Develop Bugs

[Q&A][SGH-M919] Knox Q&A / Discussion Thread

This thread was originally created by @Hawke84 over in the i9505 forums. A lot of people are unaware of KNOX or have no idea how exactly it works so I thought we should have a thread like this in our forum as well. I have sent @Hawke84 a PM and would like to let everyone know I take no credit for this idea. Huge thanks goes out to @Hawke84.
Please feel free to ask any question here and i'll do my best to answer it but hopefully some of the other members who know a bit more will also join in and help answer some of the questions people have.
What we know so far:
1. Upgrading to newer 4.3 Samsung firmware will most likely upgrade the bootloader to knox bootloader. This will give an additional 2 lines in download mode about knox status.
2. If the Knox Warranty Void line says 0x1 then you cannot use KNOX Software on your device. Your device has also been flagged as insecure. This means that if your workplace / company supports bring your own device to work for corporate emails, etc. and they use KNOX, your device will not allow this.
3. If the KNOX Warranty Void line says 0x0, KNOX will work and your warranty is still valid.
4. With the new KNOX Bootloader, root will work. However, rooting with CF Auto-Root will trip the KNOX flag. Someone else has developed a way to root without triggering the KNOX flag. (Root de la Vega)
5. If you try to downgrade to an earlier firmware / bootloader it will set the KNOX flag to 0x1 (Void)
6. Once the KNOX flag gets set to 0x1, there is no way to set it back. (Yet!)
Let me clarify some things. The KNOX processes and functions are already on the stock ROM, most devs remove them, though. So many of you with custom ROMs haven't seen anything related to KNOX.
What the new T-Mobile update (when it gets pushed out) is most likely to come with is a "KNOX Bootloader" which will introduce a thing called "KNOX Flag" which is similar to the old counter we're all used to. This is the counter that @Chainfire was successful in resetting with his app, Triangle Away.
Unfortunately, @Chainfire or anyone else for that matter, has not been able to reset the KNOX flag.
The KNOX flags is this:
0x0 = You have not tripped the KNOX flag.
0x1 = You have tripped the KNOX flag.
Again, once you trip that flag, rooting, flashing a custom recovery, etc.. there is NO way to reset it as of now. And any KNOX functionality on your phone will not work. But the worst part is Samsung will refuse warranty on your device if they see a 0x1 in your bootloader.
Another thing.. on the new bootloader, if you try to downgrade, even with an official Samsung firmware, it will fail and you will trip the KNOX flag.
So once you're on the new bootloader, there's no going back.
There's been speculation that there's an eFuse at play here.
Anyway, for this reason.. I am suggesting you all disable OTA updates and wait until a ROM is built without the new bootloader and all the functions (Wifi, MMS, etc.) are working.
Useful links:
[Q&A][i9505] Knox Q&A / Discussion Thread - ask questions here!
[RESEARCH] Samsung Knox: Warranty Void Behavior
Everything KNOX...

agreed... I dont care about knox. since i and our company dont, but i do care about the stupid flag and them disallowing warranties even though that is not legal.. Hardware warranties should NOT be disallowed due to some s/w.

lgkahn said:
agreed... I dont care about knox. since i and our company dont, but i do care about the stupid flag and them disallowing warranties even though that is not legal.. Hardware warranties should NOT be disallowed due to some s/w.
Click to expand...
Click to collapse
Indeed.
I don't mind Samsung at all for KNOX, but for the people that don't use it, it should be optional.

