[Galaxy S 4 General] Absolon:
Well, I might be wrong then. The "assertion" about each certificate if from Samsungs own White paper, released on their, web, so I didn't take it from "the air".

They state that each phone has it's own unique X.509 cert that is put into the Prom at the production that they use to verify that the BL has been untampered

and if so the phone will not boot.

That makes it impossible to rewrite it since we don't have any higher issued "root-cert" that they sign it with. This is built from the start on all phone and

it's just been "activated" now. Took us by surprise, leaked 4.3 and all. Very well timed indeed. But there is no way to get pass this, we are in the hands

of a SELinux that can properly configured virtualize your phone. It's already need made. Even NSA "brags" about thei SEAndroid built on XEN.

So what is it to say that we root, install custom kernels, roms but we never are in the phone at all? Since we can never get pass the SELinux we will

never know what it contains since it's crypted and we have currently no way to decrypt it if we have no way to extract the key from the prom.

And that is the only way. I think they have pretty strong defense against that and all that is left is either a bug from their side or some hardware wizard,

that can do a "man in the middle" or side attack the prom to extract it.

Else we are boxed in, no matter what we do, in the SELinux and you might try to root it. Did you get to the part where the rules are? Do you have the text-files

that they are?

Because I have not been able to do that but then, I lack skill for that.

And I might very well be wrong with the assymetric/symmetric case here but what I meant was that the the key could be crypted even harder on the device

with a key to unlock it passed by the already not to date crashed RSA. That was what I meant then I theorized about tampering.

Because all we have are theories. Although I noticed very peculiar behavior when I sat down and started digging on my Knox 0x01 device. That you have

higher up. I also know why the BL on my friend's never got written.

It was laying and loading, as usual, and then all this started and she paniced and pulled the battery, so it never completed. Samsung says that a total

reflash (with lost info) is needed through Kies. Kies doesn't even recognize the phone.

How many times have you woked up to rebooted device? I have. (Damn ****ty product. Again a spontaneous restart).

After what I saw and the more I started to dig today the more "strange" my phone gets. I will do a total restore with Odin and see if it's back to "normal"

or not, but with the Knox flag tripped. Or if it will brick my whole phone?

Time will tell,

but if I'm wrong with the cert then good to know. Thank you.

The thing is that if you have a CA then you can revoke any certificate that you signed at any time, right? I wonder if that is the Knox flag that tells that or not?

The thing I meant is that it can smack on harder security for anti-tampering. But this seems to late now. People don't act. Acting is never "fun".

Zdzisiu, or whatever his name was, talked about control. Why I'm not attacking Google. They are not the good guys here. No one is. In the end it just

boils down to money and control.

And we gave it up ourselves, willingly.

Sad but true. If anyone know the way out of hindering the BL to load the SeLinux-part, scream. I don't know if that is possible? Again, I lack knowledge here.

All the best,

Abs