yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] :
I think, this is a great idea, but i don't think, that this is a fully solution for the KNOX-problem. Because if you have to give your device to Samsung for any repair, then they would see the tripped flag.

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] bungadudu:
How would they see it if in download mode all is official and knox counter clearly says 0:0?

Of course a method to reset it is better but this is as close as it gets.

/Let aside many of them don't bother to test things and just replace the owner called defective part.

//Also, don't forget that there are many people who've sent their phone with knox counter 0:1 and it still was repaired under warranty. Part of them got clear response that knox counter doesn't void the warranty if all else is official.
[Galaxy Note 3 General] radicalisto:
Chances are high that Samsung don't just rely on Download mode to see if 0x1 has been triggered. They have different debug software that can probably pick up on it pretty much straight away.
[Galaxy Note 3 General] :
I'm sure, that root is needed, to force the flag at 0x0, and if you send it with root to Samsung, they will detect it.

Or if it works without root, then Samsung only has to flash the firmware (they do this ALWAYS at first, then they get a broken device) and they will see the tripped flag.

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] bungadudu:
So they would trip my counter which previously showed 0? Not cool :rolleyes:

Anyway, for now this is just chit-chat..

Maybe a solution to reset it will appear and we all will be happy.
[Galaxy Note 3 General] radicalisto:
Just to weigh in on this part, Samsung UK won't repair any KNOX 0x1 devices, under warranty or paid by end user.

Original thread

http://xdaforums.com/showthread.php?t=2542127

Updated after Samsung tech has confirmed.

http://xdaforums.com/showthread.php?t=2547223
[Galaxy Note 3 General] bungadudu:
Samsung uk just repaired a note 3 with knox 0x1

->
[Galaxy Note 3 General] radicalisto:
Ahhhh hmmm, now that's interesting for sure, seems Samsung UK service centres are third party therefore it must vary between each shop which undertakes the repairs. -- Would be nice if Samsung officially cleared it up still.
[Galaxy Note 3 General] bungadudu:
And if they would say knox 0x1 voids the warranty?

This situation of uncertainty seems pretty good for us for now..

There was some talk about the apparent method Samsung uses to reset knox (special jig and a password).

Let's just pray it will escape in the wild.
[Galaxy Note 3 General] radicalisto:
Indeedy. I think when they manage to downgrade it (however they do it at their location) - it must realign to a new eFuse (if indeed it is eFuse tech used) if not, then the reason they lock downgrades is because it resets KNOX somehow if you can do it.
[Galaxy Note 3 General] bungadudu:
I'm just amazed no-one works as a Samsung technician and/or no-one knows such a person to share anonymously the know-how about this.
[Galaxy Note 3 General] radicalisto:
Not sure it'd be allowed on here if someone did reveal info tbh, A dev would have to post how they broke it down and discovered it, XDA would risk the wrath of a big company and would have to adhere to pulling the post(s) (remember the Beat By Dre posts that were removed)

I agree though, seems like not many are in-the-know regarding KNOX and Samsung issues.
[Galaxy Note 3 General] testadeferro:
You never know the names nor who leaks softwares. Is the same.
[Galaxy Note 3 General] bungadudu:
You forget about triangle away which did the trick for years.

Someone could send the details to Chainfire for a triangle away v4 which would help the many. But they don't :(
[Galaxy Note 3 General] :
[MENTION=4872224]yashade2001[/MENTION]

Do you exactly know, on which partition and on which sector the KNOX-flag is stored? :)

You wrote, that it is stored in a sysmlink file, but how could it be in an symlik file? I thought, that a symlink file is only a link to a partition on the eMMC?

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] dpeddi:
I'm thinking that bootloader may protect read/write of address uned by knox. I had some headhake with stb and mipsel

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Galaxy Note 3 General] yashade2001:
It's mmcblk0boot0 file i think. Or it can be mmcblk0...
[Galaxy Note 3 General] :
Thank you. :thumbup:

Can it be, that in mmcblk0boot0 also the custom binary counter is stored?

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] tcntad:
Whynot. This isnt my area of expertise at all:P But if knox is why cant the counter be?
[Galaxy Note 3 General] ddogishere:
Speaking to a Samsung technician the other day about knox and bootloaders he said this...

