yashsingh1/xdaforums huggingface dataset:
[Xperia Play Android Development] axiomjunglist:
If someone is really desperate and/or ballsy enough, they could try flashing the R800i generic UK 2.3.2 firmware using Flashtool. Apparently you don't need an unlocked bootloader, as someone in the forums was able to successfully flash a locked R800a on Rogers to the R800i generic UK 2.3.2 firmware. That build is confirmed rootable.

http://xdaforums.com/showthread.php?t=1108239

But, it could potentially brick the CDMA radio and/or other fuctions. Plus, there's no flashtool images out there for the Verizon model so there's no backup in case it goes to hell.

But, could potentially work...
[Xperia Play Android Development] Mills00013:
Im so torn over whether thats a great idea or the absolute craziest. The only thing that i can think of that would stop the process would be getting your phone into the flash mode. I can reboot and hold the search button like im supposed to, and then it recognizes in windows as the usb flash mode for about ten seconds and then fails and restarts. Has anyone successfully done this? It shouldnt be that hard to get the system image from seus like all the other phones if we can just get into this mode.
[Xperia Play Android Development] dan-htc-touch:
it's a bad idea, you still wont have access to fastboot
[Xperia Play Android Development] axiomjunglist:
It should be the back button, not search. Same method as when updating within SEUS.

http://xdaforums.com/showpost.php?p=13313088&postcount=2
[Xperia Play Android Development] zaith1234:
Let us know how this goes.
[Xperia Play Android Development] radio five:
Thanks for the reply, sonicfreak360. Yes, I typed in "reboot recovery". I'm not sure about the latest kernel. I simply downloaded the kernel provided in the link.

I ended up using the "Easy Method", booting into recovery, doing a factory reset and starting the "Easy Method" from the beginning. I believe everything is now working. I have Superuser, so I believe I'm rooted. I even got the message prompting me to do a system update.

But I'm a little confused on how to delete the bloatware. I was expecting to be able to go to "manage roms" and uninstall some of this garbage, but the option isn't there.
[Xperia Play Android Development] sonicfreak360:
I have a nice guide on what to uninstall and how to do it! :)
[Xperia Play Android Development] Silvist:
Heyo everyone,

Whelp the first step was very easy Mills. It took about 1-2 min for it to boot off the recoveryPLAY.img in fastboot. Once inside i was able to navigate it just like a typical CWM, and it flashed the xperiaroot.zip file perfectly. Had absoutely no driver issues in Win7 x64. Awesome work yet again! :D
[Xperia Play Android Development] Mills00013:
Great to hear!

I think I'm going to end up removing the rest of the methods I have listed on the first page anyways since they were written the day root was broken and are mostly obsolete now, with the exception of the first easy method. And I think I'm going to leave it just like it is, without elaboration. As far as I'm concerned, 1-click-roots and easy methods are the cancer killing the advanced android community...
[Xperia Play Android Development] Amir_Clark:
I have successfully rooted my Play, now that i have root, its wanting me to download the OTA update i think, it never asked me to download it up until i rooted the device, do i ignore the update?
[Xperia Play Android Development] Mills00013:
There is no OTA update. Its just the update utility asking to check for an update.

You can delete the application that makes that call.
[Xperia Play Android Development] jami2976:
thank you Mills!!

just wanted to thank you for your easy method sir it was a piece of cake..maybe 5-6 minutes for the whole process!! you rock man!! thank you to all the devs working on this project you make our phones kick ass!:D
[Xperia Play Android Development] DooMLoRD:
@Mills00013

u are making the instructions [Second Method] too complicated ;)

if u just want root the simplest way is:

download my latest kernel (which already has autorooting)

get into fastboot mode

use this command to "hot boot" the kernel:

fastboot boot boot.img

u will now see new boot logo, ur device may or may not bootup fully, it doesnt matter

upon reboot u should have rooted system on stock kernel ;)

do test this out and let me know :D
[Xperia Play Android Development] Mills00013:
Excellent! I'll amend the first post this afternoon with your solution. I didn't like the other steps I had anyway. Youre way is definitely the best way, no doubt. Excited to see your new kernel being prerooted again!
[Xperia Play Android Development] Cubsfan3493:
Hey every time that I try using your kernel, I end up with the boot image that you implemented, and everything works, the only problem is it is suuuuuppppeeerrr slow...I have tried everything that I know how to, how do I fix this? Thanks in advance.
[Xperia Play Android Development] DooMLoRD:
"everything works"???

