yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note5] xenomorph318:
Yup in another rom slot its a flawless flash. I made sure to wipe afterwards because that was in the directions for NOBLE ROM . I do the standard wipe data/factory reset that twrp offers. Still stuck on the white ATT splash/logo screen.
[AT&T Samsung Galaxy Note5] Delgoth:
I wonder if there is a log created at that point that would tell us where the boot is failing. How long did you let it sit at the boot screen? Sounds like classic bootloop. I wonder if the eng kernel would make a difference or not then.

Maybe I should copy all the libs found only in the combo fw that aren't in the stock system instead of just those two. Because libsigchain.so is in the stock but I overwrite it with the one from the combo. Liblptcp.so was only in the combo. But there are a few other libs found in combo that are not present in the stock. I can't look at it for a few hours yet.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
I found some advanced logging capabilities hidden in an app in my combo firmware. I'm going to try to extract the apk and see if I can get that functionality on other firmware. It doesn't require root, but the combo selinux is permissive so we might run into problems there. Hopefully I'll have time to work on that today.

[MENTION=3254678]Delgoth[/MENTION] the recovery log that you are looking for, do you care if it is on a clean flash? Or what firmware or kernel?
[AT&T Samsung Galaxy Note5] Delgoth:
Well in xenomorphs case the logs while his phone is boot looping. The clean flash log is good and all. But having installed a stock rom first and then the combo would allow safestrap to pull the stock recovery logs as well as the combo fw logs. The stock logs would help as well. Seeing the log where it flashed alright but then failed to boot would be awesome.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
He said he was able to get a root shell while it is stuck. The app logs to SD card, so hopefully we could get in with adb and pull the logs.
[AT&T Samsung Galaxy Note5] Delgoth:
But which app are talking about? And what bootloader do you have installed while you are testing. Because won't your BL be locked again by flashing an AT&T or Verizon bootloader? Because really, if we use the ADB Root of the Eng Kernel, couldn't we install Safestrap that way? And then flash the Busybox & SuperSU zips from SS to root instead of MobileGO?

And couldn't FlashFire flash the recovery image from the 1AOGG FW that doesn't use dm-verity either?
[AT&T Samsung Galaxy Note5] Delgoth:
Looking at our scripts though, I can't really tell much of a difference, except that the two carriers have almost completely different system apps. So I'm not quite sure yet what I would need to modify the updater-script.

Although you say that it errored out on a mount command. It says directory empty, but is that because the combo kernel doesn't have root baked in like the eng kernel? Because you got through the busybox and supersu zip install successfully, so we then moved on to booting all the way into what the system thinks should be a carrier stock system. I wonder if it has to do with the the factory binary not having a Real CSC installed like a stock rom would though. Did you use Nand erase all in ODIN when you went from a stock 6.0.1 rev4 FW to the 4apl1 factory binary?

You still said it flashed in the rom slot but not in the normal stock slot? And it errored on the stock slot at a mount command. I would at least try the eng kernel then if you haven't yet. Because apparantly there is no revision check on that image then for the combo FW. You can flash a rev2 kernel on the rev4 combo FW.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
I was referencing the app that has the logging feature on the combo firmware. Bootloader is still locked. Flash fire works. I can even flash twrp to recovery, but it won't boot, I can't remember the message, but it says something like "rebooting to avoid tripping warranty bit"

The engkernel that I have been using will allow a root shell from adb, but freezes when attempting to remount system as rw. AFAIK that was never overcome.

