yashsingh1/xdaforums huggingface dataset:
[Android General] RahilPatel:
Hello Enthusiasts,

I have an S23 Ultra (S918U) running a security patch of 1st of Aug, 2023. I purchased it from marketplace and the previous owner reported it to be lost a week later. He turned out to be a scammer.

Since its on august patch, I'm not able to use Lycan bypass method. This is what I'm doing to bypass KG lock.

1. Factory reset with volume up+Power

2. Clear Cache

3. Reboot the phone and open QR code scanner

4. Login to alliance X app and grant admin access.

5. Open chrome>Download Splashtop and Lycan CCSWE manager through the shortened link t.ly-sqt.

6. Install Splashtop and open. Grant know permission, remove check on device admin. Success- Knox gets activated. And then leave the app.

7. Disable KLMS agent. KLMS does get successfully disabled.

Now here is where I get stuck. After this I'm unable to uninstall Splashtop add-on by going through app search> settings> activities tab> open settings through first activity> navigating to apps. When I try to click on add-on to get inside to uninstall, it wont let me get in. Also I'm unable to uninstall through alliance X by going into Splashtop app> second tab where disable-enable-export apk-force stop and uninstall icons are placed.

I have tried disabling the app and then install Lycan app, it shows error and wont let me install.

Also I tried enabling developer options by multiple clicking on build no, but the pop-up of developer options enabling wont show up and I wont have access to it. Since then, I'm not able to access adb where the new method can work.

Please suggest any solution if you can.

Also I was thinking of downgrading the security patch by flashing firmware through Odin for June patch. Is it really an option that can be done? I don't care if I have to use the same android version and security patch for the rest of device's life. All I'm looking for is to somehow get KG unlocked and get bootloader unlocked to dump whole OneUI and get onto custom ROM like lineage OS where there's no Samsung interaction.

Let me know what the possibilities are.

Thanks in advance

Edit:- Also I tried disabling SystemUI in order to bypass whole Samsung stuff and then to install launcher and other apps, but once I click on disable in SystemUI through alliance X, the phone gets rebooted and does not gets disabled on reboot.

Essentially meaning i have tried all methods AllianceX+Lycan and Only AllianceX. Since i'm unable to enable adb, the adb method does not work for me. Also i'm on august update, the samfw tool patch wont work on *#*#0#*#* device test menu.
[Android General] Emilson:
@RahilPatel

one user also had this problem, he found a solution by installing app 'Uninstaller'.

you can find links it on the first page in my post in the 'Useful tips & Apps' tab
[Android General] RahilPatel:
Thanks Pal.

It was my mistake, I didn't read that carefully. I looked only at play-store link.

Thank you for correcting me. I'll try it tonight.

One more question, does Splashtop has anything to do with Lycan CCSWE?

Like Lycan cannot install till Splashtop is installed kind of thing?
[Android General] Emilson:
nope, i just added Direct Link after your post for easier download in bypass process.

Lycan is based on splashtop license to use its license, so system detects that you trying to instal 'the same app'

Klms Agent manages these licenses, so after getting knox license by splashtop You have to 'freeze' Klms Agent and replace splashtop with Lycan app. (Then You can enable-back Klms Agent, is needed in the future, e.g. in the next Unlock step)
[Android General] RahilPatel:
Understood now.

Thanks for the clarification. Now it makes sense to me how it works.
[Android General] RahilPatel:
For security patch beyond June 2023 (essentially no AT commands, manual adb) At what step should I activate KLMS for performing permanent KG unlock during above steps of 2-7?

Edit:- I understand you haven't tried on S23 Ultra and are only recommending for patch of June and before, I'm just going to give it a shot anyhow to see if it works or not.
[Android General] srikanth444:
Once you have gained access to usb debugging from developer options using lycan bypass enable klms a d go with commands process
[Android General] iBowToAndroid:
None, as you can't bootloader unlock a North American S23U
[Android General] Emilson:
far-reaching planning 😅

You want to unlock botloader

when we just barely got the kg unlock ;D

Kg status: Active allows to use download mode so for eg. i downgraded my software from 13 to android 12. But i think that was with locked oem bootloader oem, so only official and allowed Binaries
[Android General] RahilPatel:
Call me an old school guy😉, as I used to do this stuff back in 2012-2015 when Motorola Droid Razr's were a thing.

Then I graduated and jumped into real life. So after that I haven't been tinkering much until some scammer reported the device lost.😢🤦‍♀️
[Android General] mkalam01:
I am getting error in ccswe enable device admin okay but next is asking for activate knox and showing this i m not getting in.

