Develop Bugs

[Q] GT-N7100 rooted on Android 4.3 Knox 0x1 can't update OTA

Hi
I am using Samsung Galaxy Note II GT-N7100
I did a mistake by not doing more research before rooting my phone and now my Knox flag is 0x1.
I upgraded my phone to Android 4.3 then rooted it with Chainfire autoroot using Odin.
Now I am not able to remove KNOX bootloader also if I try to flash a KNOX free bootloader Odin show unsupported device error and device gets soft brick then I have to flash Chainfire autoroot again to start the device again.
Is there any way to get KNOX free bootloader? or to be with Knox bootloader but everything fine like it was before.
Disadvantages are
I can't use Knox feature now.
Cannot update my device OTA or through Samsung Kies so downloading form Sammobile and flashing takes a lot of time.
I don't have any other problem I am running on stock rom 4.3 but I want that I should able to update my mobile OTA and if possible able to use KNOX feature again.
Thank you
Have a nice day

XenonTNT said:
Hi
I am using Samsung Galaxy Note II GT-N7100
I did a mistake by not doing more research before rooting my phone and now my Knox flag is 0x1.
I upgraded my phone to Android 4.3 then rooted it with Chainfire autoroot using Odin.
Now I am not able to remove KNOX bootloader also if I try to flash a KNOX free bootloader Odin show unsupported device error and device gets soft brick then I have to flash Chainfire autoroot again to start the device again.
Is there any way to get KNOX free bootloader? or to be with Knox bootloader but everything fine like it was before.
Disadvantages are
I can't use Knox feature now.
Cannot update my device OTA or through Samsung Kies so downloading form Sammobile and flashing takes a lot of time.
I don't have any other problem I am running on stock rom 4.3 but I want that I should able to update my mobile OTA and if possible able to use KNOX feature again.
Thank you
Have a nice day
Click to expand...
Click to collapse
So far, this issue of 0x1 back to 0x0 is still fly high in the air. I read a lot of thread regarding this issue, until I myself also a bit headache
But, from my understanding after reading so many thread... Once it tripped, there's no way to return back. And you can't (theoritically) to revert back to 4.1.2 bootloader, but perhaps, there's a way. And yes, once it tripped, you can't use any KNOX features.
I still have no better conclusion as well regarding this issue. I got read 1 time somebody is able to revert back to 4.1.2, but still with KNOX 0x1. Most are failed. You may want to read all the thread regarding this issue with a search.
I'm here not to answer exactly on how to revert back. But just to share what I know regarding this tripping issue. To be frank... I also want to know about this, as I need to root my MJ7 Note 3, which so far... no solution yet for the tripping KNOX, so I still hold on to it.

YOu can root if you have not trip 0x1 without tripping it.
antique_sonic;49546705
I also want to know about this said:
I found a way today on the internet that If Note 2 is at 0x0 flag you can root it without increasing the count but it will show custom that you can revert back to original by triangle away may be there is a way for Note 3 too.
I have already rooted so problem starts here
Click to expand...
Click to collapse

I have a rooted official 4.3 OTA rom knox is 1. I used triangle away to make it official. when i check for updates it say that i have the latest rom. I think i can use ota update even knox is 1
Sent from my GT-N7100 using xda app-developers app

Not for me.
tadz202 said:
I have a rooted official 4.3 OTA rom knox is 1. I used triangle away to make it official. when i check for updates it say that i have the latest rom. I think i can use ota update even knox is 1
Sent from my GT-N7100 using xda app-developers app
Click to expand...
Click to collapse
I used triangle away also this is my device status in Downloading mode.
Custom binary download No
Current Binary Samsung Official
System Status Offcial
Knox Warranty Void 1
but in Software update you device is modified. May it is showing you because you have already the latest update. Please can you tell me the Device status in Downloading mode also please report back if you are able or not to download update OTA when available.
Thank you.

Same boat
My phone is in the same boat as you. My desire was not so much KNOX as to have 4.3 with phone encryption and root. In order to succeed with my desire, I have to leave the stock 4.3 recovery intact. This greatly reduces my root options. I had root before the update, but it was unable to update after going to 4.3. I tried Kingo in an attempt to fix root, but to no avail. I decided to unroot and re-root. I used Kingo to unroot. From there I had to run saferoot a few times before it was finally able to install SuperSU and associated files. The version it installed is the latest so I'll have to wait until the next release to find out if it can update. Everything else seems to work fine except ES File Explorer appears to no longer be able to mount the /system RW.
saferoot can be found over here
http://forum.xda-developers.com/showthread.php?t=2565758
Hope that helps,
Ddfault
XenonTNT said:
I used triangle away also this is my device status in Downloading mode.
Custom binary download No
Current Binary Samsung Official
System Status Offcial
Knox Warranty Void 1
Click to expand...
Click to collapse

n7100 upgrade to 4.4

Hello
I was wondering if someone can help.
I have a u.k n7100 running 4.3, its is rooted with knox disabled, in doing so I have tripped the knox warranty counter
I want to upgrade 4.4.2 stock
Is this possible due to the fact of my current situation. Will the upgrade go through?, like a routine upgrade keeping my data. I assume knox will be disabled and i will lose root, which i am fine with. Please let me know if it can be done and it is routine stock flash procedure using odin.
or are other steps required.
thanks
harlzden

harlzden said:
Hello
I was wondering if someone can help.
I have a u.k n7100 running 4.3, its is rooted with knox disabled, in doing so I have tripped the knox warranty counter
I want to upgrade 4.4.2 stock
Is this possible due to the fact of my current situation. Will the upgrade go through?, like a routine upgrade keeping my data. I assume knox will be disabled and i will lose root, which i am fine with. Please let me know if it can be done and it is routine stock flash procedure using odin.
or are other steps required.
thanks
harlzden
Click to expand...
Click to collapse
You can update with no problem at all, using ODIN you will lose data as for root it depends on ROM you flash if stock with root then you keep root but if not then lose it, Id recommend flashing a custom ROM with no wipe

harlzden said:
Hello
I was wondering if someone can help.
I have a u.k n7100 running 4.3, its is rooted with knox disabled, in doing so I have tripped the knox warranty counter
I want to upgrade 4.4.2 stock
Is this possible due to the fact of my current situation. Will the upgrade go through?, like a routine upgrade keeping my data. I assume knox will be disabled and i will lose root, which i am fine with. Please let me know if it can be done and it is routine stock flash procedure using odin.
or are other steps required.
thanks
harlzden
Click to expand...
Click to collapse
AFAIK Mobile ODIN flashes stock ROM without the bootloader, someone correct me if I'm wrong.
N7105 rocking AOSB with AGNi kernel,
Click "Thanks" if I was of any help!

harlzden said:
Hello
I was wondering if someone can help.
I have a u.k n7100 running 4.3, its is rooted with knox disabled, in doing so I have tripped the knox warranty counter
I want to upgrade 4.4.2 stock
Is this possible due to the fact of my current situation. Will the upgrade go through?, like a routine upgrade keeping my data. I assume knox will be disabled and i will lose root, which i am fine with. Please let me know if it can be done and it is routine stock flash procedure using odin.
or are other steps required.
thanks
harlzden
Click to expand...
Click to collapse
Ofcourse you can upgrade to any stock firmware via odin but once KNOX is triggered it cannot be reset so even thought your binary counter will be reset after flashing official stock ROM, knox will still read 0x1.Good luck.

[Q] Successfully Rooted with Towelroot on Note 3(SM-N900T), have some questions...

Successfully rooted without tripping Knox with Towelroot. NE6 firmware. I have T-Mobile Jump and would like to Jump to the Note 4 when it comes out. If I install TWRP and make a backup of stock, will I trip knox and void my JUMP eligibility? Wanted to install via Flashify and install Xposed framework at some point down the line.
Thanks!

Steameffekt said:
Successfully rooted without tripping Knox with Towelroot. NE6 firmware. I have T-Mobile Jump and would like to Jump to the Note 4 when it comes out. If I install TWRP and make a backup of stock, will I trip knox and void my JUMP eligibility? Wanted to install via Flashify and install Xposed framework at some point down the line.
Thanks!
Click to expand...
Click to collapse
Yes.. Custom recovery or custom kernel will trip knox
Sent from my SM-N900T using Tapatalk

effortless said:
Yes.. Custom recovery or custom kernel will trip knox
Sent from my SM-N900T using Tapatalk
Click to expand...
Click to collapse
If I flashed back to stock, did a factory reset, would it still say custom?

