yashsingh1/xdaforums huggingface dataset:
[Android General] rhcp011235:
Thank you. But I am not interested in posting it if it’s not the same.
[Android General] bestsofttj:
if adb enabled then worked
[Android General] mamun2109030:
Does any solution for app not install. Manually I can install the first app but not second. Device samsang A23 4G

View attachment 5994829
[Android General] srikanth444:
Just run step1.bat file it does it u need not install them manually
[Android General] mkalam01:
where is qr code
[Android General] mamun2109030:
KG status is LOCKED

FRP state is ON

OEM state is ON

Binary: samsung official

Now I'm using Bypass from Emailson bro. Try to new method But Not get Knox permisson. I have enable the klms and other disable service and uninstall CCSWE but not get knox license permission. Device A23 4G.

View attachment 5994933
[Android General] srikanth444:
search google alliance owner setup ull get the qr
[Android General] srikanth444:
You Should Not Remove lycan, u need to enable klms agent from alliance and remove alliance owner and admin permissions from alliance settings then restart, then u will be able to get knox permissions to the app. hope this helps
[Android General] mastar blastar:
interesting, if you do not mind me asking, what is the procedure to enable us to send AT commands to the device ?
[Android General] mamun2109030:
Thanks eveyone for your support. Totally unlock my device
[Android General] czermar:
Thank you @melksants and @Emilson

I just succeed for S21 Ultra. Totally unlocked device. I hope the KG lock will not come back someday...

1. I started with Factory Reset (I like to have a clean start)

2. Used SamFw Tool to enable ADB Debugging

3. Followed the instructins from the movie posted by @melksants (only 2nd part)
[Android General] Gazphard:
Bro, help pls!! When I run the command AT+PARALLEL=2,0,00000;AT+SERIALNO=2,R9JN70R5D9J it gives me this error. Are there any other commands I should run before that?
[Android General] Emilson:
Check those two apps:

-'Device Services' (com.samsung.android.kgclient)

-'knox enrolment service' (com.sec.enterprise.knox.cloud.smdms)

Try to disable them thru 'lycan ccswe app manager' or Alliance shield x'

If you cant disable them thru app, download Samfwfrptool for pc.

try to use 'disable knox' option. That should disable all knox apps.

You need to enable 'adb debug' in phone settings developer options.

if you cant, tap 'Phone' app and type *#0*# when using SamFw Tool.

Not sure if this will help in this case, but these apps usually block access

Maybe You may need to disable these applications right at the first setup wizard to make this work, not sure.

Ps. tell me what version of android system and 'security patch level' date you have.

You can find it in phone settings software info.
[Android General] hamza2512:
View attachment 5880537I will try WHT you told me and then I will let you know
[Android General] hamza2512:
It works for me brother thank you so much
[Android General] iBowToAndroid:
Did you manually disable via ADB, or did you use SamFW?
[Android General] fitrockx:
Hello, I am having some issues. When I install the splashtop app it doesn't let me pick what privileges to grant, it automatically grants all of them. See picture. So I decided to use it like that. I am able to disable klsm through Alliance manager but I am unable to uninstall the splashtop app even after deactivating it from device manager. I can't uninstall it through Alliance either. Therefore I am unable to install Lycan Ccswe to continue the rest of the process.
[Android General] Emilson:
Is that splashtop addon from my link?

It looks like an old version

Try the latest available version

'splashtop-add-on-samsung' (com.splashtop.streamer.addon.knox)
[Android General] fitrockx:
Yes, it was from your link. Now this one you provided does the trick. I will try again and let you know. Thank you!
[Android General] Emilson:
Sorry my bad, I didn't notice that there is an old version in one of the download links.

I have to update links then.
[Android General] fitrockx:
Hey don't worry. I am pleased to announce that now I was able to bypass it on a S23 running android 13 with March 2023 security patch. The only different step I had to do was install an uninstaller app (I used https://play.google.com/store/apps/details?id=com.splendapps.shark&hl=en&gl=US) to be able to uninstall the Splashtop app from there, and then I continue the process as described in the Lycan Method. Now I am searching to be able to recover most of the stock interface options possible. I am so grateful for your work and step by step guide.
[Android General] iBowToAndroid:
How did you install the apks? I never get the MTP permission popup, so I can't copy them to internal storage
[Android General] fitrockx:
I did it with a usb otg drive, copied all the apks to the drive and opened my files trough alliance to install them from the usb.
[Android General] fitrockx:
I was able to disable it through cmd adb shell commands:

pm disable-user --user 0 com.samsung.android.kgclient

pm disable-user --user 0 com.sec.enterprise.knox.cloudmdm.smdms
[Android General] Emilson:
Just wondering what cause these complications with splashtop, perhaps they are related to newest security..

