yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] kiru:
Was the first on the 4.3 bootloader? And the refurbished on 4.4? The older 4.3 bootloader will trip knox but the 4.4 won't.
[Galaxy Note 3 General] Hypercore:
It was refurbished 4.4. B7 Firmware. So does that mean it's insignificant? I just have the benefit of not being able to trip the counter? Can't that be used to devs advantages?
[Galaxy Note 3 General] kiru:
If you really want to trip your knox, try downgrading back to 4.3 with odin. It has been reported by doing this, it will trip.

http://xdaforums.com/showthread.php?t=2690082
[Galaxy Note 3 General] pclov3r:
What will happen to all the money that was donated?

It appears that this cannot be reverted.
[Galaxy Note 3 General] drew071:
Is pledged money. There is no pot with this money in.
[Galaxy Note 3 General] pclov3r:
Ah ok

Having some talks with people you'll never be able to reset it.

What I learned

- An eFUSE comes from the manufacture set to 0

- Once an eFuse is written from 0 to 1 it may not be written as 0 again.

- Blowing an eFuse DOES not cause physical hardware damage. It's just a value that is written.

It seems to me that an eFUSE is like write only once memory. Once it's written to you can't change the value of it again.
[Galaxy Note 3 General] pRo_lama:
Maybe it's no over at all. :)

http://xdaforums.com/showpost.php?p=52152414&postcount=2201
[Galaxy Note 3 General] Olleo:
One short question - anybody tried to ask Samsung on official facebook page why authorised services cancel the warranty if Knox is tripped if Samsung stated that it has nothing to the phone warranty?
[Galaxy Note 3 General] Hypercore:
This looks like very good news...
[Galaxy Note 3 General] pRo_lama:
Ale also Chainfire wrote this on his Twitter:
[Galaxy Note 3 General] frostmore:
what does SSC means?

Samsung service centres?

I tot one knox is tripped,the only way to reset it is replace the MB.
[Galaxy Note 3 General] pRo_lama:
I think so. But he didn't write anything more about it.

His next post on twitter was this:

So I think he's trying to find the way how to reset KNOX.
[Galaxy Note 3 General] bungadudu:
Well, according to him this is the only way.

Now let's hope a friend of a friend who knows somebody who work at a ssc will leak the said bootloaders..
[Galaxy Note 3 General] frostmore:
I think i know what he is saying.

Sometime back,some decrypted closed source files where leaked.and he must have gotten hold of it.when he reverse engineered it,he must have found a way to reset knox but cannot release as an app for it since that would mean distributing close sourced copyrighted software.

any work around would also be based on having information on closed sourced software and if he were to release it,that would mean expensive lawsuits.

Chainfire knows some thing and he is not telling us,not that i think he must but releasing this information would mean be detrimental to the community at large.
[Galaxy Note 3 General] Kickasskev:
Think this will be my last sammy phone, restricting the user of something they have bought out right is crappy :eek:
[Galaxy Note 3 General] X610:
Lots of companies take measures against modifications, Samsung is not a pioneer here. Other companies even had locked bootloaders in their international versions that could not be unlocked [ahhmm 4X] until the company wanted to let you do so, losing warranty of course at the same time. I may dislike the KNOX stuff but it is great that if you want to modify your phone, you can with the void warranty as the only downside.
[Galaxy Note 3 General] TTLayland:
I really like that news. I doubt we wilk get anything from it though.
[Galaxy Note 3 General] WormsCH:
There's another downside. Unable to downgrage. Once on kitkat, unable to go back to jelly bean. And that is worse than knox for me.
[Galaxy Note 3 General] mohamedm:
i called samsung egypt he told me that thy will repair my knox by this way.thy will put a new software and i must change my address mail of samsung then it will be back and works. i will go to them next weak
[Galaxy Note 3 General] bungadudu:
Cool.

Just one thing, please make a minor scratch or make a small sign with a permanent marker on the sim/micro-SD tray (the metal cover) to see if they changed the motherboard or not.
[Galaxy Note 3 General] mohamedm:
ok i will do it but as i remember he said to that he will wipe all the phone and he will put software and only i must chang my samnsung email and he asked me the prize of the software only nothing els.beouse my phone is warrantly free
[Galaxy Note 3 General] somator:
<edited for your own safety>
[Galaxy Note 3 General] My1xT:
exynos version, so nothing new...
[Galaxy Note 3 General] somator:
ah ok then
[Galaxy Note 3 General] xinfinityoO:
There shud be one for snaodragon..maybe chainfire has one...
[Galaxy Note 3 General] pitastrudl:
so flashing this over exynos version via odin will reset counter guaranteed?

