[Galaxy Note 3 General] Lt1streconbn:
Good questions....

I'm going to go farther back, and This will answer those questions I believe and maybe help you decide if this will be of benefit... BTW: I'm not interested in a 'Bounty" at all. I love doing this stuff, and if I actually have a chance of helping some people... I'm quite happy. If it turns out to be the answer, you can donate you pledged donations to Autism Awareness or any other legitimate Ausism/ASD charity. Okay.... back to this now. Starting from day 1....

--- I received the device and it literally went black screen on first boot before I even set my google account up in setup. It had NC1 on it at that time and was covered by warranty of course. I sent it to Samsung and it returned with NI1 on 10/17/14. I flashed the NC1 kernel to it (SGH-I337) and attempted to gain true root access thru Kingo Root on pc and with that Chinese root app (I've had luck with it on S-ON HTC devices in the past) but neither were able to get root access. I already knew SuperSu couldn't get root most likely but installed directly from market just to see what happened and where it encountered issues. I was unable to disable Knox at that time. I was unable to get any root access in terminal. I decided to uninstall SuperSu and rebooted to stock recovery and cleared cache on reboot because it's better than nothing I suppose. I installed towel root and it had success. I wasn't sure what extent of root access I had with it, but upon checking wasn't satisfied. I searched forums on current and older Samsung devices with and without Knox and with older versions than 2.0. I decided to try installing SuperSu from market again, but it still couldn't disable Knox. I installed all the apps from market at that time I thought I would need possibly and decided on a course of action. I figured by others post that Knox and SELinux could softbrick the device to a nonfunctional state. I then use 'pm disable' in terminal emulator to disable the Knox container app as it was the app SuperSu disabled in 2.0. I managed to pull root access from SuperSU using 'daemonsu' command as trying su didn't get me root access at that time from SuperSu. It triggered SuperSu to prompt me in Terminal and I gained root, but only in Terminal. It wouldn't give root to FX or TiBu. I then use 'cp' in terminal to copy daemonsu to sdcard and renamed it su and placed it in /system/bin. Then used settings to shut down TiBu completely and opened it... it worked and SuperSu prompted for root access for TiBu. I then opened SuperSu and it went thru install and warned of Knox and prompted to disable it. It stated success. I immediately froze all remaining knox apps and the three security apps wiping their data as I went. I then opened FX which also now gained root access thru su I assume. I went to system and switched to TiBu to uninstall all the Knox apps... when it warned of .odex files, I went to the with FX and renamed them to .bak and copied the knox .apk files to microsd in case this course led to soft brick... I'd be able to remotely reinstall the apps and rename the .odex files or I might have just flashed fresh thru Odin3 again, but I like options. I left the security apps frozen at this time until I knew more about the scale of their permissions and relationship to Knox. I didn't bother with other bloatwares... I felt that rebooting before I had completely wiped out the primary apps and their data would be risky. I now went back to SuperSu as it'd need to update binaries to be stable... it stated it failed and to reboot. I didn't but it hadn't actually failed and I moved it to /system without incident. Device state was still official. I decided to get rid of bloatwares as I didn't want to run a second OS thru Safe Strap. I just wanted control of the phone, and I rather like this version of TW. The AT&T apps came out without issue thru TiBu. The device was still NI1 at this time with the NC1 kernel. I developed a screen rotation problem... it quite rotating. I didn't make the connection, but I knew the process I had done and refined it a bit. I used I337UCUFNB1_Rootable_Full_Odin.tar that I found on a forum search as that can be flashed to this device even with the locked bootloader and it already had the NC1 kernel it in. That's is the only modification to my knowledge. Flashing back to stock can usually fix this issue as I had the problem on my old SGH-I747 once and use UCDLK3 to repair it and went back to CM10.1 after and it was successful. Long story short here... I did it again with Samsung apps but knew there was a connection this time {{{{This is when I acquired the custom boot logo and 0x1, I didn't do that the previous time, but I had actually removed ALL the Samsung apps this time around. I booted to Odin mode to check the device state there and it listed custom and 0x1}}}}. I found a forum outlining this issue on I9500 International version of the S4. They had a .so file to fix the problem, so I edited it some and used it to repair mine. I really didn t care about the warranty and 0x1 value because I also have aftermarket warranty that services or replaces rooted devices. It was successful in repairing the screen rotation issue,,, Unexpected results also though that I'm not entirely sure came about. It changed my device state back to 'Official', restored the standard official boot logo... and 2 days later when I went to Odin mode I noticed the Knox warranty value had reverted to 0x0. That same day... I was searching for something in forums completely unrelated to this whole thread honestly ( even though I found close to what I was looking for here) but, I read a lot and realized this was a possibly useful thing to people with this issue. I decided to put the other project on hold and try to help you figure out how to reset that value, as I know it is absolutely possible. I have gained a lot more ownership, access, and control over my device since then by finally getting ownership in system and ability to modify build.prop without softbricking and repairing localhost and getting it to work on other ports since 5555 has been disabled (intentionally I believe). I also removed supports SELinux requires to remove and replace modified files without softbricking the device (in most instances). BTW.... I didn't actually install Safe Strap until I wanted to flash MF3 modem to the device to use ReigonLock Away to unlock it. I have since figured out the code to get access to required fields in Service Mode though and the inputs needed once there.

LoL... I wasn't mad. I didn't want anyone attempting this until I finished though so used the CAPS.

Okay... continuing here.... This is basically a 'hack' at this point. I'm just proving (I guess) that this is possible. I wasn't working in this direction before and stumbled into this. I love challenges. The basic idea is that SELinux has control of the major commands including the most important to me.... setuidgid and ioctl which are crucial, but lower commands are not restricted and at the same time SELiniux depends those commands to run. I'm just chipping away at it's lower command supports to basically cut it off from the system and then kill it. Getting full control of build.prop is huge I think and I'm not sure if everyone has already done that or not. I'm trying to get control of default.prop in root folder now to enable debugging. I only have ownership in /system and recursive folders for now though. What I'm saying is that this very difficult and you CAN BRICK YOU DEVICE very easily if you aren't familiar with data retrieval as I am. It was my profession I was trained for, so don't attempt this lightly. Use Safe Strap and run a backup every time youre attempting changes to and props or scripts... anything pretty much. I've had to restore several times, but if you have tha, it isn't a big deal imo. That's all of this long dang post. If anyone has a question don't hesitate to ask. I can share my current build.prop BUT if you simply have root access it will soft brick your device without other changes. If I run across anything new I'll share it or if I remember anything I may not have noted that was important I will also.