yashsingh1/xdaforums huggingface dataset:
[Xperia Z Original Android Development] Hullie NL:
Oke i followed the steps and when i tried to make ta backup i got this, what i do wrong?

----------------------------------

[ Backup And Restore TA ]

----------------------------------

[ (1) Backup TA ]

[ (2) Restore TA ]

[ (3) Quit ]

----------------------------------

Please make your decision:1

4096+0 records in

4096+0 records out

2097152 bytes transferred in 0.457 secs

(4588954 bytes/sec)

cannot stat 'C:\Backup-TA\tools\busybox'

: No such file or directory

Unable to chmod data/local/tmp/busybox:

No such file or directory

This is the md5 for phones TA

/system/bin/sh: data/local/tmp/busybox:

not found

4275 KB/s (2097152 bytes in 0.479s)

This is the md5 for the TA backup

4D0097742BDCA852B699A3FDF02E3723 C:\Bac

kup-TA\tools\backup\TA.img

----------------------------------

[ Backup And Restore TA ]

----------------------------------

[ (1) Backup TA ]

[ (2) Restore TA ]

[ (3) Quit ]

----------------------------------

Please make your decision:
[Xperia Z Original Android Development] Egan:
[MENTION=1457505]hullem[/MENTION]: Use this version instead: http://xdaforums.com/showpost.php?p=40404640&postcount=185
[Xperia Z Original Android Development] Hullie NL:
thanks...again it did not work, something wrong with my phone?

----------------------------------

[ Backup and Restore TA ]

----------------------------------

[ (1) Backup ]

[ (2) Restore ]

[ (3) Check Compatibility ]

[ (4) Quit ]

----------------------------------

Please make your decision:1

Backing up TA Partition to sdcard...failed

The backup was unsuccesful.

Druk op een toets om door te gaan. . .

Ill wait for a reply of op, maybe he knows...if not i will go ahead and unlock the bootloader and skip this backup...
[Xperia Z Original Android Development] Egan:
Is your device rooted?
[Xperia Z Original Android Development] Hullie NL:
yes it is rooted...using the method (link) in op

Maybe try to unroot and root again a solution?
[Xperia Z Original Android Development] Egan:
When that first step fails, it means you either have not rooted or didnt install BusyBox.

What is the output when you run this in a terminal: su -c "dd if=/dev/block/mmcblk0p1 of=/sdcard/ta.img"
[Xperia Z Original Android Development] Hullie NL:
Output is:

usage#2: su login command...

4096+0 records in

4096+0 records out

2097152 bytes trabsferred in o.411 secs
[Xperia Z Original Android Development] Egan:
Do you have USB Debugging enabled? That is needed when you run the tool.

Also when you run the tool (the first you tried) from the OP, do you have it in C:\Backup-TA?
[Xperia Z Original Android Development] Andrewtst:
Thanks a lot, I just success backup my TA and with same md5 check. :)

I will keep it for safe in case future need it. :)
[Xperia Z Original Android Development] Egan:
I did some examining myself of the TA dumps before unlock and almost immediately after. The diff is encouraging :)

What you see is that there some minor changes throughout the first half of the data. I do not know how important these minor parts are, but what really caught my eye was the last 1/3 part of the data. It appears that is the part missing after unlocking and causes a lot of the limitations unlocked devices have. Now whats even more interesting is the fact that the last 1/3 part of the data appears to be an almost copy of a little over first 1/3 part of the data. I still struggle with layering them on top of each other to see what the differences actually are, but it could well be that nothing(!) is lost when unlocking only not in the same spot as it was before.

When you do want the dumps this image represent I can send them to you.
[Xperia Z Original Android Development] gm007:
I don't know if this is something you already know but in the service menu,in security under service tests,there is some info about keys,maybe we should check before and after unlocking,or backup and restore for ta.

This pic is for my locked bootloader.
[Xperia Z Original Android Development] Egan:
Where under service tests is what you are showing?

