New kernel flaw to gain root, maybe without breaking KNOX? - Galaxy Note5 Q&A, Help & Troubleshooting

Maybe a way of obtaining root without KNOX 0x1 through a script?
Zero Day security flaw

Still got to deal with Selinux if this even works...

siriom said:
Still got to deal with Selinux if this even works...
Click to expand...
Click to collapse
This is Selinux enforcing, no?
http://forum.xda-developers.com/spr...systemless-root-supersu-v2-64-custom-t3277353

AndroidState said:
This is Selinux enforcing, no?
http://forum.xda-developers.com/spr...systemless-root-supersu-v2-64-custom-t3277353
Click to expand...
Click to collapse
That seems to be for s6 only , not note 5 ... also it trips knox.

siriom said:
That seems to be for s6 only , not note 5 ... also it trips knox.
Click to expand...
Click to collapse
I know it is for S6, but someone said in Sprint Note5 forum it worked for him. It tripped knox because they flashed the root.
In this situation we might get root from a script and leaving our kernel stock.

AndroidState said:
I know it is for S6, but someone said in Sprint Note5 forum it worked for him. It tripped knox because they flashed the root.
In this situation we might get root from a script and leaving our kernel stock.
Click to expand...
Click to collapse
link to post plz ?

siriom said:
link to post plz ?
Click to expand...
Click to collapse
http://forum.xda-developers.com/sprint-galaxy-note5/general/guide-how-to-root-custom-kernel-t3278185

AndroidState said:
http://forum.xda-developers.com/sprint-galaxy-note5/general/guide-how-to-root-custom-kernel-t3278185
Click to expand...
Click to collapse
Thanks . Its for marshmellow so .... yeah.
I figure its gonna trip knox always if you odin something that isnt stock . Guess ill wait and see.

siriom said:
Thanks . Its for marshmellow so .... yeah.
I figure its gonna trip knox always if you odin something that isnt stock . Guess ill wait and see.
Click to expand...
Click to collapse
Where does it say it is for marshmallow?

http://forum.xda-developers.com/app...arshmellow-t3219344/post64161125#post64161125
All discussion should go the SuperSU BETA thread
Attached find modified boot.img for the Nexus firmwares released so far. Together with SuperSU v2.50+ these allow root with SELinux in Enforcing mode.
These are the stock boot images from Google, with the ramdisk modified as follows:
- patched sepolicy
- disabled dmverity (if applicable)
- disabled forceencrypt (if applicable)
Rooting procedure:
- flash/upgrade to Marshmellow
- flash modified boot.img
- flash/boot TWRP and sideload latest v2.50+
The flash upgrade to marshmellow sorta gives it away ?

siriom said:
http://forum.xda-developers.com/app...arshmellow-t3219344/post64161125#post64161125
All discussion should go the SuperSU BETA thread
Attached find modified boot.img for the Nexus firmwares released so far. Together with SuperSU v2.50+ these allow root with SELinux in Enforcing mode.
These are the stock boot images from Google, with the ramdisk modified as follows:
- patched sepolicy
- disabled dmverity (if applicable)
- disabled forceencrypt (if applicable)
Rooting procedure:
- flash/upgrade to Marshmellow
- flash modified boot.img
- flash/boot TWRP and sideload latest v2.50+
The flash upgrade to marshmellow sorta gives it away ?
Click to expand...
Click to collapse
I thought I sent this yesterday:
"If on Android 6.0 or Samsung 5.1, the ZIP installer will install SuperSU in systemless mode and patch the boot image"
Samsung 5.1 works.

AndroidState said:
I thought I sent this yesterday:
"If on Android 6.0 or Samsung 5.1, the ZIP installer will install SuperSU in systemless mode and patch the boot image"
Samsung 5.1 works.
Click to expand...
Click to collapse
Have you tried this on a note 5 ?
I would guess it will surelly trip knox but I havent seen anyone try.

siriom said:
Have you tried this on a note 5 ?
I would guess it will surelly trip knox but I havent seen anyone try.
Click to expand...
Click to collapse
Of course not if I said someone needs to make a script for it...

When I tripped KNOX i gave him a extra shove in the back. Making him trip more hard.

