yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] Sudo77:
I would go with that ^. Although you are right in theory. That's what we've been discussing about, but I think the container software is tied to the flag you and you can't break that link. Think of the container as a Virtual Machine which executes code in an isolated environment (normal space vs secured space). Information may get in secured space only if its authorized and NOTHING gets out. However, IF you can reset the FLAG because it acts like a ticket, it can also get you back into the container.

Btw... fuses, I know I bring this up a lot but they just pop up everywhere I read. Samsung explained themselves that they use fuses (hardware-assisted verification) with the Knox flag. (Read page 6 Here) Life just got harder hasn't it?

Just for the gist of it and to lighten spirits, I'm going to propose possible solutions for resetting the flag :fingers-crossed:

Assuming a.) Exynos versions have fuses in only emmc and b.) Snapdragon versions have fuses in emmc AND CPU or other integrated chips according to here)

1.) Wait for leaked firmware to reset bootloader status and flag (done here).

2.) Wipe or replace emmc (unit disassembly required) with Jtag and re-install downgraded/unlocked BL and firmware (stock 4.2.2 or older devices only) or locked 4.3 or higher (Exynos only). Done here.

3.) Replace motherboard and re-install (All variants)

I am going to discard the possibility of BL modification to reset flag, because even if it is done, there is going mismatch in BL/kernel signatures and TIMA component will re-trip the flag/you will never be able to return to stock Android. Not to mention if companies use server-side verification to check keys and do this anyway.

Its a funny life I might add, there are things that move me. Inspirational speeches, intelligent people, etc. Of all things, I really did not expect to be moved by a mere hex value that is 0x1. :eek:
[Galaxy Note 3 General] msasm09:
i think it's possible

dear all

if we dumb all partition by two devices

one is towelroot with knox flag 0x0

other with any root tool but with knox void flag 0x1

and compare two binaries by hexeditor tool could this guide us more on knox void behavior and maybe the key to access the container or even way to mask that flag or readdress it
[Galaxy Note 3 General] tomxass:
No one try it?

Send from Siemens S6classic using Tapatalk Pro
[Galaxy Note 3 General] SnuggP:
Best idea I've seen on this thread since I got my S5
[Galaxy Note 3 General] Sudo77:
I have a question, what are you trying to accomplish by analyzing the dumps from a tripped and un-tripped device? The location of the flag? I think that this could work here. If you can go through encrypted info that is. I'm sure that I've read devs have done this before (although not with towelroot). People have also analyzed differences in partitions of 4.2.2 roms vs 4.3.

S4 dump:

http://xdaforums.com/showthread.php?t=2568958

sboot file changes behavior:

http://xdaforums.com/showthread.php?t=2447832&page=164

http://xdaforums.com/showthread.php?t=2447832&page=167 > Rejection of older BL downgrade attempt

I think that while you can find useful information about knox by doing this, like Knox flag location/ tripping prevention methods, however the procedure (aka rooting) is not the same as resetting Knox on devices that already holds 0x1. If you modify but a little portion of BL (not limited to hex editing) or kernel software, signatures will mismatch. You also need permissions to modify.

In other words, towel root has shown the ability to prevent the tripping of Knox, but not undoing the damage by resetting it.

Kindly remember that this post is about Knox reset or removal if worst comes to worst. Not maintaining 0x0 by rooting.

Edit: I seem to have brought confusion to people about the Knox container. All it is, is an app (part of the Knox app that I removed a long time ago when I downgraded to 4.1.2). All I'm saying is, I think it is tied with with hardware verification that is the Knox flag in BL, and the flag must be reset if you ever want use the Knox app again. No keys here, I used the word "key" meaning solution. (Knox container != Knox flag)

The only real encrypted key you should worry about here is in the primary bootloader which verifies signed firmware. If someone can bypass or inject the older BL by appending an acceptable key (set to re-write) into here there would not be a flag to begin with. OR reset flag location to 0x0, but it MUST pass (via PC Odin for example).
[Galaxy Note 3 General] Aijazji:
I have rooted device with 0 knox.. :D

Sent from my SM-N900
[Galaxy Note 3 General] Er. Aditya:
how bro ??
[Galaxy Note 3 General] bitstopfen:
Towelroot..., He is funny.