EDIT: Found it!
[Xperia Z Original Android Development] gm007:
When you dial *#*#7378423#*#*

Service tests-security.
[Xperia Z Original Android Development] Egan:
Unlocked its the same as yours (locked) but MARLIN and WMLA have an "Unknown Error" instead of "Key OK", because it cant find these keys I guess.
[Xperia Z Original Android Development] Hullie NL:
Oke...i leave it for now, trying for hours...pfff...i got root and installed a couple of programs that needed root like tb root explorer...ill keep a eye out on this thread
[Xperia Z Original Android Development] Androxyde:
And if you rewrite your ta backup from locked status back to the phone, are those keys back to OK ?
[Xperia Z Original Android Development] Egan:
Yes, they are.
[Xperia Z Original Android Development] Androxyde:
great :)
[Xperia Z Original Android Development] shadstheman90:
So this is looking promising?? Won't to unlock my phone but don't won't to lose DRM keys :D
[Xperia Z Original Android Development] Thraxzzz:
A friend of mine just bought his Z, I checked under security and it's says that marlin and the WMLA is unknown error, but he still has his BE2...wonder why
[Xperia Z Original Android Development] Droidphilev:
aaaaargh....

i thought that with those marlin and wmla keys things were proven so finally i backed ta and restored. after reboot both of those keys again say unknown error :( :( :(

EDIT: PLEASE forget this post. to restore you need root. because of flashing stock rom root was gone. the tool only doesn't show that restore was unsuccessful because of not having root. it's ok now. all keys show up as 'ok' :)
[Xperia Z Original Android Development] lilstevie:
This isn't as promising as you would like.

This gives you the ability to restore your devices DRM keys, but unlock and DRM keys are still mutually exclusive.
[Xperia Z Original Android Development] schaggo:
lilstevie, you seem to get the deeper hang of it. What does this do then to unlocked devices, really? From your comments I gather, this tool is not Jesus blood and bones for the unlock-willing if you wish, it basically only undoes one more of the (many) things unlocking does.

This really makes me start wondering what else changes with unlocking... on the other hand, if all obvious traces and (negative) effects of unlocking can be mostly reversed, why even bother.

My motives: resale value. I'm a damn capitalist :D

Sent from my C6603
[Xperia Z Original Android Development] lilstevie:
What it does to unlocked devices is simple, it allows you to relock it back up to retail state.

So to set this out clearly:

What this does do:

Relock with DRM keys

Remove all traces of unlock

What this does *NOT* do:

Allow custom kernels with DRM

Run custom kernels while locked

Enjoy being unlocked with DRM keys being restored

This is why I say unlock and DRM are mutually exclusive, with this you can restore your locked TA and have DRM keys, but you cannot run anything custom, or you can enjoy being unlocked but you cannot have DRM keys.
[Xperia Z Original Android Development] fareeed:
The extreme Tl;DR: no doomkernel + bravia engine ;)
[Xperia Z Original Android Development] kraatus90:
sorry for noobish question . but i want to know is this method work with xperia s . because i made a backup of my phone's ta with this tool :cowboy: . but not sure if i unlock and want to restore ta later my phone will work or not :rolleyes:
[Xperia Z Original Android Development] lilstevie:
Your phone will work as long as you restore stock using emma/pc companion/etc. before restoring your TA, you can still restore back to stock after relocking, but AFAIK emma will no longer work.
[Xperia Z Original Android Development] kraatus90:
thanks sir :good:

so this is safe to use :D

i have to make sure this

1. backup TA

2. unlock , and use whatever rom + kernel i want

3. before restoring TA , i have to back on stock rom + kernel .

4. restore TA .

am i right ? :silly:

and thanks again :good:
[Xperia Z Original Android Development] Osyx:
Yes, that's alright.
[Xperia Z Original Android Development] schaggo:
This is the part I was interested in. Answers it all. Thanks. :thumbup:

The rest I know about and am aware of anyway.

It seems to brutally easy though, pulling and writing back the TA, I wonder why nobody thought of this earlier. Its not like the TA contents were unknown, or the partition was unknown, or the dd command is something new. Whatever, big thanks to all that contributed.

Sent from my C6603
[Xperia Z Original Android Development] fareeed:
My guess is that no one really tried messing with their TA because of the known risks (rip gm007's old phone :p) , plus imo devs don't seem interested in preserving DRM keys etc.
[Xperia Z Original Android Development] schaggo:
Good point, fair enough. Very welcome nonetheless!

Sent from my C6603
[Xperia Z Original Android Development] Egan:
I did some more digging into this. The last 1/3 part of the data indeed is more or less a carbon copy of the first 1/3 of the data.

This most likely means nothing is lost while unlocking the device. Sony appears to have 2 sets of the same data in TA and removes one set when unlocking, which results in the system thinking it lost its DRM keys while it actually has a spare set.

