yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 General] khaytsus:
Certainly does not prove the end result is software, OBVIOUSLY the trigger is..
[Galaxy Note 3 General] Chainfire:
There are multiple things at play here. There is definitely mention of eFuses in the bootloader, close to the KNOX related code. That is why I first suspected eFuses may be involved. It could well be KNOX bootloaders use eFuses if available and uses a software counter if not (like the original flash counters). It may of course also be the case that it's indeed just a few bits somewhere that get flipped (possibly inside an encrypted section).

The big difficulty here is that the KNOX counter is only settable once. So it is very difficult to pin down where this value is stored, if even in a user-accessable place, which doesn't need to be the case at all. Remember that on Exynos4 devices it was an engineering mistake that even made us find the counter the first time (and then the cat was out of the bag). Anyway, you'd need an exact flash dump of before and after, then maybe it would be easier to pin down.

The next problem however becomes write protections. One reason I stopped working with Triangle Away on the Note 3, is that certain areas of the flash memory are write protected. These protections are set inside the bootloader (== protected code) and cannot be unset, they cover the sections containing the flash counter data. Even if we knew where the data was stored and how (assuming it's not an eFuse), we'd still have to beat those write protections. These protections were also used in the Exynos S4, which is why there is no Triangle Away for that specific device. I'm not completely sure if all the devices that are getting KNOX support this hardware feature, but I believe so - it's fairly common.

Mind you, I know a theoretical exploit that may beat the write protection, but I have not worked it out in practise (not even attempted), as it'll be lengthy, device model specific, difficult, and probably dangerous. As long as those write protections are there, we can't reset the status, but as long as we don't know where or how the KNOX data is stored, it is of no use trying to crack the write protections. That is, even assuming that data we want is even accessable from kernel and/or userland, which doesn't have to be the case at all.

RIFF boxes and ORT connectors have raw access to the flash, by the way, that's why it would be trivial to do with that equipment if you know where the data is at. Of course, you can also use a RIFF box to downgrade bootloaders due to said access. When we were hacking the original Samsung Galaxy Tab's locked bootloaders that's exactly how we tested things :)
[Galaxy Note 3 General] sohebq:
^^

As long as you are alive, we have hope :)

Sent from Note 3 (The beauty & beast)
[Galaxy Note 3 General] My1xT:
[MENTION=631273]Chainfire[/MENTION] if they're write protected, how can they be written in the first place???
[Galaxy Note 3 General] .NetRolller 3D:
What we know so far:

-The Knox flag is physically stored in the eMMC, not in the SoC. Replacing the eMMC resets the flag.

-Some phones with Knox have Toshiba eMMCs supporting only eMMC v4.5, meaning, a standard eMMC 4.5 feature is being used (not a Samsung extension or something new to eMMC 5.0). This alone excludes an efuse - eMMC 4.5 doesn't have efuse support.

-Samsung can reset the flag using software only. This also rules out an efuse.

-Restoring a full eMMC backup (including boot and user partitions) doesn't clear the flag, even if done via JTAG or direct eMMC programming. So, the flag is not in the user or boot areas of the eMMC.

That leaves only the RPMB or the eMMC partition table.
[Galaxy Note 3 General] Chainfire:
As I said, the protections are set by the bootloader. If you turn on the device, the protections are disabled. When the bootloader has done its thing (flashing also goes through the bootloader) and its ready to boot the kernel, it'll turn on those write protections.

Very interesting information!
[Galaxy Note 3 General] Silberpfeil3110:
Just write on it the first time and at the end of the procedure initiate an efuse lock. Maybe knox counter is placed in a kind of "hardware bootloader" and triggered by false checksums of software bootloaders, kernels or else... without efuses.

Gesendet von meinem SM-N9005 mit Tapatalk
[Galaxy Note 3 General] My1xT:
[MENTION=631273]Chainfire[/MENTION] that akes sense. [MENTION=750544]Silberpfeil3110[/MENTION] CF said that TA wasnt available on i9500 coz of the protection and it didnt have knox loader at that time so a write and lock wont work for the good old flash counter, since it (obviously) counts the flashes...
[Galaxy Note 3 General] luminouche:
LoL, this is the tool used by Samsung :

:good:
[Galaxy Note 3 General] Silberpfeil3110:
That's true but the note 3 had knox from the beginning. Maybe s4 only has software triggers and note3 hardware components? And maybe s4 has also hardware components for knox but Samsung implemented it from the software side intentionally because of some reason....

