yashsingh1/xdaforums huggingface dataset:
[Galaxy S 4 General] chudy_85:
i open slb1 using hex editor and find somthing interesting dowmload from link and unpack and you see screan shoot

link ---> http://www36.zippyshare.com/v/58041538/file.html

assertion parti -> is_locked == 0 fajled.assertion parti -> is_formating == 0

and

assertion parti -> is_locked == 1 fajled.assertion partii -> is_formating == 1 failed.assertion parti -> ref_cnt >= 1
[Galaxy S 4 General] dpeddi:
Speculation: S4 comes with 4.2.2... 4.3 bootloader should setup knox and tima datastore after installation of bootloader...

If knox is software as expected.. perhaps is possible to simulate a first setup

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Galaxy S 4 General] malybru:
Mod Edit

Thread cleaned

I am going to keep this thread clean for the Research only.

All other knox questions go to the Q&A THREAD

Thank you

malybru

Forum Moderator
[Galaxy S 4 General] E:V:A:
Very nice collection and Good work.

I only have a couple of comments.

First of all, don't trust anything that Samsung writes! We've been proven countless times that their eye-candy marketing presentations rarely have anything to do with reality.

That being said, since Samsung KNOX (TM?) is "present" across a whole range of devices, we should naturally expect that the methods used to check for KNOX flags, varies just as much. From blatant "fake" flags to real 'burnt' fuses, somewhere on the chip dye. So that's probably why we have/find such varying info on how to revert the KNOX flag. This is especially true since Samsung phones with the same "name" have many different HW inside. (Remember "Galaxy S2", which exists in about 20 different HW versions!)

Certainly in the Qualcomm documentation of the S4 (MSM8960) + others, it seem that there is a real "fuse" present on the dye. (It's a PoP, so on which dye?) But on the SOFF flag on the HTC One X, we were dealing with a simple flag on a non-accessible part of the EMMC.

So can we trust the QCOM docs? Honestly I don't know. But since the Snapdragon S4 (MSM8960 family, inc. 8960) is PoP, we can not completely rule out that they are just using a funny way of programming (using higher voltages etc) a specific part of the memory. If it is physically revertible, we don't know, and doesn't help for this discussion. What would help, is knowing exactly how the KNOX is used in various HW configurations. Surely, there should be ways to intercept and fool either the checking or fusing mechanism.

At this point I suggest we make a new thread or decide on someone to maintain an updated post, that contain the

technical details

on where and how the KNOX works on each one, on a list of devices.
[Galaxy S 4 General] z-phoria:
Thank you alot, but PLEASE don't be too hard in cleaning - just obvious, 'googleble' questions ;)

:good:

/z
[Galaxy S 4 General] z-phoria:
Sure, or we could make a post containing this which a mod makes sticky as first post - if possible.

Great idea thou. Has to be verified info too. And links for the sources etc.

/z
[Galaxy S 4 General] wanb1i:
I'm not sure if this applies to the manufacturer, but if it does, this would give us another avenue to force Samsung to honor their warranty.

http://infojustice.org/archives/31815
[Galaxy S 4 General] _alex74_:
On the electrical sheets of MSM8960 my conclusion are that there is only a qFuse that can be programmed, seems blown by a positive supply voltage from QFPROM?...

at the end seems we figure the same, in fact is impossible to know if and how it can be reverted(different voltage), it does not help, but we can understand better how it works

uhm.....this only Sammy knows, we really need something comes/leaks out of there.... but in my opinion Knox routine written in non-accessible part of the EMMC will acts the same just pointing on different qFuses or eFuses (if any i will say, device depandant)

i think that if it will be discovered where and how the KNOX works then porting to other knoxed devices will be for Xda Devs/masters walk in the park.

We miss the most important bolded points, in my opinion we really deal with 2 kind of Knox action:

- the EMMC 5 with efuse, hardware protection

- the EMMC 4.5 without eFuse, software protection

this is the point which may differ for devices and be resetted only on second example
[Galaxy S 4 General] E:V:A:
No, the opposite! ;)

eMMC5 has built-in fuse-like behavior. TL;DR details...

eMMC4.5 has something, but not proper, so they depend on Qfuses (Qualcomm) and something else (eFuses) for other processors.
[Galaxy S 4 General] _alex74_:
UHMMM... i just lose myself.... maybe you can correct me?

eMMC4.5 has no efuse so they uses qfuses that seems can be programmed/reprogrammed , so software trick will do the job

eMMC5 uses efuse so once is blown, you can do nothing exept replacing eMMC.