COMBINATION_FA51_N920VVRU3API2_CL7082958_QB10844657_REV00_user_mid_noship.tar

I'm in the middle of testing something in the sboot console,I'll try to remember to grab the logging app next time I boot up.
[AT&T Samsung Galaxy Note5] Delgoth:
I remember that part now though. On the rev3 combo plus eng sboot and eng kernel, was changing basically the fstab. I didn't remount it at RW. but I remounted it as is with just different options. Like in the fstab where it declares nosudid ,etc. (maybe I just remounted nosuid and it turned it off?) but after i remounted using different options than just rw initially, I was able to move a linux aarch64 su into the system and get an unstable root shell. It didn't always start. I didn't have to remount RW only necessarily. But after the options changed I was able to affect the system more with the root shell of the eng kernel. I did have it work one time but I wasn't sure what was up and I flashed before I finished it all the way through.
[AT&T Samsung Galaxy Note5] xenomorph318:
Honestly Im not sure if I checked Nand erase all in ODIN when I went from stock 6.0.1 rev4 FW to the 4apl1 factory binary. I believe the last time I checked that box was bout a week ago when I tried out the droidvoider method so I could fool around on that, but other than that I never really check that box. Now here lately Ive been using so many different versions of ODIN on so many different phones, maybe one of the versions comes with the box already checked??! I can start from scratched again if you like with a fresh nand erase into PL1 factory binary and go from there if you would like? Righ quick tho Im gonna flash the APB2 eng kernel and see if i can boot passed the att logo. Oh btw, I think i sat on the ATT logo screen for 20 minutes maybe then my fone died. I can let that sit longer to if you would like. I remember I could occasionally hear it vibrate to btw.

But yea just lemme know what u want done exactly and I'll do it man, cuz I know between all the flashing Ive done and how much tiny minute things actually matter, the error is possibly on my end. I couldnt tell you how many times Ive been stuck in bootloops just like this and come to find out it was cuz i checked or didnt check a box or wipe then flash or flash then wipe or something like that lol.

And yes, so far in every scenario, flashing on stock rom slot fails at the very begging when it attempts to mount. Not 1 time has it made it passed that. I even made a twrp backup while in the custom slot, then switched to stock slot and try to restore the other rom onto the stock slot. That ended in "error system is read only". On the other hand, the custom rom slot always succeeds. Its starts with the

Built with SuperR's Kitchen

Checking config ...

and continues on into SU installer script and the Busybox installer script and completes without error. Now when a Rom slot is created, what all exactly is it a clone of? I know its basically a standard emmc clone, but between the two slots, aside from there not being an OS, what is differece? Looking at it like that it would seem that not being able to flash on the stock slot but being able to flash on a custom slot and the two are clones, the stock slot would need something missing/taken out for the ROM flash to go correctly like it does on the custom slot. Sorry i tried to say that in the easiest way possible as to not confuse but still get my question across
[AT&T Samsung Galaxy Note5] Delgoth:
Were you always on the combo kernel in this case?
[AT&T Samsung Galaxy Note5] xenomorph318:
You mean when i recieved the phone? Negative, I got it 2nd hand and was told it was broke. They just didnt know what they were doing so i booted into recovery and downloaded the exact same build and flashed it. Then afterwards got root curious and discovered these threads. thats how i ended up on combo pl1 and stayed there

lol i misread your reply,

During the flashing tests yes. never left the combo kernel
[AT&T Samsung Galaxy Note5] Delgoth:
The combo kernel shouldn't be able to normally mount /system in shell though. I feel like I'd have to get the n920a stock rom afaneh92's is based on and try to make one out of that to see how he modded the install script. It might or might not be the same for the n920a.

Their factory seems to be built in September 2016 on the n920v. It is probably still vulnerable to dirty cow. 4apl1 I don't believe is because it was built later.

I will look over the two rom zips some .ore as the night goes on.

I might be able to make my own for the note8 using this method. And I can test that device. I never had much luck using any of the modded Odin's on my rev3 n920a. Stock ODIN did the work. 3.10.7?
[AT&T Samsung Galaxy Note5] xenomorph318:
[MENTION=3254678]Delgoth[/MENTION]

Started over. Did a fresh flash of PL1 combo , then SS, then your rom. I'm leaving this phone at the ATT logo longer than 20 mins this time, plugged in this time as well lmaooo. I'm at the splash screen with root shell. If you need me to do anything just lemme know

---------- Post added at 02:16 AM ---------- Previous post was at 02:04 AM ----------