lgkahn said:
agreed... I dont care about knox. since i and our company dont, but i do care about the stupid flag and them disallowing warranties even though that is not legal.. Hardware warranties should NOT be disallowed due to some s/w.
Click to expand...
Click to collapse
I agree. I mean, I understand why they do it; if some idiot roots and then overclocks the phone so much that it damages the CPU, then Samsung shouldn't have to honor the warranty. The device is designed with a certain thermal budget and going beyond that means all bets are off.
On the other hand, if say your microUSB port in the phone breaks off, that's obviously not something that rooting has any effect on; indeed, most physical failures not caused by user error are unaffected by root status. I'd like to believe that people aren't stupid enough to try and overclock the device beyond its thermal budget; its not a CPU where you can just stick a better cooler on and go. But you know what they say about assumptions...
I wish that there was a way for Samsung to honor the warranty on a case-by-case basis. Thermal damage to the CPU should be easily identifiable. I suspect the cost of having the phones examined CBC must outweigh any losses they sustain because of the "locks" they are adding (not to mention the huge potential sales to businesses and governments who want the security implementations).
It will be interesting to see what happens from here on out. I think we can see what Samsung's goals are (at least on the surface), but I wonder what effect Samsung's decisions will have on other phone manufacturers and the market in general.
Sent from my SGH-M919 using XDA Premium HD app

Any word on a fix to reset the warranty flag?

[FAQ] KNOX and you

[SIZE=+1]There seems to be a lot of confusion and misunderstanding circling the forums with regards to Knox and the 4.3 OTA.
This is an attempt to clear things up[/SIZE]
UPDATE: It seems that people can find this thread, but are unable to actually READ the information presented. The most important note here is that if you are on 4.3 firmware, you can flash ANY rom you like. No, you are not tied down or locked into stock only or 4.3 roms only. AOSP roms will work fine as well. Now scroll down and READ EVERYTHING IN THIS FIRST POST.
What is Knox? Knox is both a firmware and a software component. The OS has Knox apps, and the MK3 bootloader has a Knox component too. Having Knox apps does not necessarily mean you have the Knox bootloader, or vice-versa.
How does Knox work? Because Knox is both in the OS (apps) and in the firmware (bootloader) it works in two ways. The OS components prevent attempts to obtain root access and make rooting with these Knox apps a pain in the butt. Fortunately they can be removed. In the firmware component (bootloader), Knox works to prevent the flashing of custom kernels and recoveries. If you flash a custom rom or custom recovery WHILE on the Knox bootloader, your Knox flag will be tripped and your Warranty Bit will go from 0x0 to 0x1. The Knox bootloader cannot be downgraded to, say, the MD4 bootloader because of special protections built into it. If you attempt to downgrade it, your phone will instantly brick.
Can I get root on the Knox-enabled update? Yes. For those of us who DID NOT take the official OTA and DO NOT have the Knox bootloader, we can get root on 4.3 by injecting it and removing the Knox apps. For those WITH the Knox bootloader, you will need to wait until a full stock MK3 tar is available, which we can then use to make an Odin-flashable MK3 stock rom with root injected using the de-la-vega root method.
Can I downgrade while on 4.3? You can flash roms no matter what Android version they are. That is perfectly fine. But you cannot downgrade the bootloader if you have the Knox bootloader, or else it will cause your bootloader to become corrupted and give you a fancy paperweight. Again, for those who DO NOT have the Knox bootloader, you needn't worry about this/downgrading firmware since the Knox bootloader is what prevents you from doing this. Downgrading your bootloader includes: attempting to flash full stock tar of software versions < MK3, etc.
How can I tell if I've got the Knox bootloader?
Boot into download mode (through custom reboot menu, or by powering off then holding Power+Home+VolumeDown and then VolUp when prompted). If you see a line that starts with the following, then you've got the Knox bootloader. I will insert a picture showing how it actually looks soon
Warranty Bit:
Click to expand...
Click to collapse
[SIZE=+1]READ THIS TOO: http://forum.xda-developers.com/showthread.php?t=1788313
It's for the Verizon S3, but it applies to all the carrier 4.3 updates[/SIZE]
I will add to this as more questions come up
I hope the above helps to clear up some confusion. Ask questions if you are still concerned and I will do my best to answer them.

is there any way to make this a sticky @kennyglass123

This is great information man!
http://i.imgur.com/qrByUGN.jpg

[Q] For now, once you have Knox you'll always have knox? What's the possibility of removing Knox?

elephant007 said:
[Q] For now, once you have Knox you'll always have knox? What's the possibility of removing Knox?
Click to expand...
Click to collapse
as of right now none.

elephant007 said:
[Q] For now, once you have Knox you'll always have knox? What's the possibility of removing Knox?
Click to expand...
Click to collapse
No way to remove bootloader Knox ATM.

