yashsingh1/xdaforums huggingface dataset:
[Xperia Z3 Compact General] Pyres:
Disclaimer: This thread has been extended to the entire Z3 lineup since throughout it the software similarities abound and, therefore, an exploit in any device of this series would result in a 99,9999% probability of an exploit in each and every device of the series.

I'm currently exploring any way to give this thread maximum visibility and the largest public in order to maximize our bounty and get more developers to work onto this.

If anyone has any suggestions and/or observations, feel free to PM me. Please do not pollute this thread, the list of acceptable post can be found in the OP.

Thank you and have a good day.
[Xperia Z3 Compact General] muzab a:
U forgot xz3c d5833
[Xperia Z3 Compact General] sansart:
Is this root for Kit Kat or Lollipop? Or either?

I realize Lollipop isn't out yet but it seems like it's just around the corner and who knows how long it will take (if ever) for root to be achieved for Kit Kat.
[Xperia Z3 Compact General] jug6ernaut:
Put me up for $50.
[Xperia Z3 Compact General] Jliax:
Ill add 10$
[Xperia Z3 Compact General] lcohen999:
I'll put up 15
[Xperia Z3 Compact General] adamk7:
I'm in for 50mBTC (0.05 Bitcoin)

Here's the bounty thread for the S5. http://xdaforums.com/showthread.php?t=2728051

I found this comment pretty interesting: http://xdaforums.com/showpost.php?p=52169205&postcount=112

People pledged a lot individually, the most from one person being $4000 (!).

Do we know how many people came through with paying?
[Xperia Z3 Compact General] tansy:
Excuse my ignorance, where is the link to check in ??

And this exactly ??? serving to create root.

Thank you
[Xperia Z3 Compact General] Kev1000000:
I'm in for $50.
[Xperia Z3 Compact General] SsezZ:
I think this thread must be started in sony crossdevelopment brunch. Root will be the same for all z devices on new firmware, because they are practicaly the same. And amount of money we can collect will increase . Anyway I'm in 20 $
[Xperia Z3 Compact General] mo3553:
I think it's great that people are giving something for the community, but in my opinion you are doing it wrong. I think it's wrong to give people money to find root exploits, that should be done for free. On the other hand i think we should donate money so we can buy the respected devs devices like the Z3/Z3C so they can develop some goodies for the community. No one needs money or a new device to find a root exploit. Cheers.
[Xperia Z3 Compact General] Pyres:
Thanks for letting me know. I corrected it right away.

Your concern is understandable. For now, of course, it's for Kit Kat only. I specified in the bounty rules that in order to claim the bounty, the root access must be obtained in the latest software release, therefore once Lollipop is out and about the root access will have to be obtained on it in order to fulfill the bounty.

Nothing but our own word. There'd legal actions to be exploited, but none of them would be effective both in regards to the amount per single person and the transnactionality of this forum and its users.

There is no link to check in, you just pledge a sum of money here, and commit yourself to paying that sum to whoever fulfills the bounty first.

That's actually a good idea, but I don't think I'm technically qualified enough to delineate the technical requirements.

If anyone wants to take this to the next level, I'm all for it though.

Even the devs need money to live: if this can get both the users and the devs happy, why not?

You're free not to pledge anything and just wait in order to enjoy what others have paid for, if that makes you happy.
[Xperia Z3 Compact General] mo3553:
Actually I have started a thread in the Z3 forum, that i called donation for development. It's not because I don't want to pay, I just think it's wrong to pay people for root. Imagine if there is someone who already found an exploit, thanks for your thread, he won't release it until the right amount of pledges is reached. So next time try to understand before you answer like that.
[Xperia Z3 Compact General] tansy:
OK thankss
[Xperia Z3 Compact General] Pyres:
As I've already been given occasion to explain in another thread:
[Xperia Z3 Compact General] istux:
It doesn't really matter, as it's enough to find a working exploit on any android version.

Once rooted, you can install a recovery and flash all the next firmwares already rooted from there ;)
[Xperia Z3 Compact General] aegixnova:
I own a full size xperia z3, not the compact. However, I believe that any work towards the Z3C will be helpful for my device too. I'll contribute $25 to the bounty for the Z3C. If the root exploit works for the full size Z3 I'll make it $50.
[Xperia Z3 Compact General] Dsteppa:
Plz don't let this become a discussion topic, this is a topic where people pledge for the bounty and other kinds of questions.