One more idea comes to mind, by uninstalling splashtop thru adb with command:"

adb shell pm uninstall --user 0 com.splashtop.streamer.addon.knox

anyway I'm glad you managed to solve this problem (y)
[Android General] Emilson:
did you try download SamFw Tool and tap 'Phone' app and type *#0*# when using SamFw Tool, to unlock adb??

Then you can disable 'com.samsung.android.kgclient' to prevents disabling adb/mtp after reboot

(Kgclient can be disabled only after disabling systemUi services, otherwise triggers kg lock security)

Now SamFw Tool has an 'app manager' same as 'AdbAppControl' where you can install/uninstall, enable/disable apps on the phone.

To get 'app manager' in SamFw tool you need to switch tab from 'samsung' to 'android'.

EDIT:

if you really can't get adb acces, you can run youtube app find my video and open xda link and download apps directly to your phone.

☆added shortened link to xda post and updated links to Direct Download, so you can just open link t.ly/-SQT in phone browser and downloads apps directly to phone.
[Android General] fitrockx:
I believe it's the security patch because I was unable to unlock adb, even trying with *#0*#. But after doing all the process with the uninstaller app workaround I was able to unlock adb through developer options.
[Android General] Emilson:
that would be correct because someone already wrote to me about not being able to use the *#0**# trick
[Android General] fitrockx:
I believe once Lycan is unistalled, even after choosing to keep the app data, everything disabled through it enables back. I unistalled it keeping the data and got the mdm kg lock screen again. Had to factory reset and do all the process again.
[Android General] iBowToAndroid:
My issue is that incoming calls only work when the screen is on and lit up. If the screen is off, then they go directly to voicemail

These 2 are both disabled already

If anyone has any insight or figures it out, would appreciate a response
[Android General] fitrockx:
Try to use "Disable Knox" from SamFw Tool. Connect the phone to the PC, go to developer options and enable USB debugging then open SamFw tool and Disable Knox.
[Android General] melksants:
this is interesting and necessary for a totally definitive KG, anyone who works with JTAG knows that SN needs to be changed to avoid relocks
[Android General] Emilson:
@Gazphard use all the commands shared by @melksants to enable the appropriate UART mode, then you can use one with your new serial number.

⚠️I do not recommend posting private serial numbers publicly, if everyone will use the same number, I bet that may make some problems. (not sure how unique and important SN are)

Btw. Changing only SN does nothing to kg unlock yet.

(I tested that already, kg lock stays anyway, even after facory reset.)

Only combination with changing SN and changing Kg Lock state to active may be a solution for case like yours.

i saw solution on YT where they change SN and then flash a clean firmware, (because through jtag they can bypass any lock and flash anything) to clear kg locked status. so that's where my idea came from.
[Android General] Gazphard:
Thank you so much! I'll just try changing the SN and change the kg state again, then I'll just format and see what happens. Because I can't find firmware less than mine that is binary 4.
[Android General] Emilson:
I was looking here https://samfw.com/

and i see there is a lot of 'binaries from 1to5 for a32 but I'm no magician, diviner or fairy to guess whats is your exact model, when I can found at least 10 different models of a32 🙃

Or maybe I missed where you post your model
[Android General] Gazphard:
Thanksss! my model is the A325M. Will it be possible, knowing if it is illegal or not, to modify the IMEI with the same tool?
[Android General] Emilson:
sorry, i have no idea about this.

(I don't understand why are you all asking about this?😳? You cant make calls after unlocking KG?)

Btw. A325M there are firmwares as I wrote above, from binary 1 to 5 (android11 to 13)

you have to download it yourself

Link, once again https://samfw.com

keep in mind that samsung doesn't allow to downgrade some newer firmwares.(i've seen info in one of last updates android13 that after update you cant downgrade, but it wasn't my phone.)

I don't know the rules of when you can downgrade, how low you can downgrade or from which you can't.

in that case if you downgrade it anyway you can get kind a 'soft brick' with a error message on boot - until you flash acceptable higher system again.