I've seen several posts mention "tripping KNOX" or "voiding KNOX." What does that mean, exactly, regarding rooting a phone? Does it just mean it voids the warranty if you need to get support from Samsung/Sprint? Or are there other adverse effects?

Mostly just a visible warranty void.

Samsung bought crapple disease. So sad, but its my excuse to buy a nexus.
Sent from my SPH-L710 using xda app-developers app

As said above, a voided Knox is mostly just a highly visible warranty void. Your local Sprint store may or may not care, or the specific Samsung rep that you deal with may not care, but it's easier just to not have to deal with it to begin with.

Does this mean there is already a touchwiz 4.3 ROM we can flash or do we still have to wait?
Sent from my SPH-L710 using Tapatalk

The biggest thing here is the fact that there is no full tar file to restore. So even if you do not care about knox or warranty. If something goes wrong with a flash or anything else you can't use an older tar file let's say MD4 or LJ7 or anything because you will end up with a brick. There is nothing to use to ODIN restore your device. Once you go 4.3 with Knox you have to stay 4.3 and even if you wanted to stay 4.3 and wanted to restore that there is no tar file at this time.
Have a great day!

I have a question I think we talked a bit about the problems the knox bootloader brings into the system. My question is the opposite what does it fix / change?
Im thinking along the lines of somebody modding the update so an old bootloader would be with the new rom would that be an issue? I think i remember hearing something about wifi being the problem but any clarification would be nice.

docnas said:
I have a question I think we talked a bit about the problems the knox bootloader brings into the system. My question is the opposite what does it fix / change?
Im thinking along the lines of somebody modding the update so an old bootloader would be with the new rom would that be an issue? I think i remember hearing something about wifi being the problem but any clarification would be nice.
Click to expand...
Click to collapse
Late to the party. CNexus already has a update cooking.
Sent from my SPH-L710 using Tapatalk

the question im trying to ask is what do we lose if we use the old bootloader? any functionality? (besides the knox security bull$hit)

docnas said:
the question im trying to ask is what do we lose if we use the old bootloader? any functionality? (besides the knox security bull$hit)
Click to expand...
Click to collapse
Right now, wifi is broken with the old bootloader and 4.3 rom...happened on the other devices too (tmo s3 and sprint s4)
But there is a fix: flash at&t kernel. But it messes up screen rotation. So i'm trying to come up with another fix that will let wifi turn on properly and let screen rotation work properly too

You = rock. Or some other awesome thing.
Sent from my SPH-L710 using xda app-developers app

CNexus said:
Right now, wifi is broken with the old bootloader and 4.3 rom...happened on the other devices too (tmo s3 and sprint s4)
But there is a fix: flash at&t kernel. But it messes up screen rotation. So i'm trying to come up with another fix that will let wifi turn on properly and let screen rotation work properly too
Click to expand...
Click to collapse
So is this Knox a Sprint thing, or a Samsung thing?
I can understand the reasoning for Knox(money) but, dang, I guess it's a dog eat dog world out there.
This doesn't affect CyanogenMod does it? I'm scared...
edit... I remember reading about a brick api or command, I never executed it, sounds nasty, is this what they use to brick peoples phones if they try to "hack" it?

Edge-Case said:
So is this Knox a Sprint thing, or a Samsung thing?
I can understand the reasoning for Knox(money) but, dang, I guess it's a dog eat dog world out there.
This doesn't affect CyanogenMod does it? I'm scared...
edit... I remember reading about a brick api or command, I never executed it, sounds nasty, is this what they use to brick peoples phones if they try to "hack" it?
Click to expand...
Click to collapse
This would be a we-can't-update-the-bootloader thing lol. And we can't do that because it has Knox, which is Samsung's doing
This shouldn't affect any AOSP roms because it uses a different kernel and builds its own WiFi libs

docnas said:
the question im trying to ask is what do we lose if we use the old bootloader? any functionality? (besides the knox security bull$hit)
Click to expand...
Click to collapse
From what I've read Knox is Samsung's attempt to provide strong security to their phones for the enterprise customers. As you can imagine, allowing system level access to files can be used to get around a lot of security measures that IT people would like to enforce in their client's devices. It makes sense at the enterprise level, but it's a pain for anyone who want's to mod their phone.
So I think the answer to your question is, unless you are using your phone in a locked down corporate environment then there really is no advantage to Knox. Too bad it can't be turned off, at least not officially.

