yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] neoKushan:
I'm not really sure what you're trying to achieve here, friend. All of the knox stuff that's part of the ROM has little to do with the knox flag. The knox flag gets set to 0x1 before you even boot anything, it happens as soon as you flash a custom recovery or whatever. Since the knox apk's and stuff are largely useless, you can go right ahead and remove them (be careful though) but that's about it. Sticking to the old bootloader seems to have no obvious gain at the moment.

I wasn't confused before, but I am now - you're saying that hardware in a chain of trust is "not workable", yet you're describing exactly the reason why you'd use hardware in a chain of trust. I'm not really sure what point it is that you're trying to make with this.

Stop right there, because this is exactly what Knox is meant to be for. Yes, you can't ever be sure that someone is who they say they are - but that's why you have certificates and digital signatures. This is what SSL does, it gives you a certificate that you can use to prove that the person you're talking to is who they say they are (or at least tries to, assuming they use a decent CA). The point of Knox is so that enterprises can be sure that all their enterprisey stuff (such as VPN certs) are secure. Knox isn't designed to prevent forgeries, it's designed so that people can take their company's critical data and be safe in the knowledge that it's secure and encrypted. IF we can bypass knox entirely, the whole purpose of knox is broken, so it makes sense that Samsung won't let anyone near it if they use custom software - after all, how can Sammy know that the custom build you've just installed doesn't have some kind of keylogging service with it, or a packet sniffer with root access? Think of the knox flag as a tamper flag, if the flag gets tripped then Knox shuts down - as intended.

Why are you still talking about software? The reason you use a chain of trust is to ensure security of the system. Why would you want to run outlook on an insecure system? That doesn't make sense. What matters is that we want to be able to use our hardware however we please without Samsung telling us it has voided our warranty. Sure, if someone OC's their CPU and it fries, then Sammy shouldn't have to fix that, but if I flash a custom recovery and then later my speaker stops working, I should be able to RMA it.

This whole thread is theoretical, at least until someone can say for sure that they know what causes the knox flag to be set. Right now, the best we can do is educated guesses - even what you've just posted there is largely theoretical, though it's probably some of the best chances we've got. Still, I'm not sure I see the point in "fooling the software" - that's still not going to help if Samsung checks for it during an RMA process. All we could get from that is the ability to use Knox and to be honest, I don't think that many people care about it.
[Galaxy Note 3 General] checkmateyou:
I think the total in the title thread is inaccurate since generous Skander1998 upped his total from $40 to $120 in a few pages back!
[Galaxy Note 3 General] Zerqz:
Add 20$ from me. I rooted 3 days before the new root was released :eek:
[Galaxy Note 3 General] htc9420:
Yup. 20 euros for the Knox cracker...and I will keep a 20 bill for me as I will personally send a Knox device flying on a Sammy window. Went today with a friend to pick up a returned S4 with VOIDED warranty because of the Knox flag ( the S4 had some serious 3G/GSM antenna problems). Sammy just simply refused it. Belgium BTW.
[Galaxy Note 3 General] Sonorus:
I think we're just discussing too different points. You seem to be pointing out how such a trust can work. (if you actually trust the end user to use the trusted hardware)

I'm just pointing out that it can easily be circumvented by using hardware that is untrusted. And the other party has no way to know. What i'm saying is that it's ultimately a pointless process. So long as there is open hardware out there, there's no way for this to be an effective tactic.

Security is always a balance. You either allow remote access to data and trust the other party to keep it safe, or you don't allow access and /actually/ keep it safe. (albeit useless). Security is a network of trust, nothing more.

Either way, i think it's just unfortunate that nobody holds Sammy's feet to the coals about breaking the device intentionally with this antifeature. I think under most laws, it would be considered unlawful to refuse warranty for blown fuse which is DESIGNED to blow. If anyone challenges the knox "denials", let me know what precident is set. :)
[Galaxy Note 3 General] micger21:
:cyclops: One day for me!!! 20$ TOO
[Galaxy Note 3 General] Kingybear:
Add me for AU$20.
[Galaxy Note 3 General] mahmoud007:
i saw some posts of many users saying kernel 4.3 can be downgraded using pit file !!!

how true is that ??
[Galaxy Note 3 General] gazeddy:
Im aware its not that easy. Seems like an ideal solution though
[Galaxy Note 3 General] Bitmixer:
back to topic...

I'm in with $20. Where do I need to sign? ;)
[Galaxy Note 3 General] Dral29:
How can "root" damage the hardware?

