yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] neoKushan:
The efuses blow to prevent dashboard downgrades. Microsoft was actually very clever with their security - they knew that all it took was one little exploit in a firmware and the whole console would be screwed. Even if they patched it, people would just hook up a NAND flasher and downgrade - but with the efuse blown, you can't. Removing the resistor does stop them getting blown, but that also means that upgrading the dashboard will brick the console (until you use a NAND flasher on it again).

Despite the PS3 also (apparently) having efuses, it does not use them to prevent downgrading, meaning every PS3 out there is completely exploitable just by hooking up some wires and flashing an older firmware.

Now the glitch attacks, that's another level of brilliantness....

(And before anyone asks, no, we won't be able to apply the same attack here).

The Knox flag isn't a counter, it's a flag. It's either 0 or 1. It won't increase, the flash counter however will.

Why are we all so sure the bootloader is what's actually setting the flag? There are other bootloaders within the hardware, the chain of trust begins in hardware. The bootloader is just displaying a value, if that value is read from a hardware flag within the CPU, there's every chance the CPU is what's setting it in the first place.
[Galaxy Note 3 General] :
I can almost bet that if someone checks out the bootloader, we will be able to find a workaround on this :silly:
[Galaxy Note 3 General] neoKushan:
this isn't a new thing, the galaxy s4 has had this knox counter for months now and all of those developers haven't figured it out yet, either. That includes the likes of Chainfire, who made triangle away. I really don't think it's as simple as some people think.
[Galaxy Note 3 General] :
Of course it isn't simple, it is a security stuff... it's meant to be difficult to crack.. but not impossible :)
[Galaxy Note 3 General] Sonorus:
This isn't my point. Why do we care that an eFuse is blown if no software can see it? Software knows only what it sees.

My point is simple. Software looks at memory values, memory values can be shadowed. Just redirect requests to read that bit (or preferrably, the entire qfuse block). What i speak of is a simple function of a basic rootkit.

At the end of the day, software is what will care about that value. (otherwise we wouldn't care about it because you'd never see it)

I don't need to fool the hardware, only the software, and thus the technicians. I doub't they would jtag every phone.

And hardware chains of trust cannot work because there is nothing that can be done to stop someone from making different hardware do the same thing. Eg. Take a radio and a cpu, make it speak the protocol. No way for the other end to know it's not "trusted hardware". Even encryption doesn't work because you just pull the keys off the hardware. (which is of course why DRM can never work)

It just makes it /harder to do/. That's the point. It's our job to make it EASY.

Possible, but the point in software is to abstract. Nobody is going to program every little security feature into the hardware. Takes massive R&D with very little reward. Eg. it's not economically feasible.
[Galaxy Note 3 General] cheesekeeper:
Expect a Nobel prize if you manage it :D
[Galaxy Note 3 General] checkmateyou:
Got my paycheck today, and I be happy to give $50 (and maybe an extra $25 if I have spare)! :victory:
[Galaxy Note 3 General] newxdabie:
quote of chanfire...oh MFG he is genius!!!!i cant wait for his program to reset knox!!!
[Galaxy Note 3 General] DrawnToLife:
Must I really quote myself..
[Galaxy Note 3 General] Omar04:
LMAO

---------- Post added at 12:05 AM ---------- Previous post was at 12:04 AM ----------

No man I made a mistake is not a quote from chainfire is a quote from the poster yashade2001 I believe
[Galaxy Note 3 General] newxdabie:
yeah i realized that after when i saw his quite post in 28 December...to sad... just for moment, i was so happy about it...almost scream out of windows "bye bye knox..."
[Galaxy Note 3 General] bungadudu:
Regarding warranty in case of knox 0:1 seems we're close to an official standpoint.

" -*(Samsung KNOX Service Support)

Jan 05 14:11

Dear xxx,

Thank you for the follow up. There has been many discussions regarding the article due to legal reasons. The revised article should be made available to the public sometime next week. We greatly appreciate your patience.