Sent from my GT-I9505
[Galaxy Note 3 General] My1xT:
well dunno, but the point is that ExyKNOX was solved already...
[Galaxy Note 3 General] somator:
reseting knox counter was solved already ? can not find anything on the subject, just roots wo tipping knox
[Galaxy Note 3 General] My1xT:
for exynos and READ THE OP before posting...
[Galaxy Note 3 General] somator:
i did, can you link to an actual method description or thread covering it ?
[Galaxy Note 3 General] My1xT:
http://xdaforums.com/showthread.php?p=50181731#post50181731

here is the basics. I havent found details yet...
[Galaxy Note 3 General] Saggiehaim:
Tell me if you find something. .. I have n900 too but didnt managed to find anything regarding to knox resetting. ..
[Galaxy Note 3 General] pRo_lama:
Has anyone tried it?
[Galaxy Note 3 General] Chainfire:
People keep asking me to visit this thread - yes, I have had similar files for a while now. No, I haven't tested them - they don't match the exact models I have. No, you can't have them, as I've been asked not to share them and use them for research only.

(unlike some others who have further leaked this, I respect the wishes of the original leaker to not spread it further)
[Galaxy Note 3 General] somator:
so i guess this one is made for ha3gzs, ill better delete so no one will break his/hers device.
[Galaxy Note 3 General] mustang393:
it worked for the exynos version
[Galaxy Note 3 General] Saggiehaim:
What and how?????
[Galaxy Note 3 General] nfribeiro:
So this KNOX thing defeated us. Nobody can help us...

Even those that may have the answer are committed not to talk (which I respect, it is not a criticism).

It is a very sad moment for this comunity.
[Galaxy Note 3 General] somator:
would you look at that ;-P so it works when used on proper device board model - glad to hear
[Galaxy Note 3 General] drew071:
I think this whole scenario is a catch 22. If knox was overcome, wouldn't Samsung just be pushed into further developing its security against being hacked and so on until they finally won.
[Galaxy Note 3 General] somator:
reupload

Samsung's Odin Bootloader tar file used in Service Centers for reseting Knox counter to 0x0.

Only (?) for HA3GZS version.

Use on your own risk, if you do not know what it is, do not touch the file.

Enjoy.

for the dl link look at sxtp thread, i do not want Samsung hitting on me :)
[Galaxy Note 3 General] somator:
oh ive found the possible source of this file: http://sxtpdevelopers.com/samsung-note-3-knox-fix-qualcomm/
[Galaxy Note 3 General] dawgboy1783:
Holy smokes can this be taken apart to explore the files in it to get a better idea of how it works?, maybe it can be ported to work with all the other variations of the device, unless it already does?.
[Galaxy Note 3 General] somator:
chain already stated that he has such files for various versions that he can not share so i guess he looked inside. and who wlse than him to reverse it
[Galaxy Note 3 General] WormsCH:
I hope he will.

I've a question [MENTION=631273]Chainfire[/MENTION] : Flashing these custom bootloaders who allow to reset knox may allow to flash older bootloaders for instance to downgrade to Jelly bean ?
[Galaxy Note 3 General] dawgboy1783:
Maybe [MENTION=631273]Chainfire[/MENTION] can make a universal tool of his own knowing how knox is reset.
[Galaxy Note 3 General] :
Yeah Exynos version :p

But thank god its released. Id wish to be able to try it. But I ain't sure if I'm allowed to

nop
[Galaxy Note 3 General] My1xT:
what do you mean with "allowed to"???
[Galaxy Note 3 General] :
I personally don't own a note 3. My brother does.

And come to think about it he's most likely is using the snapdragon version so it's for no avail.

But I be keeping this files. If sxpt removes the link

nop
[Galaxy Note 3 General] My1xT:
well since you dont live in the US it should be easy look up:

SM-N900 -> Exynos

SM-N9005 -> Quallcomm
[Galaxy Note 3 General] nitrate:
We definitely need a release for Snapdragon N9005 devices as well. It's a shame that it isn't released yet but for Exynos it's a beginning...

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] Chainfire:
You can take apart the param.bin file if you want - it's just a tar file. Contains some images (one of them curiously mentions Verizon) and an emmc firmware binary.

I am not aware of any other param.bin files available for the Note3 - though I must admit I had checked for Qualcomm models initially, not Exynos - so that file may be universal. I thought maybe the emmc firmware file may play some part in resetting the KNOX bits, as maybe it is stored on emmc. Flashing it to my own Note3 didn't do anything though, and I have not found the location of this file in stock firmwares to replace it in there, so far.