After the root is where you can have problems and even there. We are in 2014. This site is being up for years. Every single flash instructions has a warning sign!... my point is unless a noob trying to cook a rom with no clue or kernel. There is no way the hardware will be damage by software.
[Galaxy Note 3 General] pitastrudl:
you sure? try cooking the cpu with overvolt and overclock, with root you can also boost speakers to a very high volume and damage them with long period of playing. but this is not the thread to discuss this.

Sent from my GT-I9505
[Galaxy Note 3 General] Dral29:
But is NOT ROOT that damage it. Is WHAT YOU DO that **** up. IF you act WITHOUT IMPULSION and READ BEFORE you start changing stuff. You will enjoy the experience without problems.
[Galaxy Note 3 General] Journyman16:
I might be showing my ignorance here, but I have read quite a number of posts about the Knox bit and what might be done to stop/reset/fix the situation. I'm wondering if the approach is wrong...

Clearly Samsung can do all kinds of things and not trigger Knox to set the bit. New kernels, probably new Recovery, flash updates OTA or from Odin... all these change the basics on the phone and, for Samsung, do it with no 'warranty' impact. So, what is Samsung doing to avoid the trigger? Can't custom ROM's, custom Recovery and custom kernels emulate whatever it is Samsung is doing to update?

Or is that where all the attention is anyway and I've not understood what I'm reading?
[Galaxy Note 3 General] gazeddy:
Samsung files are signed. The bootloader checks the signature. Whereas custom stuff isnt and therefore fails the check
[Galaxy Note 3 General] lilstevie:
You seem to forget the part where the bootloader is signed :) Also an ideal solution wouldn't be "make a bootloader with a virtual fuse set" it would be make one without knox tripping abilities. All moot however as without samsungs private key you will not get it on device unless some exploit like qualcomms faulty ASN-1 parser from a few years back is found.
[Galaxy Note 3 General] Journyman16:
Bugger! :(
[Galaxy Note 3 General] DrawnToLife:
Yes, but they can't control what users do with root so they'd rather not take the risk :/
[Galaxy Note 3 General] jeRrRKKKK:
lets assume for a second that we can unsign the bootloader, what next should be done to reset the switch back to 0x0?

from what i read, there is a symlink that the boot loader reads to show the knox value, somebody has posted that you can edit the file and upon reboot the flag will show 0x0 until the next reboot.

so why can't we have a scheduler to run and edit the flag upon boot up?
[Galaxy Note 3 General] mahmoud007:
Knox

ok so today i got my device back from warranty .. they didn't do anything ~ still knox void 0x1

so i got crazy and tried to Nand Erase All and repartition ... but nothing happened !!

.

.

.

apparently SELinux effect is running on odin mode !!

so we need to focus on shutting down SELinux first in order to remove knox bootloader .

.

.

and one more thing !!

when i tried Nand Erase after it fails on device screen was written in red font SW fuse 3 , Binary 1

.

which confirms that Binary counter is still working on s4 but we need to remove the additional bootloaders first .. starting with SELinux

.

thats why triangle away is not working on knox bootloader because it cant access to binary counters !! SELinux reason !!

and another thing !!

i made my own JIG today with 330k ohm resistor on old s3 usb cable !! :p

after i made it and connected it to pin4 & pin5 , device action was only normal start up and skipping Odin mode !!

so i took a look for s4 origional cable pins !! and here was the surprise !!

Pin4 "ID pin" does not exist on s4 cable !!!:confused::confused:
[Galaxy Note 3 General] geek78:
Triangle away works now with knox bootloader
[Galaxy Note 3 General] rgshah3:
It doesn't reset the knox warranty counter
[Galaxy Note 3 General] geek78:
Yes I know, we are talking about binary counter
[Galaxy Note 3 General] dclarkg:
KNOX binary counter...

eFuse does not necessarily means hardware, S4 with old bootloader do not have knox but if you upgrade to the new bootloader knox ''appears''. I don't think Samsung will build a device already with knox and not include the knox bootloader on it and then release TW updates with knox a year later... IMHO I think that the new bootloader installs the knox container and takes one bit of the memory phone and mark it as an eFuse. They call it eFuse because once burned it can't be unburned but this is not literally, is just to illustrate a state that can't be reversed.
[Galaxy Note 3 General] geek78:
No, read again his post ;)

And knox doesn't seem to be a counter
[Galaxy Note 3 General] dclarkg:
I'm sorry, just read again the post.