Its very tricky to even test something related TA, I don't even dare to do anything like that yet, so this is all theoretically. However with this info it becomes pretty likely that users who did not backup their TA before unlocking can get their TA back as it was before unlocking. Still long way to go before this info can actually be useful :).

EDIT: I decided to create another backup of the TA while unlocked. It appears now there is only one copy of the DRM data instead of two and it appears as if Sony is shuffling with data. Sometimes a block with data is at the bottom and some time later it is at the top. Looking for a pattern and a way to map these blocks of data.
[Xperia Z Original Android Development] thienbrand:
So...

1 - Which two MD5 we have to compare ?

2 - If I:

- Backup MD5 and matched.

- I flash roms and have fun with it...

does after a long time any of below MD5 change ?

And in that case can we still flash any stock firmware and restore TA ? And get BE2 back ?

---------- Post added at 03:51 PM ---------- Previous post was at 03:09 PM ----------

now I flash TA.img and my BE2 won't back. F!!!
[Xperia Z Original Android Development] Androxyde:
Check with ft ta backup. Ta struct as per S1 protocol i know is ta divided in partitions. One i dump is misc ta. In this misc ta you have many units (addresses?) And for each a data area. 8b2 unit in misc ta area is unlock code. In ft, to relock i simply write a zero lenght data to this unit to erase the unit.

Envoyé depuis mon C6503 avec Tapatalk
[Xperia Z Original Android Development] thienbrand:
help. i reflash TA.img but BE2 won;t back.
[Xperia Z Original Android Development] Egan:
I'm sorry Androxyde, you have to enlighten me on this S1 protocol (I have no idea what that is). I have the feeling there is something very important which I do not know yet and you do. Do I understand you correctly, that there is a way to extract areas from TA and rewrite them?
[Xperia Z Original Android Development] kraatus90:
reflash stock rom using flashtool :cowboy:
[Xperia Z Original Android Development] mysterio619:
What happens if I reflash ta when I'm on custom kernel??
[Xperia Z Original Android Development] Egan:
You'll soft-brick your device. The original TA can only work with stock kernels.
[Xperia Z Original Android Development] Androxyde:
OK, when the device is in Flashmode (for flashing Sony software for example), there is a protocol to comunicate with the device in this mode. That's what is called S1 protocol.

Basically, it offers a set of functions to comunicate.

So there is one function to open TA, another one to close TA, one to read TA and one to write TA :)

the openTA function takes one parameter which is the area to open (2=Misc TA, I don't know for the other areas)

I know that some TA parts are not accessible to those functions (or maybe, but with an authentification, protected areas).

The S1 command structure is explained here (some notes I took while investigating)
[Xperia Z Original Android Development] Maddhouse:
Sorry for the question but I haven't seen the right answer. If ta is backed up and restored, will Sony (warranty) find out and can it accept OTA
[Xperia Z Original Android Development] Egan:
Sony will probably not find out and yes you can accept OTA.
[Xperia Z Original Android Development] Androxyde:
[MENTION=2613436]Egan[/MENTION]

Here is a new beta :)

TA backup & Restore has now an history and when restoring, you can choose among set of previous backups :)

I reorganised Advanced TA menu too (S1 style backup and raw device backup).
[Xperia Z Original Android Development] Maddhouse:
Thanks for the reply, one last thing will this only work via flash tool unlock or Sony adb way as well?

I suppose both because you are just over writing the bootloader partion with the one before unlocking aren't you? Am I correct

Or what have you unlocked by and confirmed successful relocking and drm codes
[Xperia Z Original Android Development] Mr. Droid:
Question

If I back up my TA, unlock my bootloader play with cm.

If I Decide to come back to stock and restore my TA will bravia engine 2 still work?
[Xperia Z Original Android Development] plasmid09:
You can recover your phone. Just make sure you got QDLOAD mode.

Get tips from here: http://xdaforums.com/showthread.php?t=2136738
[Xperia Z Original Android Development] Egan:
The unlocking procedure of adb and Flashtool are the same, so no difference in which you use.

---------- Post added at 05:13 AM ---------- Previous post was at 05:12 AM ----------

That is correct.
[Xperia Z Original Android Development] lilstevie:
This device does not use MSM8660. QDL does not accept unsigned loaders on MSM8960 based cores which includes APQ8064 and MSM8260a(used in the Xperia T)
[Xperia Z Original Android Development] WWEpsp:
This should be pinned to first post, extremely useful and explains everything.

