yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] ryanbg:
Well, my efforts are mainly concentrated on freeing devices locked down by signature verification, something the majority of you lucky non-Americans generally don't have to deal with. This past week, a lot of us have really learned a lot of different information. So much in fact, I'm still sorting through it in my mind, looking for loose ends. It doesn't take an engineering degree to figure some of this stuff out. Most of what I do is exploratory. I'm just playing around with different stuff, looking for things where they shouldn't be, finding things that do things they shouldn't, etc...

Anyways, as a result of some of my research, I've learned a little bit about Knox, it's relationship with TIMA and Qfuses, etc... TrustZone issues SCM calls (formerly known as SMC??) which can fuse Qfuses, trigger the infamous warranty 'bit', etc... We know this much already, but I'm starting to understand how some of it works in relation to TZ and TIMA. It really is picking puzzle pieces up, and putting them together. While I'm not quite sure exactly how the Knox counter works yet, I do know what I'm currently researching would be able to give us the tools needed. It's a slow slow slow process, as there is many systems working against us.

Currently, I'm also interested in /prov_data/Knox/ in the EFS. Also keep in mind, I'm not an expert, so not to get your hopes up to high. I am relaying this information to the proper channels though, so no worries on that end.

Also regarding the script, I am aware of qfuse shadow registers. This is something that reads the qfuses, and stores the value in a database hidden or encrypted somewhere. These registers can be 'overridden' according to some older Qualcomm documentation, meaning you can change the value of most qfuses (not physically) to my knowledge. It'd be very simple for Samsung to write a small program to change these values.
[Galaxy Note 3 General] caiding10_28:
thank you for share
[Galaxy Note 3 General] ghibli3:
I have Hard-bricked my phone (N9005) too trying downgrade bootloader (and all *.mbn files)!

So no restart at all

Only when i connect to pc there is new com port "qualcomm hs-usb qdloader 9008" and also without battery!!!

I haved download QSPT (Qalcomm Product Support Tools) and the programm see this "qualcomm hs-usb qdloader 9008" but i don't know how to use becouse in the list don't see MSM8974 (processor of N9005) and i don't know what file flash to exit from this partcular bootloader state.

How have you resolved your Hard-brick?
[Galaxy Note 3 General] hey_joe:
Looks to me that he didn't resolved it. Maybe he sent it in for repair/warranty as he's currently waiting for the replacement.
[Galaxy Note 3 General] ghibli3:
Ok, thank you!

It's would be a good think have the file immagine to use with Qpst becouse the procedure is simple and we don't have to send phone to service point for hard brick.
[Galaxy Note 3 General] smartje74:
Absolutely not true, i reverted to stock 4.3 without any problems and Knox is still 0x0.
[Galaxy Note 3 General] hey_joe:
You're the first poster that claim this. Care to share your method for other people to try?
[Galaxy Note 3 General] hussam1988:
10 here
[Galaxy Note 3 General] rgshah3:
You can go from 4.4 to 4.3 since they use the same bootloader! Going to 4.2 is not possible
[Galaxy Note 3 General] hey_joe:
I don't think they share the same bootloader. There's a lot of people in the general section area that flashed the official/leaked poland 4.4.2 and couldn't flash back to 4.3 official or custom.
[Galaxy Note 3 General] EnhancerFIN:
It would be very nice to see a way around this knox ****.

I have a simpler way to do it. I'm going to trip my knox counter intentionally, and do whatever I want with my phone. If I then have a warranty issue, I will hard brick my phone by flashing newer bootloader to it, and then claim that something went wrong in kies update.

They have no way of showing that I'm responsible for tripped knox counter, if they are even able to see the counter from the hard bricked phone.

Problem solved.
[Galaxy Note 3 General] mnasledov:
Interesting. QPST is useful for more than messing with the modem's NVRAM and doing things like enabling AWS?

PS: I notice that ARM TrustZone has features like ....

"KeyStone II devices can disable the JTAG interface completely or provide restricted access to enable or disable secure debugging."

