yashsingh1/xdaforums huggingface dataset:
[Galaxy S 4 General] exprxp:
1. If u remove aboot.mbn from any firmware it will always pass in Odin3.

2. 1st phone u need to flash twice

3. Service Menu is available only in MA6 not in MH8 anymore.

What I have tried yesterday, I made a full copy (KNOX I9505 MH8 BTU) 0x0-377....... of sectors then I paste it into another phone with KNOX bootloader already inside. Phone then powered up without any problem.

I made a full copy (I9505 MF8 O2U) 0x0-377....... of sectors then I paste it into another phone with KNOX bootloader already inside. Phone then didnt power up at all, it stacked into QDLOAD mode. I did a new JTAG QDLOAD v2, then phone powered up again.

So now we have 2 JTAG version

1. USb QDLOAD non KNOX.

2. USB QDLOAD KNOX.

So If I have a KNOX phone with dead boot, I have to use 2 option.

If i have non KNOX phone I can use 1 or 2. After 2 phone will become KNOX protected.

Im still trying to replace eMMC chip with non KNOX inside into KNOX phone.
[Galaxy S 4 General] spinky360:
So... from what I understand not even via jtag is not working. But I still thing is not eFused. Can someone provide me a level 2, 3 schemayic ? Im thinking to compare all the flow around the board at boot between knox and non knox
[Galaxy S 4 General] exprxp:
Service Menu 0011 not anymore in MH8

Please downgrade firmware to access to this menu again. (tested on MA6 software without aboot.mbn)
[Galaxy S 4 General] spinky360:
This I sayd upper :)

You can downgrade without the aboot.mbn

Can you provide me pleas with level 3 schematics?
[Galaxy S 4 General] KEriksen:
Now I may be out of bounds on this matter, never heard of it until now. But isnt this sort og what TriangleAway fixes? Flash new stock, root, TriangleAway, unroot, woohoo...
[Galaxy S 4 General] wPatriot:
No, TriangleAway currently doesn't reset the Knox-flag. It will reset the device status to official, but not the Knox-flag. Apparently, some people believe eFuses may be involved, which would imply that resetting that flag is physically impossible. That's all speculation though, as of right now nobody outside of Samsung knows for sure.

[ontopic]

Aside from the technical issues, I also wonder what this means for people returning phones with this flag set to 1. Right now we're all assuming the worst because of the name, but it might as well only apply to phones that are used in a business environment that truly use Knox. It might be good to know for sure whether or not this flag will be used to deny people certain rights they have under warranty..
[Galaxy S 4 General] joecool666:
that's right pal looking for that answer myself.
[Galaxy S 4 General] DjeMBeY:
That is the most important thing I would love to know as well!

Hopefully it won't affect warranty rights. All fingers crossed as mine shows 0x1 ;)
[Galaxy S 4 General] joecool666:
i might call Samsung where i am. and say while i was updating. my PC crashed and i had to do an emergency firmware update.and now my device now shows Knox warranty void 0x1 and see what they say. ya never know might be all good like you say fingers crossed lol.
[Galaxy S 4 General] spinky360:
Sorry to tell... but they won't do nothing. :) I needed to kill it one of mine so I can get a new one
[Galaxy S 4 General] joecool666:
i was thinking that aswel if that was the case.i take it you called them yourself?
[Galaxy S 4 General] wPatriot:
Are you saying you've already been denied replacement or repair under warranty because of the Knox Warranty Void-flag set to 1? What was your issue, and what was Samsung's response?
[Galaxy S 4 General] spinky360:
Unauthorised systems voided warranty. Very simple answer. But I did it intentionally to see if they are accepting it.

---------- Post added at 06:22 PM ---------- Previous post was at 06:16 PM ----------

No. I gone to carphone warehouse from where I have contract and show them that sound is not " working ". They took it for service and after 3 days they called me to go to them after it.

---------- Post added at 06:24 PM ---------- Previous post was at 06:22 PM ----------

Ps. Maybe they haven't send it. I dont have from where to know
[Galaxy S 4 General] donalgodon:
Am I understanding this correctly?

