Hello guys.
Today i will post a kernel that i (just run the wizard to) created for XZ DUAL variant version 41.3.A.2.192. My simple contribution! I'm not responsable for brinks or 3º global war if my kernel makes something bad.
This kernel is compatible with:
root with magisk - bypass SafetyNet
disable dm-verity with magisk
RIC disabled
Force encrypt disabled
Installation:
Flash twrp
Flash custom kernel
Flask drmfix_system_mode
Flash magisk (compatible with Last One)
If you install magisk you should be able to get SafetyNet status Sucess (Pokemon Go / Android Pay support).
I used a modded tool version from this thread to create it:
https://forum.xda-developers.com/xp...oot-automatic-repack-stock-kernel-dm-t3301605
Please, Don't thanks me. All the hard work was performed by Mr. Tobias Waldvogel and the mod was performed by Mr. Serajr
So, if you like this kernel, please consider to pay a coffee for these guys!
Feel free to correct something that I wrote wrong. I'm improving my english!
Download: (Not tested yet)
https://mega.nz/#!pNYXGAzK Key: !tDZsLsKs0QsFLMhZ1W4zpmMFT07fSqcsO8MHhEXzP2c
old versions
version. 184 - build 1.00
https://mega.nz/#!EIw2FCqY Key: !aVfQoIDMvzlBQbrMspIGRQ6Gr1m_5CvMe9bstYmugm4
version. 171 - build 1.00
https://mega.nz/#!ZchCkK6S Key: !hxJ4J4qXMLQwwKYVkaAN_jPh-k6i-SsiwZCC-Zf11do
version. 157 - build 1.00
https://mega.nz/#!gBQzBSAT key: !OVB-XORc7mw1gnroUsW0AhkBS2mv12_xstEUK0xQ4cA
https://mega.nz/#!9dxEUbbR Key: !X9ODJJwnEXqhAzr68cDUWnjfxqH-3n9-I0SLf78boHM
https://mega.nz/#!lBBGRQxZ Key: !o0a-QigbEyaon9IRRdb0n8QJLCX1HrftnlzGNet6uK8
version. 107 - build 1.00
https://mega.nz/#!0QQ2GTxR Key: !woCNVi_WmMh__kZKB-uQBPH8lTIATkKBCkyJsLczAkk
version .99 - build 1.00
https://mega.nz/#!dBRElbqI Key: !ZomrVQmSdb2YanNjtxw_uybrBuHc857NdFGM_NXx4rw
version .75 - build 1.00
https://mega.nz/#!dcRHWZyQ Key: !MEnuKmMPr5yjyAQ2ugnpkWy_ILWdkWwxP6ZIho350p4
version .58 - build 1.01
https://mega.nz/#!ZIAWmSBI Key: !2LEnUPjoFpZ_SIe7OrOXeiBWHtBVVP2Mu5f2732tlDo
Version .58 - build 1.00
https://mega.nz/#!QAxhUIKY Key: !Onf0oMLJ-AdMVxc0XlDQrJoCw4aciPX0TEYpQwQcv1Y
Alert!!!! -> Drm fix only work in 14.5 magisk version!
https://mega.nz/#!AAwDDLhQ Key: !rVDi5m3a-DXHWSVu9Jq689lZKEZxFV8KR4KKl_HDNDE
Version .401
https://mega.nz/#!8Z4BXBYa key: !21EDDhzSdp78qzli36iBPdj7Sgg1JfZGSPKwAqVUf0U
Version .76
https://mega.nz/#!JdhxyQza key: !gL9LOwn4xagWIhTBuLreQM-BZR3npB9e-lnlxqZS5u0
Version .65
https://mega.nz/#!FdJyTZyS key: !NsOvvX0uoUwhpbkrgIVzoN55lF_G1IGcorUr0SDLOIM
thanks for the job!
but i'm wondering does the "fake drm key" means the kernel will give a drm key for those functions need it to keep working?
Yes, root kernel also works on XZ, but I would fastboot flash the kernel-patch.elf to boot instead of img.
Details and credits go here:
https://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605
You will need on kernel_*.sin from the latest firmware you downloaded (If you use xperiafirm that come with flashtool, check here: %USERPROFILE%\.flashTool\firmwares )
Use Flashtool -> Tools -> SIN Editor to extract data from system_*.sin
Copy both the kernel_*.elf and SuperSU*.zip to the rootkernel folder, then you can start patching the kernel.
