yashsingh1/xdaforums huggingface dataset:
[Xperia Z3 Compact General] gregbradley:
There is every chance that that exploit will be patched on the Xperia Z series release of Android 5.0. Sony have had long enough to close the vulnerability that his root method uses
[Xperia Z3 Compact General] Sparksys:
I don't understand it..

Sony supports developing and spreads guides on how to unlock bootloader and pushes sources on github.. In other words they encourage developing

Then why they patch every exploit so we can't root?
[Xperia Z3 Compact General] Moist:
I imagine they are trying to protect some intellectual property of theirs. I'm not sure how easy it would be for competitors to copy the camera features, but I imagine that's what they're trying to protect.
[Xperia Z3 Compact General] tribemac:
It's Google that makes android more secure, not Sony.
[Xperia Z3 Compact General] Moist:
Sony does take your DRM away when you unlock though...
[Xperia Z3 Compact General] android404:
Eventually there will be root on locked bl, Sony is just giving us a hard time. If I knew this half a year ago I'd never ever have bought this phone and I'll never buy a Sony again
[Xperia Z3 Compact General] Miche1asso:
Hi,

I am the author of this method:

With it we have been successfully rooting an Xperia M2 Aqua D2403 (which came with Kitkat) using the JB kernel of the Xperia M2 D2303. The idea is that as long as the SoC is the same the kernel should start and adb should work.

Now the Z3 doesn't have a JB ROM, but the Z2 (which has just a slightly different SoC from the Z3. Still they both are Snapdragon 801), does. I would personally try flashing the Z2 JB kernel in the Z3 and then apply my method above. In the worst case the kernel would soft brick the phone (no boot at all) the flash mode should still be active. Just restore the Z3 kernel (or rebuild the ROM with PC companion) and the phone should be fine.

Unfortunately I don't have a Z3 for testing, but based on my experience of flashing other devices kernels and CWM in my previous Samsung phone I would estimate this has a 90% chance to work.

In case anyone feels comfortable enough to try this, and it works, I think it would be just fair to share the bounty. :D
[Xperia Z3 Compact General] tRippinthehead:
Thank you for the tip, looks like we could be to try :)

So we should try to flash z2 jb kernel via flashtool then start phone and connect to usb while bootloop (if present) ?
[Xperia Z3 Compact General] Miche1asso:
Yes, more or less. Just use the full guide for the M2:

http://xdaforums.com/xperia-m2/help/qa-rooting-locked-bootloader-ota-method-t2999665

Using the JB Z2 kernel in the Z3.
[Xperia Z3 Compact General] tRippinthehead:
Ok, what kind of kernel we should use? Stock? and much closer to first revision or it doesnt matter
[Xperia Z3 Compact General] Miche1asso:
A Z2 stock kernel which is known to be vulnerable to the Towelroot exploit. Stock, because having the bootloader locked I don't think anything else can be flashed.. :D
[Xperia Z3 Compact General] tRippinthehead:
http://xdaforums.com/xperia-z2/development

hmm, can't find 4.3 jb roms here
[Xperia Z3 Compact General] DdcCabuslay:
The Xperia Z2, like the Z3, launched with KitKat. So I would assume that would mean the Z2 has no JB kernel available.
[Xperia Z3 Compact General] serajr:
See it !!
[Xperia Z3 Compact General] Miche1asso:
Ok, I think you're right. I checked last night and I was sure it had a 4.3 ROM. 4.4.2 then it's exploitable by Towelroot (which is what we need). I used 4.3 because that's the only ROM that could be rooted on the Xperia M2.

Using the 4.4.2 kernel it may even happen that it gets rooted and disables the RIC in one step. Still what it is important is to have the rooting in /system. After that to disable the RIC we can push and execute install_tool.sh again from 4.4.4.
[Xperia Z3 Compact General] Moist:
Isn't 4.4.2 a Kitkat kernel?