If I have updated to MH1 via Odin, I have the Knox bootloader, so I'll (probably) never be able to downgrade the bootloader?

I thought it was MH8 that had the new bootloader. :crying:

When I boot into Download mode, I don't see anything about Knox in the splash.
[Galaxy S 4 General] Fornowagain:
Try downgrading you'll soon see.
[Galaxy S 4 General] spinky360:
Lets let time to the job ( ofc :) and the developers ). Im not ONE OF THEM ! But im sure that will find a solution ( we = XDA Community :) )

Lets only hope that 4.3 wont have Knox :D ( but im in doubt of that ). Because me personally i wont update till this knox thing is not sort out
[Galaxy S 4 General] aljo00:
If having knox void warranty 0x1 can i flash via odin or just with cwm ?
[Galaxy S 4 General] Hawke84:
nice idea, its still believed to be an eFuse embedded into the eMMC (unusual i know) so it may not be writing data to the eMMC but rather reading the state of the eFuse attached to it?
[Galaxy S 4 General] spinky360:
When the fuse is f*** up ... the bootloader can't read the key that the hardware is generating. Or vice versa. I dont know yet who is generating the key
[Galaxy S 4 General] Hawke84:
oh i see so your thinking of a way of bypassing the blown fuse to trick the bootloader to reading knox 0x0?
[Galaxy S 4 General] robogo1982:
Nexus, Oppo or Xiaomi is my next choice, real soon. LG would have been a choice, but they locked down the IR, so... dang.
[Galaxy S 4 General] bogdan1980:
Yes, Samsung is history. Is an coincidence that when i write Samsung on swiftkey it write damaging?
[Galaxy S 4 General] spinky360:
Honestly no:)) but thank you for ideea.

I was thinking how to generate the key so we can sign the bootloader to se the hardware that is ok
[Galaxy S 4 General] Hawke84:
the other easier thing to do (ignoring the fact that we need to sign the bootloader) is to hex edit the BL to display knox 0x0 even through the true status of the eFuse is 0x1 so any repair centre will put it into download mode and go: "oh this is fine!"
[Galaxy S 4 General] spinky360:
Like someone was saying " only stupid people are complicating simple things "

And thats me ... I was trying to much and I forgotten that have to be a easy way
[Galaxy S 4 General] Hawke84:
"always give a complex task to a lazy person because they will find an easy way to do it"

:)

to be honest it would be great to really have a proper work around rather than just a visual thing. I dont know what hex editing 1 value will do to the signed status of the bootloader, im not that smart... :(

I dont know what other methods repair centres will have of checking knox status, if they only rely on visual in download mode great, but im sure there will be other diagnostic methods they could use..
[Galaxy S 4 General] timberwolf60:
We have a same thought.

Send via i9505 using Tapatalk,

ROM: PYRANA MF8 1.7 LITE.,

CSC/Modem: OLBBMF8(STH)/XXUBMGA

Kernel/rec: GE V7/Phil 5.07.6.

SuperSU Pro 1.41, 64GB FAT32 Card
[Galaxy S 4 General] ppcd9220:
I have some ideas about Knox warranty flag...

For me this looks like HTC and Sony was doing this some years already...

In the eMMC there's a KEY or DRM signature (in case of Sony). it is there since production. It is unique to each and every unit and it is linked with IMEI code for example.

Once something happen - Policy violation for Samsung, HTC unlock procedure, Sony unlock procedure - this code is just erased.

That's it.

Bootloader can't find the digital sign - then Knox Flag 0x1.

"Unlocked" message in HTC bootloader and so on.

For example with unlocked Sony bootloader - it is impossible to use some software, that requires this DRM sign.

For me this looks really the same like Samsung did. Knox container software doesn't work without Digital signature. This doesn't look like effuse that is broken, instead of this "digital sign" is erased. This works not worse then eFuse and this is irreversible.

There's no reason to go back to previous bootloader - it simply doesn't work with this data on eMMC. But once it is erased - it is gone.