Gesendet von meinem SM-N9005 mit Tapatalk

---------- Post added at 08:54 PM ---------- Previous post was at 08:53 PM ----------

...implemented it for some reason later.

Can't edit posts from app.

Gesendet von meinem SM-N9005 mit Tapatalk
[Galaxy Note 3 General] My1xT:
you can edit posts from App, tap on your post tap on the moderate button on top-right, tap edit and there you go.
[Galaxy Note 3 General] Silberpfeil3110:
I use stock tapatalk app. There are no entries showing up in the moderate - menu. Sorry for the off - topic post

Gesendet von meinem SM-N9005 mit Tapatalk
[Galaxy Note 3 General] My1xT:
I was talking about stock Tapatalk too...
[Galaxy Note 3 General] Drizzy xS:
One thing that really sticks out to me is: when I enter download mode on my 9005 and I look at the bootloader in grey under knox void it says "write protection enabled" I might just be talking crap as I don't know much about it but some how some way this seems to me that something in the bootloader has write protection enabled and maybe if the bootloader could be closer studied and hacked somehow then this write protection could be disabled and we could change knox back to 0x0?
[Galaxy Note 3 General] LtG:
newb here, so I'm most likely talking crap, but I agree. I have a suspicion that the trick to the flag lays in the greyed out items:

However, I have no clue where to begin, though totally willing to dedicate my free time to helping figure this out. My SM-900T and I are willing to risk it for a bisket. Just awaiting instructions.
[Galaxy Note 3 General] CNexus:
So then we should take all of this at face-value, go on our merry way and trip Knox? yeah, no thanks
[Galaxy Note 3 General] dr.m0x:
He he he. I never said that, I only said there is no way for them to offer up hard evidence. Obviously it's entirely up to you if you wish to believe them or not.

Sent from my SM-N9005
[Galaxy Note 3 General] gnik luap:
For several days now the app is acting strange. When I try to edit my posts I can't, when I try to quote a post the app mostly quotes the wrong one.
[Galaxy Note 3 General] Vagany:
http://xdaforums.com/showthread.php?t=2510867
[Galaxy Note 3 General] tongueman87:
Interesting
[Galaxy Note 3 General] phr3ncj:
what if we can overflow that variable to reset it? 0xfffffffc is near to 0x0 if we can do `knoxflag+=1` easily.
[Galaxy Note 3 General] equlizer:
I wish my repair shop would tell me how they reset knox :( For $50 they will reset it and root your device.
[Galaxy Note 3 General] Khizar:
Most likely they are using root de la Vega. And charging you for something you can do for free..

Edit- oh i thought you meant they will root your device and THEN reset the knox binary counter, misread your post :good:
[Galaxy Note 3 General] equlizer:
Umm, that does not reset knox:angel:
[Galaxy Note 3 General] lorinkundert:
Just because you flash a new bootloader does not mean that Odin wipes the partition it sits

on.
[Galaxy Note 3 General] My1xT:
ok then maybe we could make a tar(or tar.md5) that formats the BL and then reinstalls a new one???
[Galaxy Note 3 General] CNexus:
Except for the fact that you can't.
[Galaxy Note 3 General] mateenf:
Knox came up in the 4.3 update with S4 as well. If the Root was still possible with S4 then i think this might be an efure restriction as being discussed here
[Galaxy Note 3 General] SocietyKiller[GE]:
Ok great news.
[Galaxy Note 3 General] dumbquestion:
Rooting by several methods for note 3 does NOT trip KNOX and is reversible (Root de la Vega, King Root, VRoot). non-issue... right?
[Galaxy Note 3 General] paul01609:
King root tripped my Knox and a few others
[Galaxy Note 3 General] M3r71n0:
Sorry but, where did the user who opened the post? xda_q8?

It is natural to think of a lie the history of the service samsung

I think, yes
[Galaxy Note 3 General] benhouli:
did u upgrade to mj6 with kingoapp when the knox was tripped?
[Galaxy Note 3 General] :
:D

You're answers man love em :D

[True Friendship doesn't exist]
[Galaxy Note 3 General] kiurudj:
knox is no efuse

talking to samsung live chat i found out that knox is not efuse and they dont way that flag is not resetable [MENTION=631273]Chainfire[/MENTION]
[Galaxy Note 3 General] nitrate:
LOL, can't see (read) sh*t... WTF u got to be kidding...

