yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 4 General] gekkehenkie11:
I loaded up the Snapdragon bootloader in IDA but I haven't found the correct loading address yet. On byte 8 is address 0xF800000, so I tried loading it to that but the addresses are (slightly) off that way, so it must be something else, but it's close since all references start with 0xf8 and 0xf9 ...
[Galaxy Note 4 General] thedicemaster:
you can change the thread title at the first post with edit> go advanced> title
[Galaxy Note 4 General] :
Thanks! Done. Guess now it's more clear for everyone.
[Galaxy Note 4 General] AndroidSon:
Nice one man, should be useful.
[Galaxy Note 4 General] gekkehenkie11:
Well not trying to improve anything just yet, just wanted to take a look at the bootloader disassembly to see if it's easy to figure out how it works. In order to do that one needs to know the loading address of the bootloader, so the relative addressing corresponds to the absolute addressing. And I just found out what it is ! :) For anyone interested: the Snapdragon bootloader must be loaded at:

0x0F7FFFD8

:)

If you load it that way, everything adds up ! And the "Program Entry" is that 0xF800000 I mentioned earlier, it all corresponds exactly like this ! Now going to check out the code that prints that KNOX string ...
[Galaxy Note 4 General] gekkehenkie11:
Exactly. That's why that KNOX warrany string appears twice in the FW: It either prints:

KNOX WARRANTY VOID: 0x%x (%d)

or it prints:

KNOX WARRANTY VOID: 0x%x

It compares a variable to 0 and then either prints the first or the 2nd, so I'm pretty sure that variable is actually that %d part. In other words, if that %d part is 0, it doesnt print that () value. So to fake it, just edit them both.

Anyway I did some more reverse engineering, this code appears in the bootloader in the KNOX section: https://android.googlesource.com/kernel/lk/+/qcom-dima-8x74-fixes/platform/msm_shared/scm.c

as you can see there's code that blows a fuse. So I'd bet money on the fact that that's how they manage the warranty void bit: they just blow a fuse inside the CPU. So there's no way you can undo it. They use the same mechanism in the xbox 360.

BTW when googling for some strings, I found this thread, haven't read it but I'm sure there are tons of answers in here already: http://xdaforums.com/showthread.php?t=2447832 :)
[Galaxy Note 4 General] AndroidState:
Your working on a Snapy Model? If so, Which one?

Will you post it when ready?

Sorry for questions.

Thanks!
[Galaxy Note 4 General] d4rkkn16ht:
Nice hacks.

This hack reminds me of my school days hacking IO.SYS, MSDOS.SYS & COMMAND.COM (boot loader of MS DOS) & changing the strings inside :)

Tell us if you find out how to disassemble the code
[Galaxy Note 4 General] gekkehenkie11:
Most of the bootloader code comes directly from Qualcomm and can be found here: https://android.googlesource.com/ke...ce8b60fafabd0c23c5a73a360a7/app/aboot/aboot.c

Here an interesting post about it: http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html and how it all works.

---------- Post added at 02:22 PM ---------- Previous post was at 02:08 PM ----------

BTW did anyone even try this spoof 'hack' already ? Based upon what I'm reading this would power down your device:
[Galaxy Note 4 General] Pafcholini:
Exactly, tima is the new security feature implemented in LP release.

You can read more here: https://mega.co.nz/#!itBFQQiB!IpiwiozjQw_9YLFCTxKsSyVknVMMoR7DyATdurjxrTk

Ps: when I tried to flash the modified bootloader it's failed. The secureboot detect the modified bootlaoder.

Powered by ET!
[Galaxy Note 4 General] gekkehenkie11:
So, what I've found so far: yes the KNOX warranty void is being set by an efuse that they blow. The code to blow the efuse is present in the bootloader. It's done via a "Secure Monitor Call" (SMC), this is a call to a 'secure world', where the actual code resides to blow the fuse.

So, once blown, it simply can't be undone, efuses are physical fuses, residing in the hardware itself.

However, a spoofing exploit is at least possible in theory. I have SERIOUS doubts though that it's as easy as modifying a string and flashing it back, that would make really no sense at all to me, I'd say the bootloader itself is signed and thus cant be modified. If they didnt sign it, that would be a HUGE security whole. I'd find that pretty hard to believe.