I have s23 security patch 01 Aug 2023.

is there any solution @melksants @Emilson
[Android General] srikanth444:
Did you allow knox permissions via splashto and disabled klms agent?
[Android General] mastar blastar:
tried them all:

[18:59:56] AT+CPLDUCFG
[18:59:58] AT+CPLDUCFG

ERROR

[19:00:08] AT+MSLSECUR
[19:00:08]
+CME Error:PACM(AP),UNREGISTED

OK

[19:00:35] AT+VERSNAME
[19:00:35] AT+VERSNAME

ERROR

[19:00:46] AT+PRODCOD

[19:00:46]
+CME Error:PACM(AP),UNREGISTED

OK

[19:00:55] AT+READRSSI
[19:00:55] AT+READRSSI

ERROR

[19:01:05] AT+TESTM0
[19:01:05]
+CME Error:PACM(AP),UNREGISTED

OK

[19:01:22] AT+IMEISIGN=0,6,NG_NONE
[19:01:22] AT+IMEISIGN=0,6,NG_NONE

ERROR

[19:01:33] AT+LVOFLOCK=1,0k
[19:01:33]
+CME Error:PACM(AP),PROTECTED_NO_TOK

OK

[19:01:53] AT+IMEISIGN=0,6,0
[19:01:53] AT+IMEISIGN=0,6,0

ERROR

[19:02:02] AT+SYSSLEEP
[19:02:02] AT+SYSSLEEP

ERROR

[19:02:30] AT+CPLDUCFG
[19:02:30] AT+CPLDUCFG

ERROR

[19:02:39] AT+MSLSECUR
[19:02:39]
+CME Error:PACM(AP),UNREGISTED

OK

OK

[19:02:47] AT+LVOFLOCK=1,0k
[19:02:47]
+CME Error:PACM(AP),PROTECTED_NO_TOK

OK

[19:02:56] AT+IMEISIGN=0,6,0
[19:02:56] AT+IMEISIGN=0,6,0

ERROR

[19:03:27] AT+SYSSLEEP
[19:03:27] AT+SYSSLEEP

ERROR

[19:03:35] AT+VERSNAME
[19:03:35] AT+VERSNAME

ERROR

[19:03:45] AT+PRODCOD
[19:03:45]
+CME Error:PACM(AP),UNREGISTED

OK

OK

[19:03:54] AT+READRSSI
[19:03:54] AT+READRSSI

ERROR

[19:04:02] AT+SCMMONIT
[19:04:02] AT+SCMMONIT

ERROR

[19:04:10] AT+TESTM0
[19:04:10]
+CME Error:PACM(AP),UNREGISTED

OK

OK

[19:04:18] AT+DETA
[19:04:18]
+CME Error:PACM(AP),UNREGISTED

OK

OK

[19:04:34] AT+TF
[19:04:34]
+CME Error:PACM(AP),UNREGISTED

OK

OK

[19:04:44] AT+LOCK
[19:04:44]
+CME Error:PACM(AP),UNREGISTED

OK

OK

[19:04:51] AT+MEIDAUTH
[19:04:51] AT+MEIDAUTH

ERROR

[19:04:59] AT+CHNSELCT
[19:05:00] AT+CHNSELCT

ERROR

[19:05:20] AT+FACTOR
[19:05:20]
+CME Error:PACM(AP),UNREGISTED

OK

OK

[19:05:28] AT+IMEISIGN=0,6,NG_NONE
[19:05:28] AT+IMEISIGN=0,6,NG_NONE

ERROR

none worked.
[Android General] mkalam01:
yess bro.I did and after that uninstall the splashtop with uninstaller app.
[Android General] mkalam01:
yess bro.I did and after that uninstall the splashtop with uninstaller app
[Android General] Emilson:
Try again, and 'force stop' splashtop in app info after you grant knox permissions then disable klms agent.

You should be able go to app info or settings, via alianceX or lycan.
[Android General] mkalam01:
okay will try then tell u
[Android General] RahilPatel:
i tried the method you suggested.

Got success in uninstalling splashtop add on.

Also downloaded and installed Lycan.

Device admin activated.

Somehow gets stuck in activating knox.

got similar error 204.

Error reads as below

Error:- Invalid package name (204)

Please activate Samsung knox before continuing.

Please suggest solution.
[Android General] RahilPatel:
I tried the solution you suggested.

Got success in uninstalling splash top.

Downloaded lycan and installed.

Admin activated. Know does not gets activated.

Got an error similar to this.

