[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] khongloi113:
Hello XDA again,

Maybe many of you knew me before, especially my work on secure folder for rooted note 5.

I currently own Note 8 rooted.

Many devs said that Samsung introduced TEE and because of that we can not use secure folder again.

After spending a lot of time on investigating, patching both old and new lib, apk, framework, services I figured that actually Secure Folder is currently not related to TEE. Samsung just patched by code then we can bypass their patch to use Secure Folder in custom rooted rom.

How:

A. FOR PIE ROM

I. Include all Knox related things in your rom.

II. Patch build.prop:

change ro.config.iccc_version=3.0 to

ro.config.iccc_version=iccc_disabled

De-compile new SecureFolder.apk show that it uses Iccc (IntegrityControlCheckCenter) to check system integrity status (device_status). If it's ok, SecureFolder.apk will create container. Old SecureFolder.apk did not use that check.

Patch libtz_iccc.so is difficult so that just bypass this check by above patch.

III. Patch services.jar

Lcom/samsung/android/knox/SemPersonaManager is personal manager for knox related things. If device is compromised then Lcom/samsung/android/knox/SemPersonaManager will set persona's attribute to 0x4 and securefolder container will be uninstalled.

Check this code in Lcom/android/server/pm/PersonaManagerService:

iget-object v11, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;

invoke-static {v11}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z

move-result v11

if-nez v11, :cond_2

.line 1345
const-string v11, "PersonaManagerService"

const-string v12, "Device compromise detected !"

invoke-static {v11, v12}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

.line 1346
[COLOR="DarkOrange"] invoke-static {v10, v9}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]

move-result v10

if-nez v10, :cond_3

.line 1347
const-string v10, "PersonaManagerService"

const-string/jumbo v11, "setting compromise attribute failed !"

invoke-static {v10, v11}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

goto :goto_2

.line 1349
:cond_2
invoke-virtual {v8}, Landroid/content/pm/UserInfo;->isSuperLocked()Z

move-result v10

if-eqz v10, :cond_3

.line 1350
const-string v10, "PersonaManagerService"

const-string v11, "Device is super locked - start lock screen"

invoke-static {v10, v11}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

.line 1354
.end local v8 # "ui":Landroid/content/pm/UserInfo;
:cond_3
:goto_2
iget-object v8, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;

invoke-static {v8}, Lcom/samsung/android/knox/SemPersonaManager;->isKioskModeEnabled(Landroid/content/Context;)Z

move-result v8

if-eqz v8, :cond_4

.line 1355
iget-object v8, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;

invoke-static {v8}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z

move-result v8

const/4 v8, 0x1

if-nez v8, :cond_4

.line 1356
invoke-direct {p0}, Lcom/android/server/pm/PersonaManagerService;->getPersonaManager()Lcom/samsung/android/knox/SemPersonaManager;

move-result-object v8

invoke-virtual {v8}, Lcom/samsung/android/knox/SemPersonaManager;->getKioskId()I

move-result v8

[COLOR="darkorange"] invoke-static {v8, v9}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]

move-result v8

if-nez v8, :cond_4

.line 1357
const-string v8, "PersonaManagerService"

const-string/jumbo v9, "setting compromise attribute failed !!"

invoke-static {v8, v9}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

.line 1362
:cond_4
return-void

and this code in Lcom/android/server/pm/PersonaServiceHelper

.method public static shouldBlockUserStart(Landroid/content/Context;I)Z
.locals 7
.param p0, "c" # Landroid/content/Context;
.param p1, "userId" # I