My settings are: disable dm-verity (Y), disable RIC (Y), no TWRP (N), install DRM fix (Y) (it will say experimental, but it will work), install busybox (Y)
Sample here based on 41.2.A.7.65 Customized HK (1305-2218) (but you should create your own, since every kernel might slighty different depending on country)
Flash the new kernel to boot in fastboot mode, or use flashtool->fastboot->doomlord->kernel
(To save time, recommand to flash TWRP to recovery at the same time with fastboot flash recovery twrp-3.*-kagura.img )
You can also flash your real drm key if you have back up it before, like Z5.
(Go to root kernel directory and use this command "flash_dk TA_F8332_*.img DK.ftf". You will also need the older version of flashtool 0.9.22.3 to flash the DK.ftf as well )
It doesn't quite work with AdrianDC's patcher thou, dont install this afterwards.
bruno$0 said:
Hello guys.
Today i will post a kernel that i (just run the wizard to) created for XZ DUAL variant version 41.2.A.7.65. My simple contribution!
This kernel contents:
-dm-verity disabled
-fake DRM key
-Ric Disable
If you install magisk you should be able to get SafetyNet status Sucess (Pokemon Go / Android Pay support).
I used a modded tool version from this thread to create it:
https://forum.xda-developers.com/xp...oot-automatic-repack-stock-kernel-dm-t3301605
Please, Don't thanks me. All the hard work was performed by Mr. Tobias Waldvogel and the mod was performed by Mr. Serajr
So, if you like this kernel, please consider to pay a coffee for these guys!
Sorry about my english.....
Download:
https://mega.nz/#!FdJyTZyS key: !NsOvvX0uoUwhpbkrgIVzoN55lF_G1IGcorUr0SDLOIM
Click to expand...
Click to collapse
What DRM fake keys
If i relock the phone os like ta partion not delete of i don't have it
I don't understood what you talked. Fake Keys emulate the original Keys if you don't have it anymore. If you relock you device flashing the tá backup image you will restore all functions. If you don't have your ta backup it's better stay with this kernel to simulate a locked device.
bruno$0 said:
I don't understood what you talked. Fake Keys emulate the original Keys if you don't have it anymore. If you relock you device flashing the tá backup image you will restore all functions. If you don't have your ta backup it's better stay with this kernel to simulate a locked device.
Click to expand...
Click to collapse
I don't have ta backup.
I flash the kernel and get fake keys, or i shoul flash kernel then the patched .elf.
I want to relock and have camera working to can sell.
Thank you, your kernel is working fine
I will test the performance later
If you dont have ta backup, you cant relock.
Fake key is a work around to make camera working, but doesnt relock.
gspbeetle said:
If you dont have ta backup, you cant relock.
Fake key is a work around to make camera working, but doesnt relock.
Click to expand...
Click to collapse
you mean if i flash this kernel and relock camera still working properly like original after reset
karrouma said:
you mean if i flash this kernel and relock camera still working properly like original after reset
Click to expand...
Click to collapse
He means that the DRM keys that you currently don't have is preventing you from relocking your bootloader
Tldr : you cannot relock your bootloader anymore because your DRM keys are gone
@[email protected]$0
thank you for the update?
karrouma said:
@[email protected]$0
thank you for the update?
Click to expand...
Click to collapse
U ar welcome. I always use solutions from here. This is the minimal that can help U guys!
@[email protected]$0 Is it even or twrp?
I don't understood what you mean.
bruno$0 said:
I don't understood what you mean.
Click to expand...
Click to collapse
If the kernel comes with twrp
Nope. U Will need download it from twrp official site and use power + volume combo.
gspbeetle said:
Yes, root kernel also works on XZ, but I would fastboot flash the kernel-patch.elf to boot instead of img.
Details and credits go here:
https://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605
You will need on kernel_*.sin from the latest firmware you downloaded (If you use xperiafirm that come with flashtool, check here: %USERPROFILE%\.flashTool\firmwares )
Use Flashtool -> Tools -> SIN Editor to extract data from system_*.sin
Copy both the kernel_*.elf and SuperSU*.zip to the rootkernel folder, then you can start patching the kernel.
My settings are: disable dm-verity (Y), disable RIC (Y), no TWRP (N), install DRM fix (Y) (it will say experimental, but it will work), install busybox (Y)
Sample here based on 41.2.A.7.65 Customized HK (1305-2218) (but you should create your own, since every kernel might slighty different depending on country)
Flash the new kernel to boot in fastboot mode, or use flashtool->fastboot->doomlord->kernel
(To save time, recommand to flash TWRP to recovery at the same time with fastboot flash recovery twrp-3.*-kagura.img )
You can also flash your real drm key if you have back up it before like Z5.