The bootloader itself could well make all the difference and do all the work. You'd have to disasm it to be sure. The thing is, unless we run down the entire system, figure out how the bootloader does it, and be able to replicate that from booted Android (or maybe ODIN flashable) this is completely useless.

We can't take a stock bootloader and modify it so it does the same as this one (assuming it even does anything), as the bootloaders are cryptosigned, and we cannot replicate the signatures. As such, even if we managed to get the modified bootloader on the device (which we won't), then it still wouldn't boot.

In other words, this is all well and good, but I don't see it getting us anywhere for devices X, Y and Z, unless the counterparts for those devices get leaked as well.

Again assuming we don't decode the bootloaders, find out what trick it is pulling, and manage to replicate it in some other way - which isn't very likely, as decoding bootloaders is tedious work, you're easy to miss the actual trick, and even if we do figure it out, chances are that the stock bootloader protects the area (they're already hidden now) that we need to write, so there will still be no way to do it from booted Android.

Unless we then also hack that, and and if the data is stored in a secret part of emmc then maybe that is possible, as there are some theoretical hacks to reset bootloader-set write protections - but then that would still only work if trustzone hasn't properly shielded that area of the phone anyway, regardless of emmc write protection.

Are you still with me? Maybe you understand what I'm saying - probably not. Those that do, probably have some minor technical statements to correct in the above, but it doesn't really matter. What it comes down to is that it's not bloody likely I'll be spending my time on this because it's a high effort but low chance of success endeavor, but if you have the time and the expertise, go right ahead and give it a shot. It's not impossible - just improbable (with the current knowledge of the situation)
[Galaxy Note 3 General] Saggiehaim:
How to use it? Is it safe??
[Galaxy Note 3 General] david515:
Rule of thumb don't flash files until there tested out. Wait until Devs have tested those files.
[Galaxy Note 3 General] Olleo:
[MENTION=631273]Chainfire[/MENTION]

any other way, than rooting the phone, to get access to things/files/functions/APIs that are not accessible for the common android user? I mean things like backup&restore of phone, replacing files (needed for call recording, silent photos etc.), changing settings of GPS etc.?

E.g. something like poweruser or temporary root...
[Galaxy Note 3 General] nfribeiro:
Yes, get a new phone that isn't a Samsung!!!
[Galaxy Note 3 General] bungadudu:
You do know that every other big OEM (inc Apple, Sony, HTC, LG) behaves the same, right? [emoji28]
[Galaxy Note 3 General] ryanbg:
Warranty bit and rollback protection (major and minor version) are stored on RPMB in Exynos. Minor version is apparently stored on Qualcomm models, but the warranty bit on the MCU apparently. From what I can tell, it appears that it's wiping and reprogramming the RPMB. The RPMB also has an authentication key inside of it for HMAC -> AP/MCU. I've been doing some research and it may be possible to get R/W to RPMB via ext_csd register 179. It's treated as a seperate physical device/hardware partition. I'm extremely curious if there is a key inside of that file. I'll do some analysis later. Feel free to PM me, I've been working on this with some others knowledgeable in this field. It's possible to do all this with direct ISP to eMMC chip via JTAG, but I want to find a way without it. I'm still extremely confused how they are doing this, but if I can find their OEM JEDEC commands somewhere in there, we may be in luck.

Also, unless Perm WP is enabled, it's possible to disable Boot/User Area WP within Android. I need root though, and maybe a custom kernel module for some more advanced operations.
[Galaxy Note 3 General] Chainfire:
Interesting stuff - but indeed JTAG based is not as interesting, though a cool feat if pulled off.

Right, I had thought up something for that as well, but I haven't tried to implement it so far ...
[Galaxy Note 3 General] noah93:
may help??

hey guys i know its probably been said, but i can confirm it is something flashed to phone that fixes knox counter. i recently found out i know someone working at a samsung repair centre. i told them i had tripped my knox counter and in the next couple weeks im going to take it to them and its going to get fixed, this is where i should tell you i have a GS4 with snapdragon. (sorry i know its a note post but thought it was relevant) is there anything i could do pre and post fix that would be useful to the cause?
[Galaxy Note 3 General] ryanbg:
[MENTION=631273]Chainfire[/MENTION] I had a chance to run through it quick, the sboot.bin even though not for Qualcomm devices holds some very valuable information. Specifically, I believe it contains some ODIN commands/protocol/RDX?. I've been looking for something like this for quite awhile... I'll grab a serial console when I'm home from work. If you've ever plugged into a Linux box, you can actually see Odin receieve the AT commands like AT+CLAC but obviously it doesn't recognize them. Definitely something to look into. The SBL/ABOOT/SECLOG has lots of good information. Heimdall source and logs is all I've had to go off of so this is definitely appreciated.

