[ROOT] N920A - 7.0/6.0.1/5.1.1 - [The Current State 7/5/19]

Search This thread

VanillaG0rilla

Senior Member
Mar 15, 2012
534
117
Pittsburgh
No worries @Delgoth. Thanks for getting back to us. If i can, ill try measing around with it today and let you know what happens.

Im actually in need of a Verizon note 5. I thought I could unlcok the att one to work with Verizon but apparently not.

Anyone happen to have a verizon phone and wanna switch?
 

Delgoth

Senior Member
Dec 1, 2010
636
183
No worries @Delgoth. Thanks for getting back to us. If i can, ill try measing around with it today and let you know what happens.

Im actually in need of a Verizon note 5. I thought I could unlcok the att one to work with Verizon but apparently not.

Anyone happen to have a verizon phone and wanna switch?

Yeah the 7420 board did come with a different QC modem for each carrier it seems. But hopefully you guys can take all this and run with it. I have to leave for a little while. Things resurfaced. Again. Everytime I speak on this subject weird things start happening. Same as it was 3 years ago. So I probably won't be able to elaborate any further. Good luck. The CP boots first on the board and carries out the rest.

EDIT: I guess really it doesn't matter though. It will just help teach me the part I don't understand that well yet. Too bad I deleted the information from that thread back then.
 
Last edited:

Delgoth

Senior Member
Dec 1, 2010
636
183
Update: Please check out this thread for newly uncovered information regarding root on the newer bootloaders.

https://forum.xda-developers.com/ve...-aoj3-v1-0-t3940543/post79760804#post79760804

We should be able to translate this to the N920A on rev 4 and 5 bootloaders. If we can downgrade to 5.1 and then root the combination firmware, we can install safestrap and use it to the max.

From there, we can find a good 5.1 stock build to use with afaneh92's method on the N920V. But from there even, we should be able to use jrkruse's method to install a nougat system with safestrap preinstalled.

With Safestrap in use on Nougat, I feel like Nougat is still exploitable enough on the Note 5 to gain root now it no longer gets security updates.

There have been a lot of big time patches in the last 8 months that should be able to be leveraged.
 
Last edited:

xenomorph318

Senior Member
Jun 30, 2018
63
9
Nexus 7
I feel like it really might be possible to install Safestrap on the LP Combination Firmware. And from there a lot is possible.

I Successfully gotten safestrap installed and working on Rev. 4 920a combo PL1 factory binary. Im really digging that btw. I cannot for the life of me get either the Rapture zip or the NOBLE ROM to stick at all. Ive tried every combination in flashfire and in safestrap. They both successfully install without error both ways if u wipe before hand, otherwise they still flash just have an error. In safestrap i even changed boot slots once i found that was an option. The splash image for safe strap changes to activated that way and you get one bootloop and then boots to recovery as opposed to the flashfire you go straight to userfault screen. I been falshing every zip i come across for 920a just for the heck of it really tbh lol Fun stuff!
 

Delgoth

Senior Member
Dec 1, 2010
636
183
I Successfully gotten safestrap installed and working on Rev. 4 920a combo PL1 factory binary. Im really digging that btw. I cannot for the life of me get either the Rapture zip or the NOBLE ROM to stick at all. Ive tried every combination in flashfire and in safestrap. They both successfully install without error both ways if u wipe before hand, otherwise they still flash just have an error. In safestrap i even changed boot slots once i found that was an option. The splash image for safe strap changes to activated that way and you get one bootloop and then boots to recovery as opposed to the flashfire you go straight to userfault screen. I been falshing every zip i come across for 920a just for the heck of it really tbh lol Fun stuff!

Wow. OMG yes. So safestrap works!!! So. Now we need to just get the system image on there. This is great news indeed. We need something like like "libtcp.so" and another file to get a stock system to boot. We can't use the N920V zip exactly but make the same thing out of our firmware.
 

xenomorph318

Senior Member
Jun 30, 2018
63
9
Nexus 7
Wow. OMG yes. So safestrap works!!! So. Now we need to just get the system image on there. This is great news indeed. We need something like like "libtcp.so" and another file to get a stock system to boot. We can't use the N920V zip exactly but make the same thing out of our firmware.

I grabbed both libtcp.so from system/lib/ and system/lib64/
 

Delgoth

Senior Member
Dec 1, 2010
636
183
I grabbed both libtcp.so from system/lib/ and system/lib64/

Well i finally got my external booted up and accessible, finally. It has all my n920a firmware on it and I've been unable to get that partition to mount for a couple weeks. Haven't had time to mess with it to hard. But now I should be able to dig into the FW to maybe make up a package.