(Go to root kernel directory and use this command "flash_dk TA_F8332_*.img DK.ftf". You will also need the older version of flashtool 0.9.22.3 to flash the DK.ftf as well )
It doesn't quite work with AdrianDC's patcher thou, dont install this afterwards.
Click to expand...
Click to collapse
So in that picture you got your real keys back or were you using the fake drm keys from the thread? I'm trying to get my fido keys provisioned but apparently i didn't back up my original TA so i guess it's impossible? Just wanted to get back the screen mirroring feature .
Vu Mai said:
So in that picture you got your real keys back or were you using the fake drm keys from the thread? I'm trying to get my fido keys provisioned but apparently i didn't back up my original TA so i guess it's impossible? Just wanted to get back the screen mirroring feature .
Click to expand...
Click to collapse
You won't be able to get Fido keys using my kernel just because doesn't exist any solution for that. If you just wanna restore your screen mirror, just add this in tha tail of your build.prop:
persist.debug.wfd.appmonitoring=1
Then restart your device. Now everything should be okay.
bruno$0 said:
You won't be able to get Fido keys using my kernel just because doesn't exist any solution for that. If you just wanna restore your screen mirror, just add this in tha tail of your build.prop:
persist.debug.wfd.appmonitoring=1
Then restart your device. Now everything should be okay.
Click to expand...
Click to collapse
You're a legend! Much love to you and your work. Keep up my good man!!
I'm glad to helped you! Now we only need wait for Oreo firmware! It's should be great!
Dear bruno$0,
Please check my attatchment.
If I flash the kernel with fake DRM keys ,can I get the Fido keys provinsed?
If I Still can't get it back, the situation from my attatchment means the DRM-fix is working?
X-reality, camera denoise and some sony function is working?
Thanks in advance!
Related
Q&A for [STOCK][D58XX][5.0.2] Firmware 23.1.A.0.690 Generic [ROOT/XZDR/SuperSU]
Some developers prefer that questions remain separate from their main development thread to help keep things organized. Placing your question within this thread will increase its chances of being answered by a member of the community or by the developer.
Before posting, please use the forum search and read through the discussion thread for [STOCK][D58XX][5.0.2] Firmware 23.1.A.0.690 Generic [ROOT/XZDR/SuperSU]. If you can't find an answer, post it here, being sure to give as much information as possible (firmware version, steps to reproduce, logcat if available) so that you can get help.
Thanks for understanding and for helping to keep XDA neat and tidy!
Can i flash zip or ftf via adb? i'm using cm12 rom.
hi guys,
I bought a Z3C and I just checked the bootloader is not locked .
pen the dialler and enter #*#7378423#*# to access the service menu.
Tap Service info > Configuration > Rooting Status. Bootloader unlock allowed says Yes
I wanted to know if I could flash via Flashtool software directly ?
OK, so I've used the method described in the thread, flashed firmware.zip from recovery on rooted 4.4.4. (.77), after flashing I wiped cache and dalvik, rebooted, android was upgraded, system booted, and all of my apps and settings remained intacted. Is this normal? I expected clean start. I used D5803_23.1.A.0.690_Generic_NCB-Root-XZDR2.8.3-SuperSU.
savudin said:
OK, so I've used the method described in the thread, flashed firmware.zip from recovery on rooted 4.4.4. (.77), after flashing I wiped cache and dalvik, rebooted, android was upgraded, system booted, and all of my apps and settings remained intacted. Is this normal? I expected clean start. I used D5803_23.1.A.0.690_Generic_NCB-Root-XZDR2.8.3-SuperSU.
Click to expand...
Click to collapse
If you didn´t wipe data in recovery, then no data should be wiped. That´s normal.
Yes, that's it. But, did I had to wipe data? I've read that clean install is recommended. I've noticed no problems in the last couple of hours of usage.
Dirty Flash from 23.0.1.A.5.77
I dirty flashed 23.1.A.0.690 from Greatslon MIUI v5 23.0.1.A.5.77 and still have root.
The phone froze and bootlooped a couple of times when i installed and restarted it, but patience was rewarded, as it finally booted.
I can still mount /system as rw both via adb shell, "onboard" terminal and through Root Browser.
Can i be of some help with a logcat, and in case how?
I am a software developer myself, but in a different branch than android. I just can't see through how i should get started with android development.
Great work guys
I guess i should add, that i still have my bootloader locked.
So to summarize:
>Bootloader locked (never unlocked)
>Firmware 23.1.A.0.690 from this thread
>Full root
>System R/W
Hey,
is there a chance to change the carrier name on the lockscreen? In the upper left corner it says "no service" but my carrier is already set up successfully.
