yashsingh1/xdaforums huggingface dataset:
[Xperia Z Original Android Development] Androxyde:
From Flashtool, raw device backup / restore does those two checks before processing :

Is device rooted ? yes then continue, else cancel operation

Is busybox installed ? yes then continue, else cancel operation

From the "My device" menu you can fine a entry to install busybox :)

the raw device backup from flashtool produces 2 files : the ta image and a file named ident with contains a userfriendly string of your backup. this string is input from the backup feature :)

you can do multiple backups

when restoring, the restore feature asks you which backup you want to restore.
[Xperia Z Original Android Development] schaggo:
Installing busybox won't change anything, check the path highlited above.

Have you root for sure at the very moment you try? I didn't check the script what exactly it does at a given moment, but it seems to me you don't have proper root and thus pushing busybox to /data/local/tmp fails.

I'd do as follows: you are unlocked, so go and flash Doomlord's kernel. Then use the recovery that kernel provides to flash any desired superuser package (there is superuser by ChainsDD, the new superuser by Koush [clockworkmod], and supersu by Chainfire) and thus obtain full root over your device. Then restore your TA, reboot to flashmode and flash a compatible kernel, eg. any stock kernel using flashtool to get your device booting again. Piece of cake :D

---------- Post added at 01:46 PM ---------- Previous post was at 01:43 PM ----------

I'm only with Sony since the 2012-line, so I'm not fully informed. But, I believe there is something called Testpoint or so on Sony or at least earlier on SonyEricsson devices, this should put the device in a mode which could be similar to UART or JTAG modes of other devices.

A simple linkage to a google search which might reveal some more as I honestly cant: https://www.google.com/search?q=sony+ericsson+testpoint
[Xperia Z Original Android Development] :
[MENTION=4322181]Tungstwenty[/MENTION]:

unit 2:66667 is unique device key, which used to crypt sensitive data, like DRM keys.

during official "bootloader unlock" it is erased, thus rendering DRM keys useless.

unit 2:2226 is device unlock key.

If this unit present and allowed by ROOTING_ALLOWED value in hwconfig, then it is checked by semcboot via some weirdo-hash-etc things against RCK_H value in hardware config - one of 3 core security units.

hwconfig is signed unit, so it's modification not possible.

i have strong feeling that DRM keys are NOT tied to anything other, than device key unit.

i will try to copy DRM keys + device key from one phone to other later today and report my results.

beware :

if trim area image will be modified externally without proper checksum calculation, phone will be hard brick and it can only be fixed by writing proper trim area image by means of external programmer, like jtag ( if jtag not disabled permanently and can't be bypassed )

same goes to damaged hwconfig unit.

ergo - do not play with trim area on sony phones.

[MENTION=2613436]Egan[/MENTION]:

so, writing 0002:08B2 unit is enough to have unlocked bootloader with DRM keys intact.

as for "bravia engine", i'm sure it just checks "bootloader unlocked" status - so it can be bypassed by patching some system libraries.

lib_get_rooting_status.so is root of evil ;)
[Xperia Z Original Android Development] Osyx:
Wasn't that a way to unlock bootloader without loosing DRM keys? But any way I don't think those exists on the Z since we'll need to remove the whole backpane to reveal it and that would be quite a job, but in case they do exist I don't think anyone would use them anyway because of the placement.
[Xperia Z Original Android Development] Egan:
I'm not sure the DRM keys are intact. The actual TA data was more or less the same size as when I unlocked it the Sony way, much less than locked TA. Would be great if I'm wrong :).

I'm going to send you and Tungstwenty a dump of my TA after I wrote to 0002:08B2 to see what the actual difference are compared to after the official unlock method. To me they look pretty much the same. Can it be that Sony changes TA at next boot after any unlock?
[Xperia Z Original Android Development] that-fat-old-man:
Removing the backpanel shouldn't be that hard. All you need is a hairdryer and a piece of gaffa tape to pull off the backpanel. You could also use a suction cup instead of the tape. Not sure if the device will be water resistant after this operation. Wasn't there someone in here who removed the backpanel after bricking the device? Maybe you could provide some pictures if there are some sort of rubbers to keep it dry?
[Xperia Z Original Android Development] :
[MENTION=2613436]Egan[/MENTION]:

you are wrong ;)