On a side note: for me in Germany there has a call or chat with a so called "service representative" nothing to do with a company like Samsung directly. They stand in no direct contact. These service representatives sit in a so called "call center" and do their work for companies like Samsung. Where from should these guys know what they are talking about anyway.

[ironic mode enabled]

Err... Wait a sec: oh, I know... KNOX is a hardware trigger *cough*

[ironic mode disabled]

Think before saying things like "I talked to a guy from service".

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] BUFUMAN:
Hahaha!:D

Gesendet von meinem SM-N9005 mit Tapatalk 2
[Galaxy Note 3 General] khaytsus:
If you want to read attachments, use the browser. Tapatalk is completely useless when it comes to attachments.

As for the chat itself... Yeah, most support folks, especially the initial lower level ones, are clueless. They have a script and a FAQ they read from, maybe some sort of knowledgebase. Had you asked them to define efuse I bet they couldn't have.
[Galaxy Note 3 General] Ribeard:
Gotta say, I'd take that with a massive grain of salt.
[Galaxy Note 3 General] tongueman87:
Anything is possible with the dev's here
[Galaxy Note 3 General] kiurudj:
knox is no efuse

if you cant see it u must be blind as f' just open it as a new tab and thats it .....people this days SMH
[Galaxy Note 3 General] testadeferro:
If knox uses mocana security technology we are fried. Lol.
[Galaxy Note 3 General] DAGr8:
just wanna come in and say , http://xdaforums.com/showthread.php?t=1569206 (hi [MENTION=2898906]braway[/MENTION] )

this was achieved independently of TA and was using a different method back then we had no idea what the hell that counter was, Im pretty sure the same method can be used for knox ie lots of trial and error and ofc certain amount of risks involved

just my 2 cents : ppl keep putting bounty up and make amounts interesting ,

money talks

, that will get developers (otherwise not) interested.
[Galaxy Note 3 General] :
Is there any one who has container folders with some long encrypted names

and has triggered knox to 0x1

[True Friendship doesn't exist]
[Galaxy Note 3 General] HitBobLer:
You could get it insured. Seeing that your in the UK here is a 10%off code for protect your bubble: PYB10

It works out at £5.30 per month with the code.
[Galaxy Note 3 General] Xelphos:
I know you guys don't trust live chat, but I was just talking to a support agent on it. When I was talking to him, his name was Archie, I had asked if knox used efuses. It took a few times to get the right answer but he said that rooting would damage software and hardware. I asked him if that meant it used efuses and he said yes. I don't have a picture the chat window closed when I clicked "Ok" on a popup telling me I was disconnected. If this helps then yay if not well then no harm done.
[Galaxy Note 3 General] Mwyann:
If that guy told you that rooting can damage the hardware... I wouldn't belive him. Maybe he didn't knew about efuse and just said yes to give you the answer you were waiting for.
[Galaxy Note 3 General] Xelphos:
I had also called them and was given the same answer. Just putting it out there. From my understanding of an efuse, it burns out when activated just like the xbox did when it updated it would destroy an efuse that was linked to the previous firmware. Burning out = hardware damage. Maybe not serious damage, but it can be classified as a type of damage.

I don't understand why you guys are even getting mad at Samsung for this. They are not stopping you from rooting your phone, they are just making it so that if you do it voids your warranty. If you break your phone because you root it and flash a rom and it bricks it, then Samsung should not be obligated to replace your phone free of charge because you wrecked your phone in a purposeful way. Purposeful meaning you knew the risk and took it.

This is the same as computers with the seals on them that say "do not break seal or warranty will be void". If you go tampering with your phone and you wreck it, it is on no one else but you. I think this is pretty good. Samsung is protecting them selves from losing money because of people who wish to tamper with their phones.
[Galaxy Note 3 General] grud1e:
quote This is the same as computers with the seals on them that say "do not break seal or warranty will be void unquote

not quite true at least in the uk the manufacturer / seller has to prove that you have done something to break it just by tearing a seal does not invalidate a warranty as much as they would like you to believe consumer law protects against this .......samsung can't say or prove tripping knox made your home button break
[Galaxy Note 3 General] My1xT:
Yes but usually the seals are on hdd screws or alike where just opening can damage the whole thing and such.