I'm guessing since people are JTAG'ing the phones that they're not implementing this (yet?).
[Galaxy Note 3 General] mnasledov:
I entirely agree. If someone is worried about KNOX counter being an issue with a warranty replacement/repair, I would probably just end up bricking the damn thing and checking my engineer knowledge at the door. "Duh, my phone stopped working. It won't turn on. Please help."

"Rums? Flashing? I don't drink rum. And I certainly don't flash people."
[Galaxy Note 3 General] ryanbg:
Because I accidentally wrote TZ over my SBL1 and RPM partitions, my device is a perma-brick. Especially without RPM. If you can get qdloader, we can most likely revive the device. I am at work until 4pm CST USA, so when I get home I might be able to help.

---------- Post added at 01:29 PM ---------- Previous post was at 01:28 PM ----------

I believe it depends on the fuses that are blown. I know there is a debugging fuse which will disable JTAG, but I'm pretty sure there was a method where you can short a resistor and have temporary JTAG access.
[Galaxy Note 3 General] mobilexpert:
if you haven't, yet, read this ... can be an eye-opening blog post, regarding new Qcomm cpu's with "fantastic, super-duper" e-fuse crap ...

http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html

in short, all this crap with Knox will blow in one second, with a simple TZ exploit,

allowing all possible things to do with S4, Note3 and similar QComm devices.

p.s. imho, no need for tripping at all ... all u need is CM11 ... who cares for Samsung roms, with 2Gb of bloatware ...

b.r.

Alex
[Galaxy Note 3 General] ghibli3:
Thank [MENTION=766721]ryanbg[/MENTION] but this afternoon i send phone to service centre.

Probably i had to waiting more time...this evening i have found this guide i think can be solve... http://www.mediafire.com/download/jkw1vv95ub8596h/13-58_SM-N900_Boot_Recovery_Guide_rev1.0.pdf

Anyway any information about hard brick are good and also about QPST program.

I think that are problems that must be solved without any service centre

if I could have the first 200 megabytes of my phone (saved from my dev/block/mmcblk0) I pheraphs could use the program QPST successfully

Are you able to manage QPST program?
[Galaxy Note 3 General] keendark:
So it actually does void warranty

So Samsung are trying to void my warranty using knox as an excuse (I have a screen issue where the glass front is coming away from the digitizer). My phone had been rooted and had a custom rom on it from day one and was only upgraded to send back for the screen repair (Hence I hadn't even heard of knox until the latest firmware triggered it when I reset my flash counter). I am fairly certain that what they are doing isn't legal, at least in the EU but time will tell. Anyone else having warranty issues because of knox? Bear in mind that knox is meant to be for the consumer to increase security, not for samsung to get out of contractual obligations.
[Galaxy Note 3 General] theunderling:
^^^^^^^

We understand your feelings, but this thread is not about knox warranty, there is a couple of threads about that.

I too am a bit disappointed about knox, since I cant even use it anyway.

But, looking from Samsungs angle, why should they fix things when people break it.They must have went through a warehouse full of motherboards for the s2 with clowns bricking their devices.

People have the option in future, like me, if they dont like their product/conditions; to buy rival product.
[Galaxy Note 3 General] Killberty:
Resolve this hard brick by the sd card boot.

http://xdaforums.com/showthread.php?t=2531224

hit 'thanks' if i helped you

SM-N9005 DBT-DMJ7 0x0

XDA Developers 4 premium app
[Galaxy Note 3 General] hey_joe:
I don't see the connection between rooting/installing custom rom to the physical damage the poster was trying to have them fix.

My apology for going off-topic.
[Galaxy Note 3 General] gencho81:
think all the problem with knox come with SBOOT.BIN.