Maybe its just because im from germany and its a generic rom or something. so is there a option to set up manually?
greets
Interesting, I did exactly the same but only have partial root, meaning that my system indicates root but I don't have writing permissions. Tried the ADB fix but did not work. Any other suggestions for getting full root again?
FYI: Nut has mentioned that he fixed recovery in his main development thread and will be working on releasing it to everyone soon.
Tnx for ur great work... but i have problem to download from mega site.. and specialy from the folder...
can anyone give me the direct link of [5.0.2] Firmware 23.1.A.0.690 Generic and A.5.77... not the folder link...
and can anyone tell me where exactly save the file we download from mega site ?
i cant find it anywhere...
Tnx alot.. :xX
How to delete recovery when it not working, thanks
Can't try new xposed for lollipop because it require install from recovery. And recovery not working in 5.0.2
air32 said:
Hey,
is there a chance to change the carrier name on the lockscreen? In the upper left corner it says "no service" but my carrier is already set up successfully.
Maybe its just because im from germany and its a generic rom or something. so is there a option to set up manually?
greets
Click to expand...
Click to collapse
edit the build.prop
what if I restore the TA Backup after that?
AndreDNA said:
what if I restore the TA Backup after that?
Click to expand...
Click to collapse
You would only need to restore the TA backup if you've unlocked your bootloader in the past.
I'm locked now, but it seem that I have to be unlocked to manage in upgrading to LP and keep the R/W is that right?
Sent from my D5803 using XDA Free mobile app
AndreDNA said:
I'm locked now, but it seem that I have to be unlocked to manage in upgrading to LP and keep the R/W is that right?
Sent from my D5803 using XDA Free mobile app
Click to expand...
Click to collapse
No, system rw is working atm with the newest(2.8.3) release from nut with locked bl. At least for Z3C . the system rw not working refers to other devices.
So when he manages to get the new recovery working you should just be able to install it. That is my hope at least. Anyway in case it doesnt you can backup with titanium backup and after flashing everything again just restore.
2mal16 said:
No, system rw is working atm with the newest(2.8.3) release from nut with locked bl. At least for Z3C . the system rw not working refers to other devices.
So when he manages to get the new recovery working you should just be able to install it. That is my hope at least. Anyway in case it doesnt you can backup with titanium backup and after flashing everything again just restore.
Click to expand...
Click to collapse
oh!
Really thanks for the answers, but I'm not sure to have understand (first sony for me).
I have kk, rooted and with locked bootloader. I have no recovery (I can't manage in flashing that without unlock), so how can I flash the preeroted LP?
I understand that if I backup TA, unlock BL, flash a recovery, flash a pre-rooted LP (after a full wipe), flash the last NUT recovery and then relock the BL restoring TA, I should finally have LP with root, R/W, and drm feature right? Am I missing something? Sorry for the High Noob Lvl xD
AndreDNA said:
oh!
Really thanks for the answers, but I'm not sure to have understand (first sony for me).
I have kk, rooted and with locked bootloader. I have no recovery (I can't manage in flashing that without unlock), so how can I flash the preeroted LP?
I understand that if I backup TA, unlock BL, flash a recovery, flash a pre-rooted LP (after a full wipe), flash the last NUT recovery and then relock the BL restoring TA, I should finally have LP with root, R/W, and drm feature right? Am I missing something? Sorry for the High Noob Lvl xD
Click to expand...
Click to collapse
Go to the thread of NUT dual recovery and (assuming your on a windows pc) download the installer for nut dual recovery. it will let you install the recovery on locked bootloader by running the install.bat file. with this recovery you can then flash a prerooted lollipop zip (you can do it yourself with prf creator, include the newest SuperSU zip and the newest dual recovery zip together with stock lollipop rom) after wiping your phone. people also just flashed over KK but i prefer to do it clean and set up my phone newly again. you will then end up with a phone which has system rw and root on lollipop but the recovery will be gone until NUT fixes it. That is what everybody is waiting for.
So unlocking BL wont really gain you anything except sonys DRM keys not working. it will just introduce an additional step to relock them.
Here is the thread: http://forum.xda-developers.com/showthread.php?t=2261606
to get into recovery just spam the volume up button(or down since it has two recoveries ) when your phone boots and lights up the led.
