yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
I have successfully built a UART jig and booted to a s-boot console on the n920v. This has been done on a few different devices, so it isn't exactly a new thing, but as far as I can tell it has never been done on any exynos 7420 devices. I am still exploring what is possible, and if anyone has any additional guidance on what to do with this access I'm all eyes/ears! I'll attach the 2 logs that I have so far that I find the most interesting.

Idea time: could we fry our bootloader somehow and replace it with a more favorable one? Like for the n920g? External SD card boot is possible through the s-boot console I think, but we don't have an external SD.

I have a kindle fire that uses a bootrom exploit to redirect the loading point for the bootloader so that it will load unsigned firmware/recovery/kernel stored elsewhere on eMMC.

Booting unsigned firmware/recovery/kernel might be possible through use of the tflash option in heimdall, however again...no external SD. I have been able to flash a TWRP image in heimdall on my n920v, but couldn't get it to boot.

I am in way over my head, but I have done a lot of reading over the last few weeks. Given the fact that our devices are now no longer being patched, and exploits have continued to be discovered we should be able to figure something out.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
Forgot to attach them.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
One more pretty interesting log that I just grabbed.
[AT&T Samsung Galaxy Note5] Delgoth:
Tflash could possibly be helpful. Fry the BL to much will drop the device basically into edl mode. Which is weird on an Exynos SoC. Have only had two tests there. My g925v is still in 9006 mode now. My tests on 9008 mode dropped it into 9006 mode. Still bricked.

On my g925v the internal sdcard seemed to act as both internal and external SD cards to me a lot of times. We have no slot but the storage permissions still have to work somehow.

On the 4APL1 combo ramdisk I notice there is init.sec_debug.rc that calls the corehelper.sh script from /system/bin as root. Maybe we can modify the system.img and make the corehelper.sh script run our own commands by just setting a prop detail. We can still use /data/local/tmp to execute things.

But it looks from your logs like we could maybe change the kernel command line string from the sboot console. Meaning we might be able to set enforcing to permissive or change the debug level on a stock LP system. Or at least know where things will be loaded so that we can use safe strap to affect those areas as well.

It also seemed to show us the magic number for the Device Tree. I don't have time this morning. But I'll be back.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
[MENTION=3254678]Delgoth[/MENTION], I can't find the arguments to add to boot permissive. Do you happen to know the argument?

It will go as an argument on the boot command in the sboot console.

I bet I could force factory download mode on your g925v with my jig.
[AT&T Samsung Galaxy Note5] Delgoth:
I don't know it off hand and I'm not at my PC. But I've seen it before here on the forums used. There is a way to set selinux to permissive via the kernel command line.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
Our devices should be vulnerable to this exploit.

https://www.google.com/url?q=https:...FjADegQIBxAB&usg=AOvVaw2-cc6gIXIrOjEJzxzd2Ebo
[AT&T Samsung Galaxy Note5] Delgoth:
I haven't seen that pdf in a long time. And I don't think you're wrong. Going back and looking through the beginning of the State of Root thread, I realize that many of the failed tests were not done in the correct order now. How I would downgrade was by flashing the rev3 combo firmware via ODIN, I would reboot directly back to download mode without ever letting recovery or system ever boot up once. And then I would flash the rev3 actual eng boot, then reboot directly back to download mode, and then flash the the AP and CSC file of the Stock LP firmware I wanted (1AOGG). After I let that boot up I would go back to download mode and flash the 2APB2 root eng kernel. Then everything would work and you just had to setup SuperSu manually via the CLI (Which I probably still can't do....).

I don't know if anyone actually has tried Flashing the 4APL1 Combo firmware with nand erase all, and then tried to flash an AP file from 1AOGG. I saw people trying to downgrade from stock bootloaders and failing. Which is expected. Generally trying to downgrade param.bin or cm.bin or sboot.bin will result in errors. Can you flash just the AP file from the combo? What about flashing the AP directly after flashing the comfirmware without it booting? Because I guess I still can't be positive it was an eng rev3 sboot or if it were the nand erase all and flash/boot order. Then I typically used the 2APB2 Eng root kernel while using the rev3 combo firmware at the same time through odin. Because the ENG Kernel was an LP Kernel like the combo firmware.