[MENTION=5222812]that-fat-old-man[/MENTION]:

it is all useless
[Xperia Z Original Android Development] babylonbwoy:
Yes it's the now famous gm007 XZ

For those who are not familiar with the unlock testpoint method : thread for 2011 line http://xdaforums.com/showthread.php?t=1730874
[Xperia Z Original Android Development] Egan:
[MENTION=4322181]Tungstwenty[/MENTION] and [MENTION=3665957]the_laser[/MENTION]: The dumps after 0002:08B2 write are in your PM inbox :).
[Xperia Z Original Android Development] that-fat-old-man:
I remember. ;)

And I thought restoring TA while being on a custom kernel would lead to an instant brick. So I can still restore the stock kernel after I have restored TA? Really, is it that easy? Then I guess that it will only lead to a softbrick that can be fixed by flashing any stock kernel...

I will try it again tonight. Must have been root that was missing. I used Goroh_kun's method to get root access in the first place. I dumped my TA, unlocked bootloader, replaced stock kernel with Doomkernel, restored stock rom, used the exploit again to regain root access and this is where I'm stuck right now, because Backup-TA can't find busybox runtime. This is fun. :)

What bothers me here is that the exploit worked for the first time and somehow failed the second time. I had no problems getting my TA dump. MD5 were identical and I dumped that thing five times just to be safe. Guess I can exclude having a corrupt dump.
[Xperia Z Original Android Development] Osyx:
Yes exactly, you won'r be able to boot since stock rom looks at the kernel signature but you can get into fastboot and flashmode :)
[Xperia Z Original Android Development] flipz0r:
So does this mean I now can unlock my bootloader and keep all the feutures? If I backup the keys and then restore them.
[Xperia Z Original Android Development] Egan:
No, when you restore the backup the bl is locked again.
[Xperia Z Original Android Development] flipz0r:
Oh, ok. So I can unlock the bootloader and use it without for example bravia engine and then when i want to restore it to stock I can restore the keys and it will be like normal again?
[Xperia Z Original Android Development] Egan:
Thats right :).
[Xperia Z Original Android Development] schaggo:
As already answered: yes and no. Yes, brick; no, softbrick only.

I tried to voice several times that there must be "residue" left back from a first try/run, which more or less breaks any subsequent attempt to various degrees. I recommend a full-wipe after an unsuccessful try.

Anyway, now there is no need to run the exploit and have it fail, save yourself the hassle and do the following:

Flash Doomlord kernel

Have a look at Koush's new Superuser (https://play.google.com/store/apps/details?id=com.koushikdutta.superuser)

...and also get it on your sdcard (http://download.clockworkmod.com/superuser/superuser.zip)

Boot doomlord kernel recovery

Flash Koush Superuser from there

Reboot Android

Restore TA

Flash stock kernel with flashtool

Profit!
[Xperia Z Original Android Development] fareeed:
I was wondering do Sony have some sort of special method for generating each device's unlock key? Is it some sort of algorithm based on the idea? Or is the unlock code unique for every device? Thanks :)
[Xperia Z Original Android Development] Egan:
Actually, not necessarily. I have tried to restore my "locked" TA yesterday with DooMKernel still present and it boots just fine, only it sees the bl as unlocked, WLNA and Marlin keys are not ok and BE2 is not working.

Maybe only when the kernel is not based on the stock kernel like CM.

EDIT: Actually also the DoomKernel gives a soft brick. Tried it again to be sure.
[Xperia Z Original Android Development] schaggo:
This is weird then, as the kernel is unsigned code.
[Xperia Z Original Android Development] DooMLoRD:
on "locked" bootloader unsigned kernels will not boot..

and WLNA & MARLIN keys will show {OK}
[Xperia Z Original Android Development] Egan:
Thats weird, since I truly restored the locked TA. I used the same dump when I restored TA while being on stock kernel unlocked and that relocked it and brought back be2 and such. I will try this again tonight with DooMKernel and stock kernel to see what happens.
[Xperia Z Original Android Development] :
checked DRM keys + device key transfer.

it is "no go", cause beside that DRM key crypted with device key, it is also signed with IMEI

DRM key itself decrypted okay, but IMEI in DRM key certificate mismatched and thus rejected by system.
[Xperia Z Original Android Development] Tungstwenty:
Are you still talking about bootloader code and what it does with the sqlite db in TA entry 0x9C4?