.line 934
invoke-static {}, Landroid/os/Binder;->clearCallingIdentity()J

move-result-wide v0

.line 936
.local v0, "token":J
:try_start_0
const-string v2, "PersonaServiceHelper"

new-instance v3, Ljava/lang/StringBuilder;

invoke-direct {v3}, Ljava/lang/StringBuilder;-><init>()V

const-string/jumbo v4, "shouldBlockUserStart() "

invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v3, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v3}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v3

invoke-static {v2, v3}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

.line 937
invoke-static {}, Lcom/android/server/pm/PersonaServiceHelper;->getUserManager()Lcom/android/server/pm/UserManagerService;

move-result-object v2

invoke-virtual {v2, p1}, Lcom/android/server/pm/UserManagerService;->getUserInfo(I)Landroid/content/pm/UserInfo;

move-result-object v2

.line 938
.local v2, "uinfo":Landroid/content/pm/UserInfo;
if-eqz v2, :cond_2

.line 939
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isManagedProfile()Z

move-result v3

const/4 v4, 0x1

if-eqz v3, :cond_0

.line 940
invoke-static {p0}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z

move-result v3

if-nez v3, :cond_0

.line 941
[COLOR="darkorange"] const/4 v3, 0x4

invoke-static {p1, v3}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]

.line 942
const-string v3, "PersonaServiceHelper"

new-instance v5, Ljava/lang/StringBuilder;

invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

const-string v6, "Device compromise attribute set for user : "

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v5

invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I

.line 943
iget v3, v2, Landroid/content/pm/UserInfo;->id:I

if-eqz v3, :cond_0

.line 944
const-string v3, "PersonaServiceHelper"

new-instance v5, Ljava/lang/StringBuilder;

invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

const-string v6, "blocking when device compromised "

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v5

invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_0
.catchall {:try_start_0 .. :try_end_0} :catchall_0

.line 945
nop

.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

.line 945
return v4

.line 950
:cond_0
:try_start_1
iget v3, v2, Landroid/content/pm/UserInfo;->id:I

if-eqz v3, :cond_1

invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isManagedProfile()Z

move-result v3

if-eqz v3, :cond_1

invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isDeviceCompromised()Z

move-result v3

if-eqz v3, :cond_1

.line 951
const-string v3, "PersonaServiceHelper"

new-instance v5, Ljava/lang/StringBuilder;

invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

const-string v6, "blocking when device compromised : "

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v5

invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_1
.catchall {:try_start_1 .. :try_end_1} :catchall_0

.line 952
nop

.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

.line 952
return v4

.line 955
:cond_1
:try_start_2
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isSuperLocked()Z

move-result v3

if-eqz v3, :cond_2

invoke-static {p1}, Lcom/samsung/android/knox/SemPersonaManager;->isLegacyClId(I)Z

move-result v3

if-eqz v3, :cond_2

.line 956
const-string v3, "PersonaServiceHelper"

new-instance v5, Ljava/lang/StringBuilder;

invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

const-string v6, "blocking non-BYOD super locked user "

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v5

invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_2
.catchall {:try_start_2 .. :try_end_2} :catchall_0

.line 957
nop

.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

.line 957
return v4

.line 961
:cond_2
const/4 v3, 0x0

.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

.line 961
return v3

.line 963
.end local v2 # "uinfo":Landroid/content/pm/UserInfo;
:catchall_0
move-exception v2

invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

throw v2
.end method

Then we can bypass those things by several way:

1. Delete those Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z lines

2. Patch Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z so that it returns true. But this way may cause other issues related to tima.

3. Just add simple code like below:

invoke-static {v11}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z

move-result v11

[COLOR="DarkOrange"] const/4 v11, 0x1[/COLOR]

if-nez v11, :cond_2

Better use the third way.

IV. Patch method isUnifiedKeyStoreSupported in Lcom/android/server/locksettings/SyntheticPasswordManager so that it return true, by two way:

1. Simply add that line (from S10 firmware to system/etc/floating_features.xml:

<SEC_FLOATING_FEATURE_KNOX_SUPPORT_UKS>TRUE</SEC_FLOATING_FEATURE_KNOX_SUPPORT_UKS>

2. Modify smali file.

V. If your rom is a ported rom. You should replace services\smali_classes3\com\android\server\enterpr ise\ccm from stock services.jar.