In this case we can try several things:

1. try to find a way to backup and restore this piece of Data on eMMC on non-Knox Bootloader (on Knox bootloader this area in the memory is believed to be protected)

2. try to emulate (fake) the status. In this case there is a question: which applications are using this and for what reason: i.e. Knox Container application relays on Knox-Varanty Flag or checks Signature/Data on eMMC ?
[Galaxy S 4 General] Hawke84:
if you are right all we would need to do is a full NAND dump of phone before and after and look at the partitions side by side look for changes between 0x1 phone and 0x0 phone to work out what partition stuff is on.

does anyone have any partition information already on the eMMC of the samsung phone, would a .pit file help? i dont know how to read / edit .pit files, one is attached for i9505 for reference...

EDIT:

Quick look at the visable partitions for the phone there are:

/persdata/absolute

/system

/data

/cache

mmcblk0p1 /firmware

mmcblk0p2 /firmware-mdm

/efs

/storage/emulated/0

mmcblk0p3 - 9 all have some data on some as small as 128kb, at the moment none are mounted on my phone (im pre knox):

emmc label size

mmcblk0p3 = sbl1 128kb

mmcblk0p4 = sbl2 256kb

mmcblk0p5 = sbl3 512kb

mmcblk0p6 = aboot 2mb

mmcblk0p7 = rpm 512kb

mmcblk0p8 = tz 512kb

mmcblk0p9 = pad 16.5mb

mmcblk0p10 is the efs partition

mmcblk0p11 - 15 are again unmounted of various sizes

mmcblk0p11 = modemst1

mmcblk0p12 = modemst2

mmcblk0p13 = m9kefs1

mmcblk0p14 = m9kefs2

mmcblk0p15 = m9kefs3

mmcblk0p16 is /system

mmcblk0p19 - 25 more unmounted partitions.

in total 29 mmcblk0p partitions....

anyone think this is worth a look?
[Galaxy S 4 General] ppcd9220:
For test it is better to try reading the eMMC directly via SPI or I^2C interface.

I think even if you'd read the full eMMC on old bootloader - the new one will not give you an access to this area to prevent restore of the sign.

There was some experiment already in this thread when eMMC micro were exchanged between phones.

The main problem, if I'm right, is that this is useless, because this "digital sign" is sticked to the unit. Then when eMMCs are exchanged the phone could not boot at all, because the sign is wrong for target device.

P.S. This is all my IMHO, based on experience. Nothing else. Just theory.
[Galaxy S 4 General] spinky360:
Changeing of eMMC will let you downgrade bootloader to non knox. Then you need to repair the EFS.
[Galaxy S 4 General] Hawke84:
interesting theory like you say if it is really hidden it will be hard to find without direct interface to the eMMC chip but it could very well be like the efs partition..

ive listed a few in an edit to my post above... but these are all just unmounted including some what looks like secure bootloader paritions

---------- Post added at 02:28 PM ---------- Previous post was at 02:26 PM ----------

but will chaning eMMC remove the knox flag? if not them im guessing efuse somewhere else other than on the eMMC chip and not a key thats erased.
[Galaxy S 4 General] spinky360:
In few days ill tell you. After ill order few eMMCs. Till then I cant tell you nothing 100%. The downgrade working theory is confirmed by a person who is involved with Samsung repair centers. Or maybe is someone from Samsung that wants us to think that it can be done nothing.... ill confirm the eMMC in maxim 2 week's
[Galaxy S 4 General] tanjiajun_34:
Just a stupid question. How do you tell if my bootloader is one of those new secured bootloader. I don't see any "Knox warranty void: 0x0 or 0x1" in my Download Mode does that means my bootloader is not those new secured bootloader?
[Galaxy S 4 General] tight13:
yes thats right

when you cant see it you have got the old bootloader
[Galaxy S 4 General] spinky360:
Exactly. .. stupid.... if you dont see knox nowhere. ... what conclusion you are pulling?
[Galaxy S 4 General] tanjiajun_34:
Haha sorry.... I am just making sure it isn't there. Cannot risk it man :X
[Galaxy S 4 General] spinky360:
I dont want to bee a smartass but this question was ... 1, 2, 3 ... n》 times
[Galaxy S 4 General] ppcd9220:
Sorry, but who told you that knox 0x1 is a flag ?