What is the easiest way to root this device?

I don't wont to trip any counters...

kingo would be the easiest way. install the program on your computer, connect your device, click a couple times, let it do its thing and you'll have instant root. nothing else changes and nothing is lost. there was some bad feedback about the app but its been cleared up since then.
many people have used it.
www.kingoapp.com

rlee008 said:
kingo would be the easiest way. install the program on your computer, connect your device, click a couple times, let it do its thing and you'll have instant root. nothing else changes and nothing is lost. there was some bad feedback about the app but its been cleared up since then.
many people have used it.
www.kingoapp.com
Click to expand...
Click to collapse
Seconded. It probably won't even trigger your Knox flag (I have rooted several times with Kingo and my Knox flag is still 0x0)

thompsos said:
Seconded. It probably won't even trigger your Knox flag (I have rooted several times with Kingo and my Knox flag is still 0x0)
Click to expand...
Click to collapse
Why would we not want to trigger that, does that make Knox useless? Reason I ask is because I do use this phone for work with an exchange account and have been curious about this. If I use Knox to just try it out will that screw anything up?

ilogik said:
Why would we not want to trigger that, does that make Knox useless? Reason I ask is because I do use this phone for work with an exchange account and have been curious about this. If I use Knox to just try it out will that screw anything up?
Click to expand...
Click to collapse
I tripped knox and never looked back I guess I'll figure out what I can do when my jump comes up
Official CM11 & Lean Kernel Powered hltetmo

ilogik said:
Why would we not want to trigger that, does that make Knox useless? Reason I ask is because I do use this phone for work with an exchange account and have been curious about this. If I use Knox to just try it out will that screw anything up?
Click to expand...
Click to collapse
Tripping KNOX may make the phone incompatible with certain enterprise scenarios. Using kingo wont trip the counter so it shouldnt matter in your case.

ilogik said:
Why would we not want to trigger that, does that make Knox useless? Reason I ask is because I do use this phone for work with an exchange account and have been curious about this. If I use Knox to just try it out will that screw anything up?
Click to expand...
Click to collapse
Check out this thread which is linked in the FAQ sticky here.

There is one person claiming Kingo tripped his Knox flag despite MI7, so unless we figure exactly why, I would be careful and maybe wait a little.

pete4k said:
There is one person claiming Kingo tripped his Knox flag despite MI7, so unless we figure exactly why, I would be careful and maybe wait a little.
Click to expand...
Click to collapse
I don't know about that other person, but I had the same issue, I'm still on MI7, I used Kingo to rood my Note 3, everything was fine until it asked me to install an app called MtkCamera, which I declined, then Kingo kind of frozed and then it restarted. When I checked the Knox counter it was tripped ...so, I would suggest caution with this.

Well, first of all I would ask why do you want to root to begin with and secondly is that reason more important than using it for work. At least In theory Knox was developed for people like you, who have one phone for work and personal use, by providing secure environment for sensitive data. Even if your job doesn't use Knox yet, they may in the future. If I was doing banking or CC transactions on my phone I would seriously consider Knox as well, albeit I have no idea if it would actually serve it's purpose well. If you just test Knox you would need to download some extra software from Samsung, Samsung is aware of security holes and already patched them in the latest bootloaders, so Knox flag will trip when rooting for sure, so I wouldn't be surprised if those security updates wouldn't be the first downloaded as part of Knox suite, when installing it. So here I would speculate, since I have not tried it myself, that you should either root and take your chances, or use Knox and forget about rooting. I wonder if PTJunkie didn't play with Knox, or somehow manage to get Samsung security update, to get his flag tripped, where others didn't. I actually disabled updates to make sure I don't get any new enhancements from T-mo or Samsung.