What about using a Z1C firmware?

edit: and the author of that thread wasn't trying to use adb was he?
[Xperia Z3 Compact General] tRippinthehead:
Different SoC?
[Xperia Z3 Compact General] Miche1asso:
So the DRM doesn't allow to flash a Z2 kernel in the Z3? I though it was possible because there is no check in the M2.
[Xperia Z3 Compact General] tRippinthehead:
They didn't tried cuz of too risky?
[Xperia Z3 Compact General] Moist:
The steps in your guide are:

And in the other thread where it was tried:

I'm not sure if those steps are the same?
[Xperia Z3 Compact General] tRippinthehead:
Look like they tried to flash kernel and system to Z3, not only kernel like in new method
[Xperia Z3 Compact General] Moist:
And perhaps that they waited for the phone to boot and didn't try root it whilst in the bootloop....
[Xperia Z3 Compact General] Miche1asso:
No, wait. I checked that method better. It wants to install the whole FTF. Then they talk about creating a custom FTF which will never install due to the DRM.

With my method we just need to change the kernel. I wouldn't even try to run a full Z2 ROM in a Z3. All it needs it's a vulnerable by Towelroot kernel running the OS. Being the SoC very similar it has chances to work.

Yes, it is a bit risky. But nothing that shouldn't be fixed flashing back the original kernel and maybe system. I mean, if I had a Z3 I would do it myself, as long as it doesn't mess up with the flash mode it shouldn't be dangerous.

So, if the Z3 DRM allows the installation of the Z2 kernel, like in the M2 Aqua case with the M2 kernel, it may work. Otherwise forget about everything. :)
[Xperia Z3 Compact General] tRippinthehead:
Ok, looks like we can't flash kernel from Z2 to Z3c, cuz as they said it will be missmatch errors/etc, boot_delivery.xml absolutely different on these phones... is it?
[Xperia Z3 Compact General] Moist:
I think I will try it. I am downloading(very slowly) D6503_17.1.2.A.0.314, will this be fine? It is not JB though...
[Xperia Z3 Compact General] tRippinthehead:
they couldn't even flash kernel cuz of missmatch errors :)
[Xperia Z3 Compact General] STR33TPIR8:
Here's my result. Unfortunately it didn't work. Phone booted as normally does.

17/054/2015 14:54:51 - INFO - Selected Bundle for Sony Xperia M2 (D2303). FW release : 18.0.C.1.13. Customization : Global Generic by Saiarkar

17/054/2015 14:54:51 - INFO - Preparing files for flashing

17/054/2015 14:54:51 - INFO - Please connect your device into flashmode.

17/055/2015 14:55:00 - INFO - Device connected in flash mode

17/055/2015 14:55:01 - INFO - Opening device for R/W

17/055/2015 14:55:01 - INFO - Device ready for R/W.

17/055/2015 14:55:01 - INFO - Reading device information

17/055/2015 14:55:01 - INFO - Phone ready for flashmode operations.

17/055/2015 14:55:01 - INFO - Current device : D5803 - YT910YNHYS - 1289-4008_R5B - 1285-6521_23.0.1.A.5.77 - GLOBAL-LTE_23.0.1.A.5.77

17/055/2015 14:55:01 - INFO - Start Flashing

17/055/2015 14:55:01 - INFO - Processing loader.sin

17/055/2015 14:55:01 - INFO - Checking header

17/055/2015 14:55:01 - ERROR - Processing of loader.sin finished with errors.

17/055/2015 14:55:01 - INFO - Ending flash session

17/055/2015 14:55:01 - ERROR - ERR_SEVERITY="MINOR";ERR_CODE="0017";ERR_DYNAMIC="800A0017";

17/055/2015 14:55:01 - ERROR - Error flashing. Aborted

17/055/2015 14:55:01 - INFO - Device connected in flash mode

17/055/2015 14:55:05 - INFO - Device disconnected
[Xperia Z3 Compact General] Miche1asso:
Yeah, that should work. Here is a list of the Z2 FTF. It isn't reported as not rootable.