Those make much more sense than our knox counter...

Gesendet von meinem SM-N9005 mit Tapatalk

---------- Post added at 12:48 AM ---------- Previous post was at 12:47 AM ----------

Since those indicate that you probably have screwed up the hardware if anything is killed...

Gesendet von meinem SM-N9005 mit Tapatalk
[Galaxy Note 3 General] grud1e:
i agree i was making the point of a seal that stops you opening the side panel on a pc can't void the warranty by itself they have to prove that something you did after that damaged it
[Galaxy Note 3 General] My1xT:
Ok of course (sometimes they are out of place) since just because you want to build in another HDD can't kill your warranty by common sense...

Gesendet von meinem SM-N9005 mit Tapatalk
[Galaxy Note 3 General] Xelphos:
You miss my point, if you go tampering with your device and you break it, the manufacturer should not be obligated to replace it free of charge. The seal topic was just an example. Samsung says if you root your device you will void the warranty. Some manufacturers put seals over parts of the inside of a computer or device that void your warranty if broken. Knox is the seal for Samsung Software/Devices, by rooting the device you break that seal.

Don't worry about Knox, worry about what Samsung will do with KitKat now that KitKat can prevent rootkits and stuff like that, which will ultimately prevent people from gaining root access good or bad.

http://www.xda-developers.com/android/google-taking-aim-at-device-modders-in-android-4-4-kitkat/

or

http://securitywatch.pcmag.com/android/317698-android-kitkat-blocks-rootkits-but-at-what-cost
[Galaxy Note 3 General] My1xT:
Yeah but the seals are out of place often enough... Knox is one of those... A seal on HDD screws is understandable, but not on on the side of a pc or the outer layer of an external hdd (outer layer means the case which works as sata/usb adapter) since you can do nice things screwing with the latter ones (like use an external hdd as internal or specing up your pc) do not necessarily break anything. The former example us valid since opening an hdd breaks it...

Gesendet von meinem SM-N9005 mit Tapatalk
[Galaxy Note 3 General] Xelphos:
How is Knox out of place? If you brick your phone because you flash something or it fails why should Samsung replace your phone? When you root and flash you know the risks, and so does Samsung. Knox is valid. Samsung is just protecting themselves from people who tamper and end up breaking their phones. It would be nice if Samsung offered a developer warranty at a cost so people could tamper and still have warranty.

The seals are there for a reason. You always run the risk of breaking something when mucking around inside your computer, and the manufacturer does not wish to be responsible for your mistakes.
[Galaxy Note 3 General] JohnnyRebel:
Disagree. I can install any software/os I want on my computer without breaking the seal. I might lose technical support but I still have full warranty on my hardware. Why is my phone any different? As long as the hardware damage wasn't caused by carelessness Eg. Over clocked cpu. This has to be a case by case basis. My home button falling off has nothing to do with root, why shouldn't Samsung have to replace it even if I'm rooted?
[Galaxy Note 3 General] zroice:
GUYS!

One really important question (to me - and I'm sure to many others as well) at those with knox 0x1:

I've read MHL and/or HDCP support for stuff like miracast gets broken with knox tripped? Can anyone confirm or repeal this?

I don't give a f'k about the knox "security" - warranty worries me a lil - but it would really suck not to be able to hook up the phone to a TV or computer monitor with HDM.
[Galaxy Note 3 General] Xelphos:
Installing an OS on a computer is alot different than installing a rom on a phone. The fact is Samsung owns the rights to their products and is allowed to determine what voids the warranty. Flashing a rom can lead up to hardware issues, bricked, overheating, etc. Installing an OS on a computer is just rewriting the hard drive, it is not effecting any of the chips on the motherboard, though you can re-flash your bios and brick your PC. A phone is alot different than a PC, and you cannot really compare their hardware. A PC you can take almost everything apart, a phone you cannot. You can take the phone apart and get the main board, but the CPU and everything else is usually directly attached to the board and is not easily replaced. A manufacturer for a PC will keep warranty for the hardware because it is usually easily replaced because everything can pretty much be removed aside from the chip set on the motherboard, but even then the most expensive consumer motherboards out there are only 300-400$ compared to some really expensive GPUs and CPUs. An 800$ phone depending on the issue when it breaks it usually needs either to be replaced all together or heavy work on the board to remove the broken components and then reattach new ones and is often not worth the effort. There are alot of things rooting can do to your device and a manufacturer has the right to protect themselves against people who wish to tamper. I hope more manufacturers do what Samsung is doing because I get tired of hearing people who rooted their phones tell the manufacturer that they did not root it.

