yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] :
I have been talking with some guy that works on samsung and he said that 100% sure that knox is not a hardware fuse and he explaind how the sistem works.

For what i have understand for him :

When we root the phone by flashing(anything that is not official)there is a log file that he cant be deleted by flashing.hard reset.etc that adds some lines(comands) in it and every time we try to flash official thosse lines is showing that the sistem is modify.everybody knows that android it works o linux and this log has some comands in it .

He has a contract and he cant tell me where that file is ....but i have used root explorer from play store and the only file that has some interesting lines is in root>data>local>tmp>init.rc

You can all look at that file to se what or if the file content looks odd
[Galaxy Note 3 General] msasm09:
what do you mean?
[Galaxy Note 3 General] :
I modify my post...i has trying to add a comment and i got a message that i dont have permission on that forum or something like that
[Galaxy Note 3 General] :
And manny other lines like this ones attached bellow
[Galaxy Note 3 General] :
I ve take a look at the n900 knox reset files(for thosse who dont know ..in n900 case it is a bootloader that can reset the knox)and all that guy(the own who release this bootloader) did was add a image with "watchdog reset".and make sense...

The recovery.bootloader.download mode and everything we see in a phone has build a image for it and some commands to make the images work.This knox warranty void 0x1 in order to get show in download mode ..must have a image or else we wont be able to see it.The ideea in n900 case was to replace that image with a one that shows knox 0.

The counter porhaps was not reset ..but the image that shows that ..was...and so ..when you enter in download the "fake"one is shown

This is just my way of thinking to mask this counter (knox 0x1)...for now...i will keep working and try to remove that image in order to se what wappens

I will keep working and searching...and i will try to replace that image to se what happends

If some one has a better or any idea ....?
[Galaxy Note 3 General] msasm09:
GOOD speed
[Galaxy Note 3 General] msasm09:
this might be interesting

http://xdaforums.com/galaxy-s5/development/mod-enable-private-mode-knox-0x1-t2904723

---------- Post added at 02:02 PM ---------- Previous post was at 02:02 PM ----------

i quato

"adding the line const/4 v0, 0x0 overrides the one from secure storage with a null value and makes it load the PrivateFsKey value from properties.xml and enabling the feature "
[Galaxy Note 3 General] :
You mean like

warranty_bit1ro.boot.warranty_bit

,hmac_mismatch0ro.boot.hmac_mismatch�sec_atd�tty/dev/ttySAC1ro.boot.sec_atd.ttyrtn_configunknownro.rtn_config��bootmodeunknownro.bootmode��basebandunknownro.baseband

4�Lbootloader

G903FXXU1AOI7ro.bootloader�4

debug_level0x4f4cro.debug_levelX

�

cp_debug_levelunknownro.cp_debug_level

�

d�emmc_checksum3ro.emmc_checksum�l�warranty_bit1ro.warranty_bit

?

---------- Post added at 05:26 PM ---------- Previous post was at 05:24 PM ----------

Not really that is hacking an app. It's pretty much like hacking Ishtc when you're on a Samsung [emoji14]
[Galaxy Note 3 General] msasm09:
check recovery log under stock recovery
[Galaxy Note 3 General] :
In stock rom or in the phone?
[Galaxy Note 3 General] msasm09:
in stock recovery check recovery log
[Galaxy Note 3 General] ahmekh:
I need help to reset knox from 0×1 to 0×0. Can you please help?
[Galaxy Note 3 General] royal_kerry:
so knox fuse stored in emmc secure partition

that is not take any effect while flashing or not visible likely other partition

mean changing of emmc may solve this issue

i have seen pcb of n750 that is not pasted/ glued

i will arrange a new emmc and try with replacing

till all of you good developer try it to solve with patching
[Galaxy Note 3 General] :
if you ar that "good" or smarter that all of us why you didnt figure out for yourself where the knox is?for your info i know where the knox location is ...but for guys like you i will not speak until i manage to do something about it

I work in a service centre and to replace the emmc it's easy..we all here try to figure a way for everybody that dont own a service or equipment and by the way... for hardware solution

In hardware solution .. it was easy to microwave the motherbord or the hole phone and get a replace in warranty..or put 10v on battery pins.

Have a nice day and good luck
[Galaxy Note 3 General] :
Yeeeeeeeeeeeeeees.