For the last couple of years the major manufacturers(i.e Samsung, HTC etc) have incurred substantial costs due to people deliberately tampering with their bootloaders... then playing dumb to activate their warranty when sh*t hit the fan....

So now the major companies are saying enough is enough and securing their product against this...

Then I retort with this to see his response; 'but I paid for it I should be able to do whatever I want'.... His response; you can't have your cake and eat it...you paid for it so when it
[Galaxy Note 3 General] elevul:
If you damaged the hardware, then you have no right to warranty, but if you made software changes they have no right to negate you hardware warranty.

Even if we consider overclocking and overvolting, it would be trivial to solve that problem as well by simply limiting the max voltage.
[Galaxy Note 3 General] Mittaa:
We need the word from lawyer or court that hardware warranty stands, even if SW is altered!

$amsung will

not

give us a clear statement ... they don't care about anything but protecting business ...
[Galaxy Note 3 General] :
We need a KNOXAway app. Discussions about waranty are have no sense, because in every case Samsung say different things.

Where is our hero Chainfire? Yashade found out, where the flag is stored and I think, that now Chainfire could help him to make an app to reset the flag.

Chaaaaiiiiiiinfiiiiiireeeeee, where are you???????????????

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] Mittaa:
Chainfire hands full with SuperSu :laugh:

But true ... we need one like him :good:
[Galaxy Note 3 General] :
I -and many others- don't need SuperSu, if there is no way to reset KNOX. :D

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] Coolmfarshard:
Edit
[Galaxy Note 3 General] elevul:
There is, in Europe:

http://piana.eu/root

:laugh:
[Galaxy Note 3 General] testadeferro:
You can easily go against EULA in Europe. Just claim that before buying there's no way to read it. Because EULA isn't nor out of the box or inside the box. As you buy the phone and open it you can't just retrieve the same just because you don't agree with the terms and conditions.
[Galaxy Note 3 General] Mittaa:
Thanks ... now we just need Samsung to read it too ... :D
[Galaxy Note 3 General] eybee1970:
a good friend of mine has great contacts to Samsung Mobile...he helped me a lot on Note 1....so I wrote him to get some information....hopefully he can help. I will come back here as soon as I get more...
[Galaxy Note 3 General] FireWall123:
Eyeball :D

You got a note 3 ?

Sent from my Note 3 powered by Omega v4.0

Vocaloid fan? Check out this thread!
[Galaxy Note 3 General] BrunoWestone:
Address needed

Hello Guys, i have a JTag working on the I9505 and i was wondering if someone knows the flash address for the mmcblk0Boot0.

Can you share it here pls.

Thanks

---------- Post added at 01:08 PM ---------- Previous post was at 01:00 PM ----------

Any luck with the address? Can you share it please.

Thanks.
[Galaxy Note 3 General] :
I don't know the adress, sorry. :(

Have you tried to downgrade the Bootloader with your JTAG on I9505?

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] BrunoWestone:
I'm trying as we speak.

I'll post the result as soon as i have any conclusion.

Thanks anyway.

---------- Post added at 06:48 PM ---------- Previous post was at 05:57 PM ----------

Hi guys,

first let me tell you that this knox security is definitely NOT an eFuse.

I just dump the full flash from one not voided phone to another voided and the voided stays 0x0. when i reboot the phone it was 0x1 again.

So what's happening is that the secondary bootloader writes the 0x1 again.

It's a start….

I'l let you know more as soon as more conclusions pop-in.
[Galaxy Note 3 General] :
Thank you for trying.:thumbup:

Have you also tried, to downgrade the Bootloader?

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] BrunoWestone:
I've made a full backup of the efs and i'm erasing full flash (14.4Gb). It's taking a wile, i don't' know if it's quite normal.

When finished, i'll try to flash the 4.2.2 boot loader, and do a phone resurrection. hope it take us to any lead...
[Galaxy Note 3 General] Killberty:
Of course ita not an eFuse on your S4, they didnt plan knox when they released the S4 - what we wanna knox is: is Knox an eFuse on the Note III

hit 'thanks' if i helped you

SM-N9005 DBT-DMJ7 0x0

XDA Developers 4 premium app
[Galaxy Note 3 General] BrunoWestone:
Am i in the wrong post ?? i though this was about Samsung Knox security, not Note 3 specifically.