If you have used Odin before,
root de la vega is easy.
http://www.android.gs/root-t-mobile...-root-de-la-vega-tool-knox-flags-not-tripped/
I root because i have a lot of apps that required root like titanium explorer and root explorer .
Moreso, I need to freeze all the bloatware like google now and s voice.

Dattack said:
If you have used Odin before,
root de la vega is easy.
http://www.android.gs/root-t-mobile...-root-de-la-vega-tool-knox-flags-not-tripped/
I root because i have a lot of apps that required root like titanium explorer and root explorer .
Moreso, I need to freeze all the bloatware like google now and s voice.
Click to expand...
Click to collapse
I have 2 quick questions:
1. root delavega uses att rom, att phones don't have wifi calling, is wifi calling still working as usual on rooted, t-mo phones? or in general Is there anything T-mo specific that breaks after root?
2. I assume bringing the phone back to original would require reflashing original T-mo ROMS? Anything else needs to be flashed?

I haven't flashed back to tmobile stock yet. I still have wifi calling and I make sure to disable my tmobile account because they can tell if you are rooted.

Yeah, when you run that system check, but what can they do? Even if they cared, I'm not sure if they do, if your phone is stock with no flags tripped, I would argue and play stupid if needed return, or repair. Also I wonder if this check could be somehow disabled all by itself, for example by taking away some permissions.

What IS a Knox Counter

Sorry for the noobish question, but I keep hearing about this Knox counter thing on the Root Bounty threads, that people will pay extra if it doesn't trip Knox.
Can someone tell me WHAT Knox is, what it's significance is to the phone and to rooting/flashing?

JOSHSKORN said:
Sorry for the noobish question, but I keep hearing about this Knox counter thing on the Root Bounty threads, that people will pay extra if it doesn't trip Knox.
Can someone tell me WHAT Knox is, what it's significance is to the phone and to rooting/flashing?
Click to expand...
Click to collapse
I'm not sure... all I know is I learned to fear anything Knox
Sent from my SM-N910V using Tapatalk

Knox is built in security that samsung has created. problem is that when you root, it trips a knox counter so samsung or verizon can simply power the phone into the bootloader and see knox is tripped, and right away know the device is rooted, which voids any warranties.
Sent from my Samsung Galaxy Note 4 using Tapatalk.

jayochs said:
Knox is built in security that samsung has created. problem is that when you root, it trips a knox counter so samsung or verizon can simply power the phone into the bootloader and see knox is tripped, and right away know the device is rooted, which voids any warranties.
Sent from my Samsung Galaxy Note 4 using Tapatalk.
Click to expand...
Click to collapse
Can Knox be removed somehow? Have other phones with Knox been successfully rooted without tripping it?

JOSHSKORN said:
Can Knox be removed somehow? Have other phones with Knox been successfully rooted without tripping it?
Click to expand...
Click to collapse
No, knox can not be removed. It also can NOT be reset. Yes, phones have been rooted without tripping knox. I had my Verizon Note 3 rooted and knox was not tripped.
Basically, here's how I explained it to a friend. Think of knox, as a saftey line keeping you from opening your car's hood. Your warranty is fine as long as you don't mess with the engine. You decide to cut that line, and pop the hood. That's tripping knox. If you tried to modify the engine and ended up blowing it up, yeah, you ****ed up! However, if didn't touch the engine, and then later had your car's horn stop working, it doesn't matter. Because you popped the hood, your engine car's warranty is GONE!

Knoxreset.com legit ?

Hi,
after a long time using iPhone i switched to Android (Note 10+ Exy.
I considered to root it but dont want to loose all Samsung Apps etc. I found a Website called knoxreset.com which tells you that it can put the knox back to 0x0 and "restore" all Samsung Apps.
I tried to find some reviews about this Website but found nothing. I know that Knox now a days has something to do with the Hardware and as im a newbie, i wanted to ask you guys if this is legit or a scam ?
They sell it rn for 45 Dollars.
Thanks for any help!