We have been searching in wrong places and wrong count(ox1).samsung uses ox%x for the counter.look at the attachments.tomorow if i have the time i will try to modify that file but is to big and a lot to modify(until we found/build an app to reset)

The file contain all we do in download mode and every time he keeps fails if the counter is wrong(0×1---> 0x%x)

Thosse attachments ar from my phone not from a rom placed on my pc
[Galaxy Note 3 General] jimbomodder:
so where did u find these? in a system folder or root folder?

Sent from my SM-A500FU
[Galaxy Note 3 General] :
For now i prefer not to tell..if you dont mind(please dont)i will test it tomorrow on other phone (the test phone not mine)and i will let you all know

---------- Post added at 10:02 PM ---------- Previous post was at 09:49 PM ----------

What happends ..is when ever we conect the phone in download mode..there is a file that write that down inside it.any modifications (root )makes the file unofficial(signature fail).and trigger a onficial line(the count 0x1).i will have to see a non rooted file(i have it)to see the diferance.if the replacement of the file works ..this solution will be for every model on any firmware(for non international version you will need to root the phone without knox 0x1 to get the file you need).or if it works like i think this works all you have to do is delete that lines..wait for testing becouse i cant say "delete that"and get you all with bricked phones ?
[Galaxy Note 3 General] ByteEyes:
I think the solution is only the bootloader. It can save the boolean variable changing "GET" to "SET", or simillar.

I think this variable is in a different memory space that the system memory. Upper than it.

And the only way to access to this memspace is the bootloader (maybe with the PC too). Reason for this is the bootloader the "writer" that change the valor from 0x0 to 0x1 if detects non stock startings.

Repeat: this is my personal opinion.
[Galaxy Note 3 General] :
Until now i understand way things go like you all..but then i remember that android still has his based on linux and things are getting way better

Like i allready said in previous post ..in order to see things on a screen they need to build some commands.images.signatures.etc

When we broke that lines ..we distroy the signatures(by root we add lines/commands)and the sistem become custom.konx 0x1.etc

Look at the attachments ...all you see is not official.with errors.and codes that indicate we have broke the command.(i cut the attachment becouse i dont wont anybody to find them and blaim me for bricked phones).wait and i will make it possible and with a video see it's not "fake" ...if i am right about this

You are right in some way..but the question is how we make it back and get it right?there is to much things to take care(if you write any bootloader and flash it you will get bricked phone or in best casse signature fail in odin)

Cheers
[Galaxy Note 3 General] ByteEyes:
Of course. This is the case. Wrong bootloader and you brick the phone.

But I think the system cant access the primary sector and change the other memspace.

Similary: linux of course is powerful. But can you change with commands the BIOS variables? No? Okay. You now understand me.

In this case, Triangle Away change "things" in other space that the system...

Modified bootloader can crashes the phone... like TA... is the risk.

Regards ;)
[Galaxy Note 3 General] :
Triangle away??????

Dont get me wrong but i dont belive that from hole smarts develovers in the world nobody was able to find a solution?they are people who did much worse things and they cant breake knox and i found a solution(in my opinion)in just a few hours?

Like the downgrade of n9005 back to 4.3 when samsung said we cant do it.

How about towellroot...they "found" a way to root and still have 0x0...how?

It' s just a small step to find how to modify or replace the file with right signature

As for the risk ...goes with the problem

I have few dummy phones (s4.express2.n9005.etc)and i will test it on them first..if they breake there is no problem ..but one of them will give up at the end

Cheers
[Galaxy Note 3 General] ByteEyes:
Towel roots the system and knox still be 0x0. Of corse!!! The bootloader havent any notice about changes in the system: kernel, recovery...

Do you have see the red letters? Knox warranty bit: recovery

With towel you can pass over the bootloader(BL). BL is like a PC bios. You cant access it and also its variables because share the same space in the disk. A different space.

Triangle away can access it. Not the knox variable but the flash counter. This counter is another variable sited in the same memspace (or diskspace, i dont know) where knox boolean bit is located. Maybe a Bios, Eprom or disk partition, but unaccesible by the phone system. Root, or god.

But i'll be watching your progress, of course. I hope you're right and all be much more simply that I think.