I'm not saying it is a counter, I'm saying is not entirely a hardware thing =]
[Galaxy Note 3 General] mahmoud007:
i feel that the only way to reverse it is by downgrading it first ... everything does referring that this counter lives inside eMMC

its like this 4.3 rom have the eMMC writing protection key !!

we need to find or create this key and truly wipe the eMMC ... not a factory wipe
[Galaxy Note 3 General] dclarkg:
Agree, if you can ''add knox'' via new bootloader there must be a way of reversing what he bootloader does, not reversing the counter but redirect it to a new ''dummy'' bit or force it to create a new on with 0x0
[Galaxy Note 3 General] mahmoud007:
not add new bootloader as you saying !! we need to creat a key On the device to disable/control write protection mode !!

by the way eMMC write protection key enable mode prevents any edit on the eMMC "making it read only" even if it doesn't have physical key it can have programmed key that controls it enable/disable witch in our case is enabled .

if im not wrong its possible that key is still inside device and having value = 1 which means enabled

eMMC is no different than flash memory in my opinion .

http://www.anyclub.org/2012/05/how-boot-loader-and-modem-images-on.html
[Galaxy Note 3 General] mahmoud007:
Knox

Hello

So i succeeded on downgrading my Kernel back to 4.2.2 Kernel "unlike what samsung says about downgrading"

but this come up with wifi issue that its Not working at all

This picture i couldn't capture on Odin Mode so i made it with painter

View attachment 2529437

this status did happened when i downgraded my system after Kernel Panic

after odin passes on the start up screen showing as like when i purchased the I9505 ,,, i couldn't capture a picture so :

View attachment 2529401

now on About device this picture does shows that the kernel is officially downgraded back to MGA after it was MK9

as you see SELinux status does say permissive

the last Picture shows the wifi and it does not work at all

so .. yea , it only saying Turning on without actual turning on

so after this whole missup i made of my device i figured out one thing i suspect its true .. which is :

The only Reason why we cant downgrade our devices and why we cant remove this KWV annoying counter is :

.

.

* android 4.3 aboot.mbn file have the protection key to write on the eMMC card , unlike the 4.2.2 aboot.mbn file which i believe it doesn't have this authority !!

* 4.3 aboot.mbn file does have some lines to defined KWV counter and seandroid mode and even eMMC BURST MODE "it does prove that these eMMC counters"(can be removed)

* the pins which some people been talking about and locking kernel does exist "written" in both aboot.mbn files "4.2.2 & 4.3"

* 4.3 aboot.mbn file defined counter value to %x !! i don't know what does it refer to .. electric value ??could be binary value

* bootloader lock value i believe is %d

* the 4.3 aboot.mbn file can be rewrite ... i did a test with rewritten one .. and it did not fail ... but also it didn't succeeded "probably programming fault"

* i believe as long you dont touch the encrypted signatures inside and you edit the readable part "programming part" on this file flawlessly .. i recommend a linux system while rewriting ... your good to go .
[Galaxy Note 3 General] tommyjoesanders:
It sounds like your almost there with the progess. if you succeed are planning too look at other devices with knox?
[Galaxy Note 3 General] censor2005:
mine is only fair for $15.00 directly instant thru paypal
[Galaxy Note 3 General] mahmoud007:
i don't have other devices tho .. i bought this device and got involved with knox and selinux crap .. i just need to back to the old kernel and want everything working "specially WIFI", with fully root access ... not fake uid 0 ~ fake root .

im just looking for a way to do so and dont care about counter .. but maybe removing the counter or resetting it will help to find a way
[Galaxy Note 3 General] catolh:
Im pretty sure this is going to sound dumb, but has anyone checked/looked into/spied on what is going on when you try to start a knox container with 0x1? Knox wont allow a container on a 0x1 device but surely the software must look somewhere for this information, and if that location is discovered, would it be hard to change?
[Galaxy Note 3 General] tommyjoesanders:
It would be nice too see reset counter.
[Galaxy Note 3 General] otakuloser:
$20 from me. :fingers-crossed:
[Galaxy Note 3 General] mahmoud007:
i was testing around 4.3 JB and found out this :

the new Kernel has nothing to do with knox nor SE-Linux !!

Knox is inside 4.3 system img !!

i just tested the MGA kernel with the new 4.3 JB it gives the same knox effect on MK9 kernel

so it does proves more and more that this knox and se kernels are on the emmc card

so that leads to ... we must disable emmc protection and Burst mode
[Galaxy Note 3 General] r3scue:
Add my lucky $13!

knox 0x1 to 0x0 the impossible made probable...
[Galaxy Note 3 General] BrunoWestone:
Hi guys.