My error reads as below.

Error:- Invalid package name (204)

Please activate Samsung knox before continuing.

Please suggest solution.
[Android General] Emilson:
Similar error - try Similar solution i wrote above
[Android General] RahilPatel:
still same issue persist

I tried splash top> activate know (without device admin)>return back.

Disable from app info, since there in no force stop in info. Its only under activity. Also it does not work.

Cannot install Lycan then after.

So i tried uninstalling splash top again after disabling.

Still got the same error
[Android General] srikanth444:
U have to install alliance then install splash top give knox permissions , go back to alliance disable klms agent, then uninstall splash top and install lycan you will get it.

Make sure you disable klms agent before uninstalling splashtop.
[Android General] Shot123456:
View attachment 5997287Someone help me please
[Android General] BandyPoV:
Hello Everyone!

Shout out to the guys who made(shared) the previous bypass and another dude for sharing the newest method.

I was able to successfully remove the KG Lock of my S23+(US Variant):

Model: SM-S916U1

Current Update of the device/when I did the method: May 2023, S916U1UES1AWC9

Note: I am not sure if Updates after May would work...If I remember correctly the Alliance Shield, Splashtop, and Lycan no longer work for future updates. So this also might not work.

Everything works on my side, I think going to the bootloader download mode it still says KG Lock, other than that everything works.

I see that everyone is having a problem doing the method. I can help you with that, shoot me a DM!

Here is my Discord: Rammy#2647 join the XDA discord server and just find my name and message me. I won't be offering my free time for free.
[Android General] czermar:
"I won't be offering my free time for free." You got solution here for free and offering support NOT for free. It is quite disturbing at least from my point of view... Or I don't understand something here...
[Android General] shubhsaxena2003:
damn man the audacity of people who get stuff for free and then say i wont help for free. you literally got yourself helped for free. at least have some curtesy for this open community dude
[Android General] RahilPatel:
That is exactly what I tried on my first attempt.

No luck as after following these steps, I also have to go through Lykan app> grant admin permission> activate knox > disable Knox services, this is where it gets stuck. It asks for Knox permission and does not proceed ahead.

I guess it has something to do with the august security patch.

Is there a possibility to downgrade security patch by firmware flashing old patch?

I think someone answered no, but still asking.
[Android General] mastar blastar:
are knox permssions granted successfully to Splashtop ? the checkmark should turn green if Knox permissions have been successfully granted.
[Android General] Emilson:
Ok i just tested another app and system responsed the same as with the first 'new method.

As @rash.m2k mentioned:

Downloaded "com.samsung.SMT_v3.0.02.2.apk" and "SMT_Shell_v2.0.1.apk", from thread attachments.

You can install 'SMT_Shell_v2.0.1.apk' directly thru phone installer.

but to install 'com.samsung.SMT_v3.0.02.2.apk' i had to use ADB, because the same system app is already installed and its newer.

We have to downgrade it, so i used command:

adb install -d com.samsung.SMT_v3.0.02.2.apk

installed succesfully.

Then Opened 'SMT Shell' app -> Run Exploit -> Local System Shell -> typed unlocking commands.

Respose in screenshoot.

Tested it on already kg unlocked phone.

You still may have to use SGTKEif Tool to enable UART, not sure.(my phone had a factory reset and flashed clean firmware so i think when I tested UART was disabled).

This app dont need to grant any knox/admin/owner permissions.

My security patch now is may2022, so that may make a difference aswell

View attachment 5997823
[Android General] RahilPatel:
I will have to recheck if the color changes to green.

It does get the tick mark and pop-up saying know license validation completed successfully.

I'll try and get a video of whole process in evening.
[Android General] RahilPatel:
Looking at the CSC to be XAA meaning factory unlocked, would it allow me to flash binaries with same level but older security patch?

If so, I would highly likely downgrade to old patch and try the method of permanent unlocking. Samfw website shows all binaries at level 1. I would like to jump back to may/june patch.

View attachment 5997667

SM-S918U1 /Galaxy S23 Ultra Firmware Download SM-S918U1 XAA Free Download

SM-S918U1 /Galaxy S23 Ultra Firmware Download SM-S918U1 Free Download ⭐ Official and fast update ⭐ Max speed and free download ⭐ Best Samsung Galaxy website

samfw.com

Can someone please confirm if this can be done?

Thanks in Advance.
[Android General] Emilson:
I changed my csc even when I had kg locked, using an option to change csc in SamFw Tool. (This removed carrier logo in boot screen etc)

Now after kg unlock i flashed same binary(also binary1) but with older security patch and with downgrade from Android 13 to 12, carrier unlocked CSC of course.(to my surprise it has more bloatware crap apps than my previous branded firmware..)

