Secure Folder Patch for Custom ROM - Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &

Hello XDA again,
Maybe many of you knew me before, especially my work on secure folder for rooted note 5.
I currently own Note 8 rooted.
Many devs said that Samsung introduced TEE and because of that we can not use secure folder again.
After spending a lot of time on investigating, patching both old and new lib, apk, framework, services I figured that actually Secure Folder is currently not related to TEE. Samsung just patched by code then we can bypass their patch to use Secure Folder in custom rooted rom.
How:
A. FOR PIE ROM
I. Include all Knox related things in your rom.
II. Patch build.prop:
change ro.config.iccc_version=3.0 to
ro.config.iccc_version=iccc_disabled
De-compile new SecureFolder.apk show that it uses Iccc (IntegrityControlCheckCenter) to check system integrity status (device_status). If it's ok, SecureFolder.apk will create container. Old SecureFolder.apk did not use that check.
Patch libtz_iccc.so is difficult so that just bypass this check by above patch.
III. Patch services.jar
Lcom/samsung/android/knox/SemPersonaManager is personal manager for knox related things. If device is compromised then Lcom/samsung/android/knox/SemPersonaManager will set persona's attribute to 0x4 and securefolder container will be uninstalled.
Check this code in Lcom/android/server/pm/PersonaManagerService:
Code:
iget-object v11, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;
invoke-static {v11}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z
move-result v11
if-nez v11, :cond_2
.line 1345
const-string v11, "PersonaManagerService"
const-string v12, "Device compromise detected !"
invoke-static {v11, v12}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 1346
[COLOR="DarkOrange"] invoke-static {v10, v9}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]
move-result v10
if-nez v10, :cond_3
.line 1347
const-string v10, "PersonaManagerService"
const-string/jumbo v11, "setting compromise attribute failed !"
invoke-static {v10, v11}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
goto :goto_2
.line 1349
:cond_2
invoke-virtual {v8}, Landroid/content/pm/UserInfo;->isSuperLocked()Z
move-result v10
if-eqz v10, :cond_3
.line 1350
const-string v10, "PersonaManagerService"
const-string v11, "Device is super locked - start lock screen"
invoke-static {v10, v11}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 1354
.end local v8 # "ui":Landroid/content/pm/UserInfo;
:cond_3
:goto_2
iget-object v8, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;
invoke-static {v8}, Lcom/samsung/android/knox/SemPersonaManager;->isKioskModeEnabled(Landroid/content/Context;)Z
move-result v8
if-eqz v8, :cond_4
.line 1355
iget-object v8, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;
invoke-static {v8}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z
move-result v8
const/4 v8, 0x1
if-nez v8, :cond_4
.line 1356
invoke-direct {p0}, Lcom/android/server/pm/PersonaManagerService;->getPersonaManager()Lcom/samsung/android/knox/SemPersonaManager;
move-result-object v8
invoke-virtual {v8}, Lcom/samsung/android/knox/SemPersonaManager;->getKioskId()I
move-result v8
[COLOR="darkorange"] invoke-static {v8, v9}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]
move-result v8
if-nez v8, :cond_4
.line 1357
const-string v8, "PersonaManagerService"
const-string/jumbo v9, "setting compromise attribute failed !!"
invoke-static {v8, v9}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 1362
:cond_4
return-void
and this code in Lcom/android/server/pm/PersonaServiceHelper
Code:
.method public static shouldBlockUserStart(Landroid/content/Context;I)Z
.locals 7
.param p0, "c" # Landroid/content/Context;
.param p1, "userId" # I
.line 934
invoke-static {}, Landroid/os/Binder;->clearCallingIdentity()J
move-result-wide v0
.line 936
.local v0, "token":J
:try_start_0
const-string v2, "PersonaServiceHelper"
new-instance v3, Ljava/lang/StringBuilder;
invoke-direct {v3}, Ljava/lang/StringBuilder;-><init>()V
const-string/jumbo v4, "shouldBlockUserStart() "
invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v3, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v3}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v3
invoke-static {v2, v3}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I
.line 937
invoke-static {}, Lcom/android/server/pm/PersonaServiceHelper;->getUserManager()Lcom/android/server/pm/UserManagerService;
move-result-object v2
invoke-virtual {v2, p1}, Lcom/android/server/pm/UserManagerService;->getUserInfo(I)Landroid/content/pm/UserInfo;
move-result-object v2
.line 938
.local v2, "uinfo":Landroid/content/pm/UserInfo;
if-eqz v2, :cond_2
.line 939
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isManagedProfile()Z
move-result v3
const/4 v4, 0x1
if-eqz v3, :cond_0
.line 940
invoke-static {p0}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z
move-result v3
if-nez v3, :cond_0
.line 941
[COLOR="darkorange"] const/4 v3, 0x4
invoke-static {p1, v3}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]
.line 942
const-string v3, "PersonaServiceHelper"
new-instance v5, Ljava/lang/StringBuilder;
invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V
const-string v6, "Device compromise attribute set for user : "
invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v5
invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
.line 943
iget v3, v2, Landroid/content/pm/UserInfo;->id:I
if-eqz v3, :cond_0
.line 944
const-string v3, "PersonaServiceHelper"
new-instance v5, Ljava/lang/StringBuilder;
invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V
const-string v6, "blocking when device compromised "
invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v5
invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_0
.catchall {:try_start_0 .. :try_end_0} :catchall_0
.line 945
nop
.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
.line 945