I was able to open it with hex editor but all i see is some symbols ,than some understandable and again symbols after.

i don't know nothing about programming but can be the answer in this lines :

ANDROID!<bh:00><bh:00><bh:00><bh:00>[TIMA trusted boot]: SEAndroid MAGIC failure (recovery.img)

<bh:00><bh:00><bh:00><bh:00>[TIMA trusted boot]: SEAndroid MAGIC failure (boot.img)

<bh:00><bh:00><bh:00><bh:00>Set invalid sign flag

<bh:00><bh:00>TIMA 2.0<bh:00><bh:00><bh:00><bh:00>mobismc<bh:00>Could not do normal boot. (invalid magic)

<bh:00><bh:00>reset<bh:00><bh:00><bh:00>prb is null!

<bh:00><bh:00><bh:00>%s: id=%d, data=%d

<bh:00>buffer allocation failed! (0x%x/0x%x)

<bh:00><bh:00>NeedChecksum clear

<bh:00>packet data size
[Galaxy Note 3 General] theunderling:
If hes not in the EU, then him flashing stuff gives samsung the right to excercise their warranty rules, which I suppose gives them the option to refuse ANY warranty repairs.

Even in the EU, they can still tell him to get stuffed, and see if hes got the staying power to force legal action.

Oh and put me down for $40.
[Galaxy Note 3 General] hey_joe:
That is not the point. What does the screen coming off the digitizer has anything to do with tinkering with the software? I read an email reply from a Knox support team somewhere on here that said they treat knox issue differently than hardware warranty and to me it just makes sense. If the issue to be repaired is not related to rooting/flashing then they should honor the warranty regardless of the knox bit status. If that is not the case, samsung is being sneaky and hiding under this knox thing to refuse warranty even to the legitimate ones. In that case, I hope they get a class action suit, apple-style.
[Galaxy Note 3 General] theunderling:
Its their product, and its their warranty.Its a "grey" area about software/hardware, and they do what they want, then its up to each countries govt, or courts to sort them out.

Maybe that guy left his phone on a radiator and reheated the tape, or a bodged screen replacement attempt....hows samsung to know.Ive seen people have genuine warranty claims knocked back (thats totally unflashed phones).

Probably the most straightforward way to deal with samsung warranty is to totally brick the phone,then add in other problems, like the screen glue etc when claiming warranty.

And Ive knox tripped, and in the EU also, but if something goes wrong with this phone, and I dont get warranty, I'll just bite the bullet and sell it as faulty on eBay.

That will result in approx £200 loss, but a valuable lesson learnt.And Ive learnt lessons after parting with £8k before:D
[Galaxy Note 3 General] t0r:
Hi guys,

someone asked if it was possible to just display the "KNOX WARRANTY VOID: 0x0" without actually resetting the counter.

If you want to try it do it at your own risk and report the results.

In the .tar.md5 file that comes with each ROM there is a file called "aboot.mbn".

In that file there is the exact string that alerts you about the KNOX WARRANTY:

KNOX WARRANTY VOID: 0x%x where %x stands for the hexadecimal number (in this case 0x0 and 0x1).

You could probably edit that file by replacing the "%x" with "0 " (please note the space after the 0, the replacing string has to be the exact length) and flash the whole ROM again.

Please note: just REPLACE %x, do not ADD or SUBTRACT ANY SINGLE LETTER or the file won't work.

In less words, "%x" becomes "0 "

I'm still trying to find that file in the FS to directly editing it without the need of re-flashing, but you guys might want to give it a try.

Edit: can't find that file. Anyone experienced in the FS can search for that file or any references?

Regards.

t0r
[Galaxy Note 3 General] newxdabie:
firstable i wanna say thank you for sharing this information, it is very nice to know that it is possible. but i have a noob question, after edit that file and re flashing it to phone, should we able to use knox feature? or it is only a value, just for display in order of 0x1?
[Galaxy Note 3 General] t0r:
Nope, that's just a display value, literally a string.

Regarding the chance to get knox to work again I believe we would be in off-topic, but I'm sure that's possible.
[Galaxy Note 3 General] Charlie.seah:
Was indeed a brilliant idea, just to fool the display result to Samsung Service ^^

We need to know how the "Odin download mode" are boot in, then we know where is the file which read the value.

then we could hard code the 0x0 as a string "0x0" on result of checking knox warranty.

