yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] mbat64:
reset knoxhi

all of page?

does not a fix stracture?
[Galaxy Note 3 General] perissatto:
Dude....

There is no solution available yet.

Enviado de meu SM-N9005 usando Tapatalk
[Galaxy Note 3 General] st3chn0:
I agree samsung mobile will soon start going down the drain just like Apple are. Getting too big for their own boots and no longer thinking about software that will help the usual end consumer
[Galaxy Note 3 General] ceftriaxone:
No way for now.
[Galaxy Note 3 General] Shreqg2:
I have called Samsung in Poland today, and the man told me, that resetting KNOX IS POSSIBLE, but only with full wipe of the device and reinstalling firmware from scratch. Here in Poland this can be done ONLY IN TWO (the biggest) repair services.
[Galaxy Note 3 General] nfribeiro:
I've been doing this for years... :D
[Galaxy Note 3 General] Shreqg2:
I don't know what exactly he meant. Few minutes ago I called one of this repair services too. They told me the same - IT IS POSSIBLE with reinstalling the firmware. Maybe they are using some other tool, not ODIN or some "special" firmware. :D No idea.

But I hope that what i wrote could help somebody here. :P
[Galaxy Note 3 General] amosolidu:
Maybe they use heimdall or something ????
[Galaxy Note 3 General] vonderaelic:
Samsung won against Nox but you can pay me

Have any of you tried using the built in firmware recovery tool with keis3? if you can get your phone to turn on, samsung will reflash your firmware to stock. Official. Like new. They used to only do this for updates but you can now do it whenever you want.. so long as the phone turns on. So whats the point in tricking your hardware? If the phone wont turn on you will get a new one. If it will turn on you yourself can fix it. So who are you trying to fool... and why?
[Galaxy Note 3 General] IOU-1:
Tell him that there's a bounty worth $3000+ he might provide you the complete details and "tools" needed. ?
[Galaxy Note 3 General] Shreqg2:
Haha for sure ! :D
[Galaxy Note 3 General] IOU-1:
Dude are you sure you're on the the right thread? This is about finding/developing ways to reset knox counter. ?
[Galaxy Note 3 General] Qobok:
If someone has a knoxed device please try the followings:

1) Flash via odin the latest firmware you had before rooting or tripping knox flag.

2) After the phone turns on go to Settings/Accounts/Backup and reset -> Factory data reset -> confirm.

Wait for the phone to boot.

Go to recovery and check if the knox flag is 0x0 if is not 0x0, restart the phone and go to Settings/Accounts/Backup and reset -> Factory data reset -> confirm.

And for the guy who created this thread send the money to this or this.
[Galaxy Note 3 General] IOU-1:
I can't try, I care more about the files on my device than my knox counter ? but if this solution works, I'll donate my $13 pledge to unicef. ?
[Galaxy Note 3 General] midyat47:
Have someone tried that?
[Galaxy Note 3 General] jonboyuk:
Really? Surely you'd create your own thread for making such a sought after discovery? Can you prove that this method works? If it does, well done sir. If it doesn't, stop trolling! Anyone who's tripped it fancy a go?
[Galaxy Note 3 General] bungadudu:
Don't need to be so harsh.

He sincerely tried to help and asked for nothing in return.

Thanks for sharing, but unfortunately resetting the knox counter is not so easy. :(
[Galaxy Note 3 General] Qobok:
If I understand correct this thread is to reset knox on a rooted device. This means that if the phone is used in to an enterprise environment somebody will be able to read important information by breaking the security and after by resetting the knox counter everything will be ok...

My understanding is that knox is there to protect the data. Samsung framework is heavy integrated with control solutions for enterprise. Have a look on Airwatch, check what's new. Airwatch is enterprise platform for remote control and not only.

The reset of the knox should be quite easy as long as the phone doesn't have any trace of "malicious" software. link
[Galaxy Note 3 General] Riskytwin:
Are you sure? If that's true you're a hero. If you're joking, better pack your luggage...

