Anyone have an idea how to get rid of Knox on a Samsung Galaxy S3 on Android 4.3?

[Stijn De Jong]

I have an odd situation, so, I need help with debugging tools.
This is a hard one, because Knox is designed, apparently, not to be
removed.

Anyone have an idea how to get rid of Knox on a Samsung Galaxy S3 on
Android 4.3?

1. It's a Samsung Galaxy S3, Android 4.3, rooted.
2. Knox is blocking some things (but not others).
3. Googling, it turns out to be a common problem with Knox.
4. Googling more, it seems you can uninstall Knox
https://www.androidpit.com/how-to-uninstall-knox

All that seems well and good, but, it doesn't seem that Knox is actually
running, and yet it seems that Knox is running. I'm getting conflicting
info, so, I just want to ask what tool is the best for telling you what is
actually running?

Here's what I know:
A. Root Checker Basic tells me I'm rooted (which I did via Kingoroot).
B. If I try to update the "Super SU" binary, Knox blocks the attempt.
C. SuperSU will try to disable Knox, but it will fail.

Knox pops up a notice:
Security information:
An application attempted to access system on your device without
authorization. This attempt has been blocked.

So clearly, Knox is running.
But Knox is so stupid that it doesn't tell you *what* application has been
blocked, nor what that application was trying to do. It just gives the same
useless error message every time no matter what it blocks.

So I just want to get rid of Knox.
Simple right?

Well, maybe, but I don't get what is going on yet.

Here's what is confusing:
A. I go to the Nova "Apps" drawer & find the only "Knox" in the app drawer.
B. Pressing that Knox icon brings up a request to download & install Knox
C. But that makes no sense, since Knox is already installed (by default).

If I try to snap a snapshot of the Knox installation screen, I get:
Unable to capture screen. DRM protected image.

If I bring up App Ops Starter, it says only that Knox Version 3.0 is there.
https://play.google.com/store/apps/details?id=com.schurich.android.tools.appopsstarter

If I bring up Majeur Applications-info, it shows 4 different "knox" things,
namely KLMS Agent, Knox, Knox, Knox Store, are installed.
https://play.google.com/store/apps/details?id=com.majeur.applicationsinfo&hl=en

KLMS Agent com.samsung.klmsagent 1.5 (1) /system/app/KLMSAgent.apk
KNOX com.sec.knox.app.container 1.0 (1) /system/app/KNOXStub.apk
KNOX com.sec.knox.containeragent 3.0 (30 /system/app/ContainerAgent.apk
KNOX Store com.sec.knox.store 1.0 (1) /system/app/KNOXStore.apk

If I bring up Checkey, it shows the four "knox" things:
KLMS Agent com.samsung.klmsagent
KNOX com.sec.knox.app.container
KNOX com.sec.knox.containeragent
KNOX Store com.sec.knox.store
https://play.google.com/store/apps/details?id=info.guardianproject.checkey

In summary, here's the problem:
A. I just want to *run* Knox, so I can hit the setting to disable it.
B. But, there is only one Knox icon in the app drawer
C. When I press that one Knox icon, it says Knox needs to be installed.
Huh?

Going to the Android Application Manager, I see the four "knox" things,
where hitting the "Force Stop" button seems to force it to stop.

Yet, when I try to update Super SU, Knox blocks the process again!

Anyone have an idea how to get rid of Knox?

[Stijn De Jong]

On Mon, 13 Mar 2017 05:41:46 +0100, Stijn De Jong wrote:

> Yet, when I try to update Super SU, Knox blocks the process again!
> Anyone have an idea how to get rid of Knox?

After rooting a week or so ago using Kingoroot:
https://www.kingoapp.com/root-tutorials/how-to-remove-bloatware-on-android.htm

I installed "System App Remover (ROOT)" freeware from Google Play:
https://play.google.com/store/apps/details?id=com.jumobile.manager.systemapp

First I practiced on removing easy things like "Amazon", "S Voice", "Yahoo!
Finance", "Galaxy Apps", "Luminous dots", "More Services", "RoseEUKor"
(fonts?), "S Suggest", "Samsung Books", "Samsung Games", "Samsung Link",
"Samsung Music", "Stock Daemon(EUR)", "Facebook SNS", "Windy Weather",
"Yahoo!News", "ChatON", "ChocoEUKor" (more fonts?), "Dropbox", another
"Dropbox", "Flipboard", "Weather Daemon(EUR)", "Weather Widget", "Weather
Widget Main", "T-Mobile TV", "Samsung Sans", "Samsung Print Service",
"Samsung Push Service", "Samsung SMemo SyncAdapter", "Samsung
Syncadapters", "News Daemon(EUR)", etc.

