yashsingh1/xdaforums huggingface dataset:
[Galaxy S 4 General] BrunoWestone:
Hi guys, here is a copy of my conclusions i'm writing in another thread.

I'm going to post them here as well, it might help someone….

Hi guys.

I don't know if this helps or not but here are some of my conclusions on the subject:

I have a Jtag Box (Riff Box) and i tested several different things on several S4 With Knox 0x0 and 0x1.

1st Conclusion - Clone or Change the Boolean to 0x0 its not possible since the phone will put counter back to 0x1 again in the first full boot

2nd conclusion - There is a 3rd bootloader (kind of a bootloader) on this new firmware (latest 4.2.2 and on) that creates a secure container using the trust zone, and sandbox security keys and checksums communicating with the PBL (Primary bootloader) and SBL1 (Secondary Bootloader).

3rd conclusion - This container is created not on the first boot after the upgrade (as some say) but in the firmware upgrading process.

4th conclusion - The 3rd Bootloader is not read or write permitted not even with Jtag (At least i didn't found it after 3 full dumps in different phones)

5th conclusion - Once you upgrade to knox secure bootloader you can't downgrade to a un-knoxed bootloader because the security checksum between the 3 bootloader will fail and odin won't flash.

6th conclusion - This is far away the most advanced and secure operating system ever made by Men, but it as is faults. Last week the world found a huge bug in the knox containers that allows data to be exchanged from insecure boot mode to secured sandbox in knox app…

The theory :

The only way to reset knox counter is to "convince" the phone bootloader that it still's in 4.2.2 un-knoxed bootloader and flash a 4.3 knox firmware. This way, all the secure containers in trust zone and boot loaders checksums will be recreated, flags inclusive.

I tried unsuccessfully "kill" a knoxed bootloader with Jtag and recover it in a 4.2.2 un-knoxed one but Jtag won't write the new bootloader 'cause apparently this specific address (Bootloader address) is write protected ….

I hope this helps anyone, i'm done with this. I'm not a bootloader specialist and i'm pretty sure someone will find the way to reset this.

For now still Samsung 1 - 0 Rest of the World

I'm giving up on this but since i have a Jtag and 198 voided S4 in my office, i'll be available for testing anything on those.

Good luck researchers,

By the way, if it helps click thanks
[Galaxy S 4 General] rgshah3:
I guess [MENTION=3264599]degra[/MENTION]tedshadow had his warranty bit reset with jtag
[Galaxy S 4 General] bungadudu:
Huh?

Where?
[Galaxy S 4 General] FallenZen:
[MENTION=5584002]BrunoWestone[/MENTION], you're a star. Based on the information here: https://www.samsungknox.com/en/overview/technical-details

It looks like there are actually 4 bootloaders that are interacting, if we include the Android loader (which I believe is worth considering since all evidence suggests KNOX is incorporated into the system as a whole: bootloader(s), kernel, and active OS.

From this, it's reasonable to consider that the mysterious roadblock lay in the behavior of KNOX's redundancy processes. We've got bootloaders that cross-check one another to verify authenticity, we've got a kernel that kicks back anything from the bootloader that doesn't offer up the right key, and we've got something handling disk management processes (evidenced by partition modification and destruction which is not limited to occurring only during an actual firmware update)... And we know that it's possible to change the flag via modification of aboot.mbn, but the alteration isn't persistent due to aboot's interaction with one of the redundancies. Do I have it right, so far?

So, if (big IF) I'm not totally off-base with this assessment, there might be potential in combining Gazeddy's broad-stroke concept:

Which I originally read here: http://xdaforums.com/showthread.php?t=2486346&page=78

Is there the possibility for some multi-tiered method that simultaneously fools both sides of the handshake when one redundancy is verifying with another? Ostensibly, the end goal would be to introduce a custom (user-known) security key to each redundancy in a way that whenever a check is done, both processes offer matching keys... If that makes any real sense. I mean, I don't suspect this would likely be successful in the devices that have actual eFuses implemented, on account of the permanent hardware alteration of eFuses; However, for those devices that are faking it and/or attempting to masquerade using qFuses, does this sound like something that might be worth looking at? I mean, it sounds promising to my under-slept and over-caffeinated brain at 6am... But I'm just a newbie with hopes, dreams, and a lot of data with very little experience; So, I'd like the perspective of someone more familiar with all of this than I am. Thoughts?
[Galaxy S 4 General] mahmoud007:
I was able to remove knox on jb 4.2.2 and it never appeared again !!