return v4
.line 950
:cond_0
:try_start_1
iget v3, v2, Landroid/content/pm/UserInfo;->id:I
if-eqz v3, :cond_1
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isManagedProfile()Z
move-result v3
if-eqz v3, :cond_1
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isDeviceCompromised()Z
move-result v3
if-eqz v3, :cond_1
.line 951
const-string v3, "PersonaServiceHelper"
new-instance v5, Ljava/lang/StringBuilder;
invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V
const-string v6, "blocking when device compromised : "
invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v5
invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_1
.catchall {:try_start_1 .. :try_end_1} :catchall_0
.line 952
nop
.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
.line 952
return v4
.line 955
:cond_1
:try_start_2
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isSuperLocked()Z
move-result v3
if-eqz v3, :cond_2
invoke-static {p1}, Lcom/samsung/android/knox/SemPersonaManager;->isLegacyClId(I)Z
move-result v3
if-eqz v3, :cond_2
.line 956
const-string v3, "PersonaServiceHelper"
new-instance v5, Ljava/lang/StringBuilder;
invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V
const-string v6, "blocking non-BYOD super locked user "
invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v5
invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_2
.catchall {:try_start_2 .. :try_end_2} :catchall_0
.line 957
nop
.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
.line 957
return v4
.line 961
:cond_2
const/4 v3, 0x0
.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
.line 961
return v3
.line 963
.end local v2 # "uinfo":Landroid/content/pm/UserInfo;
:catchall_0
move-exception v2
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
throw v2
.end method
Then we can bypass those things by several way:
1. Delete those Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z lines
2. Patch Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/ContextZ so that it returns true. But this way may cause other issues related to tima.
3. Just add simple code like below:
Code:
invoke-static {v11}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z
move-result v11
[COLOR="DarkOrange"] const/4 v11, 0x1[/COLOR]
if-nez v11, :cond_2
Better use the third way.
IV. Patch method isUnifiedKeyStoreSupported in Lcom/android/server/locksettings/SyntheticPasswordManager so that it return true, by two way:
1. Simply add that line (from S10 firmware to system/etc/floating_features.xml:
<SEC_FLOATING_FEATURE_KNOX_SUPPORT_UKS>TRUE</SEC_FLOATING_FEATURE_KNOX_SUPPORT_UKS>
2. Modify smali file.
V. If your rom is a ported rom. You should replace services\smali_classes3\com\android\server\enterpr ise\ccm from stock services.jar.
VI. Recompile services.jar and enjoy secure folder.
B. FOR OREO ROM
I. Include all Knox related things in your rom.
II. Patch build.prop:
change ro.config.iccc_version=3.0 to
ro.config.iccc_version=iccc_disabled
De-compile new SecureFolder.apk show that it uses Iccc (IntegrityControlCheckCenter) to check system integrity status (device_status). If it's ok, SecureFolder.apk will create container. Old SecureFolder.apk did not use that check.
Patch libtz_iccc.so is difficult so that just bypass this check by above patch.
III. Patch services.jar
Lcom/samsung/android/knox/SemPersonaManager is personal manager for knox related things. If device is compromised then Lcom/samsung/android/knox/SemPersonaManager will set persona's attribute to 0x4 and securefolder container will be uninstalled.
Check this code in Lcom/android/server/pm/PersonaManagerService:
Code:
iget-object v11, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;
invoke-static {v11}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z
move-result v11
if-nez v11, :cond_2
.line 1345
const-string v11, "PersonaManagerService"
const-string v12, "Device compromise detected !"
invoke-static {v11, v12}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 1346
[COLOR="DarkOrange"] invoke-static {v10, v9}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]
move-result v10
if-nez v10, :cond_3
.line 1347
const-string v10, "PersonaManagerService"
const-string/jumbo v11, "setting compromise attribute failed !"
invoke-static {v10, v11}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
goto :goto_2
.line 1349
:cond_2
invoke-virtual {v8}, Landroid/content/pm/UserInfo;->isSuperLocked()Z
move-result v10
if-eqz v10, :cond_3
.line 1350
const-string v10, "PersonaManagerService"
const-string v11, "Device is super locked - start lock screen"
invoke-static {v10, v11}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 1354
.end local v8 # "ui":Landroid/content/pm/UserInfo;
:cond_3
:goto_2
iget-object v8, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;
invoke-static {v8}, Lcom/samsung/android/knox/SemPersonaManager;->isKioskModeEnabled(Landroid/content/Context;)Z
move-result v8
if-eqz v8, :cond_4
.line 1355
iget-object v8, p0, Lcom/android/server/pm/PersonaManagerService;->mContext:Landroid/content/Context;
invoke-static {v8}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z
move-result v8
const/4 v8, 0x1
if-nez v8, :cond_4
.line 1356
invoke-direct {p0}, Lcom/android/server/pm/PersonaManagerService;->getPersonaManager()Lcom/samsung/android/knox/SemPersonaManager;
move-result-object v8
invoke-virtual {v8}, Lcom/samsung/android/knox/SemPersonaManager;->getKioskId()I
move-result v8
[COLOR="darkorange"] invoke-static {v8, v9}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]
move-result v8
if-nez v8, :cond_4
.line 1357
const-string v8, "PersonaManagerService"
const-string/jumbo v9, "setting compromise attribute failed !!"
invoke-static {v8, v9}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 1362
:cond_4
return-void
and this code in Lcom/android/server/pm/PersonaServiceHelper
Code:
.method public static shouldBlockUserStart(Landroid/content/Context;I)Z
.locals 7
.param p0, "c" # Landroid/content/Context;