Grüße bit
[Galaxy Note 3 General] JonSCSL:
Towel root does work but soon as you install a custom recovery you will trip knox. There is no current way to install a custom recovery without tripping knox.
[Galaxy Note 3 General] Sudo77:
+1

So you can root... But can you unlock the BL once locked? Can you bring back the freedom that once was and flash custom roms without fear of Knox? Well, can you?!?! :mad:
[Galaxy Note 3 General] JonSCSL:
Currently no.

---------- Post added at 03:29 AM ---------- Previous post was at 03:25 AM ----------

How to Root the AT&T and Verizon Samsung Galaxy S5: http://youtu.be/qm8A6fKrTlU
[Galaxy Note 3 General] Sudo77:
I know, I was addressing the posts above you. However if you find out, please share. The same solution can be used to reset Knox. Seriously people, stop talking about rooting on this thread unless it is part of the solution. I can see now why mods are frustrated.
[Galaxy Note 3 General] fredrikwe:
So do I after having done towelroot earlier, but Device Status is "Custom" and the Software Update says that I have a modified device and refuses any more updates after the latest July one. I am now again unrooted and towelroot does no longer recognize my SM-N9005(int'l):p
[Galaxy Note 3 General] nicholaschum:
I strongly agree that this thread has gone way off topic.

Still wondering how "Towelroot KNOX 0x0" == "Reset KNOX counter to 0x0".....>.>
[Galaxy Note 3 General] phillyd420:
WASHINGTON*-- President Barack Obama signed a bipartisan bill into law Friday that aims to make it easier for consumers to change their cell phone service providers without paying for a new phone.

The bill, known as the*Unlocking Consumer Choice and Wireless Competition Act, reverses a decision made by the Library of Congress two years ago that said it was illegal for consumers to "unlock" their cell phones for use on other networks without their service provider's permission. That means that providers like AT&T or Verizon could legally keep a consumer's phone "locked," in which case the person would face large costs switching carriers or attempting to*link to other carriers overseas*while traveling.

---------- Post added at 08:05 AM ---------- Previous post was at 08:04 AM ----------

Soo in turn does this mean thats it is illegal for samsung to have a device that is unlockable
[Galaxy Note 3 General] effortless:
Not to flash custom ROMs, but to be able to sign on a different carrier's network. You request the carrier that the phone was originally meant to work with unlock it and they will as long as the phone is paid off.
[Galaxy Note 3 General] phillyd420:
Well if you took your phone to a diff carrier wouldnt they have to flash a diff rom to get rid of carrier branding wouldnt that trip knox just asking
[Galaxy Note 3 General] Sudo77:
Yes it will trip, but they will not flash their rom for you lol. They will only unlock it so it works with other carriers while still having the ATT branding. I had a chance to get hold of and ATT S4 for a while. Nasty pieces of work ATT and Verizon phones are, they not only have Knox flag, but also Kernel lock flag. This means that the phone can only accept their and ONLY their version of the kernel. You can't switch countries when flashing roms. It's like they are leasing you their phones on heavy terms, and its far from being "your phone". I was glad I got rid of it.
[Galaxy Note 3 General] st3chn0:
Wouldn't flashing any stock firmware branded or unbranded not trip knox as it signed by Samsung?
[Galaxy Note 3 General] Sudo77:
Well...no. Stock rom prior to 4.3 is now considered "custom" because it doesn't have Knox security components and deemed unsafe. Even if you get past safely rooting and flash old stock rom on locked BL, on your next boot it may not be able to verify the integrity of the rom and trip the flag. I think is how the process goes.

Similarly if you even try to flash non-ATT firmware (this includes all other stock roms) on ATT phone, it cannot verify the integrity of the kernel and will simply fail. Doesn't actually trip the flag though. Samsung is not in control here, ATT is because they are the ones who do the signing. Is that what were you saying?
[Galaxy Note 3 General] SnuggP:
I'll be sure to never get a phone from either of those companies

---------- Post added at 01:42 AM ---------- Previous post was at 01:40 AM ----------

Your info is big help to us all thank you!
[Galaxy Note 3 General] Aijazji:
Here Is my steps..

