yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] ValenteL:
Today Flashed the Rom from my Country, complete, no more reduced like before:

Model: SM-N9005

Country: Portugal (TPH)

Version: Android 4.3

Product Code: TPH

PDA: N9005XXUBMJ3

CSC: N9005OXXBMJ3

MODEM: N9005XXUBMJ2

My bootloader now is [ro.bootloader]: [N9005XXUBMJ3]

Whit Odin3 v3.09, no issues, work well.
[Galaxy Note 3 General] zbz999:
add me too

Add 20 US from me too.

would like to stick it to samsung face.:rolleyes:
[Galaxy Note 3 General] Action B:
I'll offer $10 even though its probably not possible.

This question might be kinda dumb but.....

1. If my phone dies and won't turn on, can they still tell if I'm rooted?

If not, we should just come up with a way to destroy our phones in a way they can't tell we did it if there is some problem that needed repair but the device could still power on.
[Galaxy Note 3 General] jetbruceli:
rooting is possible without tripping knox. Knox flag tripping seems to be something built into the hardware.

I think we will need to find out where the trigger sits.
[Galaxy Note 3 General] Action B:
I have no intention of rooting without a custom ROM and recovery.
[Galaxy Note 3 General] spad:
We need to find out how to circumvent Knox flag after it was set. To be able to go to full functionality of knox program and warranty issues.

I'm one of people used cf-root, but only because at that time there was no explanation what knox means and also there was no other option. So my flag is tripped now because of lack of patience on my side :) if I would have known then what knox means I would never have rooted.
[Galaxy Note 3 General] baste07:
How many phones have you rooted before?
[Galaxy Note 3 General] Action B:
I have rooted around 20 if you are including friends
[Galaxy Note 3 General] yulet:
I'm rooted with 0x0 counter but I'll give $10.

Sent from my SM-N900W8
[Galaxy Note 3 General] KenTcN:
mark

来自 SM-N9005 上的 Tapatalk
[Galaxy Note 3 General] jetbruceli:
Experia x8, Milestone 2, g2x, galaxy s2, gs3, gs3 lte, gs4, galaxy ace, galaxy tab 2, galaxy note 10.1, galaxy note 1 att, gn1, gn2, nexus 4, nexus 7, one x, galaxy nexus.

Probably more that I can't think of at the moment
[Galaxy Note 3 General] Virusbetax:
I donate $30 USD to this project. I hope you guys figure out something new. My Note 3 is like a Dog on a leash ready to break out the to the rooting world.
[Galaxy Note 3 General] djnoicatse:
Not sure what firmware you're on....but there's a way to root without tripping Knox. I believe MJ1 is the last working firmware for root. MJ3 will trip knox to 0x1<<<someone correct me if I'm wrong.
[Galaxy Note 3 General] ytwytw:
I would like to drop $20 for my Note 3 to 0x0
[Galaxy Note 3 General] nitrate:
Somebody thinks as well that the guys at #f0f may should have a look into this? I know they usually are addicted to game consoles but maybe fewer members of #f0f like marcan, sven or even bushing are interested. I don't know. A question to them should be worth it since they really got lots of hardware experience. So maybe we can gain more information what's going on with the bootloader / Knox thing and their relations.

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] piit79:
Good idea! Put me down for $40.
[Galaxy Note 3 General] jetbruceli:
At this bounty now they can buy a note 3!!
[Galaxy Note 3 General] benito.brazil:
And this really works? I think its possible to see knox warranty void after format emmc on cwm..

Enviado de meu SM-N9005 usando Tapatalk
[Galaxy Note 3 General] kosmasgr:
Νο its not work. Hardbrick your phone by doing this.

Sent from my SM-N9005
[Galaxy Note 3 General] mahmoud007:
Remember you do not have an access to the full emmc even with cwm .. which means you only will be allowed to do whatever on your avalable memory without touching the hidden side .

There gotta be a way to reach that hidden part by software .. either create new switch replacment for the one samsung removed due new upgrade

Witch allow user to control emmc "format" ... or , you know .. jtag 'dislike'
[Galaxy Note 3 General] deeppalei:
there is no way to reset the knox counter ??????