Or is it already later on in userland code, such as the lib_get_rooting_status.so you previously mentioned? I haven't looked at anything else besides aboot and the ta dumps, but looking at the db table it can easily be seen that all entries are encrypted except for the last one ("copy_complete"). I'm assuming each device has different contents on this table.

But going back to the IMEI - is that done in userland code? If so, that could be patched to ignore the signature. If not, can you tell me which of the bootloader fragments (which partition) does that check?
[Xperia Z Original Android Development] Egan:
It appears I have done something wrong than yesterday :o.

Tried it all over again and got a soft brick indeed.

Also I tried the locked TA with the write to the 8b2 unit through Flashboot BLU and my ulcode.txt again, but as before no joy there.
[Xperia Z Original Android Development] Egan:
These are the differences I can see before and after 08b2 unlock write to a locked TA:

I erased my unlock key from the image but left the first 2 characters ("B8XXXXXXXXXXXXXX") intact.

Sent you and [MENTION=4322181]Tungstwenty[/MENTION] the same dumps so you guys can have a closer look than I can :).
[Xperia Z Original Android Development] :
[MENTION=4322181]Tungstwenty[/MENTION]:

unit 0x9c4 has nothing to do with DRM.

hwconfig ( imei, security status ,etc ) parsed in semcboot, it is sbl1+sbl2+sbl3+trustzone image, protected by qualcomm

signatures chain and can't be patched from user mode because of MPU ( at least no public solutions exists )

trustzone image provide functions to userland to check imei, rooting status, verify signatures, crypt/decrypt with device keys and so on.

addon:

examined their new semcboot ( can be found in boot.zip in almost every firmware package ) - they tighten things up - now emmc_appsboot delete unit 66667 ( device key ) if "bootloader unlock" unit present in trim area.

s1 security team thought of everything ;)
[Xperia Z Original Android Development] XperianPro:
Well since im pretty aware for long time what you guys told here but you are looking this from to far,I would reccomend flashing complete TA and whole data from another phone (at least on Novathor) with should give device new IMEI... And unlock network and bootloader lock at the same time.

I flashed key at 8B2 adderess and does not do anything because this adderess is not loader if BOOTLOADER_ROOTING_ALLOWED is 0 and whole this line is "signed" and key which is signed is most like IMEI.

Going to keep you informed if I find something new.
[Xperia Z Original Android Development] :
well, buy new phone and then try to "flash complete TA and whole data from another phone"

xperia u is cheap phone, it will not hurt your wallet ;)
[Xperia Z Original Android Development] lilstevie:
This is by far the single worst piece of advice you could give anyone. If you read through this thread you would have seen that someone already did this, and bricked their phone because of it.
[Xperia Z Original Android Development] XperianPro:
You cant flash only TA,because there are other things that needs to be flashed to,it cannot be done on qualcomm devices but on Novathor there is fair chances.
[Xperia Z Original Android Development] lilstevie:
but this board is for Xperia Z only, which is a qualcomm device.
[Xperia Z Original Android Development] erfandl:
Can it work on XPERIA ZL ?
[Xperia Z Original Android Development] demonicangell™:
Some tried it on ZL and i think it didnt work ?

would be awesome if it works or in future :fingers-crossed:
[Xperia Z Original Android Development] Egan:
It works on ZL also. At least two ZL owners already done it.
[Xperia Z Original Android Development] Wahad:
Can you unlock bootloader and then return this DRM keys so you can have unlocked bootloader + BE2?
[Xperia Z Original Android Development] mirhl:
NOOOO!

for the tenth time: DRM keys are bounded to bootloader status (up to now)

choose what is more important for you: custom kernels or BE/music info
[Xperia Z Original Android Development] Dsteppa:
When you restore the partition the bootloader will be locked again.
[Xperia Z Original Android Development] munjeni:
Any one dumped boot loader and burn them into ida for getting all string references? ...I tried but unable to decompile them, no understand how to find "unpacking" ofsset in order for propertly loading them into ida and decompiling them
[Xperia Z Original Android Development] 666pounder:
Does it work for xperia t?
[Xperia Z Original Android Development] Cookie Ninja:
Congrats OP, this thread has been featured on XDA news!

Dead cookies leave no trails...
[Xperia Z Original Android Development] rickwyatt:
yep iv just noticed lol :)
[Xperia Z Original Android Development] Egan:
Yes, it probably also work on Xperia T. The TA partition is also on mmcblk0p1 so I see no direct problem here :).
[Xperia Z Original Android Development] danw_oz:
try it
[Xperia Z Original Android Development] Tungstwenty:
If you want to decompile the ARM code at the right loading address, do the following:

- the dword at 0x0c is the loading address, e.g. for sbl2 (mmcblk0p3) it's 0x2e000000

- the first 0x28 bytes are the header, and are skipped when loading to the target address; in other words, the byte at offset 0x28 will go to 0x2e000000, 0x29 to 0x2e000001, etc.

- the dword at 0x10 is the total length of the data, e.g. 0x22920 for sbl2; at 0x22920+0x28 of the dump, you'll start seeing 0x00 instead of the padding 0xFF's

- at 0x14 you have the length excluding the signature, or the start of the position with the signature; e.g. for sbl2 it's at 0x21020+0x28

Just use whatever tool you want to load the bytes starting at the dump offset 0x28 to address 0x2e000000

This structure seems to be valid for all the code partitions except for sbl1, where the values are:

- 0x14 has the total length of the header: 0x50

- 0x18 has the loading address, 0x2a000000

- 0x1c has the total length

- 0x20 has the length excluding the signature

- 0x50 is the first byte, loaded at 0x2a000000
[Xperia Z Original Android Development] coilbio:
I'm Trying to use this on my ZL but I get 4 error messages.

the first two are permission denied for /dev/block/mmcblk0p1

and also the md5sum

the next error message is "sdcard/TA.img" doesnt exist

and the last one states it cant open the backup md5, this one is because there is no image that was backed up.

my phone is rooted with the stock rom.

Any Ideas?
[Xperia Z Original Android Development] lilstevie:
you first need to root your device
[Xperia Z Original Android Development] coilbio:
It is rooted, I'm also using apps that require root without a problem.
[Xperia Z Original Android Development] gm007:
I did TA backup unlocked my bootloader than restored TA.

Everything went fine :)

---------- Post added at 10:09 AM ---------- Previous post was at 10:08 AM ----------

Busybox?
[Xperia Z Original Android Development] coilbio:
Yeah, I already tried that. Still did nothing.

The furthest I got was when it tells you to open adb insecure.
[Xperia Z Original Android Development] Osyx:
Use [MENTION=2613436]Egan[/MENTION]s tool instead, it's more secure and have no adb secure, external busybox and so on.
[Xperia Z Original Android Development] Egan:
Little note: My tool expects that the device has already root and busybox. Most of the rooting methods include installing busybox, especially the Xperia Z methods. So it works out of the box for most users. If not, one can install busybox from Google Play Store. It does make no mention of it not being installed. However when my tool fails in the very beginning one most likely didn't root the device or hasn't installed busybox.
[Xperia Z Original Android Development] Osyx:
I meant external busybox, changed the post ;)
[Xperia Z Original Android Development] munjeni:
Any one want to post TA before and after unlocking just for making DIFF ...I found a tool, compiled them, (search in my profile/all post, its between Feb-Apr) for writing/dumping low level partitions, so I think if we make diferencies between old/new TA I think we will b abble to figure out what is need to be hex modified in TA dump for unlocking boot loader on "not allowed" boot loaders, just for idea!

Allso see this:

http://xdaforums.com/showpost.php?p=39211766&postcount=487

http://xdaforums.com/showpost.php?p=39212431&postcount=488

...there is very interesting things for AT@ command interpreter which I found on Xperia... for example if we found a password in an TA file maybe we will use AT@ command for broking lock? For example in relockbootloader.ftf (preser.ta) I found next thing:

seems password is "Blagus" ?? Just for idea!

Will be great if someone dump memory offset from 0 to 0x100000 and decompile them, just for finding what function is 0x0x000008B2

Allso next interesting thing in simlock.ta:

For example, if you dump your partitions and find offset for string "ROOTING_ALLOWED="0", maybe you can change them to the "ROOTING_ALLOWED="1" and write them back to the phone ??
[Xperia Z Original Android Development] DooMLoRD:
Blagus is the developer on XDA who found the way to RELOCK bootloader!!!
[Xperia Z Original Android Development] fareeed:
Anyone know where Blagus is these days? :P
[Xperia Z Original Android Development] :
@ munjeni:

units are signed with rsa 2048 length certificate.