Then I run a search within System App Remover for "knox", which finds:
com.sec.enterprise.knox.attestation
com.sec.knox.eventsmanager
KNOX
KNOX
Knox Notification Manager
KNOX Store

I'll google a bit before I install any of those, but if you have experience
removing Knox, let me know how you did it.

[Stijn De Jong]

On Mon, 13 Mar 2017 06:19:26 +0100, Stijn De Jong wrote:

> Then I run a search within System App Remover for "knox", which finds:
> com.sec.enterprise.knox.attestation
> com.sec.knox.eventsmanager
> KNOX
> KNOX
> Knox Notification Manager
> KNOX Store
>
> I'll google a bit before I install any of those, but if you have experience
> removing Knox, let me know how you did it.

Googling, it seems that a lot of people have the problem with Knox:
http://forums.androidcentral.com/samsung-safe-knox/366118-solution-how-permanently-remove-knox.html

They recommended "NoBloat free" so I installed that from Google Play:
https://play.google.com/store/apps/details?id=com.tvkdevelopment.nobloatfree

In addition, they referenced this site for 3 ways to remove Knox:
http://androidcentral.us/2014/01/how-to-disable-uninstall-knox-on-your-samsung-galaxy-devices/

What that reference shows three ways to remove Knox, the first method is to
just uninstall it, but I already explained that this doesn't work.

The second method uses Titanium Backup to uninstall Knox:
https://play.google.com/store/apps/details?id=com.keramidas.TitaniumBackup

Where the instructions are:
1. Launch Titanium Backup and Freeze the following:
a. com.sec.enterprise.knox.attestation
b. com.sec.knox.eventsmanager
c. KLMS Agent
d. KNOX
e. Knox Notification Manager
f. KNOX Store
2. Select all the files and Remove them.
3. Reboot your Phone.

So I launched Titanium Backup, pressed the Backup/Restore button, pressed
the "click to edit filters" button, and typed "knox", where it found:
a. com.sec.enterprise.knox.attestation 1.0 (No backup yet)
b. com.sec.knox.eventmanager 1.0 (No backup yet)
c. KNOX 1.0 (No backup yet)
d. KNOX 3.0 (No backup yet)
e. Knox.Notification Manager 1.0 (No backup yet)
f. KNOX Store 1.0 (No backup yet)

So I pressed on each and then pressed on the backup button where it said:
"Process KNOX is currently running.
Do you want to terminate it and proceed ?"

I said OK to that message, which backed up each of the knox lines above,
turning the icon into an orange happy guy face.

I pressed on the first line, and then hit the "Freeze!" button, but the
phone vibrated popping up a message saying:
"Sorry, apps can be frozen/defrosted in the Donate version only."

The third method uses Android terminal emulator to uninstall Knox:
https://play.google.com/store/apps/details?id=jackpal.androidterm

Where the instructions are:
1. Launch Android Terminal Emulator & grant it SuperSU access if asked
2. Type "su pm disable com.sec.knox.seandroid"
http://www.teamandroid.com/2014/02/25/disable-knox-rooted-samsung-android-devices/

When I launched Android Terminal Emulator, the text was super tiny, but I
typed in the requested command, and it asked for Kingoroot permission,
which I granted, but then it said:
"tmp-mksh: com.sec.knox.seandroid: not found

[Stijn De Jong]

On Mon, 13 Mar 2017 06:54:31 +0100, Stijn De Jong wrote:

> Googling, it seems that a lot of people have the problem with Knox:
> http://forums.androidcentral.com/samsung-safe-knox/366118-solution-how-permanently-remove-knox.html
>
> They recommended "NoBloat free" so I installed that from Google Play:
> https://play.google.com/store/apps/details?id=com.tvkdevelopment.nobloatfree

While this blog suggested 4 methods for removing Knox (including flashing a
knox-removal zip file), I'm gonna try one of the standard removal tools.
https://www.progeeksblog.com/how-to-disable-samsung-knox/

Going back to the "nobloat free" suggestion, I started the app:
https://play.google.com/store/apps/details?id=com.tvkdevelopment.nobloatfree

I selected:
a. KLMS Agent com.samsung.klmsagent 228.5KB
b. KNOX com.sec.knox.app.container 38.0KB
c. KNOX com.sec.knox.containeragent 1.8MB
d. Knox Notification Manager com.sec.knox.seandroid 43.0KB
e. KNOX Store com.sec.knox.store 12.7KB

Each time I selected a line, up popped the dialog:
Disable
backup
Backup and delete
Delete without backup

I pressed "Delete without backup" for each, and then "Okay".
Woo hoo!