Yes it is, from some point of view. But this is not what is read somewhere by bootloader. Chainfire already tried to discrover...

No bits are set to 0x01...

To my mind, Bootloader checks SOMETHING and then, as a result of operation sets this flag and shows it to you...

Knox software doesn't read bootloader "flag". It performs the same check operation like bootloader does.

This means that the flag is not exist like "flag bit". It is something (some data or DRM key) written (or erased) on some partition. Possibly EFS.

Once you remove the event than bootloader will show you 0x00.

On HTC there was one tricky thing: the key was written in mmcblk0 on first 4 kb (after partitions information) (sorry don;t remember the exact details right now). On some bootoaders you could even read and dump the data, but writing back gave no results. (once rebooted -everything was reverted to original state). On other bootloader you can read the block and copy via ADB, but the result is Zeroes.

So, to my mind accessing eMMC via Bootloader will gave no result - even if you read (and copy) any data (also directly by ADB) you can't trust them.

Does anyone tried to look inside EFS backup on knox and non-knox bootloader ?

Working directly with Qualcomm download mode avoids bootloader and write/read directly from eMMC or bootloader (second bootloader) is still influence ?

Can anyone provide me with the eMMC chip name and/or point to datasheet ? Is it generic memory IC or it is Samsung proprietary for this device only ?

Thanks for the answers!

P.S. I would really love to see this thread as a [research].
[Galaxy S 4 General] Hawke84:
Sorry perhaps used the term flag a bit loosely.... I haven't been able to find much info on data sheets for this device.

I'm used to HTC s-on bootloader which as far as I remember was liked to radio partition to get full s-off

I listed a few of the visible partitions which are unmounted, those helpful?

I'd like to see more research and brainstorm here...
[Galaxy S 4 General] spinky360:
1107-002251 UME600 IC-FLASH MEMORY

I dont have yet the data sheet
[Galaxy S 4 General] My1xT:
what is the Quallcomm download mode???

I only know the "normal" Download mode (by pressing Home+Vol-+Power)
[Galaxy S 4 General] .NetRolller 3D:
A small detail as we speculate about "efuse in eMMC" - the eMMC used in the I9505 appears to be the same as in the I9305. The Note 3 LTE has a newer eMMC, KLMBG4GEAC, which is a standard Samsung product listed in their eMMC catalogue, not something specifically made for the device.

Oddly enough, the I9500 (which is NOT affected by Knox locking, apparently) has a device-specific eMMC model, KMV3W000LM, nowhere to be found in Samsung's catalogues. The American variants appear to come with Toshiba eMMCs, strongly suggesting a standard eMMC feature (such as RPMB) at work, rather than a Samsung extension.

Also, if replacing the eMMC undoes the damage by Knox, then I think we can discount the "key erasing" idea suggested earlier - a new eMMC would presumably not come with a key preprogrammed.
[Galaxy S 4 General] Tanis64:
[MENTION=4932206]My1xT[/MENTION]

You must put the phone in a special USB (AP / RNDIS + DM + MODEM) mode. (*#0808#).

Then you can use a special Qualcomm Toolkit (QPST) to download/upload from/to the phone.

I used this to backup my IMEI/EFS.
[Galaxy S 4 General] tech_head:
Okay,

I have something interesting or maybe not.

My phone *IS* ME7. It was rooted by the guy before me and knowing that I just flashed ME7 with ODIN because the previous owner removed bloat and could not put it back. I knew or thought I knew the KNOX flag would be tripped to 0x01.

So with that being said. My phone is rooted but in download mode there is no KNOX flag.

What I see is the following:

PRODUCT NAME: SCH-I545

CURRENT BINARY: SAMSUNG OFFICIAL

SYSTEM STATUS: OFFICIAL

CSB-CONFIG-LSB: 0x30

WRITE PROTECT: Enable

Can't find a manufacture date.

My Device Status also shows as Official.

Baseband Version - I545VRUAME7

Kernel version - 3.4.0-690088

se.infra@s0210-13 #1

Thu Jun 13 10:14:27 KST 2013

So where is KNOX status on my phone???