But let me tell you that almost all Samsung's came with un-used eFuse's that can be activated by a new firmware.
[Galaxy Note 3 General] :
Everything is ok. In my view they should move this thread away from the N3 forum to somewhere other.

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] bungadudu:
This would equal changing the emmc, right?

So if there is no e-fuse, at the end you would have knox 0:0...

And if you still have 0x1... we're doomed... right?

Praying to all the Gods this would end well! :thumbup:
[Galaxy Note 3 General] gazeddy:
if this procedure is successful would i be correct in assuming its still out of the reach of us mere mortals without specialist tools?
[Galaxy Note 3 General] Killberty:
Yes... seatch jtag samsung in youtube...

Crazy ****...

hit 'thanks' if i helped you

SM-N9005 DBT-DMJ7 0x0

XDA Developers 4 premium app
[Galaxy Note 3 General] frostmore:
As of now,we are pretty sure knox is software triggered in models before N3.so its just about finding where the information is stored in the emmc and rewrite it.

as for note 3,i highly doubt its an efuse on the hardware side. i read on this forums on another thread, in the EU, seller must provide warranty for hardware defect and if efuse is used for the note 3 in the EU market,imagine the huge amount of losses for samsung if ppl starts tripping it.

(http://xdaforums.com/showthread.php?t=2484240)

Samsung,like any other huge multi-national co. are not that industrious enough to build in a hardware linked efuse into all note 3.that would increase production cost and warranty costs as well since the only way to reset this efuse is either replace a new motherboard(expensive) or rewrite the efuse info elsewhere (cheaper alternative). if its the latter,that would mean its software triggered and can be reset with the right info but still run afoul of the EU law since the hardware defect is still there and they sure as hell do not want a PR nightmare over a silly efuse.

my opinions are jus speculations at the moment.i may or may not be right.but i do know how a biz person thinks.and if they can take the lazy man's shortcut and get high returns,they will take it.given the phone market nowadays,they are all abt keeping production costs low and profits high.building in a hardware efuse is about the dumbest thing they can do right now.

---------- Post added at 06:13 AM ---------- Previous post was at 05:59 AM ----------

its like triangle away all over again.

This was how CF found the binary check counter when he compared GB with ICS.

if you are right on the ball,all we need is to locate the knox counter and all the security checks in the bootloader to end this knox horsecrap once and for all.

seriously,knox is telling me what i can or cannot install on MY fone and can even go as far as prohibiting me from using MY own network.

last i know,i bought the fone,its MY fone and i can do WHATEVER I WANT with it.
[Galaxy Note 3 General] BrunoWestone:
Ok Good news and potential disturbing one's !!

The good is that as previously stated, when we dump the flash the security stays 0x0 until you remove the battery and reboot the phone witch is consistent with an existing of a secondary bootloader that writes the security bit again on the primary bootloader.

The pontencial disturbing one's is that even after a full flash erase and a phone resurrection ( that consists in write a new bootloader, partition table and other essentials to recover the phone) the fu*{} phones remains with this stupid download mode showing security 0x1.

How's this possible ??? I'm running out of ideas guy's….
[Galaxy Note 3 General] danieljamie:
Maybe the bootloader checks if the efuse is blown or not. So writing a new bootloader and flash contents won't change anything. You would need to modify the bootloader to stop checking the efuse.
[Galaxy Note 3 General] geek78:
So no way for people yet with Knox 0x1 but maybe a way for the others by writing a new secondary bootloader and finding a way to flash it without triggering knox ?
[Galaxy Note 3 General] bungadudu:
We need [MENTION=631273]Chainfire[/MENTION] , [MENTION=2348906]designgears[/MENTION]
[Galaxy Note 3 General] eybee1970:
subscribed!

...or the leaked SW from Sammy to reset...if there is any and hopefully standalone and not any web application on Sammy servers with TANs or whatever to use it...
[Galaxy Note 3 General] BrunoWestone:
Not quite true. as soon as we know what to do and if the solution is user accessible (Odin flashbel) we just need to create one .tar file and share that with all you guy's.