So I'm interested to see if I can come up with something now. I have a newer Linux Environment setup with the img tools. So hopefully I can parse the FW enough to find the way to make the PL1 combo bootloader & kernel to boot one of the rev2 LP system images.

*****

Because that is the real goal here, to take one of the stock LP system images made for the rev2 BL and use Safestrap to flash it over the 4APL1 combo system image and still have it boot. That way we can try and run stock LP on a revision 4 bootloader. It's been managed then on the N920V, and now the N950U as well. So it shouldn't be but a thing to make it happen on the n920a, there is prolly just a couple loose ends yet to be pinned down.
 
Last edited:

xenomorph318

Senior Member
Jun 30, 2018
63
9
Nexus 7
Well i finally got my external booted up and accessible, finally. It has all my n920a firmware on it and I've been unable to get that partition to mount for a couple weeks. Haven't had time to mess with it to hard. But now I should be able to dig into the FW to maybe make up a package.

So I'm interested to see if I can come up with something now. I have a newer Linux Environment setup with the img tools. So hopefully I can parse the FW enough to find the way to make the PL1 combo bootloader & kernel to boot one of the rev2 LP system images.

*****

Because that is the real goal here, to take one of the stock LP system images made for the rev2 BL and use Safestrap to flash it over the 4APL1 combo system image and still have it boot. That way we can try and run stock LP on a revision 4 bootloader. It's been managed then on the N920V, and now the N950U as well. So it shouldn't be but a thing to make it happen on the n920a, there is prolly just a couple loose ends yet to be pinned down.

Im hyped! ima keep my eyes peeled for your hard work. to be honest i did get a lil jelly over N920V and N920U lmao. Cant wait to see what u come up with dude.
 

Delgoth

Senior Member
Dec 1, 2010
636
183
Im hyped! ima keep my eyes peeled for your hard work. to be honest i did get a lil jelly over N920V and N920U lmao. Cant wait to see what u come up with dude.

Well I'll probably need you to help test flash some stuff. Unless other people can report they can get safe strap installed and usable as well.
 
N920A 6.0.1 v4 bootloader root

PHP:
IMG_20200605_161704.jpg
[/IMG]Hi I am new to XDA. I have gotten root and would like to share my information.
Step 1) Odin flash 4apl1 combination file, check all the boxes under Odin options before you flash.
Step 2) let phone reboot after flashing then install wondershare mobile go apk installer and king flasher apk installer on the PC.
Step 3) install kingroot 4.8.2 on you phone using USB cable and mobile go apk installer or king flasher apk
Installer.
Step 4) open kingroot 4.8.2 run it and let it root your phone.
Step 5) install nova launcher prime 5.1.1 on your phone.
Step 6) open nova launcher app set it as your default
Launcher.
Step 7) in the nova launcher settings apk go to apps and widgets then go to the hide apps screen. Then check the boxes for the apps you don't won't to view
On your launcher. I will hide the combination firmware apps you don't want to view.
Step 8) install root checker, es file explorer, chrome betta, download manager, downloads, download all,
Stickmount, uninstaller root apk and any other apks you may like.
Step 9) use Odin again to flash n920a eng modem which can be downloaded from google.
Step 10) use Odin again to flash n920a eng boot file download it from google.
Step 11) install build prop editor set factory binary to zero
Step 12) install flashfire and terminal emulator and busybox
step 13) change kingroot to supersu using terminal emulator
Method.
Step 14) download and flash with flashfire your opengapps package for android 5.1 give your phone time to boot up.

Here is a rom link I have modified and tested it works flash with flashfire or safestrap then when the Rom boots up simply root with kinguser then change to supersu using the terminal emulator method.
https://www.dropbox.com/s/gmr28i326u9m3q0/N920A_5.1.1_Rootable_Rom2020(New)working.zip?dl=0
 
Last edited:
Here I am talking about the N920A 6.0.1 with v4 bootloader i have downgraded to 5.1.1 with the 4APL1 Combination Firmware and rooted. I have made progress I have successfully installed and fully booted up after making a lot of modifications to the noble zero rom over my 4apl1 combo bootloader and rooted again. I had to make a lot of modifications to the original rom to make it work. This really works it boots up successfully but only flash over the 4APL1 rooted combination firmware with safestrap or flashfire.

Here is the link address for the Rom I flashed over the rooted 4APL1 Combination Firmware. Once you are rooted with supersu flash this Rom with Flashfire or safestrap. Then once Rom finishes booting up simply root the Rom with kinguser again then change to supersu using the terminal emulator method.