I havent tried 3.10.7 Should i look into that?? The odin that is in the metalcated files is the one I have been using mainly.
[AT&T Samsung Galaxy Note5] Delgoth:
I didn't even check at first. The build prop the kitchen made is different than the stock or combo rom. I don't know that we can change that all up like that before first boot. And I didn't include the cached CSC either. So that might be why it stuck at the AT&T boot instead of the samsung. I'm going to create v1.2 tonight. And I'll have a new upload ready soon.
[AT&T Samsung Galaxy Note5] xenomorph318:
Great I'll check back in a few, I'm gonna keep riding this att logo until then lol

[MENTION=3254678]Delgoth[/MENTION] [MENTION=9533319]Reverse-anastomosis[/MENTION]

Well its been on the ATT logo for almost a couple hours now. Still, throughout this whole time, I have had root shell. I even did a dmesg just to see what was going on, should be posted below.

Now i know its not a pc but its still debian so it could be helpful.

I dont really know the hardware like you guys do but there is some checksum the keeps failing and a init set group id that fails too. Now again i dunno if its anything significant to us, but i was just "cd-ing" and "ls-ing" everything in root shell hoping to find a log of some sort but dmesg was the best i could think of off top of my head unless one of you's know something a little more accurate than that.
[AT&T Samsung Galaxy Note5] xenomorph318:
After some digging in root shell then more digging thru filemanager i noticed the /datamedia/log folders were different according to which slot i was in and then afterwards when i was back on the stock slot i noticed a folder in /sdcard labeled log, i dont generally remember logs being dumped there, but inside was a folder labeled Flog_SAMSUNG-SM-N920A_0915f95563523d02 so i zipped it up too. But these were all the logs i could find. :P

Had to split the customslot logs into 2 separate zips due to file size
[AT&T Samsung Galaxy Note5] Delgoth:
I have about 15 minutes left on the upload for the new ROM. This time i started fresh made a flashable zip. extracted added the libs from the combo and copied the build prop from 2apb2 and included the the Cache CSC. I hope it works this time. I'll go over the logs. You prolly had a root shell because the root zip worked and the combo recovery has adb access all the time I think even when off sometimes.

Not including the CSC Files and original build.prop is probably what did it.
[AT&T Samsung Galaxy Note5] xenomorph318:
After uploading all those logs I finally decided to give that a shot. So in the custom rom slot I flash the eng kernel, but i flashed it over the top of ur rom in the custom slot. It boots straight to the combo firmware lmaooo. So now i 2 rom slots that boot independently to the combo firmware. I say independently not only because safestrap is still reachable, but because of the rom slot labels and the safestrap splash screen being enabled/disabled at boot.
[AT&T Samsung Galaxy Note5] Delgoth:
[MENTION=9270077]xenomorph318[/MENTION] So you can flash a boot.img or recovery.img through safestrap and it knows how to handle how to split up and extract the data to the right partitions? Upload is ready im getting the link and putting back in the op. I keep bringing up the eng kernel, because I think the eng kernel could still have DC exploited where the combo kernel is most likely patched due to the build date, and it is also the same kernel for the system image the rom is based on.
[AT&T Samsung Galaxy Note5] xenomorph318:
See thats what im not sure about, cuz twrp lets you pick where you want to flash i.e. boot,system,recovery. This is the first i have done it in safestrap, but it didnt let me choose, i'm guessing it picked what it thought was best. it flashed over system tho. And another thing, all i did was add a ".img" on the APB2.tar cuz SS wouldnt pick up the .tar

edit---- I take it back, i have flashed a system.img before in SS and it made me flash over system there too so i dunno if it always makes u flash system or what.

---------- Post added at 07:55 AM ---------- Previous post was at 07:43 AM ----------

Hey bro if you got faith in the eng kernel like that then so do I lol. I'll post the results of a fresh flash of PL1 combo into SS then flash NobleZero shortly. shouldnt take long to download.
[AT&T Samsung Galaxy Note5] xenomorph318:
[MENTION=3254678]Delgoth[/MENTION] Ok so flashing over the stock slot has the same error as before. I didnt notice this before and im not sure if its suppose to occur, but after creating a new rom slot, immediately after it activates the rom slot it says

