[GUIDE] S9 G9600 PayJoy Rent-A-Center MDM Knox Enterprise Disable Bypass

[kekistaneerefugee]

I picked up a G9600 and it has a knox enterprise certificate that configures the phone upon initial setup. It is not locked out yet and I can still return it but I’m also trying to figure this weird setup out and possibly clean it up. Rent-A-Center is renting phones that can be remote controlled by them, they supposedly buy them directly from Samsung like this. It’s very interesting!

To remove all of the knox and mdm stuff you have to do this:

Open Samsung Calculator and type in (+30012012732+, this will pop up drp mode, then type in the *#0808#, select DM+Modem+ADB, and hit reboot. You should now have ADB! (you have to do this same method after every reboot)


Once you enable ADB, then you can run these commands to disable knox enrollment center:

"adb shell pm disable-user --user 0 com.sec.knox.kccagent"

"adb shell pm disable-user --user 0 com.planetcellinc.ressvc"

"adb shell pm disable-user --user 0 com.absolute.android.agent"

"adb shell pm disable-user --user 0 com.sec.enterprise.knox.cloudmdm.smdms"

From here you can also now grant SystemUItuner adb permissions to disable animations and modify your status bar/quick settings. FYI, none of this will survive a reset.

Now all I have left to do is figure out how to enable developer options so that I can OEM unlock. I successfully got CROM app to unlock it, I just have no way to access the toggle. After 7 days the prenormal KG Status did go away.

EDIT: I no longer have the phone so I cannot continue digging into this. It worked on all version of Oreo, I never got to try it on Pie.

 

[M4xh3dr00m]

At Least link the original post dude

 

[kekistaneerefugee]

At Least link the original post dude

The YouTube video I learned it from? Lol or the multiple multiple multiple internet pages that I had to such through for each individual step?

Soure: Google Fu

 

[*Detection*]

The YouTube video I learned it from? Lol

Anywhere you got it from otherwise you are taking credit for someone else's work

 

[M4xh3dr00m]

The YouTube video I learned it from? Lol or the multiple multiple multiple internet pages that I had to such through for each individual step?

Soure: Google Fu

Well, maybe.

https://xdaforums.com/showpost.php?p=78584395

I post this in January 3rd.

Maybe is not the full set of instructions, then you post the rest and now its a full solution (i think). I dont want credits or whatever, i just want to point you must link the info for reference. Videos, Posts and other stuff. If you post the link to the Youtube Video, can be useful.

The work of recopilation its yours, but the info is for all.

This is a community dude.

 

[kekistaneerefugee]

Well, maybe.

https://xdaforums.com/showpost.php?p=78584395

I post this in January 3rd.

Maybe is not the full set of instructions, then you post the rest and now its a full solution (i think). I dont want credits or whatever, i just want to point you must link the info for reference. Videos, Posts and other stuff. If you post the link to the Youtube Video, can be useful.

The work of recopilation its yours, but the info is for all.

This is a community dude.

Your comment is the only one that I found after using THIS, obtaining ADB, and disabling knox. Yours wasn't complete so I posted a working solution, for the community dude.

 

[Nickdroid86]

If I do this on my Note 9 will I be able to flash a new firmware without being blocked by frp/mdm?

---------- Post added at 09:56 PM ---------- Previous post was at 09:55 PM ----------

*N9600 from Rent A Center.

 

[M4xh3dr00m]

If I do this on my Note 9 will I be able to flash a new firmware without being blocked by frp/mdm?

---------- Post added at 09:56 PM ---------- Previous post was at 09:55 PM ----------

*N9600 from Rent A Center.

Like the OP said, this method cant survive a Reset.

 

[dandel0074]

Hello, need a little help with a note 9 from RAC. I was able to get into phone by bypassing set up but I'm limited with what I can use do to samsungs knox modified by RAC. I tried the calculator method from this post by I't didnt work because of the limitations I suppose. Is there any way that you can grant root access to an app like file explorer from a PC to remove frp setting so that I can Odin flash an unmodified RAC firmware.

 

[*Detection*]

Hello, need a little help with a note 9 from RAC. I was able to get into phone by bypassing set up but I'm limited with what I can use do to samsungs knox modified by RAC. I tried the calculator method from this post by I't didnt work because of the limitations I suppose. Is there any way that you can grant root access to an app like file explorer from a PC to remove frp setting so that I can Odin flash an unmodified RAC firmware.