For now let's just all hope that someone gets to that point.
[Galaxy Note 3 General] bungadudu:
There was some talk about what samsung uses to reset knox: a special jtag with a password. But no one knows for sure and no one wants to tell more about this.

I'm sure the great minds from xda would succed if they'd joined their forces though it seems they jumped the ship and left us on our own... :(
[Galaxy Note 3 General] frostmore:
are the system dump from the same fone?

if they are,all u need is a tripped and before tripped system dump to see what the changes are and try to locate the the knox information.

as of now,no one knows how knox checks to see if you have tripped the efuse.check done could be the imei,scs files,primary/secondary bootloaders,phone serials etc.

i think some of the information is stored in the emmc chip itself that cannot be written once knox trips it...yes,even a full phone resurrection with odin. or jtag.

any expert would like the shed light on this?
[Galaxy Note 3 General] alexkum:
I personally think you should compare the dump file with a phone which already tripped the knox but samsung reset it back to zero with another original phone
[Galaxy Note 3 General] dpeddi:
May knox check for emmc serial number too?

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Galaxy Note 3 General] BrunoWestone:
Yes i will do some of those tests/experimentals tomorrow.

today i'm busy with HTC 8s flashing:silly:

I'll post results tomorrow.
[Galaxy Note 3 General] Rajada:
See that:

http://www.jedec.org/sites/default/files/Victor_Tsai.pdf

This is about emmc 4.41

S4 uses emmc 4.5

Maybe, when you erase all memory, you don't erase all "real" memory. Maybe, some parts of memory are protected with a manufacturer key
[Galaxy Note 3 General] bungadudu:
Quite possible. Someone said a special "password" is needed to reset knox through jtag...

I still think our best bet is with a friend of a friend who works on a Samsung repair center to spill the beans..

// Also found this

There are some interesting posts on that page, including Chainfire's.
[Galaxy Note 3 General] :
Which bootloader did you excactly flashed? Maybay the phone resurrection flashes a new KNOX bootloader.

If not, i don't understand, how i could be.

On a HDD/SSD in the PC, S.M.A.R.T is also stored somewhere and you can wipe the full HDD/SSD and it wouldn't be erased. Mayby KNOX is also stored like S.M.A.R.T, so that you can wipe the full flash memory and it wouldn't be erased.

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] gazeddy:
Ive been thinking this or knox flag is in the "hard"coded bootloader
[Galaxy Note 3 General] :
But how could this stupid bootloader alive a full erase? This is not possibly, maby only, if it is stored like S.M.A.R.T in a HDD/SSD.

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] bungadudu:
[MENTION=5002182]mike_galaxy_s[/MENTION] [MENTION=3883420]gazeddy[/MENTION]

As I quoted just above your posts, apparently the knox counter should be in a special, password protected location on the Emmc.
[Galaxy Note 3 General] :
But with a JTAG you can write directly on the flash memory, right? And how can there be a protection, if you directly write on the flash?

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] gazeddy:
Reading the pdf posted earlier it reads to me some parts can be password writeprotected
[Galaxy Note 3 General] bungadudu:
Don't know but I'd assume there's a special section of the Emmc read/write password protected.

That person also said replacing the Emmc "resets" the knox counter so it's clear this counter resides in Emmc.
[Galaxy Note 3 General] yashade2001:
There is a hardware protection and there is no way to write there without deleting the damn hw protection.
[Galaxy Note 3 General] :
Have you already found out, where excactly the flag is stored? :)

But how works TA if there is a hardware protection?

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] yashade2001:
Ta?
[Galaxy Note 3 General] :
Ta = Triangle Away ;)

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] gazeddy:
Is it possible to watch the emmc as knox is tripped surely that would allow us to see first where the flags is and potentially snag the "password" for the write protection
[Galaxy Note 3 General] :
Let's crack the password with brute force. :D

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] gazeddy:
Wont that potentially take hundreds of years being we dont know its length or even its possible character set
[Galaxy Note 3 General] yashade2001:
So hw protection is only available in exynos devices triangle away still does not work in exynos devices.

---------- Post added at 05:41 PM ---------- Previous post was at 05:40 PM ----------

No password. There is no pw. Flag is stored in mmcblk0 i think. If we delete hw protection, we will be able to edit that symlink.
[Galaxy Note 3 General] :
What's with the I9505? Do you think, that there is a chance to reset KNOX?