IMPORTANT INFORMATION; When installing supersu with the terminal emulator method make sure supersu has uninstalled kinguser before rebooting the phone. If kinguser is not uninstalled do not reboot but instead after supersu has installed, uninstall kinguser with a root app called System App Safe remover app then reboot.

https://www.dropbox.com/s/gmr28i326u9m3q0/N920A_5.1.1_Rootable_Rom2020(New)working.zip? dl=0

Here is a short video on YouTube with all the necessary file links in the video description along with the Rooting procedure I used. The link is
https://youtu.be/J6GXvtxq2aA
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 14

    ** STOP & DO NOT **


    • Pass Go (... or collect 200 dollars ...)
    • Attempt this without reading the first page entirely at least
    • Attempt this without knowledge of how to recover from softbrick status
    • Flash any non official Firmware if you're banking on a warranty claim later {It may or may not work}
    • Post in this thread, any super negativity, disbelief, or naysaying.
    • Blame any Project/Thread contributor(s) for what YOU did, when YOU flashed your device. Please, no one forced you to press start in ODIN.

    Preface
    *****

    [FOR THE LATEST UPDATE: GO TO POST #185 for the next steps towards rev 4/5 bootloaders.]
    https://forum.xda-developers.com/showpost.php?p=79764173&postcount=185



    Bootloader v3 and v4 devices currently on MM or Nougat can use the Factory Binary for their particular bootloader version in order to install a 5.1.1 based ROM that can have an untethered full root. To downgrade back to 5.1.1 use the combination firmware available for your bootloader revision. From there you CAN root 5.1.1 un-tethered.

    ** I do believe using the Binary 5 Combination Firmware, you can still root using the method for the v4 Bootloader, if you don't mind downgrading back to 5.1.1 and being on the combination firmware.
    ** I still haven't got a root method for fully rooting 6.0.1, or rooting 7.0 at all. These root methods will have your device ending up on a 5.1.1 build of Android.

    For rooting Bootloader v4, please see @droidvoider 's Post #110, Post #110

    Since there have been many threads scattered throughout the N920A forums about how to root 6.0.1/5.1.1, and how to downgrade the AT&T Galaxy Note 5 MM Builds back to LL builds, I've decided to collect up all the information I've had time to gather. This thread pertains to downgrading marshmallow builds to lollipop builds, and it covers gaining a tethered root system. What I am also going to cover is what I've discovered about the Factory Binary Firmware for this device. This includes what I call the Eng Modem & Eng Sboot, and how the PB2 Eng Kernel can be used with all three of the above.

    Throughout all of my testing on the device, I have never once tripped my KNOX counter. The warranty remained valid on the device and it has been persistently rooted.

    @TechNyne66 has outlined {proven} instructions for attaining a Tethered Root. I know there are already a few threads circulating the forum here about Root Status & Progress of the Note 5, and I hate just adding one more to the mix, but this isn't meant to be a general discussion thread.

    I spent a lot of time reading over the last two years about the Exynos7420 SoC and I am always trying to learn more than high level google searches can give to me. There are a lot of hardware level topics involved I need more information on, hopefully the devs on XDA with this kind of knowledge would contact me. Because google does not always have the answers we search for when it comes to mobile hardware. It is in the minds of the devs here, and not always posted publicly. Not everyone in the world who wants the abilities granted by root access, is ready/able to deal with the potential hazards and security risks to their Device & Personal Lives. But they never will be ready, if we cannot study what those risks are in the first place.

    Just remember, there is a reason things like SuperSu exist in the first place. Without a method to manage access to root privelages by installed apps, you'd be using an Open Source Universal Remote that knows everything about you, its surrounding environment, and knows how to manipulate said data. Given the nature of the Exynos7420's 64bit Architecture, all known variants of the SM-G920, SM-G925, and SM-N920 should theoretically be able to run or boot any code we could ever write for a computing device. We have the build-tools. It's just a matter of using a specific version of a particular tool depending on the timing & current context. Ideally.


    My Device Results
    *****

    The firmware that was initially installed on my particular AT&T Note 5 when I first got it, was the August 1st 2016 build "UCS3BPH4". I have the Full ODIN Package, as well as the OTA.zip that upgrades PE6 to PH4. I also have the OTA.zip for upgrading PB2 to PE5.

    I really need, if anyone has some, any unreleased official OTA updates for adb instead of just all ODIN files. I'd also like some advice on how examine how the bootloader loads a kernel, and what it looks for when it does. The update chain of OTAs to the PE5 build would be great. The N920A is odd in the sense that AT&T released two different update paths for their devices. Some devices ended up on the left path, and some on the right path.