So, what the OP is reporting here, that he simply edited the string and flashed it back, to me at least seems very unlikely to be true ... Cause if that were true, more sophisticated hacks would be possible. I mean, the efuse can only be accessed via SMC calls. So, if one would just patch those calls, one would be able to report efuse status 0x0, regardless of the true state of the efuse, to any application accessing the efuse.
[Galaxy Note 4 General] gekkehenkie11:
So, you're saying this worked with KK bootloader for your SM-N910C ? You could edit the string and then simply flash it back ? That would be pretty incredible ... IF samsung was really that stupid, then why come up with KNOX in the first place ?
[Galaxy Note 4 General] gekkehenkie11:
BTW, attached is the important part of the KNOX bootloader code. I labeled the functions myself of course. But what it does, is it calls that "Getwarrantyvoidstatus", which returns a number in register R0. If it's 0, then warranty is not void and it prints that "KNOX WARRANTY VOID: 0x%x" to the screen, where that x will be 0. IF it's NOT 0 (so warranty *is* void), it will print that "KNOX WARRANTY VOID: 0x%x (%d)" instead (mind the difference being that (%d)).

I'm not sure yet what that %d represents, I am pretty sure that it's being retrieved by that function call that I labelled "StillunknownProbablygetthe_d", but I'd need to look into it.

Anyway what that "GetwarrantyVoidStatus" function does is just that SCM call to the 'secure enviroment' with parameters to retrieve the efuse status. If bootloader really could be edited for 910C, like you say is possible, then all you'd need to do is fixup that efuse SCM call to always return value 0. That way, this bootloader will ALWAYS show warranty is 0x0, on screen, in Odin, in the samsung factory, everywhere ...
[Galaxy Note 4 General] gekkehenkie11:
I don't know about the Exynos, I just posted how it works on the Snapdragon.

Anyway, are you 100% sure you have edited strings on the Exynos and then flashed it ? I just find that extremely hard to believe. If Samsung left the bootloader open for editing (so without signature) then that would make them the dumbest company on earth. Why invest all that money into a security system and then just leave the front door wide open ? That just makes 0 sense.
[Galaxy Note 4 General] gekkehenkie11:
That's 100% impossible. You can't 'fake' a signature, they're 100% secure. You need the original key and only Samsung has that.

So what you'd need to do is to hack the bootloader to make it not care about signatures. This theoretically is possible and in fact, it has been done for example for the S4: http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html

But AFAIK nobody has hacked the S4 bootloader(s) just yet. But yeah if you could hack the bootloader, then you could create a spoof hack like you've proposed in this thread. If you do it the way I proposed (patching the SMC call to read the efuse) then there's no way Samsung will read KNOX WARRANTY VOID: 0x1, unless they install a new bootloader themselves.

But again, since bootloader is unhacked, this is just not possible at the moment.

---------- Post added at 08:25 PM ---------- Previous post was at 08:09 PM ----------

I just read the OP again, you said:

So you indeed haven't done it yourself. Anyway, your idea was actually quite nice. In fact, I like it a lot :) Samsung has implemented their Efuses, which is a good protection in itself: once they burn an efuse, you simply can't bring it back to 0. So it's a good and secure way of storing that warranty bit. HOWEVER you still need to read and communicate the Efuse status and that's where the flaw lies. Even if the efuse is located inside the CPU (which AFAIK always is the case), it needs to be communicated to user space and to the end user. To modify that code, that communicates that status, that's quite a nice angle of attack. But again, you'd need to hack the bootloader in the first place.

So for now, a really nice idea but unfortunately still future music ...

Anyway I propose to close the thread, it serves no use until there's actually a hack.
[Galaxy Note 4 General] :
deleted.

Hope, you're happy, gekkehenkie11 . Your wish came true. Enjoy.
[Galaxy Note 4 General] mangus294:
what da ffffff are you working for Samsung?

this is much more than any one accomplish so give the guy a break and go do something for a change (something else than bring down people).

phoenix91140 i take my hat to you.

very good job dont let bad comments bring you down
[Galaxy Note 4 General] megatooth:
Sh*t, I knew I should have made screenshots of first post...
[Galaxy Note 4 General] :
Hope, that you'll get well paid by Samsung Corporation for saving their defense system(and their ass actually too, cauze it could result Samsung to loose money for warranty works, that usually refuse to do since knox warranty void). It's unconditional Samsung's victory now. I'm sorry, guys, but I'm dropping this research, have no mood to continue in that manner. If anyone have made any backups - feel free to use them, but I'm out of that now. I already wasted over week time day to day researching that question instead of doing my primary work(what I get paid for) just to help other people, wasting my time and own funds. So up to now - enough. Have a nice night everyone and sweet dreams. Bye. Hope this topic will finally get completely deleted.
[Galaxy Note 4 General] megatooth:
Thank God for Google cache. :D
[Galaxy Note 4 General] FutureBSD:
And for those who want to follow the instructions here is the cache:

