How do I verify my firmware is legitimate?

Question

I just bought a "new" Galaxy S7, but the box was already open when it arrived.

Condition of the phone was perfect, so I don't mind if it's used/refurbished. What I worry about is whether the device has a keylogger installed or some other malware.

It successfully accepted an over-the-air update. This gives it some credibility (I don't know how indicative this is, but I believe OTA updates are only offered to stock firmware).

Samsung KNOX is enabled, and hasn't complained yet.

I've rebooted into recovery, and see the following text:

Android Recovery

MMB29K.G930FXXU1BPHJ

samsung/heroltexx/herolte

6.0.1/MMB29K/G930FXXU1BPHJ

user/release-keys

Those are real build numbers for stock firmware I have been able to find online.

I've rebooted into ODIN mode, and see the following text:

ODIN MODE

Download speed: fast

Product name: SM-G930F

Current binary: Samsung official

System status: official

FAP lock: ON

Secure download: enabled

Warranty void: 0 (0x0000)

RP SWREV: B:1 K:0 S:0

The KNOX counter (warranty void) is still set to 0. This suggests further that it has not been tampered with.

Are the checks that I have performed already sufficient? There are some further checks I would like to know how to do:

I expect anybody can just type a build number in. I would like to compare the checksum of the firmware with the real build. I also would like to check if it has been signed with a Samsung certificate.

There are no custom User certificates in its security section. But I would appreciate some way to compare my System certificates to confirm they are genuine.

— Birchlabs | Sources

Answer

IMO, your firmware is original, because it

Received OTA - most clinching reason ( see edit for details)

Knox isn't tripped

Firmware number matches

For Samsung phones, there is a handy app that provides a lot of information about the phone, including Refurbishment Check. It also shows if the device is original. It is Phone INFO Samsung. App developer thread on XDA here

This question shows you to verify the checksum of OS. You could try that with the checksum available on OEM site or SamMobile Is there a way to verify stock ROMs?

Edit

Starting from Android 5.0 Block based OTA, in which the device can get an OTA when the entire /system partition matches with that does on their servers. Concerns of OP in comments are addressed here- if the system is modified OTA would fail

....File OTA tolerates some changes to the partition, such as the addition of files that are not part of the source or target build. However, block OTA does not tolerate additions to the partition, so users will need to install a full OTA overwriting any system partition modifications) or flash a new system image to enable future OTAs

(Emphasis supplied)

— beeshyams | Sources

Topics