.param p1, "userId" # I
.line 934
invoke-static {}, Landroid/os/Binder;->clearCallingIdentity()J
move-result-wide v0
.line 936
.local v0, "token":J
:try_start_0
const-string v2, "PersonaServiceHelper"
new-instance v3, Ljava/lang/StringBuilder;
invoke-direct {v3}, Ljava/lang/StringBuilder;-><init>()V
const-string/jumbo v4, "shouldBlockUserStart() "
invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v3, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v3}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v3
invoke-static {v2, v3}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I
.line 937
invoke-static {}, Lcom/android/server/pm/PersonaServiceHelper;->getUserManager()Lcom/android/server/pm/UserManagerService;
move-result-object v2
invoke-virtual {v2, p1}, Lcom/android/server/pm/UserManagerService;->getUserInfo(I)Landroid/content/pm/UserInfo;
move-result-object v2
.line 938
.local v2, "uinfo":Landroid/content/pm/UserInfo;
if-eqz v2, :cond_2
.line 939
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isManagedProfile()Z
move-result v3
const/4 v4, 0x1
if-eqz v3, :cond_0
.line 940
invoke-static {p0}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z
move-result v3
if-nez v3, :cond_0
.line 941
[COLOR="darkorange"] const/4 v3, 0x4
invoke-static {p1, v3}, Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z[/COLOR]
.line 942
const-string v3, "PersonaServiceHelper"
new-instance v5, Ljava/lang/StringBuilder;
invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V
const-string v6, "Device compromise attribute set for user : "
invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v5
invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
.line 943
iget v3, v2, Landroid/content/pm/UserInfo;->id:I
if-eqz v3, :cond_0
.line 944
const-string v3, "PersonaServiceHelper"
new-instance v5, Ljava/lang/StringBuilder;
invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V
const-string v6, "blocking when device compromised "
invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v5
invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_0
.catchall {:try_start_0 .. :try_end_0} :catchall_0
.line 945
nop
.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
.line 945
return v4
.line 950
:cond_0
:try_start_1
iget v3, v2, Landroid/content/pm/UserInfo;->id:I
if-eqz v3, :cond_1
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isManagedProfile()Z
move-result v3
if-eqz v3, :cond_1
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isDeviceCompromised()Z
move-result v3
if-eqz v3, :cond_1
.line 951
const-string v3, "PersonaServiceHelper"
new-instance v5, Ljava/lang/StringBuilder;
invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V
const-string v6, "blocking when device compromised : "
invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v5
invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_1
.catchall {:try_start_1 .. :try_end_1} :catchall_0
.line 952
nop
.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
.line 952
return v4
.line 955
:cond_1
:try_start_2
invoke-virtual {v2}, Landroid/content/pm/UserInfo;->isSuperLocked()Z
move-result v3
if-eqz v3, :cond_2
invoke-static {p1}, Lcom/samsung/android/knox/SemPersonaManager;->isLegacyClId(I)Z
move-result v3
if-eqz v3, :cond_2
.line 956
const-string v3, "PersonaServiceHelper"
new-instance v5, Ljava/lang/StringBuilder;
invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V
const-string v6, "blocking non-BYOD super locked user "
invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v5, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v5
invoke-static {v3, v5}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
:try_end_2
.catchall {:try_start_2 .. :try_end_2} :catchall_0
.line 957
nop
.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
.line 957
return v4
.line 961
:cond_2
const/4 v3, 0x0
.line 963
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
.line 961
return v3
.line 963
.end local v2 # "uinfo":Landroid/content/pm/UserInfo;
:catchall_0
move-exception v2
invoke-static {v0, v1}, Landroid/os/Binder;->restoreCallingIdentity(J)V
throw v2
.end method
Check this code in KnoxMUMContainerPolicy
Code:
invoke-static {v5}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/ContextZ
move-result v5
if-nez v5, :cond_0
Then we can bypass those things by several way:
1. Delete those Lcom/samsung/android/knox/SemPersonaManager;->setAttributes(II)Z lines
2. Patch Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/ContextZ so that it returns true. But this way may cause other issues related to tima.
3. Just add simple code like below:
Code:
invoke-static {v11}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/Context;)Z
move-result v11
[COLOR="DarkOrange"] const/4 v11, 0x1[/COLOR]
if-nez v11, :cond_2
Code:
invoke-static {v5}, Lcom/android/server/pm/PersonaServiceHelper;->isTimaAvailable(Landroid/content/ContextZ
move-result v5
[COLOR="DarkOrange"] const/4 v5, 0x1[/COLOR]
if-nez v5, :cond_0
Better use the third way.
IV. Patch method isUnifiedKeyStoreSupported in Lcom/android/server/locksettings/SyntheticPasswordManager so that it return true, by two way:
1. Simply add that line (from S10 firmware to system/etc/floating_features.xml:
<SEC_FLOATING_FEATURE_KNOX_SUPPORT_UKS>TRUE</SEC_FLOATING_FEATURE_KNOX_SUPPORT_UKS>
2. Modify smali file.
V. Mod KnoxFileHandler
In Oreo Samsung forced using tima to store, retrive and delete encryptkey. But in Pie they changed to use KeyProtector. So that we will mod KnoxFileHandler. Compare modded one to stock one in attached to find out what need to be changed.
VI. If your rom is a ported rom. You should replace services\smali_classes3\com\android\server\enterpr ise\ccm from stock services.jar.
VII. Recompile services.jar and enjoy secure folder.
PS:
VII. SamsungPay and SamsungPass still use TEE, their own trustlets and use samsung server to check, store hash code. I will try to investigate deeper on those apk if I have time.

