GUIDE: ROOT, install XPOSED, and UNROOT/returning to stock a Galaxy S7 or S7 Edge

[psouza4]

NOT WORKING? This method requires Marshmallow (Android 6.0), released with the phone at launch, in order to flash. Apparently this flash method won't work with any OTA update released over the last year or so, which means you cannot use anything in this guide if you're unable to flash these stock images. Sorry, I can't help you with that.

DISCLAIMER: I don't take credit for releasing a root method -- a huge giant thank-you goes out to Chainfire, Wanam, markhaines1985, PrinceComsy, Snoop05, x3demond3x, br3w3r, and everyone else who goes out of their way to make our phone experience better!

PERMANENT ROOT

Prerequisites: Samsung Galaxy S7 or S7 Edge (any carrier) and Microsoft Windows PC

Optional: I highly recommend making a backup of the data on your phone, including pictures and videos from the internal sdcard. If there is a problem at any point or if you need to unroot, there's a high likelihood of losing that data. Make sure you back up to an external sdcard or your computer or laptop.

Optional: Once satisfied with any backup you want to make, use my unroot guide to (a) upgrade to a more recent firmware if you're on an older firmware and (b) start from a fresh state. I have seen too many people have problems that were completely fixed by unrooting and re-rooting, so it's a good idea to just start fresh if you can.

Install Samsung USB device drivers
SAMSUNG_USB_Driver_for_Mobile_Phones.zip (mirror)

Install ADB (system-wide)
adb-setup-1.4.3.exe (MD5 hash 8C9085D4F753A2AAB26082FD2EB46A8E) (credit Snoop05)

On your phone, go into Settings -> Lock screen and security. Make sure that "Secure startup" is off/disabled. This option prevents the su binary from giving root.

Again on your phone, go into Settings -> About phone. Tap on the space that says 'Build number' seven times until it tells you that developer mode/options have been enabled. Tap back and then tap on Developer options. Make sure that developer options are on (general setting at the top of the Developer options screen) and then scroll down to USB debugging. Tap to enable USB debugging.

Connect phone to PC via USB.

At your PC, a Windows command prompt (Win+R and type 'cmd' and press enter or find it under Start -> Accessories). In the command prompt, type adb wait-for-device. Your phone may prompt you to authorize the computer and it is important that you approve the authorization and check on to "Always allow from this computer". If it doesn't prompt you, that's fine (you may have given it authorization some other time), but you should not skip this step or the root process may not work. After the adb command in command prompt returns to a blinking prompt, you may close the command prompt window (or just type exit inside the prompt).

Note: if typing the 'adb' command gives you the message "'adb' is not recognized as an internal or external command, operable program or batch file", then please check the F.A.Q./Help section of this guide.

Download and extract Odin3 v3.12 (try either version)
Odin3_v3.12.zip (MD5 hash F4BAE9E20925DA85854A9C49E8E06F1C)
Odin3_v3.12_PrinceComsy.zip (MD5 hash 136E707B39C2E4CDC47820C68065CD5C) (credit PrinceComsy)

Note: most people use the PrinceComsy version, but some AT&T users said the other version will prevent bootloop/stuck AT&T logo.

Download engineer-rooted boot image appropriate for your model of phone:
Samsung_G930x_QC_Rooted_BOOT.TAR (any Samsung Galaxy S7) (MD5 hash 948A01ECCF280828DFD13AC366F6FE85) (credit markhaines1985)
Samsung_G935x_QC_Rooted_BOOT.TAR (any Samsung Galaxy S7 Edge) (MD5 hash F3B7C5E4E8F6B31235ED0125371EB1F6) (credit markhaines1985)

Note that this download is a .TAR file and while it looks like an archive, you should not extract its contents.

Power off the phone. Turn it back on while holding Home, Volume Down, and Power buttons at the same time to enter download mode. Press Volume Up to confirm that you want to flash data to the phone.

Open Odin. Click 'AP' and select the appropriate AP TAR file:
Samsung_G930x_QC_Rooted_BOOT.TAR (any Samsung Galaxy S7)
Samsung_G935x_QC_Rooted_BOOT.TAR (any Samsung Galaxy S7 Edge)

Still in Odin, click 'Start' to flash the engineer-rooted boot image and reboot the phone.