:crying: think there is no solution for knox counter reset .was anyone found or research is still continue.
[Galaxy Note 3 General] newxdabie:
this moment no yet...but i sure will found a solution!
[Galaxy Note 3 General] mielletseed:
But also devices with a SnapDragon-SoC like my S4 mini duos got knox ...

So knox seems to be independent of exynos ...
[Galaxy Note 3 General] Omar04:
I have lost all my hopes on this. I'm even offering to exchange my Note 3 two covers and Original packaging for a LG G2, Nexus 5 or Moto X yeap even without box or chargers to some friends.
[Galaxy Note 3 General] mahmoud007:
i sold my device without much loss yesterday and like i said that was my last Samsung and will never get back to it

if they still counting on the same method by the memory and device
[Galaxy Note 3 General] kakyyabata:
Guys i found file Called

COMBINATION_FAJP_N9005XXUCMJ2_N9005OXACMJ2_1880424_REV00_user_mid_noship_MULTI_CERT.tar

and its on site for repairing Samsung N9005 and the size is 749 mg

i tried to flash it but it wont work and in website sort under folder called knox any one have any idea about that
[Galaxy Note 3 General] eccomania:
http://www.dlgsm.com/index.php?dir=...4_Files)/Model_N/N900_(SM-N900)_GALAXY_NOTE_3

i found this website with same kind of files but I can't download any file because it requires membership, if you have membership can you post the service manuals of N900 note 3 ?

thanks in advance.
[Galaxy Note 3 General] kakyyabata:
i extract the file and i got this
[Galaxy Note 3 General] JAMIE1000UK:
Looks like a European rom. .
[Galaxy Note 3 General] kakyyabata:
here

https://www.dropbox.com/s/xk62kghd5sm3qg8/N900_Service_Manual.rar
[Galaxy Note 3 General] xp500:
im looking at lg g2, only thing is that no sd card... kind of hurts but might end up with lg anyway.
[Galaxy Note 3 General] Pierre118:
Thanks. Is it possible you can post the N9005 service manual files?
[Galaxy Note 3 General] JAMIE1000UK:
Would really appreciate the dissasembly/resemble manual for n9005 if you could do that ;)
[Galaxy Note 3 General] eccomania:
thank you very much my friend.
[Galaxy Note 3 General] Shreqg2:
On the photo you can see CSB(...)OPEN. Can that file disable quallcomm secureboot maybe?

Wysłane z mojego SM-N9005 przy użyciu Tapatalka
[Galaxy Note 3 General] kakyyabata:
here ur file
[Galaxy Note 3 General] kakyyabata:
I'm upload all files without extract
[Galaxy Note 3 General] JAMIE1000UK:
Thanks very much
[Galaxy Note 3 General] eccomania:
wow ! really you are hero my friend :D can you please upload knox folder of n900 too ?
[Galaxy Note 3 General] kakyyabata:
sure my friend i will download it now for u
[Galaxy Note 3 General] eccomania:
thank you very much :good: I hope we can reset know with your files :good::good::good::fingers-crossed::fingers-crossed::fingers-crossed:
[Galaxy Note 3 General] kakyyabata:
i flashed last kitkat with this file and i repartition my device all state is official but knox still 0x1
[Galaxy Note 3 General] Shreqg2:
And bootloader still write-protected? CSB turned on?

Wysłane z mojego SM-N9005 przy użyciu Tapatalka
[Galaxy Note 3 General] kakyyabata:
yes CSB enabled
[Galaxy Note 3 General] Shreqg2:
:( no good...

Wysłane z mojego SM-N9005 przy użyciu Tapatalka

---------- Post added at 02:46 PM ---------- Previous post was at 02:37 PM ----------

Is that mysterious box, that somebody wrote about, the Samsung Anyway Jig Box? We can see that it's used to flash S/W in the "Product specification.pdf" file...