The first indication it worked was that the desktop icon for Knox
disappeared, but that's not a great test (although it was the first thing
that removed it).

The second indication was that the Knox icon was also missing from the Nova
launcher "app drawer" app.

I brought up App Ops Starter and went to the "Device" tab.
https://play.google.com/store/apps/details?id=com.schurich.android.tools.appopsstarter

I can't figure out how to get the order to be alphabetical but I scrolled
all the way down through more than three hundred and fifty apps, and didn't
see Knox there.

Bringing up Applications-info, it alphabetically listed over 350 apps,
where it was easier to see that Knox was no longer there!
https://play.google.com/store/apps/details?id=com.majeur.applicationsinfo&hl=en

Then I brought up Checkey. which also has a good alphabetical listing, and
no Knox was there either.
https://play.google.com/store/apps/details?id=info.guardianproject.checkey

Now it's time to reboot!

[Stijn De Jong]

On Mon, 13 Mar 2017 07:16:44 +0100, Stijn De Jong wrote:

> Now it's time to reboot!

Good news and bad news after the reboot.

The great news is that the reboot seems to be much faster!
I don't know if it's just my butt dyno telling me that, but what I should
have done was time the reboot before and after. Too late.

If anyone follows my steps in the future, I recommend that they time the
reboot or boot with Knox, and without Knox.

Anyway, the reboot worked, but when I ran "System App Remover (ROOT)":
https://play.google.com/store/apps/details?id=com.jumobile.manager.systemapp

And then searched for "knox", it found two entries:
com.sec.enterprise.knox.attestation 3.63KB [Key module]
com.sec.knox.eventsmanager [Key module]

I went back to Titanium Backup, which showed them also, with a blue phone
icon next to the orange happy face backup icon, so, the "phone" icon must
mean it's on the phone still.

So I went back to Nobloat Free and realized there isn't a "search"
function, so the reason I missed it was I was looking for items that
started with "Knox" whereas these two items start with "com".

What that tells me is that "System App Remover (ROOT)" is probably better
than "Nobloat Free" (all other things at the moment assumed to be equal).

Anyway, just to be safe, in Nobloat Free, I selected "system apps" and then
went to the "com" section to select and delete without backup those two
lines.
com.sec.enterprise.knox.attestation 3.63KB [Delete without backup]
com.sec.knox.eventsmanager [Delete without backup]

And rebooted.

[Stijn De Jong]

On Mon, 13 Mar 2017 07:26:45 +0100, Stijn De Jong wrote:

> What that tells me is that "System App Remover (ROOT)" is probably better
> than "Nobloat Free" (all other things at the moment assumed to be equal).
>
> Anyway, just to be safe, in Nobloat Free, I selected "system apps" and then
> went to the "com" section to select and delete without backup those two
> lines.
> com.sec.enterprise.knox.attestation 3.63KB [Delete without backup]
> com.sec.knox.eventsmanager [Delete without backup]
>
> And rebooted.

The reboot worked, and seemed faster than before (I wish I had timed it
prior to removing Knox).

The proof being in the taste of the pudding, I tapped "Super SU":
https://play.google.com/store/apps/details?id=eu.chainfire.supersu

Up popped the message:
"The SU binary needs to be updated. Continue?"

Up pops the message about whether or not you have a custom recover (which I
don't), so I hit "Normal".

Then it said SuperSU "Installing, please wait..." (which is where it used
to time out saying Knox was preventing the installation).

Drat!

It gave a different message of "Installation failed !"
"Please reboot and try again."

Even though I pressed the SuperSU "reboot" button on that dialog, nothing
happened, so I restarted the phone normally.

Only with computers do you do the same thing multiple times and expect
different answers to results, but, I tried it again.

Drat! It still failed (but took much longer to fail).

Googling, I see this is a separate (we hope) issue with Super SU:
http://www.androidayos.com/fix-supersu-binary-update-failed-android-device/
https://forum.xda-developers.com/showthread.php?t=1900217
http://android.stackexchange.com/questions/111255/the-su-binary-must-be-updated
etc.