When the phone has finished rebooting and while it is still connected to your PC, enter settings and re-enable USB debugging if it has been disabled.

Download and extract SuperSU flash package:
SuperSU-v2.76-S7QC.zip (MD5 hash E6990D0A34B0142C1F35D2EB386D748F) (mirror) (credit Chainfire)

Start the SuperSU flash package by double-clicking 'root.bat' from 'SuperSU-v2.76-S7QC'. Once it finishes, the phone will automatically reboot again. If double-clicking 'root.bat' only briefly shows a command prompt that quickly disappears, then most likely your PC is not recognized/authorized for USB debugging, the USB cable isn't connected, or ADB isn't properly installed. Check the steps above and try again or check the F.A.Q./Help section of this guide for more.

You'll know that the 'root.bat' process has completed successfully when your phone reboots. Once it has finished rebooting, SuperUser may inform you that the 'su' binary is outdated and that you should update. Dismiss this notice for now as Chainfire has indicated that our build is unsupported and that we should not update. As of right now (July 15, 2016), v2.76 is the most recent version for our phone.

Proceed to the recommended next steps to fix some odd quirks and behaviors with the root boot image.

RECOMMENDED NEXT STEPS (after rooting)

Prerequisite: rooted Samsung Galaxy S7 or Samsung Galaxy S7 Edge (any carrier)

Install Xposed (optional, instructions below).

Debloat and fix several issues with the phone (CPU lag issues, poor battery performance, phone becoming too hot, Wi-Fi not saving passwords, hotspot/tethering not working, VoLTE icon appearing, searching for service issues, MMS not working, unauthorized security nag notification, etc.):

On your phone, open the SuperSU app (installed during the root process) and tap on Settings. Half-way down under Security, tap on "Enable su during boot". This option will ensure that startup scripts that are installed during this process get to do their job correctly.

Install FlashFire on your phone:
https://play.google.com/store/apps/details?id=eu.chainfire.flash

Download the fix or fix+debloat script flashable ZIP package appropriate for your model of phone and copy this file to your device:
S7_or_S7Edge_Fixes_V15.zip (MD5 hash F15CD9BDC35382A8F48FFBEDBB1BCDF0) (any Samsung Galaxy S7 or S7 Edge)
S7_or_S7Edge_Fixes_Debloater_V15.zip (MD5 hash 4DED5D7B09BB7672723AAA77F395BC87) (any Samsung Galaxy S7 or S7 Edge)
VZWS7_PE1_Fixes_V15.zip (MD5 hash 7FEE320A9749B7CDFBAEACCBDC8AC45C) (Verizon Samsung Galaxy S7 on *PE1 firmwre)
VZWS7_PE1_Fixes_Debloater_V15.zip (MD5 hash 9146006E9A3C5AB5CAF9EB6123F7DB77) (Verizon Samsung Galaxy S7 on *PE1 firmwre)
VZWS7Edge_PE1_Fixes_V15.zip (MD5 hash 5F7CC8C95D316332B581F982D4ECAAF9) (Verizon Samsung Galaxy S7 Edge on *PE1 firmwre)
VZWS7Edge_PE1_Fixes_Debloater_V15.zip (MD5 hash 00850CA4D879660E74A54CFD3D47D0E5) (Verizon Samsung Galaxy S7 Edge on *PE1 firmwre)

What's special with the Verizon-only files? We flash a patched /system/framework/framework-res.apk that bypasses Verizon's Wi-Fi hotspot tethering provisioning. This is only compatible with the PE1 firmware and only for Verizon.