Anyway, i've read that after restoring TA partition its says "Relocked" instead of "Locked". ¿Is this true? :confused:

:good:
[Xperia Z Original Android Development] Egan:
Where did you read that? Anyway, its not true :).
[Xperia Z Original Android Development] :
heh, nice.

if we root phone with current exploits, then we can get untouched trim area image backup.

then, after we officially unlock bootloader, we can get another backup and fetch unlock key.

finally, need to write original trim area image backup and then write unlock key unit

voila - we have officially unlocked phone with DRM ;)
[Xperia Z Original Android Development] Egan:
Nice find! Will try that tomorrow.
[Xperia Z Original Android Development] gm007:
Things are getting serious,the_laser is here :)
[Xperia Z Original Android Development] Androxyde:
I thought about it from the beginning :) but feared to unlock my phone until im sure to get it back to original state. But yes i asked myself what if i write the 8b2 unit with the unlock code right in flashmode instead of writing it in fastboot mode as per sony tutorial ;)

In such cases no even need to have root and have untouched ta partition. Just get code from sony and write code to ta from flashmode (S1 tawrite)

Envoyé depuis mon C6503 avec Tapatalk

---------- Post added at 10:30 PM ---------- Previous post was at 10:03 PM ----------

To try, you can :

1 - check that custom\[DEVICESERIAL]\ulcode.txt file is there. if not, create it with your unlock code inside (one line no carriage return).

2 - restore your unlocked TA partition

3 - Use the BLU feature of Flashtool. As ulcode.txt will be found, code will be written to TA in flashmode

If you don't know your device serial, from DOS command, type adb devices and you will have it :) or from flashtool: Devices -> Check drivers and in the list of adb devices, you have it too.
[Xperia Z Original Android Development] :
to be honest, i'm never checked if unlock code written in "plain hex" into 0002:08b2 unit

( cause i'm just patched semcboot ;) ),

only checked actual 0x08b2 validation procedure.

it can be easily checked, if someone will provide ta dump after bootloader unlock and unlock code itself.
[Xperia Z Original Android Development] Egan:
When you haven't found a volunteer by tonight, I'll send you mine as PM. Just out of curiosity, can't you use your own?
[Xperia Z Original Android Development] DooMLoRD:
thats the plan ;)

so going thru the locked vs unlocked dumps :D
[Xperia Z Original Android Development] Egan:
[MENTION=2784807]DooMLoRD[/MENTION] && [MENTION=3665957]the_laser[/MENTION]: Look in your PM inbox for my before and after unlock TA with 5 minutes in between. Also added the unlock key used for this TA.
[Xperia Z Original Android Development] :
unlock code stored as plain ascii text.

Egan, can you restore "locked" trim area and perform unlock code writing using ta_write command, as Androxyde explained here ?
[Xperia Z Original Android Development] thienbrand:
Keep going guys, you are all awesome ;)
[Xperia Z Original Android Development] Egan:
Alright I restored the locked TA, the BE2 is working again and service info is telling me the bootloader is unlockable. I than performed the ta_write command and BE2 is not working anymore and service info is telling me the bootloader is unlocked.

So it did not work as we hoped. Perhaps it alters the TA the first boot after I write the unlock code with the ta_write command? The data of TA is smaller after the unlock code write than it was before.
[Xperia Z Original Android Development] Sermpie:
I followed this post from the beginning with good hope.... Now it sucks because i already unlocked my z haha.
[Xperia Z Original Android Development] Osyx:
Ehm? You said you followed it? Still you unlock it without backing up TA for even a reference or something? I must say that that's quite stupid if you were interested in this :rolleyes:

But it's up to one itself, anyway [MENTION=2613436]Egan[/MENTION] which tool are you using for backup and restore, yours or the Flashtool implementation?
[Xperia Z Original Android Development] Sermpie:
I unlocked my phone before this post.

I was only hoping to get drm back with this :)
[Xperia Z Original Android Development] Egan:
For now my tool since I know exactly what is being checked, double checked and executed. With TA I would rather play it on the safe side ;).