Flashing over a new Rom slot, the flash succeeds. The enabled safestrap splash image pops up, but after hitting continue it goes dark for bout 30 seconds then reboots into stock recovery. Then if u select reboot system from there the process starts all over again. before leaving recovery i see red words at the bottom, something about unmounted something, it goes too fast. I will try flashing diff ways again tomorrow when i wake up

btw: back in safestrap when you go look at the rom slot it says the partitions sizes and whatnot. but the are basically empty cuz it has the available space right beside the partition name
[AT&T Samsung Galaxy Note5] afaneh92:
Slot roms not working on arm64 devices for some reason, still work on it!
[AT&T Samsung Galaxy Note5] Delgoth:
Wow, that sucks then. So are you saying you actually got further in the boot process with the first version I uploaded? Maybe the zip needs opened up and extracted. It should have the whole 2APB2 system in it, with some libs from the combo. If you extract the combo firmware as well, you can add other files that aren't in the stock system, and then repackage the zip. It would save time redownloading the same system everytime. I'm still trying to figure out what it is making it not flash then.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
[MENTION=3254678]Delgoth[/MENTION], I'd be interested in playing with frying bootloaders, I don't really want to fry a functional device. Would you be interested in sending your fried 925v to me for testing? The muic should be unaffected, so hopefully I could get somewhere with my jig?
[AT&T Samsung Galaxy Note5] Delgoth:
I like where your head's at. I plan on watching the video as well. What makes me hesitate is that I'm not a C language Kernel Programmer. I went to school for CompSci, and know a decent amount about quite a few languages and topics yeah. I basically have a 100 page M.S Thesis in true 2-Way BCI's written but haven't gone back to school in some years. Logic & Design are my strongest suits. I can visualize code and flowcharts very well. But I also didn't grow up in Linux even though we used it in school. My biggest claim is that I once spent 2 days compiling a stage 1 gentoo distro from source with some help in IRC. I know some things, but back in the S1-S3 days we didn't actually need Linux to do most of this. And I've only had one or two Androids that weren't a Samsung Device.

I'd say let unsigned code be the second phase maybe, given where we've said we're at. What would be easier to begin the process with, I feel, is getting supposedly "unacceptable, yet signed code" onto the device. Because the Signature Checks are a whole different ballgame to themselves, and not the entire process. If we could manage a way to get still signed code onto the device in places where the devices tries to prevent it, we could see how successful that part is. We could see where our code injections actually works. Because if we used unsigned code, we might figure out how to place it on device, but wouldn't know it, because it still wouldn't boot you see. We could exploit the device all day and actually manage to get our data where we wanted, but that is still only half the battle. And at the point, the unsigned code wouldn't boot and we might think our method just failed altogether. Once we have injection, we can further study the Revision. That's my two cents though. Unsigned Code (or dev signed) is the ultimate goal in XDA's case I suppose. But I feel starting with that might be harder. Because if we can manage to roll back signed code, then we should be able to get unsigned code with a few more checks and balances after that no problem.

But you're right like I mentioned. TWRP, Magisk, and Lineage. Because of that, is how OEM's know where to steer their devices to be incompatible, because there's no real method competition. So they know what they are working against. And those methods have been geared specifically to AOSP devices and General Chipsets.

How did you play with the checksum value specifically? I've seen on another more hardware focused forum about getting passed the multi-core checksum for a reason or two, but don't know exactly why either.

Like, would you be willing to give read outs of what each command does with no argument? or what each one does without trying to overwrite data that cause the device to mess up?
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
I'm like a toddler at a keyboard, just mashing keys until something happens :)

I'll save the output of things that I have tried that do give some meaningful info. Some of the commands won't do anything until other commands have been invoked first, and when a command is issued out of order it hangs the device, and requires a power reset hard reboot. Sometimes that kicks me into a screen off, led blinking bootloop softbrick that resolves after a complete battery drain. So progress is slow.

In regards to code injection...according to this video it allows arbitrary code injection as well as execution...that's why it is so interesting to me.

