yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 Developer Discussion [Developers Onl] Walter.White:
Definitely true. For instance MI1 (4.3) & MI9 (4.3) had ALL flags ending in 1 but once they released MJ5 ALL flags changed to ending of 2. Then they released NB4 (4.3) about 2 days ago and ALL the flags still end in 2. Interestingly enough though the leaked MLG (4.4.2) didn't change any flags either... All of them still end in 2 so that's the reason why we can still downgrade back to MJ5 and not to MI9. I guess they don't change flags till the final release!?

Also I wonder if the flags are related to # of fuses blown or simply a counter stored somewhere on eMMC. If it's former than we might have a big problem.
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
We know where the flag values are kept inside of .mbn images like aboot and sbl1. I can even modify the flags, but the problem is that when I do, I break the hash so it won't flash. Device side, I know there are calls made to QFPROM, but as I demonstrated earlier, I can change the P flag, which makes me believe we can change any flag.
[Galaxy Note 3 Developer Discussion [Developers Onl] Walter.White:
I guess we need to figure out a way to bypass hash checking by patching the verification call for it or something. Or we need to find a disgruntled Samsung employee who will release the signing key.

I guess once S5 is released.. many more developers will start digging thru this and hopefully someone will crack it open.
[Galaxy Note 3 Developer Discussion [Developers Onl] st3chn0:
After many updates my P flag still remains at 0 and I'm on mk2 that's why I believe it isn't
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
Again, every deice and carrier will have different flags. You say you're on MK2, which means you're probably on an S4. You could do a billion updates and still get P0 as long as your carrier chooses to leave it like that for each software update.
[Galaxy Note 3 Developer Discussion [Developers Onl] st3chn0:
just realised it has now changed to P2 since the last time i checked which was around 10 days since then, I havent changed anything
[Galaxy Note 3 Developer Discussion [Developers Onl] xclub_101:
P is a more "special" flag - unlike S T R A (which change immediately after you update firmware), the P seems to also change without firmware update - since my post here:

http://xdaforums.com/showthread.php?t=2567165

I have not touched Odin or Mobile Odin Pro and yet P has changed from 1 to 2, the only system-related things that I did were:

- reactivation lock ON

- hide the custom status in Wanam Xposed.
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
I've seen that thread, I was also able to get SECURE BOOT: NONE on my device, but only lasted for a single reboot. I believe this is related to some sort of MMC error handling or corruption. I noticed my P flag went from 0 to 1 since you mentioned, but I can reset it indefinitely. I'm sitting here scratching my head...
[Galaxy Note 3 Developer Discussion [Developers Onl] xclub_101:
So far I believe it is more productive to think of the S T R A P flags as "debug info" rather than the same kind of stuff as the knox flag.

There was also a very interesting thread here - it sounds like a "pre-production" Note 3 that had no knox:

http://xdaforums.com/showthread.php?t=2657631
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
I know STRA at least are Rollback Protection counters. I was able to verify QFPROM calls in aboot. You have gtalk?
[Galaxy Note 3 Developer Discussion [Developers Onl] siraltus:
I don't think it didn't have Knox, I ran that app on my two-weeks-old SM-900T with Knox 0x1 and it also said "Knox warranty bit not found." I think the app is just buggy and doesn't know how to look for the Knox warranty bit on all devices.
[Galaxy Note 3 Developer Discussion [Developers Onl] xclub_101:
The 900T might be out of the list of devices known, but EU N9005 should be well inside the list. Moreover the firmware version that the guy has is earlier than any EU N9005 firmware that I could find. Of course that does not prove anything, but would be interesting to double-check.
[Galaxy Note 3 Developer Discussion [Developers Onl] siraltus:
Agree, I'm just saying that the app is kinda wonky.
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
I've done a bit of reverse engineering, and I've discovered two very important pieces of information.

1. TrustZone appears to not be device specific, you could most likely flash any N3 TZ and possibly even S4/N2, as long as it is signed properly.