---

This is great to see, ive been curious on how you fixed SS back on Note 5 nougat for a while now, ill give it a go on my N5 running pie.
Thanks for sharing :good: god bless

---

Nice find mate,Keep it up

---

Nice finding mate, can i try the implement this method on @ananjaser1211 's Refined Nougat for N4? ?

---

Is great, but I don't know how to do it ?

---

nice !Good job!!!

---

Massive thanks mate!

---

Great! @khongloi113 welcome back!

---

Nicee

---

Great job mate, working perfect... View attachment 4794516
Sent from my SM-N950F using Tapatalk

---

Can someone just post the edited secure folder because i dont know how to even decompile it?

---

SHKOMAGDID said:
Can someone just post the edited secure folder because i dont know how to even decompile it
Click to expand...
Click to collapse
Secure Folder doesn't needs to be edited...

---

AbrahamGC said:
Secure Folder doesn't needs to be edited...
Click to expand...
Click to collapse
So why it didnt work i just edited the build.prop then what should i do?

---

SHKOMAGDID said:
So why it didnt work i just edited the build.prop then what should i do?
Click to expand...
Click to collapse
There is only 2 files to edit on the guide, build.prop and services.jar, is not much long to read...
Add back knox files you debloated (idk exactly which are required and which not, for testing I just added all knox stuff), edit prop, edit services, and done :good:

---

AbrahamGC said:
There is only 2 files to edit on the guide, build.prop and services.jar, is not much long to read...
Add back knox files you debloated (idk exactly which are required and which not, for testing I just added all knox stuff), edit prop, edit services, and done :good:
Click to expand...
Click to collapse
And heres the problem i dont know how to edit it maybe any guides?

---

What's tools you use decompile service.jar?

---

sazuke0703 said:
What's tools you use decompile service.jar?
Click to expand...
Click to collapse
Apktool

---

khongloi113 said:
Apktool
Click to expand...
Click to collapse
Link apk tool please I decompile has eror.

---

Can anyone please share their edited Service.jar?

---

AbrahamGC said:
Great job mate, working perfect...
Click to expand...
Click to collapse
Did you patch via option III.? I.e. just adding the line, or which way?