Develop Bugs

[FAQ] KNOX and you

[SIZE=+1]There seems to be a lot of confusion and misunderstanding circling the forums with regards to Knox and the 4.3 OTA.
This is an attempt to clear things up[/SIZE]
UPDATE: It seems that people can find this thread, but are unable to actually READ the information presented. The most important note here is that if you are on 4.3 firmware, you can flash ANY rom you like. No, you are not tied down or locked into stock only or 4.3 roms only. AOSP roms will work fine as well. Now scroll down and READ EVERYTHING IN THIS FIRST POST.
What is Knox? Knox is both a firmware and a software component. The OS has Knox apps, and the MK3 bootloader has a Knox component too. Having Knox apps does not necessarily mean you have the Knox bootloader, or vice-versa.
How does Knox work? Because Knox is both in the OS (apps) and in the firmware (bootloader) it works in two ways. The OS components prevent attempts to obtain root access and make rooting with these Knox apps a pain in the butt. Fortunately they can be removed. In the firmware component (bootloader), Knox works to prevent the flashing of custom kernels and recoveries. If you flash a custom rom or custom recovery WHILE on the Knox bootloader, your Knox flag will be tripped and your Warranty Bit will go from 0x0 to 0x1. The Knox bootloader cannot be downgraded to, say, the MD4 bootloader because of special protections built into it. If you attempt to downgrade it, your phone will instantly brick.
Can I get root on the Knox-enabled update? Yes. For those of us who DID NOT take the official OTA and DO NOT have the Knox bootloader, we can get root on 4.3 by injecting it and removing the Knox apps. For those WITH the Knox bootloader, you will need to wait until a full stock MK3 tar is available, which we can then use to make an Odin-flashable MK3 stock rom with root injected using the de-la-vega root method.
Can I downgrade while on 4.3? You can flash roms no matter what Android version they are. That is perfectly fine. But you cannot downgrade the bootloader if you have the Knox bootloader, or else it will cause your bootloader to become corrupted and give you a fancy paperweight. Again, for those who DO NOT have the Knox bootloader, you needn't worry about this/downgrading firmware since the Knox bootloader is what prevents you from doing this. Downgrading your bootloader includes: attempting to flash full stock tar of software versions < MK3, etc.
How can I tell if I've got the Knox bootloader?
Boot into download mode (through custom reboot menu, or by powering off then holding Power+Home+VolumeDown and then VolUp when prompted). If you see a line that starts with the following, then you've got the Knox bootloader. I will insert a picture showing how it actually looks soon
Warranty Bit:
Click to expand...
Click to collapse
[SIZE=+1]READ THIS TOO: http://forum.xda-developers.com/showthread.php?t=1788313
It's for the Verizon S3, but it applies to all the carrier 4.3 updates[/SIZE]
I will add to this as more questions come up
I hope the above helps to clear up some confusion. Ask questions if you are still concerned and I will do my best to answer them.

is there any way to make this a sticky @kennyglass123

This is great information man!
http://i.imgur.com/qrByUGN.jpg

[Q] For now, once you have Knox you'll always have knox? What's the possibility of removing Knox?

elephant007 said:
[Q] For now, once you have Knox you'll always have knox? What's the possibility of removing Knox?
Click to expand...
Click to collapse
as of right now none.

elephant007 said:
[Q] For now, once you have Knox you'll always have knox? What's the possibility of removing Knox?
Click to expand...
Click to collapse
No way to remove bootloader Knox ATM.

I've seen several posts mention "tripping KNOX" or "voiding KNOX." What does that mean, exactly, regarding rooting a phone? Does it just mean it voids the warranty if you need to get support from Samsung/Sprint? Or are there other adverse effects?

Mostly just a visible warranty void.

Samsung bought crapple disease. So sad, but its my excuse to buy a nexus.
Sent from my SPH-L710 using xda app-developers app

As said above, a voided Knox is mostly just a highly visible warranty void. Your local Sprint store may or may not care, or the specific Samsung rep that you deal with may not care, but it's easier just to not have to deal with it to begin with.