Wysłane z mojego SM-N9005 przy użyciu Tapatalka
[Galaxy Note 3 General] kakyyabata:
here is the link of the files

https://www.dropbox.com/s/9wihqqnad...0424_REV00_user_mid_noship_MULTI_CERT.tar.md5

we need some one to discover it
[Galaxy Note 3 General] Shreqg2:
Could you also upload full documentation for SM-N9005 model please? :)

Wysłane z mojego SM-N9005 przy użyciu Tapatalka
[Galaxy Note 3 General] kakyyabata:
https://www.dropbox.com/s/kym11hotkahk2yk/N9005_Service_Manual.rar
[Galaxy Note 3 General] Shreqg2:
Thank you very much ;)

Wysłane z mojego SM-N9005 przy użyciu Tapatalka
[Galaxy Note 3 General] kakyyabata:
you welcome my friend :good::laugh:
[Galaxy Note 3 General] Shreqg2:
Unfortunately the part called "level 1 repair" is missing in that SM-N9005 related files. :(

Wysłane z mojego SM-N9005 przy użyciu Tapatalka
[Galaxy Note 3 General] kakyyabata:
yes its not there but i found this may help you

http://www.youtube.com/watch?v=pgljKYBxBbY
[Galaxy Note 3 General] kakyyabata:
This file for N900

https://www.dropbox.com/s/urww7sljm...OXACML1_2258507_REV00_user_mid_noship.tar.md5
[Galaxy Note 3 General] eccomania:
Thanks my friend :)
[Galaxy Note 3 General] kakyyabata:
Guys i found this Folder in the same web site before

Samsung_Jtag_Program

http://www.dlgsm.com/index.php?dir=/FLASH-FILES/Samsung-Flashfiles/Samsung_Jtag_Program/I9505

this folder contain the attached files
[Galaxy Note 3 General] kosmasgr:
So , we hope :D

Sent from my SM-N9005
[Galaxy Note 3 General] Mwyann:
The Recovery43_EUR_V3.exe file contains some resources, if you open it with a resource extractor, you'll find some binary files (probably the bootloader), some xml files that contains informations about what to flash where, and an embedded executable called "emmcdl", usage is as follows:

Version 1.6
Usage: emmcdl <option> <value>
Options:
-l List available mass storage devices
-d <start> <end> Dump from start sector to end sector to file
-e <start> <num> Erase disk from start sector for number of sectors
-s <sectors> Number of sectors in disk image
-p <port or disk> Port or disk to program to (COM1 or 1)
-o <filename> Output filename
-x <*.xml> Program XML file to output type -o (output) -p (port or disk)
-f <flash programmer> Flash programmer to load to IMEM eg MPRG8960.hex
-i <singleimage> Single image to load at offset 0 eg 8960_msimage.mbn
-t Run performance tests
-b <prtname> <binfile> Write <binfile> to GPT <prtname>
-g GPP1 GPP2 GPP3 GPP4 Create GPP partitions with sizes in MB
[Galaxy Note 3 General] EnhancerFIN:
This could at least be a solution for bricking the phone so badly, so that the Knox status could not be read?
[Galaxy Note 3 General] Mwyann:
Kind of a poor method to get your MB replaced and Knox at 0x0 ;) You don't need fancy confidential software to hardbrick your phone. But that may replace Odin at least, if someone finds a way to wisely use that program. And if it allows us to reprogram protected parts of emmc, that'd be a start. And if this tool allows to retrieving the cert, maybe you'd have to fetch a backup of your Knox cert before doing anything, just to be able to recover it later if you want to get Knox back in place (just assumptions).
[Galaxy Note 3 General] mahmoud007:
does this come from 0x1 KWV device or 0x0 KWV ??

i've reed this before but instead of hex values it was variables %s and %d on 4.3 aboot.mbn file
[Galaxy Note 3 General] Mwyann:
It''s not a string dump of the aboot file, it's the output log from a booting phone. Apparently this one has triggered (and it uses the term "fuse" btw).
[Galaxy Note 3 General] newxdabie:
what surprise!!! will it being the guys saying "unofficial odin knox flasher" *.*
[Galaxy Note 3 General] Olleo:
i don't believe it. Best devs work for months and can't find a solution and suddenly a repo with the solution comes up from nowhere? It's too beautiful to be true. Such a turnover happens only in crappy movies.
[Galaxy Note 3 General] Riskytwin:
At least we should keep the faith. Let's hope we'll defeat knox

Risky's my name
[Galaxy Note 3 General] deeppalei:
I hope So.