Best regards
Steve
Samsung KNOX Team
www.samsungknox.com"

Maybe there will be no need for resetting knox on our own.. :)

So you who know how to reset knox come forth with the method now and take the money!
[Galaxy Note 3 General] p4j1:
Let's just say a previous post in this thread about HEX values had some truth to it, but to be honest there are too many ungrateful users here to even consider sharing this information. All I did in my original post was ask if it was okay to post this kind of information/instructions on this forum and all I get is ungrateful idiots whining.
[Galaxy Note 3 General] hey_joe:
I don't blame you if you don't want to share the info but calling them ungrateful I think isn't right since you haven't shared anything that is of benefit to them. Like others have suggested, you can contact the op or chain fire or whoever by pm and let them in on the secret then claim the reward when it's proven it can reverse knox status.
[Galaxy Note 3 General] mahmoud007:
Knox

ill know the way as soon Just my phone come out from warranty ... i know i was late ... but only because of them asking me daily to comeback tomorrow ... but till now my device still they asked me for no additional charges ... maybe because i flashed the original Rom before i deliver it to them ... so be patient and get ready to donate for me :D:D

i hope they tell me the way tho .. :confused::confused:
[Galaxy Note 3 General] rgshah3:
You have the script which resets knox?
[Galaxy Note 3 General] _alex74_:
Of course it is OK.... this will help a lot XDA community, here most people are kind and grateful... do not base on some people behaviour....

if it has.... let it Chainfire do it's magic!:good::highfive:
[Galaxy Note 3 General] rmercado:
Dude... they p#ss-you-off so that you will not be able to get the bounty... hehehehe

They will do the same as what you did and post it here to get the bounty... reveal the script before they do.... ;)
[Galaxy Note 3 General] nitrate:
If I were you I would release the script / information before anyone else does.

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] bungadudu:
There's no proof that he actually have a method to reset knox.

And the fact that he now resorts to whining about how ungrateful some strangers can be on the Internet when he could make a quick $3000 just seals the deal for me.

Another wanker looking for attention.

As I've posted earlier, apparently Samsung knows about this whole warranty mess and will issue a somewhat official statement next week.

Given the fact that apparently there are many repair centers that don't care about knox and the whole discussion about how rooting is legal in Europe I do hope they'll say the knox counter only affects the knox containers and not the warranty.
[Galaxy Note 3 General] rgshah3:
Chainfire posted about the file replacement about 3 months back! Nothing yet
[Galaxy Note 3 General] DrawnToLife:
Where did he do this? Source please.
[Galaxy Note 3 General] newxdabie:
there are someone still working on it? i ve heard nothing yet...maybe it will more easier one day a samsung guy will leak it...
[Galaxy Note 3 General] rgshah3:
Someone posted a link to a blog which contained a post from Chainfire
[Galaxy Note 3 General] DrawnToLife:
No.
[Galaxy Note 3 General] picrthis:
Is this what your talking about?

http://yashade2001.wordpress.com/category/hacking/
[Galaxy Note 3 General] rgshah3:
Yeah! I guess

Edit- read it again! Apologies for the confusion! It wasn't Chainfire
[Galaxy Note 3 General] bihslk:
Ok guys. If it is an eFUSE? How become that Knox never was on the NOTE 2 when it was released. KNOX came with 4.3 update and updated bootloader.

KNOX RELEASE DATE: "Samsung first announced Knox in MWC 2013, to be first preloaded with Samsung Galaxy S4"

More devices such as the Samsung Galaxy S4, Samsung Galaxy S III and Samsung Galaxy Note II will receive Samsung Knox at the end of 2013 with the Android 4.3 Samsung Premium Suite Upgrade.

So how could it be HARDWARE built in when it was first released on S4?

It must be a hardcoded bootloader or something like IOS... It cant be a hardware.
[Galaxy Note 3 General] Thumper_:
[MENTION=221652]bil[/MENTION]slk Are you sure they are talking over knox counter ? I think they mean the Knox security software for business users.
[Galaxy Note 3 General] jonboyuk:
At a stab in the dark,

The Qualcomm chipset has always had the eFUSE technology built in, but all older bootloaders weren't utilising them. It only took a small update to start using the eFUSE technology built into the chip.

I don't believe it's a fake thing, even on legacy devices.
[Galaxy Note 3 General] dawgboy1783:
I believe that either way it boils down to a software switch/trigger wich should be able to be removed or disabled, makes you wonder if the trick is right under our nose :eek:
[Galaxy Note 3 General] mahmoud007:
knox

Bad news

To reset knox you must change the main board -_-

it is not an efuse like most of people says ... its just Knox locking device with encrypted security to protect the device as they say

My last device from Samsung is s4

im going to another type of devices that does not try to be iphone and treat me as real owner
[Galaxy Note 3 General] nitrate:
What's the source of this news? I don't believe this until you give a trusted source.