@doomlord:

"blagus found way to relock bootloader" ;) ;) ;) it is how tales are born ;)
[Xperia Z Original Android Development] Maddhouse:
I have been following this from the start. Can I just confirm that by what the laser had said we will never be able to have unlocked bootloader with b2e due to encryption level?
[Xperia Z Original Android Development] zippy01:
Correct, or unless someone finds some security hole.
[Xperia Z Original Android Development] gm007:
the_laser said that bravia engine need patching some libs files.
[Xperia Z Original Android Development] ianrobbie:
Anyone confirm?

Hi.

I recently had some problems with my new Xperia Z. My first root failed and I had to unlock the Bootloader to install a pre-rooted .zip file.

When I enter the developers menu, my Bootloader status is unlocked.

Here's the thing.

I still have the Bravia Engine (It can be switched on and off in the menu)

Gracenote and TrackID still work.

Wasn't I meant to lose them when I unlocked the bootloader?
[Xperia Z Original Android Development] gm007:
You can switch be2 on off after unlocking but no effect on photos ;)
[Xperia Z Original Android Development] :
RCK is part of information string in simlock control unit and can't be changed, as simlock control units hash stored in simlock signature.

it can only be changed, when new signature generated via sony s1 security server.

DK is not signed, as it tied to DRM certificates, which tied to phone IMEI, which, in turn, tied to unique hardware device key.

to bypass all that stuff i can see few ways:

- find exploit in bootrom signature validation. Hardly possible, as such exploit was already found and qualcomm thoroughly rechecked code. But who knows, maybe there is some other exploit, just need to look from different view ;)

- find exploit in TZ BSP image, which allow us to patch it "from inside". Perhaps, possible.

- find exploit in S1 security and create own signature/whatever. Hardly possible - S1 security very simple and very strong ...

- break RSA 2048 keys for qualcomm sbl images part or for s1 signature part. Not possible for today, as far as i know.

-

regarding bravia engine - it seems to me, that it tied just to userland libraries, like lib_get_rooting_status.so.

even not, even it perform own call to TZ, it still can be patched ...
[Xperia Z Original Android Development] munjeni:
So that mean if I replace one bute in an block I will get hard brick? Some one confirm? Are you 100% sure about that? If I am not wrong I think I not found block signatures in my dump Any one analysed xperia things? Any one tried to use fotakernel partition for recovery?If I am not wrong, some one allready done these thing but using lkbootloader?
[Xperia Z Original Android Development] :
depends of what you will change.

change hwconfig ( unit 7d3 ) and you will receive hard brick.

change simlock control unit and you will receive phone without radio.
[Xperia Z Original Android Development] munjeni:
Ok. Just thinking something, not going to do anything related to the hacking Xperia things because its very diferent than HTC things and I am a simple BIG noob for Xperia low level things :o, without jtag simple I not going to try anything
[Xperia Z Original Android Development] Tungstwenty:
Yes, I've seen that too.

The RCK one has to enter when prompted (or write directly to 8b2) is such that its sha-256 is the value stored as RCK_H="..." in the SIN unit. It's therefore only doable from their side - they have assigned RCK values to each individual unit (or computed it somehow, but not reversable) and stored the hash on each device's TA so it only accepts its code.

Right. It's not the entire TA that is signed, but rather only some of the (critical) units.

These all seem very unlikely, right?

Is the kernel dynamic replacement (kexec, perhaps?) a no-go?

From my personal perspective, BE is really the only thing that would be nice to keep even with a custom kernel. DRM is something I personally live without :)

This patching is only possible if all the logic is done using "regular code" and not dedicated hardware such as graphic chips (or the cryptographic HW for the DRM).

If is implemented similarly to something like this:

if (isBootloaderLocked()) {
refineImage();
}

The "if" can be easily patched, yes. But if refineImage() were implemented through TZ, it wouldn't work since it would be inside the secure environment that the checks and the DK value would be used for the pics / video buffer to be "enhanced" (whatever that consists of).
[Xperia Z Original Android Development] mirhl:
Well, i'm not a guru like you.. but if you success with all this stuff.. wouldn't be possible to even unlock not unlockable bootloader?

Keep going :p