Related

Flashing system.img to upgrade from mra58k to N

so heres the situation
running stock mra58k rooted with elementalX
encrypted
rooted with su2.46
can i just flash system.img from mra58n to upgrade then reroot?
darthchilli said:
can i just flash system.img from mra58n to upgrade then reroot?
Click to expand...
Click to collapse
Yes, that will work just fine. You may need a newer version of SuperSU to get proper root on marshmallow. The latest version is 2.52 (there is also a v2.56, but that's only for the "systemless" root method).
Face_Plant said:
Yes, that will work just fine. You may need a newer version of SuperSU to get proper root on marshmallow. The latest version is 2.52 (there is also a v2.56, but that's only for the "systemless" root method).
Click to expand...
Click to collapse
So if we are running a Kernel and rooted, this will work. I guess I am nervous to try flashing the new OTA because I don't want to have to setup programs again, but that isn't a huge deal.
haibane said:
So if we are running a Kernel and rooted, this will work. I guess I am nervous to try flashing the new OTA because I don't want to have to setup programs again, but that isn't a huge deal.
Click to expand...
Click to collapse
I've been using the same non-encrypted/no boot warning kernel on MRA58K, MRA58N, and MRA58R with no issues. I was rooted with the experimental "systemless" root method. I have flashed the system.img from both MRA58N and MRA58R without losing root or having to flash anything extra (like my kernel or SuperSU) or set up my phone again.
The only things you will have to redo (if you ever did any of these in the first place) are build.prop edits, redelete any system apps you removed, reinstall Busy box, and reinstall hosts files from ad blockers. All of your other data should remain unchanged.
Face_Plant said:
I've been using the same non-encrypted/no boot warning kernel on MRA58K, MRA58N, and MRA58R with no issues. I was rooted with the experimental "systemless" root method. I have flashed the system.img from both MRA58N and MRA58R without losing root or having to flash anything extra (like my kernel or SuperSU) or set up my phone again.
The only things you will have to redo (if you ever did any of these in the first place) are build.prop edits, redelete any system apps you removed, reinstall Busy box, and reinstall hosts files from ad blockers. All of your other data should remain unchanged.
Click to expand...
Click to collapse
So my follow up question. I am runing SuperSU 2.52. Would I have to do a clean install to update to the "systemless" after a OTA flash?
haibane said:
So my follow up question. I am runing SuperSU 2.52. Would I have to do a clean install to update to the "systemless" after a OTA flash?
Click to expand...
Click to collapse
You cannot flash an OTA if you are rooted.
danarama said:
You cannot flash an OTA if you are rooted.
Click to expand...
Click to collapse
Sorry I meant do a system.img flash. I assume it has the same result as doing a full OTA and then re-rooting/adding custom kernel.
Basically, I am just trying to get from mra58k with supersu 2.52 and franco kernel to mra58r with supersu 2.52 or 2.56 and franco kernel.
Obviouslly, I could probably just do a nandroid backup and go crazy on the phone to try and do whatever, but I wanted to see what the preferred method would be first.
haibane said:
Sorry I meant do a system.img flash. I assume it has the same result as doing a full OTA and then re-rooting/adding custom kernel.
Basically, I am just trying to get from mra58k with supersu 2.52 and franco kernel to mra58r with supersu 2.52 or 2.56 and franco kernel.
Obviouslly, I could probably just do a nandroid backup and go crazy on the phone to try and do whatever, but I wanted to see what the preferred method would be first.
Click to expand...
Click to collapse
I don't know what a full OTA is but no, an OTA is not the same as flashoing a system.img.
Process should be flash system.img and boot.img, boot to recovery, flash kernel and supersu. All good. Do not boot up to android before flashing kernel if you want to be unencrypted.
The reason for flashing the boot.img is that some kernels do not provide their own ramdisk, so it is always worth flashing the boot.img that comes in the factory image for the sake of wasting 3 seconds.
danarama said:
I don't know what a full OTA is but no, an OTA is not the same as flashoing a system.img.
Process should be flash system.img and boot.img, boot to recovery, flash kernel and supersu. All good. Do not boot up to android before flashing kernel if you want to be unencrypted.
The reason for flashing the boot.img is that some kernels do not provide their own ramdisk, so it is always worth flashing the boot.img that comes in the factory image for the sake of wasting 3 seconds.
Click to expand...
Click to collapse
Ah. That makes sense. I have been avoiding going unencrypted because well encryption brings security so why not lose a little processing to gain security. Anyhow, Thanks I'll try this method after my backup finishes.
Also not sure if you know the answer to this, but could I move to the systemless root variant after doing the system.img and boot.img flash? I would assume this would become possible because the system.img would clean anything done by the standard root.
haibane said:
Ah. That makes sense. I have been avoiding going unencrypted because well encryption brings security so why not lose a little processing to gain security. Anyhow, Thanks I'll try this method after my backup finishes.
Click to expand...
Click to collapse
No probs.
This is probably going to sound insane, but I am almost annoyed that the update appears to have worked flawlessly. I kind of wanted some sort of catastrophic failure. I've yet to have any bootloop etc...
haibane said:
This is probably going to sound insane...
Click to expand...
Click to collapse
yeah....
haibane said:
This is probably going to sound insane, but I am almost annoyed that the update appears to have worked flawlessly. I kind of wanted some sort of catastrophic failure. I've yet to have any bootloop etc...
Click to expand...
Click to collapse
Be careful what you wish for, you just might get it.