The workaround will be(if there are more efuses) software say to check at boot a non blown one(this seems to me like walking on the water). Emmc specs do not say anything.... so .....
[Galaxy S 4 General] mahmoud007:
Knox news

I just contact with the samsung service in my country explaining the issue about my knox

Conversation:

Me : Hello .. i have a problem with new update Jellybean 4.3 a program called Knox "acting Innocent :angel:"

SS : Thank you for calling S.S .. what is the problem with Knox ??

Me : i just got my device back from the warranty and they told me that the only way that could be fixed is by changing Main Board

SS : Can you give me your Phone N.o sir ?

Me : its the same N.o im calling from

SS : I'll be right back sir ... thank you for waiting sir ... it seems that your Knox is blocked ..

I can see it on my system its Locked

!! ":eek: dafaq"

Me : could you tell me why i just bought new phone that have not working and irremovable Program ??

SS : you must'v entered wrong password too many times !!

Me : whats the Solution now ??

SS : you must do as the warranty C.o says , witch is changing Main board

So .. the question is .. how many fingers does the cat have ?? :confused::confused:

could be IMEI lock guys -_-

or worse !!

we could be Holding Samsung spy tool :mad:

or WORSE !!

IT COULD BE BOTH !! :mad::mad:

Im not buying samsung anymore ... and thats final !!
[Galaxy S 4 General] bungadudu:
So if you enter a wrong password, you must buy a new mainboard / phone to use it again? And subsequently loose all your data anyway?

What's wrong with them????

Pretty interesting that they can see remotely if knox is blocked.. Anyone can confirm this?
[Galaxy S 4 General] mayotube:
So it seems that entering a wrong password too many times results in getting KWV Bit 0x1 ?!?!

Gesendet von meinem GT-I9505 mit Tapatalk
[Galaxy S 4 General] nitrate:
If that's true, then it's a real disaster. :eek: Where has privacy gone these days?

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy S 4 General] bungadudu:
Id say this must be tested..

And if it's real.. there must be a way to reset it.

Wtf? My kid can play with it. So I loose all my documents and I must buy a new mb? :eek:
[Galaxy S 4 General] wishm:
I've tried 20 times to enter the wrong password. After 20s I'm trying to erase everything and you have to re-install knox. Flag has however remained at 0.
[Galaxy S 4 General] gencho81:
Dude i have N7100(PLS don't remove my post) ,but i can say i have same conversation with Samsung Greece .

What i learn from them-even they don't know what to do with KNOX Flag.And why i say that :

When i told them that my knox is set to 1 the told me -My warranty is over in that momment.

When i told them after that everything else is OFFICIAL and 0 -My warranty is still OK.

And one suggestion to devs :

If KNOX is part of the Bootloader and cant be passed with ODIN without tripping it - is there other way to flash only the bootloader(under Linux lets say) before it detects the attempt for replacement
[Galaxy S 4 General] z-phoria:
Dont know about N7100, because this is for Galaxy 950x and the only thing i can tell you is that if you have Knox there currently is impossible to flash the bootloader as it is locked (write protected) and the secondary bootloader gets checked by signature verification.

If we can find a way to circumvent this and get to install a custom bootloader, there might be a chance changing this. Research is on-going.

/z
[Galaxy S 4 General] fr3ker:
Researchers discover Vulnerability in Samsung's KNOX

I dont know if anyone had found

this

yet...

seems like there's still hope :D
[Galaxy S 4 General] nitrate:
No exact explanation on this bug / exploit.

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy S 4 General] bungadudu:
Was not a flaw/bug of knox.

https://www.samsungknox.com/en/node/795
[Galaxy S 4 General] gazeddy:
But arent samsung going to play down any exploits found. They arent going to let the corps that are trusting knox think its insecure
[Galaxy S 4 General] dannyling:
Sorry about last post .

Just still trying to get my head round this knox and a way to get around so if I root and disable knox does this affect my hardware in any way if it does on a hardware level would it be possible to change bootloader before rooting like a custom bootloader as knox is a link between software and bootloader if we can change bootloader before knox runs
[Galaxy S 4 General] gencho81:
I think all the problem with knox come with SBOOT.BIN.

