FORUMS
Remove All Ads from XDA

A few things on knox / rooting and bootloaders that need more testing / development

1,240 posts
Thanks Meter: 359
 
By xclub_101, Senior Member on 9th February 2014, 03:08 PM
Post Reply Email Thread
I never had the time (and the devices) to properly research this but there are a few things that other people might want to test (or already know the answers) and I think it might come very handy to the Note 3 community. There is a somehow similar thread for the S4 community here.




0) SUCCESS WITH KNOX / DOWNGRADING ON N900 !!!

On N900 (Exynos) there is now a solution (unfortunately for the moment only for Exynos models) - a special firmware leaked originally here:

http://sxtpdevelopers.com/samsung-no...-fix-qualcomm/

(it looks like a firmware reset/update for the EMMC, which results in the erase of the RPMB where Knox flag and downgrade restrictions are stored).

In this thread details on some of the people testing it can be found in those posts:

http://forum.xda-developers.com/show...6#post52329946

http://forum.xda-developers.com/show...8#post52408318

If the original site is taken down by Samsung you need to search after a file called BL_HA3GZS_CLEAR_WARRANTY_BIT.tar - the one I saw was 2334801 bytes in length (might be shown as a 2.23MB download in some chinese sites). There might be a problem finding it since Samsung might go after anybody hosting and distributing it.


1) Just rooting should not trip knox

The problem with rooting that makes knox 0x1 - originally Root De La Vega was developed for the AT&T very locked structure, and as such it was doing the rooting in a pretty convoluted way. However on other Note 3 versions the knox warranty flag is very clearly linked to just kernel and recovery, and not to system itself. In other words it SHOULD be possible (even after MJ3) to root and keep knox 0x0 on devices that are not "bootloader locked" by not touching kernel and recovery and only touching system - that is probably NOT going to work on AT&T (N900A) but it seems to work on N900W8 and IMHO it could also work on N9005 (and possibly N9000, but I know much less about that). If you want more proof look into the posts about N900W8 + different version (of more or less) stock-based ROMs (like xnote, but stock kernel and recovery).

So the bottom line on this is to verify on a knox 0x0 device with firmware MJ3 (or newer) that just writing a pre-rooted system would be allowed in download mode and would keep knox 0x0. And we would need a more clear confirmation for both N900W8 and N9005 (or any other models) - of course with some description of what was written and how

EDIT: some W8 users have provided extra details and so far it looks it might be more the bootloader itself and not so much in how/what is written, but more information is needed.
EDIT2: there is a thread with that kind of talk here:
http://forum.xda-developers.com/show....php?t=2627996



2) We should really test the "portability" of various bootloaders since this could solve a lot of things

First - here are two external (non-xda) pages with some very good development information regarding "bootloader hacking":

http://blog.azimuthsecurity.com/2013...ootloader.html

http://blog.azimuthsecurity.com/2013...cure-boot.html

On bootloader-confused devices (for instance Hong-Kong versions that got the KitKat bootloader from Polish/XEO KK and have to wait for Hong-Kong KitKat, or any device that seems to be bricked in the bootloader) it might be also interesting (for somebody VERY daring - remember that it could brick your phone even worse) to try to write the bootloader files (all 5 of them?) from the N900W8 and see if those are accepted (since once that would be the case downgrading would also become a possibility).

EDIT: the N900W8 is also reported (see here) to let you have a custom recovery and not trip knox, which is kind of weird but maybe this is the knox breakthrough that we were expecting



3) More info on STRAP flags (those listed in download mode)

STRAP flags - there are a number of places where the values listed in download mode are discussed, for instance:

http://forum.xda-developers.com/show....php?t=2567165

It seems that the values for S T R A and P flags could be versions of the 5 main bootloader-related files used in Qualcomm-based Note 3 devices, most likely:

S - SBL1

T - TZ

R - RPM

A - ABOOT

P - SDI (?)


My EU N9005 (I believe with MI7 or so bootloader) was something like S1, T1, R1, A1, P1 and also SECUREBOOT: ENABLE (CSB) (as it can be seen in the thread above) but is now P2 (which is very strange since I had all automatic and security updates disabled, but might be related to the fact that at some point I activated the reactivation flag linked to the Samsung account - disabling it does not return P back to 1 so this might not be it).

Also if you look around the values seem to be somehow consistent - with post-MJ3 bootloader most flags become 2 and with KitKat bootloader at least the A flag becomes 3.

It remains to be seen if this is the case and if it is any way relevant to hacking the bootloader system or knox (or is just for debug purposes - like when we see people with A3 complaining that they can't return to stock MJ7 or MK2).


