[Xperia Z3 Compact General] serajr:
Idea!

I wrote this snippet of code to know which apks have root previleges*...

private void listRootApps() {

try {

PackageManager pm = getPackageManager();
List<PackageInfo> packages = pm.getInstalledPackages(0);

for (PackageInfo pi : packages) {

ApplicationInfo ai = pm.getApplicationInfo(pi.packageName, 0);

// android:sharedUserId="android.uid.system"
if (pi.sharedUserId != null && pi.sharedUserId.equals("android.uid.system")) {

// 1000
if (ai.uid == Process.SYSTEM_UID)
Log.d("xx_log", ai.sourceDir + " | " + ai.packageName + " | " + pi.versionCode + " | " + pi.versionName);

}
}

} catch (NameNotFoundException e) {

e.printStackTrace();

}
}

root previleges*

- android:sharedUserId="android.uid.system" (AndroidManifest.xml)

- uid=1000 (system)

And that's what I got:

01-13 14:47:17.262: D/xx_log(24766): /system/app/bootinfo.apk | com.sonyericsson.android.bootinfo | 19 | 4.4.4-1
01-13 14:47:17.272: D/xx_log(24766): /system/app/phone-usage.apk | com.sonymobile.phoneusage | 6291456 | 3.0.A.0.0
01-13 14:47:17.282: D/xx_log(24766): /system/priv-app/Settings.apk | com.android.settings | 19 | 4.4.4-1
01-13 14:47:17.282: D/xx_log(24766): /system/priv-app/usb-mtp-update-wrapper.apk | com.sonyericsson.mtp.extension.update | 1 | 1.0
01-13 14:47:17.292: D/xx_log(24766): /system/app/SemcPowerSaveModule.apk | com.sonyericsson.psm.sysmonservice | 1 | 1.0
01-13 14:47:17.302: D/xx_log(24766): /system/app/ServiceMenu.apk | com.sonyericsson.android.servicemenu | 19 | 4.4.4-1
01-13 14:47:17.302: D/xx_log(24766): /system/app/IntelligentRotation.apk | com.sonymobile.intelligent.rotation | 1 | 1.0
01-13 14:47:17.302: D/xx_log(24766): /system/priv-app/EnterpriseService.apk | com.sonymobile.enterprise.service | 1 | 1.0
01-13 14:47:17.302: D/xx_log(24766): /system/priv-app/SettingsProvider.apk | com.android.providers.settings | 19 | 4.4.4-1
01-13 14:47:17.302: D/xx_log(24766): /system/priv-app/CustomizationSelector.apk | com.sonymobile.customizationselector | 1 | 1.0
01-13 14:47:17.312: D/xx_log(24766): /system/app/StartupFlagV2.apk | com.sonyericsson.startupflagservice | 1 | 2.0
01-13 14:47:17.312: D/xx_log(24766): /system/app/ImageEnhancer.apk | com.sonymobile.imageenhancer | 1 | 1.0
01-13 14:47:17.322: D/xx_log(24766): /system/priv-app/ExtendedBootLockService.apk | com.sonymobile.extendedbootlock.service | 19 | 4.4.4-1
01-13 14:47:17.322: D/xx_log(24766): /system/app/CrashMonitorSystem.apk | com.sonymobile.crashmonitor.system | 1 | 1.0
01-13 14:47:17.322: D/xx_log(24766): /system/priv-app/CustomizedSettings.apk | com.sonyericsson.customizedsettings | 2 | 1.1
01-13 14:47:17.322: D/xx_log(24766): /system/priv-app/InputDevices.apk | com.android.inputdevices | 19 | 4.4.4-1
01-13 14:47:17.322: D/xx_log(24766): /system/priv-app/fast-dormancy-wakeup.apk | com.sonyericsson.android.wakeup | 19 | 4.4.4-1
01-13 14:47:17.332: D/xx_log(24766): /system/priv-app/SimlockUnlockApp.apk | com.sonymobile.simlockunlockapp | 1 | 1.0
01-13 14:47:17.342: D/xx_log(24766): /system/priv-app/SemcTvOut.apk | com.sonyericsson.tvout.mhl | 1 | 2.0
01-13 14:47:17.342: D/xx_log(24766): /system/priv-app/SomcHotspot2Settings.apk | com.sonymobile.settings.wifi.hotspot2 | 0 | null
01-13 14:47:17.342: D/xx_log(24766): /system/framework/framework-res.apk | android | 19 | 4.4.4-1
01-13 14:47:17.342: D/xx_log(24766): /system/app/PrototypeProtection.apk | com.sonymobile.prototypeprotection | 1 | 1.0
01-13 14:47:17.352: D/xx_log(24766): /system/app/KeyChain.apk | com.android.keychain | 19 | 4.4.4-1
01-13 14:47:17.352: D/xx_log(24766): /system/app/SuperStamina.apk | com.sonymobile.superstamina | 1 | 1.0
01-13 14:47:17.362: D/xx_log(24766): /system/app/TimeService.apk | com.qualcomm.timeservice | 19 | 4.4.4-1
01-13 14:47:17.382: D/xx_log(24766): /system/framework/SemcGenericUxpRes.apk | com.sonyericsson.uxp | 2490368 | 1.3.A.0.0
01-13 14:47:17.382: D/xx_log(24766): /system/app/AntHalService.apk | com.dsi.ant.server | 30100 | 3.1.0
01-13 14:47:17.402: D/xx_log(24766): /system/app/white-balance.apk | com.sonymobile.whitebalance | 4194305 | 2.0.A.0.1
01-13 14:47:17.402: D/xx_log(24766): /system/priv-app/retaildemo.apk | com.sonymobile.retaildemo | 32308 | 3.23.8
01-13 14:47:17.412: D/xx_log(24766): /system/priv-app/DeviceSecurityService.apk | com.sonymobile.devicesecurity.service | 19 | 4.4.4-1
01-13 14:47:17.412: D/xx_log(24766): /system/priv-app/FusedLocation.apk | com.android.location.fused | 19 | 4.4.4-1
01-13 14:47:17.422: D/xx_log(24766): /system/priv-app/SomcWifiDisplay.apk | com.sonymobile.tvout.wifidisplay | 0 | null
01-13 14:47:17.422: D/xx_log(24766): /system/app/TouchFilterPackageSwitchService.apk | com.sonymobile.touchscreen.touchfilter | 1 | 1.0
01-13 14:47:17.432: D/xx_log(24766): /system/priv-app/ScreenRecording.apk | com.sonymobile.screenrecording | 2203648 | 1.0.13.A.0.0
01-13 14:47:17.432: D/xx_log(24766): /system/priv-app/usb-mtp-factoryreset-wrapper.apk | com.sonyericsson.mtp.extension.factoryreset | 1 | 1.0
01-13 14:47:17.432: D/xx_log(24766): /system/priv-app/SomcMirrorLinkSystem.apk | com.sonymobile.mirrorlink.system | 1 | 1.0
01-13 14:47:17.442: D/xx_log(24766): /system/app/HotspotAdvancedSetting.apk | com.sonyericsson.settings.wifi | 19 | 4.4.4-1
01-13 14:47:17.452: D/xx_log(24766): /system/priv-app/com.qualcomm.location.apk | com.qualcomm.location | 1 | 1.0
01-13 14:47:17.452: D/xx_log(24766): /system/app/WfdService.apk | com.qualcomm.wfd.service | 2 | 2.0
01-13 14:47:17.452: D/xx_log(24766): /system/app/SemcSettings.apk | com.sonyericsson.settings | 1 | 1.0
01-13 14:47:17.462: D/xx_log(24766): /system/priv-app/CredentialManagerService.apk | com.sonyericsson.credentialmanagerservice | 1 | 1.0
01-13 14:47:17.472: D/xx_log(24766): /system/priv-app/enhancedusbux.apk | com.sonyericsson.usbux | 1 | 1.0