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] mahmoud007:
knox

My sources is from waiting 3 days for my device was in warranty company and I've been surprised by this info as you
[Galaxy Note 3 General] gadomido:
i had tripped knox 0x1 and my phone had problem in hardware then i contact samsung then they told to send it to them and i did 2nd day i recieved it with knox counter 0x0 but only change was in odin mode S2, T2 , R2 , A2, P5 which was before fixation S1 , T1 , R1 , A1 BUT KNOX NOW 0X0

BY THE WAY THEY DID NOT CHARGE ME .
[Galaxy Note 3 General] bungadudu:
Finally a ray of sunshine!

Can you attach a screenshot?
[Galaxy Note 3 General] melvie:
What country are you from? And what was your hardware issue?
[Galaxy Note 3 General] htc9420:
Why R U screaming like that?

Did you check the IMEI of the phone? maybe they just changed the mainboard....

also, please state your country and Sammy center that serviced your phone ...

I find it hard to believe it would be so easy to reset the Knox.... why would Sammy create something that they call "secure" just for the kicks...and any service center can easily reset KNOX counter...after all, Note 3 has the NSA:p BYOD approval....

just imagine you are someone VIP ( for whom the KNOX really means something), someone breaks into your home during the night, steals the device, reads all the critical info inside KNOX container, resets it at "friendly" service center and puts it back like nothing ever happened. You would be pretty annoyed, wouldn't you?

IMHO,breaking Knox is like breaking BBM...almost impossible...
[Galaxy Note 3 General] gazeddy:
My phones STRAP numbers change dependant on how i go into odin mode
[Galaxy Note 3 General] smartje74:
Some interesting things to read:

http://www.samsungdevus.com/sites/default/files/IntroducingtheSamsungKNOXPlatform-PengNing.pdf
[Galaxy Note 3 General] nitrate:
Maybe some kind of bootstrap? I remember changing my own STRAP when doing a hard-reboot from within Android by holding the power-button until the phone reboots and going into download-mode right with this procedure.

You can test yourself possibly. You maybe have to test several times until you see any change to the STRAP.

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] gazeddy:
Thats when mine changes from android i get 2 2 2 2 0 and from off i get all 2. Also when i get 22220 secureboot is none
[Galaxy Note 3 General] gadomido:
imei was same and i am living in dubai
[Galaxy Note 3 General] eraybozkurt:
Donation

$50 from me.
[Galaxy Note 3 General] lilstevie:
It doesn't work like that, you need a password to get into the knox secure container, incorrect passcodes trigger sanitisation of the container.

Tripping the knox bit also sanitises the knox secure container. So if you tripped it trying to find a way to prevent incorrect passwords from sanitising the container, all the data would be gone, and tampering would be evident, resetting the knox bit does not bring back the sanitised containers, once it is gone, the only way to get it back is to set it all back up, and re-enter all that information.
[Galaxy Note 3 General] Arymanik:
I think if wee see new os on all samsung devices than we goodbay already version of knox bull...

Because we must reinstall rom and kernell ;). I think knox info is writed on security and hide sdd partition. Or install in bios. Its really too check. Broke bios and give it to service. If mb back with knox 0x0 than all information about knox is saved in bios. Its cant be in hardware. Its only security we must wait for person who decrypt it.
[Galaxy Note 3 General] moto211:
Bios, really? Our phone has no bios.
[Galaxy Note 3 General] lilstevie:
Really now? Knox is implemented in the boot portions of the firmware, that is pre-android, so even if they did update the devices in the field to switch away from android to another os, which by the way would never ever happen, the knox bit would still exist.

um okay, would be nice if you could explain your logic here.

I'm going to be honest here, I really don't care what you think, I deal in fact, and unless you can prove it, your opinion is irrelevant, your opinion doesn't change the facts.

However, it is highly likely with these reports of knox bit being reset that it is indeed on a hidden portion of the eMMC. We don't have SSD's in our phones, we have embedded SDCards.