You can think that what we doing is wrong (to each his own), but it's also like telling someone else what to do with their 'hard' earned money. Don't forget that their are plenty of companies like Google, M1cr0$oft that also pay people to find exploits on their systems. How is this any different? People infest their time into finding an exploit.

Time == money

Edit:

If someone already rooted this phone and waiting for a right price, well then it's his own problem. If that is the case then he's also taking a risk that someone might beat him to it.

Count me in for 10$

(Please note that I might pay up late since I'll soon be going on vacation till Feb 2015)
[Xperia Z3 Compact General] sansart:
In for $20
[Xperia Z3 Compact General] dekefake:
Hey guys !

Is this phone unrootable ?

Give me the partition table of this phone. I've an idea ;)

Thanks

If somebody have a Xperia Z3, please PM me.

Cheers
[Xperia Z3 Compact General] Pyres:
I share your indignation towards certain people and their pointless remarks: what I intended to do was to gather potential donors in order to show the developers their work wouldn't be useless and that we could both get something from an exploit that allows root access on LB.

Since this has been clearly misinterpreted by some, I'll keep the bounty going until the 3k mark, then I won't update the OP any longer. Of course, should the bounty be fulfilled and the exploit discovered, anybody will be free to donate without having pledged anything.

Greetings
[Xperia Z3 Compact General] Luhccas-X10:
Where are [MENTION=3665957]the_laser[/MENTION] or [MENTION=3280118]geohot[/MENTION] when we need his help? :p

I'm in with 10 U$.
[Xperia Z3 Compact General] Nickcer:
In for $50
[Xperia Z3 Compact General] Pistachio20:
i think that there should be a link in the main z3 forum as well since this forum is z3 compact so that its not misinterpreted by some as a z3 compact only thread (although it clearly states z3 lineup)
[Xperia Z3 Compact General] maikoandres:
Hello , obtained partition table ?
[Xperia Z3 Compact General] LastSilmaril:
Pledge.

In for $25 (US).
[Xperia Z3 Compact General] hedgie123:
Partition Table

Here is the z3c partition table
[Xperia Z3 Compact General] dsmero:
In for $20 USD. Subscribed to thread.
[Xperia Z3 Compact General] dekefake:
Stop PM me, i had what i need. Now, is somebody able to convert a recovery.img to fotakernel.sin ? If yes, PM me

This recovery is for Z3, and not Z3 compact. I'll do a ftf with it who can be flashed with locked bootloader. It will install TWRP. With TWRP you'll be able to change rom, and root your current stock if you want.

The recoverywho needs to be converted can be downloaded here

Cheers
[Xperia Z3 Compact General] someone755:
AFAIK sin files are some closed source Sony thing. If there was a way to simply create sin files there would be no need for this bounty or searching for exploits with each new Xperia.
[Xperia Z3 Compact General] dekefake:
I know it's possible to completly decompile a boot.img, and compile a sin file, so i think it's possible no ?
[Xperia Z3 Compact General] pricey2009:
Geohot works for google now..

He is now the one being paid to block us from getting root, there is no-one better they could of to given the job to really.
[Xperia Z3 Compact General] Fruktsallad:
I don't know the first thing about any of this, but I found a tool called bin2sin that might be of use if all we need is a sin file. I'm guessing that we still need some kind of signatures or something along those lines to make flashtool accept the sin file, no?
[Xperia Z3 Compact General] dekefake:
Don't think..
[Xperia Z3 Compact General] eskamhl:
Another hole here from which we can obtain system permission ( but nothing more, I think :( ) http://seclists.org/fulldisclosure/2014/Nov/81
[Xperia Z3 Compact General] maxp84z:
Why are there forces at work that don't want us to have root? Ugh. So selfish.
[Xperia Z3 Compact General] wooki:
Could this be an alternative approach?

http://xdaforums.com/showthread.php?t=2930672 ---DRM FUNTION RESTORATION FOR UB

They're looking for z3 users interested in testing.. Maybe someone brave could help them? :D

Sent with my Sony Xperia Z3 Compact with Tapatalk Pro
[Xperia Z3 Compact General] SONiX-GERMANY:
For me personally not. The goal is root on LB, for future official updates, warranty, maybe i want to sale my Z3 onedays.
[Xperia Z3 Compact General] vittogn:
Agreed 100%.