---------- Post added at 03:26 PM ---------- Previous post was at 03:23 PM ----------

I remember using QPST on a some older phones.
[Galaxy S 4 General] Tanis64:
Your ROM has no secured bootloader, so this doesn't read out / calculate the KNOX warranty state. All ROMs before new bootloader act like this.
[Galaxy S 4 General] tech_head:
Interesting.

I thought and from what I read, all factory ME7 based software had KNOX enabled.

Works for me, but I thought that KNOX was implemented in the Verizon ME7 release. I stand corrected and don't see any KNOX stuff in the status.

I guess I should just count my lucky stars and disable and new OTA.
[Galaxy S 4 General] My1xT:
and where is the difference to the normal DL mode???
[Galaxy S 4 General] Hawke84:
Bypasses the bootloader
[Galaxy S 4 General] My1xT:
meaning you could flash CF autoroot, CWM or whatnot without flag trigger?

nice...
[Galaxy S 4 General] Hawke84:
no i dont think its as simple as that, i think its lower level communication through the qualcomm chip i dont think it will do something as complex as the autoroot but im not sure this is byond my knowledge...
[Galaxy S 4 General] My1xT:
then what can it do???
[Galaxy S 4 General] Hawke84:
basically access hiden partitions on eMMC and hopefully find some flag that is showing knox and reset it.

heres some interesting reasing and R&D:

http://xdaforums.com/showthread.php?t=2086142
[Galaxy S 4 General] spinky360:
I need a knox 0x1 unit. Who have insurance and wants to sell it to me ?
[Galaxy S 4 General] Hawke84:
what are your plans with it? replace eMMC?

im still pre-knox so cant help
[Galaxy S 4 General] spinky360:
For that I'll use my own unit. But I need one to play with the PIT and EFS
[Galaxy S 4 General] argentux:
After I tried to flash an old firmware, a red text appeared in download mode in the top left corner:

fused: 2, binary: 1

yes I had already rooted my phone, are multiple efuses involved?
[Galaxy S 4 General] spinky360:
Make us a pic... I never heard about this
[Galaxy S 4 General] Hawke84:
are you already on a knox based firmware trying to flash an odin package to downgrade? if you are this wont work and this will be the reason for the failure.

can i ask if the text was displayed in download mode or through odin while you were in download mode?
[Galaxy S 4 General] argentux:
it is shown on my phone's screen in download mode. I am on the new firmware. And i knew it would fail, but the failure is likely that the message shows up at all. I will try and do it again to get a screenshot, and to see it it is going to say fused:3
[Galaxy S 4 General] spinky360:
What exactly frimware you have and to what version you want to downgrade ?

Because you are unique case :)
[Galaxy S 4 General] exprxp:
Dont try to put old firmware, plz use only new firmware.
[Galaxy S 4 General] starbucks2010:
Anyone knows if I'll flash the XXUDMH6 modem on my I9505 (XXUDMI1, FoxHound ROM 2.0) with old bootloader, will trigger the void 0x1?

Thank you.
[Galaxy S 4 General] l8erz:
I must admit theres a lot u can do with an s4 even without root.
[Galaxy S 4 General] mrgold2505:
Mine as I

Mine as insurance
[Galaxy S 4 General] Hawke84:
just a bump for the Q&A thread for knox in the Q&A section of the forum for Q&A...

http://xdaforums.com/showthread.php?t=2470635
[Galaxy S 4 General] spinky360:
You want to sell it to me ?
[Galaxy S 4 General] mrgold2505:
Pm

on me with offer price
[Galaxy S 4 General] krz_ayman:
Hi, this is that there are developers who are busy working to crack the knokx?
[Galaxy S 4 General] Hawke84:
Please don't post the same thing in several threads. I don't really get what u are asking either
[Galaxy S 4 General] krz_ayman:
I just wanted to ask if the developers are working to be able to change the Knokx flag?
[Galaxy S 4 General] Hawke84:
Yes as far as I know people are working on it
[Galaxy S 4 General] overkillZ:
working on what? you cant undo an eFUSE, you can maybe hide the knox flag in the software, but the eFUSE will still be flagged. When they look at the hardwere they will se it
[Galaxy S 4 General] krz_ayman:
Ok thanks ;)
[Galaxy S 4 General] :
Yupp chainfire have looked into it, not more info from him

Yupp, others seems to be working on it so i van confirm youre fight, i would help bit my s4 is on repair, havent heard anything yet though,
[Galaxy S 4 General] krz_ayman:
it is possible to hide the flag and when samsung repair sees nothing?