I had this case years ago, don't know if anything has changed
[Android General] Gazphard:
ahahah what the kg lock returns is the imei as I see, that's why I ask
[Android General] Ansh7448:
Did Anyone other than @Gazphard receive the lock again? Or what steps did you take to make sure it doesn't?
[Android General] rhcp011235:
So if we are able to change the serial number using:

`AT+PARALLEL=2,0,00000;AT+SERIALNO=2,XXXXXX`

Are we hypothetically able to change the IMEI as well? if so, what would the command be for that? I am about to download the radio image (if someone can supply me with one) if the command is not known
[Android General] mastar blastar:
got the newest method working on a S22 Ultra running the July update. the device was running the Lycan bypass and was shutting down after roughly five and a half minutes.

Massive thanks to @melksants, @Emilson and @srikanth444; @Emilson first for their post on applying the Alliance Shield+Lycan bypass to the device that i have(Galaxy S22 Ultra), @melksants for posting the KG state reset method and @srikanth444 for showing that the KG state reset method could be done on devices running the July security update and for the tip on enabling klms agent in Alliance Shield in order to get rid of the Knox error.

some notes on my experience:

- like srikanth444, i also needed to run step1.bat more than once for the process to be successful. running the commands one by one is also an option.

- the klms agent must be re-enabled from Alliance Shield in order for the app that is setup by step1.bat to be successful in being granted device admin and knox privileges.

- i have been able to change the device serial number by running these AT commands that were originally posted by melksants and Emilson:

AT+SWATD=0

AT+ACTIVATE=0,0,0

AT+SWATD=1

AT+PARALLEL=2,0,00000;AT+DEBUGLVC=0,5

AT+PARALLEL=2,0,00000;AT+SERIALNO=2,XXXXXXXXXXX(the X's represent the serial number)

in my case, i needed to change the device's usbsettings, that is found by dialling *#0808#, to RNDIS+DM+MODEM+ADB then i was able to send AT commands to the device through SGTKEif. this does not seem to have had any effect on the KG Status in the download mode(it is still Active(01) which is what it was after the reset) it remains to be seen if changing the serial will prevent a relock of the device.

all in all Thank you very much to everyone mentioned for making our devices usable again.
[Android General] melksants:
samsung devices can downgrade based on the binary, an example would be the S21 in binary 7 in the G991BXXS7EWE3 version it could downgrade to the G991BXXS7EWC4 version without problems, never downgrade to a lower binary than the current one (also never downgrade on samsung devices with UNISOC, they die lol)
[Android General] adfree:
Maybe somebody find way again...

To dump RPMB partition... via Software only...

Write access to RPMB would be cool... but READ access to dump the 16 MB without direct eMMC stuff...

Any idea what this is? In RPMB partition found...

"serverMsg":

Some blabla Base64 encoded data...

"serverToken":

Base64 encoded... Decoding Result is 256 Byte... this remembers me on RSA 2048...

But I have no idea...

In KG APK few Certs can be found...

MASTER_PINNING_SERVER_CERT_CN.PEM.cer

B80DC6F2A1385258F3FFEA174C2FE6858B3FCB4972F90AB644213E71878B03B1E999BD0F45BCE393A455817B3585BA6669ABBD0D9C7324689FE1DC8CE83F9BD47F5122359242B27A071A1E7240F22E8870F27DF31C5EB76A70389AF2ECE162A1E388E582B5BE7C09D0F1009349E0F26EFA86CD80CEADF11D690A8B5E368984831F35AD937A04255F2FBA4F403C908898CDAF666E885FF877E184F6A30C31BDD967AE7FC9B38BEFEC5BA7DA63FB0D990DE6783DD8C6FDD2D000216E874ED1AA29244F27F7FDB54B81CBD41E7CD960829029816761DA219E7E3D761BFA25CACDF858313342AC22DBDC2C33F101841028FB85CCAAC53E07B7F772F5DAF288F1D305