If in the next weeks for this f***ing KNOX won't be a solution, I will sell my I9505 and by a N5.

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] yashade2001:
9505 can be reseted with ta. The main problem is exynos devices.
[Galaxy Note 3 General] :
But the KNOX flag can't be reset with TA. :(

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] yashade2001:
I guess you are using 4.3 rom. Just flash 4.2 rom and you can reset counter with ta. No exynos in i9500.
[Galaxy Note 3 General] :
How should I flash 4.2.2? This is the problem. :D

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] bungadudu:
Triangle away works for status and binary counter both in 4.2 and 4.3 i9505 roms.

Not for the knox counter. Guess their values are in different places on the Emmc, that of knox being protected.
[Galaxy Note 3 General] :
[MENTION=1115432]yashad[/MENTION]e

How did you reset the flag temporary, if you don't excactly know, where the flag is stored?

Where is Chainfire? Why couldn't he help us?

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] gazeddy:
Using a complete emmc image im guessing
[Galaxy Note 3 General] :
No, he wrote, that he did it with a hex editor.

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] yashade2001:
I have not got the device that was my tester's s4 and i have not got any testers now :D chainfire doesn't hear us i think :D

---------- Post added at 06:07 PM ---------- Previous post was at 06:02 PM ----------

Also that way should work if there is no device serial in symlinks.
[Galaxy Note 3 General] :
What is a symlink? I thought, that this is only a link to a partition.

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] yashade2001:
Symlinks are like; mmcblk0boot0 or mmcblk0 etc..
[Galaxy Note 3 General] :
I know, but they are only links to partitions, right?

Gesendet von meinem GT-I9505 mit Tapatalk 2
[Galaxy Note 3 General] gazeddy:
Im sure symlinks can got to files. I could be wrong im new to this. But i know a little on linux
[Galaxy Note 3 General] yashade2001:
Yeah.
[Galaxy Note 3 General] Tanis64:
After reading the pdf I think the KNOX Warranty Void Flag lays in the 'Replay Protected Memory Block' RPMB

So you need the Authentication Key from Samsung, the Data Structure that is used in that RPMB Area and the knowledge to code a tool that uses that transaction messages in the right way to reset that KWV Flag.

BUT

Even we find a way to do that, we all have to consider the consequences.

Samsung's Enterprise strategy is than broken and useless! Samsung will not cancel it's way to support Enterprise Segment, so they then are forced to release more closed, secured Bootloaders to protect their Systems!

Best case was when Samsung itself will provide a tool to Reset that RPMB Area including a complete factory reset of their devices with the cost of loosing all (really all) Data on the Device including all KNOX containers.

When someone can do this here, (s)he should also implement a forced complete Data erase, so Samsung will not be forced to to release more closed, secured Bootloaders.

Regards

Send from the outback with my GT-I9505
[Galaxy Note 3 General] gazeddy:
No the best way is to give us an option of fully disabling knox in our devices
[Galaxy Note 3 General] yashade2001:
[MENTION=2524541]Tanis64[/MENTION] ;)
[Galaxy Note 3 General] anglas:
I'm curious where did you repair your phone, as I both wrote to samsung and visit nearest samsung service and they both told me it's impossible to fix this without replacing my motherboard, which to me is stupid due to it's price cosidering it's only for the sake of working buisness space in my phone which I never used or would use.
[Galaxy Note 3 General] GhiGo65:
+1

i made the same... went to ask in a samsung service and they said that is a fuse that can't be reset. If you want back warranty and knox features you need to change logic motherboard....
[Galaxy Note 3 General] Khizar:
What makes you guys think they would tell you the truth if it is a software thing? I didn't even buy the phone with warranty so don't care but can you really be so naive to believe that they will just give out their secrets when customers ask?
[Galaxy Note 3 General] GhiGo65:
i didn't said that mine is the only truth, i told an experience.
[Galaxy Note 3 General] anglas:
I don't believe them that's why I asked questions here.
[Galaxy Note 3 General] Khizar:
The only thing you asked in your post is where the OP got his phone repaired.

Neither of you were asking if it's true that it's a hardware thing, thats why i replied. But still only time will tell if we will ever be able to reset the counter or not.