    When I flashed the Unlocked PH4 Modem, my device became carrier unlocked and opened the APN Editor. I consider it an Eng Modem.
    When I flashed the Eng PH1 Sboot.bin from the Factory Binary and the Eng PB2 Kernel, I became able to Flash+Root a Lollipop Build that would stick on rebooting. Using a device with a Version 3 Bootloader. If there are other ways to downgrade to lollipop from marshmallow without using the Eng Sboot, please tell me.

    I'm not trying to say at this point that the 3APH1 Firmware is actually a real eng binary like they found for the S8. But the system image on the firmware does have some interesting tidbits I haven't seen in any other Factory Binary I've messed with. It's more than normal.

    If you cannot find any of the items I'm referring to in the links below. PM Me.
    *****

    What I understand about 3BPH4
    1. Included Files in Full ODIN Package:
      AP_N920AUCS3BPH4_CL7563702_QB10603229_REV00_user_low_ship.tar.md5
      BL_N920AUCS3BPH4_CL7563702_QB10603229_REV00_user_low_ship.tar.md5
      CP_N920AUCS3BPH4_CL7563702_QB10603229_REV00_user_low_ship.tar.md5
      CSC_ATT_N920AATT3BPH4_CL7563702_QB10603229_REV00_user_low_ship.tar.md5
      NOBLELTE_USA_ATT.pit

    2. If I remember reading correctly, ODIN FW whose CSC file does not include a 'hidden.img' in their Cache.img are technically Unbranded ROMs. If this is still true today, then this firmware minus CSC is actually unbranded but uses the AT&T multi-cert CSC. Unless I didn't look hard enough, I did not find a hidden.img when I used CacheRipper to unpack the Cache.img -- I don't remember what post I read this in, I read many threads all the time, I can't confirm at this moment this assumption still holds in modern builds or this device series. Still testing other theories.

    3. I'm not sure about other N920a's, but I have a multi-CSC cert on the device, meaning it should be able to accept any firmware compatible within the same series. At least that's how I remember it being. Same goes for my VZW S5 & S6 Edge. -- I don't know how common Multi-CSC certs are still. I honestly can't remember NOT having a Multi-CSC on any of the Samsung Devices I've owned. Mine all have them. I just have some intuitive feeling the Multi-CSC is basically a requirement for Unlocking.

    4. I have successfully downgraded the AP file many times to earlier builds by flashing the AP by itself. I have successfully done a full cold boot after downgrading the PH4 AP file to PB2, OJ1, and OGG. I successfully flashed the PE6 AP file as well.

    5. I have successfully downgraded the CSC file many times when downgrading the AP file as well. I cannot remember at this moment if I had success downgrading the CSC by flashing only the earlier FW CSC file. The One time I can remember, I flashed only the '.PIT' file included with PH4 & the CSC file of the earlier FW. I do know that I've downgraded the AP file and not the CSC with no errors. I have NOT yet tried to downgrade the CSC file by itself to an earlier version than the Installed AP. -- It remains to be tested in more detail how the AP File and PIT File affect the flashing of a different CSC.

    6. The PH build series is the first publicly available FW for the N920A to use a Level 3 Bootloader Binary. I notice this change from Binary 2 to Binary 3 on most devices going from 5.1.1/6.0 to 6.0.1 Builds on Samsung Devices. With the Exception of Verizon, who has been using a Level 4 Bootloader Binary for quite some time, most Carriers are just now getting around to Level 3 Binaries in their Firmware. Leading many people to believe it is completely locked to a level 3 and can never boot anything designed for an earlier binary. -- While I have so far not been able to test a method for fully downgrading all parts of the BL File from Binary 3 to Revision 1 or 2, a Revision 3 bootloader can still boot a Binary 2 ROM. Although I'm told it is possible to fully downgrade all parts of the PH4 bootloader to an earlier version, but have not successfully done so.

    7. I have successfully downgraded the 3BPH4 sboot.bin included within the BL File of the Full ODIN Package. I did it by packaging the earlier sboot.bin into a tar by itself and flashing in the BL slot of ODIN (3.10.6). Anytime I try to flash a full revision 2 bootloader it quite expectedly fails the flash at param.bin. It trips the alarm in Download Mode by stating the error Binary 2 Device 3. In my successes here, Download Mode still showed Official Device Status, Valid KNOX Bit/Warranty Status, Passing DM-Verity Verification. In all my flashes thus far I've never tripped KNOX. Once, the device status changed from Official to Custom, but KNOX was still showing valid. It wouldn't boot due to an error about invalid kernel length, but everything was valid status under the hood. -- The two downgrades I'm referring to, are the downgrades from


      N920AUCS3BPH4 sboot -> N920AUCU3APH1 engsboot
      Using the Bootloader from the Factory Binary, we can downgrade from Android 6.0.1 to 5.1.1. I also have the N920C_XXU3API1_ENGSBOOT, but ODIN wouldn't even start to flash it before failing. I don't have the param.bin or cm.bin for either of the ENGSBOOT files. If they even exist publicly or privately.