Does this mean there is already a touchwiz 4.3 ROM we can flash or do we still have to wait?
Sent from my SPH-L710 using Tapatalk

The biggest thing here is the fact that there is no full tar file to restore. So even if you do not care about knox or warranty. If something goes wrong with a flash or anything else you can't use an older tar file let's say MD4 or LJ7 or anything because you will end up with a brick. There is nothing to use to ODIN restore your device. Once you go 4.3 with Knox you have to stay 4.3 and even if you wanted to stay 4.3 and wanted to restore that there is no tar file at this time.
Have a great day!

I have a question I think we talked a bit about the problems the knox bootloader brings into the system. My question is the opposite what does it fix / change?
Im thinking along the lines of somebody modding the update so an old bootloader would be with the new rom would that be an issue? I think i remember hearing something about wifi being the problem but any clarification would be nice.

docnas said:
I have a question I think we talked a bit about the problems the knox bootloader brings into the system. My question is the opposite what does it fix / change?
Im thinking along the lines of somebody modding the update so an old bootloader would be with the new rom would that be an issue? I think i remember hearing something about wifi being the problem but any clarification would be nice.
Click to expand...
Click to collapse
Late to the party. CNexus already has a update cooking.
Sent from my SPH-L710 using Tapatalk

the question im trying to ask is what do we lose if we use the old bootloader? any functionality? (besides the knox security bull$hit)

docnas said:
the question im trying to ask is what do we lose if we use the old bootloader? any functionality? (besides the knox security bull$hit)
Click to expand...
Click to collapse
Right now, wifi is broken with the old bootloader and 4.3 rom...happened on the other devices too (tmo s3 and sprint s4)
But there is a fix: flash at&t kernel. But it messes up screen rotation. So i'm trying to come up with another fix that will let wifi turn on properly and let screen rotation work properly too

You = rock. Or some other awesome thing.
Sent from my SPH-L710 using xda app-developers app

CNexus said:
Right now, wifi is broken with the old bootloader and 4.3 rom...happened on the other devices too (tmo s3 and sprint s4)
But there is a fix: flash at&t kernel. But it messes up screen rotation. So i'm trying to come up with another fix that will let wifi turn on properly and let screen rotation work properly too
Click to expand...
Click to collapse
So is this Knox a Sprint thing, or a Samsung thing?
I can understand the reasoning for Knox(money) but, dang, I guess it's a dog eat dog world out there.
This doesn't affect CyanogenMod does it? I'm scared...
edit... I remember reading about a brick api or command, I never executed it, sounds nasty, is this what they use to brick peoples phones if they try to "hack" it?

Edge-Case said:
So is this Knox a Sprint thing, or a Samsung thing?
I can understand the reasoning for Knox(money) but, dang, I guess it's a dog eat dog world out there.
This doesn't affect CyanogenMod does it? I'm scared...
edit... I remember reading about a brick api or command, I never executed it, sounds nasty, is this what they use to brick peoples phones if they try to "hack" it?
Click to expand...
Click to collapse
This would be a we-can't-update-the-bootloader thing lol. And we can't do that because it has Knox, which is Samsung's doing
This shouldn't affect any AOSP roms because it uses a different kernel and builds its own WiFi libs

docnas said:
the question im trying to ask is what do we lose if we use the old bootloader? any functionality? (besides the knox security bull$hit)
Click to expand...
Click to collapse
From what I've read Knox is Samsung's attempt to provide strong security to their phones for the enterprise customers. As you can imagine, allowing system level access to files can be used to get around a lot of security measures that IT people would like to enforce in their client's devices. It makes sense at the enterprise level, but it's a pain for anyone who want's to mod their phone.
So I think the answer to your question is, unless you are using your phone in a locked down corporate environment then there really is no advantage to Knox. Too bad it can't be turned off, at least not officially.

What is the easiest way to root this device?