Regards.
[Galaxy Note 3 General] msasm09:
hope again
[Galaxy Note 3 General] :
Delete
[Galaxy Note 3 General] :
Don't see your point coming here throw some random comments about wrong stuff and more Knox 0x1 is not wrong by any case. Just because it says 0x01 in your info doesn't mean it's wrong.

Also not sharing what file you got there is for what reason?

Also what you did was looking at the bootloader (as people done before.) But clearer output. Strange
[Galaxy Note 3 General] :
Are you ok?

The path to the files is in my last comment.what file do you want.

The files are in your phone ...you know what.....i dont need this ..like i allready said i own a gsm service centre and i can change the emmc hardware and bingo ...knox 0.

Only experts on this forum.keep searching becouse i will delete this account right now

Have a nice day and good luck searching

---------- Post added at 01:16 PM ---------- Previous post was at 01:15 PM ----------

Deleted
[Galaxy Note 3 General] :
I did only see the yesterday comment where you showed your findings and you didn't want to share what file.

My bad. It is good that you have some more knowledge and "insider" yet I am not sure for thus who "reset" their counter with reset bl if it they were able to use Knox Sox again or got warranty. According to your findings on how It worked. I doubt it be working but who knows
[Galaxy Note 3 General] :
Like i said....I dont need this and am not doing nothing about it this.

I know how to fix my problems

I get tones of emails and private mesages ..but for what...?

I ..like every body else quit this and i will stop helping

I have make a request to xda adimn to delete this account .

Please dont send any messages becouse until my account will be deleted i will be log out

Have a nice day
[Galaxy Note 3 General] mielletseed:
I don't see any reason why you react like this. Still believe the knox flag is not just stored in any file and could simply be resetted by modifying this file (this was simply spoken security by obscurity) . Than Samsung would have serious problems and work for their lawyers :)

Proof you solution or be quite. But you already decided to leave. Good luck anyway.
[Galaxy Note 3 General] royal_kerry:
he got the solution n not want to share with anyone ?

! or he got warning of any type because he is member of service center

but as i know about knox : it's 1000% software level locked doesnot using any efuse or any hardware layer

when i was change emmc of mine n750 from a dead one n750

my knox counter reset to 0 that's proved this is not any efuse

it's somewhere hidden emmc block that not taking any effect in flashing with pit even copied all partition with jtag
[Galaxy Note 3 General] istperson:
Yeah, but that's Exynos, so it doesn't count.
[Galaxy Note 3 General] mielletseed:
N750 is Exynos (Samsung) SoC

in my mind the information was (without guaranty):

Exynos SoC == resettable by special "reset bootloader" (knox stored in emmc or in some partition or something like that)

Qualcomm SoC == not resettable (knox stored in an eFuse)

so for me it's no prof that people with Exynos devices tell me about resetting knox to 0x0

(that's why this bounty never has paid out, nobody found a way to reset )

---------- Post added at 03:56 PM ---------- Previous post was at 03:44 PM ----------

I'm not sure he really found a solution. His posts where hard to read for me. At the and he was more shouting and complaining.

The lines he provided as screen shots looked more like some "log entries" or something like that to me than the storage place of the knox flag. But I'm not very skilled.

But he left without any proof so for me it was a hoax again :)
[Galaxy Note 3 General] royal_kerry:
you mean there is possibility to reset knox with modified bl

so anyone made apps or edit bl for reset knox in n750 exynos chipset

if you provide me schematic for Qualcomm SoC having n3 device

then may be i will find efuse in pcb ( if Qualcomm chipset device using hardware layer as a efuse )
[Galaxy Note 3 General] :
If you change the emmc you change hardware. Therefor your Knox was reset. Also Knox is used with a signature. It's already known. Why it's triggered. So yes modifying bootloader will gain good stuff. However it isn't easy. One must be able to find the culprit.

How it's not a efuse. Is hard to tell just because s4 got Knox and it was triggered doesn't mean it's not a fuse. Still could be fuse but due to checking the way it's being triggered is helping us see it is most likely not a efuse. The reason why we can't bypass it most likely the way apple handles their software. They have special software for downgrade and stuff without using iTunes and more. There might be a similar way with this.

A correct "reset" signature must be used. Or a complete reset of all partitions which Odin does not fully wipe. This is most likely due to Samsung acknowledge that it's out therefore they had to use different method to void so people can "re claim" warranty when they think they shouldn't.