Risky's my name
[Galaxy Note 3 General] newxdabie:
are you going to try? :angel:
[Galaxy Note 3 General] Riskytwin:
You do it and tell :D

Risky's my name
[Galaxy Note 3 General] newxdabie:
yeah, thats good idea, if where me, i would take it, why not? it is $3000+ clean
[Galaxy Note 3 General] adilrenzu:
really dude, i mean really.. anyways doesnt work
[Galaxy Note 3 General] ReNeH99:
i like his idea to send the money to unicef
[Galaxy Note 3 General] frostmore:
*giant facepalm*
[Galaxy Note 3 General] bonustokin:
I think if there was a way to reset knox, we'd have it by now. Im not holding my breath for this hahaha.
[Galaxy Note 3 General] newxdabie:
yes there is, but how...still a question... it takes 7 or 8 months and still nothing yet....wait for someone somehow to leaks the "tool"
[Galaxy Note 3 General] mahmoud007:
if someone have i9505 4.2.2 JB rooted

install busybox

install terminal or use adb

and write these codes :

# su
# dd if=/dev/block/mmcblk0p6 of=/storage/sdcard0/aboot.mbn
# dd if=/dev/block/mmcblk0p8 of=/storage/sdcard0/tz.mbn

and then go to phone memory then youll find aboot.mbn & tz.mbn files

please send them to me or post it on forum
[Galaxy Note 3 General] dawgboy1783:
Has anyone tried to root de la vega pre 4.3 then use root explorer to delete anything knox? Would this trip the counter? Im thinking it will since your not actually removing the bootloader but wouldnt you be removing the software trigger part of it?, or is that kinda like a virtual trigger during boot?, I'm still 4.2.2 untripped on note 3 and s4 haven't tried myself but what do you think?
[Galaxy Note 3 General] hey_joe:
I don't remember note 3 having 4.2.2 as it shipped with 4.3. Maybe the s4 did.
[Galaxy Note 3 General] dawgboy1783:
Yes my friend you are absolutely correct I stand corrected thank you. :D
[Galaxy Note 3 General] alesa1988:
[MENTION=3242193]Qobok[/MENTION]

On the contrary.... I do not use my phone for anything enterprise related... The reason I wish to fix this is because I have had dead pixels from the day I got the device and it clearly says 'knox warranty void ' I was never expecting this to occur as the first thing I did when I got it was root it... Never had an issue on my previous S III Mini. And if you trully believe that the fix is easy as you stated please add details as to what made you come to this conclusion... Almost everything points to an eFuse and that is no easy fix....
[Galaxy Note 3 General] dawgboy1783:
A was just putting bits and pieces together from all the info out there and sharing my 2 cents :D
[Galaxy Note 3 General] Shaun--77:
if you got it from a store that isnt a carrier, then take the warranty to them. for example if you bought it from asda/walmart then take it to them and do warranty. they usually don't check for warranty. if not then you are stuck. maybe i helped! :good:
[Galaxy Note 3 General] gencho81:
hi i am owner of n7100 with knox bootloader.i have a friend with n7100 without knox bootloader.

So i have 4 partitions more than him.He have loop0 and dm-0 with size 7308. i have loop1, 2 , 3 and dm-1 , 2 , 3.

all other partitions are with same names and size.

Any idea ?? can be one of them the blocked knox???
[Galaxy Note 3 General] alesa1988:
[MENTION=5009386]Shaun--77[/MENTION]

You are a legend!!!! They had no more black front screens, so they put a white one on, which honestly looks a lot better with the pink S-View cover.... Thank you so much :))

I still commit to my due in the bounty as promissed. But yaaay my issue is resolved.

Edited: typos
[Galaxy Note 3 General] madlag:
Bump
[Galaxy Note 3 General] mr sharpey:
Great thread idea!

I'm happy to donate $30 - put my name down please! :good:

I have an S3 LTE (I9305) on 4.3

Didn't read about KNOX and just wanted to check out 4.3. Tried to go back to my custom ROM and Knox 0x1 prevailed.
[Galaxy Note 3 General] ceftriaxone:
Just came back from Samsung repair service in my country. Having problem with my home button being stuck.

Anyway, I asked him about knox. He said it is software thing, and it is possible to reset it. He mentioned some BOX (forgot to ask him if it was some software or hardware). He also said, that when you update OS version, you need new box for knox reset. Hope someone will find this useful.

PS I have already read somewhere something like this.
[Galaxy Note 3 General] georgesmh:
just a question... i heard that the Exynos Version (N-900) does not have knox warranty void bit 0x0 or 0x1. is that true? If yes, they won't know that the device is played with if we flashed the original stock firmware... please clarify this
[Galaxy Note 3 General] TheBeci:
Its not true.

All versions of note 3 have a same program with knox flag 0x0 or if you put an Nonofficiall firmware then you can void warrantly and knox flag will be 0x1
[Galaxy Note 3 General] bungadudu:
Would be awesome if you could say in which country and service you acknowledged this.