2. It appears rollback information is stored in the rpmb. I found a string in TZ.mbn directly indicating so.

Here's my idea; Since the only way to communicate with TrustZone is via TEE (Trusted Execution Environment) or in our case QSEE (Qualcomm Trusted Execution Environment) which is a proprietary stack. The device driver for QSEE is /dev/qseecom. I'm doing some experimenting on whether it'll accept commands or data, but this looks to be the most promising route. If it were possible to rollback the counters to 0, which I know now to be rpmb based so we can most likely reset them, we could flash an old aboot that exists from MHV or MG3 (I might be able to insert the certificates MG3 since it is not signed, but it's 4.2.2 based.) I'm able to see much lower level debug and logging information thanks to [MENTION=4939386]Surge1223[/MENTION]. The files in /firmware/image and /system/etc/firmware are elf images of TZ HLOS applications. Another place to start investigating more thoroughly. I would not be surprised to find Knox related things too.

After an attempt of provisioning rpmb:

Hmm...

More information: RPMB Secure Boot PDF
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
I found a very interesting log file on my device that was hidden pretty deep...
[Galaxy Note 3 Developer Discussion [Developers Onl] ant456:
Where did you find that bootloader log file I've only had my phone for a week so I still have the 14 day warranty so I can just exchange it at the store if you have any tests you want me to do
[Galaxy Note 3 Developer Discussion [Developers Onl] ant456:
This forum went underground too? Sounded like you guys were making some progress.
[Galaxy Note 3 Developer Discussion [Developers Onl] Walter.White:
Not sure how but this user claims to have reset Knox back to 0x0 http://xdaforums.com/showthread.php?t=2671643

P.S. I hope once S5 is released, it gathers more developer attention and we can finally crack open this damn thing.
[Galaxy Note 3 Developer Discussion [Developers Onl] Mjoelnir77:
Would be interesting to know whether https://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor could be used to access stuff on knox devices (and patch the system that way) that Samsung would us not want to do ...
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
I've been looking into it the past couple of days. It may be possible to use an older modem and a hacked-together ServiceMode.apk to issue AT/DM/FTM commands directly to the modem. Decompile HiddenMenu.apk, there's all sorts of goodies in there. It's a little more complicated than I'd like to think, but it seems plausible. They have their own custom firmware/RIL library though, we don't have the luxury of using that to take advantage of the exploit, so we'll have to find another way.
[Galaxy Note 3 Developer Discussion [Developers Onl] siraltus:
Hey, not much to go on here, but it could be taken as confirmation that the Knox flag is resettable using a secret unique to each handset:

http://xdaforums.com/showpost.php?p=51287755&postcount=27
[Galaxy Note 3 Developer Discussion [Developers Onl] Zibri:
That's VERY likely to be true.
[Galaxy Note 3 Developer Discussion [Developers Onl] E:V:A:
And where is that? (Do you know what wrote it?)

Any progress? I did something similar for the SGS3, found tons of goodies. I'd like to see what you have if anything new.
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
Rollback protection information isn't stored in 'actual' QFPROM, but rather the RPMB. Both on Snapdragon and Exynos devices. The warranty bit is controlled by an actual hardware fuse in the MCU, while the Exynos warranty bit is also stored in the RPMB. I believe the RPMB may serve as a shadow register for all fuses also. I'm looking into the patches and ioctl for RPMB. I was dissecting an old unsigned RPMB from a Note 3 engineering build and found an 'SSD Keystore Encryption Key' and 'SSD Auth Key' within the TrustZone blob. Note I have a 160 bit key for both in plaintext, not a .key file. I'm not exactly sure if SSD is referring to the RPMB or the NAND chip itself, but it may be possible to send authenticated messages to TZ kernel/keystore. I can explain more in-depth via gtalk. We've got several theories.
[Galaxy Note 3 Developer Discussion [Developers Onl] david515:
Don't know if this helps anybody wth MJE to MI9...

I was able to flash from MJE Modem down to MI9, but system Image still on MJE but ever thing else says MI9- ( don't know if that helps anyone)
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
The modem actually has rollback protection, but all modems seem to be '1' value.
[Galaxy Note 3 Developer Discussion [Developers Onl] david515:
I'm planning on investing in JTAG...

I may be of some better help after I get a Jtag set up hopefully this next week. Thank you everyone for your efforts. J TAG has been something I've been meaning to invest in for a while.
[Galaxy Note 3 Developer Discussion [Developers Onl] siraltus:
SSD could stand for System Software Debug, part of the JTAG specification.
[Galaxy Note 3 Developer Discussion [Developers Onl] evilpotatoman:
Create folder /sdcard/ks.license and place key files there.