---------- Post added at 04:27 PM ---------- Previous post was at 04:22 PM ----------

Doesn't matter if it's exyno or Qualcomm. The method is rather similar method as well.

Apps running in Android will most likely never being able to handle this. Reason is the protection that prevents us from modifying the system partition that knox bit flag is stored in. Even if we can modify it it will be reset on reboot. Since it is "stored" in a way where of bootloader will revert it to the true state.
[Galaxy Note 3 General] mielletseed:
So you know any Snapdragon device that has been reset? (sorry I'm not up to date)
[Galaxy Note 3 General] :
No only repot Qualcomm i heard of was my motherboard replacement . Got Knox 0x0 after it returned back. And it was triggered before. But both uses the signature method, looked into qq and it had same info written everywhere.

but the details in bootloader are equal both stores in emmc if I'm not mistaken. But it isn't difficult to see I seen info from exyno and was equal to Qualcomm.

But as said I believe it's has to do with signature. Also how else would someone be able to replace a bootloader if not having special signature? Is that even possible?

Also judging by

(�:0PROP��n��,ro(

�Hbooth��debug_level0x4f4cro.boot.debug_level

lxemmc_checksum3ro.boot.emmc_checksum�boot_salescodero.boot.boot_salescode

8�odin_download1ro.boot.odin_download

�Dbootloader

G903FXXU1AOI7ro.boot.bootloader`�Lselinuxenforcingro.boot.selinux

�security_mode

1526595584ro.boot.security_mode�warranty_bit1ro.boot.warranty_bit

,hmac_mismatch0ro.boot.hmac_mismatch�sec_atd�tty/dev/ttySAC1ro.boot.sec_atd.ttylserialno dro.boot.serialno�lserialno dro.serialno

��rtn_configunknownro.rtn_config��bootmodeunknownro.bootmode��basebandunknownro.baseband

4�Lbootloader

G903FXXU1AOI7ro.bootloader�4

debug_level0x4f4cro.debug_levelX

�

cp_debug_levelunknownro.cp_debug_level

�

d�emmc_checksum3ro.emmc_checksum�l�warranty_bit1ro.warranty_bit

boot_recoveryunknownro.boot_recovery

��hmac_mismatch0ro.hmac_mismatch��

@

im\

paramx

offsetunknownro.im.param.offset�me param
[Galaxy Note 3 General] msasm09:
great

after the past brain storm and new hope appear we lost it and return to face on brick the silly efuze question

do you think that sammy would like to change emmc to reset enterprise security solution like knox? i doubt it but what's sure that we lost another good brain who provide way to revert back to 4.3 and hope to reset this soon?

i hope you can sleep on it

---------- Post added at 06:03 PM ---------- Previous post was at 05:58 PM ----------

for all how doupt it towelroot able to safely root without any warranty void ok so it must be software check and can be masked or readdress it
[Galaxy Note 3 General] :
I'm sure Samsung provides a reset solution but most likely to premium or qualified partners only. The trigger hasn't really anything to do with downgrade. That is a protection by its own. Pretty much same story there. Except modem is protected. Once a bootloader is hacked it can most likely disable that protection. It just need to be done. It isn't easy. I do not know how the n3 bootloader reset was achieved if it was a leaked reset bootloader or not. But if you got proper info and tools that can decompile the bootloader and compare original and the "reset" one will have good knowledge about what's needed to be done. But if that bootloader really resets it (as people said it does) it's a good step forward. I've tried compare it with another note 3 files but isn't easy even if it same version. Many changes in that bootloader. Memory controller made a good plug-in for IDA to be able to read bootloaders easier but I haven't checked it out yet.

If you don't think they are using equal method on the two different chips.

But if you have a Qualcomm device go to /dev/_properties_ and read about the emmc

The info I posted above was from s5 neo exynos powered.
[Galaxy Note 3 General] mielletseed:
First: I'm a little bit angry. What did you expect the people? I don't know why cristityy was so upset he decided to leave. Nobody did any harm to him. Even some notes to his posts he interpreted as massive critics. I don't know why.