I was able to open it with hex editor but all i see is some symbols ,than some understandable and again symbols after.

i don't know nothing about programming but can be the answer in this lines :

ANDROID!<bh:00><bh:00><bh:00><bh:00>[TIMA trusted boot]: SEAndroid MAGIC failure (recovery.img)

<bh:00><bh:00><bh:00><bh:00>[TIMA trusted boot]: SEAndroid MAGIC failure (boot.img)

<bh:00><bh:00><bh:00><bh:00>Set invalid sign flag

<bh:00><bh:00>TIMA 2.0<bh:00><bh:00><bh:00><bh:00>mobismc<bh:00>Could not do normal boot. (invalid magic)

<bh:00><bh:00>reset<bh:00><bh:00><bh:00>prb is null!

<bh:00><bh:00><bh:00>%s: id=%d, data=%d

<bh:00>buffer allocation failed! (0x%x/0x%x)

<bh:00><bh:00>NeedChecksum clear

<bh:00>packet data size
[Galaxy S 4 General] goodex:
Actually that could be the test of the recovery ans reset it :0 thanks and please look for this devs

Gesendet von meinem GT-I9505 mit Tapatalk
[Galaxy S 4 General] bungadudu:
A revised article about the knox warranty bit was published by Samsung - https://www.samsungknox.com/en/blog...ox-enabled-devices-and-knox-warranty-void-bit .

They keep marching on the idea that the knox counter is an e-fuse, that once tripped it will not allow reading/using knox containers ever again (dumb!).

About rooting and the warranty seems they are not buying into that "rooting is legal in Europe"

" We do not recommend that you root your device , since it can cause software problems, cause your device to operate improperly (for example, overheat), and as a result void your warranty"
[Galaxy S 4 General] Hawke84:
AFAIK only thing u could do with that would be to create a fake 0x0. Any unsigned packages would likely trigger the fuse
[Galaxy S 4 General] latouffe:
I called yesterday the Samsung repair service here in Wroclaw, Poland. They said that 0x1 = warranty void and they dont have any means to make it 0x0 again.

So yeah...
[Galaxy S 4 General] mahmoud007:
Knox

ok so today i got my device back from warranty .. they didn't do anything ~ still knox void 0x1

so i got crazy and tried to Nand Erase All and repartition ... but nothing happened !!

.

.

.

apparently SELinux effect is running on odin mode !!

so we need to focus on shutting down SELinux first in order to remove knox bootloader .

.

.

and one more thing !!

when i tried Nand Erase after it fails on device screen was written in red font SW fuse 3 , Binary 1

.

which confirms that Binary counter is still working on s4 but we need to remove the additional bootloaders first .. starting with SELinux

.

thats why triangle away is not working on knox bootloader because it cant access to binary counters !! SELinux reason !!

and another thing !!

i made my own JIG today with 330k ohm resistor on old s3 usb cable !! :p

after i made it and connected it to pin4 & pin5 , device action was only normal start up and skipping Odin mode !!

so i took a look for s4 origional cable pins !! and here was the surprise !!

Pin4 "ID pin" does not exist on s4 cable !!!:confused::confused:
[Galaxy S 4 General] downwiththebanksters:
I just have to throw in here, in case Samsung is counting, that I'm seriously angry about this situation. Outside of an S4GPE I won't buy, or recommend, Samsung phones again. We may be small in number, but our influence extends far beyond our own devices. The company has to be tremendously tone deaf to the public's reactions to the Snowden revelations et al recently. Their assertion this is for "our protection" is dubious at best. I'm curious why there hasn't been as large a consumer outcry as there was when HTC locked their bootloaders. If there has, and I missed it, please point me in that direction.
[Galaxy S 4 General] Damir78:
Petition for rooting

Please, join and share THIS petition:

Friends,

I just created a new petition and I hope you can sign -- it's called: Samsung, HTC, Nokia, Sony, etc.: Allow rooting of our phones - we want freedom

This issue is very important to us, and together we can do something about it!

Read more about it and sign it here:

http://www.avaaz.org/en/petition/Sa...ooting_of_our_phones_we_want_freedom/?efZyKdb

Thank you:good:
[Galaxy S 4 General] Mack_75:
Good idea but very aggressive text. The first part in a bid to root for me is fine, but to threaten Samsung and other companies "You'll see what you have of it" is not the way I want to go, so I will not sign the petition, Sorry.

btw: It's OT here
[Galaxy S 4 General] bungadudu:
Either way, I signed it.

The main idea is what matters.

We must unite and bring some common sense into this matter.

With enough backers, media coverage will come and with enough media pressure they will be forced to acknowledge their bullying and back down.
[Galaxy S 4 General] PHIL63370:
I use a JIG each time I want to use Odin and I have no problem with it, the phone boot in Odin mode like always.
[Galaxy S 4 General] GalaxyS49505:
I have a friend in Globul Bulgaria(Repair Service). And he told me Samsung have a cloud software for resetting knox.They attach phone with usb ,write the IMEI on cloud software and software resetting knox.
[Galaxy S 4 General] bungadudu:
Test it.