apk location | package | version code | version name

But whatta hell is this can help us? You will tell me by reading the lines below!!!

I have decompiled every listed apk from old 23.0.A.2.93 fw, compared its android version number/name with latest 23.0.1.A.5.77 fw, and believe me, there is one apk (just one apk) which has new android version number/name. This one:

01-13 14:47:17.432: D/xx_log(24766): [COLOR="Blue"]/system/priv-app/ScreenRecording.apk | com.sonymobile.screenrecording | 2203648 | 1.0.13.A.0.0[/COLOR]

Old fw:

android:versionCode="2179072" android:versionName="1.0.10.A.0.0"

New fw:

android:versionCode="2203648" android:versionName="1.0.13.A.0.0"

If we revert back to old 23.0.A.2.93 fw by flashing it with FlashTool, we can update ScreenRecording.apk by simple installing it... Theorically!

But whatta hell is this can help us again? Keep reading...

If scenario above is feasible, we're able to write and push new smali code into latest ScreenRecording.apk that will run with root previleges due apk context! In other words, we can inject code up there to TRY remount system as r/w and copy su/busybox binaries and Superuser.apk to /system/xbin and /system/apps (respectively).

The idea:

1 - Write up a BroadcastReceiver class in which will contain all the root related code and push it into latest ScreenRecording.apk

2 - Later send it a broadcast (intent) with external app or via adb to start root process attempt!

If we get it, device will be rooted!

I'm not sure about whole process I described here, so that's why I'm presenting it for you! What about?