Steameffekt said:
If I flashed back to stock, did a factory reset, would it still say custom?
Click to expand...
Click to collapse
As long as you didn't flash a custom kernel or recovery, it should be OK once you flash stock.
Even if you trip Knox, flash back to stock and jump when the time comes. They generally don't care about that as long as your phone is not damaged.
Knox warranty void is not the phone warranty. It's telling you Knox can't secure your phone anymore. Its (Knox's) warranty is void. People all over the Internet don't even know what Knox is and they spread misinformation.
Look up what Knox really is. It is an app that runs on your phone and creates a secure Android environment within itself. It's like another phone with its own launcher and app store that is secure. It's meant for employees to use their personal phone for work purposes as well.
When you trip the Knox warranty, Knox triggers an efuse that will prevent the secure container from being able to be created... Meaning Knox will never work again on your phone. It's a security measure so that companies will take the Samsung phones seriously in the work space. In reality it has worked for them as the department of defense recently approved a few Samsung models with Knox.
If you don't plan on using Knox for anything, then trip Knox and enjoy custom kernels/recoveries etc. If you do plan on using it, it's not a good idea to even root your phone as the whole purpose of Knox is to be secure and rooting will make Knox vulnerable.. You might even get fired if your IT department finds out.
Sent from my SM-N900T using Tapatalk

effortless said:
Yes.. Custom recovery or custom kernel will trip knox
Sent from my SM-N900T using Tapatalk
Click to expand...
Click to collapse
effortless said:
As long as you didn't flash a custom kernel or recovery, it should be OK once you flash stock.
Even if you trip Knox, flash back to stock and jump when the time comes. They generally don't care about that as long as your phone is not damaged.
Knox warranty void is not the phone warranty. It's telling you Knox can't secure your phone anymore. Its (Knox's) warranty is void. People all over the Internet don't even know what Knox is and they spread misinformation.
Look up what Knox really is. It is an app that runs on your phone and creates a secure Android environment within itself. It's like another phone with its own launcher and app store that is secure. It's meant for employees to use their personal phone for work purposes as well.
When you trip the Knox warranty, Knox triggers an efuse that will prevent the secure container from being able to be created... Meaning Knox will never work again on your phone. It's a security measure so that companies will take the Samsung phones seriously in the work space. In reality it has worked for them as the department of defense recently approved a few Samsung models with Knox.
If you don't plan on using Knox for anything, then trip Knox and enjoy custom kernels/recoveries etc. If you do plan on using it, it's not a good idea to even root your phone as the whole purpose of Knox is to be secure and rooting will make Knox vulnerable.. You might even get fired if your IT department finds out.
Sent from my SM-N900T using Tapatalk
Click to expand...
Click to collapse
Makes sense and I probably will flash a custom recovery. I just don't understand the fuss with people wanting not to trip knox if they're not even gonna use it.

I successfully rooted my Tmo Note 3 with Towelroot v2. I am currently on NE6 Boot-loader and have Knox at 0x0 and would like to remain there. I would like to upgrade to the new firmware NF1 which is not rootable with Towelroot yet. Does anyone know if using Mobile Odin Pro is able to keep root if manually done without breaking/tripping Knox? I think I remember reading somewhere that it was okay to do so and ignore the message even though it asks to download a file and then it gives a warning saying that:
"Using, Mobile Odin on this device will void your warranty, as the Knox counter will be triggered .This is not reversible".
Can someone confirm if its Okay to ignore the warning and that activating Mobile Odin Pro on my phone is OK without triggering Know 0x1, or was that other posting I read somewhere wrong? I cannot remember where I read it. If not possible to use Mobile Odin without triggering Knox 0x1,. is there any other way to root NF1 without triggering knox on our device? What do you guys think?

un-answered question............
I don't know why I have not asked this before, but here it goes..........
First, I just want to say that I could care less about Knox...
(my phone already has the knox pox)
But for future reference if I had a brand new Note 3 with official stock NB4 baseband
and I rooted it successfully using Towelroot (or root de la vaga) would it be possible
to simply rename a custom rom like Hyperdrive to "update.zip" and copy it to the
internal sdcard then boot into the stock NB4 recovery and flash/install "update.zip"?
If the only problem with this method would be the fact that a different kernel would
also flashed along with the rom it would be an easy fix by just removing the kernel
from the custom rom file before flashing the update.zip?
I know that more likely than not this method would not work.
But if it did work it should not trip the knox right?