VI. Recompile services.jar and enjoy secure folder.

B. FOR OREO ROM

I. Include all Knox related things in your rom.

II. Patch build.prop:

change ro.config.iccc_version=3.0 to

ro.config.iccc_version=iccc_disabled

De-compile new SecureFolder.apk show that it uses Iccc (IntegrityControlCheckCenter) to check system integrity status (device_status). If it's ok, SecureFolder.apk will create container. Old SecureFolder.apk did not use that check.

Patch libtz_iccc.so is difficult so that just bypass this check by above patch.

III. Patch services.jar

Lcom/samsung/android/knox/SemPersonaManager is personal manager for knox related things. If device is compromised then Lcom/samsung/android/knox/SemPersonaManager will set persona's attribute to 0x4 and securefolder container will be uninstalled.

Check this code in Lcom/android/server/pm/PersonaManagerService:

iget-object v11, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;

invoke-static {v11}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z

move-result v11

if-nez v11, :cond_2

.line 1345
const-string v11, "PersonaManagerService"

const-string v12, "Device compromise detected !"

invoke-static {v11, v12}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

.line 1346
[COLOR="DarkOrange"] invoke-static {v10, v9}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]

move-result v10

if-nez v10, :cond_3

.line 1347
const-string v10, "PersonaManagerService"

const-string/jumbo v11, "setting compromise attribute failed !"

invoke-static {v10, v11}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

goto :goto_2

.line 1349
:cond_2
invoke-virtual {v8}, Landroid/content/pm/UserInfo;->isSuperLocked()Z

move-result v10

if-eqz v10, :cond_3

.line 1350
const-string v10, "PersonaManagerService"

const-string v11, "Device is super locked - start lock screen"

invoke-static {v10, v11}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

.line 1354
.end local v8 # "ui":Landroid/content/pm/UserInfo;
:cond_3
:goto_2
iget-object v8, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;

invoke-static {v8}, Lcom/samsung/android/knox/SemPersonaManager;->isKioskModeEnabled(Landroid/content/Context;)Z

move-result v8

if-eqz v8, :cond_4

.line 1355
iget-object v8, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;

invoke-static {v8}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z

move-result v8

const/4 v8, 0x1

if-nez v8, :cond_4

.line 1356
invoke-direct {p0}, Lcom/android/server/pm/PersonaManagerService;->getPersonaManager()Lcom/samsung/android/knox/SemPersonaManager;

move-result-object v8

invoke-virtual {v8}, Lcom/samsung/android/knox/SemPersonaManager;->getKioskId()I

move-result v8

[COLOR="darkorange"] invoke-static {v8, v9}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]

move-result v8

if-nez v8, :cond_4

.line 1357
const-string v8, "PersonaManagerService"

const-string/jumbo v9, "setting compromise attribute failed !!"

invoke-static {v8, v9}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

.line 1362
:cond_4
return-void

and this code in Lcom/android/server/pm/PersonaServiceHelper

.method public static shouldBlockUserStart(Landroid/content/Context;I)Z
.locals 7
.param p0, "c" # Landroid/content/Context;
.param p1, "userId" # I

.line 934
invoke-static {}, Landroid/os/Binder;->clearCallingIdentity()J

move-result-wide v0

.line 936
.local v0, "token":J
:try_start_0
const-string v2, "PersonaServiceHelper"

new-instance v3, Ljava/lang/StringBuilder;

invoke-direct {v3}, Ljava/lang/StringBuilder;-><init>()V

const-string/jumbo v4, "shouldBlockUserStart() "

invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v3, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v3}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v3

invoke-static {v2, v3}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

.line 937
invoke-static {}, Lcom/android/server/pm/PersonaServiceHelper;->getUserManager()Lcom/android/server/pm/UserManagerService;

move-result-object v2

invoke-virtual {v2, p1}, Lcom/android/server/pm/UserManagerService;->getUserInfo(I)Landroid/content/pm/UserInfo;

move-result-object v2

.line 938
.local v2, "uinfo":Landroid/content/pm/UserInfo;
if-eqz v2, :cond_2

.line 939
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isManagedProfile()Z

move-result v3

const/4 v4, 0x1

if-eqz v3, :cond_0

.line 940
invoke-static {p0}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z

move-result v3

if-nez v3, :cond_0

.line 941
[COLOR="darkorange"] const/4 v3, 0x4

invoke-static {p1, v3}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]