4) More info on "microSD debricking and if this could let us re-write different bootloader files (and maybe we should encourage people to have their "debricking image" made in advance "just in case")

When the bootloader files become "bad" and you can not go in download mode (but probably sbl1 is still valid) it is still possible to recover things by forcing the boot process from microSD. That seems to require no extra hardware on Qualcomm models and one small contact for Exynos devices (where that is even documented in Samsung original documents like 13-58_SM-N900_Boot_Recovery_Guide_rev1.0.pdf).

There is a thread on this at:

http://forum.xda-developers.com/show....php?t=2625332



5) More info on how Samsung CAN reset knox

There are already two threads with something more than 5-6 first-hand reports from people that went with a Note 3 knox 0x1 into service and left with the same device (and motherboard and IMEI and in some cases all their programs and even their normal/old firmware) but with knox 0x0!

One thread in T-Mobile Note 3 forum:

http://forum.xda-developers.com/show....php?t=2637718

And a much larger one in International Note 3 forum:

http://forum.xda-developers.com/show....php?t=2504258

There is also already a "hardware+software solution" (expensive, aimed at specialized phone shops that also do phone unlocking and similar stuff) which claims to be able to reset the knox flag on Exynos devices:

http://forum.gsmhosting.com/vbb/f672...-emmc-1769456/
http://forum.gsmhosting.com/vbb/f672...world-1776265/
http://forum.gsmhosting.com/vbb/f672...ox-s4-1775213/




6) Pre-production bootloaders before knox?

Here is an interesting thread apparently about a N9005 with no knox:

http://forum.xda-developers.com/show....php?t=2657631
The Following 25 Users Say Thank You to xclub_101 For This Useful Post: [ View ] Gift xclub_101 Ad-Free
11th February 2014, 12:13 AM |#2  
Senior Member
Flag Toronto
Thanks Meter: 14
 
More
I'm not too sure if this is helpful, but with the introduction of Kitkat, the SM-N900W8 has been able to flash a custom rom/kernel and recovery without tripping Knox. I am really not sure how this is possible, but my phone is living proof of it. To my understanding we are still using the old bootloader.
13th February 2014, 09:42 AM |#3  
OP Senior Member
Thanks Meter: 359
 
More
(reserved for the future, I just had a very large edit on the top post and not very much extra data can fit there)
The Following User Says Thank You to xclub_101 For This Useful Post: [ View ] Gift xclub_101 Ad-Free
13th February 2014, 05:32 PM |#4  
CNexus's Avatar
Senior Member
Flag ~/android
Thanks Meter: 14,053
 
Donate to Me
More
Just a note @xclub_101...you cannot write older/different bootloaders using the debrick method. gTan64 and I originally pioneered that method on the Sprint S3, and it was then ported to the other qualcomm S3's, and eventually to other Samsung devices.

It does not work. The phone will only boot with a debrick sdcard when the bootloader written to the sdcard has the same version as the corrupt one on the device emmc.

And even if an older bootloader sdcard COULD boot the device, it wouldn't matter because you would still need to Odin flash a non-corrupt bootloader to the device after using the sdcard, and it would still reject a non-Knox bootloader because of that.

So unfortunately that section is incorrect.
13th February 2014, 10:48 PM |#5  
Inactive Recognized Developer
Thanks Meter: 1,750
 
More
I can downgrade P1 to P0. It is device and carrier specific. I'm not sure what the P flag is for. RPM, SBL1, and TZ were only items modified when downgraded. All signed releases. Looking for any more information regarding these flags.
14th February 2014, 04:38 PM |#6  
OP Senior Member
Thanks Meter: 359
 
More
Quote:
Originally Posted by CNexus

Just a note @xclub_101...you cannot write older/different bootloaders using the debrick method. gTan64 and I originally pioneered that method on the Sprint S3, and it was then ported to the other qualcomm S3's, and eventually to other Samsung devices.

It does not work. The phone will only boot with a debrick sdcard when the bootloader written to the sdcard has the same version as the corrupt one on the device emmc.

And even if an older bootloader sdcard COULD boot the device, it wouldn't matter because you would still need to Odin flash a non-corrupt bootloader to the device after using the sdcard, and it would still reject a non-Knox bootloader because of that.

So unfortunately that section is incorrect.



That is somehow true, but IMHO if all relevant partitions are wiped on the internal flash (from SBL1 to ABOOT) then all those will be read from microSD and have the code and signatures from there, and the "Odin mode" itself will be the version from microSD.

And here we have a number of interesting paths:

- the signature/hash on SBL1 itself is similar among Note 3 versions - that would result on all steps up to and including ABOOT being valid, so the "special Odin mode" will be entered; if the signature/hash on SBL1 is NOT similar between Note 3 families (or even before and after a major bootloader version) not even the "special Odin mode" will be started;

- if "special Odin mode" is started we can see another fork - if the "downgrade limitations" are part of the microSD code itself then you will be able to write any single firmware you were able to write when the internal SBL1/ABOOT was at the same version as the microSD SBL1/ABOOT - in other words you will be able to downgrade as far back as the microSD SBL1/ABOOT will let you!