Inviato dal mio LG-D802 utilizzando Tapatalk
[Xperia Z3 Compact General] Jstar22:
Me too, Agree 100% also.
[Xperia Z3 Compact General] frostmore:
so,i jus wanna noe,the root exploit,is that through the kernel or through something else?

i have on my hands a software to access qualcomm's stuff.its pretty high lvl stuff frm what i have heard and a cease and desist letter was sent to the original person distributing it.

i am not sure if it works still and i am not going to flood the net with it.if u are a recognised dev,i am ready to share the software to help.

pm me.
[Xperia Z3 Compact General] Doda94:
Is this root for LG L9 II Android: 4.1.2
[Xperia Z3 Compact General] pricey2009:
No its for z3 series, read the thread man!
[Xperia Z3 Compact General] sxtester:
You have been sentenced to pledge 100 USD minimum, no matter what device you're in possession of! Confirm it here and now!
[Xperia Z3 Compact General] bdorr1105:
Trader, if it was me I would tell Google to stick an Apple symbol in place of the O in Google for being sellouts
[Xperia Z3 Compact General] cmvienneau:
The key to root is the settings app. The recovery.sin idea WILL not work unless you have a sonys sig keys and signing tool which I'm certain is not the case. I haven't dug into it much. http://seclists.org/fulldisclosure/2014/Nov/81 this is the exploit. Now we have to implement it somehow. I'd focus on that.
[Xperia Z3 Compact General] Dijk:
I don't think Google is the culprit here. The folks there are working to make Android more secure, to avoid phones being hijacked by malicious apps and the likes.

Remember: every exploit in Android can also be used agaist the will of the device owner!

The culprit is Sony, for doing things that developers don't like.

I can actually understand that unlocking the bootloader causes warranty to void. After all, (broken) custom ROMs can very well damage the device (e.g. overclock, overheat, overload the hardware).

However, the DRM issues, in my opinion, are unreasonable.

I think Sony should aim at a more finely-grained "modding" policy.

But finding a balance between openness and (partly valid) business concerns is not an easy task - and easily pushed aside.

This bug actually looks more promising than the one disclosed by Jann Horn before (CVE-2014-7911).

To my untrained eye, it seems much easier to execute something with system user privilges.

Since Lollipop is coming along by now, I would expect more bugs in Android < 5.0 be disclosed in time as they have been reported to Google months ago and are fixed in 5.0.
[Xperia Z3 Compact General] cmvienneau:
What ever manufacturer should do is stick a separate chunk of flash memory on the board with a complete mmc partition backup and lock it up tight so it can't be corrupted. Qualcomm should lock their socs (no pun intended) so that overclocking wouldn't be possible..at least not for the majority of people. THAT WOULD BE A TRUE RECOVERY.LOL anyways I wouldn't update if u really want root. Updates are merely patches to make root even harder too obtain. I hate lolly plops anyways.
[Xperia Z3 Compact General] sununs11:
I think this exploit(seclists.org/fulldisclosure/2014/Nov/81 ) can't get root, it says, "bad app can use this to broadcast intent with the same permissions and identity of the Settings application, which runs as SYSTEM uid. Thus bad app can broadcast sensitive intent with the permission of SYSTEM.". It can just broadcast intent, get system uid permission at most, but the system uid privilege escalation already be found in another exploit seclists.org/fulldisclosure/2014/Nov/51 .
[Xperia Z3 Compact General] cmvienneau:
I was actually able to get unlock code from Sony development site for my t-mobile d6616. Only problem is fastboot won't allow unlock command.lol
[Xperia Z3 Compact General] Dijk:
Rooting through an exploit is not possible for "the majority of people" until someone writes a one-click app for it.

It's really a shame that developers don't leave their code wide open for attackers to do bad stuff - no pun intended ;).

As I said, there's nothing bad about making a system secure. Maybe you would appreciate mobile security once someone hijacked your phone.

A few posts earlier there were comments about that (http://xdaforums.com/z3-compact/gen...der-method-t2940539/post56998732#post56998732).

Escalating from system to root would be a generic thing once you have access to system.

However, I think that the PendingIntent-bug is easier to exploit that the deserialization flaw.

Jann Horn only made a proof of concept to show it works, but one still has to inject something into memory.

I would assume working with an abusable Intent in Java could be easier.

I would assume Sony doesn't keep a big database of all IMEIs with their current bootloader status. The device and SIM locks are probably stored somewhere in the bootloader config (in the mysterious TA partition, maybe).

Carrier locks are a shame. They should be defeated.
[Xperia Z3 Compact General] cmvienneau:
As far as I know the system files store ZERO user information. It's a cell phone not a NASA terminal? Not too much "bad stuff" can happen from rooting your friggin cell phone. Android is OPEN source and we pay good money for a device like the z3. If I want to change my configuration. I shouldn't be hindered...if your sh#? gets hacked you were warned before you ventured down the android hole.
[Xperia Z3 Compact General] Dijk:
root user has access to all files on your device. Do you want some malicious app to gain this access?