Downgrade back to 5.0.1 from 6.0/7.0 for full root.

Not sure if anyone care or still want to go back to 5.0.1.
It is possible if you download COMBINATION_VZW_FA50_G925VVRU4AOJ1 (Google it yourself its free out there.)
After flashing combination file you can root it with kingroot then replace it with superuser ( https://forum.xda-developers.com/a310/general/how-to-remove-replace-kingroot-kinguser-t3308989 ), then you can use flashfire to flash 5.0.1 rom.
You will need to keep the sboot/bootloader from combination file i order to boot with 5.0.1 kernel.
Anyone know if theres good rom that will still work with this method? I tied some stock root rom ( https://forum.xda-developers.com/ve...ment/rom-stock-rooted-g925v-vru1aoc3-t3115121 ), it seems to be missing some file after flashing. It boots up gets signal, but it is buggy. If anyone know if bugs from flashing this way cannot be fixed then let me know so I can stop trying .
I flashed the COMBINATION_VZW_FA50_G925VVRU4AOJ1 tar file but how do it install apks so i can use kingroot. unless you have forum to share with me
I haven't used the XDA forums in over a year. I don't know if I have the courage to downgrade from 7.0 to 5.X
Snowby123 said:
I haven't used the XDA forums in over a year. I don't know if I have the courage to downgrade from 7.0 to 5.X
Click to expand...
Click to collapse
Something similar for me honestly. I just downloaded the firmware stated, did the steps and it seems to have worked fine. Even with root, I honestly liked 7.0 on this device. Dang locked BL. :/
3Cubed27 said:
I flashed the COMBINATION_VZW_FA50_G925VVRU4AOJ1 tar file but how do it install apks so i can use kingroot. unless you have forum to share with me
Click to expand...
Click to collapse
You can install apks using ADB -- I think you can get it from Android Studio or try https://www.xda-developers.com/install-adb-windows-macos-linux/
Once you have ADB installed, just connect your S6 to your PC, open terminal, and run "adb devices" to confirm your phone is visable
Then to install an apk, have it downloaded on your PC and run
"adb install {path/to/apk}"
Example:
adb install Downloads/NewKingrootV5.3.7_C197_B451_xda_release_2018_06_19_20180620193529_242043.apk
I don't really think there was a 5.0.1 ROM designed for the Revision 4 bootloader outside of the Combination Firmware. I think this may be a reason.
Delgoth said:
I don't really think there was a 5.0.1 ROM designed for the Revision 4 bootloader outside of the Combination Firmware. I think this may be a reason.
Click to expand...
Click to collapse
I know this is old. But I come from a s8. So we should be able to even though rev4 bootloader flash any 5 System IMG. The bootloader from the fa50 combination should suffice to boot any lolipop system since they are not incremented
TheMadScientist said:
I know this is old. But I come from a s8. So we should be able to even though rev4 bootloader flash any 5 System IMG. The bootloader from the fa50 combination should suffice to boot any lolipop system since they are not incremented
Click to expand...
Click to collapse
Correct, you just need the bootloader and kernel capable of booting the system up. This is how I was able to use any of the LP AP Build/System on my rev 3 Note5.
All the LP builds were rev 2. But I had a LP bootloader and kernel. Realistically someone should try, but you might need to root the combo firmware first and use flash fire/flashify/safestrap to flash the system image. Because ODIN might not let you.
Delgoth said:
Correct, you just need the bootloader and kernel capable of booting the system up. This is how I was able to use any of the LP AP Build/System on my rev 3 Note5.