Wrong forums, this is the S9 forum, not the Note 9
https://xdaforums.com/galaxy-note-9

 

[dandel0074]

Wrong forums, this is the S9 forum, not the Note 9
https://xdaforums.com/galaxy-note-9

Yes I kind of got that but I figured it would be the same process and all on how disable samsungs modified by RAC Knox and as it seems to work for me on a temporary disable as listed etc. I know of some apps that need root access can be granted through a PC my question was in how to do that to try and change it through fike explorer. Has it been attempted?

 

[darkensx]

I picked up a G9600 and it has a knox enterprise certificate that configures the phone upon initial setup. It is not locked out yet and I can still return it but I’m also trying to figure this weird setup out and possibly clean it up. Rent-A-Center is renting phones that can be remote controlled by them, they supposedly buy them directly from Samsung like this. It’s very interesting!

To remove all of the knox and mdm stuff you have to do this:

Open Samsung Calculator and type in (+30012012732+, this will pop up drp mode, then type in the *#0808#, select DM+Modem+ADB, and hit reboot. You should now have ADB! (you have to do this same method after every reboot)


Once you enable ADB, then you can run these commands to disable knox enrollment center:

"adb shell pm disable-user --user 0 com.sec.knox.kccagent"

"adb shell pm disable-user --user 0 com.planetcellinc.ressvc"

"adb shell pm disable-user --user 0 com.absolute.android.agent"

"adb shell pm disable-user --user 0 com.sec.enterprise.knox.cloudmdm.smdms"

From here you can also now grant SystemUItuner adb permissions to disable animations and modify your status bar/quick settings. FYI, none of this will survive a reset.

Now all I have left to do is figure out how to enable developer options so that I can OEM unlock.

I have a S9+ sm-G9650U variant from R.A.C. ... you can still get to developer options via the apps that shortcut to there in the play store but it's hidden from normal settings area anyway even when enabled also attempting to flash results in "cannot flash MDM mode" message and phone auto reset to the out of box remote set up. also it seems oem unlock is permanent locked (supposedly) via MDM somehow...as I asked this at rent a center and was told at the end of the lease/rental agreement MDM is removed and oem unlock will be enabled so idk if it can be done without MDM issuing it... also attached is the app i use to access developer options.

 

[kekistaneerefugee]

Yes I kind of got that but I figured it would be the same process and all on how disable samsungs modified by RAC Knox and as it seems to work for me on a temporary disable as listed etc. I know of some apps that need root access can be granted through a PC my question was in how to do that to try and change it through fike explorer. Has it been attempted?

There should be no difference between the S9 and Note 9, I only had access to the S9 for testing. I doubt the Android Pie update still allows this, I got rid of the phone before that came out but I was on latest Oreo update with it still working.

 

[cellstoregujrat]

Yes

I picked up a G9600 and it has a knox enterprise certificate that configures the phone upon initial setup. It is not locked out yet and I can still return it but I’m also trying to figure this weird setup out and possibly clean it up. Rent-A-Center is renting phones that can be remote controlled by them, they supposedly buy them directly from Samsung like this. It’s very interesting!

To remove all of the knox and mdm stuff you have to do this:

Open Samsung Calculator and type in (+30012012732+, this will pop up drp mode, then type in the *#0808#, select DM+Modem+ADB, and hit reboot. You should now have ADB! (you have to do this same method after every reboot)


Once you enable ADB, then you can run these commands to disable knox enrollment center:

"adb shell pm disable-user --user 0 com.sec.knox.kccagent"

"adb shell pm disable-user --user 0 com.planetcellinc.ressvc"

"adb shell pm disable-user --user 0 com.absolute.android.agent"

"adb shell pm disable-user --user 0 com.sec.enterprise.knox.cloudmdm.smdms"

From here you can also now grant SystemUItuner adb permissions to disable animations and modify your status bar/quick settings. FYI, none of this will survive a reset.

Now all I have left to do is figure out how to enable developer options so that I can OEM unlock. I successfully got CROM app to unlock it, I just have no way to access the toggle. After 7 days the prenormal KG Status did go away.

EDIT: I no longer have the phone so I cannot continue digging into this. It worked on all version of Oreo, I never got to try it on Pie.

thanks bro it worked but it's not permanent solution.
By the way thanks for your contribution

 

[mattfirey]

You're the only guy helping with this problem. Full solution isn't allowed to be discussed here. Thank you very much for contribution despite the irrelevant comments.