The Android developer community aims to make the system more secure. Of course this doesn't replace user attention.

I bet many Windows systems are more vulnerable to infection than Android.

Android is open, it imposes no more restrictions to owning root permissions than any other Linux. It's the device vendors that lock boot loaders.

Still, Sony isn't the worst of vendors. After all, there were 18.000$ as bounty for rooting the Samsung Galaxy S5 (Verizon etc) and this was not just for convenience of losing warranty or noise reduction: http://xdaforums.com/showthread.php?t=2728051
[Xperia Z3 Compact General] cmvienneau:
We way off topic.lmao.. point is...if I buy a Lamborghini..I want the keys!
[Xperia Z3 Compact General] sxtester:
Exactly, and no brick underneath the gas.
[Xperia Z3 Compact General] Dijk:
I'm sure you will loose warranty if you flash a custom motor control software LOL.

You can do whatever you want with your car, or your Sony phone - drive it, tune it, break it. But don't expect the vendor to pay the repair if your mods blow up. Warranty, after all, is a convenience understood as mandatory these days.

The Android maintainers don't decide what vendors do and don't do with the software.

Compared to others, Sony isn't doing too bad about openness.

The DRM/camera-issue is somewhat unreasonable and sucks, yet they allow to unlock the boot loader and flash the phone without much hassle.

Rather than criticizing Android and Sony for whatever, we should encourage and help them make their products and policies more convenient and open.

Maybe this talk is a bit away from topic for a bounty thread, but it is something worth discussing.

I do honor the work on finding a root-exploit, but for the future, a cooperation with vendors would be much better.

After all, finding and publishing an exploit will almost certainly also lead to a fix for the underlying bugs in future versions.

And now, good night. :)
[Xperia Z3 Compact General] Pondera:
Just my 2 cents: Since it is so hard to find an exploit, it is best to wait for Lollipop update even it is found...
[Xperia Z3 Compact General] tomcatoggo:
I would add 15 € (or the eqivalent amount in $)
[Xperia Z3 Compact General] JamesChilds:
Has anyone here tried stump root for the lg g3? Its an apk.
[Xperia Z3 Compact General] eskamhl:
Already tried, doesn't work of course.. I'm pretty sure there's someone that tried everything including something like "root your htc dream with android 1.5" :D

Maybe it could be interesting to check ( if possible ) if the "backup and restore" software included by Sony has a daemon that runs as root ( like the bug in Sprite backup software for LG phones ). It's very unlikely but we could be lucky in that case :eek:
[Xperia Z3 Compact General] someone755:
I believe the Backup & Restore app exploit has already been patched (with the JB or a late ICS update of the Xperia software).
[Xperia Z3 Compact General] spychodelics:
Count me in for EUR 10 :D

I dont own the device, the loss of Camera Quality is the only thing keeping me away.
[Xperia Z3 Compact General] pricey2009:
What if you could trick the phone into installing a lower exploitable version as an update?
[Xperia Z3 Compact General] someone755:
You can't downgrade without uninstalling first and you'd need Sony's signatures if you wanted to repack an old version to trick the system into thinking it's a newer one.

Every simple method has already been tried, don't know why these questions keep being asked...
[Xperia Z3 Compact General] padde0711:
$30
[Xperia Z3 Compact General] omnikai:
I'll throw $30 USD into the hat. I miss adblocking :(
[Xperia Z3 Compact General] pricey2009:
You don't get answers unless you ask questions.. We will just have to be patient I suppose.
[Xperia Z3 Compact General] cmvienneau:
The only dumb question is the one not asked. You're questions might have been answered elsewhere so just keep your eyes open.
[Xperia Z3 Compact General] jiexi:
Why?
[Xperia Z3 Compact General] cmvienneau:
Has anyone tried a hot boot using insecure kernel? Or tried flashing the kernel in S1 flash mode using this http://www.flashtool.net/index.php?

---------- Post added at 06:26 PM ---------- Previous post was at 06:23 PM ----------

Because that's how you aquire knowledge.lmao ASK THE QUESTION OR SEARCH FOR THE ANSWER.
[Xperia Z3 Compact General] AdiSimpson:
iam in with 20$ :)
[Xperia Z3 Compact General] ChristianLetti:
Put me in for 30 USD
[Xperia Z3 Compact General] Dijk:
That's how I rooted my Xperia Z which runs 4.4.4 now as well (flash 4.4.2 kernel, use towelroot, flash recent kernel).