      N920AUCS3BPH4 sboot -> N920AUCU2APB2 sboot
      Like I mentioned above, I downgraded the sboot from a binary 3 to a binary 2, by flashing only the sboot.bin and not trying to downgrade the param.bin or cm.bin. But I think having the stock PH4 param.bin & cm.bin could be what is leading to a couple roadblocks. While the flash to PB2 sboot went off without a hitch, and did successfully do a full boot, it only lasted for about 20 minutes. When more tests caused it to stick in a bootloop to prevent itself from tripping the KNOX warranty bit due to invalid kernel length causing failed boot. This is also the only time in all my tests that my Device changed from Official to Custom status. Reflashing the Full PH4 package returned everything back to Stock. I also flashed Systemless Root (Which worked btw! But Verity Caught it, hence why the session lasted only 20 minutes or so) during this test session which could have also done it potentially.


    8. My Best experience flashing most of the files I've tried successfully, came from using ODIN v3.10.6, and it does not seem to be a standard ODIN. Instead of just Odin3.exe & Odin3.ini, these are the files that came bundled inside the Odin zip:


      Odin Downloader Release Notes.xlsx
      Odin3 v3.10.6.exe
      Odin3.ini
      S1PlugIn.bundle_141117.zip
      SS_DL.dll



      But it seems like this version of ODIN has some kind of FTP mode within it for grabbing something I have no idea at this moment. So insights from someone smarter than me would be nice. I think FTP mode was enabled by connecting the Device to odin, while in RNDIS USB Mode. If not, I know that connecting to ODIN in that connection mode did something odd in one of the ODIN versions I have. ALSO, what are all the modded versions running around supposed to be used for exactly? And how were they modded? Often times they fail to flash simple things this v3.10.6 flashes successfully without blinking.[/color]



    *** *** ***


    Rooting/Downgrading Files Involved
    I.Note5 Online Repo - https://drive.google.com/folderview?id=0B4PoJYLnmv1BNzY2OXB3QlFfcVk
    ** This is the folder where I'm keeping all files referenced here + other N920A related material.

    II. Binary 3 Lollipop Bootloader (N920AUCU3APH1 sboot.bin, FRP eng Bootloader) - https://drive.google.com/folderview?id=0B4PoJYLnmv1BQ19qeVFUd2cxaWM
    ** This sboot can be flashed overtop of the Stock PH4 sboot.bin and IT WILL NOT trip KNOX. This is the only "binary 3" bootloader for our device I've found that will boot 5.1.1 based ROM's or Kernels. Using this bootloader, you can flash 5.1.1 based ODIN AP Firmware Files (ROMS) & continue to have Official Device status for Warranty/KNOX Purposes.

    III. 2APB2 Lollipop Eng Kernel - https://drive.google.com/folderview?id=0B4PoJYLnmv1BQVBfQUdYeE5IR1U
    ** This is a 5.1.1 based, rooted kernel. As far as I know this is a leaked Engineering Kernel from the 2APB2 build. Flashing this Kernel and the PH1 eng sboot, overtop of Stock PH4, gives access to an ADB Root Shell during the bootloop/failure. Flashing this kernel overtop of a stock LL based Kernel allows a bootable rooted system.

    IV. Metalcated g920a 5.1.1 Root v4 -
    ** This is Metalcated's Root Method for the Galaxy S6. This zip is used for the Root-Install & Root-Boot script files. The Root-Install command should be ran once the PB2 Kernel has been flashed and successfully rebooted the first time. Afterwards, the Root-Boot command should be ran during the device's next boot process, to continue using the PB2 Kernel & maintain a bootable system.

    *** *** ***

    6.0.1 Downgrading Instructions (tested using full Stock PH4 FW)
    1.) Enable Developer Options
    2.) Enable OEM Unlock
    3.) Enable USB Debugging (For a safe bet I make sure to "always remember the device" by saving the RSA Key)
    4.) Power Off then Boot into Download Mode
    5.) Flash the Binary 3 Lollipop Bootloader using the "BL" slot in ODIN. (Listed Above)
    6.) Once Bootlogo Appears, reboot into download mode by holding, VOL Down + HOME + POWER
    7.) Now Flash the AP File of the Lollipop FW you want to install. (The OGG ROM, has no DM-Verity in Recovery Mode)
    8.) Boot into Recovery Mode
    9.) Wipe Data/Factory Reset
    10.) Reboot