Edit:I feel like someone with decent knowledge of C would make short work of this whole s-boot and exploit business. As it is, I am going to learn what I can.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
This is pretty interesting, and has some good info on memory addresses. Just posting for reference. I'm guessing that this exploit is patched in the current bootloader, but if we can get the bootloader rolled back....everything is laid out here for a complete patch for loading unsigned images.

https://wikileaks.org/ciav7p1/cms/files/cadmium.pdf
[AT&T Samsung Galaxy Note5] xenomorph318:
Yeah, actually got further with the first zip. Keep working at it tho and I'll keep testing them for ya. I'm gonna try a bunch of different stuff and ways if I can just unzip those zips and adds stuff or take out stuff like u said, a little later.
[AT&T Samsung Galaxy Note5] xenomorph318:
[MENTION=3254678]Delgoth[/MENTION] hey guess what. I got your v1 rom to boot up, in a custom slot btw :P What i did was while in safe strap wipe everything on stock slot except data, then in custom slot make a backup of everything but system and restored everything over the stock slot. i dunno what or why that made it work but it works. Including two screens of the about page
[AT&T Samsung Galaxy Note5] Delgoth:
Reading the first 11 pages, it seems like it could still be potentially possible on the G925v Combo FW. Like I said before about the memory mapping. It is actually different on the 64GB variant than it is on the 32GB variant. Maybe that is how Super-Boot booted, and why I still think the Radio/Modem has some potential. It has been almost 4 years now since I've had a usable S6Edge. Most Combo Firmware recoveries based on 6.0.1 or lower don't actually boot up. They use just a little space for keys and such. A lot of possibilities now that I see this pdf that I didn't notice before.

I will look into it some more, I uploaded a "sboot-dump-master.zip" from github that was this project. I don't know if it was the original or the forked version. Yes though, I have highly considered this program since you posted about having UART connectivity.

But look for the app called "APK Extractor Lite". I've been able to extract even system apps with it on a non rooted device before on my (old) G925v and N920a.

But didn't you say that it booted to the combo firmware? Did I accidentally use the wrong system.img from the wrong folder because it was like 3am at that point? I know that I used the 2APB2 system.img contents for the v1.2 rom zip.
[AT&T Samsung Galaxy Note5] xenomorph318:
yes v1.2 booted to the combo firmware but i had a feeling v1 was so close and just needed a little playing around with. So i kept fiddling with v1. So i deleted the assert line in the script cuz NOBLE rom didnt have that line, at this point i was trying everything and i doubt that had any thing todo with it cuz the argument was correct anyway. So I wiped everything on the stock slot except for data cuz if u wipe data i think the phone bugs out and reboots without SS. then swapped to custom slot, made a backup of every thing via SS backup, swapped back to the stocked slot and restore the backup. But when i restored the backup i had to uncheck system cuz it wont let u restore system but it will let u restore system image and the rest. I lost SS, but im sure its just a matter of flashing again with flashfire.
[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
Sanity check time.

My 1st idea, which I think is actually possible for us to do with the tools and knowledge that we have.

Flash stock 7.0, or really whatever firmware you want. Get to s-boot prompt(which I have tested and its still accessible in 7.0) load the kernel. Add kexec support to the kernel via Nitay Artenstein's code injection method. Go ahead and boot the kernel (may need an argument to enable kexec). Once booted, kexec a custom kernel with root support and sepermissive. Install permanent root via adb root shell. I'm not sure if we would be able to keep root under the stock kernel after installing via adb, or if we would have to kexec a custom kernel with each reboot. This should be stable enough that a tethered root wouldn't be a big deal. The system should still be usable under the stock kernel if you had to reboot for some reason.

Todo

1. get memdump working

2. Figure out exactly how nitay's exploit works(he's still alive I think so we could maybe reach out to him)

3. Write code necessary to add kexec function to stock kernel(I don't know how to do this, but I think that if we have all of the other pieces put together we can find a dev who knows C to write it for us.

Second idea is more outlandish, but hear me out. Safestrap doesn't work with custom ROMs, only because the custom kernel can't get past the locked bootloader. As far as I know, you can actually flash the whole custom ROM sans the kernel and the bootloader doesn't care. So, if we could figure out how to load a custom kernel from the sboot console, we should be able to boot a custom ROM....I think.