All the LP builds were rev 2. But I had a LP bootloader and kernel. Realistically someone should try, but you might need to root the combo firmware first and use flash fire/flashify/safestrap to flash the system image. Because ODIN might not let you.
Click to expand...
Click to collapse
Yea Odin pushing the rooted firmware with combo boot was patched on s8 about the same time. But now where using edl to push a rooted combination file with su flash fire and safestrap.
My s8 is running a bit 5 nougat combo which that bootloader is reserved for Oreo and pie. But I'm running a rooted system IMG I made up from a equivalent rev2 nougat system and runs fine other than 80% charge limmit on the newer combos. Even my j3 limmits to 80 on combo. But I found a hack to charge to 100% I got posted in the s8 threads. I'm gonna try this over the next few days. If there's a eng bootloader with permissive kernel nougat should be able to be rooted too.
TheMadScientist said:
Yea Odin pushing the rooted firmware with combo boot was patched on s8 about the same time. But now where using edl to push a rooted combination file with su flash fire and safestrap.
My s8 is running a bit 5 nougat combo which that bootloader is reserved for Oreo and pie. But I'm running a rooted system IMG I made up from a equivalent rev2 nougat system and runs fine other than 80% charge limmit on the newer combos. Even my j3 limmits to 80 on combo. But I found a hack to charge to 100% I got posted in the s8 threads. I'm gonna try this over the next few days. If there's a eng bootloader with permissive kernel nougat should be able to be rooted too.
Click to expand...
Click to collapse
The question is, what did you do to.modify your stock rom to be able to boot on the combo bootloader? I'm still a little lost on that.
Delgoth said:
The question is, what did you do to.modify your stock rom to be able to boot on the combo bootloader? I'm still a little lost on that.
Click to expand...
Click to collapse
I didn't on the j3.
TheMadScientist said:
I didn't on the j3.
Click to expand...
Click to collapse
Maybe not on the j3 haha.
Delgoth said:
Maybe not on the j3 haha.
Click to expand...
Click to collapse
Wrong device ****. I got so many phones lying around. I haven't really messed with the s6 much. I got a few other on the front burner
TheMadScientist said:
Yea Odin pushing the rooted firmware with combo boot was patched on s8 about the same time. But now where using edl to push a rooted combination file with su flash fire and safestrap.
My s8 is running a bit 5 nougat combo which that bootloader is reserved for Oreo and pie. But I'm running a rooted system IMG I made up from a equivalent rev2 nougat system and runs fine other than 80% charge limmit on the newer combos. Even my j3 limmits to 80 on combo. But I found a hack to charge to 100% I got posted in the s8 threads. I'm gonna try this over the next few days. If there's a eng bootloader with permissive kernel nougat should be able to be rooted too.
Click to expand...
Click to collapse
This is what I was asking about though. I still can't get anyone to explain how to make the stock ROMs work on the newer more locked devices. It's like a big secret or something. But it is possible on the S6, Note5, and S8. Probably the S7 too.
But 5.0.1, 5.1.1, and 7.0 are built a lot differently and I imagine the method is different.
TheMadScientist said:
Wrong device ****. I got so many phones lying around. I haven't really messed with the s6 much. I got a few other on the front burner
Click to expand...
Click to collapse
Before the S9 Line most everything has been built pretty similarly.