http://xdaforums.com/showthread.php?t=2759934

Please be a bit patient because I am new to the Xperia Z2 and Z3. I've just found this thread by mistake. ;)

---------- Post added at 03:07 PM ---------- Previous post was at 03:03 PM ----------

Fortunately it didn't! You tried to install the M2 kernel from my thread. That would have never worked I suppose. It must be a Z2 kernel. It may fail as well, but it is worth to give it a try.
[Xperia Z3 Compact General] STR33TPIR8:
You're right, I'm an ass XD
[Xperia Z3 Compact General] tRippinthehead:
errors as they said
[Xperia Z3 Compact General] Miche1asso:
Crap. Too bad, It was worth to give it a try. Now I wonder why it allows to install the M2 kernel in the M2 Aqua, though. Maybe because the SoC are identical? Who knows.
[Xperia Z3 Compact General] tRippinthehead:
Sad :( , looking for another solution again...
[Xperia Z3 Compact General] Moist:
Very sad indeed. Howcome some people reported getting stuck in a bootloop though? Or would the kernel not flash, but firmware did flash?
[Xperia Z3 Compact General] Miche1asso:
That's too bad. It fails in here:

insmod: init_module '/data/local/tmp/ric_disabler_mod.ko' failed (Exec format er
ror)

But that's rootkitXperia failing. More specifically the exec format of ric_disabler_mod.ko isn't recognized? :confused:

Without it it can't do the rooting copying su & C in the /system. No idea why it is happening, though. I thought rootkitXperia was working in all Xperia phones.

---------- Post added at 03:29 PM ---------- Previous post was at 03:27 PM ----------

Yeah, that's a possibility. The DRM may not check if the system is for a device or another. Only for the kernel.

---------- Post added at 03:35 PM ---------- Previous post was at 03:29 PM ----------

Sorry, I missed this.

flash back the kernel and system of 4.4.4. That should fix it. Otherwise I am afraid you also need to clear the data/reset to factory setting,
[Xperia Z3 Compact General] Moist:
Out of curiosity, how does the DRM checking work? Does the "phone" do the check? Maybe it only does this check in newer firmware and not in the older firmware(as in Sony found the exploit before we did and fixed it before we found out)?
[Xperia Z3 Compact General] Miche1asso:
I am not an expert, but checking the two flashing logs we get this:

M2 kernel:

17/055/2015 14:55:01 - INFO - Processing loader.sin
17/055/2015 14:55:01 - INFO - Checking header
17/055/2015 14:55:01 - ERROR - [B]Processing of loader.sin finished with errors[/B].

Z2 kernel:

17/010/2015 17:10:45 - INFO - Flashing data
17/010/2015 17:10:45 - INFO - Processing of loader.sin finished.
17/010/2015 17:10:46 - INFO - Loader : S1_Root_9c84 - Version : MSM8974AB_22 / Boot version : S1_Boot_MSM8974AC_LA3.0_60 / Bootloader status : ROOTABLE
17/010/2015 17:10:46 - INFO - No bootdelivery to send
17/010/2015 17:10:46 - INFO - Processing kernel.sin
17/010/2015 17:10:46 - INFO - Checking header
17/010/2015 17:10:46 - ERROR - [B]Processing of kernel.sin finished with errors[/B].

In the M2 kernel case it doesn't even load the loader (totally different phone). In the Z2 kernel case the loader is fine, but then something in the kernel header says no to the installation. Maybe it is were it checks if the SoC are the same.

