A few things on knox / rooting and bootloaders that need more testing / development

[ryanbg]

Is there anything Note 3 owners can do that would help you in any way? I'd be willing to help you in any way I possibly could.

I need memory dumps from Developer devices.

 

[shangrila500]

I need memory dumps from Developer devices.

Unfortunately I don't have a DE Note 3, just the regular version so i can't help with the memory dumps.

Have you tried making a post in General asking for memory dumps from Developer Edition devices? Another good place to ask would be the Galaxy Note 3 subreddit. If it'd help I can make a post asking for memory dumps from DE phones on reddit. All I need is an explanation on how to get the dumps and i will make a post and forward you the applicable dumps.

 

[KaratemanTJ]

Do these memory dumps need to be Note 3 Dev devices or would any similar gen Samsung Dev device be useful? (e.g. an S4)

 

[Product F(RED)]

I have a T-Mobile Note 3. T-Mobile doesn't lock the bootloader on them.

Sent from my SM-N900T using Tapatalk

 

[KaM1KaZ3]

I have a T-Mobile Note 3. T-Mobile doesn't lock the bootloader on them.

Sent from my SM-N900T using Tapatalk

If it's not locked it should work but then again might need a Verizon/AT&T

 

[badler6545]

Unfortunately I don't have a DE Note 3, just the regular version so i can't help with the memory dumps.

Have you tried making a post in General asking for memory dumps from Developer Edition devices? Another good place to ask would be the Galaxy Note 3 subreddit. If it'd help I can make a post asking for memory dumps from DE phones on reddit. All I need is an explanation on how to get the dumps and i will make a post and forward you the applicable dumps.

Hey! I'm a mod at /r/samsung and if you'd like, I can promote or make a posting there. Just pm me or reply here and we can set that up.

 

[Walter.White]

The AP_ANTI_ROLLBACK fuse controls the S+T+R+A+P flags in ODIN, and this controls whether a revision is blacklisted or not via a monotonic counter in QFPROM (fuses.) There is a check on address 0xF9269EC whether the value is 0 or not. If the value is not 0, Odin recognizes the device as 'MODE: DEVELOPER". This same check also controls whether the device will boot an unsigned kernel or recovery. A spare fuse is also used for something, but I haven't identified what yet. There's also some goodies on the RPMB on the eMMC chip, which is secured with a symmetrical 32 byte key stored on the SoC and eMMC chip.

There's much more than that. This is a very complex and multi-system operation.

Can't we just use Dan's exploit to change value on that address to 0?

 

[ryanbg]

Hey! I'm a mod at /r/samsung and if you'd like, I can promote or make a posting there. Just pm me or reply here and we can set that up.

I'll be in touch.

Can't we just use Dan's exploit to change value on that address to 0?

No. This value does not reside in Secure World memory. I'm not sure yet where it's derived from.

 

[benwaffle]

does the note 3 use LK?

https://www.codeaurora.org/projects...bypasses-signature-verification-cve-2014-4325

someone on google+ : "The easiest way to tell would be to run strings on the bootloader image and search for "bootimage: incomplete or not signed" if it contains that string it's probably patched if not then good luck! Don't forget this is just the kernel check however. So for full custom boot you would have to build a kernel with an embedded initrd and prevent the exists one from being unpacked. .. .. Not sure about persisting the whole thing either "

 

[nicholaschum]

does the note 3 use LK?

https://www.codeaurora.org/projects...bypasses-signature-verification-cve-2014-4325

someone on google+ : "The easiest way to tell would be to run strings on the bootloader image and search for "bootimage: incomplete or not signed" if it contains that string it's probably patched if not then good luck! Don't forget this is just the kernel check however. So for full custom boot you would have to build a kernel with an embedded initrd and prevent the exists one from being unpacked. .. .. Not sure about persisting the whole thing either "

We don't have Fastboot mode, so even if we do, we can't use your link's resources to do anything.

 

[MontyMontie]

Anyway to update...since I rooted I havent been able to root. Not sure if this has been addressed?

Sent from my SM-N900 using XDA Free mobile app

 

[trollarc]

That's my point. Since the tamper flag's main purpose is to indicate the integrity of the secure container, perhaps in Android L it will be decoupled from any hardware warranty claims and be software-resettable by some kind of enterprise administration authority that configures the secure container, such as your employer, and not just Samsung. Here's to hoping.

Yeah, and hopefully a xposed module is made to reset that. Or CM and other custom ROM makers bake it in.
I still feel that will not happen, and the flag will continue to be used for warranty purposes. ,

 

[mayank shekhar]

(Knox had been triggered on the the tested device already), This has been tested & working on Note 3 N900/Exynos on KitKat ND1 firmware which was on official status without root but Knox triggered, The file was flashed using Odin and after flashing I went into download mode and to my surprise Knox was been reset from 0x1 to 0 but the device status had turned custom (was official before flashing the Knox reset), however I will re-flash the firmware and see if Knox remains 0 and device status turns to official, also there are some different stuff in download mode which I hadn't ever seen before like EMMC PIN, Binary Sboot Version and all. I'll be attaching the screenshots for the same kindly find in attachments.