So Samsung would include a spy to prevent bypass the root?
[Galaxy S 4 General] Bessagabriel:
It's confirmed that there is an eFUSE involved?
[Galaxy S 4 General] My1xT:
not completely...
[Galaxy S 4 General] bidav1:
fused 2

this is NOT a unique case..

all i9505 devices with knox enabled bootloader will show fused: 2, binary: 1 in red while trying downgrading to non knox version. Of course the process fails and oding generates an error message.

already seen this on 2 devices.
[Galaxy S 4 General] TubeShaped:
So knox bootloader comes only with 4.3 firmwares right? Or how can I make sure a firmware package is knox free? XXUDMHB as an example
[Galaxy S 4 General] timberwolf60:
xxuDmhb the capital D mean Knox boot loader like xxuDmgg, xxuDmh8 etc. xxuBmga, xxuBmg6, xxuBmg8, the B mean old bootloader.

Send via i9505 using Tapatalk,

ROM: GE V2

Modem: GE default

Kernel/rec: faux123 #3/Phil 5.07.6.

SuperSU Pro 1.65, 64GB FAT32 Card
[Galaxy S 4 General] CodeJACK:
Very odd, I have XXUDMGG but no mention of knox on my download screen.
[Galaxy S 4 General] Mittaa:
Not odd if you have old bootloader :good:
[Galaxy S 4 General] joiN85:
In XXUDMGG aboot.mbn,sbl2.mbn,sbl3.mbn are new bootloader (WinMerge compare with mh8)

but XXUDMGG don't have new Sbl1.mbn

You have old Sbl1

Please backup your Sbl1 partition with:

dd if=/dev/block/mmcblk0p3 of=/data/media/0/Sbl1.bin

and post Sbl1.bin file

Thanks
[Galaxy S 4 General] CodeJACK:
I hope this file does not contain any of my personal data but I guess I have nothing to hide :D
[Galaxy S 4 General] Piksou:
I've seen a lot of posts referring to new Roms without the bootloader in Q&A.

Can someone indicate the xda topic with such roms ? I'm on MGA and plan to keep my current bootloader, but if I can get the latest ROM/Modem at the same time...
[Galaxy S 4 General] joiN85:
This is a samsung partition... no personal data... thanks
[Galaxy S 4 General] somator:
today ive asked Samsung Polska (Polish branch of Samsung) about Knox and the warranty and here is the response from spokesperson

https://twitter.com/SamsungPolska/status/390401098626138112

"Knox flag alone does not voiding the warranty"

---------- Post added at 06:32 PM ---------- Previous post was at 06:31 PM ----------

the question was if the service will repair the device with knox flag triggered
[Galaxy S 4 General] bungadudu:
Guess that's subject to change..
[Galaxy S 4 General] spinky360:
Lol!!!! In ireland they refused my unit :)))
[Galaxy S 4 General] bogdan1980:
They refuse în any country if flag is on.
[Galaxy S 4 General] somator:
maybe you had firmware revision not aviable in your region, custom krnel custom rom whatever

could you show us the letter you got saying they refuse to repair ?

simple debranding might be enought for them, even without rooting

seems like in Poland they've got some other approach
[Galaxy S 4 General] adry1988:
I'm now using vega pre rooted 4.2.2 rom which didnt trigger the knox warranty.

Considering this Is a knox friendly rom is the anyway of making a custom kernel which will not affect the knox warranty?

Is anyone working on solutions for the knox security added to our devices?
[Galaxy S 4 General] joiN85:
Ok this is sbl1.mbn (old bootloader thanks to CodeJACK) combine to mgg bootloader.

Odin flash work perfect (no error) but line knox remain in download mode!

Any idea?