I'm in the process of pulling relevant posts into this thread's OP for consolidation.
[AT&T Samsung Galaxy Note5] xenomorph318:
[MENTION=3254678]Delgoth[/MENTION] O_O Very exciting!! I just got free time and you know what i have to do tomorrow?!? Not 1 thing. I havent read your updated OP yet, I bout came out of my skin when i skimmed over it. Tis where im headed now and will definitely share what crazy stuff i get into.

Update

Hyped!! Ive got safestrap ready togo on rev 4 combo and even made custom rom slots ha, im flashing everything. I actually flashed gapps and doing all this from factory binary lol . I got Csploit running in root but it wont run the Metasploit rpcd server unless u flash gapps. Ofcourse you cant download and install from google play but adb doesnt mind!!! xD
[AT&T Samsung Galaxy Note5] Delgoth:
Cool. I think I found the two libraries we for a stock system image. I will try and make one up this afternoon and posts the steps to do it yourself as well because I might not do it right the first time. If you got all that working can you flash the 2APB2 eng kernel via Odin or use safe strap to flash it and still have the combo firmware boot? I've been able to get bad kernels to flash before on rev3. Once I actually got a boot error that said invalid kernel header but still managed to flash through Odin.

I have the eng 2APB2 tar file in my sm-n920a files link in the OP. If it doesn't flash over the standard 4APL1 combo firmware or boot, maybe we need to use the 1AOGG recovery.img or the special 4CQB2 recovery.img for drk fix.
[AT&T Samsung Galaxy Note5] xenomorph318:
Yup yup i have done it before just to see if the root install script and the root boot script method would work for me and it did!

I just tried again to dbl check and yes again. I did it via odin I will try it via safestrap in just a sec to see if it will work that way as well. I have everything staged, i dont have a sd card at the moment :(
[AT&T Samsung Galaxy Note5] Delgoth:
The metalcated root method is a tethered root method however. The way Wondershare Mobile Go does it must either setup SuperSu correctly. Which I couldn't tell you, or it uses exploits to untethered the root. On my old rev3 device with 1AOGG AP file, eng 2APB2 boot.img, and 3APH1 eng sboot.bin installed the metalcated root would still only give me a tethered root as well.

But are you saying the PB2 eng kernel flashed successfully via ODIN using the 4APL1 combo?

Because while the PB2 Eng Kernel has a root shell by default, it is stuck in SELinux Enforcing mode if I remember correctly. You actually have to setup root to switch to permissive persistently. Where the combo kernel is not rooted but is default set to permissive.

So the rev2 eng kernel still works on the rev4 combo firmware? This makes a difference to me and how we will setup flashing a stock system image over the combo system.

[MENTION=9533319]Reverse-anastomosis[/MENTION] which firmware have you been using your jig with? And have you tried using the Eng Kernel to see about different output to your console? Which commands have you tested? I'm looking into the console so I can flesh out its information in the OP. Hopefully we can even get instructions for making one too. We have something going here, we can keep the momentum going.

Right now I only have you two to help explain what I'm talking about and test it specifically. Im working on a test system image right now.

[MENTION=9270077]xenomorph318[/MENTION] once you have the combo firmware installed and then flash the pb2 eng kernel, can you go back to ODIN and flash the stock AP (MINUS boot.img) File from either 1AOGG OR 2APB2? I used to be able to on rev3.

** CAN BOTH OF YOU ZIP UP YOUR /cache/recovery directories SO I CAN LOOK AT YOUR LOGS PLEASE PLEASE PLEASE **
[AT&T Samsung Galaxy Note5] Delgoth:
androidboot.selinux=permissive

And looking back over that PDF you linked, I feel like that was the R&D done to intially unlock the G925V that was quickly patched up. That was the original root and only BL unlock on the G925V if I recall right. So we might be patched, but it didn't take long to be officially patched and was on the Rev1 BL. But again, you now a whole new level of access.

Here, https://alephsecurity.com/2017/05/23/nexus6-initroot/ , we can find other arguments to test in the sboot console for the kernel. I'd bet some of this works. Seems the eng kernel works, maybe the commandline options there are better utilized. You've got me thinking now. I'm glad you're here right now ready to go. We might not be applicable to this exploit, different OEM, but they don't have a direct console to the bootloader either.

(For a stock bootloader if it loads the console) * buildvariant=userdebug
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
[MENTION=3254678]Delgoth[/MENTION], I'll try this tonight. Then I'll write up everything that I have tried/know, in detail. I'll post it tonight of tomorrow.
[AT&T Samsung Galaxy Note5] Delgoth:
Please and thanks. Please if you could also include your recovery logs from /cache/recovery. Either post them here or send them to me privately. But I'm looking for the things I see in my Note8's recovery logs, which we could affect to our great benefit with the eng kernel and sboot console here.

https://developer.android.com/things/sdk/pio/uart

This link could also be applicable to your jig. If we can get an app that will utilize the UART port, then maybe we could have realtime communication with a root system and the sboot. Farfetched and for later of course.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
So I was doing some digging, and found this video. Have you seen it?

https://m.youtube.com/watch?v=QpaeneaNEbw
[AT&T Samsung Galaxy Note5] xenomorph318:
give me 2 hours i'll be home by the pc to flash on odin again

but yes im 100% sure the rev 2 pb2 eng kernel flashed over the top of PL1,

here is the recovery directory u asked for after a fresh flash of the rev 2 LL eng kernel

sorry its taking me so long, i cant find a site that doesnt cap my download speed but i will have the pb2 stock downloaded in like 50 mins
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
I am working with a n920v right now. I will have access to a g925v at some point in the next few weeks. I think for the s-boot research that is doesn't matter though.

1. My Jig

USB to serial converter-purchased on amazon.

A 5 pin male micro USB

A 1M ohm variable resistor, but I think a single 619k ohm resistor would be fine

A 5 wire cable-I used a USB C cable, but anything will do

Pin 1=red=vcc-this does not need to be hooked up for us

Pin 2=white=D-=rxd

Pin 3=green=D+=txd

Pin 4=blue=ID

Pin 5=black=ground

The resistor goes in between pin 4 and 5.

With the jig built, plug in the adapter and open a terminal. I am using lubuntu, I know nothing about serial devices on windows or mac. I am using minicom and it works fine.

sudo minicom -s

serial port setup

A

/dev/ttyUSB0

F(To disable hardware flow control)

exit

Plug in the phone, press and hold vol- and power until you see output on the terminal. Press enter on your keyboard until you see the s-boot prompt.

I was inspired by this blog post, but couldn't find the 2nd part. I just found this video, which is a presentation by the author of the hexdetective blog. The video goes into detail about the exploit. It seems like the console commands are probably not very useful to us, except as outlined in his exploit, or perhaps in combination with the link that [MENTION=3254678]Delgoth[/MENTION] posted.

I initially started with the setup that is outlined here. I flashed the combination firmware, eng kernel, safestrap, and the noble rom. I was messing around with the md5 function in the s-boot console and softbricked. Got it into download mode and flashed the full nougat firmware cqb9. The s-boot console still functions exactly the same as it did on the noble rom with eng kernel.

I'd like to get rooted again, but wondershare is such a pain. Do you know of any way to get around the trial period? I have just been doing a system restore to fix it, but that is a huge pain.

Memory Dump

I found these 1, 2, programs that should work. I have not compiled or tried either one yet.

Here is my plan at the moment.

Make a flashable image that contains recognizable code eg. "123456789abcdefg"

flash it in heimdall. It will fail, but thats OK it should still be loaded into ram

Dump memory to find out exactly where heimdall loads the image before flashing

use heimdall to flash the initramfs from the linage build for other note5's

Enter s-boot console and load the kernel, boot the kernel with instructions to load initramfs from the location where heimdall uploaded it.

have a booted kernel and system with a temporary, but full ADB root.

Convert to permanent root somehow......

IDK, it is a work in progress.

Edit: [MENTION=3254678]Delgoth[/MENTION] I tried the kernel param to make SELinux permissive, but it gets reinitialized by init when the system boots. (or something like that, I can't remember everything I have read and attempted to absorb too much information that is over my head lately) anyway, it didn't work.
[AT&T Samsung Galaxy Note5] Delgoth:
I will take all that into consideration then. I really haven't been able to do much today because I've had the worst migraine ever after last night.

As far as MobileGo goes, I don't know of hand. But all we would have to do is setup SuperSu in the same manner as far as file placement and ownership + context.