Would be even better if you go back and try to get more info about this or maybe someone else will.

There were other similar reports but no-one is willing to follow this leads :banghead:
[Galaxy Note 3 General] alesa1988:
[MENTION=4484617]bungadudu[/MENTION]

I think I should add, that I did ask too when I got my screen repaired, though I was somewhat indirect about it... (Didn't want them saying that my warranty was void and leaving me with a faulty display... Excuse my paranoia.) They said it was a security thing for businesses and I shouldnt use it, thinking they may not have had much of an idea what I was talking about... It was an official Samsung store in Spain.
[Galaxy Note 3 General] ceftriaxone:
Serbia. The guy told me that they don't have BOX thing here. I will try to get some more info when I go there to pickup my phone.
[Galaxy Note 3 General] Sultanali:
Looks like we are really close. :thumbup::)
[Galaxy Note 3 General] theunderling:
It also looks like mugs are using this thread for posting any old crap now.
[Galaxy Note 3 General] Shaun--77:
No problem. ive had to do few myself and ive rooted every time. also there is a thread about the s view cover wiping away the oleophobic coating and scratching the screen so id be careful as not to damage hat precious new screen!:good:
[Galaxy Note 3 General] htc9420:
:(Bad news,

According to this

http://forum.gsmhosting.com/vbb/f672/easy-jtag-1-0-99-0-new-year-new-revolution-solution-repair-rebuild-emmc-1769456/index4.html#post10054176

KNOX bit is located on RPMB [Replay Protected Memory Block] on Exynos devices...not good ...not good...it's virtually impossible to touch RPMB without the specific key
[Galaxy Note 3 General] JonSCSL:
Is that the same for the Snapdragon US variant?
[Galaxy Note 3 General] st3chn0:
Well just adding my thoughts to this since rpmb is really to comply with phone theft rules compliance something (Google rpmb first pdf document)

Would the data for the reactivation lock stored in the same sector? There's been document leak of what needs to be done to reset that. Maybe using some aspects of that to see what is actually changed may help further development on resetting the knox counter?
[Galaxy Note 3 General] htc9420:
Well, to do further explaining.

I guess reactivation lock is a much more lighter kinda of security...

In order to generate a valid WRITE message for the eMMC controller, we need a valid certificate. Those kind of certificate are really hard to be found, sometimes even Sammy doesn't have them( most likely the eMMC manufacturer has them in pairs, for enhanced security reasons they are individually linked to serial of the chip-for this part I can only assume). For anyone familiar to TPM chips, RPMB is almost the same for NAND.

Anyway, this scenario makes sense with the reports of people having the KNOX reset. The tool goes online, finds the cert+address of RPMBlock according to eMMC data, generates a valid message with a valid MAC...rewrites the RPMB... Anyway, MAC includes the successful writes counter, counter is linked to HOST( also that counter cannot be reset most likely), and all of this cr@p is almost untouchable unless someone shadows the auth server, LOL.

This is why rewriting the the eMMC gives a bootloop as the address of RPMB is not public and for surely is not accessible during third party J-TAG session. The picture is somehow complete now. Welcome to the security age.
[Galaxy Note 3 General] oddbehreif:
Well that sucks. Kudos for figuring that out, but boy do I hope you're wrong.
[Galaxy Note 3 General] letama:
Well, yes, but as the bootloader by itself is able to write to rpmb to set counter, certificate has to be on the phone. No way that bootloader goes online to grab it from external server...
[Galaxy Note 3 General] htc9420:
Yeah, it really sucks ( from our POV, for the rest it's a good security implementation). But wait, not all hope is lost...at least for the other devices such as Note2, SGS4...they got OTA knox and everything OTA is more vulnerable. Sadly, our devices came with KNOX implemented...chances are quite slim...and if someone makes is real....the 3k from here is pennies compared to what he would earn by, for example, dumping the keys from XBOX one/PS4 ( almost the same security approach).

There is a difference between READ and Write message= nonce vs cert. A valid bootloader only reads a value from RPMB, and compares it to the system image secret hash. If returns false, it boots with the flag knox tripped-and it could set its own flag also. The primary bootloader is locked by Samsung. If we mess with the bootloader, we end up with a brick due to secure boot. By version architecture , there is a XLOAD write protect implemented and the bootloading sequence is write protected until the HW reset by means of online tool. This is where the KNOX flag rests. The local cert is stored only to set WP flag but it cannot revoke it.