 

[kekistaneerefugee]

You're the only guy helping with this problem. Full solution isn't allowed to be discussed here. Thank you very much for contribution despite the irrelevant comments.

Yeah, XDA mods are bad. The full solution seems to be the better solution in the long run anyway. I hope anyone who actually needs to use this goes the full solution route.

 

[hyelton]

I tried something simulre back several months ago when I first picked up an unlocked S9 from Amazon from a 3rd party seller, was never able to get it bypassed, and even If I did didnt trust it. I ended up calling the number which was a local store number, they looked up the imei and it was reported stolen. So back to the seller it went.

 

[stevena1844]

If you trip knox on purpose it goes away perm. First to get rid of the problem of not being able to wipe it you have to get combo firmware use Odin to flash it in but be sure to check nand erase all on options tab and boom it's now able to be wiped. For a lot of units you're done just flash full firmware. However on some devices you have to extract the boot.img.lz4 from the ap file from full firmware file (not combo) then use 7zip to extract boot.img from boot.img.lz4 now copy the boot.img to a device that has magisk manager running on it. Tap install magisk select boot.img it creates a patched boot.img in your downloads folder. Copy back to PC use 7zip to put boot.img into a tar. Put device in download mode flash new tar it in you will see an error about knox. Put back in download mode confirm knox is tripped (samsung pay and other knox stuff won't work) flash full firmware. The notice about reenrollment will pop up but once u connect to wifi itll just go through normal setup because it's no longer "fit" for knox enrollment. Boom. Any questions let me know.

 

[ninjap0_0pface]

I picked up a G9600 and it has a knox enterprise certificate that configures the phone upon initial setup. It is not locked out yet and I can still return it but I’m also trying to figure this weird setup out and possibly clean it up. Rent-A-Center is renting phones that can be remote controlled by them, they supposedly buy them directly from Samsung like this. It’s very interesting!

To remove all of the knox and mdm stuff you have to do this:

Open Samsung Calculator and type in (+30012012732+, this will pop up drp mode, then type in the *#0808#, select DM+Modem+ADB, and hit reboot. You should now have ADB! (you have to do this same method after every reboot)


Once you enable ADB, then you can run these commands to disable knox enrollment center:

"adb shell pm disable-user --user 0 com.sec.knox.kccagent"

"adb shell pm disable-user --user 0 com.planetcellinc.ressvc"

"adb shell pm disable-user --user 0 com.absolute.android.agent"

"adb shell pm disable-user --user 0 com.sec.enterprise.knox.cloudmdm.smdms"

From here you can also now grant SystemUItuner adb permissions to disable animations and modify your status bar/quick settings. FYI, none of this will survive a reset.

Now all I have left to do is figure out how to enable developer options so that I can OEM unlock. I successfully got CROM app to unlock it, I just have no way to access the toggle. After 7 days the prenormal KG Status did go away.

EDIT: I no longer have the phone so I cannot continue digging into this. It worked on all version of Oreo, I never got to try it on Pie.

After you do the above, you'll be able to uninstall "com.absolute.android.agent", "com.sec.knox.kccagent", and "com.planetcellinc.ressvc" from within Settings > Apps.

Then you can go into Settings > Developer Settings > OEM Unlock

***I don't think this step matters, but I did it anyway just to be sure***

Go back to adb use the "adb shell pm disable-user --user 0 <package name>" command on everything that has the word "knox" and "enterprise" in the package name.

Then power off the device.

Hold Bixby + Volume Down while you connect phone to the computer.

This will bring you to download mode. You'll see 3 options:
Volume Up for Download mode
Volume Up for 7 seconds for Bootloader Unlock
Volume Down and Power for Cancel/Restart Phone

Choose the Bootloader Unlock option

Your phone will factory reset, but I guess since it unlocks the bootloader, it factory resets the phone to stock samsung firmware and not the rent a center controlled firmware..

You'll go through the initial setup but it will skip the rent a center knox configure step and go right into the phone as normal.

When it loads, go back to Developer Settings, double check to see that OEM Unlock is on AND grayed out, rather than OEM Unlock being off and grayed out.

This will remove all Rent A Center phone control, but I'd assume they could still blacklist your IMEI number.

 

[Silenus21]

.