Scam

raul6 said:
Scam
Click to expand...
Click to collapse
Okay, i'll stay away from it

Shxckz said:
Hi,
after a long time using iPhone i switched to Android (Note 10+ Exy.
I considered to root it but dont want to loose all Samsung Apps etc. I found a Website called knoxreset.com which tells you that it can put the knox back to 0x0 and "restore" all Samsung Apps.
I tried to find some reviews about this Website but found nothing. I know that Knox now a days has something to do with the Hardware and as im a newbie, i wanted to ask you guys if this is legit or a scam ?
They sell it rn for 45 Dollars.
Thanks for any help!
Click to expand...
Click to collapse
I would go with a scam... Tripping knox literally blows an efuse. Once it blown that's it... It is blown for good on that motherboard.
The site is misleading in what it does. The app involves rooting (or uses existing root on) the phone, installs (possibly uses if exists) a custom recovery and merely makes the trip counter looks like it wasn't tripped (it does not actually change the knox trip counter). It's a purely superficial mask and nothing more.. also if I recall correctly this is something you can do yourself.
Also the site says it doesn't effect knox, so any apps which depend on knox itself won't work.
https://support.samsungknox.com/hc/...-a-Knox-Warranty-Bit-and-how-is-it-triggered-

It's easy to fake reset Knox if you are rooted which is exactly what they are doing. It will fool some apps that won't work if knox has been tripped but it won't fool Samsung and as soon as you flash back stock then it will show Knox tripped. If you want root but won't to fake knox then there are guides out there
Sent from my SM-N976B using Tapatalk

andy242 said:
It's easy to fake reset Knox if you are rooted which is exactly what they are doing. It will fool some apps that won't work if knox has been tripped but it won't fool Samsung and as soon as you flash back stock then it will show Knox tripped. If you want root but won't to fake knox then there are guides out there
Sent from my SM-N976B using Tapatalk
Click to expand...
Click to collapse
So it is possible to root, fake knox and use for example Samsung Pass or other apps that doesnt work with a tripped knox ? Thank you for your answer!
EDIT: I cant find any updated tutorial how to fake it properly, do you have any link for me ?

Shxckz said:
So it is possible to root, fake knox and use for example Samsung Pass or other apps that doesnt work with a tripped knox ? Thank you for your answer!
EDIT: I cant find any updated tutorial how to fake it properly, do you have any link for me ?
Click to expand...
Click to collapse
No, banking apps, samsung pay, and other apps will not work, only some apps can be fooled by hiding root, just consider this before rooting, as for tripping knox, there are some cosmetic implementations that make knox look 0x0, but just for show, this can not in anyway be reversed, apps specifically looking for the e-fuse status, will never be fooled

The ONLY sure fire way known to reset KNOX is Motherboard replacement...
This will be expensive and will also change your IMEI and Serial number...

yeah it definitely looks like a scam website @scottusa2008 is definitely on the mark. once that efuse is blown, its blown.

Okay guys thank you very much for the help, ill do some more research and will probably go with the Dr. Ketan Rom
I'll close this Thread now

Ex developer of KNOX Reset (Disabler) application
Hi,
The application listed at KNOXReset.com cannot indeed reset the actual KNOX counter. It is also mentioned on the store page before purchasing the application now.
It has been designed to spoof the string in Odin mode and display 0x0(0) regardless of actual value. It works only on certain devices.
Also, it now includes modified S applications which work even on rooted devices.
Venus342

lolol... all it does is set a property to appear as not tripped.. smh.. ppl do anything for a quick buck these days

venus342a said:
Ex developer of KNOX Reset (Disabler) application
Hi,
The application listed at KNOXReset.com cannot indeed reset the actual KNOX counter. It is also mentioned on the store page before purchasing the application now.
It has been designed to spoof the string in Odin mode and display 0x0(0) regardless of actual value. It works only on certain devices.
Also, it now includes modified S applications which work even on rooted devices.
Venus342
Click to expand...
Click to collapse
Where's the application brother