I would really love an explanation here. Arm devices have an embedded bootloader, not a BIOS. Also on your computer nothing except code is stored in BIOS, what I think you mean is CMOS which on your computer is what stores the settings for BIOS. However even as a hole in your idea, if the firmware was wrecked with a small amount of effort they could check if the bit had been set as they know where it is stored, and would be able to read it out without ever turning on your device.

Samsung have the ability to replace the mainboard on your device without you ever knowing as they can clone your dead one's unique identifiers over to the new board.

Why can't it be hardware, even a hardware trigger, except efuses can have a software trigger to reset it.

You don't "decrypt" security. Security is more than just encryption.
[Galaxy Note 3 General] mahmoud007:
knox

If no software can reset knox .. its probably knox probably activate one time program inside cpu unable to make it loop back ... we gotta find a way to downgrade the system because cpu will be triggered for good unless there was way to communicate with cpu's memory and remove that trigger or reset it ... thats my theory not a fact !!
[Galaxy Note 3 General] lilstevie:
No, just no.

If software cannot reset the knox bit, then it is exactly as described, an e-fuse. e-fuses are, well best way to think about it is like a fuse. once it is blown it is blown, there is no reversing a linkage that has been physically destroyed.
[Galaxy Note 3 General] Omar04:
If only we can get our hands in the several android 4.2.2 pre release builds the Note 3 was running back in August 2013 to see if there is something.

Scribbled from my SM-N900P using Tapatalk PRO

ELITE TESTER
[Galaxy Note 3 General] htc9420:
Nice. Though I have some doubts, it seems that Knox counter acts solely as a warranty seal. I wonder why did they make it so visible? EG. would've been better if they required a special tool/sw tool to read KNOX bit status ( Sec T Obscurity)....the main proof that the device has been tempered with is the disappearance of knox container. I see no gain in showing 0X1 if TB erases the container....
[Galaxy Note 3 General] lilstevie:
The gain is time. Needing to spend time hooking up to equipment vs booting into download mode is a huge difference.

Also I don't know how they work where you are but with repair centres here there are drop off zones, the CSR at the desk does not have any equipment to do that with, however they can easily boot into download and cite the flag status while booking the device in.
[Galaxy Note 3 General] mahmoud007:
dude are you serious ??

why would Samsung take risk in putting efuse inside device that could cause pretty much electric issues when it does blows ??

beside even if its blown it can be replaced !! I'm an electric engineer and i know how this stuff work on electric side .. on my view if it was electric problem efuse blown means no more electricity come through this path !!

and it will result of some of hardware stop working ... but can be fixed by replacing it !! not by changing the whole main board !!

the problem gotta be more deeper than this
[Galaxy Note 3 General] gazeddy:
Look at pic and avr microcontrollers efuses are used to set configuration bits on them.
[Galaxy Note 3 General] nobnut:
Try reading his post again with a metaphorical hat on and not a literal hat.

I.e. A metaphorical fuse and not a literal fuse :eek:
[Galaxy Note 3 General] bungadudu:
Anyway it's a dumb move from Samsung if they don't have a sw method to reset the counter.

Why never after allow use of knox containers?

And what about the refurbished phones?

And they enraged the community.

DUMB
[Galaxy Note 3 General] mahmoud007:
ahaa so it is programmed fuse after all ...not Blown !! but redirect to another functions ... so as long is programmed one .. it means that it have a memory and can be reprogrammed again ... if knox have an access to this function .. then there is a window to access that fuse
[Galaxy Note 3 General] gazeddy:
Not necessarily it was more in reference to the poster above me stating blowing a fuse will cause problems. Surely if that were the case ALL knox tripped devices would have the same issues not just some of them
[Galaxy Note 3 General] mahmoud007:
the devices whom have wifi issue .. it caused by the rooted rom they've flashed into there devices !!

if they flash the original Rom this problem will be gone !! i faced this problem in the beginning .
[Galaxy Note 3 General] gazeddy:
Exactly and not knox causing it
[Galaxy Note 3 General] vinokirk:
Ill donate $10 here....
[Galaxy Note 3 General] Arymanik:
Yes knox is preinstall in boot loader with specify crypt.

But you must know if we change any files than knox flag up to 0x1.

But if S give us new software than must change everything...

I think you know what i mean :P.

Can you install Windows on any device with this lock boot? No...
[Galaxy Note 3 General] OmarManLover:
I Said No Way!!

why all of you don't convince that we will never ever be able to break the GOD Feature which called (Knox) ?

no way ! , no way ! should I say it more ??!!