I don't wont to trip any counters...

kingo would be the easiest way. install the program on your computer, connect your device, click a couple times, let it do its thing and you'll have instant root. nothing else changes and nothing is lost. there was some bad feedback about the app but its been cleared up since then.
many people have used it.
www.kingoapp.com

rlee008 said:
kingo would be the easiest way. install the program on your computer, connect your device, click a couple times, let it do its thing and you'll have instant root. nothing else changes and nothing is lost. there was some bad feedback about the app but its been cleared up since then.
many people have used it.
www.kingoapp.com
Click to expand...
Click to collapse
Seconded. It probably won't even trigger your Knox flag (I have rooted several times with Kingo and my Knox flag is still 0x0)

thompsos said:
Seconded. It probably won't even trigger your Knox flag (I have rooted several times with Kingo and my Knox flag is still 0x0)
Click to expand...
Click to collapse
Why would we not want to trigger that, does that make Knox useless? Reason I ask is because I do use this phone for work with an exchange account and have been curious about this. If I use Knox to just try it out will that screw anything up?

ilogik said:
Why would we not want to trigger that, does that make Knox useless? Reason I ask is because I do use this phone for work with an exchange account and have been curious about this. If I use Knox to just try it out will that screw anything up?
Click to expand...
Click to collapse
I tripped knox and never looked back I guess I'll figure out what I can do when my jump comes up
Official CM11 & Lean Kernel Powered hltetmo

ilogik said:
Why would we not want to trigger that, does that make Knox useless? Reason I ask is because I do use this phone for work with an exchange account and have been curious about this. If I use Knox to just try it out will that screw anything up?
Click to expand...
Click to collapse
Tripping KNOX may make the phone incompatible with certain enterprise scenarios. Using kingo wont trip the counter so it shouldnt matter in your case.

ilogik said:
Why would we not want to trigger that, does that make Knox useless? Reason I ask is because I do use this phone for work with an exchange account and have been curious about this. If I use Knox to just try it out will that screw anything up?
Click to expand...
Click to collapse
Check out this thread which is linked in the FAQ sticky here.

There is one person claiming Kingo tripped his Knox flag despite MI7, so unless we figure exactly why, I would be careful and maybe wait a little.

pete4k said:
There is one person claiming Kingo tripped his Knox flag despite MI7, so unless we figure exactly why, I would be careful and maybe wait a little.
Click to expand...
Click to collapse
I don't know about that other person, but I had the same issue, I'm still on MI7, I used Kingo to rood my Note 3, everything was fine until it asked me to install an app called MtkCamera, which I declined, then Kingo kind of frozed and then it restarted. When I checked the Knox counter it was tripped ...so, I would suggest caution with this.

Well, first of all I would ask why do you want to root to begin with and secondly is that reason more important than using it for work. At least In theory Knox was developed for people like you, who have one phone for work and personal use, by providing secure environment for sensitive data. Even if your job doesn't use Knox yet, they may in the future. If I was doing banking or CC transactions on my phone I would seriously consider Knox as well, albeit I have no idea if it would actually serve it's purpose well. If you just test Knox you would need to download some extra software from Samsung, Samsung is aware of security holes and already patched them in the latest bootloaders, so Knox flag will trip when rooting for sure, so I wouldn't be surprised if those security updates wouldn't be the first downloaded as part of Knox suite, when installing it. So here I would speculate, since I have not tried it myself, that you should either root and take your chances, or use Knox and forget about rooting. I wonder if PTJunkie didn't play with Knox, or somehow manage to get Samsung security update, to get his flag tripped, where others didn't. I actually disabled updates to make sure I don't get any new enhancements from T-mo or Samsung.

If you have used Odin before,
root de la vega is easy.
http://www.android.gs/root-t-mobile...-root-de-la-vega-tool-knox-flags-not-tripped/
I root because i have a lot of apps that required root like titanium explorer and root explorer .
Moreso, I need to freeze all the bloatware like google now and s voice.

Dattack said:
If you have used Odin before,
root de la vega is easy.
http://www.android.gs/root-t-mobile...-root-de-la-vega-tool-knox-flags-not-tripped/
I root because i have a lot of apps that required root like titanium explorer and root explorer .
Moreso, I need to freeze all the bloatware like google now and s voice.
Click to expand...
Click to collapse
I have 2 quick questions:
1. root delavega uses att rom, att phones don't have wifi calling, is wifi calling still working as usual on rooted, t-mo phones? or in general Is there anything T-mo specific that breaks after root?
2. I assume bringing the phone back to original would require reflashing original T-mo ROMS? Anything else needs to be flashed?

I haven't flashed back to tmobile stock yet. I still have wifi calling and I make sure to disable my tmobile account because they can tell if you are rooted.