the kernel is ment for R800i / R800a and that too for 4.0 FW...

have u checked SETCPU? may be the min/max cpu freq might have got screwed...
[Xperia Play Android Development] Cubsfan3493:
Okay that makes sense then. I have the r800X and it freezes as soon as it boots up. Is there any chance you will be making one optimized for the R800X? I would for sure donate if you did.
[Xperia Play Android Development] AndroHero:
Sony have yet to release source code for CDMA kernel :p
[Xperia Play Android Development] antEris:
Thanks!

I would just like to thank mills and doom for there instruction, I had a few hitches here and there but I'm rooted on stock :D

Just deleted Verizon's crap exclusive Skype app, will begin debloating.......now!:p
[Xperia Play Android Development] Mills00013:
This is the issue we have had with Doom's kernel since the beginning.

If you get into the nitty gritty of the whole thing, you'll see your phone is actually running fine, its just the GUI thats having hissy fits. I would say that there is probably a conflict with the stock ROM's graphics driver and the way that it talks to doom's kernel. Everything at the shell level runs fine and perfect, its just the GUI that feels slow.

You can test this by using doom's amazing kernel with Fraser's amazing rom. It works just fine together, overclocking and all. So its just an issue with the stock rom.

The steps that doom detailed above are just for rooting. They are not for permanently using his kernel. When his kernel is booted or flashed (but his method says booting so that we can instantly go back to our stock kernel) it copies the rooting files into the system partition for us. Props to you, doom. You rock.
[Xperia Play Android Development] DooMLoRD:
has anyone tried the steps i suggested (hot boot and then reboot after some time)?

did it work?
[Xperia Play Android Development] mehdi.moha:
hey guys

i have unlocked my bootloader , thank you

but can i root me play ? cause my build is : 4.0.a.2.368

does it work on this build number ?

thanks
[Xperia Play Android Development] sonicfreak360:
I think so... but don't take my word...
[Xperia Play Android Development] mehdi.moha:
i rooted my play successfully , now i can't reinstall from SEUS .

my question is , if i factory reset and unroot my x-play , then can i use SEUS to receive new updates ?:confused:

or is that related to unlock boot loader ??:(

if so , never i can receive SE updates ??? :(:(:(:(
[Xperia Play Android Development] chatch:
2 days and I just cannot get adb to recognize this thing. Ive tried every driver there ever was. I feel like im missing something real simple, anybody help?

I mean ADB driver is installed. but on the prompt it just wont see it. It makes no sense.

Edit: tried on a different computer, worked first time. Whatever...
[Xperia Play Android Development] torsti:
Does it only works on r800x or can i root my r800i (with 2.3.2) also with These methods?
[Xperia Play Android Development] Cubsfan3493:
I don't know...it should be easier to do it with the r800i. Getting the bootloader unlock key is a lot easier, due to the fact that Sony Ericsson. Unfortunately, if you are GSM locked, I am not sure that it is available right now. But either way, this is not the right thread to look, I know for sure that you need to go here if you want it to be done right.

http://xdaforums.com/showthread.php?t=1043630
[Xperia Play Android Development] jami2976:
Removed post

Sorry wrong topic
[Xperia Play Android Development] jdedeaux:
in the fastboot terminal i keep getting the error "FAILED:Device must be rooted first" when i try to fastboot boot etc.etc.img ..... im lost
[Xperia Play Android Development] remy2501:
i've had my r800x for a day and hate it so far simply for this fact.. i've already maxed out. i came from an first gen incredible, i miss the amount of storage on it.. i'm trying to adjust from incredible rooting to xplay rooting, i am totally missing the ease of it..
[Xperia Play Android Development] crono141:
So trade it in for a different phone.
[Xperia Play Android Development] Blagus:
OK, after writing for 15 minutes I deleted my post since I found out something:

your phone is not SIM-locked, and has got fastboot enabled in TA.