Also, TrustZone xPUs are my biggest obstacle atm on Qualcomm devices. However, us N3 VZW guys just got a build with loadable kernel modules for the first time, so we're about to do work. I believe I've found the shadow register too, but I can't really confirm it with TrustZone kicking me out :p I've got lots of ideas though.
[Galaxy Note 3 General] cheffy11:
Why would you want to go backwards???
[Galaxy Note 3 General] nfribeiro:
Are you sure about LG? And Apple? :laugh:
[Galaxy Note 3 General] nitrate:
I think that some of the guys of Fail0verflow should look into the bootloader / KNOX thing. If they can hack consoles (their security systems) like they did with the Wii, PS3 and Wii U, why shouldn't they try this with a smartphone...?

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] Chainfire:
The more the merrier.
[Galaxy Note 3 General] WormsCH:
- Poor battery life with kitkat (worst than JB) (N9005)

- Be able to root without tripping knox (if knox is really on efuse (N9005))

- Be free to play with custom JB & KK ROMS/Kernel

- For apps who are not woking properly on KK
[Galaxy Note 3 General] note2nooby:
If a downgrade to a Knoxless bl would be ever possible that will be the greatest thing that could happen to any of us.i know note 3 was knoxed all the way from the beginning but the first one was permissive at least.
[Galaxy Note 3 General] v00d007:
Thanks for your statement but what I indeed don't get in my brain, is that all changes Samsung did to the devices was all just SOFTWARE. They didn't change the hardware when bringing knox to older devices with just an OTA update - how could they, it's impossible. So why shouldn't it be possible to get all back to where it startet, a full reset - some kind of..?? Maybe we all just need another tool than Odin that cracks the knox architecture, uses some exploit and then injects the old knox-free platform.

Am I really so wrong??
[Galaxy Note 3 General] sawgent:
here is the results

before

http://i.imgur.com/8xrkSsw.jpg

after

http://i.imgur.com/8dCSe8a.jpg

bootloader locked. any other old or new bootloader loading but nothing changed. status still custom.
[Galaxy Note 3 General] bungadudu:
Read here - http://xdaforums.com/showthread.php?p=52329946

Leaked bl + stock rom and stock recovery = knox 0, all official.
[Galaxy Note 3 General] kaos_king:
I read that as if your screen fails and you've rooted, then you won't be covered, as rooting voids your warranty.
[Galaxy Note 3 General] ValenteL:
If the root is made whit SuperSU from Chainfire the appl have a UNROOT option. It work, I tried already. No more root.
[Galaxy Note 3 General] ultwill:
If you root with the De La Vega, then you won't void your warranty. Any other method, OR flashing any custom recovery, will void you warranty, regardless if you have a screen issue, or something completely unrelated to the rooting. At this point, they also charge you for even looking at the phone if you decline to have your board replaced.
[Galaxy Note 3 General] kaos_king:
Will they not say that tripping the knox is due to rooting? I hope not, just asking :)

I have insurance through my bank so I'm hoping they don't check if I do have any issues
[Galaxy Note 3 General] galnet:
Well considering that "Official Firmware is tripping the 0x1 behaviour, I don't think they have a leg to stand on!

Edit: What I mean here , if you try flashing Stock 4.2.2 with Bootloader after flashing 4.3, it will trip to 0x1. Truthfully I don't think an eFuse is used, my two cents is that Samsung have done what Apple have done for years, and that's any Bootloader that is not Signed after a certain date, fails to flash. I'd be more apt to think about Unix Time Stamps within the Bootloader.. But again this is speculation and isn't verified just like the eFuse..!

Speculation is the killer, Samsung need to tell us if it is indeed an eFuse, and come clean about why they have done this to consumers (Non Business Users) without warning!
[Galaxy Note 3 General] kaos_king:
If that's true that's great for us!