Magisk root S10e

Hi all
On the S10e is a problem by the rooting part from magisk. The approach with 'system-as-root' will not work.
It look likes, that the system not load the new ramdisk.packed. The hex-patch for skip_initramfs > want_* works.
The dt.img patch has also an error. This img must be manualy add to the boot.img for the hex-patches.
Has any one a fix?
*On the G970U works the approach.
Are you using Canary magisk ?
https://www.xda-developers.com/magisk-canary-update-support-aonly-system-root-android-pie/
spartanz51 said:
Are you using Canary magisk ?
https://www.xda-developers.com/magisk-canary-update-support-aonly-system-root-android-pie/
Click to expand...
Click to collapse
Yes. On the new s10 are no ramdisks included in the boot.img. So the 'system-as-root' is the way to go.
*On the actual magisk source, is an error for the dtb-patch.
sq_dev said:
Yes. On the new s10 are no ramdisks included in the boot.img. So the 'system-as-root' is the way to go.
*On the actual magisk source, is an error for the dtb-patch.
Click to expand...
Click to collapse
You use Canary or Official Magisk??
Cause on Canary there is a fix for system-as-root support
spartanz51 said:
You use Canary or Official Magisk??
Cause on Canary there is a fix for system-as-root support
Click to expand...
Click to collapse
Yes I have try both.
Now is the kernel available. I will check the functions.
How can you root without custom recovery?
Maybe I'm missing something cos I always root with TWRP + Magisk!
Lord Spectre said:
How can you root without custom recovery?
Maybe I'm missing something cos I always root with TWRP + Magisk!
Click to expand...
Click to collapse
With Odin
spartanz51 said:
With Odin
Click to expand...
Click to collapse
Thank you for reply. Could you please point me to the magisk package I have to flash with odin?
Is it ok the following one?
https://raw.githubusercontent.com/topjohnwu/magisk_files/master/canary_builds/release.json
Subscribed, wanting to root my 970u
Sent from my SM-G970U using Tapatalk
That's all quite interesting. I wonder if Magisk will also work with my Chinese Snapdragon S10+, or if something specific needs to be done for the particular architecture. I downloaded the zip file that's supposed to be installed and saw in boot_patch.sh that some changes are to be made in binary files. If those binaries are the same for both Exynos and Snapdragon, it should work on both, and if not, then my phone probably wouldn't boot because the binaries would be corrupt.
One of my questions is: were those patches based on compiling the kernel source code released by Samsung, or reverse engineering the binaries? Because if it's based on compiling from source with a couple modifications and then finding the difference with the stock binaries, it's less work than reverse engineering the binaries.
This is the only reason I got Exynos S10. Last year, it took a while for Chinese Snapdragon S10 root. Also Pie update was released first week of this year for Exynos whereas for SD it took them another month and a half.

