yashsingh1/xdaforums huggingface dataset:
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
Im pretty sure its root that triggers this. If you check it right after booting up you will see where it says its scanning and can take up to 2 min to complete.

I want to know what process is it running to perform the scan.

Did you chec it in Settings > About Device, or download mode? Everuthing can be great in DL mode, but still say modified in settings.

I'm pretty sure it'll say this just from flashing root66, but I forgot to check it to be sure.

Ill let you know when I do.
[T-Mobile, Samsung Galaxy SIII] Towle:
"Device Status: Normal"
[T-Mobile, Samsung Galaxy SIII] Woody:
Last time I was on Rooted stock with no custom kernel or recovery, my Settings>About Phone showed modified as well. This was discussed a bit ago and I was able to find it. Go here on page 38, post 379 and read from there to the next page re: Settings>Modified. Main points are between mrRobinson and Joederp.

Doc, I got your PM and am looking into it. Let me get my Google on and see what I can come up with.
[T-Mobile, Samsung Galaxy SIII] tdizzle404:
So basically what I'm gathering is we pretty much have to run stock recovery and a non rooted ROM to not trip the counter?

I'm trying to follow and know this is a WIP I'm just getting a lil list with everyone's findings lol

---------- Post added at 01:22 PM ---------- Previous post was at 01:18 PM ----------
[T-Mobile, Samsung Galaxy SIII] Woody:
I all fairness, I think that they put some code in FaceUnlock.apk so that once you look at it funny, the counter trips.
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
You can be rooted, and even have a custom recovery. The main two things that trigger it is booting with a custom kernel and booting a custom recovery. Custom recovery won't trip the counter till you boot into it.
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
Lol, no kidding! Don't cross your eyes and stick out your tounge at it or it'll brick! :what:
[T-Mobile, Samsung Galaxy SIII] scifan:
Doc,

Out of curiosity... have you tested to see if removing the IQ files or syscope specifically cause the modified state?
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
No I haven't actually. I've got CIQ removed and left SysScope for testing. In Settings it says my system status is modified. In download mode it says official.

Ill look at the effect of it later tonight. Fixing to get the kid for the evening so won't be on much if at all till later on.
[T-Mobile, Samsung Galaxy SIII] elesbb:
Have fun with your son/daughter!
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
Thanks man! I've got a couple of links to share as well when I get back on later tonight. But I'm not so sure what joederp says is relevant anymore, in fact I tend to disagree with a few of his points. It may be that what he says was true for ICS, but I dont believe it is for JB anymore. As usual, Ill have to check on this, but in ICS apparently libcordon.so was being used to detect certain root processes. libcordon.so is a part of SysScope.apk, but it is possible its also used by other parts of the system.

Anyway, in JB you can remove both of these and everything still acts exactly the same as before. So either they were mistaken with ICS, or it has changed. (probably its changed). One thing that has not though is where the System Status is stored. I believe it is in the Param.img, you can learn more about this starting from Chainfires

Triangle Away

thread. This may be a good starting point for another workaround....maybe?

Anyway, I'm getting in too big a rush and cant double check what all I'm trying to say, so hopefully its made sense and is correct! Ill be back with more later!

The deeper it gets the more confusing it seems at some points!
[T-Mobile, Samsung Galaxy SIII] scifan:
Hmm...

So, it appears that when I was playing with modem firmware(s) trying to test if my download speeds would be faster with LJ4 vs LJA, that's when media Hub wouldn't work... (note that I Odin'd to LJ4, then upgraded modem to LJA, and boot & System to Deodexed LJA) back on LJA across the board, I can get Media Hub to work after using triangle away to zero the flash counter...

(yes, it shows as "modified" under settings -> about)

I need to putz with it some more... but right now I'm busy moving stuff over to my new sdcard... ;)
[T-Mobile, Samsung Galaxy SIII] tony yayo:
Im assuming you can go back to ICS and still triangle away, no? Sorry if its been brought up already. Just curious.
[T-Mobile, Samsung Galaxy SIII] scifan:
Yes...

What are you wanting to do?
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
AllShare Cast Dongle

Samsung just released an update for the Allshare Cast Dongle Software!

First time Ive seen them do this. Maybe itll address a lot of the problems a lot of people were having with it. I know a few felt that the flash counter and system status were to blame.

Be sure to let us know if it fixes the problem for you!

They also have an update to Music Hub. Its been out for a couple of weeks but I honestly never noticed it there till now! Maybe a Media Hub update is coming soon??

Just go to MyApps in the Play Store App.

AllShareCast Dongle S/W Update

Music Hub
[T-Mobile, Samsung Galaxy SIII] Chainfire:
Wow, this entire thread, and from reading it I think there's not actually a single thing ' figured out' that wasn't already known. All of this has been discussed in the Triangle Away thread and if any questions had remained I could have answered them.

There are various levels of detection going on in the very newest devices:

ODIN

Flashing with ODIN/Heimdall (not Mobile ODIN) goes through SBL, which checks signatures during flash, and if the signatures do not indicate a Samsung build, increase the flash counter.

Boot check

The bootloader checks the kernel and recovery every time you boot them (it will check kernel when you boot kernel, recovery when you boot recovery), and if they are not Samsung-built, will increase a 0 counter to 1 (it will not increase a 1 counter to 2, etc)

SysScope

SysScope runs on the device and scans for unwarranted root processes, and if found sets System to Modified (in the bootloader, not in Settings!). This one influences DRM - at least on the Exynos systems. I don't have a Qualcomm-based Samsung so it may be slightly different there. If SysScope is present and working on the device, Triangle Away will attempt to abuse it to reset the System status to Official, and then disables the SysScope scanning process.

Settings

The System status in Settings is actually a second scanning process embedded directly into the framework code. It's pretty much a copy/paste of SysScope. This one decides whether or not OTA will work as I understand it. There is no reliable cross-device way to disable this one (though I am still working on it, with high priority - it *is* possible), but if you're making a custom ROM obviously you can just rip the offending classes out of the framework.

---------------

Now, if you take all the above into account, you get the following:

- You can use Triangle Away to *reset* to 0

- If you want your counter to *stay* at 0, you need to be running official kernels and recoveries (this is why I have moved away from CWM/TWRP and only use Mobile ODIN now)

- You need to use Triangle Away to disable SysScope or remove it yourself (but if you remove it System status in the bootloader will not be reset)

- Your system partition contents don't matter as long as SysScope isn't running

Full reset for warranty purposes can be done the following way (depending on your current device state you may skip several status, but this should always work):

- Flash a full stock firmware + data wipe

- Root it

- Run Triangle Away to reset everything

- Immediately after Triangle Away boot into Download Mode

- Flash a full stock firmware + data wipe

Also, using Mobile ODIN does *not* trip the flash counter even if flashing a ZIP file - *unless* something in that ZIP triggers the counter (like a custom kernel or recovery).
[T-Mobile, Samsung Galaxy SIII] wideasleep1:
Well, I was happy to discover the manual/adb method still works in JB. :)
[T-Mobile, Samsung Galaxy SIII] Spartan 363:
Does anyone know if installing BusyBox on the rooted stock rom with stock recovery/kernel make the counter tick upwards?

For now, I'm staying rooted only, I like the stock rom for now.
[T-Mobile, Samsung Galaxy SIII] rock571:
America has been on the verge of self destruction for the last 40 years or so going fast every minute but most of us are "dormant" to it all happening and by the time we wake up will be already way too late BUT... this is a tech thread and I really really would hate to turn it into a political one and defy the forum's rules..lol that said, sorry but i couldnt resist answering to this one..

Let's hope we all have the common sense, the means and especially the balls to not "allow" the destruction actually plays up, but real news, as anyone intelligent enough can see, don't look too good.
[T-Mobile, Samsung Galaxy SIII] wideasleep1:
I'm running root66 stock recovery, and busybox, with no counts and official.
[T-Mobile, Samsung Galaxy SIII] tdizzle404:
So is the root 66 rom the only rom we can flash via mobile odin?

I see that the zips are tripping the counter
[T-Mobile, Samsung Galaxy SIII] Towle:
Anything with a custom kernel or recovery inside will trip the counter regardless of how it's flashed, as far as I know.
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
Well, for me it seems the zips do trip the counter. But id like if a couple of people could confirm this on their phone.

Chainfire says it shouldn't do that so it could be something I'm doing.

You can flash other stuff too. If you select the stock fw you can clear all partitions but what you want flashed. Or you can flash the individual partition by itself. I.e. recovery.img, boot.img, modem.bin..... its one of the reasons I love mobile odin.

Also, Once already rooted, you can flash the orig fw instead of root66. M.O. will inject root during flash.

I keep the original, un rooted fw on my phone for mobile odin and root66 on my pc for regular odin.
[T-Mobile, Samsung Galaxy SIII] Towle:
What zip did you flash?
[T-Mobile, Samsung Galaxy SIII] Chainfire:
From feedback I've gotten from other users (though these things may vary slightly from device to device, seeing as you're even using a completely different chipset than the devices I have, which are all Exynos), as in my country none of these DRM-based services are even available, the counter needs to be 0, the status has to be official and system also has to be official for DRM content to work.

If somebody is able to set up a special account for me on some DRM service and load it up with a test movie, so I can actually test all this myself, I would be happy to do so.

Not sure how libcordon fits into this. I think if you actually remove it, that may have adverse consequences. I'm not completely sure, when I tested all this in detail libcordon was not actually present as a separate library, it only existed inside SysScope (which it still does as well).

I guess I'd need to do some further testing to see if the "embedded" SysScope now also updates the System status (it certainly did not used to) in the bootloader.

Are you running Pro ? If Mobile ODIN Pro triggers the counter, it automatically resets it. It does this regardless of what you're flashing (a firmware, a kernel, a ZIP file - it'll do it with any of those). As such, your counter will "stay" 0 unless whatever you flash causes the counter to be tripped *again*.

You should note that the act of booting into Triangle Away's special mode itself triggers the flash counter on this device (as documented in about 15 places), so if you're using T/A to actually check the counter being 0, that won't work :)
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
I can verify that on stock JB firmware from Tmobile and Sprint that libcordon is pre-loaded in the /system/lib folder in addition to it still being part of sysscope. After you mentioned the framework code that's a lot like SysScope I assumed that was its purpose. I've removed it along with sysscope with no noticable side effect so it seems to be safe to do so. Ill need to go look again, but it seemed that all detections were still functioning with them removed.

I don't believe it sets off the status in the bootloader, but maybe its a backup of sorts for sysscope? Just guessing there.

I've been using Mobile Odin Pro for a few months now. Was one of the first apps I bought for the S3.

I just ran through everything again and it is triggering the flash counter. Here's what I did:

Checked that counter was zero in download mode and TA. Rebooted, then checked TA and then download mode once more. Counter remained at zero every time.

In M.O. pro, selected the official, untouched, stock firmware, and chose to flash the kernel and recovery.

Checked the counter again in DL and TA, then rebooted again and checked TA first then DL again. Counter still at zero.

In MO, I next flashed a zip file that installs a system app (wifi band switcher). Once done and booted, I rebooted to DL mode and the counter has been triggered. Rebooted system and reset in TA.

Rebooted system, then rebooted DL mode and counter was zero.

Rebooted system, then in MO did not flash anything, only wiped Dalvik Cache. Checked DL mode and counter has been triggered again. Flash count was at one.

Reset again with TA, rebooted, rechecked and it was staying at zero.

I did it this way to verify nothing else, like TA or what I just flashed was tripping the counter. But every time I used a "recovery-type" operation it would up the count to one.

I noticed that with wiping dalvik, or flashing a zip file, when MO reboots into its flash kernel it would first show the small blue text at the top of the screen, just like when you enter any other recovery. (I think it says something like starting, or booting, recovery.)

I don't know if that helps you at all, but it seems like it triggers the counter because the bootloader is seeing it as a custom recovery.

Not trying to be difficult for you! Just figured you'd want to know about it.

Its really not a big deal for me. My phones almost always had multiple flash counts and modified/custom stats! I don't have much at all that uses DRM protection, so its generally not an issue for me. (Doing this more to help than anything)

Because of this I'm not sure if I can help on getting you into an account to test DRM with. I'm hoping someone who can more easily do so will step up to help out. But if no one does, ill do my best to help find or set up a way you can do your tests.

Thanks again man! If there's anything I can do to help you out, let me know!
[T-Mobile, Samsung Galaxy SIII] LoGiK915:
Not sure if this helps anyone in any way but figured I'd post anyway. I installed stock jb through mobile Odin n injected root. Installed twrp 2.3.1 through goo.im app. Ran stock for a while then flashed wicked through twrp after making backup. Then flashed frosty in twrp and am now running freegs3 with ktoonz. Download mode says "no" "official Samsung" and "modified". Settings, about, status says "modified" and Triangle Away says "0" "official" I never reset using TA, just used it to check. Avengers plays fine. The only thing that doesn't work is my allshare dongle. It says connected on phone but tv won't actually connect. I got it to work on frosty one time by resetting the dongle and reconnecting several times but hasn't worked since. Not sure if I'm doing something wrong that my counter isn't tripping or if I'm just lucky. Hope this helps someone.
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
Since you updated using Mobile Odin, it didn't flash 5 of the partitions that would've been updated if you were to use PC Odin. Ive been suspecting that a large part of the updated detection mechanism would be in one or more of those 5. Was actually going to try to verify and find exactly which tonight. Thanks for posting.

SysScope is what's causing the Settings to show modified, but I dont think its what's causing it to show modified in download mode.

Id like to see if theres a way to force SysScope to always report official. Still been looking into it.
[T-Mobile, Samsung Galaxy SIII] LoGiK915:
Your welcome.

So basically I'm running jb but still using the ics partitions? And that's y I'm not tripping the flash counter when booting into recovery or flashing another rom? Basically the same as u stated in the OP about odin back to j4 and flashing jb roms from there. Only I did it unintentionally. Just trying to clarify for my own edification. Thanks.
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
Yup, I think you've pretty much got it! :thumbup:

If you don't use anything that the counter and modified status breaks, then I suggest odining the full update. If, like you, someone has the dongle, or needs to have drm content working, then I suggest running pretty much as you are now.

For the dongle you could try backing up and then deleting the SysScope.apk and libcordon.so from /system/app and /lib. Then reboot and try your dongle. If its still not working try resetting with Triangle Away and see if that'll work.

Just a suggestion. Id try but I don't have the dongle to test with.
[T-Mobile, Samsung Galaxy SIII] Jirv311:
I thought on ICS that the detection of Busybox was what changed the status to Modified in Settings. Is this no longer the case?
[T-Mobile, Samsung Galaxy SIII] DocHoliday77:
I'm not sure about ics. Never tested it there. I've seen it reported both ways in jb but from a stock rooted rom I installed busybox using stericsons installer and it didn't seem to detect it. Ill double check it later though.

SysScope contains the detection engine, so even if busybox does trigger the modified status, its SysScope that detects it.

That's how I currently understand it.
[T-Mobile, Samsung Galaxy SIII] EhdisChris:
So recently I reflashed root66 coming from root66 with installed CWM through rom manager for tmo Galaxy s3 (which means i have stock recovery and everything ..etc.) and was still modified under system settings. I then force stopped sysscope and checked system settings. to my surprise it then said 'normal'. I changed the build.prop for hspa speeds then rebooted. when i went back to settings, it then said modified.

I changed the build prop back to original, rebooted, and still it said modified.

I checked and sysscope was running again.

Does this mean there is never a workaround for sysscope and settings saying 'modified'?

and what is causing my system settings to say modified if everything is stock? just root?

will using titanium backup and uninstalling sysscope then deleting libcordon put my system back to normal?

But uninstalling sysscope will not reset your bootloader 'custom'? correct?
[T-Mobile, Samsung Galaxy SIII] white00gt:
It's just the fact that it is rooted the system picks it up and then it shows modified, flash counter can be reset using triangle away but not the modified status as long as it is rooted
[T-Mobile, Samsung Galaxy SIII] EhdisChris:
Thanks for clearing that up!

I've never had to use T/A, and I plan on never having to.

Binary Count is still at 0.
[T-Mobile, Samsung Galaxy SIII] Towle:
I'm rooted with root66 and my system status is "normal" in both download mode and settings.
[T-Mobile, Samsung Galaxy SIII] jcbofkc:
I understand what you are saying, but as a business owner I also see the other side. Many people screw up their phones attempting various things . A business should not have to pay for people that f up their phones. Most people that actively post know the deal. Those that attempt to modify their phone without the necessary knowledge get zero sympathy from me. If we can help new people and prevent unnecessary returns that will help lower costs. That is why I post when time permits.
[T-Mobile, Samsung Galaxy SIII] otariq:
I think the op mentioned something like this but if we Odin official ICS over ota jb it should remove all traces of new binary counter security correct? Then we can just install custom recovery without it tripping the counter after each reboot into recovery.
[T-Mobile, Samsung Galaxy SIII] DarkPyroGuy 09:
I can maybe add to the research part of the thread. I recently had to do a warranty claim on my original S3 (Screen Cracked), I received the replacement and it had 4.1.1 on it. So, I PC Odin flashed root66, which didn't trip the counter. Then flashed CM Recovery through Rom Manager to flash CM10 (again through Rom Manager) at that point I believe I had a count of 2 (I did at one point at least), when I booted into CM10 I had no service and imei was there. Anyway, I was able to get everything back to zero and official. Odin flashed back to root 66 trangled away the couter to zero and back to official. And device Normal is shown in settings.

Just received the second replacement and wanting to root and go to CM10 (Little scared I'll lose my service). I will be going the Mobile Odin way this time, so I will report back on those findings (if any special information is needed let me know), Chainfire if you still need the samsung account, I will be more then willing to help just PM me.

(Side note)

Is downgrading to ICS simply just flashing the image .tar in odin or is it more complicated then that? And does that fix the problem of custom kernels upping the counter?

(End side note)
[T-Mobile, Samsung Galaxy SIII] md1008:
True, although I think a cost effective restore should be an option from users who tinker. I have messed up some phones and sometimes I fix and other times not, I learn a lot from my mistakes and sometimes costly.
[T-Mobile, Samsung Galaxy SIII] LoGiK915:
I tried what u recommended and deleted those two files, after backing up of course. Rebooted and tried connecting to the dongle to no avail. I then used TA, even though counter was still zero, to reset flash counter. Tried connecting to dongle again. This time it ran an update for Allshare, which showed on both my phone and the tv screen. After the update I still was unable to connect. My phone says connected but the tv doesn't. The tv used to just hang at the black "connecting" screen even though the phone said connected. Now the phone says connected but the tv stays on the dongle home screen. Never gets to the "connecting" screen. Not *****ing just trying to be helpful. The dongles a nice commodity but not necessary. I know I can go completely stock and it will work, but hopefully with everyone's input and the amazing dev's here we can get this working on custom roms/kernels/recoveries.
[T-Mobile, Samsung Galaxy SIII] EhdisChris:
Have you ever installed CWM through Rom Manager?

Thats what I did and even after I reflashed root66, I still have modified.
[T-Mobile, Samsung Galaxy SIII] Jirv311:
Can you install busybox and check again. Then remove busybox and see if it goes back to normal?
[T-Mobile, Samsung Galaxy SIII] otariq:
how is ur binary count still 0? haven't u ever flashed a custom rom? i thought as soon as it boots into a custom recovery the counter trips
[T-Mobile, Samsung Galaxy SIII] demize!:
I don't know if this in any way is useful info for you but I rooted stock and lost root after taking a Jellybean OTA. The trip counter remains at zero however when hitting the Update button I now get a "this device has been modified "error even though I am non root and running stock firmware. Let me know if you need any more info.
[T-Mobile, Samsung Galaxy SIII] EhdisChris:
I've flashes root66 and installed CWM through rom manager but never actually booted into CWM. I've been around the block with flashing and all this amazing stuff, but since this is the newest and greatest phone I've had yet, I'm not really wanting to void my warranty just yet.

---------- Post added at 06:50 PM ---------- Previous post was at 06:48 PM ----------

I'll try this. But I've never actually had to remove and install busybox. Let me go research on this.

Will it trip my flash count?