B80DC6F2A1385258F3FFEA174C2FE685

MASTER_PINNING_SERVER_CERT_PROD.PEM.cer

A4768786B4586C747397C56AD64708E62190D2AD96BF6555260030F3DB3DA4ADE678A2F11C8BAB64B03608B1F7CFE0A63451883AC407A8EE9ED04F078B9255ED210F785393A4FBCA36142D4EDDD49638D389D804F09B220B0E498414C8359B92708688E0A0113AD3346CDC511A40AC6A3C10FF91B202491B194D53F62F66E3424DBB40BE287BDAA15F1C5C55C37B8379950F6E37BA6A2076598DD999025AE3A49CF4EF5C7262866D8DD7A055F20E3F64A15839F5ECBF9F2A64A0645C401C492BE34CCDB72C72C0EF47D15CCFAEA3FFBC10524547F450F74B541362B3E99E9B939181A3040B9DA54CD4A3456C53B8AD4BB0553458E2FE8100C27FD148A723ED83

A4768786B4586C747397C56AD64708E6

MASTER_PINNING_SERVER_CERT_STAGE.PEM.cer

B67E9586E43254D202FA3EE0F21EDB01B512A2CE465C4FD746DEA9B2CF6F671BEFBDD7EE24CC769E52D6503AA724FA15EB2CAE6C7D886AF674B822F7AD66184D7839E3C135589D271156BA9D873A422033D39BF1EFF00B108F02931E395DAFA27584A735A71A821235230AD05BE218A3CC3B39A6E7AF7F70745B64A6C33620CAE4B94CC61DD98475BEB7F845349F538E9B2D86AF15041B2C98EA4B160AED71A468C46A74A17A5103B7C0DE8C70B8B271EFED7AB25373EC2072C3D35194FDD069D1DAB8730A4B21AFC51B3A3C5FA3C65A7B251823487E5F80701DA7D3E3CC95434F6D5ECBD872CF99E055189B4B5612305767FA72B0BDAC1A8576671A2ADDD91D

B67E9586E43254D202FA3EE0F21EDB01

256 Byte is RSA 2048 Modulus...

16 Byte is for my little small tiny brain... easier for Copy and Paste and to search through files...

Only as Info.

Best Regards
[Android General] melksants:
ABOUT RELOCKING

I've been following some forums and websites and I noticed that the relock

of the devices and a reality, the procedure just changes from LOCKED to ACTIVE, it would be the same as what would happen if I paid the invoice, that is, at any moment there could be an update and everything would be relocked again

To avoid this I recommend disabling the Knox Enrollment app and blocking KNOX connections using a firewall app

edit1: I currently use Alliance Shield Rebirth (donate version), firewall works without needing a VPN

edit2: for a complete removal it is necessary to change the imei and SN of the device (which is not legal in many countries)
[Android General] melksants:
some tools nowadays allow the reading and writing of the RPMB through a USB cable, but this does not work for all models

You can even take a copy of an RPMB and write it to another device (for example, I can take a rpmb from one with KG COMPLETED and write in mine that it is LOCKED, and thus change the state of the KG of my device)
[Android General] adfree:
I "know" only KG info is written to RPMB and steady partition...

No idea yet where else data KG related is stored...

IMHO RPMB partition is IMHO also reason why we can not downgrade Bootloader...

I am out of Luck with SM-G965F and UH/SH sboot Version...

No bit 17 Combination Firmware exists... in "public"...

And now my new Toy...

SM-A505FN similar problem....

Damn U9/S9 sboot... and no Combination Firmware...

And because oldest Firmware i can downgrade is after March 2021...

I can not easily play with eToken...

Mag.a or T.ger Tool showed around 20 Modes... with funny names like KNOX_TEST... etc...

v3 forgotten...

And no idea what kind of data KG related we can find via Debug HIGH and Upload Mode...

New Phones no need RDX Tool or similar... can ramdump to external SD Card...

Best Regards
[Android General] rhcp011235:
Any of you play with Sim unlock as well? we appear to be accessing NVRAM if I am not mistaken here.

So we should be able to change the Sim lock status as well.

Looks like you can read the carrier lock by:

AT+SVCIFPGM=1,4
[Android General] Gazphard:
I found an old AT command, will it work to alter the *IM€I* ?

AT +EGMR=1.7,"xxxx..."

I literally don't know anything about AT commands 🙃
[Android General] rhcp011235:
That command was for MTK devices I don’t own a device to test on. Anyone care to try?