Hi there,
I think we should make a simple thread to sum up everything we know about root, since the main talking thread is long, here are the main informations:
Xperia Z5:
- No locked bootloader root yet
- AndroPlusKernel: http://forum.xda-developers.com/xperia-z5/development/kernel-andropluskernel-v1-t3246100
- TWRP here http://forum.xda-developers.com/xperia-z5/development/twrp-2-8-7-0-z5-rootable-kernel-t3240032
- CWM booting but not usable: http://forum.xda-developers.com/xperia-z5/development/recovery-clockworkmod-recovery-sony-t3249782
- Unlocked BL dirty rooting available and working as intended: http://forum.xda-developers.com/xperia-z5/development/dirty-root-solution-unlocked-bl-t3233274
- Dumped original firmware: http://forum.xda-developers.com/xperia-z5/general/ftf-files-sony-xperia-z5z5-dual-t3214397
- Xposed works but you need to let it bootloop a few times
Xperia Z5 Compact:
- No locked bootloader root yet
- Zombie Kernel testing release here: http://forum.xda-developers.com/z5-compact/orig-development/kernel-zombie-t3224735
- Unlock bootloader root available (http://forum.xda-developers.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524)
- Prerooted firmware available for unlocked BL: http://forum.xda-developers.com/z5-...-rooted-32-0-5-32-firmware-one-click-t3231520
- Xposed doesn't work with prerooted firmware
Currently we need to:
- Compile Zombie Kernel for Z5
- Improve TWRP support
- Create prerooted-firmware
- Most obviously and most hardly, find exploit for Locked BL root
Ok I'm not an Xperia pro, just got my first one few days ago, but still a android and linux geek, so if there is mistakes in my post, or update I haven't seen, notify me
Knux14 said:
- Maybe dump the original firmware ?
Click to expand...
Click to collapse
If I'm not mistaken, I think it already has: http://forum.xda-developers.com/xperia-z5/general/ftf-files-sony-xperia-z5z5-dual-t3214397
Need root for Z5, thx for efforts.
Uclydde said:
If I'm not mistaken, I think it already has: http://forum.xda-developers.com/xperia-z5/general/ftf-files-sony-xperia-z5z5-dual-t3214397
Click to expand...
Click to collapse
Updated
Test kernel for Z5:
https://mega.nz/#!15oSGLiA!N-lOlfn8RS9_gN_GcVJrFzXg21nzL1xDdt1xKujl9is
This is stock Z5 kernel modified to disable Sony RIC, dm verity, etc.
It should work together with the Z5C rooting solution:
http://forum.xda-developers.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524
Please report back.
nilezon said:
Test kernel for Z5:
https://mega.nz/#!15oSGLiA!N-lOlfn8RS9_gN_GcVJrFzXg21nzL1xDdt1xKujl9is
This is stock Z5 kernel modified to disable Sony RIC, dm verity, etc.
It should work together with the Z5C rooting solution:
http://forum.xda-developers.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524
Please report back.
Click to expand...
Click to collapse
You are the man, you saved me
my phone works now with root access
nilezon said:
Test kernel for Z5:
https://mega.nz/#!15oSGLiA!N-lOlfn8RS9_gN_GcVJrFzXg21nzL1xDdt1xKujl9is
This is stock Z5 kernel modified to disable Sony RIC, dm verity, etc.
It should work together with the Z5C rooting solution:
http://forum.xda-developers.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524
Please report back.
Click to expand...
Click to collapse
Huge thanks, But I can't get it working...
I open BL, I fastboot flashed the kernel, then I fastboot booted on the recovery (Which doesn't show a black screen as expected but a real non-fully-working twrp for me) and I tried to install Supersu but I write an error then...
EDIT: Kinda glitchy to do, but works.
If anyone has Xposed working, please make a tutorial
Okay so this is my first Xperia device and my second android device (used to have a Nexus 5 so rooting was simple). Can anyone ELI5 the root situation?
I understand that the TA partition contains DRM keys to make X-Reality etc work and that unlocking the bootloader will wipe this TA partition and the features will stop working. My main confusion comes from - if other lollipop devices have rooting methods for locked bootloaders, why don't these methods work on the Z5? Sorry if this is extremely obvious and I'm an idiot.
Most android devices have either already unlocked BL or you have to. For example, Nexus 5 needed to unlock the BL, as well as the OnePlus One, but those devices don't contain DRM so you don't loose anything when unlocking
nilezon said:
Test kernel for Z5:
https://mega.nz/#!15oSGLiA!N-lOlfn8RS9_gN_GcVJrFzXg21nzL1xDdt1xKujl9is
This is stock Z5 kernel modified to disable Sony RIC, dm verity, etc.
It should work together with the Z5C rooting solution:
http://forum.xda-developers.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524
Please report back.
Click to expand...
Click to collapse
Worked in second attempt. First time reboot into recovery. New fastboot boot booted into black screen.