But there is no older Sony-signed kernel for the Z3 series.

You could try flashing the kernel of an older model, but it will most likely not boot, even if the bootloader accepted it as genuine.

Maybe this will somehow work, but it could as well hard brick a 500$ device.
[Xperia Z3 Compact General] cmvienneau:
Try loading generic kernel from stock ftf. Id test all this but aint got a pc yet.
[Xperia Z3 Compact General] Dijk:
I think a locked bootloader will not boot an unsigned, generic kernel. Preventing this is the purpose of a lockable bootloader after all, right?

How would you get a generic kernel into a stock FTF? If you change the file, the signature changes and the bootloader will reject it.

At least this is what happens from my understanding. The stock firmware is signed with Sony's private key and its integrity is verified before booting.

There is a nice explanatory post about bootloader security on Reddit: http://www.reddit.com/r/Android/comments/hkbf3/so_you_want_to_know_about_bootloaders_heres_the/

Skimming through the comments, it's quite interesting how - only three years back - the modding community was struggling to get an unlockable bootloader at all.

What is proposed there (website to get unlock code, warranty void once unlocked) is pretty much the template for how Sony does it now.
[Xperia Z3 Compact General] Levered:
What is this?

hummmm...good luck everyone and thanks for pledges
[Xperia Z3 Compact General] sxtester:
Already tried to flash a kernel from a Z1C as well as from a Z2 onto the Z3C, no luck. Even flashing is blocked by the bootloader.
[Xperia Z3 Compact General] Levered:
Please dont try to flash that. It will broke your devices
[Xperia Z3 Compact General] Dijk:
Then I guess the bootloader is not only limited to any Sony-signature, but only Z3C-specific signatures.

Thus, the only way towards flashing would be to optain a pre-4.4.4 genuine Z3C kernel signed by Sony.

I doubt such a kernel exists, even the development versions (that might be pre-4.4.4) are probably unsigned because they are not intended for general use.

The only way to obtain root then really is to find a new exploit - for Android 4.4.4 in general, or somewhere in Sony's system utilities and customizations (or a weakness in the bootloader, though this will be hard to find).

Could someone with an already unlocked and rooted Z3C (or Z3) provide a task list and insight into what Sony-specific processes run with elevated privileges (root at best)?
[Xperia Z3 Compact General] istux:
You did the wrong way.

You should download the firmware from Xperifirm, then you should make the FTF tagging it like z3c model.

This way it works and you can flash it.

But GOOD LUCK my friend, as cross-flashing a kernel may mess up your phone permanently :silly:

Be careful about doing this kind of things...
[Xperia Z3 Compact General] sxtester:
Well, I actually did use XperiFirm to download the firmware for Z1C and Z2 which I know are rootable.

Specifically, I took...

XperiaZ1c_D5503_14.2.A.1.114_(Android 4.3)_Generic DE

XperiaZ2_D6503_17.1.2.A.0.314_(Android 4.4.2)_Generic DE

...then created the .FTF via FlashTool and then tried to flash the kernel of both the above. But no luck, it's not getting flashed even.

Now, could very well be the case I did something wrong or missed some steps in order to make it happen. Please let me know what exactly you mean by "...then you should make the FTF tagging it like z3c model.". How?

As my BL is still locked, I think the risk of permanently bricking the phone is fairly low for I should always be able to enter flashmode and push the correct Z3C FW over again. Or is that also a false assumption? Anyway, I want root on that masterpiece so I'm willing to take a risk. :p

Yes, I fear you're right. Looks like the bootloader is limited to accept Z3C-specific signatures. However (and hope), I'd be more then happy to stand corrected.
[Xperia Z3 Compact General] dekefake:
If somebody can find me a ota update zip of xperia z3 or z3 compact it would be greatly appreciated.

Cheers
[Xperia Z3 Compact General] sxtester:
There's been a minor OTA update on my Z3C from 23.0.A.2.98_R7B to 23.0.A.2.98_R8B some weeks ago (which I did). Now, how to create a ZIP from an OTA and how would that help (sorry for probably asking things that are obvious to the Pros over here).

If there's a chance to obtain root by this method then I'd be willing to go back to 23.0.A.2.98_R7B, thus triggering the OTA again and subsequently create the ZIP (if you tell me how).

Edit: Does it work on Sony as (it at least has been) on HTC? http://xdaforums.com/showthread.php?t=1996614