[AT&T Samsung Galaxy Note5] Delgoth:
I started this thread awhile back in hopes to get more testers for the revision 4 bootloader. My other State of Root thread was originally based on BL Revision 3 anyways and just where we've released what root methods there are I'm going to eventually gear that more towards Revision 3 LP & MM status. I'm going to consolidate a bit of the later research in that thread here, specifically for rev4 so we can get a clearer vision of how to finish what we started 3 years ago.

Many Thanks go out to [MENTION=4770483]afaneh92[/MENTION] , [MENTION=9270077]xenomorph318[/MENTION] , [MENTION=9533319]Reverse-anastomosis[/MENTION] for helping me jump start this back up. Thanks to [MENTION=1949695]jrkruse[/MENTION] , and [MENTION=3812611]elliwigy[/MENTION] to giving me more ideas to get this going again. We might just be able to make this happen now.

****

So what I have is:

4APL1 Combo Firmware

1AOGG stock 5.1 fw (stock recovery mode speaks nothing of dm-verity)

2APB2 stock 5.1 fw

Rooted ENG UCE2APB2 boot.img

(looking for/getting) 4CPK1 stock 6.0.1 fw

4CQB2 stock 6.0.1 fw

These are the firmware files I am currently looking at. Before, we were looking primarily at Rev4 MM via dirtyc0w. But we never had safestrap back then. The Revision 4 bootloader supports LP, MM, and Nougat. And safestrap works on LP and Nougat right? So doesn't (can't it?) work on MM too? So couldn't we go from a rooted combo or stock 5.1 system with safestrap and flash over into a 6.0.1 build and retain safestrap? The HOME_CSC comes in handy in 6.0.1 flashing.

++ Now we have the option of potentially using a rom slot to do tests on a mirror dummy of the emmc. Don't be like me and try to mess with the partition table to /sdb with sgdisk, that's what deleted the bootloader on my g925v.

---- After we can get the 5.1 stock system booted for the rev4 combo BL, we can start to find out if we can flash the 2APB2 ENG Kernel through ODIN or if we will have to flash a safestrap package to get the LP Eng Kernel to boot.

=== Having the ENG Kernel Booted, with an sboot console also available, we would have a root shell to the AP & BL. There is a rev4 (combination, unbootable) recovery.img that fixes the DRK, that is supposed to also disable dm-verity. The Things in the system.img firmware are kind of copied into efs and param. As they don't seem to be populated until after first boot. But I see the .x509 FW key, and I also see A LOT of PEM certs on the FW too. Is it really hardware baked? Because it seems more like a lot of software checks in upgrade programs.

****

The end goal right now

is to put together a pre-rooted stock 5.1 system.img, that can be flashed via safestrap, that will boot on on the 4APL1 combo bootloader. I'm talking about getting the same result as afaneh92's N920V ROM What has also come up, is the ability to connect directly to the UART Console inside of the sboot.bin. This is great news. If xenomorph318 and Reverse-anastomsis can come into this thread and post their recent findings as well, we can really get this party started.

--- INITIAL CONCEPT ---

The system.img's are sparsed ext4 partitions. They can easily be unsparsed using simg2img, and then mounted on a linux pc. What I am looking to do this week inbetween work, is go back over these init.*.rc files and see how much they actually differ. I'm also going to try to modify enough to boot up a build in qemu if I can. I will then also try to build a safestrap zip for flashing. We've seen that this method is possible on the N920V and the rev5 N950U. It is my thought that the same can be achieved here.

Once we can get a stable driver going, we can begin working on a way to get enough leverage to upgrade our rooted stock ROM. Lucky for us we just might have DC access in the cache on MM. And having access to the cache can mean a lot of things when the system thinks it is updating. But I don't want to get too far ahead yet.

Since the sboot console can get full kernel logs we might be able to leverage that to pull out some full Remote Code Execution inside the sboot to get the eng kernel to work somehow. It's just that, having access to both a root system console and possibly a root sboot console, we can attain data that may just allow safestrap to unlock the bootloader like SS has been able to do in the past. There's always been a bit of speculation here, but so far a lot has panned out in the right directions like I'd hoped, I still need testers to come together on this project so we can leverage all of our knowledge. Lucky for us, 6.0.1 are on rev4 as well. We should be able to get MM installed with safestrap maybe now too. And from their we might really be able to leverage the exploits available to root MM builds as well.

/// DOWNLOADS \\\

SM-N920A FILES via GDrive.

About Android Bootloaders

Other documentation

N920A_NobleZero_rev4_ROM_v1.2.zip ( SS Flashable Zip, NEEDS TESTED, Based on 2APB2 FW )

\/\/

/\/ Re-Envision with Safestrap available \/\

Standby for more updates and uploads soon.