I just don't know how it changes the system versus how metalcated's root changes the system.

Thank you for your hard hard work. And maybe this will only take another couple weeks to iron out. I'll go over the heimdall idea some more and see if I could find some more insight for it.

As far as I know, hexdetective never actually posted part 2. I think they intended on it, but probably ran into some road blocks or didn't want to spill too many beans at the time. That was when security had just started to be the big deal it is today. The tutorial for the cable looks good enough for me to maybe make a cable for my Smartwatch too.

I opened up a stock system image and was able to modify it. I haven't made it into a flashable zip for safestrap and it might take a bit to upload. So that will probably have to be tomorrow now.

I don't know that I would try and go full lineage yet. I wanted the recovery logs to look for memory addresses that could help with using the sboot console. OTA recovery logs tend to help in that regard. Especially in later android builds.

It is interesting how the eng kernel still works on the combo pl1. That means they must have some of the same signatures, or that dm-verity really is mostly off. Either way, it presents to us a SW Rev check bypass. So maybe it is possible to really change up the system img after it has been flashed through safestrap.

The n920a has full adb root using the eng kernel. And the combo kernel then has permissive enabled. So if we can use the eng kernel to setup a modified root system, we could probably have the combo kernel load the pre rooted system with permissive and let it stay.

It would be nice to see if each of the sboot console commands had a help section in them. Or usage text. How did the MD5 function end up softbricking the device? Because there are bunch of read commands there it seems. And in the recovery logs xenomorph posted, it looks like the kernel command line actually does set selinux to enforcing, which could possibly be turned into permissive if that is what sets up enforcing in the first place.

What I do know is, the 4CQB2 drk/dm-verity fix build I downloaded has its permissions set to 777 in the tar file. Where the stock build doesn't. I've only seen that happen on eng/rooted FW. Maybe the drk 4CQB2 recovery image would really allow a dm,-verity bypass without the need for everything else. Let me try and put together this flashable zip over the next couple days. We should have some good tests ready to go by this weekend.

Didn't the N920V sboot say it was from Sep 2016? the 4APL1 sboot is from Dec 2016.
[AT&T Samsung Galaxy Note5] Delgoth:
[MENTION=4770483]afaneh92[/MENTION] [MENTION=9270077]xenomorph318[/MENTION]

So my problem is right now, I'm not sure how to make up the SS flashable zip. I looked at afaneh92's SS zip, and I kind of get it, but you actually setup SuperSu a lot different than I was thinking about doing myself.

I was going to pre-root the stock system.img and copy over the two shared libraries (.so's) and see if the system would boot on either the Eng Kernel or Combo Kernel. I've been going over the location and perms/SELinux contexts the files need to be inorder to work. As they worked for metalcated's root method and [MENTION=1949695]jrkruse[/MENTION] setup his pre-rooted system image that way for the N950U pre-rooted system with SS on Nougat. A system root. I know you told me afaneh that we shouldn't just flash the stock system.img, so does that mean I can extract it, add the files to the places they need to be at and then just leave it be? Or do I have to go the same route that you did with your zip? I really want to get xenomorph318 something to test, and this is the exact point I was at on Rev3 but couldn't see it through because I couldn't figure out the method of injecting root manually.

afaneh92, your SS zip looks pretty involved, and I'm wondering how did you get all that? Would I have to do it the same way for it to work? That SuperSu zip you have in there is different than any one I've really ever looked at. After downloading your NOBLE ROM zip, I feel like I'm doing it wrong or something.

Because on the N920A we have an ENG Kernel with full ADB Root. Meaning we should be able to place all the SuperSU files manually into the system image while booted, this typically would trigger dm-verity to restore the system on reboot, but if when we shut down and flashed the combo kernel before the system restore was triggered, shouldn't the permissive SELinux of the combo kernel allow the modified system to boot?

I'm asking because, if we root the combo firmware and then use SS to flash a pre-rooted system image, shouldn't that work as well? Please tell me what tidbit I'm missing here. PLEASE!
[AT&T Samsung Galaxy Note5] Delgoth:
[MENTION=4770483]afaneh92[/MENTION] [MENTION=9270077]xenomorph318[/MENTION]

So my problem is right now, I'm not sure how to make up the SS flashable zip. I looked at afaneh92's SS zip, and I kind of get it, but you actually setup SuperSu a lot different than I was thinking about doing myself.