Tho I couldn't change some files talking about fuses .. looks like they are offsets for the origional files

Wifi still not working ... sound was working but looks like it crashed !!

Not just sound .. no phone calls

but sim signal is fine ... I suspect that wifi hav3 relation with the knox counter

and system storage dropped to 9.86 gb from 16 gb full storage

any advice ??
[Galaxy S 4 General] ryanbg:
Which is all the more reason this points to the RPMB on eMMC. I've looked in several places, almost all of them, except the RPMB. It's got to be there. I just need a dump.
[Galaxy S 4 General] Mistertac:
This stuff fascinates me, keep up the good work.. Wherever it may lead
[Galaxy S 4 General] BrunoWestone:
You were able to do what ?? How ??

Do you mean you were able to flash a 4.2.2 un-knoxed firmware (Downgrade) and keep your phone working probably, but that doesn't mean you change the knox flag in the bootloader (holding volume down + power + home button ).

I'm i right here ?
[Galaxy S 4 General] Tanis64:
That's also my thinking about it, but if the KNOX Partition and / or the KNOX Container are been destroyed if the KNOX Warranty Void Flag is triggered, then why the hell Samsung doesn't reset that Flag within a complete wipe.

If I root / custom ROM my phone that Flag is triggered which makes sense in that context, so it is impossible to use KNOX. Then I wipe my phone, KNOX is allready destroyed, but with the Flag triggered I never ever can use KNOX anymore.

Why?

I think triggering the Flag does NOT destroy the KNOX Container, but it denies the access to it.

So if there is a way to reset that Flag, access will be granted again, and that exactly is the problem for Samsung. Then KNOX will be broken.

Send from the outback with my GT-I9505
[Galaxy S 4 General] BrunoWestone:
You are almost 100% right . Sammy say that once you root, downgrade or modify the software of your phone, is no longer guarantied the security of the containers.

Otherwise, you could root, install a spyware in the trust zone, unroot then create a secure container and sell the phone to anyone saying " this is the most advanced and secured phone in the world, so you can put your naked pictures inside and no one will access them", but the phone as the security bypassed with the spyware.

To prevent this, Samsung VOID THE BIT SO THE USER KNOWS THE PHONE IS NO LONGER SECURE.

Lots of people don't know this, but if knox flag is voided, the Knox app inside the phone won't work anymore and thats the big problem for all of us ( at least me ) that have phones that i can't sell in the market since all they're features can't be used by the user.

Thats why i have 198 brand new S4 here i can't sell.

It's painful mate !!
[Galaxy S 4 General] Surge1223:
Wv = warranty void

Since it references SMC calls to/from the TrustZone we know that the information regarding whether the warranty has been voided or not must pass through there so even though were unsure of where the actual information is stored we can still intercept the call and or trace the location. First we would need to reverse engineer some of aboot and the tz and locate an SMC call that queries the TZ and reports the address to a "Non Secure World" location. It would have be along the lines of what djrbliss did that I've quoted below.
[Galaxy S 4 General] Michal Z.:
I'm not sure if it will help in your case but people that have flashed custom roms and triggered knox also had problems with wifi and sound. It seems that they flashed different modem and problem was solved.
[Galaxy S 4 General] dermousis:
OT: Does anyone have any suggestions about online resources or books about reverse engineering on kernel, bootloader, etc, for Android devices?