Edit/Update 1 : After re-flashing the firmware stuff like EMMC PIN and Binary Sboot Version has disappeared Current Binary has turned to official and the Knox has remained to 0 however System Status still appears to be Custom...

Edit/Update 2 : (Refers to previous updates regarding System Status being Custom and not turning to Official.) After trying to flash the firmware several times nothing really worked (nothing to do with Knox and Current Binary only referred to System Status being Custom) hence I went to stock recovery and wiped Data/Factory Reset and Cache Partition and then re-flashed the firmware (ND1 KitKat) and VOILA! Binary/System Status are now Official and now Knox is 0, seems a great success for the Exynos users, I also do have an snapdragon version so will be looking forward to it, screenshots attached....

Edit/Update 3 : The steps for resetting Knox (Exynos Note 3 ONLY!) :

1 - Download the bootloader.zip and extract bootloader from it (find in attachments)

2 - Open Odin and put device in download mode.

3 - Select AP/PDA (depending on Odin version you have) and select the bootloader (which was downloaded during step 1) don't select any other option in odin except F reset time and auto reboot (are selected by default).

4 - After the file is flashed go to download mode and check if the Knox has turned back to 0.

5 - Flash official firmware from sammobile and after flashing is done let the device reboot and boot up to device set-up screen, don't proceed the set-up for setting up device and turn of it off.

6 - Reboot to stock recovery (power + vol up + home) and wipe data/cache and flash the firmware again, once flashing the firmware is completed enter download mode and check if current binary and system status has turned to official if not follow steps number 5 and 6 again.

And that's pretty much it , you have successfully been able to reset Knox and regain warranty by this.

PS : I had done all this steps on ND1 firmware, and this will not keep root access, to root Knox has to be tripped or keep Knox 0 but Current Binary or System Status will be custom wit Knox being 0. Also to note this might get (patched) in future updates (bootloaders) if we look at Samsung's history of patching stuff , though not sure about it...

This will not work on any variant other than Exynos (Note 3) due to different processors and the boot system of both Exynos and Snapdragon. (the bootloader for (Exynos) contains Sboot which is only for the Exynos variant which cannot be used on Snapdragon as it uses Aboot). So this is by no way meant to work on SD variant or any other Samsung device ie S5/S4/Note 2 etc. and hence requested NOT TO USE IT on any other model than Exynos Note 3.

Edit/Update 4 : Downgrading Note 3 N900/N9000/Exynos from 4.4.2 to 4,3 has been successful, check out this post by me to be updated on steps regarding the same.

I'll be testing some work around's for the N9005 (Snapdragon) to reset Knox/Firmware Downgrade once I get that device as I have given mine to a friend, and have been saving money to buy a new or used N9005.

This is really awesome!!! I'd like to add one more point...after 6,
You dont need to do step 6...go into settings -> backup and restore -> erase everything..
Even this restore System status to official!

Thanks Again Dude!

 

[bsohm]

Has this gone anywhere since the last update?

 

[addictivepixels]

bsohm, try not to ask for "status updates" - I know you meant no harm but it is one of the rules for XDA.

Anywho, keep your eyes on this thread: [KERNEL] [KEXEC] Kernel EXECution for locked devices [N900V] [WIP]

 

[bsohm]

I do apologize...After reading that yeah my bad

 

[sabitsubin]

done....resetted knox and everything....can anyone tell me that the "odin mode" name always there or it was something else before rooting??I mean in a never touched non rooted device is it still called odin mode or anything else?just clearing up things....plz don't be bothered.....

 

[nicholaschum]

bsohm, try not to ask for "status updates" - I know you meant no harm but it is one of the rules for XDA.

Anywho, keep your eyes on this thread: [KERNEL] [KEXEC] Kernel EXECution for locked devices [N900V] [WIP]

I guess they may have some other usages, but kexec in kernels mainly allows for dual booting in devices through use of MultiROM.

 

[sabitsubin]

This is really awesome!!! I'd like to add one more point...after 6,
You dont need to do step 6...go into settings -> backup and restore -> erase everything..
Even this restore System status to official!

Thanks Again Dude!

did u root again after resetting and had any issue??did the knox change to 1 again after rooting?

 

[mayank shekhar]

did u root again after resetting and had any issue??did the knox change to 1 again after rooting?

yes i did root again, and there were no issues. and yes knox changes back to 1 after rooting...make sure you flash the same firmware that your phone was running!