First reflash with SEUS and decrypt firmware to have it for backup.

Then flash generic UK firmware.

Read IMEI, generate BL unlock code and unlock BL.

Flash back to Verizon's FW in case you need to.

If you still don't get IMEI after flashing generic FW, take TA backup from R800i/a phone, write it to your phone and use that IMEI to unlock BL. After that restore your TA.
[Xperia Play Android Development] zaith1234:
This sounds promising Ill give it a try when I am off work tonight. I already have TA buckup.
[Xperia Play Android Development] ace518:
best of luck to you sir.
[Xperia Play Android Development] zaith1234:
So since the UK firmware is based off a GSM phone I should in theory get the IMEI #? Also is the IMEI # built into the firmware or embedded in the hardware?
[Xperia Play Android Development] kenshindono:
Imei is built in the hardware rom (it's like a mac adress)

Guys before you did all those test ? Have you contacted Sony Ericsson Support to tell them that you need your IMEI to unlock your BL and asked them for a way ?

IT's 100% legit since they were the first to give the method and tools to make it...

You might have lost your time and it might just need to type a code. If i remember well on some device the code could be a 24 character length with many * & #
[Xperia Play Android Development] Mills00013:
So realistically flashing wont do this. We need a lower level tool like qpst.
[Xperia Play Android Development] axiomjunglist:
SE's bootloader page explicitly says "It is currently not possible unlock the boot loader for CDMA phones." I doubt very much they will change their stance at this point.

If this phone has a hard coded IMEI despite lacking the GSM radio firmware, it could possibly become recoverable by flashing the UK build. It's iffy, but nobody knows for sure since nobody has tried it yet. All we know is what we've heard from reports of people noting pins under the plastic 'barrier' covering the SIM slot on the back of the phone. It would be insane if they left it all intact, minus the proper firmware... but again, nobody knows for sure yet ;)
[Xperia Play Android Development] MAster224:
Tryed to flash the UK FW [PROT_VER="03";DATE="20110217";TIME="15:47:00";VER="R4A066";CXC="1234-5769";TYPE="S1_LOADER";UNIQUE_DEV_ID="EF5222F8EF219C7E30E2AB8A48BDED6E772911F3";SEC_LOCK_STATUS="LOCKED";OTP_DATA="4B6D71004714040816040028CDD880EEB001002000000000";IMEI="A1000017112429";AID_VERSION="0004";EROM_AID="0001";LOADER_AID="0001";SW_AID="0001";CUST_AID="0001";SIM_LOCK_AID="0001";HWCONF_AID="0001";PROD_ID="0002";ACTIVE_LOADER_AID="0001";MEMDEVS="02:00:002C:00B3:0000:00002000:00020000:00000800:00000040,03:03:0003:5344:0080:0003B598:00010000:00000200";MAN_ID="002C";DEV_ID="00B3";SIN_VER="0001";AID_TAMP="NOT_TAMPERED";MAX_PKT_SZ="00010000";AUTH_LEVEL="NONE";AUTH_MET="0001";CARD_PRESENT="YES";CARD_SIZE="16GB";CARD_DATA="UHJvZE5vPTEyNDktMjcwOQ1Qcm9kUmV2PVI2QQ1Db3BpZWRCeXRlcz0yMjA5MjcxMjU2DUNvcGllZEZpbGVzPTMwNjcNQ29waWVkRGlycz01OQ1PcmRlcj05MDE2OTUxLTEwDQ==";LOADER_ROOT="S1_Loader_Root_773f";EROM_ROOT="S1_EROM_Root_d601";SW_ROOT="S1_SW_Root_883f";CUST_ROOT="S1_Cust_Root_9603";SIM_LOCK_ROOT="S1_SL_Root_c422";HW_CONF_ROOT="S1_HWConf_Root_08af";BIM_STATE="DISABLED";] and then got an error on [Flashing adsp.sin]
[Xperia Play Android Development] zaith1234:
Awe you beat me to it.... Before you flashed the UK firmware did you happen to back up your TA like Blagus suggested. I think maybe the in our case the TA needs to be restored from a GSM device before you can flash the UK firmware I could be wrong though.
[Xperia Play Android Development] Blagus:
Yeah, take a look at your log. IMEI starts with A1000xxxx...