// you don't need warranty, talk to your friend to reset the KNOX counter. :-|

You go to Globul, ask for your friend, he is called in front, you give him the phone, he resets it and return to give out back to you.

Or give him the phone before work and he'll return it to you after work.
[Galaxy S 4 General] GalaxyS49505:
How can i test?I don't work in Globul.Besides my S4 have no warranty (I win phone).
[Galaxy S 4 General] gazeddy:
Trip knox and give it to him
[Galaxy S 4 General] GalaxyS49505:
Yeah right and he get fired because of that.Good thinking.
[Galaxy S 4 General] mahmoud007:
SO ... Today i made a huge step !! :good::D

i successfully downgraded the s4 Rom to JB 4.2.2 and SELinux on permissive mode

even there were some issues like wifi does not working at all .. and Knox warranty void 0x1 still showing on odin mode

and what its seems to be kernel panic on the start up screen !!

and leaving my device back home because i was late from work .

but i am happy :laugh: and thats what does matter :good:

i just did something samsung said that it was not possible :angel:

ill give you more information when i'm home ;)
[Galaxy S 4 General] m3w0lff:
I guess that you are downgrade to MDM or MDF (first firmwares,older) firmware,

this is possible
[Galaxy S 4 General] mahmoud007:
does it shows when you flash the kernel on ODIN MODE like this :

kernel warranty bit : system

kernel warranty bit : cache

??

and when start up it says

Kernel is Not SEANDROID as i recall :confused:

and something in yellow i dont remember it

it does look like a kernel panic to me

i dont remember the kernel number tho .. i was late from work

i think it was MK3
[Galaxy S 4 General] clouds5:
I think that's good news :) if entering a wrong pw too many times triggers KNOX 0x1 how can they refuse warranty for regular hardware issues? You can always say you forgot your pw :)
[Galaxy S 4 General] bungadudu:
Someone tested this by entering a wrong password 20 times. No problems.

I think what she saw on her computer was the warrenty status. If he previously went to a service they probably voided his warranty and entered this in system.

I'll just throw my 2 cents: if the knox counter is stored on the emmc, wouldn't it be better to find a way to fully erase the emmc, so after that we can flash a new rom along with pit =>knox 0?
[Galaxy S 4 General] mahmoud007:
in my opinion the only reason why we cant do much on odin except flashing 4.3 rom is because that emmc write protection and 4.3 Rom have that key to write on emmc

and only that key will allow us to completely format emmc .. including KWV status

and that file which have that key inside 4.3 Rom "after so many tests" is the aboot.mbn
[Galaxy S 4 General] wishm:
I tested that you enter the wrong password 20 times. Just KNOX be deleted and you have to re-install. It would be too easy to get 20 entered the wrong password and sticking you forgot your password.

Menu at the service in Slovenia mentioned that to run the application you need a license to Knox knox server. I think that this is true because if it was present eFuse, I would not even able to install the latest and not older roma, if you knox flag 1
[Galaxy S 4 General] bungadudu:
http://www.androidpolice.com/2014/0...large-number-of-root-apps-chainfire-explains/
[Galaxy S 4 General] mahmoud007:
Knox

ok so im back home and as i expected ... i'v got kernel panic status

now odin mode saying the next :

[COLOR="Red"]
ODIN MODE[/COLOR]
PRODUCT NAME: GT-I9505
CURRENT BINARY: Samsung Official
SYSTEM STATUS: Official
KNOX KERNEL LOCK: 0xfffffffc
KNOX WARRANTY VOID: 0xfffffffc
CSB-CONFIG-LSB: 0x30
[COLOR="Gray"]WRITE PROTECTION: Enable
eMMC BURST MODE enabled[/COLOR]

is that good or bad ??

in my opinion CSB-CONFIG-LSB status should be CSB-OEM-CONFIG-LSB: 0x30 am i right?
[Galaxy S 4 General] m3w0lff:
This happens when downgrade somehow

Nothing else will not work unless many bugs, corrupted rom and triggered Knox
[Galaxy S 4 General] caudex:
I did find this page which explains how Knox Works and they 'say' they use a eFuse

https://www.samsungknox.com/en/blog...ox-enabled-devices-and-knox-warranty-void-bit
[Galaxy S 4 General] mahmoud007:
Hello