And yes, it may be the phone doing the check. Like in the PlayStation.
[Xperia Z3 Compact General] Vic.:
I have tried flashing the system partition too, but I still get the same error. Well, I guess I have to backup my data now.
[Xperia Z3 Compact General] Miche1asso:
Yeah, sorry, about that. I am honestly surprised. Also because failing there root hasn't be installed (but rootkitXperia should have got root from the log). /system couldn't be modified at all. And that library is just a Linux module. It's weird that it reported the exec format wasn't correct.
[Xperia Z3 Compact General] sxtester:
Gents, sorry to interrupt you in your process, but what you have tried has failed before and it has also been described in this very thread. The BL of the Z3 does not accept any other kernel but one that's been signed for it.
[Xperia Z3 Compact General] Moist:
Realised that now :< I was still very new to the device any its workings when I found that other thread though, so didn't know it was the same thing. Sorry for carrying on a wild goose chase :x
[Xperia Z3 Compact General] cmvienneau:
I tried flashing an entire ftf from another variant just makes device unbootable. That being said....any idea of finding root using flashtool wont work.
[Xperia Z3 Compact General] STR33TPIR8:
How about trying to flash the Kernel using the new Xflasher tool? Maybe there are less file checks with it...
[Xperia Z3 Compact General] cmvienneau:
The bootloader checks the signature theres no way around that. Lol yall gotta read up on the boot procedure
[Xperia Z3 Compact General] ryanraven:
Don't think theirs many good developers out there that own the Device hence why its taking so long for us to get root with LB, I was hoping to have a slimmed out custom ROM running before LP gets released but I guess I'll be updating this to official versions until root is available
[Xperia Z3 Compact General] pricey2009:
There are plenty of trustworthy devs working on this it just takes time.

Look how long it has taken the previous xperias to get root (a good few months after release) they are not that easy, all it takes is some patience.
[Xperia Z3 Compact General] STR33TPIR8:
In the meanwhile I discovered that Sony's bloatware is not that bad. I don't think I will need a custom Rom for this phone...
[Xperia Z3 Compact General] infinitylook:
Off course compared to samsung's crapwares. Anyway, you think we will have root when lollipop is out? I am not so positive because I don't think this kitkat has it's vulnerabilities. I just hope first lollipop release has bugs that would help in rooting.
[Xperia Z3 Compact General] STR33TPIR8:
We all hope so.
[Xperia Z3 Compact General] Dsteppa:
Even though I already have root, I'm very confident that once 5.0 is out for our device it will be just a matter of time. Yes it's true that 5.0 will have the fundament of KitKat, but they will also be adding new things or even changing old things, which could result in security flaws/exploits. In the end only 1 exploit needs to be found in order to get results. Where there are humans, there are mistakes, so I really wouldn't be worried.
[Xperia Z3 Compact General] infinitylook:
Oh okay so you already lost drm. How are you living without those Sony's drm features?
[Xperia Z3 Compact General] STR33TPIR8:
Unfortunately I can't find any humans in my Xperia...
[Xperia Z3 Compact General] Dsteppa:
I never used them, so I really don't miss anything. The only thing that kept me back at first was the fact that the camera became worse by unlocking.

I took plenty of pictures and I really can't complain about the quality.

The pictures can be seen here:

http://xdaforums.com/z3-compact/themes-apps/post-pictures-xperia-z3-compact-t2889119/page15

Even though I wouldn't advise watching it while you're on mobile data:P

I know that I can restore some of the functions right now, but I'll only do that when we have 5.0, because I don't really miss anything right now and I don't want to mess with my phone since it's working really great at the moment. I'm still on FW: 23.0.A.2.98

Maybe they are on vacation, wait till they are back home and brought you a present called Android 5
[Xperia Z3 Compact General] cmvienneau:
Theres gotta be a way to boot from sd. Even the msm8960 will do that.
[Xperia Z3 Compact General] sununs11:
I think using CVE-2014-7911 vuln and CVE-2014-4322 vuln is the most feasible way to get root till now compared to other methods.

But since they discussed as the above, there is nothing about this anymore...Maybe some of them are coding now...