http://postimg.org/image/gtruq80dh/

http://postimg.org/image/j8jqangmd/

http://postimg.org/image/mtfltvl5x

If XDA is against sharing this, please just get those links removed or ask me to remove it.
[Galaxy Note 4 General] :
It's up to Admin and moderators to decide what to do with this topic now. You also can vote(to help moderators and admin make a choice). I'm out of here for 3-4 days. Need to come down and relax, will see, what will happen next.
[Galaxy Note 4 General] gekkehenkie11:
So, you come here on XDA, you post some noob idea on how to 'hack knox' and you present it like it actually works. Then I actually do REAL research, I reverse engineer the bootloader, I explain you why your noob theory can never work (you didnt even know about efuses and signatures) and then you get all angry, tell the mods to delete all your nonsense and blame me for working for Samsung ? Really, what are you smoking man ?

Then you send me a PM saying "You trying to proove me, that I'm somekind of noob or something".

Well come on man. You post crazy theories as like they're facts, you don't even understand code signing and obviously had never even heard about efuses. If you don't want me to see you as a noob, then don't act like one. I mean, everybody started out as noob, no problem there. But you opened this topic with some noobish idea and presented it as facts, like it actually worked. People even tried flashing their bootloaders because of you !!! They're REALLY REALLY lucky that they didnt HARD brick their devices (which WOULD have happened if Odin would have accepted the modded FW, cause the bootloader would have found the signature mismatch and would have shut the phone down on boot, causing a bricked phone only Samsung could repair).

So next time you open a topic, at least clearly state that you have just an untested IDEA. If you would have done that, we'd be all good man. And again, if you dont want people to see you as noob, then start reading and doing your research.

---------- Post added at 12:27 AM ---------- Previous post was at 12:11 AM ----------

It's not against XDA. He pm-ed me that he asked the mods to delete his nonsense (obviously cause he must realize now that it was just that: nonsense). The bootloader is signed and can't be just hexedited of course:

So even if you could get Odin to flash the modded FW like the OP suggested, that would result in a hard bricked device which only Samsung could revive.
[Galaxy Note 4 General] ronnie498:
Mod Edit

Thread Closed - @ OP Request

ronnie498

Forum Moderator
[Galaxy S 5 Q&A, Help & Troubleshooting] Saiyajin:
Hey guys,

just received my Galaxy S5 Duos G900FD with G900FDXXU1ANJ2 preinstalled. I'm thinking over moving to the latest official Lollipop release BOC1 but before I do that I want to backup EFS+IMEI. I manages to backup the IMEI with QPST but, unfortunately the Samsungtool App for backing up the EFS partition needs root.

I've read through a few threads, and decided to stick to the CF-Autoroot method, since I don't want to trigger KNOX. So as I understood, I have to downgrade the kernel, then root with towelroot app, and then update back to the original kernel - is that correct?

If so: where can I finde the correct files to flash for my phone? I realize this has to be done with Odin - I could only find files for the G900F, but not the FD. :confused:
[Galaxy S 5 Q&A, Help & Troubleshooting] Saiyajin:
Come on guys - i know that some of you have rooted the G900FD.
[Galaxy S 5 Q&A, Help & Troubleshooting] meiser:
Use the ANF6 kernel together with towelroot. That doesn't trigger knox.
[Galaxy S 5 Q&A, Help & Troubleshooting] Saiyajin:
Ok that much I found out, but unfortunately I can't find the file I need. I need some file extracted of this kernel - right?
[Galaxy S 5 Q&A, Help & Troubleshooting] ghasan:
I want to root my galaxy s5 G900FD versión without loosing my waranty ..knox 0x0 how c i do
[Sprint HTC One (M9)] Captain_Throwback:
TWRP for the M9 works on all variants!! Please follow the link in Post #2 to the Main thread and make sure you read the disclaimer below!!!

DISCLAIMER: Please make sure you read the >>> FAQ and Device-Specific Issues <<< for this device PRIOR to downloading or flashing ANYTHING from the thread!!