I don't know if this helps or not but here are some of my conclusions on the subject:

I have a Jtag Box (Riff Box) and i tested several different things on several S4 With Knox 0x0 and 0x1.

1st Conclusion - Clone or Change the Boolean to 0x0 its not possible since the phone will put counter back to 0x1 again in the first full boot

2nd conclusion - There is a 3rd bootloader (kind of a bootloader) on this new firmware (latest 4.2.2 and on) that creates a secure container using the trust zone, and sandbox security keys and checksums communicating with the PBL (Primary bootloader) and SBL1 (Secondary Bootloader).

3rd conclusion - This container is created not on the first boot after the upgrade (as some say) but in the firmware upgrading process.

4th conclusion - The 3rd Bootloader is not read or write permitted not even with Jtag (At least i didn't found it after 3 full dumps in different phones)

5th conclusion - Once you upgrade to knox secure bootloader you can't downgrade to a un-knoxed bootloader because the security checksum between the 3 bootloader will fail and odin won't flash.

6th conclusion - This is far away the most advanced and secure operating system ever made by Men, but it as is faults. Last week the world found a huge bug in the knox containers that allows data to be exchanged from insecure boot mode to secured sandbox in knox app…

The theory :

The only way to reset knox counter is to "convince" the phone bootloader that it still's in 4.2.2 un-knoxed bootloader and flash a 4.3 knox firmware. This way, all the secure containers in trust zone and boot loaders checksums will be recreated, flags inclusive.

I tried unsuccessfully "kill" a knoxed bootloader with Jtag and recover it in a 4.2.2 un-knoxed one but Jtag won't write the new bootloader 'cause apparently this specific address (Bootloader address) is write protected …. :(

I hope this helps anyone, i'm done with this. I'm not a bootloader specialist and i'm pretty sure someone will find the way to reset this.

For now still Samsung 1 - 0 Rest of the World

I'm giving up on this but since i have a Jtag and 198 voided S4 in my office, i'll be available for testing anything on those.

Good luck researchers,

By the way, if it helps click thanks !
[Galaxy Note 3 General] peeern:
5$ :)
[Galaxy Note 3 General] sokrboot:
So its possible that this 3rd bootloader can only be manipulated by OTA perhaps? I read an interesting article on how our phones differentiate and prioritize information/commands from external sources. Basically it states that exploiting cell phones via fake OTA is "easy" and somewhat common because the kernels and Micro OS that are in charge of those are really outdated. Perhaps someone with a reverse engineered cell booster could force a hacked OTA to either make changes to or find out more info on this 3rd bootloader. If I had the know-how I would certainly try, but this is not my area of expertise! ;) I could barely regurgitate the article I read and I probably missed something important in THAT! LoL
[Galaxy Note 3 General] mnasledov:
Doesn't the OTA still have to be signed and checked the same way in the end? I have a Cel-Fi so if there's anything special to be done with one, in theory I could see to it. I'm not quite convinced though.
[Galaxy Note 3 General] sokrboot:
This isnt new but with devices becoming so secure in other respects, maybe more time can be /should be spent on this type of exploit research...

http://www.fastcolabs.com/3021962/secrets-from-your-smartphones-other-os

I see lots of different terminology being used like baseband, micro os, micro kernel but they kinda circle back to this same idea.
[Galaxy Note 3 General] roger321974:
i think knox counter cant reset forever. root with knox 0x0 is since mj3 to future impossible. downgrade impossible. no guy cant help. i give up. and when its hacked its time for note6.
[Galaxy Note 3 General] EnhancerFIN:
There is this Samsung document which contains howto for unbricking phone by forcing it to load bootloader from microsd card. Could this be used in downgrading?
[Galaxy Note 3 General] BrunoWestone:
That only work in S3 I9300 Variants. That procedure is made because Samsung S3 doesn't have any jtag pin connections and that method is the only way to recovery dead boot phones. All the other Samsungs (Including the S3 I773 Verizon) have the Jtag pinout.

But following your brilliant idea, let me tell you that in a Note 3 and S4 i already try unsuccessfully to overwrite the bootloader . It's write protected i think :(

Samsung 1 - 0 Rest of the world
[Galaxy Note 3 General] ghibli3:
I have hard bricked my note 3 just downgrading bootloader rewriting all files *.mbn; unfortunately I sent my phone to service too soon, because only after I saw the methods to wake up

Anyway i think hard brick can mean that really bootloader and all *.mbn files have been rewritten in my phone!