The power button my my GS3 broke, I called Samsung and they told me to send it in, I was rooted at the time and sent it in rooted and it came back rooted with a fixed power button. I have had no problem with Samsung fixing my phones that have been rotted and had physical problems.
[Galaxy Note 3 General] grud1e:
thereby confirming that rooting does not void your warranty !!!

under uk consumer law samsung has to prove that your root was the cause of any failure a blanket you have voided your warranty because you have tripped knox will not stand up until/unless samsung can get a court to make it unlawful to root a phone ....and i can't really see that happening anytime soon
[Galaxy Note 3 General] testadeferro:
No friend screen mirror works normal with fort know 0x1. Be in peace.
[Galaxy Note 3 General] Blancos4Lyf:
That story doesn't seem legit, If warranty is voided at 0x1 why would Samsung need to develop a Tool to Reset the counter? There would be no point in it.
[Galaxy Note 3 General] _alex74_:
We are completely going off topic, moreover your statemant is not right...

- Flashing a rom will not hardware damage your phone, so not installing Windows or Linux or MacOS or your brand new PC(maybe things are not working properly....

- Flashing a wrong kernel will brick your device, as overclocking kernel will lead to overheating, malfunctions, hardware buttons not working properly... so it does overclocking your bios PC values....

There are just sligtly difference:

Recovery - Kernel - ROM.....i omit bootloader which is a different thing and used not that much

Bios - Operating system

End off topic please and sorry for mine, Xelphos if you want to have a talk about we can go on in Private:D

ATM some users had devices repaired with knox 0x1 tripped, so this mean warranty is not void, in europe OFC...

There are noone saying ATM that have paid just because knox tripped....

So? you will not believe until it happen to you?

Or because who have send devices to repair are not trusted and old members?

Clearly knox is not based on efuse tecnology, not on S4 almost, otherwise we cannot have three values readed til now(

0x0

0x1

0xffffffc(or smthg like that do not remember...)

efuse can give or zero(continuous) or 1(burned) third value cannot be achieved if we have efuse based(this is not a 2 position switch)

And about chat with Samsung, something operators are not att all prepared for some techincal question like that, so expect always a different response, until you'll get in touch with some tecnician or personel on service repair site
[Galaxy Note 3 General] Xelphos:
I was wrong, I am not under European law so I don't know the ins and outs. My original statement was directed at North America.

---------- Post added at 06:47 PM ---------- Previous post was at 06:33 PM ----------

[/COLOR]

Well I said that the counter and Knox does not void the warranty completely as I sent my GS3 in rooted. Knox just voids the warranty on faulty hardware. If Knox is tripped and lets say the CPU dies, Samsung will not replace it. But if Knox is tripped and the buttons fall off they will usually fix it.

None of this is a giant argument. I am not mad or upset at all, I am just stating what Samsung is doing as they see it. I personally am not worried about Knox, I am worried about KitKat and its ability to prevent root.

This will be the end of my part in this discussion. If you guys want to root and are worried about Knox, then wait a month or two before rooting. This way if there is going to be faulty hardware or something, it will usually show up in this time frame with heavy use. That's my take on it anyways.
[Galaxy Note 3 General] Killberty:
Xelphos i dont have a link but in the european union, samsung would be in duty to show you that you did destroy e.g. the cpu by rooting... this is widely known by people living here (germans ftw), the only prob is that for a single person it is hard to sue samsung :(
[Galaxy Note 3 General] gerardo87:
In my opinion the policy of Samsung's warranty is not correct. I believe that they can not decide how to void the warranty only after selling millions of devices. They should say before you buy so that the customer has the choice whether to take it or not

Inviato dal mio Nexus 7 con Tapatalk 4
[Galaxy Note 3 General] Xelphos:
Says in the warranty agreement when you buy the phone that modifying the software or hardware will void your warranty. But you know.... No one reads that.

EDIT: It actually says it after you buy the phone when you are setting it up, stupid Samsung.