WE ARE NOT DEALING WITH STUPID/SLOPPY WORK. This wasn't made by Samsung, it was made by JEDEC and Sammy is implementing the features. The security feature were avail since 2011, but Sammy never used them because it didn't have to. They are going into the secure BYOD niche, hence the need now. It takes a huge sum of money or some kind of mad genius revenge attitude to achieve cracking this kind of security.
[Galaxy Note 3 General] Olleo:
I think research should go into three different directions:

1. unblocking the bootloader (this topic and several in pararell)

2. rooting without tripping the KNOX flag (no matter if it unblock the bootloader or not) for those who are not interested in custom ROMS, but are willing to use applications requiring root rights

3. finding out other way than root rights in order to make some of the applications working

I am not sure if 2 and 3 are ongoing somewhere, but I know that backup&restore aplications require root and I recall one application that does not require - Helium. Instead of rooting, an additional action from PC via USB connection is required. Maybe that's the alternative to root for all other applications?

I own XCover 2 and SGS2. First is stock, second has stock ROM but rooted. I don't have time to root XCover 2 even there is a way (no KNOX onboard), but would make use of root - call recording, backup&restore, no sound while making photo etc. The same purposes made me to root SGS2 and the same I would need for Note 3 which I am buying next months. Without root it makes no sense for me at it's going to replace SGS2 - not the XCover 2, which I use as a regular phone.
[Galaxy Note 3 General] hey_joe:
I read on the Canadian users forum that if you have a Knox 0x0 and on 4.3, when you update to 4.4.2 using the Mexico release and certain pit file for N900W8, you can root, flash CWM and use custom rom and still Knox will remain 0x0. Maybe there's an exploit/bug there that someone can use to know more about Knox or at least help for other phones to avoid tripping it.
[Galaxy Note 3 General] rodrigorajao:
Social engineering

This could be viewed as a dumb idea, but has anyone tried some sort of social engineering at the local store or repair center? Since some people think that Knox is software-based and it can be reset in-store, some kind of social hack is possible in theory.

Call a service center and say you're a fellow tech from another service center and is in doubt about the procedure to reset a customer's Knox flag and need to be walked through the steps. Get someone who's not the sharpest knife in the drawer to spill the beans.

It was a silly example, but the possibilities are endless...
[Galaxy Note 3 General] Killberty:
Please Link where you read this.
[Galaxy Note 3 General] mahmoud007:
cant we extract the certificate !! that the one does exist on the recently 4.3 rom ?? 4.3 Roms that have kies supported ?? if they was supported by kies it means those roms does have that certificate right ??

until next upgrade they'll become invalid "theory" .
[Galaxy Note 3 General] dhiru1602:
The certificates are generated using a public key and a private key. We have the public key but we will never know the private key that samsung used to sign them.
[Galaxy Note 3 General] mahmoud007:
no need !! just give it to another previous official rom that have no knox on it ?? worth a shot , dont you think ??

maybe you can also use base64 and chmod and chown you might get lucky in faking sign
[Galaxy Note 3 General] Skander1998:
That's not how it works.

Besides, no Note 3 ROM has no knox.
[Galaxy Note 3 General] _frog hair:
my guy down at the local samsung retailer says they use an unofficial odin version specific made to flash devices with knox. An also the cable used between phone/pc has some "bulky thing" on it. He does not work specifically with this, and is not a techhead like most of us here, but he was willing to investigate further. i allready promissed him 500$ he could get hes hands on it... will keep you guys updated..

Btw as far as i know 0x1flag is not a problem for ANY european customers. Some even with bricks and knox flags are getting there devices fixed under warranty.

//Carbonized from my Note3 via ttPro
[Galaxy Note 3 General] hey_joe:
Been following it from here. Info is scattered on different posts and I suggest reading backwards ( meaning start reading from the last post ) as most of the posts on the beginning is all about note 3 release.

There's also some info here.

Don't get me wrong though. I know the posts I linked to is for N900W8 and I don't encourage anybody to flash anything meant for that phone to their N9005. I'm merely suggesting that since they're nearly identical phones, maybe if there's an exploit/bug found there, it can be replicated to work on N9005 or even better to reverse knox 0x1.
[Galaxy Note 3 General] newxdabie:
we have a bounty $3130, if he could get ou leak the program, 500 dollar will being in his bank as son as possible, but will this special cable being a problem?! will it easy to get....
[Galaxy Note 3 General] Olleo:
Sure, if you are stubborn enough to end up in court.
[Galaxy Note 3 General] EnhancerFIN:
You can always brick the phone with Odin, just flash bootloader. No way to see anything Knox related after that, and warranty will cover it, as you can always play stupid and tell that you were updating with kies etc.

