I understand that:

  1. The secure boot process checks signature of bootloaders, kernel and rootfs, but not /system partition. The Samsung KNOX e-fuse is set to 1 when any signature is bad.
  2. Tools such as make_ext4fs can create custom system.img.ext4.
  3. Odin and Heimdall are able to flash system.img.ext4 into the device. AFAIK, system.img.ext4 is not signed, so there is no way for the device to verify its integrity.

If all are correct, we can change any file in /system partition. Rooting then becomes very easy. This my proposed way of rooting without voiding KNOX warrenty:

  1. Unpack the stock system.img.ext4
  2. Find any binary which is executed by init as root. Examples are /system/bin/installd and /system/bin/vold
  3. Patch the binary to plant a backdoor which can spawn us a root shell.
  4. Repack the system.img.ext4. Hopefully the file size doesn't change.
  5. Use Odin to flash the system partition only.
  6. Boot. Secure boot shouldn't detect anything unusual, as it only checks bootloader, kernel and rootfs. ADB shell and then use our backdoor to get our root shell.

However, people are trying very hard to find a way to root Samsung Galaxy S4, Note2 or Note3 without voiding KNOX warranty. For example, the saferoot method make use of a kernel vulnerability. After Samsung patched the vulnerability, there isn't yet any way to root safely. My approach must be wrong somewhere. Appreciate if you can point it out.

  • P.S. dm-verity can verify the system partition, but it is not used on any devices in the market. – Wu Yongzheng Apr 29 '14 at 7:08

It is possible to root these devices without tripping the knox flag

S4: [ROOT] Saferoot: Root for VRUEMJ7, MK2, and Android 4.3

Note3: Root de la Vega [KNOX 0x0 Root - Lots of Versions - No Exynos]

Note2: [root]Galaxy Note 2 on Android 4.3 without tripping Knox

  • As I said, the saferoot rooting method makes use of a kernel vulnerability, CVE-2013-6282 to be exact, which has been fixed. All three rooting instructions you listed are based on this method. Details and source code of saferoot can be found here: forum.xda-developers.com/showthread.php?t=2565758 – Wu Yongzheng Apr 30 '14 at 5:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.