Samsung Wins
[Galaxy Note 3 General] ryanbg:
I refuse to give up. I will tear through everything inside and out before I give up.
[Galaxy Note 3 General] _alex74_:
yes being Smart and serious show some proof about, something that is real and documented..... no just few words as you did....

..words of nothing....
[Galaxy Note 3 General] dclarkg:
This should be on a general section since it affects many Samsung devices.

---------- Post added at 09:53 PM ---------- Previous post was at 09:47 PM ----------

I remember when people kept saying that rooting without activating the flag was impossible... and now we can.

Is not a god feature, is just a pain in the arse eFuse... I'm sure is just a matter of time until someone finds a a way.
[Galaxy Note 3 General] djnoicatse:
I've contemplated asking for the thread to be moved but decided on keeping it here. I feel that the thread would have gotten lost in the Android General section (Too many new threads that open up daily) and that could hinder a solution in finding a way to reset KNOX. This is my opinion though

I don't mind people linking this thread to their respective Samsung device forum.

Donations Updated!!
[Galaxy Note 3 General] dclarkg:
I see what u mean but leaving this thread here has the same effect because no one will see it unless they have this exact same device. I have a galaxy s4 and found this thread by coincidence.

I'm not familiarized with the entire forum set up but I think there has to be a mid option, this concerns at least every owner of a Samsung device hehe.
[Galaxy Note 3 General] bungadudu:
Quick thought: this thread along with the thread regarding knox research and the whole knox problem in general should be a topic presented by Jordan in the xda TV weekly videos.

That will sure raise the awareness of this.

Do anyone know how to contact him for this?
[Galaxy Note 3 General] 424778940:
re

I have some idea

1, we need [Developer's board of Qualcomm Snapdragon 800 SOC] and [Samsung N9005 with KNOX 0x01]

2, swap the SOC and EMMC from n9005 to develop's board

3, write a program for developer's board,to find out which efuse , fuse or any etc.(can be come flags) is used.

===================================================================================================

About more direct way,

1, need two n9005 ,one is 0x00, other one is 0x01.

2, remove the SOCs from boards, use something dissolve the package, and use electron microscopy to find the difference between two SOCs

===================================================================================================

If we find the evidence,we can know knox is a hardward flag and how does it work,then have a conclusion about this flag can or cant redo.

if we find nothing,any is not trigger, we can know knox is a softward flag (samsung lie to us) and it MUST can be reset

===================================================================================================

about my opinion, i think we should do it,not just guess and wait long long long time ago,someone take the sam's tool for us to solve this problem
[Galaxy Note 3 General] bungadudu:
http://agapegeek.files.wordpress.com/2009/10/dont-understand.jpg
[Galaxy Note 3 General] Cyenominerva:
I will donate $10
[Galaxy Note 3 General] mahmoud007:
Missing file

without much of starts ...

the reason that we fail to downgrade kernel because there is a missing file that exists only on the Device by stock !!

the official downloaded stock Rom 4.2.2 that we download to get rude of knox seems to have that file missing !!

the file name is

sbl1.mbn

for the new kernel and not exist on the previous Kernel .. as it shown :

this guy tried to downgrade to 4.2.2 stock rom .. as you see Odin was searching on this sbl1.mbn file (mbn extensions are for the Kernel) but couldn't find it ... i think that's what cause the fail in flashing ... i didn't check this particular Rom if it was having that file or didn't ,,,

but what i did check is in this picture :

View attachment 2505142

this is UAE official Rom and as you see on the on left side you find 4.3 JB official rom ( been grabbed from sammobile site ) and on the right side there is what i thought is 4.2.2 JB official Rom ( never thought it has missing files ) and as you see the file exist on the 4.3 JB and not on the 4.2.2 JB ... i liked to share that info with you guys .. but honestly i don't know what to do !! i tried my ass to copy this file to the 4.2.2 version ... but i couldn't do it !! there is must be a Rom that does have that file ... once we find it we can downgrade then forget about knox :victory:

OR

on the pit file remove the section that make sbl1 partition and then try to flash 4.2.2 rom again !!

i never tried this actually but im just making theories .. could be true !!

I gave my s4 to warranty in last try for fixing it for free :crying: