[Xperia Z3 General] ondrejvaroscak:
Some insight into technicalities behind "Concept" and rootability issues

There are few points to be said, based on my (and others) experience with previous "Concept" firmware based on Lollipop.

1. It brings new partitioning scheme, replacing FOTAkernel partition with true AOSP recovery partition. Partition contains recovery, however can only flash SONY genuine signed update zips.

2. However, you will not be unable to replace SONY recovery with any other (CWM/TWRP) unless you UNLOCK bootloader and flash CUSTOM kernel - and there is why, and the major obstacle of new line of Concept firmwares:

The new bootloader and kernel in Concept firmware are using security technique known as Verified Boot, introduced by Google in KitKat. The aim is to warn user of possible infection of system partition after system is booting.

It works on kernel level, and creates array of hashed hashes in pyramid hierarchy. Simple hash and comparison of it with actual system image would be too complex and time consuming, so instead, hashed are small sequences, their hashes are further hashed, and those hashes are again hashed, until you reach the final single hash.

The hashing process takes place as system boots and resulting hash is compared with hash created at previous boot. In case of difference, user is warned and allowed to continue booting, or launch recovery or power off the phone.

Furthermore, the bootloader doesn't allow to load kernel that doesn't support Verified Boot unless unlocked, as well it does not allow boot with content of recovery partition changed.

Sony has modified Verified Boot for purpose of strengthened security, and simply doesn't allow to boot at all if hashes do not match. Initial hash is provided in firmware flash image to prevent system modification before flashing and first boot.

Simply said, there is no way to change a single bit in system partition without making hash invalid and next boot fails. This prevents both rooting using recovery, adb and running exploit, because as soon as anything is written in system partition, hash comparison fails.

Only way, how to obtain root on such system, is of course using modified kernel. That requires UNLOCKING the bootloader, for purpose of flashing custom kernel, and to allow loading kernel that doesn't support Verified Boot feature.

So far, from introduction of Verified Boot, there has not been a single case of successful root of such protected device, with one striking exception: There was a success by using leaked engineering bootloader. It must be clearly said, that modifying bootloader is a possible way, however - flashing wrogn/corrupted/non-functional bootloader will most probably hard brick the device, as it contains also a part to flash system as such.

So shortly, expect that Concept firmware will be UNROOTABLE (absolutely) on LOCKED bootloader, and if you unlock, you loose the same stuff like on stock (low ligh camera, x-reality/vivid). Also, with custom kernel, there was no way to update the firmware, unless new custom kernel was created for each version.

I am personally bit frustrated by Sony approach, however I understand it from business perspective. I am in for testing the new Concept, because simply can not resist to have my hands on M as one of the first few people around, and because of my curiosity.

There might be a light at the end of the tunnel. Given the so far good support for AOSP community, even dedicating personnel, there is a slight chance, that Sony is evaluating a different software strategy for upcoming releases of M ... I would have absolutely nothing super secure bullet proof unrootable Concept firmware for ordinary users (they would welcome it) - if it goes hand in hand with supporting AOSP development the way that customized/independent firmwares will not have to be suffering from significant malfunctions. I can live without x-reality/vivid and low light camera, because it is just software peace. But I can not live with proper camera and RIL stack. The rest is just development.