Yeah, when you run that system check, but what can they do? Even if they cared, I'm not sure if they do, if your phone is stock with no flags tripped, I would argue and play stupid if needed return, or repair. Also I wonder if this check could be somehow disabled all by itself, for example by taking away some permissions.

Knox?

I've been "out of the loop" for quite some time and much has happened to Samsung devices since my last one (Samsung i9000). Basically it is the terror stories about this Knox security thing that mostly concern me and brought me here...
I mean I like this tablet, I trully do, but if I'm robbed by android's main advantage (modifying the thing to suit your needs) then I have absolutely no reason to choose this.
I have already read a a couple of stuff but they are all concerned about s4 and note 3. What about this tablet (the WiFi version), is it ... secured too? Also I'm a bit unclear of what this Knox thing achieves, at first it voids your warranty, second does not let you to flash certain ROMs, but I'm unclear from/on which ROMs this is enabled or even if merely rooting your device would enable this. I mean someone may not be interested in aosp ROMs but still love some "optimized stock + custom kernel" will this Knox thing prevent him even from that?
If this is proved an unmodifiable device I'd think twice for it's usefulness, android's only edge is its "modifiability" remove it and you buy sth 2nd or 3rd tier...

Stevethegreat said:
I've been "out of the loop" for quite some time and much has happened to Samsung devices since my last one (Samsung i9000). Basically it is the terror stories about this Knox security thing that mostly concern me and brought me here...
I mean I like this tablet, I trully do, but if I'm robbed by android's main advantage (modifying the thing to suit your needs) then I have absolutely no reason to choose this.
I have already read a a couple of stuff but they are all concerned about s4 and note 3. What about this tablet (the WiFi version), is it ... secured too? Also I'm a bit unclear of what this Knox thing achieves, at first it voids your warranty, second does not let you to flash certain ROMs, but I'm unclear from/on which ROMs this is enabled or even if merely rooting your device would enable this. I mean someone may not be interested in aosp ROMs but still love some "optimized stock + custom kernel" will this Knox thing prevent him even from that?
If this is proved an unmodifiable device I'd think twice for it's usefulness, android's only edge is its "modifiability" remove it and you buy sth 2nd or 3rd tier...
Click to expand...
Click to collapse
You can still root and modify things, however, Samsung has taken the stance that since Knox has been tripped you must've been running Custom firmware/apps that can "potentially" damage the hardware so all warranties (at least from Samsung) are void....
The other issue is Samsung are updating bootloaders when you install firmware updates. If you happen to get a new bootloader then you CAN'T go back to a lower version of firmware, period... Doing so generally results in bootloops or stuck on Samsung logo until you update to the newer firmware again...
The downside to this is the nandroid backup you took just before updating in case of a problem is rendered useless, and in the case of the Note 3, Kies no longer recognises the new bootloaders so emergency firmware restore doesn't work...
Knox also tries to deny any app root access, some messenger programs were denied access as their permissions required root access. SuperSu has been updated now to work with no problems, until Samsung decide to interfere again....
Knox is also a secure container for your data, it was meant for security agencies and such to have a secure passworded partition in the software that doesn't allow anyone but the person with the passcode to access it. This is disabled after rooting as the system has been modified and can no longer be deemed secure....

ultramag69 said:
You can still root and modify things, however, Samsung has taken the stance that since Knox has been tripped you must've been running Custom firmware/apps that can "potentially" damage the hardware so all warranties (at least from Samsung) are void....
The other issue is Samsung are updating bootloaders when you install firmware updates. If you happen to get a new bootloader then you CAN'T go back to a lower version of firmware, period... Doing so generally results in bootloops or stuck on Samsung logo until you update to the newer firmware again...
The downside to this is the nandroid backup you took just before updating in case of a problem is rendered useless, and in the case of the Note 3, Kies no longer recognises the new bootloaders so emergency firmware restore doesn't work...
Knox also tries to deny any app root access, some messenger programs were denied access as their permissions required root access. SuperSu has been updated now to work with no problems, until Samsung decide to interfere again....
Knox is also a secure container for your data, it was meant for security agencies and such to have a secure passworded partition in the software that doesn't allow anyone but the person with the passcode to access it. This is disabled after rooting as the system has been modified and can no longer be deemed secure....
Click to expand...
Click to collapse
So Knox is more about controlling your device than security as it is not optional (you cannot turn it off , right). Also about losing the warranty, well I was hoping to buy it from a reputable store in my country, even if Samsung voids my warranty can't the store itself honor it?
If not, if in fact merely rooting your device voids my warranty whatsoever than I'm most certain that this is not a device for me and I'm not sure for whom it is, I don't think android is a good os when decoupled from rooted apps (no xposed framework, no adblock, no virtual buttons, no gestures, no greenify), the experience is basically killed...
Even jail breaking your iPad doesn't kill the warranty as long as you install non jail broken iOS version on top... Bad Samsung, bad