I Hope so and waiting for a reliable method to defeat knox. and take the warranty back.

still waiting ... to be continue...:cyclops::cyclops::cyclops:

SM-N900

4.4.2 Kitkat

:D
[Galaxy Note 3 General] mahmoud007:
the once whom were saying e-fuse now they are silent lol

who comply to the rumors pressure instead of logically think and try to find solutions :cool:
[Galaxy Note 3 General] htc9420:
B

Maybe you don't understand what "SMC call" is..read the log and google the word.

As I stated before: this is professional security work. Made by JEDEC, ARM, etc. Samsung is only using the features. This can be done in almost any Android device bearing eMMC vers 4.4 and higher.

:p People still think that modern devices are made by amateurs in a garage, Android is joke and there are miracles all over the place. :p

for those who want tech data, here is something that makes ref to RPMB.
[Galaxy Note 3 General] nookcoloruser:
Those that are quick to mock and thinking that the holy grail has suddenly been discovered need to understand the saying "don't count your chickens before they hatch".

We are still some distance away from a solution regardless of new findings (as positive as they are).
[Galaxy Note 3 General] dpeddi:
From my unconfirmed research Tz should be closed source and developed by arm. I think should support plugin application like knox warranty and kernel lock that should be external to tz but should run in trusted area. If you look for dan rosenberg work on moto bootloader unlock you see that tz may have bugs and you could inject code

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Galaxy Note 3 General] avocco:
Don't know if anyone else has suggested this but I thought it might be possible.

Let's assume we are unable to change the status regarding knox. Could we not change the function that calls it instead

For example :-

Original

If knox=0x01 display warranty void

Modified

If knox=0x01 display warranty valid

Obviously the above is just an example and not actual code, just a theory.

Is it possible? Or something similar?
[Galaxy Note 3 General] Spere:
That's doable and someone made it show 0x0ffffff or something similar..

Problem is, if you flash phone to stock - counter is back 0x1. Or if Samsung have some program to read Knox status without even entering recovery (plug phone to computer and read Knox status) it'll most probably show 0x1 even recovery is faked to 0x0.. Can't remember but did the newest version of Odin show Knox status when phone connected?

Edit: And you couldn't use Knox container anymore, since warranty is void if counter not resetted but only faked?
[Galaxy Note 3 General] orly_mihai:
Hey guys.This is true or it's a big lie?Sorry for the link.

http://www.phonearena.com/news/Tria...05-with-Android-4.4.2-KitKat-on-board_id51384

https://plus.google.com/+Chainfire/posts/gyi2YCne5YJ
[Galaxy Note 3 General] perissatto:
Kidding right dude?

Enviado de meu SM-N9005 usando Tapatalk
[Galaxy Note 3 General] orly_mihai:
Sorry.I didn't read all. :D
[Galaxy Note 3 General] alesa1988:
I'm certain they can, check the screenshot, Certain apps display its status, no need to go into recovery...

EDIT: Sorry for double post... I couldn't modify this post for some reason earlier and pic didn't upload properly.
[Galaxy Note 3 General] Spere:
Yes, but where does those apps read it from?? Same place as recovery?

So if faked to recovery (will it fake to all apps too?) there's still no point doing that, since it's just a workaround and not even good one in my opinion
[Galaxy Note 3 General] dpeddi:
Please tell us the name of this app.

Found... its name is phone info

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Galaxy Note 3 General] alesa1988:
Phone INFO ★Samsung★ ... It's made by a fellow XDA member, vndnguyen.

Thread: http://xdaforums.com/showthread.php?t=2609045

I don't really know, maybe we could ask the developer.
[Galaxy Note 3 General] nitrate:
What's the combination to get into this menu?

Oh, I got the app. But the app gives me wrong KNOX status:

KNOX warranty void is 0x1 (I checked bootloader status manually).

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] bungadudu:
Warranty bit not found :-|

So where does this app gets it's info?
[Galaxy Note 3 General] santij07:
I want to know too.