I was going to pre-root the stock system.img and copy over the two shared libraries (.so's) and see if the system would boot on either the Eng Kernel or Combo Kernel. I've been going over the location and perms/SELinux contexts the files need to be inorder to work. As they worked for metalcated root method and [MENTION=1949695]jrkruse[/MENTION] setup his pre-rooted system image that way for the N950U pre-rooted system with SS on Nougat. A system root. I know you told me afaneh that we shouldn't just flash the stock system.img, so does that mean I can extract it, add the files to the places they need to be at and then just leave it be? Or do I have to go the same route that you did with your zip?

afaneh92, your SS zip looks pretty involved, and I'm wondering how did you get all that with the update-binary and update-script? That SuperSu zip you have in there is different than any one I've really ever looked at. After downloading your NOBLE ROM zip, I feel like I'm doing it wrong or something.

Because on the N920A we have an ENG Kernel with full ADB Root. Meaning we should be able to place all the SuperSU files manually into the system image while booted, this typically would trigger dm-verity to restore the system on reboot, but if when we shut down and flashed the combo kernel before the system restore was triggered, shouldn't the permissive SELinux of the combo kernel allow the modified system to boot?

EDIT: After actually picking up the Super R's Kitchen for once on Linux, I realize it really does do most of the work though, and was the answer to my questions kind of. So I will attempt the kitchen method first. Safestrap is still the reason it will work though. [MENTION=4770483]afaneh92[/MENTION] looking at our zips side-by-side I think I might have it. But I did mess it up the first time like i thought.
[AT&T Samsung Galaxy Note5] afaneh92:
My ROM built via superr's kitchen, plus some modded the installing config file to get every thing work, Im using system mode supersu.

---------- Post added at 06:53 AM ---------- Previous post was at 06:49 AM ----------

We have full adb root via eng kernel on N920V.

I got N920P with broken screen and replaced the board and battery (mine currupted), so I have an unlocked bootloader board now.
[AT&T Samsung Galaxy Note5] xenomorph318:
[MENTION=3254678]Delgoth[/MENTION] I'm back!! , I kinda been MIA for a day or so. I'm playing catch-up right now, going back through the thread from start to finish. Also will have the results flashing of the APB2 rom within the hour.
[AT&T Samsung Galaxy Note5] Delgoth:
Well then if it doesn't work this time, we might need to mod the install script then like afaneh92 said.
[AT&T Samsung Galaxy Note5] xenomorph318:
Alright so i just flashed it in safestrap moments ago. But it failed , It had the

Built with SuperR's Kitchen

Checking config ...

location argument to mount ( ) can't be empty

Updater process ended with ERROR : 7

Error installing blah blah from blah blah

Buuuut I didnt know if i should wipe system or whatever, just wasnt sure, I got ahead of myself cuz i finally got some free time I guess. So i made a rom slot and flash it there. Flashed perfect, booted even, saw the pretty Samsung splash colors but it froze at the white att splash screen. i could be doing something wrong, I just woke up not long ago and headed straight for the pc. Im gonna fiddle some more here very shortly. I could have missed something important I didnt read or something. If i made it to the samsung screen I shouldnt need to flash that PB2 eng kernel or anything yea? By then im passed all the init and kernel stuff I'm sure. It was sooooo close man i could taste the Lolipop.

Ok so still got the same error on stock slot after wiping system but yet still will flash on another rom slot...So started over completely with fresh PL1 combo flash then root then flash safestrap. Once in safestrap i still have to flash over new rom slot but it flashes great, SuperSU installer and Busybox both end in success, Im just gonna let it sit on the ATT logo/splash screen for a while...

adb devices registers and also can get root shell while frozen(allegedly) at att screen
[AT&T Samsung Galaxy Note5] Delgoth:
Well if you flashed it to a slot then that's good because wiping system not in a slot might make you have to re root and all. Afaneh said he had to modd the install script for the zip after the kitchen made it. The libs might be wrong. I copied libsigchain and liblptcp hopefully that's all.

You should prolly wipe data after flashing. Hopefully that doesn't kill safestrap. But in a slot you should be safe I think.

I'll look over the script some more after work this afternoon.