First, download Omnius (omnius-server.com). Install, run.

Select Xperia Play. Click Identify. Right click to log, copy to clipboard in English language. Then advanced, backup TA make sure you selected TA Misc and TA Advanced. Take backup. PM me both log and backup. Do not strip IMEI from log or backup file name, or any other key like device key, ESN, whatever...
[Xperia Play Android Development] Mills00013:
What are the steps needed to get omnius to recognize the phone? I cant even get the identify to work. I have tried booting the phone while holding both back and search, and neither seem to have any effect on omnius's ability to identify my device.
[Xperia Play Android Development] ace518:
I'm trying to do as you said. I'm having some trouble getting the identify part to work.

Edit: sorry didnt' see the reply above mine. But yes, thats the info I need and I'll send you mine as well.
[Xperia Play Android Development] zaith1234:
View attachment 619472

Power down phone. Select model from drop down. Click Identify then follow on screen. Which is hold back button while plugging USB in the power light should turn green.
[Xperia Play Android Development] Blagus:
Have you installed GGSEMC USB Flash drivers?
[Xperia Play Android Development] Mills00013:
Well it looks like I might have been having driver errors before, but now they are resolved, I'm for sure using the same drivers as zaith1234 up above. I can get my phone into the mode, and it connects, detects, and installs the drivers right, but omnius throws me this error:

Action journal
14:49:20 Identify
14:49:20 Shows detailed information about the connected phone.
14:49:20 Operating system: Microsoft Windows 7 Ultimate Edition (build 7600), 32-bit
14:49:20 Application version: 0.20.3728 (beta)
14:49:20 . The action name is 'Identification'
14:49:20 Selected phone type: Xperia™ PLAY
14:49:20 Selected connection method: USB EROM
14:49:20 i Instructions
14:49:20 i 1. Make sure the phone battery is charged to at least 50%.
14:49:20 i 2. Switch off the phone!
14:49:20 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
14:49:20 i 4. Press and hold the return back button, then connect the cable to the phone!
14:49:20 . The action started waiting for the user
14:49:40 . The action finished waiting for the user
14:49:40 Connecting via SEMC USB Flash Device (USB1)...
14:49:40 Device driver version: 2.2.0.5
14:49:45 e Error: Failed to start communication
14:49:45 . The action entered shutdown phase
14:49:45 . The action reported failure

Error code
# 22D0DD2890FD4919

Error details
---
53 FE 67 E3 DE 6E 0A CF 0C 2F 7D 48 18 77 52 62
FC 01 6A 13 AE 8F 34 28 04 13 A2 27 DF E2 E2 91
0C CD 88 7C B0 91 D6 DF 14 8E 12 6A 38 3A CC D5
4A 94 4A 73 C0 4B 43 25 DF 08 D0 98 48 67 02 1B
D5 5F 41 18 D0 F1 B6 75 2F 00 F2 BB F6 56 92 D9
C4 DF 03 F5 59 70 88 5E BC AD 62 E1 ED D4 BF C6
1A 9A 66 FD 10 A5 ED D9 C2 8C 7C 49 88 57 B2 77
A4 CB F6 37 7C 48 DD 7E
---

I dont know if this will help out at all, but I am in a virtual machine trying this, I havnt tried a native install. I dont think it would make a difference here, but I know back in the WinMo days, HTC's phones were a pain in the ass to flash from a virtual machine because of the connection dropping. Just a thought.