Bricked phone does not turn on even to show the Knox status.
[Galaxy Note 3 General] mr sharpey:
Somehow I don't think you're going to win $3000 with that answer :D
[Galaxy Note 3 General] Olleo:
2588582

It is not easy to brick the phone completely without any chance of recovering it, right? I would have to destroy it electrically.
[Galaxy Note 3 General] EnhancerFIN:
Didn't think that ;).

http://xdaforums.com/showthread.php?t=2609561
[Galaxy Note 3 General] nitrate:
Flash Clockworkmod, select option "format eMMC", be happy with your destroyed phone.

Btw: after the eMMC format, the phone didn't even load the battery when turned off. The battery wasn't shown when the power cord was plugged in. So the hole eMMC was "successfully" formatted.

I did that with the Note's brick bug before. They switched the mainboard - gave me a new one.

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] Ricky Divjakovski:
Hmm I might buy a cheap second hand or even partially bricked S4 to look into this..
[Galaxy Note 3 General] BrunoWestone:
If you put about 30V with 1amp in usb pin 2 and 3 should destroy completely the qualcomm comunitation, making impossible to sammy to diagnose anything.
[Galaxy Note 3 General] htc9420:
I'm also pretty sure that some fuse will blow up and protect the SOC.... we need something more "exquisite" than raw amps on a protected circuit. As a part of quality improvement in manufacturing process, they check the majority of swapped mainboards and parts, just like hospital forensics...

Getting a new device with knox 0X0 falls under the broad spectrum of the bounty, even if it requires an intentional hard brick. The thing is to find a certain way of hardbricking that leaves the eMMC completely inoperable/unreadable. Also, the bricking method would require simple steps, just in case your screen fails...

Fight fire with fire...all sammy did was to place an extra warranty seal. This is a looong and two sided story, though Android is heading the good way, where root is no longer required in order to access useful APIs. Android was like XP where you were required to run as admin in order to install something...and hoards were complaining about lack of security. Things have changed even for MS and it's Google's turn to follow.
[Galaxy Note 3 General] alesa1988:
I agree with most of what you said, except the reasoning for the bounty.... I don't need a tip on social engineering to get a new phone I already knew how to do that before hand, especially if the one giving support is a guy ;) and I believe most will agree. We need a practical solution to repair our already existing devices ourselves so that we may trip it and repair it again and again, like triangle away used to do...

Not to mention that if somehow people decide this is the most canny solution, Samsung will start wondering why so many devices are being returned with an overvolted chipset...
[Galaxy Note 3 General] simon2k10:
Microwave that ****
[Galaxy Note 3 General] kosmasgr:
I think that KNOX will be the winner. So , format emmc on cwm :D

Sent from my SM-N9005
[Galaxy Note 3 General] st3chn0:
just wondering it is possible to wipe everything on the emmc except the bootloader to get download mode then flash stock rom to see if the counters been reset?

sure there must be a possible script that can be created to do this
[Galaxy Note 3 General] jetbruceli:
You know all maybe before we root with the risk of losing our warranties maybe we should really use our devices. Make sure they are good to go.

I have had hundreds if electronic devices and usually the issues come early enough to know whether it's a bad model or not.

As much as I would love to see this reset, I feel it's better to wait out for rooting and flashing till something is done to fix this knox issue or until my warranty comes to an end.

I have to say though living without root hasn't been that bad.

I mainly rooted before to change the look and remove apps but with this note 3 look and huge memory, I don't really see the initial need for root.

Oh well good luck all
[Galaxy Note 3 General] Sonorus:
I would stop using smartphones before i allowed the manufacturer or carrier to dictate what software i put on it. So this is not an option.

There is principle involved here. Do you really want android to become like IOS? We're moving in the wrong direction, freedom is where we want to go!

Aside from that, i use VPN techniques that are still impossible without root. (TAP tunnel over UDP) This is just one "deal killer" for not having a rooted phone. There are other deal killers, and i'm sure many people would agree.
[Galaxy Note 3 General] jetbruceli:
Ok I totally understand and agree. I just think until something comes up to fix this I am going to stay unrooted.

I also will definitely be rooting as soon as the updates stop and need to move over to cm