Apparently there is even an app for this:
https://play.google.com/store/apps/details?id=com.noshufou.android.su.fixer

Whose description says:
"This app is designed to fix update problems that come from mismatched
signatures between Superuser.apk on your phone, and Superuser.apk on the
Market. If successful, this app will let you update from the market even if
you've had trouble before."

Running SU Update Fixer, it says:
"This app is designed to correct updat [sic] issues with Superuser. The
primary reason Supperuser [sic] updates fail is a signature mismatch, which
this app detects and corrects."

But then it says "Superuser does not appear to be installed."
Sigh.

I'm gonna take a break.
If you've solved this problem, let me know how you did it.

If not, I'll solve it, and write up how I did it so the next person can
skip a few dozen steps!

[Stijn De Jong]

On Mon, 13 Mar 2017 07:48:43 +0100, Stijn De Jong wrote:

> If not, I'll solve it, and write up how I did it so the next person can
> skip a few dozen steps!

It seems *lots* of people have problems getting Super SU to update itself,
so, I followed the recommendation of the app that failed, which was to
install BusyBox for Android.
https://play.google.com/store/apps/details?id=com.jrummy.busybox.installer

Basically that seems to be a Cygwin-for-Android of sorts, in that it
provides a bunch of Linux commands, apparently.

BusyBox for Android is weird, in that *after* you install it from Google
Play, it asks you to install it from within the app! Weird.

It says "Are you sure you want to install busybox to /system/xbin?".

Anyway, once installed, it seems to add over a hundred Linux commands, from
awk to xargs, so I think that's going to be powerful for many things in the
future, but I'm not sure how it's supposed to help me get SuperSU updated.

Googling for how I'm supposed to use BusyBox to debug SuperSU, I find:
https://chislonchow.wordpress.com/2013/03/29/what-is-busybox-for-an-android-user/
http://forums.androidcentral.com/motorola-droid-rooting-roms-hacks/8978-what-busybox.html
https://android.gadgethacks.com/how-to/android-basics-install-busybox-commands-0161945/

Apparently you're supposed to install BusyBox the moment you root, so,
maybe I need to start over on the rooting.

Apparently there are *multile* busybox apps, so I'm not sure which is best:
https://play.google.com/store/apps/details?id=com.jrummy.busybox.installer
https://play.google.com/store/apps/details?id=stericson.busybox

So I'm gonna hafta experiment a bit since this is a lot of stuff in just a
couple of hours, but, luckily, the goal of getting rid of Knox seems
solved.

Now the original problem is only left, which is why SuperSU won't update.
BusyBox (which one?) is supposed to help debug that, but nobody said how
yet.

[Theo]

Stijn De Jong <stijnd...@nlnet.nl> wrote:
> I have an odd situation, so, I need help with debugging tools.
> This is a hard one, because Knox is designed, apparently, not to be
> removed.
>
> Anyone have an idea how to get rid of Knox on a Samsung Galaxy S3 on
> Android 4.3?

[snip, I didn't read all of your posts in detail]

On a Note 2, which is roughly the same vintage, Knox came in in Android 4.3.
That means you can flash the phone with Android 4.1 and you have a
Knox-free bootloader. Then you can flash only the OS partition to some
other OS (eg Samsung's Android 4.4, or a custom ROM) and you keep the
Knox-free bootloader.

This is probably irrelevant to you, but the purpose of doing that is it
prevents the Knox bootloader blowing the 'warranty void' fuse when you root
it or install a custom ROM.

Otherwise, just install a Knox-free custom ROM?

Theo

[Stijn De Jong]

On 13 Mar 2017 11:25:25 +0000 (GMT), Theo wrote:

> On a Note 2, which is roughly the same vintage, Knox came in in Android 4.3.
> That means you can flash the phone with Android 4.1 and you have a
> Knox-free bootloader.

Thanks Theo for that suggestion, which *nobody* had when I read the
articles that I referenced!

The bad news is that many seem to have problems removing Knox, probably
because it was designed to be hard to remove in the first place.

Luckily, about the fourth or fifth method I tried completely removed Knox,
so, I won't need to use your method (which I hadn't thought of, and none of
the referenced articles mentioned).

The good news is that others reading the archives in the future will find
these suggestions. http://tinyurl.com/comp-mobile-android

> Then you can flash only the OS partition to some
> other OS (eg Samsung's Android 4.4, or a custom ROM) and you keep the
> Knox-free bootloader.

Thanks. I'm Knox free, and also I got rid of my first gaggle of carrier
bloatware (e.g., Amazon, Google Drive, Dropbox, etc.).