Full notes on what this flashable update does:

Adds a rotate button to the native gallery app.
Adds a shortcut call button in the call log next to each logged call.
Adjusts several CPU tunables, which fixes phone lag and battery life issues.
Disables "No SIM" popup when no SIM card is present.
Disables roaming data by default.
Disables secure storage support, which fixes Wi-Fi passwords not saving issue.
Disables Verizon provisioning for Wi-Fi tethering/hotspot (will still use your data plan, of course).
Enables ADB to run as root by default.
Enables CPU idling/sleeping, which fixes phone heat issues.
Enables mock GPS locations.
Enables native call recording feature in the dialer.
Enables native Wi-Fi calling feature in the dialer.
Enables RIL power saving features.
Enables scheduled messages in the native messaging app.
Enables the camera during calls.
Enables unlimited contact merging.
Enables using the new 3GPP2 Profile ID (Verizon exclusive).
Fixes various 'searching for service' and other cellular network connectivity issues (SMS/MMS not working, calls not working, etc.)
Knox apps, drivers, and data are removed (fix+debloat version).
Prefers LTE network.
Raises the contact name length limit to 1,280 characters.
Raises the maximum SMS recipient limit from 10 to 90.
Remove nagging 'unauthorized actions' security notification (fix+debloat version).
Removes VoLTE icon.
Removes bloatware and/or apps that can be downloaded from the Play Store and don't need to live in /system (fix+debloat version):

AdvSoundDetector2015
Amazon_Audible
Amazon_IMDB
Amazon_MP3
Amazon_Shopping
Amazon_Shopping_vpl
AmazonInstaller_ATT
AmazonKindle_vpl_ATT
AmazonShopping_vpl_ATT
BBCAgent
Bridge
BriefingPanel
Chrome
ChromeCustomizations
CloudGateway
com.customermobile.preload.vzw
com.govt.nflgamecenter.us.lite
com.samsung.android.securitylogagent
com.sec.knox.store
ContainerAgent
ContainerEventsRelayManager
DigitalLocker_ATT
Directtv_Shade_ATT
Directv_ATT
DriveMode_ATT
Facebook_stub
FamilyUtility_ATT
FBInstagram_stub
FlipboardBriefing
Gmail2
Go90
Hangouts
IgniteVerizon
Kindle
KLMSAgent
KnoxAppsUpdateAgent
KnoxAttestationAgent
KnoxFolderContainer
KnoxSetupWizardClient
KnoxSwitcher
LLKAgent
Lookout_ATT
Lookout_TMO
Maps
MILK_US
MobileLocate_ATT
Music2
MyATT_ATT
MyInfozone
NaverTvCast
Plenti_vpl_ATT
preloadedkiosk
preloadedmdm
preloadedsoo
RCPComponents
RemoteSupport_ATT
Safetyinformation
SDM
SDMViewer
SecHelp
SecurityLogAgent
SimLock_TMO
Slacker
Swype
UniversalMDMClient
Videos
VMS
VzCloud
VZNavigator
WhatsAppDownloader
WhitePagesNameId-release_TMO
withTV

Launch FlashFire on the phone and click the (+) button in the lower right to add a step. Select a 'Flash ZIP or OTA' flash step. Locate the flashable ZIP package and select it. For options, check on 'Mount /system read/write' and leave the rest of the options unchecked.

Scroll all the way down and click the 'Flash' lightning button in the lower left to commit this single step and wait a few moments. You should see the phone flash the package briefly before rebooting twice.

Problems getting this patch to run? Unfortunately, I can't test the universal script on devices I don't have, so if it's not compatible with your flavor of S7 or S7 Edge, you can perform most of the critical stuff manually by following these instructions:

Fix odd lag issues by setting the kernel governor to 'ondemand' or 'interactive' using Kernel Adiutor (ROOT) or Trickster MOD Kernel Settings:
https://play.google.com/store/apps/details?id=com.grarak.kerneladiutor
https://play.google.com/store/apps/details?id=com.bigeyes0x0.trickstermod

This is a poor-man's fix as it will not appropriately set CPU settings for both big and little core clusters, only the little core cluster. Also it won't re-enable some sleep states so it will still have battery issues.

Fix an issue with the Wi-Fi not saving passwords after reboots by editing the build.prop and setting 'ro.securestorage.support' to 'false'. I used JRummy's BuildProp editor:
https://play.google.com/store/apps/details?id=com.jrummy.apps.build.prop.editor

Remove nagging 'unauthorized actions' security notification by removing or disabling the SecurityLogAgent (com.samsung.android.securitylogagent) app using Package Disabler or Titanium Backup:
https://play.google.com/store/apps/details?id=com.ospolice.packagedisablerpro
https://play.google.com/store/apps/details?id=com.keramidas.TitaniumBackup

Hide the VoLTE icons by downloading and pushing a new APK:
imsservice.apk (credit x3demond3x)

Deep debloat: freeze all bloat using my separate guide (includes flashable update).