[TOOL] KnoxPatcher - use Secure Folder after root

I have finally figured out a way to use Secure Folder with a rooted / knox tripped phone!
So far this is WIP, but I have tested it to work on an SM-G960F running April 2019 rom.
You will need a GNU/Linux machine to patch your system, but a flashable zip is coming soon.
Instructions (note these are github links, I can't post actual links):
Get the tool at nm111/knoxpatch2
Install dexpatcher. You can use DexPatcher/dexpatcher-gradle-tools
Install vdexExtractor and compact_dex_converter (both can be found at anestisb/vdexExtractor)
Run ./pull_files.sh
Run ./patch.sh
Copy out/services.jar back onto the device.
Edit build.prop and remove ro.config.iccc_version.
Now secure folder will work.
Proof coming soon.
You would be our hero if you can complete this project
I have done some research, and I think it is unlikely that a flashable zip would work, unless someone could get compact_dex_converter running in TWRP (it just segfaults). I added some more scripts to download and deodex services.jar. Also I have uploaded my own patched build PPR1.180610.011.G960FXXS3CSD1 services.jar at drive[.]google[.]com/file/d/1AW7urpwMzjj3gorumsmfMeu6qh3cxD6J/view?usp=sharing. BTW, this works perfectly as far as I can see. Could someone try it out and post what happens?
It's just for pie?
denkazzzget said:
It's just for pie?
Click to expand...
Click to collapse
In theory, it should work on oreo, but I haven't tried it. You need to patch yourself though.
Good news bro and good work, i wait the flashable Zip
Nice work hope we can get the flushable soon
Eagerly waiting. The only thing stopping me from rooting is Knox tripper!!! Don't want to lose my last 6 months of warranty.
By the way, Wil this be universal and not processor specific? Curious me!
Are other features like samsung pass / pay accessible with this patch ? Normally you also lose these with root
effry said:
Are other features like samsung pass / pay accessible with this patch ? Normally you also lose these with root
Click to expand...
Click to collapse
Samsung pass would probably never work as it checks the warranty status internally in the trustlet and just never allows storage of data if WB is blown. Samsung pay may work if I can bypass the signature check (I am working on it now).
zeyaan said:
Eagerly waiting. The only thing stopping me from rooting is Knox tripper!!! Don't want to lose my last 6 months of warranty.
By the way, Wil this be universal and not processor specific? Curious me!
Click to expand...
Click to collapse
You will still lose warranty if you root, this is just so you can use Knox apps.
It might work on other phones (i think that's what you mean), but I don't have any other phones so can't check.
Will test this on my N9 and I will report back
nm111 said:
I have finally figured out a way to use Secure Folder with a rooted / knox tripped phone!
So far this is WIP, but I have tested it to work on an SM-G960F running April 2019 rom.
You will need a GNU/Linux machine to patch your system, but a flashable zip is coming soon.
Instructions (note these are github links, I can't post actual links):
Get the tool at nm111/knoxpatch2
Install dexpatcher. You can use DexPatcher/dexpatcher-gradle-tools
Install vdexExtractor and compact_dex_converter (both can be found at anestisb/vdexExtractor)
Run ./pull_files.sh
Run ./patch.sh
Copy out/services.jar back onto the device.
Edit build.prop and remove ro.config.iccc_version.
Now secure folder will work.
Proof coming soon.
Click to expand...
Click to collapse
Can you share the zip please
Update:
I have created a better version which bypasses all integrity checks but SPAY and SPASS still do not work due to them using their own trustlets. Also it is highly insecure as it forces all signature checks to return true. If I get DexPatcher to work on this then I will fix the signatures (or make an xposed module?) but if not I will release this later.
A zip will 100% not work. I have tried for ages and no luck. This is because the Samsung libraries are not loaded when in recovery so the patcher and deodexer do not work. The likely result will be a Magisk module or app which does the patching.
I am still working on this so please wait!
nm111 said:
Update:
I have created a better version which bypasses all integrity checks but SPAY and SPASS still do not work due to them using their own trustlets. Also it is highly insecure as it forces all signature checks to return true. If I get DexPatcher to work on this then I will fix the signatures (or make an xposed module?) but if not I will release this later.
A zip will 100% not work. I have tried for ages and no luck. This is because the Samsung libraries are not loaded when in recovery so the patcher and deodexer do not work. The likely result will be a Magisk module or app which does the patching.
I am still working on this so please wait!
Click to expand...
Click to collapse
Thank you <3 , We are waiting :good:
nm111 said:
Update:
I have created a better version which bypasses all integrity checks but SPAY and SPASS still do not work due to them using their own trustlets. Also it is highly insecure as it forces all signature checks to return true. If I get DexPatcher to work on this then I will fix the signatures (or make an xposed module?) but if not I will release this later.
A zip will 100% not work. I have tried for ages and no luck. This is because the Samsung libraries are not loaded when in recovery so the patcher and deodexer do not work. The likely result will be a Magisk module or app which does the patching.
I am still working on this so please wait!
Click to expand...
Click to collapse
Would appreciate if you will be able to record to process how to do it as well. Thank you and we are all waiting for this method.
So, how is the progress going so far? All good?
Sorry for that basic question, I'm eagerly waiting, I only want the Secure folder, that's it.
Thank you and keep going!
I think this is a cagada de toro, he have proof nothing
Secure folder is working on dr ketan roms with root
halo87 said:
Secure folder is working on dr ketan roms with root
Click to expand...
Click to collapse
Great,, is there Rom for S9?