These are ones that I found in the strings of a modem.bin

AT+CPLDUCFG

AT+MSLSECUR

AT+LVOFLOCK=1,0k

AT+IMEISIGN=0,6,0

AT+SYSSLEEP

AT+VERSNAME

AT+PRODCOD

AT+READRSSI

AT+SCMMONIT

AT+TESTM0

AT+DETA

VSAT+TF

qAT+LOCK

AT+MEIDAUTH

AT+CHNSELCT

AT+FACTOR

AT+IMEISIGN=0,6,NG_NONE
[Android General] coolpixs4:
Previously, my bought online device had KG Knox LOCKED after few months & it was done KG Knox bypass by @Emilson

Since my bootloader status now is:

KG state: COMPLETED (Even that I don't know what does it means, some people said it is better than Active state - it has many statuses such as: Locked, Prenormal, Normal, Completed, Checking, Broken,...)

FRP lock: OFF

OEM lock: ON(U) (now OEM unlocking appear in Developer option mode, it didn't appear before)

I decided to take a risk by re-opening/enable KLMS by command thru ADB

"adb shell pm enable --user 0 com.samsung.klmsagent"

And then, go into the Lycan application.

System UI => re-open/enable previously blocked system interfaces 'SystemUiService' & 'KeyguardService'

Enable back all services that have been disabled before and uninstall the Lycan app

Uninstall all the supplement interface apps (Super status bar, lockscreen, ultra volume, One Shade notification, NotifiCon)

Then Reboot device

After Reboot, everything seems to be normal working...

Hope it will not relock again

The system interfaces work as it should be...

Last words: THANK YOU ALL for your valuable contributions on KG lock bypass Solutions
[Android General] melksants:
The KG COMPLETED status is the only one that allows unlocking the bootloader and the one that has the lowest risk of relocking the device
[Android General] mkalam01:
Can anyone tell me how to enable usb debugging in s23 security patch 01-08-2023.
[Android General] rash.m2k:
OK I bought a Galaxy Tab S7 (SM-T870) which was KG locked.

I managed to do a KG bypass, but I want to remove KG lock, I've also got a root shell using this exploit (https://xdaforums.com/t/exploit-shi...rite-your-own-system-app-with-an-api.4561879/)

But when I run the service call knoxguard_service 41 s16 'null' command I just get a Result: Parcel(00000000 ffffffff '........') nothing else.... I'm running oneui 3.1 android 11, security patch level 1 july 2021, KNOX 3.7 KNOX API LEVEL 33
[Android General] mastar blastar:
have you tried enabling it through Developer options ?
[Android General] mkalam01:
yeah it works but I'm talking when i am on hello screen not when while handset is fully on.I just want to apply the way to bypass kg lock by @melksants
[Android General] melksants:
enable usb debugging and start from step 2
[Android General] mastar blastar:
as melksants has advised, you can enable usb debugging when the phone is fully on and the steps they posted will still work; it did for me.
[Android General] rash.m2k:
You need to reset phone and install allianx, that will make it the admin on your phone and allow you to block the kg services, then the phone starts up semi normally and you can enable usb debugging from settings.
[Android General] srikanth444:
go with lycan bypass method 1st. then u can via developer options
[Android General] karl_mel:
Any solutions for this kindly help lycan method not working splashtop addon can't grant knox

View attachment 5996501
[Android General] mkalam01:
same security patch level I think in this patch lots pf things not working i have s23.
[Android General] mkalam01:
is this necessary to be on hello screen to Bypass kg or we can do on fully on handset i have tried on fully on screen but no luck scrcpy not opening
[Android General] karl_mel:
I tried and 2.apk failed to install
[Android General] mkalam01:
i have also tried.
[Android General] mkalam01:
Please guys tell me exactly what to do

I have s23 patch 01 aug 2023.

no frp @melksants @Emilson
[Android General] Ansh7448:
Scrcpy is a third party app which happens to be bundled with this. If this version isn't opening, try downloading it via searching from any search engine and you should be good to go.
[Android General] mkalam01:
I have searched for but no luck.
[Android General] srikanth444:
We're you able to bypass with alliance qr method?
[Android General] Emilson:
You have to use ADB to install 2.apk

step2.bat script is prepared to execute automated installation for both of these apps.(you can edit step2.bat in notepad if you want check commands.

these are some commands from step2.bat:

adb install 1.apk

adb install -i PrePackageInstaller 2.apk

what do you use SCRCPY for??

Do you have a broken screen or a non-working touchscreen?
[Android General] karl_mel:
SCRCPY is working fine my touch has no problem this the error am getting [-3001: INSTALL_FAILED_REJECTED_BY_BUILDTYPE]
[Android General] Gazphard:
Do you have the Lycan method active? Maybe you have a custom launcher installed