Also maybe check out my fine-tuning performance guide for the more hardcore.

Want ViPER4Android? There's a version for SELinux-enforcing kernels now that's compatible with our phone! (ViPERAtmos 4.8 Sony Beats Universal Edition.zip at the bottom of the linked thread)

INSTALL XPOSED (after rooting)

Prerequisite: rooted Samsung Galaxy S7 or Samsung Galaxy S7 Edge (any carrier)

Install FlashFire on your phone:
https://play.google.com/store/apps/details?id=eu.chainfire.flash

Download the Xposed flashable ZIP package and copy this file to your device:
xposed-v85.1-sdk23-arm64-custom-build-by-wanam-20160530.zip (MD5 hash F62C21CA8A8B7E015622D116CD8F4B8C) (credit Wanam)

Launch FlashFire on the phone and click the (+) button in the lower right to add a step. Select a 'Flash ZIP or OTA' flash step. Locate the Xposed flashable ZIP package and select it. For options, check on 'Mount /system read/write' and leave the rest of the options unchecked.

Click the (+) button again to add another step. Select Wipe and only choose to wipe the 'Dalvik cache' and the 'Cache partition' (format method not required, but it won't hurt, either).

Scroll all the way down and click the 'Flash' lightning button in the lower left to commit these two steps and wait a few moments. You should see the phone flash the package briefly before rebooting twice.

During the final reboot, you will see the animated boot screen appear for a very long time (three to five minutes or longer) before the screen changes to an 'Android is starting...' green screen with animated gears indicating that it is 'optimizing' apps. It is building a new Dalvik cache which should take several minutes. This is all normal; so no need to panic if it takes longer!

Once the phone finally finishes booting, you can continue.

Download the Xposed Installer APK and install it from internal storage or over ADB:
XposedInstaller_3.0_alpha4.apk (credit Wanam)

RETURN TO STOCK (unroot)

Prerequisites: Samsung Galaxy S7 or S7 Edge and Microsoft Windows PC on one of these carriers: AT&T, Sprint, T-Mobile, US Cellular, or Verizon

Install Samsung USB device drivers
SAMSUNG_USB_Driver_for_Mobile_Phones.zip (mirror)

Connect phone to PC via USB.

Download and extract Odin3 v3.12 (try either version)
Odin3_v3.12.zip (MD5 hash F4BAE9E20925DA85854A9C49E8E06F1C)
Odin3_v3.12_PrinceComsy.zip (MD5 hash 136E707B39C2E4CDC47820C68065CD5C) (credit PrinceComsy)

Note: most people use the PrinceComsy version, but some AT&T users said the other version will prevent bootloop/stuck AT&T logo.

Download and extract the Samsung Galaxy S7 or S7 Edge stock firmware image appropriate for your model of phone:
ATT_G930AUCS2APF2.zip (MD5 hash B9314F30E00E541C8700DC9F5E039513) (AT&T Samsung Galaxy S7)
ATT_G935AUCS2APF2.zip (MD5 hash BB4904F9D6E730F23AE0DC727AC87752) (AT&T Samsung Galaxy S7 Edge)
SPT_G930PVPU2APF2.zip (MD5 hash A463543B398CE49FD7F5DE97DF456AB3) (Sprint Samsung Galaxy S7)
SPT_G935PVPU2APE1.zip (MD5 hash C31850FE02C0EDC5588ECAB99A6B5D2F) (Sprint Samsung Galaxy S7 Edge)
TMB_G930TUVU3APG1.zip (MD5 hash 0BD0E1899113643C46916BB597CB7212) (T-Mobile Samsung Galaxy S7)
TMB_G935TUVU3APG1.zip (MD5 hash EB35AB39E178C3EC442632FE6D61B0B5) (T-Mobile Samsung Galaxy S7 Edge)
USC_G930R4TYU2APE2.zip (MD5 hash BC9AFEF1E508D10DA1BC17638C25959B) (US Cellular Samsung Galaxy S7)
USC_G935R4TYU2APE2.zip (MD5 hash F5A361989EADBF65A178F0A2212CC376 ) (US Cellular Samsung Galaxy S7 Edge)
VZW_G930VVRU2APE1.zip (mirror) (MD5 hash 248CAE83530C167F98B2EAF4AA93E79A) (Verizon Samsung Galaxy S7)
VZW_G935VVRU2APE1.zip (mirror) (MD5 hash C01226B362F123945B3E4C1F257A501A) (Verizon Samsung Galaxy S7 Edge)