Trust me, you'll be sorry if you don't!
[Sprint HTC One (M9)] TonyStark R.I.P.:
[RECOVERY][Hima] TWRP touch recovery

Please visit the following page, for all conversation/ Q&A and downloads for this version of TWRP

[RECOVERY][Hima] TWRP touch recovery Main thread
[X 2014 General] Legacystar:
Updated today, Looks like it finally works. Bravo moto.....
[X 2014 General] pro.gangster:
did you feel any difference? in which way?
[X 2014 General] bondlolo:
For me, it looks like it is fixed. Before the system sometimes didn't recognize your face and turn off even when you are looking directly at the phone. Now it work like it should.
[X 2014 General] shamelin73:
I didn't get an update
[X 2014 General] cazman420:
Me either
[X 2014 General] kkhadr:
Yes it's really working great and it wasn't before in L 5.0
[X 2014 General] pro.gangster:
Here I had problem screen on every now and then with every noise and shake, it has been solved too!
[X 2014 General] floepie:
It's part of the update of Moto Actions, updated on the 31st.
[X 2014 General] bik2101:
5.1 update??
[X 2014 General] shamelin73:
guess it was included in the 5.1 soak

hope to get the full release soon
[X 2014 General] floepie:
No, everyone should have received the update.

Moto Actions was updated in the play store 3 days ago.

I'm still on 5.0.
[X 2014 General] Dark9781:
Those on the 5.1 leak would have not received an update to Moto Actions through the play store. The version on the play store is 1.9.10. The version in 5.1 is 1.11.2. The version in 5.1 is a newer version that the one on the play store.
[X 2014 General] rogeriorp:
Because it adds the shake movement for the flash, which is a 5.1 exclusive I believe.
[X 2014 General] Furieuxariel2:
I think so, also the camera version is 5.0.18 in 5.1. Which version on 5.0?, I ask by the exposition option in the screen
[X 2014 General] blinkin:
For me it started working only after a reboot
[X 2014 General] Pyrazol:
I have 5.0.11.7.
[X 2014 General] pagep:
I just updated the Moto Actions from play store and the Attentive display is working!! Nice
[X 2014 General] SkullDeath:
It's much more accurate now at detecting when I'm looking at the screen, somehow this update also resulted in priority interruptions working again.
[X 2014 General] tazlooney89:
upload to mega the apks of Moto Actions & Attentive Display please! :)
[Verizon Samsung Galaxy S 4] Autokill45:
I'm sure this has been asked before but I have no idea how to find the right thread, I've been searching but I'm not sure which method to use. I used towel root to root my S4 with NC5 build running 4.4.2 a while back and lately my phone has been randomly powering off. It shuts down instantly as if holding down the power button for 10 seconds. I'm not sure if this matters but I have xposed installed and before I found out about the locked bootloader I tried to install TWRP and CWP, so when I boot up it says custom. I want to factory reset the phone to hopefully solve this powering off problem, and I wanna be able to root again so I can put xposed back on. I have a laptop to use odin on if I need to. If someone could help me out it would be very much appreciated.
[Verizon Samsung Galaxy S 4] meazz1:
Start here.

http://xdaforums.com/showthread.php?t=2735172

-
[Verizon Samsung Galaxy S 4] Autokill45:
Thank you that helps so much. So I should do the full wipe correct? And how do I extract the PIT file? Should I just download the one from the thread?
[Verizon Samsung Galaxy S 4] Illogi.xbone:
You want stock yes? Should just download Odin and the NC5 image. Place the NC5 in PDA if I remember correctly, been a while but should be. Once it is flashed you can then re root and do what not :) And yes I would do full wipe.
[Verizon Samsung Galaxy S 4] Autokill45:
Yes I want stock NC5 so I can use towel root again. Sorry if these are stupid questions, this is my only experience with anything like this and I'm having trouble understanding.

So I should download Odin amd the full wipe NC5 image, unzip the image and place it in AP correct? But in the video he talks about drivers, do I need these and if so where do I get them? And in the thread under the directions for the full wipe step 3 says to extract the PIT file from your phone, do I need to do that?
[Verizon Samsung Galaxy S 4] Illogi.xbone:
We all start from somewhere :highfive: Yes, follow the instructions to the letter. Follow step 3 and you are golden. First Check to see if you already have drivers installed. Open Odin with your phone in download mode and plug it in. If Odin finds it then you already have the drivers if not windows may install them for you, if you are on 7 and up I know for sure. :laugh: Had to use Odin a lot before with my old S4.
[Verizon Samsung Galaxy S 4] Autokill45:
Well I finally figured it out. Nearly had a heart attack when I pushed the run button lol. Thank you guys so much for the help!
[Verizon Samsung Galaxy S 4] Illogi.xbone:
No problemo man :) :highfive:
[Verizon Samsung Galaxy S 4] papasmurph:
I did the full wipe via Odin to restore to NC5 and the only hiccup I'm having is that WiFi will not connect. I've done multiple reboots, too, just FYI.