So i succeeded on downgrading my kernel back to 4.2.2 "unlike what samsung says about downgrading"

but this come up with wifi issue that its Not working at all :rolleyes:

This picture i couldn't capture on Odin Mode so i made it with painter

View attachment 2529500

this status did happened when i downgraded my system after Kernel Panic

after odin passes on the start up screen showing as like when i purchased the I9505 ,,, i couldn't capture a picture so :

View attachment 2529501

now on About device this picture does shows that the kernel is officially downgraded back to MGA after it was MK9

as you see SELinux status does say permissive

the last Picture shows the wifi and it does not work at all

so .. yea , it only saying Turning on without actual turning on

so after this whole missup i made of my device i figured out one thing i suspect its true .. which is :

The only Reason why we cant downgrade our devices and why we cant remove this KWV annoying counter is :

.

.

* android 4.3 aboot.mbn file have the protection key to write on the eMMC card , unlike the 4.2.2 aboot.mbn file which i believe it doesn't have this authority !!

* 4.3 aboot.mbn file does have some lines to defined KWV counter and seandroid mode and even eMMC BURST MODE "it does prove that these eMMC counters"(can be removed)

* the pins which some people been talking about and locking kernel does exist "written" in both aboot.mbn files "4.2.2 & 4.3"

* 4.3 aboot.mbn file defined counter value to %x !! i don't know what does it refer to .. electric value ??

* bootloader lock value i believe is %d

* the 4.3 aboot.mbn file can be rewrite ... i did a test with rewritten one .. and it did not fail ... but also it didn't succeeded "probably programming fault"

* i believe as long you dont touch the encrypted signatures inside and you edit the readable part "programming part" on this file flawlessly .. i recommend a linux system while rewriting ... your good to go .
[Galaxy S 4 General] fstorm:
Nope. It just means "print the argument as a hex value. Check the doc of the sprintf function for details.

Envoyé de mon GT-I9505 en utilisant Tapatalk
[Galaxy S 4 General] mahmoud007:
ohh your probably right !!

that explains the hex values that KWV counter and KKL counter shows when kernel panic !

but what does turn to 1 as hex when we void knox ??
[Galaxy S 4 General] ryanbg:
And guess who just learned how to get into the RPMB?
[Galaxy S 4 General] bungadudu:
If you can mess around in RPMB... then.. we're close to a solution?
[Galaxy S 4 General] Tanis64:
Yes and No

Consider that if we're able to reset that KNOX Warranty Void Flag, without completely delete the KNOX Container, Samsung's answer to this will be completely locked Bootloaders, cause resetting the KWV Flag without destroying the KNOX Container will break Samsung's KNOX strategy. So KNOX become worthless and this is not in Samsung's Business Plan.

Easiest way for all:

Samsung implement function in Stock Recovery which delete KNOX Container and force a complete factory reset including Internal SD Card format.

Regards

Send from the outback with my GT-I9505
[Galaxy S 4 General] FallenZen:
I might be misreading you here, but it sounds like you're concerned that resetting the Warranty Void bit will compromise the KNOX partition. But, near as I can tell, when the bit gets tripped to 0x1: the KNOX partition is totally eradicated and it carries its secrets to the grave. Which means that resetting the bit will only serve to restore functionality of KNOX BYOD securities. I don't see how it would compromise the security of data on a partition that's already been eradicated. Am I mistaken in some aspect of this?
[Galaxy S 4 General] Tanis64:
That is new for me that triggering the KWV Flag will destroy the KNOX Container, if so what's the Flags need after that?

Send from the outback with my GT-I9505
[Galaxy S 4 General] FallenZen:
The intention behind the permanent flag is to help organizations ensure that no employee who participates in the BYOD program has a phone that has been significantly altered or compromised without explicit authorization. The KNOX Warranty bit is basically saying "if this is 0x0, then we warranty KNOX and this device as being secured by KNOX as outlined in the documentation. If it's 0x1, we cannot warranty the security of sensitive information on the device and cannot be held liable for any future security issues involving the compromised device."

I'm exhausted, so I really hope that made at least a little bit of sense.

-Zen
[Galaxy S 4 General] GTAGAME:
Yeah, i also tried to downgrade to 4.2.2 with 4 parts and it worked... But as you already said, no WiFi and even no sound! So i thougt maybe i can upgrade to 4.3 with Kies because it detected that the firmware is official and can be used to upgrade the system. After Kies set the phone to download mode it said that the Upgrade Program is unable to upgrade this device.. So yeah. And downgrading to 4.3 with Odin is also not possible.. Maybe because of the bootloader.