Eudeferrer said:
I successfully rooted my Tmo Note 3 with Towelroot v2. I am currently on NE6 Boot-loader and have Knox at 0x0 and would like to remain there. I would like to upgrade to the new firmware NF1 which is not rootable with Towelroot yet. Does anyone know if using Mobile Odin Pro is able to keep root if manually done without breaking/tripping Knox? I think I remember reading somewhere that it was okay to do so and ignore the message even though it asks to download a file and then it gives a warning saying that:
"Using, Mobile Odin on this device will void your warranty, as the Knox counter will be triggered .This is not reversible".
Can someone confirm if its Okay to ignore the warning and that activating Mobile Odin Pro on my phone is OK without triggering Know 0x1, or was that other posting I read somewhere wrong? I cannot remember where I read it. If not possible to use Mobile Odin without triggering Knox 0x1,. is there any other way to root NF1 without triggering knox on our device? What do you guys think?
Click to expand...
Click to collapse
Sent from my SM-N900T using xda premium

re: modile odin - knox
Eudeferrer said:
I successfully rooted my Tmo Note 3 with Towelroot v2. I am currently on NE6 Boot-loader and have Knox at 0x0 and would like to remain there. I would like to upgrade to the new firmware NF1 which is not rootable with Towelroot yet. Does anyone know if using Mobile Odin Pro is able to keep root if manually done without breaking/tripping Knox? I think I remember reading somewhere that it was okay to do so and ignore the message even though it asks to download a file and then it gives a warning saying that:
"Using, Mobile Odin on this device will void your warranty, as the Knox counter will be triggered .This is not reversible". Can someone confirm if its Okay to ignore the warning and that activating Mobile Odin Pro on my phone is OK without triggering Know 0x1, or was that other posting I read somewhere wrong? I cannot remember where I read it. If not possible to use Mobile Odin without triggering Knox 0x1,. is there any other way to root NF1 without triggering knox on our device? What do you guys think?
Click to expand...
Click to collapse
I just checked and it's OK to "install" Mobile Odin on your phone and it
it will NOT trip the KNOX counter by simply installing it as long as you:
1: Don't flash any custom recoveries like twrp/cwm.
2: Don't flash any stock or custom kernels.
3: Don't flash any modems/baseband or bootloaders.
4: Don't flash any custom odin flashable firmwares.
In mobile odin there is no option to flash cwm/twrp
flashable zip files of any kind including custom roms.
Good luck!

Misterjunky said:
I just checked and it's OK to "install" Mobile Odin on your phone and it
it will NOT trip the KNOX counter by simply installing it as long as you:
1: Don't flash any custom recoveries like twrp/cwm.
2: Don't flash any stock or custom kernels.
3: Don't flash any modems/baseband or bootloaders.
4: Don't flash any custom odin flashable firmwares.
In mobile odin there is no option to flash cwm/twrp
flashable zip files of any kind including custom roms.
Good luck!
Click to expand...
Click to collapse
Why would flashing a stock kernel/baseband or firmware cause Knox to change to 0x1 when done through Mobile Odin? I thought this would happen only through custom based ones?

re: knox - mobile odin
Eudeferrer said:
Why would flashing a stock kernel/baseband or firmware cause Knox to change to 0x1 when done through Mobile Odin? I thought this would happen only through custom based ones?
Click to expand...
Click to collapse
First of all I never said not to odin flash stock official firmware in my post.
If you or anyone else knows for sure that the modem/baseband or kernel you are
wanting to flash are 100% official stock 4.4.2 Kitkat NB4/NE6/NF1 versions then
its just fine to flash those.
However since knox cannot be rolled back and to keep things on the SAFE side I
always suggest the very safest way to do these things which even a NOOB would
understand without getting into trouble with a lot of unexpected issues. :laugh:
Good luck!

Misterjunky said:
First of all I never said not to odin flash stock official firmware in my post.
If you or anyone else knows for sure that the modem/baseband or kernel you are
wanting to flash are 100% official stock 4.4.2 Kitkat NB4/NE6/NF1 versions then
its just fine to flash those.
However since knox cannot be rolled back and to keep things on the SAFE side I
always suggest the very safest way to do these things which even a NOOB would
understand without getting into trouble with a lot of unexpected issues. :laugh:
Good luck!
Click to expand...
Click to collapse
My bad. I guess I misunderstood you the first time. Thank you for your response.