    *** *** ***

    5.1.1 Tethered Root Instructions (tested on PB2 & OJ1 ODIN AP FW/ROM's)
    1.) Enable Developer Options
    2.) Enable OEM Unlock
    3.) Enable USB Debugging (For a safe bet I make sure to "always remember the device" by saving the RSA Key)
    4.) Power Off then Boot into Download Mode
    5.) Flash the PB2 eng Kernel (Listed Above)
    6.) Once Booted, recheck steps 1-3, then run the "root-Install" script (.cmd for Windows, .sh for Linux) from Metalcated's zip archive.
    7.) During Device Boot Up, make sure the device the connected to your PC, and run the "root-Boot" script from Metalcated's zip archive. And the device should finish booting successfully with the PB2 eng Kernel still intact.z
    3
    We have another thread up in the General Android Q&A Forum. I currently have adb shell with eng kernel running Lollipop U1AOGG AP running the U3APH1 eng bootloader.

    I also have Busybox support, and can make persistent changes to the /system & /data directories

    Droidvoider has also created a type of custom odin/heimdall flashing application used during runtime.

    This is big stuff!!!

    https://forum.xda-developers.com/android/help/injecting-root-setting-selinux-stages-t3573036/page2
    3
    Please thank Delgoth + lowandslow200sx for this root!!

    Warning: This can lead to a ruined phone that can't be repaired proceed with caution!
    Warning: This HOWTO erases your contacts, stored music + photos, apps + data, Internal Storage, all of it GONE. Back it up before continuing!!
    Notice: When finished you will remain on Android 6.01 Marshmallow, you will not upgrade to Nougat. But you can get rid of AT&T + Samsung apps and extend battery life by a lot! You can do a lot more than that but it is SELinux Enforcing, so you still have some limits

    Introduction
    This HOWTO will outline how to gain root on AT&T Note 5 Marshmallow 6.01 through Nougat 7.0 before Feb 2018 update! i.e. basebands beginning in N920AUCS4. Such as N920AUCS4CPK1 through N920AUCS4EQL1
    If your baseband is N920AUCS3 or lower you can already root with Wondershare GoMobile (start at step 9)
    If your baseband is N920AUCS5 then this method won't work for you.
    Please be aware
    This is 1 of 2 root methods for binary 4 N920A Note 5 AT&T Phones!! There is also a Lolipop Android 5.11 root method that allows selinux permissive persistent root you can use on Post 51 of this thread!

    Gain root to disable any app and do other cool stuff

    1. You need the drivers for Note 5 but they are likely already installed test it via. Connect the USB charging cable between your computer<>Note 5 you should see your phone pop up in File Explorer
    (if you can't connect to your phone find the Samsung Note 5 drivers first)
    2. If you don't have adb installed first install it on your machine (you can test it by opening a cmd prompt and typing adb, you should get instructions for use)
    https://www.xda-developers.com/install-adb-windows-macos-linux/
    3. Install Wondershare GoMobile, it's a 5 day trial so be ready to do this!!
    4. Download and Unzip the Customized PJ1 + PK1 Firmware into a directory
    https://drive.google.com/open?id=1qHVndp4wZXeKb5TFZSnsUT-s3EBmkHVW
    5. Download Odin and Unzip it to a directory then click the file to start it up.
    6. Select Odin Options tab and in Odin check Auto Reboot, F.Reset Time and Nand Erase All
    (load the 4 files from the Customized PJ1 + PK1 zip into the respective slots)
    7. Place phone in download mode, connect it to your PC then in Odin select Start to flash the firmware, you can unplug cable when phone reboots.
    8. During initial phone setup disable Wifi, skip Google Play account, exit or skip everything you can.
    9. Disable security updates under SETTINGS|PERSONAL|Lock screen and security|Other security settings|Security policy updates|Automatic updates OFF
    10. Enable Developer options under SETTINGS|SYSTEM|About device (tap build numbers 7 times) then push arrow back to SYSTEM and open Developer options.
    11. Under Developer options OEM unlock and USB Debugging should both be ON
    12. Always allow usb debugging on phone screen when you are asked. Also allow MTP file transfer.
    13. If Google asks for feedback data always DECLINE, they don't help us!
    14. Connect cable and connect to Wondershare GoMobile then "One Click Root"
    15. After success open Windows Command Prompt and type adb shell, then su
    16. You can disable any apps now but start with these (copy / paste into cmd windows then hit enter)
    pm disable com.ws.dm
    pm disable com.sec.android.soagent
    pm disable com.policydm
    pm disable com.samsung.android.securitylogagent
    pm disable com.lookout
    17. You can enable Wifi and Sign in the Google Play now.
    18. If you reboot your phone you need to use One Click Root again to regain root, but you are free to unplug the cable!
    (If you crash your phone enter recovery mode, wipe data/factory reset, wipe cache and then start over from step 8.)