Power off the phone. Turn it back on while holding Home, Volume Down, and Power buttons at the same time to enter download mode. Press Volume Up to confirm that you want to flash data to the phone.

Open Odin. Click 'AP' and select the appropriate AP TAR file:
AP_G930AUCS2APF2_CL7617530_QB9897892_REV02_user_low_ship_MULTI_CERT.tar.md5 (AT&T Samsung Galaxy S7)
AP_G935AUCS2APF2_CL7617530_QB9897831_REV02_user_low_ship_MULTI_CERT.tar.md5 (AT&T Samsung Galaxy S7 Edge)
AP_G930PVPU2APF2_CL8196840_QB9937218_REV02_user_low_ship_MULTI_CERT.tar.md5 (Sprint Samsung Galaxy S7)
AP_G935PVPU2APE1_CL7925126_QB9447145_REV02_user_low_ship_MULTI_CERT.tar.md5 (Sprint Samsung Galaxy S7 Edge)
AP_G930TUVU3APG1_CL8439036_QB10212948_REV02_user_low_ship_MULTI_CERT.tar.md5 (T-Mobile Samsung Galaxy S7)
AP_G935TUVU3APG1_CL8439036_QB10213096_REV02_user_low_ship_MULTI_CERT.tar.md5 (T-Mobile Samsung Galaxy S7 Edge)
AP_G930R4TYU2APE2_CL7999897_QB9615072_REV02_user_low_ship_MULTI_CERT.tar.md5 (US Cellular Samsung Galaxy S7)
AP_G935R4TYU2APE2_CL7999897_QB9615073_REV02_user_low_ship_MULTI_CERT.tar.md5 (US Cellular Samsung Galaxy S7 Edge)
AP_G930VVRU2APE1_CL7722939_QB9709794_REV02_user_low_ship_MULTI_CERT.tar.md5 (Verizon Samsung Galaxy S7)
AP_G935VVRU2APE1_CL7722939_QB9709803_REV02_user_low_ship_MULTI_CERT.tar.md5 (Verizon Samsung Galaxy S7 Edge)

It will take a few moments to verify the MD5 of this very large file.

Now click 'CP' and select the appropriate CP TAR file:
CP_G930AUCS2APF2_CL7617530_QB9897892_REV02_user_low_ship_MULTI_CERT.tar.md5 (AT&T Samsung Galaxy S7)
CP_G935AUCS2APF2_CL7617530_QB9897831_REV02_user_low_ship_MULTI_CERT.tar.md5 (AT&T Samsung Galaxy S7 Edge)
CP_G930PVPU2APF2_CL8196840_QB9937218_REV02_user_low_ship_MULTI_CERT.tar.md5 (Sprint Samsung Galaxy S7)
CP_G935PVPU2APE1_CL7925126_QB9447145_REV02_user_low_ship_MULTI_CERT.tar.md5 (Sprint Samsung Galaxy S7 Edge)
CP_G930TUVU3APG1_CL8439036_QB10212948_REV02_user_low_ship_MULTI_CERT.tar.md5 (T-Mobile Samsung Galaxy S7)
CP_G935TUVU3APG1_CL8439036_QB10213096_REV02_user_low_ship_MULTI_CERT.tar.md5 (T-Mobile Samsung Galaxy S7 Edge)
CP_G930R4TYU2APE2_CL7999897_QB9615072_REV02_user_low_ship_MULTI_CERT.tar.md5 (US Cellular Samsung Galaxy S7)
CP_G935R4TYU2APE2_CL7999897_QB9615073_REV02_user_low_ship_MULTI_CERT.tar.md5 (US Cellular Samsung Galaxy S7 Edge)
CP_G930VVRU2APE1_CL7722939_QB9709794_REV02_user_low_ship_MULTI_CERT.tar.md5 (Verizon Samsung Galaxy S7)
CP_G935VVRU2APE1_CL7722939_QB9709803_REV02_user_low_ship_MULTI_CERT.tar.md5 (Verizon Samsung Galaxy S7 Edge)