Wish you success.:good:
[Xperia Z3 Compact General] tRippinthehead:
What you mean?
[Xperia Z3 Compact General] someone755:
Isn't 8960 the dual-core S4 chip? That's around 2 years older, the vulnerability is bound to have been fixed already.
[Xperia Z3 Compact General] sdorinxda:
Thanks

Just wanted to say 'thanks' to all who are working on this. I've just finished reading all 75 pages (so far) of this thread...fascinating. And I love the team spirit (sorry for the cheese). Regardless of how this turns out, I'll never buy another phone w/out determining first OEM support for rooting. So pissed at myself for getting razzle-dazzled by this piece of sh*t. Lesson learned. Love to all.
[Xperia Z3 Compact General] muzab a:
Piece of **** for not having a root exploit?
[Xperia Z3 Compact General] sdorinxda:
Piece of...

No. For designing such that value add functions are tied to root.
[Xperia Z3 Compact General] cajunflavoredbob:
It seems like a lot of people don't understand what root actually means. This isn't a feature that is being withheld by OEMs. Root exploits are exactly that: exploits in the system. They are security vulnerabilities, not magic doorways to Narnia. We exploit the security vulnerability in order to gain root access. Keep in mind that once the exploit is found, any app can use it on a system that is not using a root app to manage access. Those malicious apps may try to take over your device by means of the exploit.

Keep that in mind before *****ing about the OEMs doing what they're supposed to do. You'd be pretty pissed off if a security hole was found and some malware harvested your information or made ton of international calls on your dime. That same hole could be used to gain root. This is one of several reasons why OEMs do not give root access by default.
[Xperia Z3 Compact General] Kev1000000:
The issue isn't that we expect root from OEMs. The issue is that unlocking the bootloader (to achieve root) doesn't just void the warranty and come with security risks like it normally should, but that it actually removes features and functionality from this device with no way of getting them back.
[Xperia Z3 Compact General] clouds5:
Indeed... i owned a few devices that offered a unlock through an official tool. It's a great way to go about it, and it's understandable that you lose warranty by doing it. But losing features that are part of the software is a no go. I really hope they do something about it with lollipop. Or at least we will have some more power over the camera with the native .raw support.

I love this device even without root, but with it it will be just perfect.
[Xperia Z3 Compact General] mtz92:
I probably missed some of the discussion. I tried to rund the exploit from http://xdaforums.com/showpost.php?p=57991147&postcount=1 and it actually creates a file in the /data/local/tmp/ directory with "system" as owner and group. I did not make a screenshot. The strange thing now: I tried to reinstall the APK which is used in that exploit but it doesn't install anymore: it always sais "Failure [INSTALL_FAILED_INSUFFICIENT_STORAGE]". So I can not reproduce the creation of the file with "system" as owner. Other APKs install normally.

Back to the matter:

Has somebody else tried this? I am running Build 23.0.A.93

The thing I didn't get from the discussion: can the "system" user remount the system-partition rw?

So if that APK creates a file with "system" as ouwner, it should also be possible running the mount-command somewehre inside that APK. I tried to understand how that program works, but a part seems quite obfuscated. Do you think we could ask the creators to help us run a command instead of creating a file?
[Xperia Z3 Compact General] muzab a:
Maybe the script blocks the exploit?
[Xperia Z3 Compact General] vittogn:
Could be, but it is super easy to root, unlock and go back to factory (unlock + unroot) on Nexus!!
[Xperia Z3 Compact General] sgiannouris:
This. Given how good the phone is even without root I don't mind waiting for an exploit, and If I REALLY need to root it, I will unlock it, erasing the DRM keys in the process.

But if you bought it with the intention of rooting it from the 1st day, you should have bought a Nexus, or a 1+1 instead (and maybe I shoould have, too. Anyways).
[Xperia Z3 Compact General] mtz92:
Which script do you mean?

The exploit actually worked, and I guess it modified the system in a way that I get the error now. I had the APK installed, started the exploit which turned out to be successful, then I uninstalled the application and now it won't install anymore.