Cause its also possible that value "0x0" is not storing anyway, its may be (as may be) a test script which return everytime needed to test the knox warranty status, either via checking any files/scripts been injected or testing folder permissions then return 0x1 or 0x0.

Anyway waiting the good news, hopefully the "reset" will come to fact before our warranty period is over, else no need to play around lol~

Good luck guys and keep on the hard work!
[Galaxy Note 3 General] LordKoga:
what do you think the risk of hard bricking is assuming you CORRECTLY edit aboot?
[Galaxy Note 3 General] lilstevie:
You forget one thing. aboot.mbn is signed.
[Galaxy Note 3 General] LordKoga:
This might be a very stupid question but what happens if you try to flash an unsigned aboot file?
[Galaxy Note 3 General] lilstevie:
One of two outcomes can be expected:

1) I've not confirmed that it is this way for aboot but Odin should refuse to flash it in much the same way that it refuses to flash a kernel for a locked carrier variant.

2) Assuming you get it to flash either through odin or other methods from userland on device, you can expect a brick.
[Galaxy Note 3 General] mnasledov:
I was about to point out the same thing. The hash-sum would be different.

EDIT: In theory you can keep padding the file with whitespace until, at some point, there's a hash collision with the original. However, by then the file would almost certainly be much larger than usable ;) Also depends on how bad their hashing algorithm is.
[Galaxy Note 3 General] BrunoWestone:
Sorry to say, but that won't work… you can change the flag ( not in there, but yes it can be changed) but in the first full boot the SBL3 and SBL2 will fail checksum and write the 0x% back again…
[Galaxy Note 3 General] bungadudu:
A revised article about the knox warranty bit was published by Samsung - https://www.samsungknox.com/en/blog...ox-enabled-devices-and-knox-warranty-void-bit .

They keep marching on the idea that the knox counter is an e-fuse, that once tripped it will not allow reading/using knox containers ever again (dumb!).

About rooting and the warranty seems they are not buying into that "rooting is legal in Europe"

" We do not recommend that you root your device , since it can cause software problems, cause your device to operate improperly (for example, overheat), and as a result void your warranty"
[Galaxy Note 3 General] hey_joe:
They're trying to save some money to pay apple for the patent infringement :D
[Galaxy Note 3 General] m6ceb:
KNOX

I'm new to the whole Android and Rooting thing :D I have only had my phone 3 weeks and started reading about what you can do once your phone is rooted and could not resist! I came from iphone and cannot belive how much you can do when you have a rooted device.

Why will your warrenty be void? If the hardware fails are you not within you legal rights to get your device repaired under warrenty? My laptop had to go in to Sony for repair and I have installed tons of programs and they did not refuse to repair it...

Very unfair if they refuse in my opinion.. :mad:
[Galaxy Note 3 General] MajesticTwelve:
Yes, they can reFuse to repair it because the root can potentially damage the hardware :)
[Galaxy Note 3 General] anpho:
well that's not exactly "fresh" article. it's 1,5 month old.
[Galaxy Note 3 General] bungadudu:
The original article was published then. In the meantime it's been revised, this is at least the 3rd revision which was published 1-2 days ago as a response to different inquires about the knox bit, root and warranties, and after "many discussions regarding the article due to legal reasons."

In the original article they've said ~"from our point of view rooting and custom firmwares are ok" then removed that part and introduced ~"check with your service centers, many will void the warranty if knox tripped"

And now they blatantly say rooting voids the warranty and that the knox bit shows if custom kernels were ever used on the device.

