I understand that:
- The secure boot process checks signature of bootloaders, kernel and rootfs, but not /system partition. The Samsung KNOX e-fuse is set to 1 when any signature is bad.
- Tools such as make_ext4fs can create custom system.img.ext4.
- Odin and Heimdall are able to flash system.img.ext4 into the device. AFAIK, system.img.ext4 is not signed, so there is no way for the device to verify its integrity.
If all are correct, we can change any file in /system partition. Rooting then becomes very easy. This my proposed way of rooting without voiding KNOX warrenty:
- Unpack the stock system.img.ext4
- Find any binary which is executed by init as root. Examples are /system/bin/installd and /system/bin/vold
- Patch the binary to plant a backdoor which can spawn us a root shell.
- Repack the system.img.ext4. Hopefully the file size doesn't change.
- Use Odin to flash the system partition only.
- Boot. Secure boot shouldn't detect anything unusual, as it only checks bootloader, kernel and rootfs. ADB shell and then use our backdoor to get our root shell.
However, people are trying very hard to find a way to root Samsung Galaxy S4, Note2 or Note3 without voiding KNOX warranty. For example, the saferoot method make use of a kernel vulnerability. After Samsung patched the vulnerability, there isn't yet any way to root safely. My approach must be wrong somewhere. Appreciate if you can point it out.