Upgarde to NG1 indian..

Flash leaked bootloader

Then i have flash NA6 firmware which was old indian firmware counter become zero..

Wipe in recovery then again flash NG1 via odin..

Flash Twrp then change recovery to halaszk.

Now i have rooted device with knox 0

If you need pic i will show you

Its exynoss device towel didnt work on exynoss
[Galaxy Note 3 General] SnuggP:
Yeah and Congress is gonna undo this as soon as he is out of office
[Galaxy Note 3 General] Aijazji:
Here is some screen shot..

Sent from my SM-N900
[Galaxy Note 3 General] borito215:
Hi,

I don't quite understand your method to reset the knox counter. Can you explain it abit further please? Also, does it have to be that particular indian rom or could one use any?

I recently came across https://www.youtube.com/watch?v=9Vmvuixd3LY

Does this actually work? I know someone on the XDA forum will definitely know. If so, could something similar to this be done for the Samsung s4 i9505?
[Galaxy Note 3 General] prakalejas:
It's Note3 and exynos cpu. Kids... Flooding... :eek:
[Galaxy Note 3 General] rbeavers:
He signed the bill Congress passed. Unlike his other dictates.
[Galaxy Note 3 General] SnuggP:
Wow finally success at 1 thing a billion to go
[Galaxy Note 3 General] rbeavers:
Yea. I am not holding my breath....
[Galaxy Note 3 General] msasm09:
i think that's Why Knox always Tripped after second Boot
[Galaxy Note 3 General] SnuggP:
[emoji196] what is this triangle root for?
[Galaxy Note 3 General] Sudo77:
[MENTION=4521884]msasm09[/MENTION] I'm curious, your binary is official, your system is official (granted I don't see Samsung Official). Why is your device status still displaying Modified? Are you currently:

a.) rooted (any form)?

b.) on custom rom?

c.) tripped Knox before?

From Knox specification sheet it says:

- Trusted Boot to verify system integrity at boot time before data decryption occurs. (I think that is what you are seeing)

- Real-time kernel protection in addition to periodic kernel monitoring (So it will detect intrusions in kernel data at anytime the system is active)
[Galaxy Note 3 General] borito215:
I had this happen. I used wanam xposed to change it back to Official
[Galaxy Note 3 General] SnuggP:
How does this Wanamaker work my good sir, and does it work with the s5
[Galaxy Note 3 General] jvtrigo:
Wanamaker xposed AFAIK just fakes the status doesn't really make it official.
[Galaxy Note 3 General] SnuggP:
Sweet is... ahem Wanam for the s5
[Galaxy Note 3 General] Sudo77:
What?? Are you trying to mask official status with software despite it being modified in the first place?? My dear friends, there is one word to describe what you are doing... BLASPHEMY! You all deserved to be spanked by the mega-giant that is Samsung! :mad:
[Galaxy Note 3 General] st3chn0:
You can go prison for pirating a movie but it still happens
[Galaxy Note 3 General] nicholaschum:
Only dumbas*es think Samsung is that dumb and doesn't flash Stock before letting them fix their device.

Sent from my OnePlus One
[Galaxy Note 3 General] Sudo77:
So, by bringing that example out of the blue can I jump to the conclusion that you pi... no I won't LOL. I'm not saying always a bad thing to do, if its your device. But if you intend to sell it to someone, evidence remains for them to know that they have a tampered device. As you recall, Samsung's main goal (apart from preventing root access) is to preserve the evidence. You can see how well they can do it in the above example.

I don't see much reason in hiding information anyway. If we were to reset Knox properly, ALL the functionality should return. The only way you can do this now is by flashing leaked firmware.

[MENTION=2192410]Aijazji[/MENTION] can you use the Knox container after you reset the warranty bit? Screens would help.
[Galaxy Note 3 General] st3chn0:
Point is rules are made to be broken... you must have done some illegal activity in your past everyone has.
[Galaxy Note 3 General] Sudo77:
Don't you look at me... >.> I do strive to be an honest law-abiding citizen at times. What the law doesn't permit, I shouldn't do. Look at it this way, if law was created to be broken, there would be no point in creating them in the first place, as there would be no order. Like in SE-Linux permissive mode only logs details, and really is useless. Enforcing mode unlike permissive mode it will actually halt all unauthorized actions. Governments have the power to enforce any laws if they feel the need, and I'm quite paranoid about it.