[2022][ROOT] [Extreme Syndicate] [G960U/U1/W][G965U/U1/W][N960U/U1/W]

Info For U Model Bootloader Unlocking Can Be Found
[Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices
This thread is @svetius approved Important notice: Do not update to April 2023 security update (XXXXXXXXXXWCX) or later. Examples: G998USQS6EWCA, N986USQU4HWD1. Samsung has patched the bootloader unlock again on those updates. NOTE: The OneUI...
forum.xda-developers.com
Below US snapdragon devices can be bootloader unlocked with above service as long as bootloader version meets below criteria. Bootloader version can be determined from the 5th character from the right on the baseband version or build number, in some cases from kernel version
Below Method is no longer supported if you choose to use the unstable method below you do so on your own
This method is brought to you entirely by @elliwigy He is the reason for this exploit and method.
With that being said, Extreme Syndicate Root is now available!
Before Starting This Process Get A USB2 Mini Hub You Are Most Likely Going Too Need It​
EXTREME SYNDICATE ROOT METHOD
​OEM Toggle Does Nothing On US Model Phones
This root method breaks things and most likely will not be able to be used as a daily driver
You can be on any version bootloader. This will update you to V9 bootloader
This method will work if you are on Android 10 or Android 9 Pie but will put you on Android 8 Oreo. There is no root for Android 10 or Android 9 Pie
You will not be able to use magisk
You will not be able to flash full custom rom like Lineage or any other AOSP roms however GSI system images can be used
You cannot flash custom boot images or recovery images such as regular TWRP
Odin does not work on some later computers with USB 3.1 chip controllers the only work around is using a USB 2.0 mini hub
It is your responsibility to make sure you can use adb properly
Root will break things such as safetynet so deal with it
Disclaimer:
The Extreme Syndicate team and it's affiliates are not responsible for your actions or your device if any issues are to arise. You flash this and utilize these files at your own risk. You have been warned!
Notes:
- Safestrap recovery is now available with working MTP while in Safestrap
- This does NOT trip KNOX so don't ask.
- Bootloader is of course still locked.
- This uses some partitions from combo firmware which means 80% battery.
- Each variant will have its own post in its own download section. Download the right stuff!
* Variants this should work on are: N960U/U1/W, G965U/U1/W, G960U/U1/W. If you do not have one of these variants then this forum is not for you!
- Initial files/method will leave you on Oreo stock root.
- It works on latest rev's from rev1 up to the most recent revs.
- As of the initial first release, all variants have an issue with MTP not working except while in Safestrap
- S9 and S9+ also might have some issues with the selfie cam.
- Note 9 @elliwigy
- S9+ @klabit87
- S9 @jrkruse
- Telegram Support Group for All 3: https://t.me/joinchat/DxwvAlhtzHjg4EI9973BGQ
Anything here with a .7z extension will get unzipped before using
Anything here with a .zip extension will get flashed as a zip in safestrap
Anything here with a .tar or .md5 gets flashed in odin
Anything here with a .img extension gets flashed as image in safestrap
Downloads S9 Files:
Safestrap_S9_Cmd_Line.7z
Download S9+ Files:
Safestrap_S9_Plus_Cmd_Line.7z
Download Note9 Files: -- Only For Bit 8 Or Lower
Safestrap_N9_Cmd_Line_Bit8.7z
Instructions to Inject Safestrap:
1. Download and unzip Safestrap_S9__Cmd_Line.7z for your device
2. Plug phone into computer and run Safestrap.exe
3. Follow instructions on screen to enable USB Debugging
4. Then from there the process will be mostly automatic just follow prompts on screen
5. When done flashing BootSwap file you need to hold the buttons to boot to recovery but since we swapped boot and recovery images it will boot system.
Instructions For Flash Rom:
1. Download below files and copy files for rom to phone system img and vendor img and odm zip
Downloads S9 Files:
Stock_Rom_G960.7z
GSI_Rom_G960.7z
Download S9+ Files:
Stock_Rom_G965.7z
GSI_Rom_G965.7z
2. In safestrap flash system img then vendor img and odm zip .
3. Choose data wipe and advance and check data
4.. Now reboot system you will have to hold buttons to reboot to recovery until you see safestrap splash then click continue. You must do this on every reboot. If you do not it will reboot to stock recovery. If it reboots to stock recovery just reboot system and hold buttons to reboot to recovery again.