I will have a look at the latest Flashtool implementation tomorrow. I'm pretty hesitant when I'm not a full 100% sure all safeguards are in place. However I believe that Androxyde is doing a wonderful job on the implementation and the final version will be very reliable and as safe as it can be.
[Xperia Z Original Android Development] Androxyde:
feel free to send me a public dsa key I can propagate on the github repo so that you can participate to the dev ;) and you will be 100% sure :P

Help is always welcome ....
[Xperia Z Original Android Development] Egan:
Was planning on asking you, so this invitation comes at a good time. Will contact you about it some later this week :).
[Xperia Z Original Android Development] Androxyde:
Flashtool can dump some of the TA content (actually the ones I can access in flashmode) (from latest beta6 Flashtool : Advanced -> Trim area -> S1 -> Backup). The beta6 works with Z but any other previous sony devices as well ;)

The produced file format is the following :

UNIT(DWORD) DATALEN(DWORD) DATA(BYTE[DATALEN])

From there, you can easily create your own custom .ta file (a ta file can contain from 1 to n units) ... name it preset.ta and then create a ftf bundle containing only this ta file :)

When flashing the FTF, it will write your custom data to the Trim area :)

FT iterates through units from the ta file and write them to trim area using S1 protocol.

That is what was done before Z to relock devices :) a ftf containing only a preset.ta where 8B2 unit was written with a data array of 00 00 (to reset unlock code).
[Xperia Z Original Android Development] that-fat-old-man:
So since it's the same way to get the dump with Backup-TA as it is with Flashtool, I could just use the dump I got from Backup-TA to use it with Flashtool and create an FTF file, right?

Does it also work if I create a bundle with Flashtool containing a stock rom (that stock rom I was running when I created the dump of my TA) and the backup of TA including DRM keys? Would this work to completely restore the XZ to factory settings including DRM or am I mistaken here? Because if it would work, then restore could be done instantly with Flashtool. :cyclops:
[Xperia Z Original Android Development] danw_oz:
Not sure how you ever expected to get your DRM keys back, these are unique to your phone similar to IMEI number. Once they are gone they are gone for good, unless you crack/hack these (as some people do with IMEI), which goes against the rules of this forum.
[Xperia Z Original Android Development] Egan:
Unless they are not gone but only disabled. That's what we're here to find out too, but it doesn't look good so far.
[Xperia Z Original Android Development] Androxyde:
Not exactly. Ta dumps done with s1 protocol are not full. In such mode, i have a restricted access. The best would be to have a perfect knowledge of TA struct inside ta partition and have a native android command to perform read write to this area.

Envoyé depuis mon C6503 avec Tapatalk
[Xperia Z Original Android Development] Tungstwenty:
If invalid contents were to be written into the TA partition, would that result in a hard or a soft-brick?

The main unknown in order to manually edit the contents is the checksum at each section header (0x00000004, 0x00020004, 0x00040004, etc.)

If that calculation were to be found, would it be feasible for someone to try flashing a manually modified TA and then restore if it doesn't work? Or would the resulting condition prevent booting in a mode that allows doing that restore?
[Xperia Z Original Android Development] Osyx:
Most likely a hard brick, like the one [MENTION=4115953]gm007[/MENTION] experienced. Thought that was a completely different TA so I'm not completely sure. I'm just a quite advanced user thought so not really the person who should reply.
[Xperia Z Original Android Development] gm007:
Not sure but i think the bad backup provided by egan that i used has to do with the hard brick.

http://xdaforums.com/showpost.php?p=40320869&postcount=73
[Xperia Z Original Android Development] Egan:
The backup provided probably wasn't bad. At that moment we thought the TA was corrupt since the MD5 had changed, but later it appeared normal behavior for the TA to sometimes change data and thus result in a different MD5.

Your device got bricked because you restored a TA which was not from and for your device.
[Xperia Z Original Android Development] Tungstwenty:
Let me clarify a bit my question - is there any alternate or *emergency* boot path that would allow loading code from e.g. an sdcard, uart or whatever other means that would allow this to be experimented with? Or even a JTAG?

I'm assuming the classic fastboot mechanism doesn't work (otherwise you wouldn't be talking about a hard-brick in gm007's case) but for someone with the appropriate equipment there might be another way.
[Xperia Z Original Android Development] gm007:
Maybe an setool2?
[Xperia Z Original Android Development] that-fat-old-man:
If I dump TA using Flashtool in raw mode instead of using S1 protocol then I should get the same file I get with Backup-TA. At least I could use raw mode to backup up the TA I dumped with Backup-TA. I am having trouble restoring the partition with Backup-TA. I tried a couple of times, but somehow I always get the same error:

/system/bin/sh: data/local/tmp/busybox: not found

I already tried installing busybox and even with Flashtool I couldn't fix this. This is why I have to rely on Flashtool restoring may TA, but I guess this won't work either if busybox is not running properly.