[Samsung Galaxy Note 9 Themes, Apps, and Mods] DragonFire1024:
****Moderator Note****

A thread on this topic already exists here. Links have been removed from this one.

In Samsung's TTS app, someone discovered an exploit where the app, using it's receiver capabilities, will accept just about any command or information it receives from just about anything. This exploit so far as I know has not yet been patched but does affect a significant number of existing Samsung devices up to present day including the Samsung Galaxy Note 9 (SM-N960U) and probably others. Essentially this exploit allows a user to to run commands as system user (User: 1000) which is essentially one user level below root access. I am hoping this exploit will assist us in finding a root method for this device. In the meantime, as system user, you can run any command in a shell that is available to system. Running root commands will not work. I have not yet explored the extent of this exploit's capabilities, but you can change system props, some of which persist a reboot, probably disable some applications as opposed to uninstalling them per user, have full access to the /data directory and the ability to change anything in /data/system/users/0 at the very least. You need a Windows computer in order to perform these operations. It maybe possible to do through linux, but I did not try. This will also allow Lsposed patch to be installed on the device (a variant of the xposed framework). Though I am not sure it is required this will also allow you to use the dial pad on the device to Launch pretty much every important Samsung secret code that exists. Using Google to search for Samsung secret codes you can find what you need.

NOTE: I did not create this exploit and I do not claim any authorship or ownership over it. I just got it to work on this device. For reference, further reading and additional details and installation methods, please ***Link removed*** The steps below is the easiest and most basic method.

IMPORTANT: changing some of these props and other settings may cause device instability. In some cases a general factory reset will not change these settings back to your factory settings, so if you screw something up you're going to have to download your device's stock firmware and flash your device using odin.

1. Go to the Github repository above and download the zip file and extract it to anywhere you want. If you don't have minimal ADB and fastboot installed, you can get it here. Otherwise you'll need to download Google's platform-tools for Windows.

2. Plug your Note 9 into your PC, making sure ADB is authorized on the device.

3. Navigate to the exploit's folder and open a cmd window inside the folder, or place the folder's files in the platform-tools folder and navigate there and open a cmd window. To do this, click on the folder's window, press and hold down the shift key while right-clicking your mouse and select either "open cmd window here" or "open powershell window". Use adb to push the "samsungTTSVULN2.apk" to /data/local/tmp:

adb push samsungTTSVULN2.apk /data/local/tmp

.

4. Install "komraids_POC_V1.5.apk" using adb and reboot your Note 9:

adb install komraids_POC_V1.5.apk and open the app once. Navigate to settings, apps and select the app. Turn off battery optimizations.
adb reboot

5. When your Note 9 is completely rebooted (wait a minute or two after turning it back on, before you unlock your device), return to the exploit's or platform-tools folder and run 'systemshell.exe'. When the box pops up, click on 'start shell' and wait for the process to complete. When finished, click on 'reopen running shell'. You should be user: 1000. Run 'id' in that shell and the user should return as user: 1000. If not successful, navigate to the Github repository for other means of installation. Please note you will have to run this process on your device after every reboot.

With this level of access, you can change some system props, launch hidden activities including some degbug menus in various apps, as well as other things. From the Github repository, some examples of abilities:

Some props I was able to change which persist upon rebooting:

persist.service.adb.root 1
setprop sys.hiddenmenu.enable 1
persist.service.adb.enable 1
persist.security.ams.enforcing 0

I am hoping with this access we can figure out a way to use it to our advantage to gain root access. I have only ever had this experience once, where we had gained system level shell access through a debug app accidently left on an Amazon Fire 10 tablet. That access later progressed to root access and from my understanding it is most likely possibility if we can gain this level of access on the device than it is more than likely there is a way to also gain root access. I would very much like any feedback anybody can provide and hopefully we can get further along in this. Please post your modifications and other tricks and hacks in this thread so others can follow along.