[Xperia Z Q&A, Help & Troubleshooting] Tungstwenty:
GTV method - kexec module

I'm not saying it wouldn't be *very* nice, all I'm saying is that the motivation isn't the same as if the bootloader was permanently locked, such as the AT&T S4.

Well, I did some further research on the GTV hack originally shared:

The root exploit, as stated before, is not relevant for the XperiaZ.

But the trick that is used for loading an unsigned kernel goes in the same line as I had thought about some time ago, although the response wasn't the one I expected. Again, perhaps partially due to the motivation not being AS BIG as if the lock was permanent for everyone.

The GTV kernel hijack is obtained by:

- using a kexec implementaiton as a loadable module, instead of relying on the kernel (the stock one doesn't include it); this is in the form of kexec.ko and x86_kexec.ko (the GTV uses a x86 cpu)

- a kexec binary to request the stock kernel (now with the extra module) to load a kernel image and run it, replacing the kernel with the intended (non-signed) one

- a hijack on the /system/bin/e2fsck binary to trigger the reload kernel+reboot; this e2fsck is executed very early on the /init process, even before starting to execute /init.rc; e2fsck is called here, from fs_mgr_mount_all within init.

In short, and considering there isn't a bootloader exploit so far, ideally a similar kexec solution might be theoretically possible for the XperiaZ.

The benefits would be huge, of course, as the bootloader would still be locked, the DRM key is still there, warranty is valid as long as the /system modifications can be reverted, etc.

What would be required: replicating what has been done for GTV (x86 CPU) and putting together a kexec ARM kernel module that could be loaded onto the stock kernel.

Pretty much, "that's it" :D.

The thing is: the GTV team mentions that "It took a little work, but it paid off". I'm not sure how good/stable is the ARM kexec implementation on the android kernel sources nor whether they can be pulled to a module instead of bundled with the kernel.

I did see some tricks on the GTV implementation so the module can attach to certain parts of the kernel - such as finding the syscall table and manipulating it. I don't know if reversing the modules (or even obtaining the sources from the team) is enough to get this working on the arm platform.

I am not sufficiently versed on kernel development to investigate this on my own; I don't even have an Xperia Z yet. But if any true kernel developer wants to pursue this approach, I'm more than willing to continue investigating the GTV stuff and help in whatever I can :)

I don't know who would be the right folks for this, considering both the skills and especially the "motivation" + available time. So I'd suggest you guys that own XZ's and frequent these boards a lot more than me, reach out for those you think could be able to pursue this. Or even strike this as unfeasible once and for all, if that's the case...

Perhaps [MENTION=2784807]DooMLoRD[/MENTION], [MENTION=1713162]lilstevie[/MENTION], [MENTION=3506409]cdesai[/MENTION], [MENTION=3665957]the_laser[/MENTION] or [MENTION=4120742]munjeni[/MENTION] might be able to shed some light over this possibility, based on the discussions on a previous thread.

On the other hand, I just found the response from [MENTION=1713162]lilstevie[/MENTION] related with my previous inquiry, which isn't very optimistic :(