[Galaxy Note 3 General] neoKushan:
Saying that software is the key is all well and good, but you're making a lot of assumptions about how the Knox flag works - when we just don't know how it works.

However, what you're saying about hardware chain of trust is factually incorrect. In fact, it's nearly impossible to create a secure chain of trust without hardware.

Normally, there is a special piece of hardware that has one simple task - verify the first software bootloader, then run it. This hardware is usually somewhere untouchable (by even the manufacturer) such as the CPU and cannot be modified in any way. This way, the manufacturer can change and update their bootloader, but the second anyone tries to modify it, the hardware will fail its digital signature validation.

Normally, the hardware would then refuse to boot the software bootloader but in this instance, the hardware could just be setting the knox flag as 0x1. The bootloader itself might be doing a whole bunch of checks but it's no use patching those out if there's hardware in there to check the bootloader itself - and you can almost be certain there is.

Still, I get what you're saying - who cares about a stupid flag? If we replace the bootloader with our own that just shows the flag as 0x0, then that's just as good, right? That depends entirely on how Sammy decides to handle it. If they get wind that a whole bunch of RMA'd devices have been modified but had a different bootloader installed, then they might well add an extra check during their warranty process. You don't need to do a JTAG to verify the knox flag, all they have to do is check for modified software and I bet you this can be done from ODIN.

I do believe someone has already experimented with modifying the bootloader to do exactly that, but does that really help us? Will that actually prevent Sammy from "finding out"? I'm not so sure it will.

Anyway, saying that you can emulate this hardware - sure, but it's embedded inside the CPU - how on earth do you bypass that? You can't just solder a couple of wires on to the chip.

However, there is another option, depending on where you live. The EU has some pretty stringent laws regarding manufacturer warranties and such. The UK has even more stringent laws for this sort of thing (Google "Sale of Goods Act") - the laws supersede any policies from the manufacturer. If push comes to shove and Samsung refuses to fix knox-flagged devices, there is a legal avenue and perhaps a class-action lawsuit would quickly change their minds. In that scenario, the only problem with hitting the knox flag is loosing the knox functionality - but is that such a terrible thing? Given that knox is meant to be an enterprise grade secure area of the phone, presumably if we can bypass the knox flag, we can bypass knox itself and that makes it more or less useless. Don't get me wrong, I firmly believe the Knox flag should be reset if there's a factory restore, but that's another matter. The knox flag should only be for knox, not your warranty.

Android is open source but it has a permissive license - nobody who uses it has to ever release their code. The Linux Kernel is a different matter and that's why kernel sources DO get released.

Yes it is, you can extract it fairly easily from any of the firmware packs that are freely available. However, as stated above, nobody has found anything concrete within it yet.