[Galaxy S 4 General] FallenZen:
Compilation

Hey folks. I don't know how much it's worth, but I've kept a notepad compilation of all the information and reasonable concepts that I've come across while digging through the better part of a thousand pages. I'm sure there have been developments and promising avenues that I've missed, but I hope these notes might save others some time in sourcing so many different posts and threads.

From everything I've read so far, it sounds to me like the KNOX Warranty bit actually behaves a bit differently on older devices than on newer devices when it's flagged. On the older devices, it sounds to me like the counter may trip before it burns out an eFuse and that it's only permanently burned out if a failed attempt to reset is made. On newer devices, however, it sounds like there are instances where the simple act of tripping the flag results in an immediate burn. What they all appear to have in common is the way in which KNOX protects itself. Multiple bootloader layers stacked with hardware protection, in order to prevent the flag from being reset at any single stage. (I could be unclear on that last bit, if I am please feel free to correct me.)

Anyhow, I've gone through a lot of material at this point and I'm afraid it's left my brain pretty well putty. Here's hoping this compilation helps someone reach that "Eureka!" moment.

--------------------------------

Knox Flag Notes:

How the Knox system works on Samsung devices:

Secure Boot is a security mechanism that prevents unauthorized boot loaders and kernels from being loaded during the startup process. Firmware images, such as operating systems and system components, cryptographically signed by known, trusted authorities, are considered authorized firmware. Secure Boot is a component that forms the first line of defense against malicious attacks on devices with KNOX.

Samsung KNOX uses systematic security checks to ensure that only valid kernels are used by the device. On the hardware level, the Primary Boot Loader confirms a PKI certificate to verify the integrity of the Secondary Boot Loader 1. Similarly, the Secondary Boot Loader 1 verifies the integrity of the Secondary Boot Loader 2, and the Secondary Boot Loader 2 verifies the integrity of the Android Boot Loader. The Android Boot Loader will only load a Samsung-authorized kernel with a Samsung certificate as its Root-of-Trust.

https://www.samsungknox.com/en/overview/technical-details

One reported solution, that I have not been able to verify or corroborate, is related to the S4 Mini:

Originally Posted by SandeepEmekar View Post

My S4 Mini's Knox Status was reset when I flashed different region firmware on it.

Confused with the status of this thing, "CSB-CONFIG-LSB: 0X30" . (page 45)

The reporting user has stated that his/her KNOX flag was 0x1 and returned to 0x0 upon flashing to a different region's firmware.

"Old was India Region then I switched to latest one of Brazil (I9192UBUBMK4_I9192ZTOBMK2_ZTO.zip)" (page 46)

http://xdaforums.com/showthread.php?t=2486346&page=45

The above has not been verified, to my knowledge, and someone else subsequently reported attempting a regional change from the UK to Madagascar or somesuch place and reported no change to the bit counter.

There is also information for removing the KNOX bootloader from the Note 2, though apparently this only works if the flag has not already been tripped from 0x0 to 0x1. If the flag has been tripped, this technique still works to remove KNOX and the flag's notification from the Download Mode; However, if the bootloader is restored to KNOX then the flag is once again displayed as 0x1.

http://xdaforums.com/showthread.php?t=2500823

There have been several reports of people having their phone serviced by an authorized technician, in which their device was repaired and returned within around 10 minutes. Accordingly, when the device was returned, their KNOX flag had been restored to 0x0. This suggests the possibility of a software fix, or at least the existence of a software/hardware fix that can be implemented by connecting the device to a specialized diagnostic and recovery computer (some reports claim it is a handheld device).

It should be mentioned that several of these reports state that this fix is possible on devices which are older than the Note 3, which it seems cannot be reset. This suggests the existence, and initial utilization, of an eFuse for the Note 3 but not for devices from earlier generations (which seem to still utilize eFuses but not in the initial tripping of the flag. These devices, reportedly, will only burn the eFuse if a failed or incorrect attempt at resetting the flag occurs).

This exception for the Note 3 is contradicted here, however:

http://xdaforums.com/showthread.php?t=2504258

One user has stated that he knows where the eFuse, which KNOX utilizes, physically resides:

Originally Posted by iankellogg View Post

THe knox flag is an EFUSE, you will NEVER be able to reset it back to 0. It is PHYSICALLY destroyed in the S800 chip and there is no way to change that fact. The best you can hope for custom bootloader that fakes the flag. But they will always be able to check the flag... The speculation is that KNOX is using an E-FUSE. chainfire has said everything he can tell its an e-fuse. The S800 has at least 1 E-FUSE register that I know of and I think maybe 4 total... So I was wrong about the number of Efuses (which qualcomm calls QFuses) THere are over 100 of these QFuses. THey can be used for pretty much anything the manufacture wants (from what I have read all manufactures use QFuses for disabling Debugging). All Qualcomm chips and pretty much any CPU or FPGA on the market has at least 1 EFuse. It is up to the company to determine how those are used. LG decided against using EFuse checks in their bootloader. Samsung decided it was the only way to make Knox secure.

http://xdaforums.com/showthread.php?t=2486346

There is also discussion which indicates that the KNOX flag and notification are stored either in the eMMC or in the RPMB.

http://xdaforums.com/showthread.php?t=2504258&page=29

There was some more in-depth discussion, which I've misplaced the link to, which described the process of replacing "mmcblk*" as having reset the flag's display to 0x0. The catch is that once the device goes through one full boot cycle, the flag consistently reverts to 0x1. This corroborates the discussions regarding both software and hardware redundancies.

aboot.mdn has also been implicated with the KNOX flag.

eMMC Specs:

http://www.jedec.org/sites/default/files/Victor_Tsai.pdf

QFuses in MSM8960, which may also be relevant to identifying the active efuses used by KNOX:

http://xdaforums.com/showpost.php?p=31622172&postcount=9

Another potential avenue was suggested in the Note 3 thread, as follows:

Originally Posted by yashade2001 View Post

[MENTION=631273]Chainfire[/MENTION] I have good news. I found a way for reseting counter on new KNOX devices. So you know KNOX' s information is stored in an emmc symlink file. Some people says it is storing in mmcblk0boot0, some people says that is same with mmcblk0 and some people can't find mmcblk0boot0. Actually I have not got a KNOX enabled device but I have testers for KNOX counter reset tool ( Making for S4 currently ). One of my tester opened that symlink ( He's not my tester now and I don't know which symlink is that. ) and edited with a hex editor and he saw a flag which shows counter status ( Hex value ). He edited that to 0x0 and rebooted the device. We saw 0x0 in bootloader screen. But when we rebooted the device it gone to back. So I know there is a hardware protection ( Special thanks to [MENTION=289089]gokhanmoral[/MENTION] ). I think harware protection provided by eFuse chip. So there are two ways for reseting counter.

1) Rewrite kernel and undefine the eFuse chip. eFuse chip is defined in the kernel. Then there should be no hardware protection and we can edit that emmc symlink to reset counter. Shortly, we can modify bootloader.

2) Modify an Odin flashable tar as you want. But you need Samsung's special key to sign. If you sign that with Samsung's special key, counter will not be changed. But it's hard to get Samsung's special key. We can find it in an official flashable tar. It's not impossible but it's near to the impossible I think.

I'm going to make an app for doing first way automatticly.

Cheers. Waiting for your answer.

http://xdaforums.com/showthread.php?p=47765738

I seem to recall the above person having said something about giving up the ghost, but I can't recall a direct link. At any rate, he may or may not have hit a dead-end in his efforts.

Then, there's the discussion on Chainfire's G+ page where someone says:

Andrew Williams02/nov/2013

+Chainfire, I think +Mathew Rennie is correct. My GT-i9505 came with an NZC carrier branded ROM. Using PC ODIN, I flashed a later pre-Knox BTU stock version and had this rooted with CF-Auto-Root. I later attempted flashing a Knox enabled BTU ROM with Mobile ODIN, but upon finishing flashing I had no wifi, calls didn't work, etc. Did a factory reset and then used PC ODIN to flash this same Knox enabled BTU ROM and everything was fixed and remained at 0x0. Obviously this is because Mobile ODIN doesn't flash the bootloader whereas PC ODIN does. The point of all this is that I'm at 0x0 on a BTU ROM when my GT-i9505 came with an NZC ROM. Maybe that's because the bootloader was updated to BTU prior to the Knox enabled ROM being flashed and since I flashed another BTU ROM (albeit Knox enabled), it remains at 0x0. I even just did an OTA update to XXUEMJ7 and still at 0x0. But...I'd really like to have root back! :(﻿

https://plus.google.com/+Chainfire/posts/LCfF5A9fsTG?hl=it

Posted by ace_of_spades021

I asked some one who work at samsung agency about this and he told me they do it with BOX RIFF and ORT ......

http://xdaforums.com/showthread.php?t=2504258&page=7

Someone who appears to have changed the way the Warranty Bit displays on the Download screen:

http://xdaforums.com/showthread.php?t=2510867

Lastly, Chainfire's brilliantly informed analysis which mentions potential options for downgrading from KNOX bootloader (which would prove perfect if you've not already managed to trip the KNOX Warranty bit.

http://xdaforums.com/showthread.php?t=2504258&page=12

That page also has another informative post (which I also recall seeing somewhere along the way in this thread):

Originally Posted by .NetRolller 3D View Post

What we know so far:

-The Knox flag is physically stored in the eMMC, not in the SoC. Replacing the eMMC resets the flag.

-Some phones with Knox have Toshiba eMMCs supporting only eMMC v4.5, meaning, a standard eMMC 4.5 feature is being used (not a Samsung extension or something new to eMMC 5.0). This alone excludes an efuse - eMMC 4.5 doesn't have efuse support.

-Samsung can reset the flag using software only. This also rules out an efuse.

-Restoring a full eMMC backup (including boot and user partitions) doesn't clear the flag, even if done via JTAG or direct eMMC programming. So, the flag is not in the user or boot areas of the eMMC.

That leaves only the RPMB or the eMMC partition table.

--------------------------------