I downloaded from google: https://play.google.com/store/apps/details?id=org.vndnguyen.phoneinfo

Mine say Knox Warranty Void 0x-4, but manually say Warranty Void 1, Galaxy S3 SGH-I747M.
[Galaxy Note 3 General] vim1:
Finally it's done on S4 9500

Finally it's done on S4

Toolset : easy-jtag box

Software from here : http://forum.gsmhosting.com/vbb/f67...olution-solution-repair-rebuild-emmc-1769456/

Confirmation from best friend BABAK : http://forum.gsmhosting.com/vbb/f67...bit-0-solution-inside-first-ih-world-1776265/

Final clarification about QFuse using : http://forum.gsmhosting.com/vbb/f672/regarding-knox-s4-1775213/

B.R. NoName®
[Galaxy Note 3 General] BABAK236:
Hi Guys

Finally i found way to Reset "Waranty BIT " from 1 to 0 By easy Jtag

I think i win 3130$....:D

---

There is manuall

http://forum.gsmhosting.com/vbb/f67...bit-0-solution-inside-first-ih-world-1776265/

if anyone need more detail please let me know
[Galaxy Note 3 General] vim1:
You can make before backup of EFS by connecting Easy-JTAG eMMC tool with [X] Show software partitions info. Then select EFS etc in Profile box and dump all IMEI containing sh****t.

Also [MENTION=262544]babak[/MENTION] , help me to resolve fcuk with my HOX
[Galaxy Note 3 General] Riskytwin:
So this is for reseting knox on I9500 but for 9505 is not possible yet

Risky's my name
[Galaxy Note 3 General] vim1:
KNOX Reset cant be made before on 9500 without changing eMMC

Regarding SnapDragon its NOT POSSIBLE , maybe BOOTLOADER patch can HIDE KNOX status but cannot reset it. (http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html)
[Galaxy Note 3 General] dawgboy1783:
If this is true for i9500 then excellent work mate but what about the note 3, I thought this thread and bounty is for note 3 only, IMO it is only fair that a method is found the for note 3 as well before the bounty is collected as this is note 3 thread only, no bashing intended just my opinion.

:p
[Galaxy Note 3 General] vim1:
I think after note 3 XDA devs ask to make 9505 and so on to never pay bounty :)

Every device on EXYNOS are compatible if it has SAMSUNG emmc. I bought 9505 to confirm thats an QFUSE and wasted about 500USD on that. Exynos have no QFUSES! But I am dont want to invest more in stupid samsung junk.

Update1:

N900 flash :http://www.ernik.com/flash-chip-emmc-for-samsung-galaxy-note-3-n900_p25664.html

Update2:

If someone send at least 50% of it price I am ready to buy it now :)

B.r. NoName
[Galaxy Note 3 General] dawgboy1783:
Well mate if it were up to me I would at least award you some of the bounty for your investment in the device you used for your trial and research into breaking this knox dilemma if this were exynos thread but if you could make it work for note 3 or snapdragon devices I'd be all for it .

:thumbup:
[Galaxy Note 3 General] iCUE220:
I know this is a note 3 thread but I think we can all agree that this effects all samsung users (4.3) so my question is, is this in fact a way to reset Knox from 0x1 to 0x0? And if so can this be implemented to the galaxy note 2 tmo version t889?

sent from a phuckn phablet.. duh :)
[Galaxy Note 3 General] vim1:
Reset possible only frox EXYNOS MCU!!!

Отправлено из моего iPad используя Tapatalk HD
[Galaxy Note 3 General] dawgboy1783:
EXYNOS ONLY, got it mate :thumbup:
[Galaxy Note 3 General] santij07:
All of this is a jtag box, but we want for a software to reset Knox and Downgrade bootloader our self without jtag box and do it in a friendly way, and this method using jtag box is expensive and not all can do this just for expert. I think nobody win the Bounty for now , we need more research.
[Galaxy Note 3 General] iCUE220:
OK so this may tick some of you off, but not my intentions at all.. It seems that I am a bit of a noob when it comes to how in depth this Knox thing really is.. I've just only started flashing and what not a couple years ago, and my knowledge was based on that, reading this thread however I am lost a little bit as I assume this is geared more toward hardware..? So a lot of the lingo I am having to Google to understand. Just having a hard time putting it together, so I just would like to know if this will work for SGH-T889 Galaxy Note 2 Variant, if In fact this resets Knox... Our maybe this is a device that would have to be purchased (judging from the link)?