    Apps I disable

    Here's some apps you may not like. You can copy / paste these into cmd window but only in small batches at a time (hit enter after pasting it in the window)
    Code:
    [AT&T]
    pm disable com.att.android.digitallocker
    pm disable com.sec.enterprise.knox.attestation
    pm disable com.locationlabs.cni.att
    pm disable com.sec.att.usagemanager3
    pm disable com.att.myWireless
    pm disable com.yahoo.mobile.client.android.mail.att
    pm disable com.asurion.android.mobilerecovery.att
    pm disable com.synchronoss.dcs.att.r2g
    pm disable com.att.android.attsmartwifi
    pm disable com.wavemarket.waplauncher
    pm disable com.telenav.app.android.cingular
    pm disable com.smlds
    pm disable com.matchboxmobile.wisp
    pm disable net.aetherpal.device
    
    [Odd Apps I disabled]
    pm disable com.cequint.ecid
    pm disable com.facebook.katana
    pm disable com.facebook.system
    pm disable com.facebook.appmanager
    pm disable com.instagram.android
    pm disable com.amazon.mShop.android.install
    pm disable com.amazon.mShop.android
    pm disable com.google.android.apps.walletnfcrel
    pm disable com.americanexpress.plenti
    pm disable com.amazon.kindle
    pm disable com.hancom.office.editor
    pm disable com.google.android.talk
    pm disable com.sec.android.app.sbrowser
    pm disable com.mobitv.client.tv
    pm disable com.sec.android.service.health
    pm disable com.sec.android.app.shealth
    pm disable com.yellowpages.android.ypmobile
    pm disable com.google.android.feedback
    
    [Game related]
    pm disable com.enhance.gameservice
    pm disable com.wildtangent.android
    pm disable com.ampsvc.android
    
    [Sync Adapters]
    pm disable com.samsung.svoice.sync
    pm disable com.google.android.syncadapters.contacts
    pm disable com.google.android.syncadapters.calendar
    