Second: your statement about towelroot seems really stupid to me (sorry for that strong words)!!! I think all the people know that the detection of a modification is done by software - the bootloader checks the boot image it starts (the recovery, the kernel) so if you change the kernel or the recovery the bootloader will detect this. (also flashing a unsigned ROM with ODIN can be detected by the bootloader since it is involved in flashing). Towelroot used a security hole to get root privileges at run time so the system partition could be altered at runtime without flashing or without changing recovery or kernel. So the bootloader couldn't detect that modification since it doesn't check the whole system partition at boot time.

But the detection of a modification has nothing to do where the information about the modification is stored. You don't get a red dot on your device or a hole in the back - only a printout on the screen. So yes - the detection of modifications and the presentation of the knox state are done i software - I can't think about how it should be done otherwise and nobody ever was discussing about this!

The only difference is what people believe where this information is stored - in a multiple times writable or a one time writable storage (very short: efuse or partition). So what should towelroot "proof" in our discussion?
[Galaxy Note 3 General] msasm09:
i want to mention that security hole to gain root in any time but when you gain root and update busy box isn't a modification to system

abilty to Flash with mobile odin and there's a boost to flash prerooted firmware without trip knox

so stupid is to think that it cannot be masked or re addressed

plz don't be harsh i mind to use those vocabulary if you mind keeb your strong word for you

have a nice day
[Galaxy Note 3 General] istperson:
It does.

1. People having Exynos Note 3s have already managed to reset knox. (search this thread)

2. Nobody having Qualcomm Note 3s ever reset the knox flag.

So, so far the Snapdragon Note 3 has an e-fuse, until otherwise proven.
[Galaxy Note 3 General] :
Nope it doesn't.

Just because someone got a hands on Knox reset for only one device doesn't it prove that Qualcomm does have a fuse.

As said the emmc mismatch info trigger Knox is present on both Qualcomm and Knox. None is mentioning anything about an efuse only "fuse"

I doubt Samsung would make one efuse and other not wouldn't make any sense.
[Galaxy Note 3 General] istperson:
Sorry, I don't understand this one, what should be the difference between fuse and e-fuse?

Also Samsung only makes the Exynos SOC. The Qualcomm SOC is made by Qualcomm.
[Galaxy Note 3 General] :
I don't see why you would leave? Why not share what you can do? You can reset it ? Are you just giving people hints here. Don't get your point. No one insult you or miss believe you. You said only things which was previously mentioned and it looked like you didn't know how to reverse it. If you know how 1000x people would be helpful. Not sure why you are upset. But you gave instructions on viewing Knox info which been told some pages before or am I mistaken?

I'm not trying to insult or being mean. Must been either misreading you or swapped you with someone else. No need to leave.

---------- Post added at 07:47 PM ---------- Previous post was at 07:43 PM ----------

I believe a fuse can be triggered on/off efuse is only is one time trigger. Not sure though. I might be thinking very very wrong. But if it's a efuse and as I believe cris said it's not hardware and it's proven that it isn't at least an efuse.

Seems like I'm being stupid. Fuse is a resistor? Or am I completely mistaken
[Galaxy Note 3 General] mielletseed:
This thread is not about masking knox but about resetting :)
[Galaxy Note 3 General] erlos:
???

I d shared this notice for developing. ..

Good night!

Inviato dal mio SM-N9005 utilizzando Tapatalk
[Galaxy Note 3 General] DAGr8:
Huh?

If you mean you don't wanna pay to reset Knox flag then ok but if you mean resetting it isn't worth a dime then I disagree. .

Not everything is free.

15$ for this is more then honest.
[Galaxy Note 3 General] perosredo:
At Samsung, the lengths you have to go to internally to get a subdomain on samsung.com are so beyond belief it's not even funny - they didn't even authorize one for their Olympics marketing efforts, and they were a major sponsor.

samsung.it redirects to samsung.com

Domain: samsung.it
Status: ok
Created: 1998-09-23 00:00:00
Last Update: 2013-07-22 00:38:48
Expire Date: 2014-07-06

Registrant
Name: Samsung Electronics Italia Spa
Organization: Samsung Electronics Italia Spa
ContactID: SAMS13
Address: Via Donat Cattin 5
Cernusco Sul Naviglio
20063
MI
IT
Created: 2007-03-01 10:35:33
Last Update: 2011-07-13 17:02:17

Admin Contact
Name: Carlo Ponzellini
ContactID: CP940
Address: Via Donat Cattin 5
Cernusco Sul Naviglio
20063
MI
IT