But nuff bout laws... What is this? XDA Harvard? LOL. Try to focus on Knox. Btw, I haven't seen any users making new pledges anymore, and looks like OP has gone away for ages.
[Galaxy Note 3 General] lilstevie:
First off sorry for digging back so far, haven't been around much over the past month and just startred reading back through and this caught my eye :)

Yes, eFuses do exist (ignoring qfuse as that is just the marketting name used by qcom). We have seen eFuses in consumer devices for the better part of the past decade.

Knox is designed by samsung to use all resources possible, most notably secure cpu extensions known as trustzone, this is how it can have a supervisory role without us being able to just kill a process.

Of course you will not find them in samsungs repair manuals, much like you won't find operation of most of the normal operating software, only diagnostics software.

Incorrect, Samsung have been equiping their SoC's with eFuses since at least the Exynos 3 (formerly Hummingbird). All major CPU manufacturers have an eFuse setup in their system and have for at least the last generation or 2 of devices. TI did (called a FuseFarm) before they called it quits, QC does (qFuse), Atmel in their A5 range do (just labeled eFuse), I'm not sure about rockchip/allwinner/mtk/etc but chances are they will as well.

First of all, I really hate the "I think" term because it is rarely followed by something backed up with evidence, or understanding of how things work :)

"knowing the key" is a highly implausible protection method, that would require customising the bootloader to the device, and having it signed by Samsungs private key every time they go to reverse the fuse trigger. This would be far from a 2 second process as these signing servers are rarely connected to anything resembling an accessible network. Every time you update the bootloader it is just flashed, there is no "key" you need. You ask the old bootloader to flash the new one, it performs an integrity check, and flashes it. If it isn't correctly signed it won't flash simple, but this is far from per device, it is per device family and is the same across the several million N9005's and doesn't change between android versions.
[Galaxy Note 3 General] Sudo77:
Gee... It's funny how you only chose to quote me, from all the rest of the post >.>. What's the matter? Are you trying to discredit me for providing incorrect information? Well, in that case, I accept your point, after all, I'm only human and knowing myself, I do make mistakes. But, I do try my best to provide accurate information from online sources that I read, usually from the manufacturers themselves and from then I try to lead meaningful discussions.

I admit that I was wrong here, originally reading from only Qualcomm spec sheets that they implement qfuses into their processors and since it was found to be a lot more difficult to reset Knox (if at all possible) on these devices. I was until later that I read Knox's technical details I began to realize and suspect that efuses are not bound to only CPU's and I began suspecting Samsung to be using efuses in their emmcs as well. There are areas of the emmc which are OTP.

However, fuses are useless if there is no software addressing it. Let's say you flash an old Pre-Knox bootloader on to emmc with "blown" fuses. There is no section of the BL to address the Knox flag, so there shouldn't be one to begin with. It is much more difficult to remove the flag from Knox-enabled BL because these sections will always be addressed, and even harder yet if the fuses are in the CPU, because removing the CPU is near impossible.

Again, I used the word "key" loosely to mean signature or an string to used to generate one (similar to an md5 hash that must match). In the future, do not try to attack a concept that is not clear to you or discuss with me first. I told people before that this would be impossible, mainly because of its encryption. I also recalled reading a post from Chainfire in this thread that you CANNOT duplicate something that is cryptosigned. So, you can screw this idea. BUT if you have something that is properly signed, how long do you think it takes the BL to accept this? 2 seconds (even less). Never said it was "per device". Why do you think leaked firmware works? If a future release of Android (ex. L) comes to Samsung why do you think it has to work? It all has to go through someone who knows the "key": Samsung.