OK, since I actually want to give this tablet a go I came up with a new idea. What if I trip up the Knox counter but then get back to stock firmware and *then* my tablet gets damaged? Would then my warranty be honored? The Knox counter can only tell you that it was tripped *once* but not what is/was happening at the time you got a defect.
Maybe my battery died, or more than a handful pixels died on me, all having nothing to do with me rooting my device at some point. Can my rooting still be grounds for samsung to dismiss my warranty? Because if so that is quite a scheme that Samsung runs.
Do any people had their warranty honored even though the Knox counter was tripped?

If you have a squaretrade warranty you should be fine with that excuse. However, Samsung will say that they cannot tell if the damaged occurred before or after the rooting occurred, thus denying you your warranty. Once the counter is tripped, from that point on the warranty is gone. My recommendation, get a squaretrade for 100 with a 2 year warranty and you will be fine.
Sent from my SM-P600 using Tapatalk

Even though Knox trip flag = 0x1 if I restore a non-rooted stock rom...

... will Knox features work again? Such as secure folders?
I honestly don't care much about these features. I much prefer having access to Ad-Away. But if I do use Odin to flash a stock ROM (Without re-rooting) on the phone, even though my Knox flag is still tripped will Knox features work again?
Thanks

azzicles said:
... will Knox features work again? Such as secure folders?
I honestly don't care much about these features. I much prefer having access to Ad-Away. But if I do use Odin to flash a stock ROM (Without re-rooting) on the phone, even though my Knox flag is still tripped will Knox features work again?
Thanks
Click to expand...
Click to collapse
Once Knox is tripped it will always be tripped, you can no longer access the Knox features and I also believe that the Android/Samsung Pay system will no longer work

trickie69r said:
Once Knox is tripped it will always be tripped, you can no longer access the Knox features and I also believe that the Android/Samsung Pay system will no longer work
Click to expand...
Click to collapse
I am ignorant when it comes to rooting etc... so, just reiterating. If I root my phone, it will trip the knox? And Ill never be able to go back to full stock... Is that where you're saying? :/

androidcentralsucks said:
I am ignorant when it comes to rooting etc... so, just reiterating. If I root my phone, it will trip the knox? And Ill never be able to go back to full stock... Is that where you're saying? :/
Click to expand...
Click to collapse
You can go back to full stock but rooting will trip Knox and this cannot be undone which will prevent Knox related features from working (i.e Samsung Pay etc..).
You also run the risk of not getting Warranty support if Knox is tripped.
Hope that helps.

trickie69r said:
You can go back to full stock but rooting will trip Knox and this cannot be undone which will prevent Knox related features from working (i.e Samsung Pay etc..).
You also run the risk of not getting Warranty support if Knox is tripped.
Hope that helps.
Click to expand...
Click to collapse
It does!! I had no idea there was no way to go back 100%... =/ That SUCKS!

well, it is for security reasons, only a really small number of people root their phones, small compared to the total number of devices out there.....

winol said:
well, it is for security reasons, only a really small number of people root their phones, small compared to the total number of devices out there.....
Click to expand...
Click to collapse
Right.. I am seeing that... I do a lot of penetration testing etc, and some of the software I want to use requires root. I have this stuff on my laptop and other devices, but would like to have the option to utilize it on my phone as well.
Just stinks you can't reset it back..

Knoxreset.com legit ?

Hi,
after a long time using iPhone i switched to Android (Note 10+ Exy.
I considered to root it but dont want to loose all Samsung Apps etc. I found a Website called knoxreset.com which tells you that it can put the knox back to 0x0 and "restore" all Samsung Apps.
I tried to find some reviews about this Website but found nothing. I know that Knox now a days has something to do with the Hardware and as im a newbie, i wanted to ask you guys if this is legit or a scam ?
They sell it rn for 45 Dollars.
Thanks for any help!