May need to invoke factory mode (here's how I did it):

Boot into safe strap

advanced->terminal command

navigate to /dev/block/platform/msm_sdcc.1/by-name

open terminal

mount ./efs /efs

echo OFF > /efs/FactoryApp/factorymode

echo OFF > /efs/FactoryApp/keystr

mount ./system /system

sed -i 's/build.type=user/build.type=eng/g' /system/build.prop

sed -i 's/ship=true/ship=false/g' /system/build.prop
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
Where did you get this ks.license business? You can't tell me all this without giving me more clues ;)

Should I just paste plaintext key and save as .key? Also, why factory mode? There's an easier way to get into it too.

update: Not quite sure what I'm looking for or doing.
[Galaxy Note 3 Developer Discussion [Developers Onl] david515:
This is encouraging check this post -- Evilpotatomans post http://xdaforums.com/showthread.php?t=2721505

I hope this helps you guys out.

Thank you!!
[Galaxy Note 3 Developer Discussion [Developers Onl] E:V:A:
That thread was DMCA yanked faster than you can say "yank".

This is weird. Any idea what this does?

It surely seem like you turn OFF Factory Mode and turn ON Engineering mode,

but I always though they'd be the same. I wonder what is different.
[Galaxy Note 3 Developer Discussion [Developers Onl] Grompy:
FYI google has the cached version before it was mod editted and all the stuff is still in his google drive account available for download.
[Galaxy Note 3 Developer Discussion [Developers Onl] david515:
I'm still

I'm thinking factory mode is without any protection. gives us full freedom to do with almost anything without security? Just thinking.

---------- Post added at 10:24 AM ---------- Previous post was at 10:14 AM ----------

That sucks it was yanked.
[Galaxy Note 3 Developer Discussion [Developers Onl] GermanBrot:
Nice... did you notice the SHA256certkey.txt? Think that is all we need?
[Galaxy Note 3 Developer Discussion [Developers Onl] FauxPasIII:
It's there.
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
WARNING:

This is very dangerous. I have been able to reproduce and recover every time, but there is a HUGE inherent risk of permabricking. I am able to manually put my device into QHSUSB_BULK mode by overwriting SDI/DBI with SBL1. The screen will go black immediately, and your device will be recognized as a QHSUSB_BULK device. You can recover by making a 256MB (arbitrary number, has to be over like 128MB) unbrick image. This can be made by pulling the first 256MB from mmcblk0. Then flash to SD card using DD or Win32DiskImager. Do this before flashing SBL1 to DBI/SDI. Pop it in and it should boot right back normally, so ODIN and flash SDI again to fix. This can be useful for various purposes, of which the right people are already aware.
[Galaxy Note 3 Developer Discussion [Developers Onl] RaluSiCris:
it can be made a how to in order to be useful for all of us? It would be really appreciated.

Thanks
[Galaxy Note 3 Developer Discussion [Developers Onl] ryanbg:
If you don't know how it can be useful, this is probably not the best place for you to be posting.
[Galaxy Note 3 Developer Discussion [Developers Onl] E:V:A:
I just got a long shot theory, that need investigation.

It could work for Qualcomm based QFUSE Knox'ing.

The idea is this:

When QFUSE is written, it has to go through a special high-current/voltage power rail, triggered by the qfuse code (we already have). What we can do is to prevent enough power to reach the chip the qfuse is located on, by either on-the-fly patching the qfuse code, or by putting a resistive load, detected and timed exactly when this write happens. This would hopefully cause the QFPROM write to fail within a few attempts or timeout. It should be easily constructed by using standard tools like BusPirate, Arduino or RasberryPi. In the best case scenario, we might just have to solder a resistor somewhere. In the worst, the qfuse code goes into an infinite loop, completely blocking the device.

Please look at the code to determine feasibility for this HW hack.
[Galaxy Note 3 Developer Discussion [Developers Onl] Product F(RED):
Very good way of looking at it. Proactive instead of reactive; forget trying to reset the eFuses (which is impossible), and prevent them from being tripped/blown to begin with. :good:
[Galaxy Note 3 Developer Discussion [Developers Onl] david515:
At first I was think there might be a way of a bypass but I am lost on this and realize this whole bootloader is way more complex then I once thought, and on other thoughts someone very well could custom write and custom designed a whole bootloader and that would be the fix to this dilemma.I don't have all the knowledge or time to do such a feat.