Edit: Just read elsewhere on the internet that it might be the cable I'm using. I have been using a blackberry micro usb cable. It hasnt given me any problems with anything else, but I just want to eliminate all my options here. I dont have my official xperia cable with me right now but will update in a few hours when I can try with it.
[Xperia Play Android Development] Blagus:
Virtual machine is the problem here. Omnius is sensitive regarding communication. Why don't you use it natively?
[Xperia Play Android Development] Mills00013:
Just because I've always used Linux exclusively. Fortunately I have a Windows 7 partition reserved just in case I ever needed it. I'll reboot and retry there.

Edit: I submit to you, Sir Blagus. You are a gentleman and a scholar. Need/want a copy of my log now that I've gotten it for any debugging purposes on your end? I also made a copy of my TA for safe keeping.
[Xperia Play Android Development] MAster224:
Welp i just sent the files / log to the Blargus hope he can get this show on the road
[Xperia Play Android Development] Mills00013:
Blagus, I sent you my files as well just in case.

On another very interesting note, I tore into the TA backup and there is a very peculiar string on line 48 (in my file at least):

\B2<1Ȩ\91\88\AB\F4hz_MG\C7>\B8\E1 A\EDs\DC\DCɗ\E1ԉ\89y\83\96\C7\97\F2U\B4fg\C5\C8\CD\D4o\AB\C3l\00\8FOP_ID="8620";OP_NAME="Verizon";CDA_NR="1245-4101";ROOTING_ALLOWED="1";;RCK_H="9BD8EF33BBF52223575124F756F7615E1D5213374A92D9921EEEFEE5CEA970FB"\00CSERVERID="bmcsecs01";AUTHCERT="UNKNOWN";TIMESTAMP="110504 13:48:34"\00	\0000101-*\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00

In particular the variable that I'm excited to see is ROOTING_ALLOWED with its Boolean value pointing towards true...
[Xperia Play Android Development] MAster224:
Hmmm seems odd ^ maby we shall find out later
[Xperia Play Android Development] d2theaher69:
Subscribed. Hopefully it works for you
[Xperia Play Android Development] ace518:
If more files are needed I can follow the above directions and try to get them from mine too.
[Xperia Play Android Development] captain67:
Did you make sure wifi was off? Gingerbreak didn't work for me until it was shut off for some off reason. Mind you, mine is a different version, but I thought I'd throw that out there just in case.

Sent from my R800a
[Xperia Play Android Development] Blagus:
IMEI on Xperia phones is located in TA which is replaceable, and not on some lower level. And anyways, we can't access CPU with Qualcomm tools on Xperia because it's not supported.

ROOTING_ALLOWED is strange. It's in CDA info/customization area, however my research tells me that it doesn't do anything. It's set to 1 on phones repaired with FastGSM which doesn't have fastboot. It probably represents only factory state, plus, it's located in TA Normal. I guess actual flag is somewhere in TA Misc.
[Xperia Play Android Development] Mills00013:
Do you think it's possible the the unlock key is in the TA somewhere?
[Xperia Play Android Development] Blagus:
No, I doubt it is... since calculation from IMEI is possible, it's likely that bootloader checks the key with IMEI in TA, to see if keys match...

Anyways, since I'm getting PayPal very soon, and I hope that I'll receive some nice donations, development shouldn't be far away.

I'm making my website (Blagus' web) which will contain info regarding all this development.
[Xperia Play Android Development] gwaine:
I'm happy to donate, Blagus, for root on this thing!
[Xperia Play Android Development] ace518:
Blagus, If you figure out how to get us root, you have a donation from me.