In following sequence it was necessary to add destination file name,
D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/
failed to copy 'SuperSU-v2.51.zip' to '/data/media/0/': Is a directory
D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/SuperSU-v2.51.zip
9055 KB/s (3989636 bytes in 0.430s)
harfot said:
Worked in second attempt. First time reboot into recovery. New fastboot boot booted into black screen.
In following sequence it was necessary to add destination file name,
D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/
failed to copy 'SuperSU-v2.51.zip' to '/data/media/0/': Is a directory
D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/SuperSU-v2.51.zip
9055 KB/s (3989636 bytes in 0.430s)
Click to expand...
Click to collapse
I did not had to :/
You guys work fast!
Unsure whether to root myself yet,
Kind of wouldn't mind being able to connect a ps3 pad instead of
Ps4 using the sixaxis app
I'm still confused here. I don't see clear instructions for root process, probably because this is my first Xperia device. Neither do I know if using this modded stock kernel and doing this adb thing few posts back will break the DRM thingy and camera features or not.
Falenone said:
I'm still confused here. I don't see clear instructions for root process, probably because this is my first Xperia device. Neither do I know if using this modded stock kernel and doing this adb thing few posts back will break the DRM thingy and camera features or not.
Click to expand...
Click to collapse
There is nothing clear enough for beginner yet. Sooner or later there will be a TWRP fully working and it will be easy.
Try the dirty method, but don't do things that you are not sure that will work. Ask us if needed
I don't want to lose features because of unlocked bootloader. I guess I'm going to survive without root til there's TWRP and pretty much flash n go root
You will maybe never be able to root without loosing feature. Xperia devices work like this for ages..
The only way you could would be that we find a flaw in Android, which could either arrive soon, or never...
Knux14 said:
You will maybe never be able to root without loosing feature. Xperia devices work like this for ages..
The only way you could would be that we find a flaw in Android, which could either arrive soon, or never...
Click to expand...
Click to collapse
Ages means..? I know that the Z1 is not so fresh anymore but we were able to root 4.2/4.4.4/5.1 without losing anything with locked BL. (I know nothing except following tutorials)
Sent from my E6653
Yes because there were security holes in android. For now we havent found anything yet in this version
harfot said:
Worked in second attempt. First time reboot into recovery. New fastboot boot booted into black screen.
In following sequence it was necessary to add destination file name,
D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/
failed to copy 'SuperSU-v2.51.zip' to '/data/media/0/': Is a directory
D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/SuperSU-v2.51.zip
9055 KB/s (3989636 bytes in 0.430s)
Click to expand...
Click to collapse
I did boot into TWRP (it was like tablet mode) mounted all partitions to be sure, flashed SuperSU from external sd. It is working. Thank you all
ChrissehB said:
Okay so this is my first Xperia device and my second android device (used to have a Nexus 5 so rooting was simple). Can anyone ELI5 the root situation?
I understand that the TA partition contains DRM keys to make X-Reality etc work and that unlocking the bootloader will wipe this TA partition and the features will stop working. My main confusion comes from - if other lollipop devices have rooting methods for locked bootloaders, why don't these methods work on the Z5? Sorry if this is extremely obvious and I'm an idiot.
Click to expand...
Click to collapse
Google "Verified Boot Android" .. there is almost 100% probability that locked bootloader root will never be achieved, because of this security feature. Verified Boot was introduced in KitKat, but almost nobody used it in so strict mode implementation... Until now, no single firmware using Verified Boot was ever rooted without either custom kernel (must unlock bootloader) or leaked engineering bootloader (try ask Sony engineers for it).
Hey seniors out there, am new guy on Sony things..i've spent three days to serch and read some pages, and how-to modding our xperia Z3+.
But seems cannot find the satisfied and clear answers, and finally i decided to post here, as i still confused bout alot of things to do.
First i'm E6533 variants, on the lateat Nougat release from sony, as i wanna full controll i need to root the devices, custom rom is a must thing for me. So the questions is :
1. Can we achieve root on latest firmware (Nougat)?. As ive tried some one-clik tools seems didn't work at all.
2. I read some post, there's rootable firmware using tool called ivy-root, in the post said its on firmware 28.0.A.8.266 which is lollipop versions. Can i downgrading the device to that specific firmware versions without brick??
3. As i concerned about DRM key backup, and how really important it was, so i need to root first, and the only way to achive whole things was downgrading??
Anyone please share and guide me. Thanks
Finally done, TA /DRM key backup, u locking BL and flashing the LineageOS by Quarx on my E6533.
