yashsingh1/xdaforums huggingface dataset:
[Xperia Z Original Android Development] Blagus:
Hi guys, I came across this thread by an accident.

[MENTION=4597524]fareeed[/MENTION]: I left this Android thing, after my Play got stolen, I didn't have any other Android phone. I'm not interested in it anymore, I'm currently looking for Nokia N96 :p

the_laser said everything about security: S1 security is simple and tight, and I guess they have learned a lot about securing their phones after many years of improving it on various platforms (old school SE modder here). There may be an exploit somewhere, but who knows where to start looking (BL, QC ROM, firmware,...)

But it's interesting how restoring TA backup restores DRM, we couldn't do that on 2011/2012 series, DRM was somewhere else (I never took a deeper look at it, and couldn't do it ever because I quickly lost my Play).

[MENTION=3665957]the_laser[/MENTION]: You're saying that I didn't found out relock? It was me who spent time collecting dumps and analyzing them to find out about 8B2 unit. I actually delayed it for a week and half because I didn't test it immediately. Actually, yes, I should (and I did) say thanks to someone who reminded me back then and helped me with the actual FT script syntax (not FT dev), but don't speak about "tales" because I'm that guy.
[Xperia Z Original Android Development] Tungstwenty:
[MENTION=2784807]DooMLoRD[/MENTION], seems like there's stuff exactly like this :)

Have a look at: https://github.com/mkasick/kexec-examples/tree/master/epicmtd

The script (this is in the context of flashing a zip in recovery) remounts the partitions as R/O, syncs the filesystems, and then runs kexec to load the new kernel and then execute it.

I don't have the initramfs of the stock kernel handy, but judging from the S2's, one of the services of class core could be replaced with a wrapper that would check if the running kernel is still stock or if it has already been dynamically replaced.

If replaced, jump to the original service.

If not, do that logic of mounting the partitions R/O, sync'ing, and kexec'ing the new kernel (from a /data/zImage file, for instance).

If this fails (missing or invalid /data/zImage), fallback to the regular service so there's no bootloop if the 2nd kernel is not properly setup.

On the S2 one apparently good candidate would be /system/bin/servicemanager, as it starts very early and there's no real overhead of a wrapper since it is only executed once, at startup.

For a custom recovery, there's also a neat trick that might work on the Z:

Reading the contents of /d/gpio will give, among others, the instantaneous state of the physical buttons. On the S2, e.g. gpio-208 will change from "hi" to "lo" whenever the physical VOL-DOWN key is held pressed.

If the stock kernel includes the debugfs stuff and gpio is exposed there, querying the value of one of the physical buttons would be enough to detect whether the regular kernel boot is wanted, or if bootmode=2 should be used.

Can someone do the experiment? It can be done manually at first just to see if it works:

- place a kernel binary (zImage format needed?) on the sdcard

- boot normally

- open an adb shell

- remount the partitions as R/O

- sync

- use one of the kexec binaries to load the new kernel and jump to it, as one of the examples on the link above

I hope this turns out to be a practical solution for "production" use :fingers-crossed:
[Xperia Z Original Android Development] lilstevie:
This will only work on unlocked bootloaders, the kexec method used for the epic 4g requires a custom kernel on flash.
[Xperia Z Original Android Development] Tungstwenty:
I see, the stock kernel would have to be compiled with CONFIG_KEXEC=y :(

That feature isn't available for compilation as a module - I don't suppose the source (just 3 files if I'm not mistaken) could be adapted so it could be put in a .ko, insmod and then trigger it from usermode (even if not through the regular service calls, if that's not dynamically modifiable by modules at runtime)? :rolleyes:

EDIT:

It seems like it has been attempted before, found these 2 links about a kexec module:

http://xdaforums.com/showthread.php?t=1110048

http://www.networkedmediatank.com/showthread.php?tid=22303
[Xperia Z Original Android Development] lilstevie:
It is more than that, the epic 4g kexec uses something else, it reboots the system to give a consistent state (arm devices in a lot of cases haven't had the driver designed with the ability to kexec in mind). There is also a patch to the decompressor which is required on the host kernel, as the host kernel is started after the reboot but very early on in the decompressor it jumps off to the new kernel location.
[Xperia Z Original Android Development] umair42:
Will it work on Xperia U??
[Xperia Z Original Android Development] Egan:
I don't believe so.
[Xperia Z Original Android Development] schaggo:
Search, read, only one page back :mad:
[Xperia Z Original Android Development] zippy01:
So does this actually work? I'm about to see if my bootloader can be unlocked.

I'm actually a little confused because in service menu it says "Bootloader unlock allowed: No" But I have working fastboot.

I never checked fastboot untill today because I looked at service menu as soon as I got the phone and it said I cannot unlock so there was no need to check actual fastboot.

So if this method works I'll backup my TA with setool straight away and attempt to unlock the bootloader later
[Xperia Z Original Android Development] Tungstwenty:
If your bootloader doesn't allow unlocking, when running oem unlock 0xKEY... you'll get "Command did not succeed" and I don't think there's a workaround of that.

You can still use fastboot, but the commands you can use are very limited.
[Xperia Z Original Android Development] 666pounder:
So it doesn't work on xperia t?

Inviato dal mio LT30p con Tapatalk 2
[Xperia Z Original Android Development] :
[MENTION=4322181]Tungstwenty[/MENTION]:

i don't think that bravia engine is hardware based thing.

most probably, it is some driver in kernel or even userland library.

lets check ;)

[MENTION=2645841]Blagus[/MENTION]:

1.

most 2011/2012 series use NAND chip , block device protected by MPU and you can't backup entire trim area by root exploit.

it was possible by ta dump readout using patched loader or if use patched loader with enable high TA access.

( i'm intentionally not enabled it to prevent damaged DRM keys )

Here is patched loader with high TA access, View attachment r4a069.sin.zip, it can be used with any msm8x55 semc phone,

which have patched semcboot ( lowercase first digit in boot version output )

2.

honestly, i don't want to argue with you here - there is such things as PM.

but you can ask Binary, when we discussed with him about root enable key ...
[Xperia Z Original Android Development] Dsteppa:
Try it and tell us if it does. You can't always rely on other people to try it first before you do. And if you don't want to take the risk then I guess you don't really want to do it. In that case: What are you doing here?:p
[Xperia Z Original Android Development] Poustic:
I succefully rooted my phone but when i lunch the backup it say permission denied why ?
[Xperia Z Original Android Development] 666pounder:
Mmh do you have debug option on?

Inviato dal mio LT30p con Tapatalk 2
[Xperia Z Original Android Development] Poustic:
Of course
[Xperia Z Original Android Development] Maddhouse:
Have you installed adb insecure?
[Xperia Z Original Android Development] Poustic:
You guys think the problem is adb insecure? Cause i cant lunch it... Is it even needed ?
[Xperia Z Original Android Development] Maddhouse:
The first time I opened the cmd file it said make sure you have busybody installed then any key to continue next said make sure adb insecure is running press any key to continue and so on
[Xperia Z Original Android Development] lilstevie:
2012 Xperias use eMMC just like the Z does
[Xperia Z Original Android Development] amnher:
But what about 2011?
[Xperia Z Original Android Development] lilstevie:
I really can't comment on those devices. I haven't owned one so I don't honestly know
[Xperia Z Original Android Development] lzyllp:
2011 like arc use NAND chip
[Xperia Z Original Android Development] amnher:
Meaning? is there hope?
[Xperia Z Original Android Development] rickwyatt:
I said don't do this if you already unlocked your phone u have to be on stock Rom try using flash tool to refresh Rom because you've now locked your bootloader
[Xperia Z Original Android Development] gm007:
i was on stock rom.

flashtool cannot flash my phone anymore it's bricked.:(

i only have red light when i connect my phone via usb and blinking red in charger.
[Xperia Z Original Android Development] rickwyatt:
did you use someone else's ta file?
[Xperia Z Original Android Development] Egan:
That's bad, I'm sorry if that's because of my TA backup which appears not suitable for your device.
[Xperia Z Original Android Development] gm007:
you bootloader status= yes or no??
[Xperia Z Original Android Development] rickwyatt:
dose flash tool see your phone
[Xperia Z Original Android Development] gm007:
yes but i have this message
[Xperia Z Original Android Development] Egan:
Mine is still locked and the 350 firmware.
[Xperia Z Original Android Development] brutal_noise:
My bootloader is unlocked right now and the results from service test are absolutely the same as yours...
[Xperia Z Original Android Development] gm007:
but it service settings it say yes or no?
[Xperia Z Original Android Development] rickwyatt:
use the sony suite to flash your phone
[Xperia Z Original Android Development] Egan:
It says no, but it is unlockable.
[Xperia Z Original Android Development] gm007:
it's not recognizing my phone.

thanks :p that's why :(
[Xperia Z Original Android Development] rickwyatt:
Egan ta backup looks different from mine in every way can you get into fastboot
[Xperia Z Original Android Development] gm007:
no cannot access fastboot,the phone is dead.

only red light.
[Xperia Z Original Android Development] PeZoII:
Dude..i had same problem coz i charged my phone with an iphone 5 charger...what i did is plug the phone into an iphone 5 charger till the led stopped blinking...it only takes like a second or so..then plug to pc and you'll have a living XZ again..
[Xperia Z Original Android Development] rickwyatt:
what model of phone are you using?

Egan same question
[Xperia Z Original Android Development] gm007:
Thanks,i don't have iphone charger,i will buy one tomorrow.11:55pm here :D

i hope this will work cause i don't have warranty :(

if not i will have to buy a new phone.

C6602.
[Xperia Z Original Android Development] rickwyatt:
did you hold down volume and plug into pc when sony suite asks you to?
[Xperia Z Original Android Development] Halim2k:
Don't, I'm sorry to tell you that, but till now there is no way to fix your phone.

Never restore another phone TA to your phone, it'll bricks yours
[Xperia Z Original Android Development] :
[MENTION=1713162]lilstevie[/MENTION]:

sorry, i don't care about years.

things is : sony phones, which use nand flash ic, have protected by MPU most important partitions.

well, actually , can you get rpm firmware from msm8260 phones via android and patch it ?

if yes, then release simlock for newer msm phones and became millionaire,
[Xperia Z Original Android Development] pattawongse:
I'm tried this on XZ C6602(Rooted)

got error permission denied for /dev/block/mmcblk0p1

and also the md5sum

same coilbio got

so i decide to do it manually and it Work!:D

first run goto cmd in C:\Backup-TA\tools directory

1.launch adb shell

adb.exe shell

2.(to grant root permission)

su

3.copy TA Partition

dd if=/dev/block/mmcblk0p1 of=/sdcard/TA.img

4.open another cmd goto C:\Backup-TA\tools directory then run

adb.exe push C:\Backup-TA\tools\busybox data/local/tmp

5.back to first cmd agian run

chmod 755 data/local/tmp/busybox

6. Check TA partition MD5

data/local/tmp/busybox md5sum /dev/block/mmcblk0p1

7.back to second cmd run

adb.exe pull sdcard/TA.img C:\Backup-TA\tools\backup\TA.img

(now TA.img current in backup folder)

8.Check TA.img MD5

md5 C:\Backup-TA\tools\backup\TA.img

(this was MD5 of TA.img that in back folder make sure it same as step 6 MD5)

Hope this help :laugh:
[Xperia Z Original Android Development] tryout1:
Thanks for this trick, i really appreciate it :good:
[Xperia Z Original Android Development] shoey63:
Have you successfully restored manually? If so, would you mind posting the procedure here?
[Xperia Z Original Android Development] lilstevie:
That is exactly what he said in the part of the post you quoted.

If you read the rest of his post, you would have noticed that is exactly what he did.
[Xperia Z Original Android Development] shoey63:
I see only backup procedure and md5 check - no mention of RESTORE, hence my post.
[Xperia Z Original Android Development] draganz:
Will this work on other Xperia devices? [Xperia S, P, U, sola, go etc.]
[Xperia Z Original Android Development] Tungstwenty:
Parser for TA dumps

Here's the code I created for parsing the dumps that have been shared with me.

You can all easily compile it (Java JDK needed) and run with whatever dumps you have. The output can then be compared using Text Diff programs.

https://gist.github.com/Tungstwenty/5517424

For those not familiar with java, all you need is:

- the "javac" binary (comes with the JDK, not with the JRE)

- run "javac DumpXperiaTA.java", compilation should succeed

- from then on, run "java -cp . DumpXperiaTA <path_to_my_dump_file>" from that directory

I don't think you'll find much more than what was discussed on this thread so far, but here it it anyway in case someone finds it useful.

PS: When comparing, bear in mind that the blocks may be stored at different locations from one dump to the next, so you might need to reorder the information for the comparing to pinpoint just the relevant differences (presence / absence of some tokens or change in their values).
[Xperia Z Original Android Development] shoey63:
Thanks :thumbup:
[Xperia Z Original Android Development] danw_oz:
Maybe he didn't notice that he was in the Xperia Z forum ;)

---------- Post added at 12:54 PM ---------- Previous post was at 12:52 PM ----------

Maybe, Maybe not

I think if Sony think people have almost cracked this, they might find other ways to conceal this, like they do with root exploits...
[Xperia Z Original Android Development] newdon07:
a guy tried this on xperia S.... but he tried to restore his own phone's TA.img without unlocking bootloader, which resulted in hard brick of his device!!

so i want to know that shall we try this method?? because i am kinda scared, that if he hard bricked his device by restoreing his own phone's TA.img with locked bootloader, so it may possible that we also get our device hard-bricked after restoring our own TA.img even after unlocking BL!!

ANY SUGGESTIONS??
[Xperia Z Original Android Development] gm007:
Read page 13.
[Xperia Z Original Android Development] rohit25:
oh kay, have a query guys..... i am on stock sony rom, with doomkernel.... now if i backy my ta image.... is there a possibility of hard-bricking my phone..... or is it safe.....
[Xperia Z Original Android Development] fareeed:
Nope you've already unlocked your bootloader so it defeats the purpose, your DRM keys have already said bye bye forever
[Xperia Z Original Android Development] that-fat-old-man:
have you created your backup before unlocking your bootloader or after? if you did that before, than you can flash your backup of the TA, but if you're planning to do it now... well you can flash a backup of the TA that you created after unlocking the bootloader but DRM will still be gone.

I assume you created the backup before unlocking the bootloader so you should be good to go, if md5 matches... but as said by someone else before: flashing the TA is always risky because something might go wrong. for example, if flashing a particular firmware goes wrong, than you can still save your device, but if flashing of TA somehow fails, well then your f***ed. your device will be dead for good.
[Xperia Z Original Android Development] venky716:
I have root and busybox.

I followed all the steps but still get the following error.

There is a TA.img(2mb) in backup folder. Do i have a proper backup ?
[Xperia Z Original Android Development] Bioschnitzel:
To restore the TA Image, must i have Busybox and root again installed?
[Xperia Z Original Android Development] Osyx:
Yepp

---------- Post added at 04:53 PM ---------- Previous post was at 04:27 PM ----------

You've one proper, maybe, because you can't check the md5 sum of the phone so it can be corrupt.
[Xperia Z Original Android Development] rohit25:
okay, so here is what i am gonna try tonight..... i have doomkernel installed with stock sony rom..... would be doing a ta backup.... fingers crossed everything goes back......

any pointers i should i see too before doing the same....
[Xperia Z Original Android Development] Osyx:
If you have unlocked your bootloader without making a backup you'll never get your drm keys back, there's no use of trying.
[Xperia Z Original Android Development] rohit25:
i had made a backup before unlocking my bootloader
[Xperia Z Original Android Development] gm007:
If you want to restore your TA do it on your own risk cause it may brick your phone.It happened with me before.
[Xperia Z Original Android Development] chesterr:
I get the same error here, so does your TA.img file go to that backup folder or does it just hang in your internal memory?
[Xperia Z Original Android Development] Bioschnitzel:
But you have used an TA File from someone other....
[Xperia Z Original Android Development] gm007:
All the devs here confirms that restoring TA is very risky,even your own TA.
[Xperia Z Original Android Development] Bioschnitzel:
I know that is risky, but its always risky to flash.

A TA from another is 100% hardbrick and not risky :D
[Xperia Z Original Android Development] rohit25:
how did you recover you phone..... to cover all my sides and be prep'd for any collateral damage....
[Xperia Z Original Android Development] Osyx:
He bought a new one :rolleyes:
[Xperia Z Original Android Development] gm007:
How did you know that,you deserve a beer lol
[Xperia Z Original Android Development] lilstevie:
Flashing TA is way more risky than flashing a rom, with a rom you can just fastboot flash and

in most cases restore. Flashing a bad TA will leave you in a state where you cannot even boot

into Flash Mode or fastboot.
[Xperia Z Original Android Development] tommybrrr:
Isn't there an official re-locking from Sony that restores your DRM as well?
[Xperia Z Original Android Development] siapakahaku:
i'm confused...

i've backed up my TA with tihis tool

and i want to relock my bootloader

what should i do?

i've read doomlord's thread about unlocking/relocking XZ's bootloader

he relock BL using flashtool .2beta

if i want to relock my BL i have to use flashtools first and than restore TA.img with tihs tool?

or, i just use this tool to restore TA.img?

really confused...
[Xperia Z Original Android Development] harfot:
No
[Xperia Z Original Android Development] babylonbwoy:
If it already exist do you think they will waist their time and risk their phones finding alternative solution?
[Xperia Z Original Android Development] schaggo:
Understandably.

Restore your backup.