I would like to get my hands dirty..., and start contributing.
[Galaxy S 4 General] ryanbg:
Learn the fundamentals of Linux.
[Galaxy S 4 General] mahmoud007:
Knox

THIS BEEN TESTED ON Galaxy GT-I9505 DEVICES

Ok so i decided to tell you the way to downgrade your s4 to previous version 4.2.2 but i'm telling you now wifi will not work because apparently it attached with the KWV flag and 4.3 version !! im not sure about sound but it may crash along with phone dial up , also there will be a memory drop down correction : memory wont drop ... its already dropped down from 16 gb but i forgot about that ..sorry :cowboy: and i think no sound problem will be there because i am the one who broke it by unsafe and repeatedly flashing odin

so you decide either do it or not do it :

This wasTested on MGA downgraded from MK9kernels ... not sure about other kernels

1- Download your country 4.3 JB version from Sammobile

2- Download your country 4.2.2 JB version from Sammobile

3- Download this file View attachment sbl1.rar

4- Download Odin and extract it View attachment Odin307.zip or any newer version

(Now the Hard Part )

5- IF you have Linux system you dont need this step otherwise download this program and install it Cygwin

6- Extract from 4.3 JB the folowing files : aboot.mbn , tz.mbn

7- Extract from 4.2.2 JB all the files Except aboot.mbn , tz.mbn

8-

...a -Extract sbl1.mbn file and gather all the extracted files in one direction "FOR LINUX USERS"

...b- Extract sbl1.mbn file and gather all files in C:/cygwin/home/'win_user_name' just cut and paste all the extracted files there without making any folder "FOR WINDOWS USERS"

9- now open linux termenal or cygwin and type these codes :

this first code for linux users

cd [I]'folder direction'[/I]

chmod 644 aboot.mbn boot.img cache.img.ext4 hidden.img.ext4 modem.bin NON-HLOS.bin recovery.img rpm.mbn sbl1.img sbl2.img sbl3.img system.img.ext4 tz.mbn

tar -H ustar -c aboot.mbn boot.img cache.img.ext4 hidden.img.ext4 modem.bin NON-HLOS.bin recovery.img rpm.mbn sbl1.img sbl2.img sbl3.img system.img.ext4 tz.mbn > s4.tar

md5sum -t s4.tar >> s4.tar

mv s4.tar s4.tar.md5

10- open Odin and install the new Rom you just instructed s4.tar.md5 in PDA or PA , you will find s4.tar.md5 Rom in the same direction of the extracted files

11-restart your device and after it vibrate press Volume Down + Menu Button will show Download Mode press volume Up and connect your device through origional s4 usb cable to PC

12- on odin Hit start .. and your done !!

13- if someone find solution for the wifi and sound issue please let me know

PS: this does not fix the counter Issue this only will downgrade your s4 to 4.2.2 official !!

HIT THANKS IF THIS HELPS PLEASE :good: :D
[Galaxy S 4 General] malybru:
Just a quick reminder for those who did not see it last time:

Thread cleaned

I am going to keep this thread clean for the Research only.

All other knox questions go to the Q&A THREAD

Thank you

malybru

Forum Moderator
[Galaxy S 4 General] sangalaviral:
Try a custom kernel to see if wifi works.
[Galaxy S 4 General] mahmoud007:
I mistakenly corrupted the dalvik cache unpurposely

Is there a way to fix it w/o reflashing back the whole rom ??

Because I dont have my laptob right now
[Galaxy S 4 General] gazeddy:
Custom recovery? Try a cache wipe in there
[Galaxy S 4 General] .NetRolller 3D:
A quick question: so far, on what devices has it been confirmed that replacing the eMMC chip resets the flag?

If what some people are saying in this thread is true, then we would expect:

-Galaxy S3 / S4 / Note 2 will reset (not sure about S4 I9500),

-Galaxy Note 3 won't (because it's a true efuse, which is always inside the SoC, not the eMMC).

Also, it would be nice if people with the affected devices posted their eMMC chip model or (if known) the eMMC version.

On my I9305, I have a KLMAG4FE4B (AKA MAG4FB - the bold letters are always used to create the 6-char name), which is eMMC 4.x. The N7105 appears to have the same chip.