Just wanna share you , in case someone needed or has the same questions above:
1. Downgrading to 28.0.A.8.266 i flashed through Flashtool.
2. TA,DRM key backup i used iovy-root tools, rund the .bat script, and keep that backup in the safe places.
3. Upgrading back to Nougat firmware, unlocking BL, flashing TWRP.
4. Flash LineageOS ,thanks @Quarx its really stable enough
SH1M4BD3 said:
Finally done, TA /DRM key backup, u locking BL and flashing the LineageOS by Quarx on my E6533.
Just wanna share you , in case someone needed or has the same questions above:
1. Downgrading to 28.0.A.8.266 i flashed through Flashtool.
2. TA,DRM key backup i used iovy-root tools, rund the .bat script, and keep that backup in the safe places.
3. Upgrading back to Nougat firmware, unlocking BL, flashing TWRP.
4. Flash LineageOS ,thanks @Quarx its really stable enough
Click to expand...
Click to collapse
Hi,i have the same problem,i'm not too god in that but i try to fix my Xperia z3+ Dual E6553
Can you help me with link for iovy-root tools ( this not mean that .zip file ? )
And one more thing,can you relate step by step the proccess what you do ?
Thanks and sory for my unknow
1. Just download flashtool latest versions would be better,
2. Download that specifics firmware version using Xperiafirm which its already incl. Inside flash tool.
3. Once it already downloaded, put your phone into flashmode (hold Vol- buttons togather while you plug into usb ports), once its done power on the devices.
4. Enable Usb Debug On developer options, download iovy-root tools here
https://forum.xda-developers.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597 remember this not Root your devices permanently, its just teml-root so that the TA backup can be done.
Extract and run the Tabackup.bat (in this step you might get some hang process wait till the tool doing the job, you might also need to retry the process untill TA backup done succesfully, indicates that you have taxxx.img extenttions inside the extracted iovy-tool folder.
Save it,ake some double backup,upload to your drive perhaps..
4. Request unloock head to sony official dev pages, follow every instructions that you got, once you have the code enter the fastboot mode (vol+ ) unlock your BL as sony provided the commands line
5 Profit now you have fully control your devices, flash twrp (i used Oliver's versions)
Hi everyone,
I was one of the early "plungers" for the XZ1c, so I unlocked my bootloader without any TA key backup, flashed Oreo (47.1.A.12.145), and got by with Xperifix. But now I want to upgrade to Pie for a plethora of reasons (e.g. development).
I did a bit of reading here and there, and I came up with a set of steps for me to follow (and maybe anyone else who wants to attempt the same). Please do correct me if I'm wrong, and risk a brick:
Method A:
Backup all my stuff (a combination of manually, TitaniumBackup, Google, Sony)
Download the official stock firmware for Pie (47.2.A.10.45) via Xperifirm.
Flash Pie with a full format, to prevent any instabilities from apps.
Flash j4nn's bootloader unlock hide kernel to get root + Magisk (v18.1).
Restore backups.
Method b:
Backup all my stuff (a combination of manually, TitaniumBackup, Google, Sony)
Download the latest firmware and kernel for Pie (47.2.A.8.24) from janjan's thread.
Flash Pie with a full format, to prevent any instabilities from apps.
Flash janjan's kernel to get root + Magisk (v?).
Restore backups.
I'm leaning towards method A, as it'll be a newer version of Pie, but I do have some questions I couldn't manage to find a clear answer for:
Will Google Pay work with either method? This is kind of a deal breaker for me, as contactless payments are prevalent in my region.
Is there a reason to use Newflasher over Flashtool? I had used Flashtool for my XZ1c (even before they added official support in 0.9.24.3).
Does the gimmicky slo-mo video camera feature still work?
Is it possible to get TWRP with j4nn's method?
@TheFuzzy, concerning janjan's kernel, there is no drmfix included in pie releases, so that kernel seems to be only somehow tuned stock kernel.
My kernel releases are stock identical, no tuning at all, the only difference to stock is the kernel patch to hide bootloader unlocked state.
I believe this is a great benefit even in case of lost drm keys, if you need to use google pay or such apps. And yes, by following alternate use guide, my kernel can be flashed and used with twrp.
As tested by @russel5 (with some help and ideas from me), google pay now seems to use Android Attest Key (as I've expected long ago to happen) to truly detect bootloader unlock state.
In case you have Android Attest Key _working_ (see here to find out), even my kernel would not help to hide bootloader unlock (you can test that with the linked Auditor app even while running my kernel).
Destroying Android Attest Key seems to help to make google pay working as tested by russel5 - I did not test that myself, but @russel5 might confirm (thanks again for your testing and your finds, russel5).
But it seems to be irreversible change - we might still try to do some backup and restore tests...
@j4nn Thanks for the info! It is a bit confusing to keep up with the differences between the different methods.