[Q/A] Answers Added - OTA's/Updates, rooting & tripping Knox? - other questions

So I rooted using chainfires method for my Tab S 8.4 wifi (T700) and it tripped Knox (0x1). I know there is no way to currently reset it and there is a bounty out for it. No big deal on tripping it, I wanted to root anyways and want to try out CM12 eventually. After doing some research it appears Knox gets tripped when unofficial firmware or recoveries get flashed via Odin. Knox is not tripped when you flash official Samsung firmware. I had a few questions though I can't seem to get a clear answer on and was hoping to find some or get a discussion going at least about Knox for the Tab S.
Questions and Answers
- Are you still able to receive OTA updates on a stock rooted rom/recovery with Knox tripped?
A: No, not while rooted, "Operating System on your device has been modified in an unauthorized way. Try downloading software updates using Samsung Kies on your PC" Unsure if Knox prevents it but most likely does not.
- Will you lose root if you can get OTA updates?
A: No OTA Updates allowed on rooted devices. Reports have stated that flashing the official firmware update via odin will unroot the device but maintain data, most likely kies is the same when updating. However if a bootloop occurs after flashing, you may need to wipe data and cache via stock recovery.
- If knox is tripped (0x1), if I flash a custom recovery (TWRP/CWM) or use chainfires method to root again will it trip Knox again (0x2)?
A: YES & NO, Knox will not read (0x2) if unofficial img's are flashed via Odin but reports on other devices have stated it will read {0x1(2)}
- If yes can you trip Knox too many times, rendering device inoperable or bricked?
A: NO, tripping Knox only informs if warranty has been voided by flashing unofficial firmware/recovery/img files and root kernals via Odin. When the knox warranty void status is tripped, the knox software will no longer work.
- What is tripped specifically in Knox (for the Galaxy Tab S), an efuse, or is it software or binary code?
A: Most likely an eFuse. There is no way to reset the flag counter as it is believed to be an eFuse that once gets blown it stays damaged and cannot be reset.
***New Questions***
- Will flashing a custom recovery img (TWRP/CWM) via ADB trip Knox (0x1)?
A: Yes, it will trip Knox.
Thanks to all who answer and contribute.
If there are any new questions, updates to be added or wrong information to be corrected please let me know.

No OTAs when you are rooted on custom rom. Dont worry, someone will make a stock custom rom to flash with twrp Or you can odin flash stock lollipop and root with twrp
If you do the ota it will probably not install because of root.
If you flash a custom recovery, or root again.. Knox will stay 0x1. It wont change.
Knox is like a check when booting up your device. Its more like uhh protection. If you install custom stuff then you dont get protection. Knox was a security feature that samsung included. Its really not needed as it really doesnt work. Thats why people trip it. I highly doubt its used for security but I think its just used to detect if warranty has been void or not. Its not something that you should worry.
Hope this helps!

DUHAsianSKILLZ said:
No OTAs when you are rooted on custom rom. Dont worry, someone will make a stock custom rom to flash with twrp Or you can odin flash stock lollipop and root with twrp
If you do the ota it will probably not install because of root.
If you flash a custom recovery, or root again.. Knox will stay 0x1. It wont change.
Knox is like a check when booting up your device. Its more like uhh protection. If you install custom stuff then you dont get protection. Knox was a security feature that samsung included. Its really not needed as it really doesnt work. Thats why people trip it. I highly doubt its used for security but I think its just used to detect if warranty has been void or not. Its not something that you should worry.
Hope this helps!
Click to expand...
Click to collapse
Thanks, I figured Knox is nothing more than just a feature to let Tech's know if the warranty had been voided. Also I figure that flashing the updates myself when they come out would be the best option. Thanks again.

how do you make the knoxx counter back to zero ??
methslushee said:
Thanks, I figured Knox is nothing more than just a feature to let Tech's know if the warranty had been voided. Also I figure that flashing the updates myself when they come out would be the best option. Thanks again.
Click to expand...
Click to collapse
is there a limit to knox number and how can it be made to zero again to retain warranty

[email protected] said:
is there a limit to knox number and how can it be made to zero again to retain warranty
Click to expand...
Click to collapse
Read post two above yours. It can not be reset to zero once it's tripped.

Even if you root and trip knox, although you cannot receive official ota's, you can still use samsung kies to still recieve the updates.

updated OP with answers to questions.

Stupid Knox. This is one "feature" of Samsung devices which makes me less likely to purchase them in the future.