I was a bit pensive removing the bloatware with the two programs I
referenced but they worked great, and much better, it turns out, than the
freeware version of the otherwise venerable Titanium Backup.

I should have timed the boot process though, because my butt dyno tells me
the phone boots much faster, but I wish I had empirical data to back that
up.

> This is probably irrelevant to you, but the purpose of doing that is it
> prevents the Knox bootloader blowing the 'warranty void' fuse when you root
> it or install a custom ROM.

I saw a bunch of admonitions about the vaunted "warranty".
I'm not young, and I've almost never made good on a hardware warranty in my
life.

Cars? Yes.
Tires? Almost never.
Tools? Almost never.
Batteries? Almost never.
Appliances. Rarely.
Electronics? Almost never.

> Otherwise, just install a Knox-free custom ROM?

I made a bunch of mistakes, but I should summarize for everyone that
removing Knox is simple if things work, and there are lots of avenues if
things don't work the first or second or third time.

In the end, what worked best on my S3 Android 4.3 T-Mobile T-999 was:
a. Rooting with KingoRoot free
https://root-apk.kingoapp.com/
b. Backing up the Knox-ware using Titanium Backup free:
https://play.google.com/store/apps/details?id=com.keramidas.TitaniumBackup
c. Removing Knox-ware with "System App Remover (ROOT)":
https://play.google.com/store/apps/details?id=com.jumobile.manager.systemapp
d. Rebooting

Some mistakes I made in the process were that I didn't realize until just
today that the whole original problem was probably due to the fact that I
had *both* Kindoroot and Super SU installed.

I only belatedly realized this only after removing Knoxware and finding
that the problem still existed with Super SU not "updating" (which is an
euphemism for "working" in Super SU terminology, apparently).

Another mistake I made was to install multiple busybox setups, where in the
end, I uninstalled everything that I installed and tried again, where the
busybox worked when there was only the better simpler one.

So, my current recommendation is not to use this busybox:
https://play.google.com/store/apps/details?id=com.jrummy.busybox.installer

But to use this simpler busybox:
https://play.google.com/store/apps/details?id=stericson.busybox&hl=fr

I think the reason the comamnd-line removal of Knox didn't work was because
I didn't have a working busybox t the time.

So, I made a lot of mistakes.
But I got the job done, and, better yet, anyone can follow in my footsteps
where they can NOT make the mistakes I made (they can make new mistakes!)

[Stijn De Jong]

On Mon, 13 Mar 2017 08:14:17 +0100, Stijn De Jong wrote:

> Now the original problem is only left, which is why SuperSU won't update.
> BusyBox (which one?) is supposed to help debug that, but nobody said how
> yet.

I'm not sure, but I think both questions above are due to my naivety. \

The original problem, I think, while due to Knox, remained after I removed
Knox, which was that SuperSU wanted to "update" itself, which, is,
apparently, parlance for "working" since it won't work unless it updates
itself.

I think, but am not positive, that the problem is that I shouldn't have
tried to have *both* SuperSu and Kingoroot at the same time. I think that's
why SuperSu is failing to "update" (aka, it's failing to work). So I solved
that by removing SuperSU, although I do realize that most programs are
tested with SuperSu and fewer are tested with Kingoroot.

The only reason I used Kingoroot in the first place is that my S3 usb port
is kaput, so, I had to root using just the phone, all by its itty bitty
self, whereas the SuperSu method usually entails using a computer (for some
reason).

Anyway, I never solved the original SuperSU problem so I deleted it, but I
think that's the reason for the problem (you can't have to "su" things, I
guess).

As for the busybox question, it's kind of the same story I think.
You shouldn't have more than one busybox, so, you have to choose which one
to use.

I ditched the fancy busybox from here:
https://play.google.com/store/apps/details?id=com.jrummy.busybox.installer

In favor of this simpler busybox:
https://play.google.com/store/apps/details?id=stericson.busybox

Despite those mistakes, in summary, here's what we accomplished:
a. We rooted the S3 Android 4.3 all by it's itty bitty self with Kingoroot
b. We removed Knox-ware with "System App Remover (ROOT)"
c. At the same time, we removed tons of carrier bloat with that tool.
d. We added about a hundred linux commands (with busybox).

The bad news is I had to add a "root" folder to my one-screen desktop (so
as to keep the root-related apps separate from the other system apps),
where I try to always keep everything organized perfectly, so, that's one
more folder to clutter up a perfect desktop.

The good news is that, other than the new folder on my desktop, the phone
is better, faster, and more versatile.