.line 942
const-string v3, "PersonaServiceHelper"

new-instance v5, Ljava/lang/StringBuilder;

invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

const-string v6, "Device compromise attribute set for user : "

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v5

invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I

.line 943
iget v3, v2, Landroid/content/pm/UserInfo;->id:I

if-eqz v3, :cond_0

.line 944
const-string v3, "PersonaServiceHelper"

new-instance v5, Ljava/lang/StringBuilder;

invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

const-string v6, "blocking when device compromised "

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v5

invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_0
.catchall {:try_start_0 .. :try_end_0} :catchall_0

.line 945
nop

.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

.line 945
return v4

.line 950
:cond_0
:try_start_1
iget v3, v2, Landroid/content/pm/UserInfo;->id:I

if-eqz v3, :cond_1

invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isManagedProfile()Z

move-result v3

if-eqz v3, :cond_1

invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isDeviceCompromised()Z

move-result v3

if-eqz v3, :cond_1

.line 951
const-string v3, "PersonaServiceHelper"

new-instance v5, Ljava/lang/StringBuilder;

invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

const-string v6, "blocking when device compromised : "

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v5

invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_1
.catchall {:try_start_1 .. :try_end_1} :catchall_0

.line 952
nop

.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

.line 952
return v4

.line 955
:cond_1
:try_start_2
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isSuperLocked()Z

move-result v3

if-eqz v3, :cond_2

invoke-static {p1}, Lcom/samsung/android/knox/SemPersonaManager;->isLegacyClId(I)Z

move-result v3

if-eqz v3, :cond_2

.line 956
const-string v3, "PersonaServiceHelper"

new-instance v5, Ljava/lang/StringBuilder;

invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

const-string v6, "blocking non-BYOD super locked user "

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v5

invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_2
.catchall {:try_start_2 .. :try_end_2} :catchall_0

.line 957
nop

.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

.line 957
return v4

.line 961
:cond_2
const/4 v3, 0x0

.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

.line 961
return v3

.line 963
.end local v2 # "uinfo":Landroid/content/pm/UserInfo;
:catchall_0
move-exception v2

invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V

throw v2
.end method

Check this code in KnoxMUMContainerPolicy

invoke-static {v5}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/ContextZ

move-result v5

if-nez v5, :cond_0

Then we can bypass those things by several way:

1. Delete those Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z lines

2. Patch Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z so that it returns true. But this way may cause other issues related to tima.

3. Just add simple code like below:

invoke-static {v11}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z

move-result v11

[COLOR="DarkOrange"] const/4 v11, 0x1[/COLOR]

if-nez v11, :cond_2

invoke-static {v5}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/ContextZ

move-result v5

[COLOR="DarkOrange"] const/4 v5, 0x1[/COLOR]

if-nez v5, :cond_0

Better use the third way.

IV. Patch method isUnifiedKeyStoreSupported in Lcom/android/server/locksettings/SyntheticPasswordManager so that it return true, by two way:

1. Simply add that line (from S10 firmware to system/etc/floating_features.xml:

<SEC_FLOATING_FEATURE_KNOX_SUPPORT_UKS>TRUE</SEC_FLOATING_FEATURE_KNOX_SUPPORT_UKS>

2. Modify smali file.

V. Mod KnoxFileHandler

In Oreo Samsung forced using tima to store, retrive and delete encryptkey. But in Pie they changed to use KeyProtector. So that we will mod KnoxFileHandler. Compare modded one to stock one in attached to find out what need to be changed.

VI. If your rom is a ported rom. You should replace services\smali_classes3\com\android\server\enterpr ise\ccm from stock services.jar.

VII. Recompile services.jar and enjoy secure folder.

PS:

VII. SamsungPay and SamsungPass still use TEE, their own trustlets and use samsung server to check, store hash code. I will try to investigate deeper on those apk if I have time.