And this probably is their official standpoint as 2 weeks ago they've said " We're currently working with the legal team to draft up Samsung's official policy regarding this matter." - eg warranties in case of rooting.
[Galaxy Note 3 General] gazeddy:
What we need to do is write a custom bootloader that allows us to use a virtual efuse set
[Galaxy Note 3 General] anpho:
Oh ok. thanks for the clarification then :)
[Galaxy Note 3 General] m6ceb:
Thanks very much for the info :)
[Galaxy Note 3 General] jonboyuk:
Yea, it's that easy, hang on I'll just do it now while you wait ;)
[Galaxy Note 3 General] jetbruceli:
Well I thought android is open source, we need to get samsung to let us know their source code on this knox thing!! ???????☺
[Galaxy Note 3 General] mR.fR34ky:
Somebody should sned an msg to GeoHot aka George Hotz. He would take this issue personally :D
[Galaxy Note 3 General] danieljamie:
Is it possible to dump the current bootloader to analyse it?
[Galaxy Note 3 General] mrQQ:
$20 from me! :)
[Galaxy Note 3 General] Poisyx:
We should sign petition againt knox. Who want to open one?
[Galaxy Note 3 General] djnoicatse:
Great idea!!! But I don't think it'll help much.
[Galaxy Note 3 General] Drizzy xS:
It's gonna get to the point where whoever can fix this is just going to be a millionaire Lmao the bounty is picking up that fast, so someone from Samsung will just sell out or something and tell us how to do it Lmao.
[Galaxy Note 3 General] jetbruceli:
It was a joke really. This is just getting out of hand for those who require root and want to use their device to the max
[Galaxy Note 3 General] Sonorus:
You seem to be confused. The idea of making the hardware verify the software is completely accurate. This is done with basic cryptography - there's nothing special to it. You can program a CPU which has a key hard-wired into it, therefore it's impossible to override or ignore. This does not make a "hardware chain of trust" workable.

At the end of the day, communications are key. There is no way for someone to know that someone on the other end of the communication is using trusted hardware.

Take exchange security policies for example. Microsoft could make a CPU that will ONLY run Microsoft Outlook with all the security BS built in. There is no /practical/ way to do anything about the hardware, true. We can't change the software and still run it on that CPU, true. But we /don't need to/, just modify the software and run it on /something else/ which /doesn't/ validate the software. This fact completely undermines the entire point of a "hardware chain of trust". If i can just run software on different hardware, what goes does trusting the original hardware do?

Our conversation is a bit too theoretical. So to bring it back to "this thread";

We know for a fact that the apps bootloader (aboot.bin) can be changed. (with jtag at least). If aboot can be changed, we can shadow the qfuses and defeat knox in a "practical sense". We can't (without replacing the mmc) reverse the damage it did, but we can keep the software blissfully ignorant. At the end of the day, that's all we care about; "can we fool the software into thinking that knox is 0x0". If we can change the apps bootloader, then yes, we can.
[Galaxy Note 3 General] ValenteL:
Hi [MENTION=535343]all[/MENTION]

What You think of this?

My Note 3 N9005 had first the build XXUBMI7, bootloader [N9005XXUBMI7]

I flashed Stock MJ1 over MI7 data, w/ Odin3 v3.09, but reduced, only this:

boot.img

cache.img.ext4

hidden.img.ext4

modem.bin

NON-HLOS.bin

recovery.img

system.img.ext4 ---> ONLY

No KNOX bootloader, no tz.mbn (this is TIMA from Knox)

Works well whithout issues.

My bootloader continue [N9005XXUBMI7]

Made the same MJ3 whit csc OXA from UK over MJ1 data, Rom reduced also:

The bootloader continue [N9005XXUBMI7]

Today flashed MJ3 csc OXX from Grece whit my csc TPH over MJ3 UK data, reduced also.

The bootloader continue [N9005XXUBMI7]

At each install I deleted all KNOX apk like this:

1 - From system/app I delete:

ContainerAgent.apk + odex

ContainerEventsRelayManager.apk + odex

FusedLocation.apk + odex

KLMSAgent.apk + odex

KNOXAgent.apk + odex

KNOXAttestationAgent.apk + odex

KNOXStore.apk + odex

KNOXStub.apk

SPDClient.apk + odex

From system/containers I delete:

All .apk + .zip file and 2 apk inside subfolder framework

What do You think about I continue whit first Bootloader MI7 and all works well for me???

PS: My flag is 0x1 but... never mind...

Thanks
[Galaxy Note 3 General] baste07:
following this
[Galaxy Note 3 General] Meanee:
I will add $20