enable Android's Developer Options

On the phone, navigate to Settings | About Phone | Software Information and tap the Build Number seven times, until a message tells you that «you are now a developer». An explanation of what the different options and settings in the Developer Options do can be found in these articles. Going back, you will now find a new entry Developer Options at the bottom of the Settings menu.

b09.) Unlock the Device's Bootloader

Back up whatever you deem worthy of being preserved, because this step will erase and reset everything on the phone. When done and rebooted, enable the Developer Options again, then navigate to Settings | Developer Options and tap on OEM Unlocking. Confirm that you really want to unlock the bootloader and then wait for the phone to restart.

Consequences: this will blow the Replay Protected Memory Block (RPMB) fuse and change the warranty flag to 0x1 (0x30C), but manufacturers cannot legally deny warranty if a modification is not what caused the hardware failure. Current Binary and System Status remain official, OTA updates work, no harm, no foul.

b10.) Enable USB Debugging and Media Transfer Protocol

When the phone is back on the Android home screen, navigate to Settings | Developer Options and set the Default USB Configuration to Transferring Files (Media Transfer Protocol, MTP). Activate USB Debugging and then check whether OEM Unlocking is still enabled. If the entry is greyed out or missing altogether, it means that the phone is in Remote Mobile Management (RMM) state «prenormal», making it impossible to flash anything unofficial to it, be it firmware, recovery, whatever. Only official ROMs can be applied during RMM prenormal state, which lasts for seven days. All fiddling around with the phone's date and time settings has been rendered pointless by recent updates, so find something of redeeming social value to do for a week. It is important not to turn off, reset or otherwise restart the phone during RMM prenormal, because if you do, the clock for uninterrupted uptime (Settings | About Phone | Status) begins counting from 00:00 again. Check after 168+x hours if OEM Unlock is back and enabled in the Developer Options; if that is not the case, consider yourself attached to SAMSUNG's wooden cross by inclined planes that are wrapped helically around an axis. There are people who recommend flashing (cf. below) first a combination file and then a non-provider specific (multi CSC) official stock ROM before trying again; make sure the files are compatible with your device and service operator, then giving it a shot won't hurt. When OEM Unlock is back and enabled in the Developer Options, you are ready to continue.

b11.) Starting with an original Stock Firmware

In case the firmware that is currently on the phone is not an unmodified original one (maybe a patchwork of previous attempts and experiments), flash an unmodified stock ROM first: launch SAMSUNG's «Odin» firmware flashing software on the PC. Connect a USB cable to the PC, but not yet to the phone. Turn off the phone and wait 10 seconds. Now, while holding the phone's [Volume -]+[Bixby] buttons pressed, connect the USB cable to the phone. When a light blue screen with a warning message appears, release the buttons and then press [Volume +]. A white down arrow indicates that the device is now in Download Mode. Another way to get there: connect the phone and PC via USB cable, open an administrator's command prompt in Windows and enter ADB reboot Bootloader or ADB reboot Download.

When the phone has entered Download Mode, the virtual COM port it is connected to will be highlighted in blue in the upper left corner in Odin. Click the Buttons one after the other and load each file into the respective slot, i.e. AP into AP, BL into BL and so on.

AP (Application Processor or PDA = CPU+GPU): Represents the system partition (think of Android partition); under previous Odin versions, this was called "PDA" and in practical terms, it means Android.

BL (Bootloader): As its name implies, this option is used to flash the Bootloader of the device.

CP (Core Processor, Cellular Processor = Cellular Modem): Used to be called PHONE and refers to the Modem or baseband processor (BP).

CSC (Consumer Software Customization): Specific to geographical region and carriers. It contains the software packages specific to that region, carrier branding and APN setting. The point of using the correct [URL="http://Dr-BIOS.com/articles/what-is-csc-csc-of-different-countries/6371]CSC[/URL] is to have all the things you need for your carrier/country, but nothing irreparable should happen if you don't have that and flash another. Nevertheless, when in doubt which firmware variant to choose, basing one's choice on CSC is often the best bet, followed by CP.

PDA (Personal Digital Assistant, Phone Dialer Application, Portable Device Application or in Google's greedy mind, Permanent Data Acquisition): PDA represents the "core" OS build, while CSC represents the region and carrier-specific customizations. The two, along with the "Phone" (baseband), provide an experience tailored for the region (eg. TUR = Turkey), such as available languages, preloaded apps, optimized cellular performance and battery consumption, etc. PDA was the previous term for what is now called AP.

PHONE Modem firmware file, parts of which are required to access the hardware. This is now called CP.

PIT (Partition Information Table): Only needed after screwing up the partition table or if the firmware specifically requires it because of a change in the partition table layout. Do not fool around with this, leave it alone. ​

There are two alternatives for the CSC slot: the HOME_CSC file leaves your user data intact, whereas the CSC file erases everything. For a clean and fresh start and since you backed up your data before unlocking the phone's bootloader, a clean slate using CSC is recommended. When all four files have been loaded, hit Odin's [Start] button and after the phone reboots, it comes loaded with a shiny original manufacturer's firmware.

Flashing original ROMs is possible even in RMM prenormal state. Once the OEM bootloader has been successfully unlocked and the seven days jailtime are over, we can continue with the next phase of project Freedom for the Galaxy.

​