Installed Lycan to remove bloatware app, and disable 'Firmware update' app.
[Android General] shubhsaxena2003:
bro i have a question. so we had talked long back on this forum when i bypassed with your method and we talked about persues bypass dont know if you remember me but so coming to my question. i have a s23+ which is kg locked and i am yet to perform the permanent kg unlock on this but i have may security update so in case i perform the method then can i update it to latest august security patch ?
[Android General] BandyPoV:
Damn, you guys are pissed! Haha I should have proofread my post first.

I just followed what was suggested to do from the previous comments before me. The solution was already given, and yet people are still having trouble performing it.

That’s why I said !!*I won’t be giving my free time for free*!! Someone already gave it out. I linked my info so you get a faster response time(instead of hitting refresh on a forum) and If text communication isn’t clear enough, we can do video call. This is for the people who need extra help from having trouble performing task that other commenters posted.
[Android General] shubhsaxena2003:
@melksants @srikanth444 @Masterblaster16

i also wanted to ask that @melksants you said for a complete removal it is important to change sn and imei so can i input completely new RANDOM sn and imei to make it purely relock proof. also to change sn the command is mentioned in this forum but what about the imei number. how can i change that
[Android General] srikanth444:
Its all good bro nothing happens when u click open just go on. With the procedure
[Android General] iBowToAndroid:
You can't
[Android General] shubhsaxena2003:
bro did you try to update your device to the latest august security patch after you permanently removed kg ?
[Android General] shubhsaxena2003:
you mean in samsung i cant or in general ?
[Android General] farg0o0o:
one more thing is holding me back, because in total I have two s21 fe to do, one is already after alliance, and now the second one has arrived. Well, on this new one I can't turn on the camera for QR scanning. either there is a black screen or nothing. I turned on the front camera a few times and went a bit further, but 5 minutes and lock. What a disaster, is this new security or did I buy some crap :d
[Android General] srikanth444:
Its not a permanent unlock. As it still shows kg lock active in download mode. And also i wouldnt suggest an update infact i have downgraded device to may patch. As with june and july patches i couldn't hold lycan bypass for more than 5 min. and ansh here with aug patch couldn't even install apks mentioned in the new method/step1.bat it says invalid build.
[Android General] srikanth444:
U need to speed up the process. July patch auto shut dows/shows kg lock screen in between 5-6 min. Suggest to use otg pendrive for a faster process
[Android General] farg0o0o:
I saw in the video guide that the guy opened the com253 port and some log views appeared. and for me there is silence
[Android General] srikanth444:
Yes i know it was same for me nothing appeared when i hit open. Just go on with commands ull know.
[Android General] shubhsaxena2003:
okay right i understand your point. maybe we will just have to wait and see what if someone permanently removes it and then upgrades to latest. because theoretically i dont think if once kg is active and we block all the knox enrollments and change sn then updating will effect anything but yeah we cant really say anything at the moment. also someone said that if you permanently remove kg and then flash new framework then it becomes completely relock proof. is that true ?
[Android General] shubhsaxena2003:
there used to be an old method where people modified by removing knox in their framework and flashed it to make it no knox framework. i will attach the youtube link here

but i am not sure how true this is

would love to hear your veiws @melksants @Emilson @srikanth444
[Android General] Emilson:
Check these settings
[Android General] RahilPatel:
Can we downgrade security patch through Odin?

I have S23 Ultra on August patch and want to downgrade to May/June patch.

If binary is same and KG locked, is it possible?
[Android General] iBowToAndroid:
Nope. Can't flash anything when KG is "LOCKED"
[Android General] Emilson:
Before i managed method with disabling klms agent, there was an old method to get lycan working, using samsung 'secure folder' to keep splashtop's license for Lycan app.

It requires to login/register samsung account on the phone to use samsung 'secure folder' so more time is nedded to finish bypass, but it may still work.

Spoiler content hidden.

Tutorial in short:

You need to install splashtop, then run samsung 'Secure folder' and install splashtop also in secure folder, then grant knox permissions for second splashtop.

Then You can Uninstall main splashtop and Uninstall 'secure folder' with another splashtop app inside.