Old instructions, the method discussed here was not discovered at that time.

He simply relocks his bootloader without restoring DRM keys. Here we relock including restoring DRM keys.

Restore TA.img using the tool you created it with.
[Xperia Z Original Android Development] venky716:
Yes my TA,img was saved in C:\Backup-TA\tools\backup .
[Xperia Z Original Android Development] chesterr:
For some reason my TA.img file hangs in internal memory.

do you think it's safe to flash that? I did few times and it gave me the same md5.

This is way too risky to do it.
[Xperia Z Original Android Development] shadstheman90:
I backed up my TA partition then unlocked my bootloader with flashtools, my ba2 was still able to tick the box,if it still worked I have no idea. However I could not download music info it said scurerty error, so I flashed my backed up TA Partition and hay presto it worked:) it was like my phone was new
[Xperia Z Original Android Development] Osyx:
About BE2, yes you'll be able to tick and untick but there will be no difference on photos and videos anyway.
[Xperia Z Original Android Development] schaggo:
Out of personal curiosity, I'd like to ask: this is within the walkman app, right?
[Xperia Z Original Android Development] shadstheman90:
Yes that's right

---------- Post added at 03:12 PM ---------- Previous post was at 02:48 PM ----------

Dose any one know if you just have to back up TA just once or do you need to do it every time you unlock the bootloader???? If you get what l mean
[Xperia Z Original Android Development] schaggo:
Once. The DRM keys (and that's what we are doing it for after all) don't change. They get wiped, yes, but they don't change anyhow.
[Xperia Z Original Android Development] RHBH:
Guys, I read the whole topic (43 pages) and I couldn't find a exactly answer:

Will this work on Xperia S (LT26i)?

Anyway, I tried to backup my TA and got

/dev/block/mmcblk0p1: cannot open for read: Permission denied

My phone was never unlocked and I'm using stock rom/kernel, rooted and busybox instaled.

Do someone have an idea?

---------- Post added at 10:26 PM ---------- Previous post was at 10:02 PM ----------

EDIT

Nvm, forgot to enable adb insecure.

My TA backup seems to be ok.

Now I'm pissing my pants... so much scared of what might happen if I unlock my bootloader and then restore using the TA image.

Any guesses? Remember it's a Xperia S.
[Xperia Z Original Android Development] shadstheman90:
After I unlocked my bootloader. And restored ta,my text notification led light stoped working :( any one else have this prob....
[Xperia Z Original Android Development] wawyed:
Worse case scenario you will have to buy a new device.
[Xperia Z Original Android Development] RHBH:
So I'll save some money, and if the device gets bricked I'll buy a new one, maybe a Nexus 4, ZL or a Galaxy S IV.

---------- Post added at 07:58 AM ---------- Previous post was at 07:53 AM ----------

Also I tried check compatibility/backup with the backup-ta v6 and got "-la: no such file or directory", with v4 of tool the backup worked, I think it can be related to busybox, but it is installed as usual.
[Xperia Z Original Android Development] Egan:
Unrelated to backup and restore of TA.
[Xperia Z Original Android Development] RHBH:
One more question...

A guy flashed his own TA image on his Xperia S with locked bootloader and seems to hard bricked the device.

http://xdaforums.com/showthread.php?p=41060072

Is this a sign that this doesn't work for Xperia S or this tool is designed to restore TA image of UNLOCKED bootloaders only?
[Xperia Z Original Android Development] shoey63:
Del.
[Xperia Z Original Android Development] Mr. Droid:
How many people have been able to restore with out bricking there device after the unlock?
[Xperia Z Original Android Development] lhurtado:
I already restored TA twice, but manually using dd. Of course, this isn't the recommended method.
[Xperia Z Original Android Development] danw_oz:
Good idea

---------- Post added at 02:40 PM ---------- Previous post was at 02:36 PM ----------

Read the OP under section what i found out you will see this is information for the Xperia Z not S, so if anyone wants to try this on any other device that it hasn't been tested on, good on them and good luck. It will also answer your question above about bootloaders
[Xperia Z Original Android Development] rohit25:
will this ta backup work with stock rom and doom kernel.... really miss the be2.

p.s made a ta backup before unlocking my bootloader
[Xperia Z Original Android Development] mirhl:
No, because TA with DRM has locked bootloader

And locked bl doesnt'allow custom kernels, you will need to come back to stock one
[Xperia Z Original Android Development] RHBH:
You need be on stock rom and stock kernel when you restore or you'll soft-brick your device.