Can someone try the exploit and confirm what I can not reproduce anymore?
[Xperia Z3 Compact General] EricCartmanez:
which build is your phone on? z3 on 5.77 build got not vulnerable to exploit :(

Edit: whoops you wrote that in your first post, seems we need someone thats also on .93 build
[Xperia Z3 Compact General] minijaws:
Build 93 reporting in. Will test in about 35 mins once im at a computer
[Xperia Z3 Compact General] muzab a:
When u ran the exploit, it does some kind of hot patch which closes of the vulnerability
[Xperia Z3 Compact General] serajr:
CVE-2014-7911 exploit

Exploit app looks for "checkAndGetTcObjectClass" method inside "java.io.ObjectStreamClass" class (core.jar), and if it is found, fw is not exploitable! This method was introduced on latest .77 fw (maybe as a patch by sony... damn it).

But .106 fw doesn't have this method, and exploit runs till its end, installs Superuser.apk, but "/system/xbin/" folder keeps intact, that means... no root!

Flashed .77 fw once again!!
[Xperia Z3 Compact General] Griffiths_Anna:
Ohh my god.. Why is it so hard to root this device :'-(.. Keep it up developers.. I wish I could do something that you all do
[Xperia Z3 Compact General] m0d:
The phone comes with version 23.0.A.2.93, which is the oldest FW, has anyone tried with that?
[Xperia Z3 Compact General] minijaws:
I just tried with .93 it goes through the whole process but xbin is not changed so no SU binary.
[Xperia Z3 Compact General] OrBy:
That root looks like it's not a generic one size fits all setup and contains Huawei specific code. The exploits it uses likely can be used on our phones but a specific version will likely be required. Also the author notes that the it contains a patch that disables the exploit after it installs so your looking at re-flashing back to stock before to make your phone vulnerable again if a version is made for Sony. I would hold off messing with it unless your are ok with risking a brick.
[Xperia Z3 Compact General] mtz92:
It is clear that the root was not designed for Z3 compact, but it gets access to the system user. A modified version of that APK should also allow us to run other commands as "system" user.
[Xperia Z3 Compact General] daniel37parker:
Never seen this guy before. No idea how it got there
[Xperia Z3 Compact General] FingerBlastJ:
would using towel root v3 root the z3 6616?
[Xperia Z3 Compact General] iFlasher:
No, there is not root yet for Z3 series with locked bootloader.
[Xperia Z3 Compact General] muzab a:
Have they made any progress

Last I checked, it said that he was gna release tool to flash ta partition
[Xperia Z3 Compact General] sxtester:
Who is "they" and who is "he"? And what tool are you referring to?
[Xperia Z3 Compact General] muzab a:
Munjini and xflasher tool
[Xperia Z3 Compact General] sxtester:
Well, what about posting the question in the corresponding thread? Asking here will probably not get you/us any further, I think.

http://xdaforums.com/crossdevice-dev/sony/dev-xflasher-command-line-flasher-t2986634
[Xperia Z3 Compact General] muzab a:
Because that is a dev thread and is related to the topic and the person who mentioned it, mentioned it here on this thread
[Xperia Z3 Compact General] tijs14tijs:
I might now a way to root the z3 series

Two known vulnerabilities can be used to obtain root:

CVE-2014-8609: Android Settings application privilege leakage vulnerability

CVE-2014-4322: Memory corruption in QSEECOM driver

1. Obtain system privileges

To execute the next exploit you need to have system privileges.

The android settings application (which is on the Z3 series) can be used to obtain them.

It works by sending a malicious intent, although I did not successfully test this yet.

See http://xteam.baidu.com/?p=158 for an example how to exploit this vulnerability.

2. Obtain root

Recently I saw this come around on exploit-db: http://www.exploit-db.com/exploits/35711/

It is a kernel exploit for Android 5.0 (Nexus 5), and I think it can be ported to work on the Z3 series with android 4.4. (Because the kernel's defconfig has the following: CONFIG_ION=y and CONFIG_ION_MSM=y)

This exploit very technical but basically they forgot to check a boundary on some user input for the relatively new memory allocator ion.

I am busy with school, and I do not have sufficient knowledge and time to build this cool stuff. Sorry for that.

But we are a community, and now we know what has to be done, we are one step closer to #.