After that Lycan should work without asking for knox activation.
[Android General] melksants:
We use the term "rom patch" for this modification, some modifications are made to bypass the KG blocking, modifying the device services application and adding a modified host to block knox connections, some applications related to KNOX are also excluded

edit: even if you manage to make these modifications, it is necessary that the botloader is unlocked and the KG is ACTIVE or COMPLETED to be able to flash
[Android General] melksants:
cpid server uses AT commands to "repair" the imei, but for this you first need a token (EM-token), there is an extra layer of security around this

the most correct would be to find a way to change from KG locked to KG completed
[Android General] true.limit:
It worked for me,. But how were you able to get the device's full systemUi working as normal?

I'm on the July sec. Patch
[Android General] true.limit:
As my device still shuts down after 5 min even though the Kg status is Active
[Android General] shubhsaxena2003:
have you blocked knox enrollment applications ? which phone are you on maybe you can downgrade your patch to may or june cause i have heard this method is also working till june security update
[Android General] shubhsaxena2003:
well i was actually wondering that people somehow managed to work around kg locked and made it to active so do you think maybe we can also dig a little bit more and make it to kg complete ?
[Android General] true.limit:
Yes I disabled knox enrollment services. But the phone still shuts off..

A54 5g , no I can't downgrade from the July binary
[Android General] srikanth444:
Well go on with lycan bypass, and finish unlock 1st then you can downgrade. While in locked state it shutdowns when you try to flash firmware.were you able to bypass with lycan bypass? And device working Even for 5min? Like mine.
[Android General] srikanth444:
Did you enable keygaurd service and system ui? After 2nd method? If it kg shows active just factory reset the mobile it will solve your issue i guess. Then you can also flash may patch. Right after my device got unlocked i did factory reset 3-4 time to check if it is fine it didnt effect my lock.
[Android General] true.limit:
Yeah...the reset after the new method worked for me...

Phone is as new.. much thanks.
[Android General] farg0o0o:
Hey, I know this question is a bit inappropriate, sorry. What about other phone brands? Where to look for unlocking other models blocked for installments by dishonest sellers?
[Android General] farg0o0o:
Exactly the same problem, unless the port does not let go further. I tried your options and does not work, on one port (because I have 3) the program hangs at all. Some problem with the drivers I think, although from samsung and adb installed. On what windows did you do? Once I remember me in something 10 did not let go and I had to switch to an old computer with 7.
[Android General] srikanth444:
Did you turn 3gpp setings below usb debugging? In developer options?
[Android General] farg0o0o:
In total, I do not even have an error at the end, nothing happens next.
[Android General] farg0o0o:
yes
[Android General] farg0o0o:
Ok, somehow I went further, I do not know when I let go further, I disconnected the cable, changed the settings and one time it went.
[Android General] farg0o0o:
How to re-enable KMLS agent when I lost the owner of the device in the shield (I disabled earlier because I thought I started the KMLS agent correctly) now it refers me to the shield page to start the process again from the qr code, and it does not work without starting the device from scratch.
[Android General] noname9x:
This command only checks Lock status. Does nothing to set the locked to unlocked.

Unlocking requires MSL Auth + AK Auth + Unlock Code Set.
[Android General] srikanth444:
Use adb command or adb app control u can do it.
[Android General] farg0o0o:
what is command?
[Android General] farg0o0o:
ok found
[Android General] rhcp011235:
I’m aware. Since KG is now free.

I was thinking carrier lock next? These guys try to get over 200 for a simple sim unlock. They do it remote too.
[Android General] srikanth444:
U mean 5g bands unlock?
[Android General] rhcp011235:
No I am talking about Samsung sim unlocked and Ime* repair.
[Android General] farg0o0o:
Thank you gentlemen, you are doing a great job to show all the service technicians from jtag etc the middle finger. I am very grateful, I was able to do all the work with one device. Okay, and has anyone noticed that now there is a massacre to get to the shield from the QR code? Either it does not fire the camera at all, or there is a black screen, or a few times it started through the front camera, but I did not manage to unblock within 5 minutes. Is this qr scan crash related to a new patch,Am I the only one who has a faulty device? And is there a way to not have to unlock debugging through the shield? This new method doesn't work, right? Thank you again for everything gentlemen, you are really amazing in this job
[Android General] srikanth444:
What is your device and sequrity patch?
[Android General] farg0o0o:
Samsung s21 FE but patch i dont know, i buying locked
[Android General] RahilPatel:
I tried this one as well.

I am able to install splashtop in main, open secure folder> sign in> and then app closes.

The app wont restart again to let me add splashtop inside secure folder.

So i beleive this loophole has also been patched since i'm on august update
[Android General] RahilPatel:
tried it.

no luck

Samsung S23 Ultra S918U1 August patch KG locked.