Now click 'CSC' and select the appropriate CSC TAR file:
CSC_ATT_G930AATT2APF2_CL7617530_QB9897892_REV02_user_low_ship_MULTI_CERT.tar.md5 (AT&T Samsung Galaxy S7)
CSC_ATT_G935AATT2APF2_CL7617530_QB9897831_REV02_user_low_ship_MULTI_CERT.tar.md5 (AT&T Samsung Galaxy S7 Edge)
CSC_SPT_G930PSPT2APF2_CL8196840_QB9937218_REV02_user_low_ship_MULTI_CERT.tar.md5 (Sprint Samsung Galaxy S7)
CSC_SPT_G935PSPT2APE1_CL7925126_QB9447145_REV02_user_low_ship_MULTI_CERT.tar.md5 (Sprint Samsung Galaxy S7 Edge)
CSC_TMB_G930TTMB3APG1_CL8439036_QB10212948_REV02_user_low_ship_MULTI_CERT.tar.md5 (T-Mobile Samsung Galaxy S7)
CSC_TMB_G935TTMB3APG1_CL8439036_QB10213096_REV02_user_low_ship_MULTI_CERT.tar.md5 (T-Mobile Samsung Galaxy S7 Edge)
CSC_USC_G930R4USC2APE2_CL7999897_QB9615072_REV02_user_low_ship_MULTI_CERT.tar.md5 (US Cellular Samsung Galaxy S7)
CSC_USC_G935R4USC2APE2_CL7999897_QB9615073_REV02_user_low_ship_MULTI_CERT.tar.md5 (US Cellular Samsung Galaxy S7 Edge)
CSC_VZW_G930VVZW2APE1_CL7722939_QB9709794_REV02_user_low_ship_MULTI_CERT.tar.md5 (Verizon Samsung Galaxy S7)
CSC_VZW_G935VVZW2APE1_CL7722939_QB9709803_REV02_user_low_ship_MULTI_CERT.tar.md5 (Verizon Samsung Galaxy S7 Edge)

Now click 'Start' to flash the stock images and reboot the phone.

F.A.Q. / HELP, I'M STUCK!

Will I lose my data during the root process?
You shouldn't if you're just rooting, however you should always make a backup. Helium from the Play Store is a good choice as is Samsung's built-in cloud backup. If you have to flash the stock image for any reason, it will erase your app data as well as the internal storage (internal sdcard) so be sure you copy any important files to a safe location first. It's always a good idea to have backups and it's generally assumed that users who are looking for root/admin access to their phones know and accept the risks involved.

Does this method trip Knox?
No, it doesn't. And flashing back to stock will allow Knox to work again, as long as you didn't flash files from other sources (there are some that will trip Knox, so be careful).

Does Samsung Pay work?
No, sorry. They can detect the rooted boot environment through a driver, so you can't even hide root from the app using RootCloak.

Does Android Pay work?
It does, but you have to make a change that disables root and then reboot your phone. You can toggle this back/forth without flashing, but you either get root or Android Pay at any one time.

What happens if I brick my phone?
As long as there are stock images to flash back to, it's almost impossible to do this no matter how badly the process goes. Check that we have stock images; if we do, then we can always flash them over the device using the unroot method in this guide. That practically guarantees a return-to-stock experience for a phone as long as it doesn't have any serious physical damage preventing it from powering on.

I installed the ADB system-wide on my Windows computer/laptop, but I see "'adb' is not recognized as an internal or external command, operable program or batch file".
Your user profile path can't contain a space. That means if your Windows user is 'Somebody Nice' and thus your Windows user path is 'C:\Users\Somebody Nice', the install will fail. You can create another user on your computer (if prompted for a Microsoft login, choose to make only a local account) and enter a short, single-word name for your user. Sign into and use that user profile instead. Also, the path where you extract the SuperSU package can't contain a space, so try extracting them to somewhere simple like perhaps C:\S7Root.