I haven't seen anything about it but I've not been reading up too much recently.
[Galaxy Note 3 General] ValenteL:
I agree whit "Samsung have done what Apple have done for years". If Samsung want sale millions on US must make like Apple:

Secure Android Platform

Samsung KNOX offers a multi-faceted security solution rooted in the tamper-resistant device hardware, through the Linux kernel and Android operating system. The first line of defense against malicious attacks, Samsung KNOX is currently approved to run on US Department of Defense networks.
[Galaxy Note 3 General] nitrate:
Looks similar to the boot process Sony used for the PS3. PS3 used metldr which loaded lv0ldr which loaded lv1dr which loaded lv2ldr... o_O

The end of the story was that an exploit was found in metldr which "removed" Hypervisor restrictions. But that's just another story...

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] neoKushan:
It's not that it uses the same bootloader as the PS3, it's that a secure chain of trust has to be implemented (correctly) in a specific way. The Wii and the 360 use a similar design, it's basically an industry practice. As I stated several posts earlier, it always starts off with a piece of hardware that cannot be tampered with.

This diagram is crucial to understanding why this Knox thing is trickier than it looks. There are at least 3 separate bootloaders (One of which is embedded into the CPU, Christ knows where the other two are) before we even get near Android. You can bet your sweet arse that one of these is flipping the Knox flag. Even if it's not an efuse, accessing these loaders and modifying them in such a way that doesn't cause the system to just not boot isn't going to be easy at all. That flag could well be stored in the embedded secure element or other hardware storage of the chipset - again this is going to be extremely difficult to access.

HOWEVER, that being said, I've noticed this on Samsung's site:

Now, if we can switch the root of trust to a different one....
[Galaxy Note 3 General] valix2fr:
An idea.

Hello.

Could you imagine possible to hide the indicator knox 0×1,In download mode.

For the service after the sale not see.
[Galaxy Note 3 General] Sin07:
if you could find a way to hide it, i'm sure you could then add text saying knox 0x0
[Galaxy Note 3 General] valix2fr:
Reply

To replace 0 × 1 on 0×0 must be reset eFuse, if that is impossible.

But the flag 0 × 1 is the software so it can be programmed to hide.

Such as Xposed, which changed the custom status on official statue

In our case, Should the 0 × 1 is hidden and replaced by 0 × 0.

(Without using eFuse)

(Nb:I hope you understand me because I do not have a high level in English.)
[Galaxy Note 3 General] Skander1998:
That would be pointless since all service centers reflash stock firmware when trying to diagnose any problem.

The flag will re-appear.
[Galaxy Note 3 General] wEs.C:
from my perspective, I dont care the 0x1 flag, I just want my Knox back to work ... sigh...
[Galaxy Note 3 General] mscion:
Wow! Bounty is over $1000. Pretty impressive!
[Galaxy Note 3 General] nitrate:
I think someone would have to crack the KNOX app in order to skip the flag check.

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] Action B:
Can you elaborate on this?
[Galaxy Note 3 General] sturmavik:
Yeah, like these people are actually going to pay up when we find a way around. Personally I don't understand what all the fuss is about - warantees are for the weak.
[Galaxy Note 3 General] JCM800:
Exactly. - who's gonna pay up? One or two perhaps

If and when anyone cracks it, do it for love, realistically doubt you'll get paid sadly.
[Galaxy Note 3 General] SpenZerX:
Why not simply hide that flag in case of warranty? By adding an other defect ...
[Galaxy Note 3 General] sawgent:
status no problem for me. my note 3 is N9000Q and this leaked bl change it n900. i am flashing Turkey lastest bootloader but startup logo still n900.
[Galaxy Note 3 General] nitrate:
We need this for N9005 Snapdragon models as well. It's a shame that it didn't come alongside with the Exynos leak.

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] sawgent:
yeah totally return original :D

instruction;

- flash leaked knox resetting bootloader

- flash official stock firmware

- wipe data/factory and cache with stock recovery

- it's OK

if no succes, flash again stock firmware and wipe
[Galaxy Note 3 General] Slicktune:
2 questions

so is it official that knox is not a hardware thing... It's more of a software? (to reset)

And is there any knox reset yet for the galaxy s5?

Thanks in advance!
[Galaxy Note 3 General] sawgent:
i dont know details but n9000 series return back official totally.

s5 no
[Galaxy Note 3 General] xinfinityoO:
no bootloaders for n9005 models :(
[Galaxy Note 3 General] Alessiomagliozzi:
Hi Sawgent, i can use this bootloader reset knox to my note 2? Thanks!
[Galaxy Note 3 General] sawgent:
nope. only works with n900 note3 models.
[Galaxy Note 3 General] dawgboy1783:
So this works on SM-N900T ?
[Galaxy Note 3 General] sawgent:
nope. it's qualcomm based phone. this only for exynos based phones.