For the new question, flashing any custom recovery with odin or adb will trip knox. Flashing stock should not trip

Note 3 Rooting

I have a Note 3 and im trying to figure out the process of rooting without tripping the Knox Counter. I rooted my Note 2, years ago and has been awhile. Also like to know is there a "triangle away" method to reset the counter.
Model: SM-900T
Android: 5.0
Baseband: N900TUVUFOL1
Kernel: 3.4.0-6005498
Knox: 2.3
Thanks in advance

As far as I know, there is no way to root without tripping Knox.
If the phone is not under warranty, tripping knox should not be an issue. I have tripped Knox on a few phones and have never had an issue.

I asked the same question a while back, and only just 2 days ago rooted my SM-N900T knox 0x0. Asked: Here.
To achieve root on the note 3 without tripping knox you must downgrade from the Lollipop firmware OB6, or FOL1 to NE6 using PC Odin.
Once downgraded to NE6 download and use TowelRoot. This will unlock root without tripping knox, NE6 was the last vulnerable firmware for towelroot on the t-mobile note 3.
Make sure you are flashing official t-mobile firmwares only for kitkat/lollipop when using PC odin.
Flashing any custom recovery, kernal, rom, bootloader, or no longer supported android version (4.3 jellybean) will trip knox.
You can use sammobile to get official firmwares, or if you're risky there are likely download mirrors scattered through the internet.
Once you're rooted on kitkat NE6, to get back to Lollipop and keep root you'll need Mobile Odin Pro to flash FOL1 with the latest Super SU Zip v2.46. (instructions first page of this thread: Here.)
Rooting seems to require some gonads and research first.
When using PC Odin I left options default (Auto Reboot and F. Reset Time).
When using Mobile Odin Pro (or maybe flashfire) make sure to uncheck EverRoot!
Flashfire is the newer free mobile odin pro I think. You might be able to use it in place of Mobile Odin Pro and instead of the supersu zip in addition to flashing FOL1 it comes with an option to inject SuperSU.
I recommend sticking with mobile odin pro for confirmed results. MOP does not support Lollipop.
Note that once you're rooted and upgrade to Lollipop your android system status will change from normal to custom. This prevents future OTA updates.
Root survives factory reset, but flashing official firmware with pc odin will make your phone genuine again as long as you didn't trip knox.
Downgrading to kitkat will very likely require a factory restore. Possibly also when upgrading back to Lollipop.
Note that the XPosed framework on lollipop and samsung touchwiz stock roms does not seem supported.
It seems some people have flashed a Deodexed rom and unofficial xposed to have it working. I made a single attempt and was unable to have it working.
I assume you could stay on kitkat and manage to get xposed working easy.
If you decide to use xposed, do not try to flash the framework without mobile odin pro, or flashfire.
Using a custom recovery, or flashing anything custom with PC Odin will trip knox.
Look over the information around to get a comfortable understanding and good luck!
Proceed only with the understanding that you could always on accident trip knox, or brick your phone.
I believe there is no known way to reset knox flag to 0 on the SM-N900T.
For future readers using a newer firmware than FOL1 it may no longer be possible to pc odin downgrade to kitkat without tripping knox.

So there is no way of downgrading without tripping knox

You can downgrade to kitkat NE6 using PC odin from t-mobile lollipop firmware OB6/OL1. (OL1 being the latest lollipop firmware, OB6 a version older). Once on kitkat NE6 firmware u can use towelroot to gain root and you will not trip knox. Unless you manage to check an option somewhere during this process that would cause you to trip knox. .
As stated, I achieved downgrading/rooting without tripping knox just a couple days ago from the current latest t-mobile galaxy note 3 (SM-N900T) firmware FOL1.
I then upgraded back from KitKat NE6 to Lollipop FOL1 using mobile odin pro.
You can probably downgrade to any 4.4 kitkat firmware, NOT 4.3 jellybean, just fine without tripping knox if you have a kitkat, or lollipop firmware up to FOL1.

I'll try it later, I also want to know if custom roms are possible

From what I've read you can install a custom rom as long as it has a stock kernel, otherwise you trip knox. You would need to flash with flashfire, or mobile odin pro though...
I've only used the stock firmware on my note 3 so don't completely know about using a custom rom.

I don't think a custom ROM can be flash via Odin. A custom ROM requires a custom recovery and a custom recovery will trip Knox on a stock KK or LP AFAIK.

Ohh ok. This is all sorta new to me as well. I had just assumed mobile odin pro could because FlashFire is its "successor".