[MENTION=259457]Eva[/MENTION] I think your Idea is good and worth looking into for sure.Thanks for your help.

I am burned out on this Knox bootloader at this point. I'm going to sell my retail SM-N900V and get a different carrier different gn3 phone that isn't locked

maybe tmobile.
[Galaxy Note 3 Developer Discussion [Developers Onl] Product F(RED):
If you're not on Verizon (as in you're currently using a Verizon model on a different carrier), the T-Mobile version is your only option as far as unlocked bootloaders go (for GSM). You could get the Sprint model and hack-unlock it for domestic GSM (it blocks US SIM cards even when unlocked by default). Or you could get the SM-900V Dev Edition which is rare and expensive. I recommend the T-Mobile model. I have it and it's the easiest to deal with.
[Galaxy Note 3 Developer Discussion [Developers Onl] E:V:A:
Looong shot number two. (Qualcomm)

This is regarding a quasi-SW hack.

I think it would be extremely useful if someone could start charting out the exact chain of events, leading up to a qfuse write. I'd like to see a chart, kind of what we had for the SecureBoot2 stuff in the 8960... But I'm totally not up-to-date on the current Knox research status, so perhaps this has been done already?

Anyway, the idea is as follows. If at any point the Knox detection mechanism is using code from the modem Hexagon processor, I can almost bet my behind that there could be a hidden proprietary function in the Modem code, that could disable Knox flag. Knowing Qualcomm has their 80 MB blobs of Hexagon RTOS code, this would be some crazy feat to accomplish, but certainly not impossible. (Most of it is redundant anyway, often having ~3 copies of modem binaries, for example.) So if this is possible, I would assume there could be some hidden AT commands accessible from modem terminal shell that temporarily disables Knox fuse.

Where to look? We would need to reverse all the AT command functions using IDA Pro and the Hexagon plugins, and look for code that is related to Qfuse burning. (There is probably a lot of this code, since the recent discovery show that many RF variables are now also using qfuses.) That's why we need to make the chart above...

But given the low RoE (Return of Effort), I actually do not recommend spending too much time on this, unless Knox is starting to cause real trouble to people.
[Galaxy Note 3 Developer Discussion [Developers Onl] Surge1223:
I looked into the command to set the knox flag/fuse/warranty bit and the underlying function. And you may be right about hexagon since hlos has the strings in it that say "device is tampered!" etc...and a secure monitor call to set the warranty void flag goes to an address in tz memory. I think itd take a while to figure out the who, what, where, just by examining assembly without a kernel, TrustZone, or hexagom vulnerability...plus its a mix of arm/thumb/random blobs.
[Galaxy Note 3 Developer Discussion [Developers Onl] david515:
I found this and wondered if this may hlp

I found this link on a knox reset .I don't know if this is reliable as of yet? but interesting if it is for real.

http://sxtpdevelopers.com/samsung-note-3-knox-fix-qualcomm/
[Galaxy Note 3 Developer Discussion [Developers Onl] stash9123:
took the plunge and tried flashing just the param.bin no harm was done to my device how ever knox is still 0x1
[Galaxy Note 3 Developer Discussion [Developers Onl] swnt:
This is on their site:
[Galaxy Note 3 Developer Discussion [Developers Onl] xclub_101:
Quick question to have a more complete view on where things are - I do not have the N900 and I know little about it so the question might already not be a problem there but it certainly is on N9005 - can you also downgrade the firmware after you write the knox-reset piece?
[Galaxy Note 3 Developer Discussion [Developers Onl] ruchirtrehan:
That's a pretty interesting question, I hadn't really thought about it but I guess to give it a shot pretty soon, I am out of town atm so will try and do it asap and let you know if it could be possible to do so..
[Galaxy Note 3 Developer Discussion [Developers Onl] haybill:
Hello [MENTION=5374564]RuchRha[/MENTION]--I saw you on another thread and tracked you down to this one--it has been reported that flashing Root using CF-Root, to a Canadian N900W8, was possible to do without compromising KNOX warranty counter-- do you know whether the same applies to SM N900 variant?