The N7100 has been seen with a KMVTU000LM, also 4.x

I remember seeing a Toshiba 4.x eMMC in one Galaxy S4 (not sure which model).

What I am interested seeing is whether there are any Note 3s with 4.x eMMCs.
[Galaxy S 4 General] naboleo:
what would be the easy way to get that serial ? Didn't found anything revelant in /proc/kmsg ....
[Galaxy S 4 General] viktorak:
You can check it with this application from play store:"eMMC check"-vinagre.:cowboy:
[Galaxy S 4 General] naboleo:
MBG4GC using this app "eMMc Brickbug Check"
[Galaxy S 4 General] tommiyau:
S4 emmc chip type AFEABB using same app
[Galaxy S 4 General] bungadudu:
Funny, I found that there's an 32 gb Emmc 5 by the code MBG4BC,

but found nothing about MBG4GC on Sammy's site...

Anyway, I'm just baffled nobody tried a factory format with the new z3x, there's no talk about maybe trying to emulate that into a noob friendly solution... :what: :-|
[Galaxy S 4 General] Kouya1600:
Note 3 (N9005) "SAMSUNG MBG4GC,31GB,OCT 2013, KNOX 0:1

S3 LTE (I9305) "SAMSUNG MAG2GC,16GB,NOV 2013 no KNOX Bootloader

Note 2 (N7100) "SAMSUNG V3W00M,16GB,MAY 2013 no KNOX Bootloader MJ5 :)

Read with SD Insight

I hope I can help. The more information the better I think sometimes

Under the vibration motor and over the Spen is a unused connection, do you mean you can reset Knox or the bootloader downgrade? Since he is not even in use.
[Galaxy S 4 General] chudy_85:
I have i9505 and my emmc its AFEABB and its sammy. Can i use jtag and z3box to reset my knox waranty void??? If this its true i thing go to servis and downgrade my bootloader and rom

Wysłane z mojego GT-I9505 przy użyciu Tapatalka
[Galaxy S 4 General] latouffe:
If you have 200 USD i think you can downgrade.
[Galaxy S 4 General] bungadudu:
For the regular person it's way better to go to a service.

Cheaper, no complications.

Thing is there are quite a few people with boxes, here on xda, but no-one is reporting anything about this :bummer:

I'm still hoping [MENTION=631273]Chainfire[/MENTION] will take a look on this and try to emulate it in TA4.
[Galaxy S 4 General] Irwenzhao:
Nope.

Smack that Thanks button if I helped!

KitKat came in on my OmniROM, running on my Note 2.

Sent from a small country called Singapore.

P.S. Time for school, not much time for XDA :(
[Galaxy S 4 General] bungadudu:
Why not?

Have you tried it?
[Galaxy S 4 General] DJ_Jedi:
Im on ML6, no Knox, if i use this guide can i downgrade and after install a custom recovery without triggering it?
[Galaxy S 4 General] mahmoud007:
Im not sure about that but since no odin failure should be no issue ... but its only in theory ... im not really sure

.

I really dont care about knox counter ... Im only glad that im back to 4.2.2 with no knox... and this wifi issue .. im sure ill be able to fix it soon
[Galaxy S 4 General] mayotube:
Important news here on xda.

http://xdaforums.com/showthread.php?t=2621750

Possibility for Knox reset and boot downgrade

The jtag Box is very expansive and it has not been tested yet.

Gesendet von meinem GT-I9505 mit Tapatalk
[Galaxy S 4 General] nitrate:
Doesn't make any sense because:

For some service repair locations KNOX 0x1 = warranty void

In order to reset KNOX (even if it works by using this JTAG box) you would have to open the phone to solder some wires = warranty void

We need some USB reset method, if there even exists one...

Some people said their KNOX was reset within 10 minutes in a service locale. There must be some other way. I think it takes way longer to open the phone, solder wires, format eMMC by use of this JTAG box, reflash firmware, reflash valid EFS backup and put the phone back together afterwards...

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy S 4 General] BrunoWestone:
FIRST, YOU WONT NEED TO SOLDERING ANYTHING.