Scam

raul6 said:
Scam
Click to expand...
Click to collapse
Okay, i'll stay away from it

Shxckz said:
Hi,
after a long time using iPhone i switched to Android (Note 10+ Exy.
I considered to root it but dont want to loose all Samsung Apps etc. I found a Website called knoxreset.com which tells you that it can put the knox back to 0x0 and "restore" all Samsung Apps.
I tried to find some reviews about this Website but found nothing. I know that Knox now a days has something to do with the Hardware and as im a newbie, i wanted to ask you guys if this is legit or a scam ?
They sell it rn for 45 Dollars.
Thanks for any help!
Click to expand...
Click to collapse
I would go with a scam... Tripping knox literally blows an efuse. Once it blown that's it... It is blown for good on that motherboard.
The site is misleading in what it does. The app involves rooting (or uses existing root on) the phone, installs (possibly uses if exists) a custom recovery and merely makes the trip counter looks like it wasn't tripped (it does not actually change the knox trip counter). It's a purely superficial mask and nothing more.. also if I recall correctly this is something you can do yourself.
Also the site says it doesn't effect knox, so any apps which depend on knox itself won't work.
https://support.samsungknox.com/hc/...-a-Knox-Warranty-Bit-and-how-is-it-triggered-

It's easy to fake reset Knox if you are rooted which is exactly what they are doing. It will fool some apps that won't work if knox has been tripped but it won't fool Samsung and as soon as you flash back stock then it will show Knox tripped. If you want root but won't to fake knox then there are guides out there
Sent from my SM-N976B using Tapatalk

andy242 said:
It's easy to fake reset Knox if you are rooted which is exactly what they are doing. It will fool some apps that won't work if knox has been tripped but it won't fool Samsung and as soon as you flash back stock then it will show Knox tripped. If you want root but won't to fake knox then there are guides out there
Sent from my SM-N976B using Tapatalk
Click to expand...
Click to collapse
So it is possible to root, fake knox and use for example Samsung Pass or other apps that doesnt work with a tripped knox ? Thank you for your answer!
EDIT: I cant find any updated tutorial how to fake it properly, do you have any link for me ?

Shxckz said:
So it is possible to root, fake knox and use for example Samsung Pass or other apps that doesnt work with a tripped knox ? Thank you for your answer!
EDIT: I cant find any updated tutorial how to fake it properly, do you have any link for me ?
Click to expand...
Click to collapse
No, banking apps, samsung pay, and other apps will not work, only some apps can be fooled by hiding root, just consider this before rooting, as for tripping knox, there are some cosmetic implementations that make knox look 0x0, but just for show, this can not in anyway be reversed, apps specifically looking for the e-fuse status, will never be fooled

The ONLY sure fire way known to reset KNOX is Motherboard replacement...
This will be expensive and will also change your IMEI and Serial number...

yeah it definitely looks like a scam website @scottusa2008 is definitely on the mark. once that efuse is blown, its blown.

Okay guys thank you very much for the help, ill do some more research and will probably go with the Dr. Ketan Rom
I'll close this Thread now

Ex developer of KNOX Reset (Disabler) application
Hi,
The application listed at KNOXReset.com cannot indeed reset the actual KNOX counter. It is also mentioned on the store page before purchasing the application now.
It has been designed to spoof the string in Odin mode and display 0x0(0) regardless of actual value. It works only on certain devices.
Also, it now includes modified S applications which work even on rooted devices.
Venus342

lolol... all it does is set a property to appear as not tripped.. smh.. ppl do anything for a quick buck these days

venus342a said:
Ex developer of KNOX Reset (Disabler) application
Hi,
The application listed at KNOXReset.com cannot indeed reset the actual KNOX counter. It is also mentioned on the store page before purchasing the application now.
It has been designed to spoof the string in Odin mode and display 0x0(0) regardless of actual value. It works only on certain devices.
Also, it now includes modified S applications which work even on rooted devices.
Venus342
Click to expand...
Click to collapse
Where's the application brother