sent from a phuckn phablet.. duh :)
[Galaxy Note 3 General] dawgboy1783:
From what Vim1 is saying this is for devices with EXYNOS processors only I believe T-889 is snapdragon and knox is implemented differently between the two platforms.
[Galaxy Note 3 General] vim1:
You can confirm your MCU on PDADB.NET
[Galaxy Note 3 General] iCUE220:
Samsung Exynos 4 Quad 4412 / ARM Cortex-A9

sent from a phuckn phablet.. duh :)
[Galaxy Note 3 General] vim1:
One I can say thats possible to do by software :) but there is no profit 2 do it for free. Enough that we made thing that you all call impossible ;)
[Galaxy Note 3 General] dawgboy1783:
If you guys pulled it off for EXYNOS then I have faith in you guys snapdragon must be possible:thumbup:
[Galaxy Note 3 General] vim1:
It sad but true - no possibility for Snapdragon they store it in QFUSE. EXYNOS store it at this moment in RPMB. If any solution will be released i think they also move it in MCU fuses area;

Отправлено из моего iPad используя Tapatalk HD
[Galaxy Note 3 General] iCUE220:
So since t889 is exynos, all I would have to do is buy this device? Or is it not compatible with my device?

sent from a phuckn phablet.. duh :)
[Galaxy Note 3 General] phr3ncj:
"2. Snapdragon Devices with JTAG Enabled ( GT-I9505 etc. )

KNOX Warranty bit are stored inside of QFUSE area in MCU

KNOXed and KNOX-free firmware bit also stored inside QFUSE area in MCU

Downgrade protection byte are stored in RPMB.

What this mean ? After replacing or WIPING eMMC and burning old bootloader on device with (KNOX Warranty: 0x01 ) you may downrgade device but KNOX Warranty bit will stay 0x01 for EVER."

:(

Inviato dal mio SM-N9005 utilizzando Tapatalk
[Galaxy Note 3 General] vim1:
Since this phone are never sold in my region ;) i can't buy it fast and there is no servicemanual with schematics i am cannot provide solution fast.

Отправлено из моего iPad используя Tapatalk HD
[Galaxy Note 3 General] BABAK236:
Hi

regarding I9500 and all Exynos devices

Counter stored only in Rom2...not RMPB

So just need write rom2 for Reset Counter

See Photo
[Galaxy Note 3 General] vim1:
[Bounty] Reset KNOX counter to 0x0 (UPDATE- $3130)

Do you like to see RPMB dump for prove ? Maybe samsung make a mirror in two places. Anyway bounty never get payd )
[Galaxy Note 3 General] phr3ncj:
rembember that guy having different value in last line of dl mode? like A2 B2 instead of A1 B1 ecc, he had his note3 resetted by sammy. somehow is possible switch to another set of qfuses and those values. we have to find where the phone looks for to know what qfuses check.

Inviato dal mio SM-N9005 utilizzando Tapatalk
[Galaxy Note 3 General] eccomania:
I have note 3 with exynos soc so how can i revert knox status to 0?
[Galaxy Note 3 General] mahmoud007:
GT-I9500 doesn't have sboot.bin does it ??

and theory about the PIT file it looks like to be confirmed .. ill assume that that PIT does not Identify that Hidden storage and keep it out of reach

plus assuming that Hidden storage does have that bit plus some backups for the 4.3 Rom partitions that runs every time you boot up ... explains that wifi and bluetooth does not work when downgrading the s4 because incompatibility issue with some files inside 4.3 NON-HLOS.bin with 4.2.2 NON-HLOS.bin .. in order to keep your device safe and secured
[Galaxy Note 3 General] vim1:
About what sh@@@t you talking , look into JEDEC standard and read look in to RPMB section.

Отправлено из моего iPad используя Tapatalk HD

---------- Post added at 06:17 PM ---------- Previous post was at 06:08 PM ----------

You need Easy-JTAG box with eMMC adapter and some soldering skills ;)

Отправлено из моего iPad используя Tapatalk HD
[Galaxy Note 3 General] JonSCSL:
Is it the same for the note 3 snapdragon variant?