[AT&T Samsung Galaxy Note5] Reverse-anastomosis:
So if you're just interested in a device to play with I could probably send you the N920v, or the g925v if you're more familiar with that device(when I finally get a replacement from eBay). I know that a lot of your work has been with the n920a device. From my perspective it doesn't really matter what device I'm working with right now-as I'm not really looking for firmware specific exploits with my sboot console work.

My goal, ultimately is to do something on this device that no one has done before. Its been a huge learning experience, and I continue to learn new things every day.

The end goal for me is a custom ROM-but I'm happy with anything I get in between.

I really think that kexec can work for us...especially with safestrap available to us.

Here is how I think this will work; get on a rootable firmware, install the kexec binaries, reboot to safestrap, kexec a new kernel with hardboot, boot into safestrap with the kexec kernel, load whatever system image from whatever slot we want.

I think the with the current kexec binaries I should be able to load any kernel that I want since I'm starting with a rooted system. I need to figure out the proper arguments to pass to the new kernel in order to get kexec to load it. I do now have a log of all of the current standard arguments for the combination kernel which may be helpful. I'll attach the terminal output of my first kexec attempt for reference.

A couple of potential problems:kexec might not work correctly on 64bit systems, I know its been worked on, but I'm not 100% sure my binaries are patched.

The kernel that I am currently using may need a patch for hardboot(I think hardboot will be essential due to switching systems), which I should be able to inject and load via sboot console.

The slots need to be fixed and functional in safestrap. It sounds like xenomorph has been using them, but afaneh says they are broken. I have not tried using slots yet, but I imagine its fixable.

This method should work regardless of which device you have. If there is any kernel work or ROM building needed I could really use some help.

I know that I have not been very helpful to you in your endeavours, but with firmware specific exploits I really can't be.

I'm probably never going to get where I want to be with this device, but I do think it is possible-i just don't have the necessary knowledge. I am learning a ton though.

If you are interested, I can solder up a UART jig for you and send you the jig and the g925v(when I get the replacement from eBay) so we can work together on this. You would have to get the serial to USB converter and a multimeter that has the proper ranges.

---------- Post added at 10:28 PM ---------- Previous post was at 10:11 PM ----------

Forgot to attach the console output.

root@nobleltevzw:/sdcard/bangin # kexec --load-hardboot zImage-dtb --initrd=initramfs.cpio.gz --mem-min=0x0 --command-line="$(cat /proc/cmdline)"

kexec version: 16.02.07.19.31-g364a380

arch_process_options:112: command_line: console=ram loglevel=4 androidboot.baseband=mdm2 sec_debug.level=1 androidboot.debug_level=0x494d androidboot.bcd_im_offset=7342672 androidboot.bcd_me_offset=7342752 androidboot.bcd_sn_offset=7342832 androidboot.bcd_pr_offset=7342912 androidboot.bcd_sku_offset=7342992 sec_debug.enable_cp_debug=1 androidboot.cp_debug_level=0x5500 softlockup_panic=0 asv_table_version2=8735 ess_setup=0x46000000 charging_mode=0x0 sec_tima_log=0x200000@0x48002000 sec_avc_log=0x40000@0x48204000 sec_tsp_log=0x40000@0x48246000 sec_pmu_log=0x200@0x48288000 sec_cmu_log=0x200@0x4828a200 s3cfb.bootloaderfb=0xe2a00000 lcdtype=136260 consoleblank=0 lpj=239616 vmalloc=384m sec_debug.reset_reason=7 ehci_hcd.park=3 oops=panic pmic_info=107 cordon=558051cdf630920e8d963e67f1f13aaa connie=SM-N920V_VZW_USA_bd2d07da0a76e0d4f555a2128541d6fa fg_reset=0 androidboot.emmc_checksum=3 androidboot.boot_salescode= androidboot.odin_download=1 androidboot.bootloader=FA51_N920VVRU3API2 androidboot.selinux=enforcing androidboot.hw_rev=9 androidboot.warranty_bit=0 androidboot.sec_atd.tty=/dev/ttySAC1 androidboot.serialno=0316034cd5093c04 snd_soc_core.pmdown_time=1000 sec_bl_mem=0x1a30000@0x43e00000

arch_process_options:114: initrd: initramfs.cpio.gz

arch_process_options:115: dtb: (null)

arch_process_options:117: port: 0x0

Try gzip decompression.

kernel: 0x7f7e100000 kernel_size: 0x1267330

read_sys_dtb: No such file or directory

Modified cmdline:

Unable to find /proc/device-tree//chosen/linux,stdout-path, printing from purgatory is diabled

unrecoverable error: propnames overrun

root@nobleltevzw:/sdcard/bangin #