    
    [Samsung Apps]
    pm disable com.sec.android.easyMover.Agent
    pm disable com.sec.android.Kies
    pm disable com.sec.android.app.billing
    pm disable com.sec.android.iap
    pm disable com.sec.spp.push
    pm disable com.sec.android.app.SecSetupWizard
    pm disable com.osp.app.signin
    pm disable com.sec.android.app.sns3
    pm disable com.sec.android.app.SamsungContentsAgent
    pm disable com.samsung.android.provider.filterprovider
    pm disable com.samsung.android.writingbuddyservice
    pm disable com.sec.android.widgetapp.samsungapps
    pm disable com.samsung.android.app.galaxyfinder
    pm disable com.samsung.android.themestore
    pm disable com.samsung.svoice.sync
    pm disable com.samsung.clipboardsaveservice
    pm disable com.samsung.android.provider.shootingmodeprovider
    pm disable com.samsung.android.app.withtv
    pm disable com.samsung.android.hmt.vrshell
    pm disable com.samsung.android.easysetup
    pm disable com.samsung.android.qconnect
    pm disable com.samsung.ucs.agent.boot
    pm disable com.samsung.faceservice
    pm disable com.samsung.knox.rcp.components
    pm disable com.samsung.android.email.provider
    pm disable com.samsung.android.intelligenceservice2
    pm disable com.samsung.android.MtpApplication
    pm disable com.sec.android.app.samsungapps
    pm disable com.samsung.android.slinkcloud
    pm disable com.samsung.android.SettingsReceiver
    pm disable com.samsung.android.securitylogagent
    pm disable com.samsung.android.app.watchmanager
    pm disable com.samsung.android.app.assistantmenu
    pm disable com.samsung.android.communicationservice
    pm disable com.samsung.SMT
    pm disable com.samsung.aab
    pm disable com.samsung.cmh
    pm disable com.samsung.dcm
    pm disable com.samsung.vvm
    pm disable com.samsung.hs20provider
    pm disable com.samsung.android.smartface
    pm disable com.samsung.klmsagent
    pm disable com.samsung.android.providers.context
    pm disable com.samsung.android.sdk.professionalaudio.utility.jammonitor
    pm disable com.samsung.android.app.colorblind
    pm disable com.samsung.android.hmt.vrsvc
    pm disable com.samsung.storyservice
    pm disable com.sec.app.samsungprintservice
    pm disable com.samsung.android.app.talkback
    pm disable com.samsung.android.authservice
    pm disable com.samsung.app.slowmotion
    pm disable com.samsung.android.weather
    pm disable com.samsung.android.app.pinboard
    pm disable com.samsung.android.personalpage.service
    pm disable com.samsung.advp.imssettings
    pm disable com.samsung.android.app.advsounddetector
    pm disable com.samsung.android.app.mirrorlink
    pm disable com.samsung.android.app.vrsetupwizardstub
    pm disable com.samsung.android.clipboarduiservice
    pm disable com.samsung.android.asksmanager
    pm disable com.samsung.android.themecenter
    pm disable com.samsung.android.spdfnote
    pm disable com.samsung.android.allshare.service.fileshare
    pm disable com.samsung.android.universalswitch
    pm disable com.samsung.helphub
    pm disable com.samsung.android.app.filterinstaller
    pm disable com.samsung.imagecompress
    pm disable com.samsung.safetyinformation
    pm disable com.samsung.app.highlightplayer
    pm disable com.samsung.enhanceservice
    pm disable com.samsung.android.keyguardwallpaperupdator
    pm disable com.samsung.android.app.accesscontrol
    pm disable com.samsung.android.beaconmanager
    pm disable com.samsung.ucs.ucspinpad
    pm disable com.samsung.android.app.FileShareClient
    pm disable com.samsung.android.scloud.backup
    pm disable com.samsung.android.fmm
    pm disable com.samsung.android.mdm
    pm disable com.samsung.accessory
    pm disable com.samsung.android.app.scrollcapture
    pm disable com.samsung.android.app.interactivepanoramaviewer
    pm disable com.samsung.android.scloud
    pm disable com.samsung.android.app.soundpicker
    pm disable com.samsung.android.spayfw
    pm disable com.samsung.app.newtrim
    pm disable com.samsung.android.spay
    pm disable com.samsung.android.intelligenceservice
    pm disable com.samsung.android.sm.policy
    pm disable com.samsung.android.dlp.service
    pm disable com.samsung.android.bbc.bbcagent
    pm disable com.samsung.android.voicewakeup
    pm disable com.samsung.android.app.watchmanagerstub
    pm disable com.samsung.android.app.FileShareServer
    pm disable com.samsung.android.sdk.professionalaudio.app.audioconnectionservice
    pm disable com.samsung.android.service.aircommand
    pm disable com.samsung.dcmservice
    pm disable com.samsung.voiceserviceplatform
    pm disable com.samsung.aasaservice
    pm disable com.samsung.android.allshare.service.mediashare
    pm disable com.samsung.android.fingerprint.service
    pm disable com.samsung.ipservice
    pm disable com.samsung.sec.android.application.csc
    pm disable com.samsung.android.sconnect
    pm disable com.samsung.android.snote
    pm disable com.samsung.android.video
    pm disable com.samsung.location


    Restore PK1 boot.img and recovery.img to close dirtycow vulnerability (removes ability to gain root)

    1. Download this to a directory but don't extract it
    https://drive.google.com/open?id=1374IZTBeyNBELdrK1ESdqkUuVGutbpDm
    2. Load PK1boot_recovery_img_only.tar.md5 file into the AP slot in Odin
    3. Place phone in download mode, connect it to your PC then in Odin select Start to flash the firmware, you can unplug cable when phone reboots.


    Please let me know if any steps are unclear. I can reverse the rooting method but there's probably 20 people world wide who will use this method, so if you have security concerns make sure to close dirtycow vulnerability when you're done and just use the one click root method.

    Updated notes:
    • If you get a Screen Overlay Detected error turn OFF overlay for both MobileGo apps!
    • I added a windows batch script to disable a lot of apps (root first with wondershare gomobile)
    • If you use the phone it looses root and becomes harder to root. (if it become impossible to root again flash the PJ1 boot and recovery only file but backup before you do it)
    • Don't create things with Assayed Kitchen then flash them to the phone or mix firmwares it almost refuses to enter download mode again :fingers-crossed:

    In case of error

    During the learning process to do things like this putting your phone into a bootloop or soft bricking is very common for new comers, but don't panic. After you complete the process I outlined it will take a couple minutes to boot it will have the AT&T logo on a white screen. If it hangs here for a really long time or it gets unusually warm this is a bad sign. Let's get the phone turned off so you can think.
    • Hard Reset: press Power + Volume Down for 7 seconds
    • Screen goes black: immediately presss Power + Volume Up + Home
    • Use Volume down to move to option Power Off then push the Power button to select it.
    • You can start over / try again by pressing Power + Volume Down + Home buttons again
      or
    • Create a new post here and put my name in your post
    2
    removed outdated information about Note 5 source codes.. Please see links by Delgoth for updated info
    2
    Actually it could potentially work for Verizon.

    If you substitute the Verizon Combination Firmware for the AT&T and apply the same principles accordingly.