I can't get Odin to flash the images.
This typically means you haven't followed the instructions carefully. Read the prerequisites for each section, don't skip or skim anything, and make sure you've downloaded the files for your phone. This guide works for both the S7 and S7 Edge, so only download the correct files relative to your device. There are also two versions of Odin going around that work slightly different from each other. If one is causing issues, try the other.

BusyBox won't install.
Try another BusyBox installer, like JRummy's BusyBox for Android which is known to work.

I am seeing odd blank menus in Settings that causes it to force-close when I click it. Also Quick Settings force-closes when editing.
We suspect that XTouchWiz is causing this and I recommend uninstalling that Xposed module. Then either flash the latest version of my fix+debloater package in the 'Recommended Next Steps' section or manually use a file explorer to delete /system/csc/feature.xml (leave everything else alone). Reboot and the menus and force-closes should be fixed.

Additional Credit:
Thanks @Chainfire for supporting us with a custom SuperSU and su binaries on our devices, for Flashfire, and for so, so much more over the years.
Thanks @wanam for his great work with Xposed.
Thanks @princecomsy for his original guide in the AT&T S7 forum and the many people posting with their early findings and notes as well as his version of Odin.
Thanks @x3demond3x for a new imsservice.apk.
Thanks @jrkruse for the original S7 Edge fixes/debloater script and a patched framework-res.apk for Verizon phones.
Thanks @airos4 for a hint about secure startup preventing the su binary from functioning.
Thanks @cuezaireekaa for several suggestions and a link to working ViPER4 for our SELinux-enforcing phone.

Notes:
I am using the PrinceComsy version of Odin in these instructions. I understand that it's not necessary for all carrier variants, but for consistency it made its way to my notes and is the version that I personally used. Additionally, I have mirrored most of these files on my server since they were originally uploaded to websites with malicious ads and malware.

 

[jayochs]

nice, thanks! the original thread says since this is an engboot, it's unstable and not advised for daily use. does that mean this will be buggy if we root? are there ways to make it more stable?

 

[psouza4]

nice, thanks! the original thread says since this is an engboot, it's unstable and not advised for daily use. does that mean this will be buggy if we root? are there ways to make it more stable?

I think the caution is that the boot image wasn't intended for everyday use so there's the potential for quirky behavior. Except for the WiFi issue (there's a set-it-and-forget-it workaround), I haven't had any issues and have been using it all day setting up all my favorite root stuff.

 

[jayochs]

so i assume this completely wipes the phone, right? so the wifi issue is fixed by a build prop edit too?

Sent from my Samsung Galaxy S7 using Tapatalk

 

[psouza4]

so i assume this completely wipes the phone, right?

Only to unroot, you can otherwise root and install Xposed without clearing data just fine.

the wifi issue is fixed by a build prop edit too?

Yep, can personally confirm.

 

[nnguyen]

Only to unroot, you can otherwise root and install Xposed without clearing data just fine.

Yep, can personally confirm.

Been trying to unlock LTE band 12 on my vzw s7. With root, can i access Diag mode via hidden menu? Has anyone try this yet?

Will hidden menu work by just enable band 12 without qualcomm dp tool?

 

[psouza4]

It's anyone's guess -- try it and report back? We're kind of treading in new waters here.

 

[jayfried]

Thank you for the info, I am rooted, let the debloating begin! Any thoughts on wifi hotspot yet?

 

[xocomaox]

Does anyone know if making a bad build.prop change and getting into a bootloop can be resolved by simply re-flashing (dirty) the engineering firmware again? I only ask because I find it dangerous to be messing with root settings if I do not have the ability to do a full backup in TWRP...

 

[psouza4]

Does anyone know if making a bad build.prop change and getting into a bootloop can be resolved by simply re-flashing (dirty) the engineering firmware again? I only ask because I find it dangerous to be messing with root settings if I do not have the ability to do a full backup in TWRP...

If you bootloop, your best option (since we don't have custom recovery) is to grab the stock Verizon S7 image, flash it, boot your phone and go through the normal setup, then perform the root steps again. I had to do this when I made a mistake trying to get Xposed working and was deodexing files (unnecessary anyway, it turns out).