Apologies if this has been asked./answered but couldn't find reference to the answer.
[Galaxy Note 3 Developer Discussion [Developers Onl] smeet.somaiya:
Attempting to downgrade is worth trying. If it succeeds it would be great. If it fails with "Firmware Upgrade encountered issue" no worries just flash stock recovery back and the phone would be up again.

Sent from my Galaxy S5 GT-N7100
[Galaxy Note 3 Developer Discussion [Developers Onl] Zibri:
Hmm I analyzed this. It contains an sboot.bin for exynos devices AND an EMMC1 firmware update file.

That is the key to knox reset.
[Galaxy Note 3 Developer Discussion [Developers Onl] haybill:
Just re read a couple of pages back and it shows that it has been possible to restore original status - no Knox trip info in DL mode - very interesting indeed.
[Galaxy Note 3 Developer Discussion [Developers Onl] iede:
Really interesting step! :victory:

But from my understanding, this method tested only on ND1 firmware with ND1 bootloader, and how about if we have older bootloader? (I use NC1).

Many thanks for this founding! :good:
[Galaxy Note 3 Developer Discussion [Developers Onl] ruchirtrehan:
It certainly is not possible at the moment, but trying to see what we can/could achieve regarding this pretty soon..

Well yes, it's actually worth a shot but I am pretty annoyed I dint had an 4.3 firmware and trying to download the same from sammobile but it failed every time when only 10-20 mb is left to be downloaded and this has happened 3 times, I am looking for any mirrors for them instead of using sammobile.

It should work on any fw/bootloader related to 4.4.2, but I have no idea about 4.3
[Galaxy Note 3 Developer Discussion [Developers Onl] AdrenalineX:
[MENTION=5374564]RuchRha[/MENTION] can u post a video on how to reset knox on exynos?
[Galaxy Note 3 Developer Discussion [Developers Onl] A.S._id:
after flashing test bootloader maybe a problem with input stock recovery, so, for fixing I'm made package with standart bootloader and param.bin

http://xdaforums.com/showpost.php?p=52406571&postcount=21
[Galaxy Note 3 Developer Discussion [Developers Onl] ruchirtrehan:
I'll test it!

Edit/Update 1 : Wowzer guys, I have some good news for you all, I have been successfully able to downgrade from 4.4.2 to 4.3 without any issues, The firmware I downgraded to is MI3 and Knox is not present in download mode will post steps soon and guide you through steps for a safe downgrade, PS : this is only for SM-N900/N9000/Exynos for now, screenshots attached..

Edit/Update 2 : Steps to Downgrade (Note 3 Exynos only!)

1 - Download the bootloader.zip and extract then flash in Odin. (Find in attachments) (don't select any other option in odin except F reset time and auto reboot) (are selected by default).

2 - Download any 4.3 JellyBean Firmware from sammobile.

3 - After flashing the bootlaoder reboot into stock recovery (power+ home+ vol up) and wipe data/factory reset and cache partition

4 - Turn off the device and reboot into download mode and flash the 4.3 Firmware in Odin.

5 - After flashing completed let the device boot till boot screen and pull out the battery and turn it off then turn it on again and reboot into recovery (power+ home+ vol up) and wipe data/factory reset and cache partition once again and reboot and let the device boot up.

That's pretty much it, you've safely downgraded to Android 4.3 from 4.4

This is only for Note 3 Exynos!

I'll be testing some work around's for the N9005 (Snapdragon) to reset Knox/Firmware Downgrade once I get that device as I have given mine to a friend, and have been saving money to buy a new or used N9005.
[Galaxy Note 3 Developer Discussion [Developers Onl] XZQ't:
To anyone who wanted to try this knox reset tool.

I can confirm the method by [MENTION=5374564]RuchRha[/MENTION] that it definitely valid and I done it myself on N900 ND1 Firmware. I'm now very happy rooting my phone and will be able to get full warranty when needed.

However, this method will WIPE YOUR INTERNAL SD. So make all the necessary backup before reset knox.

----------------

There's ND2 Firmware released, can anyone confirm that this method still work or not ?

I hope it's not a patched to prevent knox reset.
[Galaxy Note 3 Developer Discussion [Developers Onl] st3chn0:
I doubt they would patch as it's official file they use to reset. If they did they would have no method to reset themselves