- however there are some reports that the "downgrade restrictions" are actually stored in the internal flash in the "invisible/protected" regions there - and can be reset with special JTAG-like hardware:

http://forum.gsmhosting.com/vbb/f672...ox-s4-1775213/

Even in that last case there would still be a small chance that the "downgrade restrictions" might be skipped when booting from microSD since the internal flash could be considered at that point "less reliable" (or hopefully somebody at Samsung forgot to read that extra info on this special path - we can all hope )

So yes, I would still like to see more detailed tests on it with detailed reports on what is failing at what point! And especially on the microSD with the N900W8 "happy bootloader" or even with some much earlier "early development bootloader" (I have seen something like that mentioned somewhere)!
The Following User Says Thank You to xclub_101 For This Useful Post: [ View ] Gift xclub_101 Ad-Free
14th February 2014, 04:40 PM |#7  
OP Senior Member
Thanks Meter: 359
 
More
Quote:
Originally Posted by ryanbg

I can downgrade P1 to P0. It is device and carrier specific. I'm not sure what the P flag is for. RPM, SBL1, and TZ were only items modified when downgraded. All signed releases. Looking for any more information regarding these flags.

That was on the Verizon N900V? Does that allow you to do direct downgrades or you still need some tricks? Was it still booting with the downgraded versions?
14th February 2014, 04:58 PM |#8  
Inactive Recognized Developer
Thanks Meter: 1,750
 
More
Quote:
Originally Posted by xclub_101

That was on the Verizon N900V? Does that allow you to do direct downgrades or you still need some tricks? Was it still booting with the downgraded versions?

Downgrading is limited to the flag fuse counter values. On MJE, I can downgrade to MI9 boot image and recovery. I was able to downgrade to some pre-release engineering SBL1, RPM, and TZ because they're signed and fuse counter is only 1 for those 3. It's very benign and basic to downgrade. Just use heimdall and try downgrading an individual image. If I figure out what P is, I'll be able to test if I can flash anything related to that flag. For some reason, I can downgrade to MI9 boot and recovery, but not the system.img. I'm just starting to learn a lot about the flags/fuse counters after dissecting aboot further. If you've got any more specific questions, feel free to PM me
15th February 2014, 07:20 PM |#9  
iamsuperuser's Avatar
Senior Member
Flag Hyderabad
Thanks Meter: 154
 
More
For the past 2 weeks I've been following the topics on Knox reset on XDA. There is so much discussion but Samsung is not at all helping.

So I was thinking we can do something like Sony Phones

On Sony Phones the trim area i.e. TA.img is backed up to restore later to claim warranty, but this should be done only before the phone is ever unlocked.
So are there any files like TA.img on Note 3 we can backup while the Knox is still 0×0 , So that if and when there is a method to reset Knox we can be ready.

If we can do this, we can go ahead and root or mod our Note 3s

So is this possible ?
19th February 2014, 05:28 PM |#10  
FeralFire's Avatar
Senior Member
Thanks Meter: 233
 
More
Quote:
Originally Posted by iamsuperuser

For the past 2 weeks I've been following the topics on Knox reset on XDA. There is so much discussion but Samsung is not at all helping.

So I was thinking we can do something like Sony Phones

On Sony Phones the trim area i.e. TA.img is backed up to restore later to claim warranty, but this should be done only before the phone is ever unlocked.
So are there any files like TA.img on Note 3 we can backup while the Knox is still 0×0 , So that if and when there is a method to reset Knox we can be ready.

If we can do this, we can go ahead and root or mod our Note 3s

So is this possible ?


I don't think that will be possible because knox flag is an e-fuse and not a software counter.
I may be wrong, though.
20th February 2014, 01:56 AM |#11  
Senior Member
Flag Hyderabad
Thanks Meter: 38
 
More
Quote:
Originally Posted by FeralFire

I don't think that will be possible because knox flag is an e-fuse and not a software counter.
I may be wrong, though.

I somehow might agree to you but there's one thing about Knox which is not understandable by any means, Knox was officially introduced in Note 3 (Android 4.3) however other samsung devices had never had any hint of Knox hardware or software wise so while the official android 4.3 started rolling for other devices ie galaxy s4, note 2 etc they also got Knox and once they're tripped they cannot be reseted however I belive this should not be the case as those devices never had such thing as Knox specifically in terms of hardware and this trick has been surely done by samsung software wise and the only way to reset Knox as f now is known by samsung as few people have reported they got their Knox reset from samsung service centers, so this is kind of strange and I still believe Knox can have something to be done with software n not hardware, though I aint sure about it.........
Post Reply Subscribe to Thread

Tags
knox, root
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes