[Galaxy S 4 General] z-phoria:
Evening fellow XDA'ers.

I don't know if these ideas or approaches have been thought-of/made on this subject, but the following links might give

you some fresh thought on have to adress this problem. I, for one, is more than ready to contribute to the competition as i would

really like to see our & ours items fully owned w/o any restrictions or force-upon software.

Atm i can only support with fresh(?) ideas - but anyways better then remaining silent, i think.

lwn.net/Articles/568943/ - Maybe a similar attack can be made for capturing the full firmware raw? (both 0x0 and 0x1 dumps for compares)

-

samsungknox.com/en/system/files/whitepaper/files/MP_KNOX%20Overview%20Whitepaper_V1.0_20131023_0.pdf -

At page 10 it says;

"Samsung KNOX technology uses a Secure Boot protocol that requires the device boot loader, kernel, and

system software to be cryptographically signed by a key whose root of trust is verified by the hardware.

Commercially sold Samsung devices will have Samsung-issued root certificates.

Government deployments generally require that government agencies or approved system integrators be

the custodian of the entire mobile device software.

As mentioned previously, Samsung KNOX devices have

a hardware-protected root certificate reserved for government agencies or their trusted partners to create

their own chain of trust. To achieve this Samsung signs the government's (or system integrator's) Level-2

(CA) certificate with the aforementioned root certificate, and provides tools to perform a one-time change

from the default Samsung root of trust to the KNOX Government root of trust."

I have no insight in how this can be used practically, but it sounds like one maybe can generate faked CA's to gain trust in bl for

perhaps custom kernels, firmwares etc.?

-

* * Own ideas on different approaches.

Verbose kernel dumping the calls made from bootloader at bootup can be useful for debugging purposes?

(dunno if this is correct thou, but it seems like its the way knox-bl works? or is it lowlevel?)

Anyone tried flash an own 'environment' with 4.3 official firmware whereat the binaries are unpacked or are they encrypted and signed by Sam whereas bl-block only accepting correctly signed ones? In that case - what algorithm is used? If so, would a mitm-attack between flasher and hardware-bl pick up any uncrypted data or is this made internally?

If the scenario really is, like some people are telling about, that Samsung "fixshops" can reset the bootloader (re-flash stock?), then

the remaining issue would be to push software into primary bootloader (not the main-hw one) tricking the main it's legit? And then, what checks are there from the primary one and what do the calls look like? Again, if one could write a very verbose soft at that stage a trial-and-error attempt could work to debug it?

Is maybe the supposed re-flash made by the retailers with the use of electricity? With this i mean hw responding to certain a/c-power-pulses or a schematic?

What are Samsungs policies on the Knox SDKs? Are they impossible to retrieve?

What are the main problem at which people stop their attempts on solving this issue?

Please share. Through new perspectives new ideas are born.

-

And you people don't just stop developing/disassembling on this subject, because the more info the more can be achieved.

Everybody seems to think ChainFire is your last hope (no not everybody, metaphorically), but you are just as good if not better (no offence ChainFire) at this, of course to some extent, you just don't know it yet :) Different people have different perspectives. To give up is the easiest.

I really urge people to post their occasional errorlogs here, no matter how trivial they might seem for your eye.

No ideas are too silly to throw away at first glance!

I hope at least some will shed some light on this matter & where they've stopped.

Thank you for your time and i look forward for any responses.

Many props for you hardworking devel's - you make our gold!

/z