There is a Jtag Jig (cost around 12£ = 16USD) for all Samsung Phones and you just connect that Jig to the PCB and voila.

The problem is IT WONT WORK !

I already read 12 different threds about knox, and i haven't see not even one guy saying he get is knox reseted to 0x0 with a Jtag procedure.

I have 2 Jtag Box's (Riff and Z3x) and tried several times with several phones different procedures (Even procedures that i know for sure it would kill the phone) to get rid of this stupid bootloader.

I'm not saying its impossible, i'm just saying that no one achieve it yet and i don't want to see you guys spending money on a box that won't do it.

This is the official Z3X team Press release:

EASY-JTAG 1.0.99.0 NEW YEAR - NEW REVOLUTION SOLUTION FOR repair/rebuild emmc

TIME FOR REPAIR BROKEN SAMSUNG EMMC

New YEAR - new Generation of EMMCtool engine comming, while others doing fake updates with hundreds uploaded files, we did some research and now we have ready for public release new REVOLUTION SOLUTION for emmc repair!!

YES YES. Exactly now we can repair lot of broken SAMSUNG EMMC chips with different internal firmware problems!!!

EMMC Tool improvements step by step:

1. Added SMART report (Samsung emmc only).

This function allow to check status of samsung emmc also see bad block couters all same like in SSD.

2. Added SMART WIPE format function ( WIPE almost any samsung eMMC card) - !!!!!!!!!

After smart format EMMC back TO FACTORY CONDITION

This function can:

- back to live almost any samsung emmc:

- can fix permanent PROTECTION FLAG (UNWRITABLE MMC).

- can remove VENDOR BOOT DOWNGRADE PROTECTION!!!! <<<< Yes. Now you can downgrade boot and phone will work!!!!

* Samsung SMART WIPE AVAILABLE ONLY FOR SAMSUNG EMMC with latest FW revisions.

3. Added moviNAND erase function.

4. Added TRIM Erase function ( may be long but work on all eMMC cards ).

5. Added display size of BOOT1 BOOT2 RPMB areas.

6. Fixed eMMC fw revision display.

7. Fixed bugs with stop button.

8. Improved connection stability.

It's Just me or i don't see anything about Knox 0x1 to 0x0, or knox voided reset, or knoxed boot loaders downgrade !?!??
[Galaxy S 4 General] bungadudu:
Well.. NoName (another member of the z3x team) clearly said that this is possible - http://forum.gsmhosting.com/vbb/10041647-post8.html
[Galaxy S 4 General] BrunoWestone:
I won't say you are wright or wrong, but i know this guys and let me tell you… If they can sell more 3 or 4 box's with all this miss understood its not bad at all…

They specifically say, and i quote "Originally Posted by LEENO View Post: so is possible downgrade s4 bootloader and reset knox counter?

Answere :Yes. Do factory format of emmc. and write old boot files." But from 4.3 Knoxed bootloader ??

Will the Bootloader stays un-knoxed with the downgrade or it will be "replaced" for a knoxed one in the first full boot ?

None of them specifically talk about knox reset, when it should be the invention of the century !!!

If i found the solution to reset Knox i would post it in times new roman 24 bold and underline so everyone notice it.

But, i'm not saying its not possible, just saying that sounds weirdo no one from the team proudly assume that Knox counter is now resettable with Z3X, don't you think bungadudu ?

:)
[Galaxy S 4 General] phr3ncj:
bruno, i think that if they would say "reset knox" on their website, sammy wouldn't take it good. btw we only have to wait for someone trying this method to confirm that what z3x team said is true or not.

Inviato dal mio SM-N9005 utilizzando Tapatalk
[Galaxy S 4 General] BrunoWestone:
I guess you're right.. we're just a few days from find out :)
[Galaxy S 4 General] nitrate:
There also is no reply yet upon a Note 3 KNOX counter reset using the z3x JTAG box.

Still waiting for confirmation on this and still USB adaptor required. Resetting KNOX counter by opening the phone is senseless (warranty void).