Finally, I use the word, "think" to express a theory or a thought, NOT a fact. It doesn't mean it is true, it is just my idea of how I think something works. I'm still amazed how people expect to find facts everywhere they go. If you hate an idea, fine, you are entitled to that right. But if you are incapable to accept ANY ideas at all with an open mind, in that case, lets not discuss things. Lets all remain ignorant, not care whats going on, and let the large companies control our devices.
[Galaxy Note 3 General] chsosMAN:
OK I'm not a dev but reading some posts on here some speculation is that there are eFuses in the device that blow when it's rooted or flashed a custom recovery. Well if this is true then there's gotta be something written in some code somewhere that says this eFuse is for knox. Why can't we just rewrite it to change the order of things. This is just a thought and decided to share. Hope we find a solution thanks
[Galaxy Note 3 General] dequadim:
Just a stupid question: yesterday I have rooted my S4 with CF-autoroot to solve the random reboots problems (then I've installed Xposed and the Reboot fix). Now my S4 works flawlessly.

As consequence of the root now the Knox counter now is 0x1 and I'm wondering if I will able to update via Odin any future firmware release (v4.4.4 or Android L, when available).

I've seen is some forums that a firmware downgrade with Odin will fail due to Knox presence. It will be the same for any upgrade?

Thanks for your attention and forgive my poor english.
[Galaxy Note 3 General] neudof:
As long as you have stock recovery and a unmodified stock rom you will be able to install the ota. A better solution is to wait for a stock rooted rom to be posted in a few days after the release.
[Galaxy Note 3 General] dequadim:
I prefer to keep to use a stock rom for now. In the future I will take a decision. I only need to know what will happen upgrading the firmware using the complete over 1 giga pack downloaded from Sammobile.

How can I install OTA if my device now results as "custom"?

Mauro
[Galaxy Note 3 General] mielletseed:
*lol*

Come on people, this thread is about resetting the knox flag, not about upgrading the firmware :)
[Galaxy Note 3 General] dequadim:
Sorry... it's my fault.

Mauro
[Galaxy Note 3 General] lilstevie:
If it were that simple someone would have already done it :)

The bootloader is cryptographically signed
[Galaxy Note 3 General] Entropy512:
Ever heard of code signing?
[Galaxy Note 3 General] BunnyPig:
Theoretically, you can "defeat" code signing. It won't be genuine but it might be enough to fool them. Depends on what they do to look at KNOX. If they have some hardware that checks it we're screwed but if they have a software that tells them if it's broken or not we can actually change the value by breaking code signing.

Only if this is the case.
[Galaxy Note 3 General] AndroideDOC:
I wish ti find a solution *--* but now i have a custom ROM and i'm 14so ...
[Galaxy Note 3 General] Entropy512:
You can't defeat it unless someone screwed up. Samsung has been continually learning lessons the hard way with their efforts with USA devices (Verizon and AT&T) and they're managing not to screw up with newer devices.
[Galaxy Note 3 General] mm_scammer:
till now this is hopeless.....0x0 just a dream for us..
[Galaxy Note 3 General] toastido:
Someone did screw up. Search for trust zone exploit. Guy at black hat cracked it and the note 3 is vulnerable. Uses a trust zone vulnerability in the qualcomm chips to inject arbitrary code to be executed as trusted code. Sammy fixed it in the s5, but according to the doc, the note 3 and some others are still vulnerable.

Unfortunately they did not release the actual exploit, but someone smarter than i should be able to write one up using the document he released.

http://xdaforums.com/showthread.php?p=54677905

Sent from my leanKernel 3.5 powered stock 4.4.2 (NF4) SM-N900T
[Galaxy Note 3 General] resudo:
All they do is reboot into download mode and check if KNOX is tripped lol. There is no way the use hardware to perform this easy task.
[Galaxy Note 3 General] lilstevie:
I think you misunderstand how that hack works.

The bootloader is sigchecked before it is run, at that point you have no regular code execution to be able to trigger the exploit. The failed signature check will then prevent the bootloader from running.
[Galaxy Note 3 General] BunnyPig:
How can you be sure about that? There might be a piece of hardware that checks it without the phone having to boot at all, like a device they insert into the USB port and it checks it. We don't know.

If what you said were true I really do think it would be quite easy to just fake it all. You might fool your retailer but not Samsung by doing this.