Any suggestions, please?
[Verizon Samsung Galaxy S 4] Illogi.xbone:
Do you have Safestrap installed? Sounds like you need the right modem.
[Shield Q&A] stafer:
Sorry if this is posted somewhere I have been searching for months now on how to unroot the portable controller version of shield and keep running in to the Nvidia Sheild Tablet tutorials and what I do find on the first shield is only how to root it not unroot it. Can any one help me please, point me in the right direction? :(
[Shield Q&A] zach jeremay:
Download super su from the playstore , than go to its setting in app, than u will find annunroot option. Bam. Simple.
[Sony Xperia Z Ultra] squeak123:
I know the Z Ultra GPE supports some of the LTE bands that Verizon uses (bands 4 and 2). Would I be able to use this as an LTE only device on Verizon's network. If so, would it be as simple as swapping my Verizon sim card in, or would I have to do some more in depth work arounds? I've done some reading and can't find a concrete answer either way. Thanks in advance for your time!
[Sony Xperia Z Ultra] squeak123:
Well since i got no replies I decided to try it. I got the phone and it seems to recognize the sim card, but doesn't find any service. I downloaded an app on my working Verizon phone that tells me what frequency LTE I'm connected to and it says 7xx mhz which of the three bands that Verizon uses is the one that the Z Ultra doesn't support. It seems that's the frequency used in my area, so I can't say that it wouldn't work on the other frequencies, but it doesn't work in my area.
[Galaxy S 5 Q&A, Help & Troubleshooting] EricV1993:
Hello guys,

I tried to install the OmegaRom v16, but i hadn't any mobile network connection. Furthermore i tried to install a new modem to fix this issue. I choose the ANG8 - Modem and tried to install it with my Mobile Odin v4.2. After my phone tried to restart itself I am stuck in the "Recovery Booting" - screen .

I tried to restarted it (removed the battery), but it didnt help. My phone tried again to boot in the recovery mode by itself.

Sorry for my horrible english. I hope you can understand my problem. Thanks for your attention.

Bye,

Eric
[Galaxy S 5 Q&A, Help & Troubleshooting] *Detection*:
_________________________________________________________________
[Galaxy S 5 Q&A, Help & Troubleshooting] metalfan78:
You can't flash modems with mobile odin, use your pc
[JASJAR, XDA Exec, MDA Pro General] afxal:
i dont get any network signal for my exec when i open the mobile and enter the the pin code after some time its there and then no network wat shall i do
[JASJAR, XDA Exec, MDA Pro General] chunwoo2k:
please try to upgrade radio module to 1.15

maybe you still need to unlock sim to become supercid.
[AT&T Samsung Galaxy S 4 Q&A, Help & Troubleshootin] mil0:
I have an old Canadian Bell based Galaxy s4, with a dead screen. I'd like to try to get files off it, but did not enable usb debugging mode prior to the screen breaking.

Is there any way to access the file system on the phone in this situation? I've done a bit of looking around and can see that I should be able to access it via adb if I have usb debugging turned on, but debugging isn't on in this case.

I have usb connected the phone to my fedora machine and can see via dmesg that it does get detected. I can hear the thing start up, but beyond that I can't see anything else.

Googling around it sounds like I should be able to load a recover kernel, with debugging turned on if I use the right process, but I can't find enough into to get me going.

dmesg output is below just in case it helps...

.....................................................................................

[ 4104.343749] usb 2-2: USB disconnect, device number 6

[ 4180.261104] usb 2-2: new high-speed USB device number 7 using ehci-pci

[ 4180.376385] usb 2-2: New USB device found, idVendor=04e8, idProduct=6860

[ 4180.376390] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3

[ 4180.376394] usb 2-2: Product: SAMSUNG_Android

[ 4180.376396] usb 2-2: Manufacturer: SAMSUNG

[ 4180.376399] usb 2-2: SerialNumber: ........

Any help is much appreciated!
[AT&T Samsung Galaxy S 4 Q&A, Help & Troubleshootin] jd1639:
If you can get a custom recovery on you can use adb without use debugging on. I assume you have an i337m. Try this with twrp http://galaxys4root.com/clockworkmodtwrp-recoveries/
[AT&T Samsung Galaxy S 4 Q&A, Help & Troubleshootin] macasus76:
If you have a custom recovery plug it up to hdmi thru HML and use the TV for the screen. Hopefully the touchscreen still works. This worked for mine. No lcd but the digitizer was still good.
[LG G Watch R] shaolin95:
You think this one will work and look fine?

I am really in love with a TW that another person posted but this one may not be bad either. :)

Not crazy about the white stitching though.