So my crazy :victory: idea is that can be a solution: voluntarily cause the hard brick downgrading bootloader (not with odin), then wake up phone and at the end reflashing old firmware with Odin

The best would be wake up phone flashing with QPRST a file (of old version firmware) that include memory from start to the end of tz and so including gpt table, pit table, apnhlos, modem, sbl1, dbi, ddr, aboot, rpm and tz; for this i am looking for QPRST files for my phone MSM9470!

Waiting my phone....
[Galaxy Note 3 General] dEATHfLOWEr:
I'm not sure what you mean exactly. Especially with the second part of your message. Have you already tried to use the MicroSD boot procedure to attempt downgrading the bootloader?

The method itself, which EnhancerFIN described, is succesfully used to revive hardbricked Note 3's in this thread:

How to Unbrick a Hard Brcicked T-Mobile Note 3 SM-N900T

If only this method could be used the flash back an older bootloader :confused:.
[Galaxy Note 3 General] mahmoud007:
Knox

THIS BEEN TESTED ON Galaxy GT-I9505 DEVICES

Ok so i decided to tell you the way to downgrade your s4 to previous version 4.2.2 but i'm telling you now wifi will not work because apparently it attached with the KWV flag and 4.3 version !! im not sure about sound but it may crash along with phone dial up , also there will be a memory drop down correction : memory wont drop ... its already dropped down from 16 gb but i forgot about that ..sorry :cowboy: and i think no sound problem will be there because i am the one who broke it by unsafe and repeatedly flashing odin

so you decide either do it or not do it :

This wasTested on MGA downgraded from MK9kernels ... not sure about other kernels

1- Download your country 4.3 JB version from Sammobile

2- Download your country 4.2.2 JB version from Sammobile

3- Download this file View attachment sbl1.rar

4- Download Odin and extract it View attachment Odin307.zip or any newer version

(Now the Hard Part )

5- IF you have Linux system you dont need this step otherwise download this program and install it Cygwin

6- Extract from 4.3 JB the folowing files : aboot.mbn , tz.mbn

7- Extract from 4.2.2 JB all the files Except aboot.mbn , tz.mbn

8-

...a -Extract sbl1.mbn file and gather all the extracted file in one direction "FOR LINUX USERS"

...b- Extract sbl1.mbn file and gather all files in C:/cygwin/home/'win_user_name' just cut & paste all the extracted file there without making any folder "FOR WINDOWS USERS"

9- now open linux termenal or cygwin and type these codes :

this first code for linux users

cd [I]'folder direction'[/I]

chmod 644 aboot.mbn boot.img cache.img.ext4 hidden.img.ext4 modem.bin NON-HLOS.bin recovery.img rpm.mbn sbl1.img sbl2.img sbl3.img system.img.ext4 tz.mbn

tar -H ustar -c aboot.mbn boot.img cache.img.ext4 hidden.img.ext4 modem.bin NON-HLOS.bin recovery.img rpm.mbn sbl1.img sbl2.img sbl3.img system.img.ext4 tz.mbn > s4.tar

md5sum -t s4.tar >> s4.tar

mv s4.tar s4.tar.md5

10- open Odin and install the new Rom you just instructed s4.tar.md5 in PDA or PA , you will find s4.tar.md5 Rom in the same direction of the extracted files

11-restart your device and after it vibrate press Volume Down + Menu Button will show Download Mode press volume Up and connect your device through origional s4 usb cable to PC

12- on Odin Hit start .. and your done !!

13- if someone find solution for the wifi and sound issue please let me know

PS: this does not fix the counter Issue this only will downgrade your s4 to 4.2.2 official !!

HIT THANKS IF THIS HELPS PLEASE :good: :D
[Galaxy Note 3 General] johnnydj:
I had a discussion with one of my collegues friend, who is in charge of the Cloud systems and Head of Note 3 models. (yes we all work at Samsung)

and I'm sorry to say but after the conversation, the only way is to fully replace the main board (or replace the chipset on the board if you have the technology :) )

Their software team often ****s up boards too and they just recycle the boards because it is faster and cheaper for them, instead of replacing the whole chipset on a board.

So yeah... no Knox reset for us, but keep looking if you guys want.
[Galaxy Note 3 General] ghibli3:
Is a way for downgrade system 4.2.2 i hoped for downgrade bootloader...:)
[Galaxy Note 3 General] mahmoud007:
it also downgrade the bootloader and give you selinux permissive mode