5. When rom is booted up your computer will not recognize the phone for mtp file transfer. Adb does still work so you can transfer stuff that way (you need to switch to ptp transfer method in the dropdown) or use USB adapter and use a thumb drive.
6. Biometrics do not work so don’t try to setup fingerprint or face recognition.
The GSI rom mtp works GSI rom is rooted already just flash phhsupersu.apk found in GSI_Rom zip
If using other GSI roms you have too choose A_Only ones and will probably need to flash the Sh_Remover.zip found in the GSI_Rom zip
ShoutOuts:
@elliwigy For the method and help and everything else
@klabit87 - Ditto
@me2151 - Ditto
@gsm-CHEN - Ditto
@mweinbach - For always posting my achievements on the XDA News portal as well as giving me someone to troll sometimes when bored.
@ShaDisNX255 - He was our best tester, give him credits for testing out GSI as well!
@everyone else I am forgetting!
ENJOY!
Mine
Wow, this is actually pretty good. S9 Snapdragon + treble enabled device? Man, this is going to change everything! I hope something good comes out of this
Does it work on the U/U1 variants of the S9+ as well?
krion64 said:
Does it work on the U/U1 variants of the S9+ as well?
Click to expand...
Click to collapse
It probably will but no files have been made for s9+ yet and not yet tested
Sent from some device I modified
krion64 said:
Does it work on the U/U1 variants of the S9+ as well?
Click to expand...
Click to collapse
It’s confirmed working on both SM-G960U/U1 and SM-G965U/U1
Sent from some device I modified
Any chance that this might be used and not trip knox? This sounds like a similar method that was used in previous devices.
Argyrus said:
Any chance that this might be used and not trip knox? This sounds like a similar method that was used in previous devices.
Click to expand...
Click to collapse
You cannot trip knox on a locked bootloader
Sent from some device I modified
jrkruse said:
You cannot trip knox on a locked bootloader
Sent from some device I modified
Click to expand...
Click to collapse
Gotcha, any idea of when you might get this working for G965U or if you will allow testers?
Argyrus said:
Gotcha, any idea of when you might get this working for G965U or if you will allow testers?
Click to expand...
Click to collapse
Did you not read la couple post above yoir question
Sent from some device I modified
jrkruse said:
Did you not read la couple post above yoir question
Sent from some device I modified
Click to expand...
Click to collapse
I did, but you made two posts, one that you said no files have been created and not tested then also state that it has been confirmed.
Since that seems to be the case then my bad for being confused.
Argyrus said:
I did, but you made two posts, one that you said no files have been created and not tested then also state that it has been confirmed.
Since that seems to be the case then my bad for being confused.
Click to expand...
Click to collapse
When it was tested I posted it was confirmed. Stuff will be released soon
Sent from some device I modified
jrkruse said:
When it was tested I posted it was confirmed. Stuff will be released soon
Sent from some device I modified
Click to expand...
Click to collapse
Awesome, sorry for any confusion.
jrkruse said:
You cannot trip knox on a locked bootloader
Sent from some device I modified
Click to expand...
Click to collapse
jrkruse said:
It probably will but no files have been made for s9+ yet and not yet tested
Sent from some device I modified
Click to expand...
Click to collapse
That means I can have root and have Samsung pay? God damn that makes me wet
Dhdeanha said:
That means I can have root and have Samsung pay? God damn that makes me wet
Click to expand...
Click to collapse
As of right now it's still detecting su binaries. So Samsung Pay probably may not work.
On my G965/U1 I do not even see a "/system/etc/init/init.lab.rc" file on my device, is this because I am updated to the latest Android 9 December 1st security patch?
elguy said:
On my G965/U1 I do not even see a "/system/etc/init/init.lab.rc" file on my device, is this because I am updated to the latest Android 9 December 1st security patch?
Click to expand...
Click to collapse
Don't worry about it. It will work on it, it's been proven to work exactly on Android 9, Dec 2019 security patch.
Wow! that's exciting, I can't wait until this releases. Looks like I'm not updating my phone anymore until then. Especially exciting if it works on Android 9 December 2019 security patch
the question is how likely this will be patched in Samsung's next update and how much time this may cause them to delay their next security patch.
Extreme Syndicate Root for S9 is live!!

Categories

Resources