If you're on an S7 Edge, there aren't any stock files to flash though that I've seen offhand, so that could be dangerous. You'll note that my unroot/restore method has a prerequisite that includes the S7 not an S7 Edge.

TL;DR: on a Verizon S7, you can recover from bootloop, screwing up your /system partition, etc.

 

[xocomaox]

If you bootloop, your best option (since we don't have custom recovery) is to grab the stock Verizon S7 image, flash it, boot your phone and go through the normal setup, then perform the root steps again. I had to do this when I made a mistake trying to get Xposed working and was deodexing files (unnecessary anyway, it turns out).

If you're on an S7 Edge, there aren't any stock files to flash though that I've seen offhand, so that could be dangerous. You'll note that my unroot/restore method has a prerequisite that includes the S7 not an S7 Edge.

TL;DR: on a Verizon S7, you can recover from bootloop, screwing up your /system partition, etc.

Oh, damn! That's no good. I had no idea the S7 Edge had no "return to stock" method.

But if we re-flash that engbuild of the firmware (assuming you can get to a point to actually flash it) then it should revert any build.prop changes made and be okay.


EDIT: What about these? http://xdaforums.com/verizon-s7-edge/how-to/firmware-verizon-s7-edge-t3344092

 

[psouza4]

But if we re-flash that engbuild of the firmware (assuming you can get to a point to actually flash it) then it should revert any build.prop changes made and be okay.

No, the engboot is just a rooted engineer's boot image and does not affect the system partition that I'm aware of, thus it can't fix issues with the system partition.

Oh, damn! That's no good. I had no idea the S7 Edge had no "return to stock" method.

EDIT: What about these? http://xdaforums.com/verizon-s7-edge/how-to/firmware-verizon-s7-edge-t3344092

Bingo -- that's exactly what you need to restore a /system partition in case of error or for warranty reasons, etc. Glad you found it! I may have to update my notes.

 

[xocomaox]

No, the engboot is just a rooted engineer's boot image and does not affect the system partition that I'm aware of, thus it can't fix issues with the system partition.

Now I understand, thank you!

 

[sasquatch1]

Anybody else getting constant Samsung security alert notices after rooting? Mine pop up after I reboot the phone.

 

[psouza4]

Anybody else getting constant Samsung security alert notices after rooting? Mine pop up after I reboot the phone.

Freeze the package SecurityLogAgent (com.samsung.android.securitylogagent) using Package Disabler or Titanium Backup, etc.. I'll add it to my recommended next steps.

 

[sasquatch1]

Freeze the package SecurityLogAgent (com.samsung.android.securitylogagent) using Package Disabler or Titanium Backup, etc.. I'll add it to my recommended next steps.

Thank you, that worked. Is there a work around to get the Charging/Photo/File transfer back in the notifications drop down? All I have is Charging listed.

 

[psouza4]

Thank you, that worked. Is there a work around to get the Charging/Photo/File transfer back in the notifications drop down? All I have is Charging listed.

I haven't encountered this issue, but I'm on a fresh data wipe after installing Xposed just because I'm paranoid about random issues (and several have been reported). You may want to check Settings -> About Phone -> tap on the device build a bajillion times until it tells you that you're a developer -> back out -> Developer Options -> USB configuration (about half way down)

 

[goblygoop]

I haven't updated since launch. Should I take the security updates prior to this or can I take them after?

 

[jonno95]

Thank you, that worked. Is there a work around to get the Charging/Photo/File transfer back in the notifications drop down? All I have is Charging listed.

I also had the same problem however if you go into settings, developer options, there is an option under the "networking" section called USB configuration and you can change it to MTP or whatever you would like there.

found here by j3ffm1ll, so give him your thanks.

edit... oops, i guess psouza4 also mentioned it, but for some reason i thought it was talking about toggling the debug option. so i guess give him your thanks. lol, sorry

 

[psouza4]

I haven't updated since launch. Should I take the security updates prior to this or can I take them after?

I did (two weeks ago, finally had given up hope) and it's fine. Even if it weren't, we have stock images we can flash. So all is well!