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy S 4 General] note2nooby:
Bruno, if you have a broken phone to test (knoxed bootloader), try to rebuild everything... Emmc , 2 boots, all. And then flash the 4.2.2 version.

If you didn't tried already. ..

When I first saw jtag really got my hopes up. But reading your post, brings my feet back to the ground.
[Galaxy S 4 General] mahmoud007:
Edit : Fixing sound & Phone Dial up

THIS BEEN TESTED ON Galaxy GT-I9505 DEVICES

Ok so i decided to tell you the way to downgrade your s4 to previous version 4.2.2 but i'm telling you now wifi will not work because apparently it attached with the KWV flag and 4.3 version !!

so you decide either do it or not do it :

This wasTested on MGA downgraded from MK9 kernels ... not sure about other kernels

1- Download your country 4.3 JB version from Sammobile

2- Download your country 4.2.2 JB version from Sammobile

3- Download this file View attachment sbl1.rar

4- Download Odin and extract it View attachment Odin.zip

(Now the Hard Part )

5- IF you have Linux system you dont need this step otherwise download this program and install it Cygwin

6- Extract from 4.3 JB the folowing files : aboot.mbn , tz.mbn , modem.bin , NON-HLOS.bin

7- Extract from 4.2.2 JB all the files Except aboot.mbn , tz.mbn , modem.bin , NON-HLOS.bin

8-

...a -Extract sbl1.mbn file and gather all the extracted files in one direction "FOR LINUX USERS"

...b- Extract sbl1.mbn file and gather all files in C:/cygwin/home/'win_user_name' just cut and paste all the extracted files there without making any folder "FOR WINDOWS USERS"

9- now open linux termenal or cygwin and type these codes :

this first code for linux users

cd [I]'folder direction'[/I]

chmod 644 aboot.mbn boot.img cache.img.ext4 hidden.img.ext4 modem.bin NON-HLOS.bin recovery.img rpm.mbn sbl1.img sbl2.img sbl3.img system.img.ext4 tz.mbn

tar -H ustar -c aboot.mbn boot.img cache.img.ext4 hidden.img.ext4 modem.bin NON-HLOS.bin recovery.img rpm.mbn sbl1.img sbl2.img sbl3.img system.img.ext4 tz.mbn > s4.tar

md5sum -t s4.tar >> s4.tar

mv s4.tar s4.tar.md5

10- open Odin and install the new Rom you just instructed s4.tar.md5 in PDA or PA , you will find s4.tar.md5 Rom in the same direction of the extracted files

11-restart your device and after it vibrate press Volume Down + Menu Button will show Download Mode press volume Up and connect your device through origional s4 usb cable to PC

12- on odin Hit start .. and your done !!

13- if someone find solution for the wifi and sound issue please let me know

PS: this does not fix the counter Issue this only will downgrade your s4 to 4.2.2 official !!

HIT THANKS IF THIS HELPS PLEASE :good: :D
[Galaxy S 4 General] BrunoWestone:
Thanks a lot mate but that don't reset the knox counter !

---------- Post added at 01:55 PM ---------- Previous post was at 01:48 PM ----------

i already did that note2noby, over and over again. I did it with Riff and Z3X Jtag Box…

eMMC adress is write protected, how can i full erase it to factory if Jtag Can't write on it ?!??! Unless they developed an algorithm to bypass write protection security, but honestly i don't think such algorithm can break the most advanced and secure (and expensive) mobile OS ever developed by Men.

But, just in case, i will do it again today, following all the step by step instructions, like i was a 8 year old baby and post the results here.
[Galaxy S 4 General] note2nooby:
I thought they said in the jtag forum, 1.99 is erasing and formating emmc...

Thanks for your efforts.
[Galaxy S 4 General] BrunoWestone:
I know and i truly believe it erases eMMC, but not on the knoxed boot loaders …

---------- Post added at 04:25 PM ---------- Previous post was at 04:22 PM ----------

But i might be wrong !!

I mean i hope i'm wrong !!!!!!!!!!