Edit: just noticed on your page you want to get us CM7 too. If you get us fully working CM7 also, there will be a second donation from me.

Hopefully CM7 can be done while keeping the gamepad and Sony's PS store part possible.
[Xperia Play Android Development] rich1984:
You'll have a few donations from me as well. Root, cwm, cm7 #swag
[Xperia Play Android Development] Frogybloop:
For sure, I will absolutely donate for any combination of these things.
[Xperia Play Android Development] Blagus:
Donation link on the left will be ready in a day or two, just to get it verified ;)

If 60 people donate only 10$, it'll be enough ;)
[Xperia Play Android Development] ace518:
Which xperia play are you getting? International one or Verizon one?

N/M, just noticed you are not in the US... guess that means the cdma one i'm using is out.
[Xperia Play Android Development] Mills00013:
I've tried most every encompiled 16 digit string in the TA, so I'm leaning towards agreeing with you. Great news about setting up a donation link, I'll be more than happy to help fund the development. Also, if you choose to purchase a GSM Xperia over the CDMA one, I would be more than happy to mirror your development as closely as possible on the CDMA device, as I'm sure most of the people here would. Also, I work for Verizon, and if you had a desire to get a CDMA play, I could procure you one at cost, which will save you quite a bit off retail, assuming the Play doesn't go real cheap on ebay yet.

Being in the position you're in, and if your development skills are up for it, getting a CDMA device might be in your favor since there is a GSM radio in it as well, just locked down by firmware. Hacking this device open could lead to a phone with a lot more potential than its GSM brethren.

Edit: just checked ebay, and they look like you can pick one up between 400-420. Thats exactly wholesale cost, so it's pretty much the cheapest you would be able to find it. I'd say thats the avenue to pursue if you are interested in the R800x.
[Xperia Play Android Development] hairdewx:
The R800x is the CDMA version, if he is trying to root another model then this is the wrong thread ;)
[Xperia Play Android Development] ace518:
Perhaps he will raise enough to get both
[Xperia Play Android Development] Blagus:
Hmm... R800x would be the best option assuming the position you are in... however, in Croatia there are no signs of CDMA, and if I fail to turn on GSM, I'll just have an Android gaming console...

But I'm still waiting for help in modifying FlashTool to have TA backup/restore option and compatibility with decrypted Omnius backups. That's also needed for testing...
[Xperia Play Android Development] Mills00013:
Blagus, did the TA backups and logs we sent help out with anything yet?

Are you readily seeing any major differences or is it basically just an MEID where the IMEI usually is?
[Xperia Play Android Development] Blagus:
Trim Area of CDMA Plays is sooo small! 38KB compared to ~80KB on GSM Plays.

TA Normal is MUCH smaller than GSM version, and TA Misc is more or less the same...
[Xperia Play Android Development] zaith1234:
So if we restore the TA from a GSM play it won't have the correct IMEI # instead of the MEID?
[Xperia Play Android Development] Blagus:
It will have IMEI... assuming that SE didn't put MEID in OTP as well... although that check is performed only in bootloader, so the TA IMEI is the one visible to running system...
[Xperia Play Android Development] zaith1234:
So in theory we should be able to restore the TA from GSM phone get the IMEI unlock then restore the original TA.
[Xperia Play Android Development] Blagus:
yeah, since bl lock state is not in TA after all, as tested by one user...
[Xperia Play Android Development] Mills00013:
So then, I guess this is the game plan?

1) Obtain GSM TA backup (and IMEI from the phone it was backup from) and TA backup from CMDA device.

2) Flash TA backup using Omnius.

3) Obtain unlock code from Ericsson.

4) Attempt unlock

5) Assuming successful, reflash CDMA TA and you will be left with an unlocked phone?

6) Assuming unsuccessful, reflash CDMA TA and pray it gets you back?