I used your bootloader with 47.2.A.10.45, and it works like a charm.
I flashed your kernel directly as I'm not interested in FOTA. I've not tried to flash TWRP as I was afraid it might break the bootloader hide unlock patch (unless there is a specific order to follow, i.e. flashing it over TWRP or vice versa).
I ended up using Newflasher too, as I had read about not flashing the persist.sin file, and it seemed too tricky to do it with Flashtool.
One odd side effect is that I required the patched kernel to be flashed instead of booted from via adb, otherwise the device would boot loop and boot with the stock kernel instead.
I wasn't able to use your patched Auditor app as I don't have another phone at Nougat to verify. Indeed, Google Pay did pick up on the bootloader unlock status (maybe because of the Attest Key), but I was able to re-enable it using the SQLite trick mentioned here. My banking apps work fine with MagiskHide, too.
@TheFuzzy, you may use my patched Auditor app just with your single phone, which you like to check your attest key in.
Just install the patched Auditor and scan the QR code available on google play store in the Auditor's screenshots, instead of using a second phone.
That will trigger the verification just fine and then the audit results are simply displayed on the phone.
hello,
I would like to flash lineage OS and get a phone without google.
can you confirm me what I have to do:
- enable OEM Unlocking ?? (isn't it exactly what we won't do before backup TA ?)
- downgrade in 47.1.A.2.324_CE1 with newflasher (before flashing: Delete Userdataxxx.sin and files ending in .ta)
- backup TA https://forum.xda-developers.com/xp...devonly-exploits-temp-root-to-backup-t3795510
-flash TWRP by adb
-flash lineageOS by TWRP
-flash a kernel ??? what to do with this : https://forum.xda-developers.com/xp...oted-kernel-hiding-bootloader-unlock-t3898711
thanks for helping me.
hazote said:
hello,
I would like to flash lineage OS and get a phone without google.
can you confirm me what I have to do:
- enable OEM Unlocking ?? (isn't it exactly what we won't do before backup TA ?)
- downgrade in 47.1.A.2.324_CE1 with newflasher (before flashing: Delete Userdataxxx.sin and files ending in .ta)
- backup TA https://forum.xda-developers.com/xp...devonly-exploits-temp-root-to-backup-t3795510
-flash TWRP by adb
-flash lineageOS by TWRP
-flash a kernel ??? what to do with this : https://forum.xda-developers.com/xp...oted-kernel-hiding-bootloader-unlock-t3898711
thanks for helping me.
Click to expand...
Click to collapse
Hi, I can help confirm a few things:
1. If by enable OEM unlocking you mean "allow the bootloader to be unlocked" in the developer options then yes, you need to do this and it won't damage your phone.
2. Downgrading to Oreo is a must to unlock the bootloader. You'll need newflasher to do this but it's a very easy and simple process. I think 47.1.A.2.324 is the fw I downgraded to but I can't honestly remember. Make sure to delete all TA files in the main folder but not the TA file in the boot folder. I did that the first time, entered a bootloop and had to use xperifirm to get back to stock pie and a working phone(not horrible but more work than I needed to do).
I also deleted the persist.sin file because I had read it was necessary to keep the android attest key(which I'm not 100% knowledgeable about) but i didn't delete userdataxxx.sin. I just made sure everything was backed up so I could have a clean flash/install every time with as few problems as possible.
3. Once on oreo, use the back up tools for your TA partition. This was the longest and hardest part for me because I didn't read the directions closely enough before hand. My problem was I didn't realize I had to open another command prompt after I established temp root in the first prompt. This sounds complex(at least, to me) but it's really not. Again, follow the instruction and you'll be fine. Now you can unlock the bootloader with your code and then restore the TA partition.
4. At this point, it's all up to you from where to go next. If you want to stay on Oreo, then flash TWRP through ADB and flash a rom, root it and enjoy. If you want a rom based on Pie, flash the latest fw with newflasher(deleting TA files and persist.sin) and then flash TWRP, rom and root.
I hope that little bit helps. I really can't give you any advice on lineage or a kernel as I am on crDroid but the devs are super helpful and hardworking on the forums and there are a lot of experienced members. If anyone can explain it better or I didnt' say it right, please correct me.
A.Karimov
Thanks a lot.
For you, why should I go for carbon and not lineage?
hazote said:
Thanks a lot.
For you, why should I go for carbon and not lineage?
Click to expand...
Click to collapse
No worries, I'm glad to help:good:
I don't have any experience with Lineage other than an old build on a tablet. I had considered flashing it but I really like having more freedom to customize things. CrDroid has been very stable for me. It is a very responsive and fast rom.