yashsingh1/xdaforums huggingface dataset:
[Xperia Z5 Android Development] tobias.waldvogel:
Kernel with working SD Card

Instead of compiling a new kernel I just took the original Sony kernel and disabled dm verity in the ramdisk in order to be able to install SU and XPOSED. All you have to do is remove "verify" in the fstab line for /system. Then you can perform any modification with TRWP as you like.

Works like a charm and SDCard is back again :D

Of course it still needs unlocked bootloader.

Cheers,

Tobias
[Xperia Z5 Android Development] _Dennis_:
Dumb question. If it's not to hard would you be able to do this for the dual SIM model? I've tried building a kernel but I'm mentally incapable apparently, keep getting errors.

If not that's fine, thank you for at least helping out.
[Xperia Z5 Android Development] tobias.waldvogel:
This is the kernel from 32.0.A.6.152 for the E6683 (Z5 Dual)

Just unpack it and flash it with

fastboot flash boot boot.img

That's all

Cheers,

Tobias
[Xperia Z5 Android Development] _Dennis_:
you just gave me my second favorite Christmas present this year (sorry but first goes to everything my daughter gave me, cause she is 4 and my daughter lol). You're amazing.
[Xperia Z5 Android Development] MacGyver78:
Z5 Dual sim

Hi guys,

I just ordered my Z5 dual sim, I will receive it in a couple of days.

As to anticipate, I took a look on this post but probably missed valuable information.

Is there a happy owner of rooted Z5 Dual sim kind enough to provide me with a quick "how to root" ?

I already downloaded "boot.zip" quoted above but don't know what to do with it .

I suppose there is a couple of "adb" actions to perform before reaching the flash of boot.zip?

Thanks to save me

Take care

François
[Xperia Z5 Android Development] _Dennis_:
[MENTION=357342]tobias.waldvogel[/MENTION]

Worked like a charm.thank you.

Anyone else who uses this, there is no way to enter recovery (which you download and install separately, see first post) except through fastboot from a compute. Just wanted to warn you, since it took me a few minutes to figure out lol.

---------- Post added at 03:44 AM ---------- Previous post was at 03:42 AM ----------

Read OP and tobias's post. No ads commands needed, just fastboot commands (unless you want to add reboot bootloader instead of turning off phone, holding volume up, and inserting USB cable)
[Xperia Z5 Android Development] nilezon:
This will not fully disable Sony RIC. You will not be able to remount /system as r/w from within the ROM using a repacked kernel.
[Xperia Z5 Android Development] tobias.waldvogel:
This is true, but the goal was just to be able to boot a modified /system. The recovery comes with a kernel with RIC disabled, so you will be able to do any modifications required.

Anyway if you need to mount /system afterwards rw, just install a terminal application and do

su
echo 0 >/sys/kernel/security/sony_ric/enable
mount - o remount, rw /system

Of course this is lost after a reboot. If you need it permanently it would be possible to include it in one of the startup scripts of xposed.

Cheers,

Tobias
[Xperia Z5 Android Development] MacGyver78:
Z5 dual sim root

Thank you for this quick answer!

I am not familiar with Sony devices, I used to carry HTC and Samsung. My last Sony was a Sony Ericsson and was not a smartphone as Android didn't even existed at this time!

For HTC, I had to unlock bootloader with a code from HTC-DEV website. It was quite a procedure and rooting was only possible after.

For Samsung, Odin software was taking over and as long as you had the correct boot image it was super simple.

My concern is : Is there an pre-unlock procedure for Sony? Is it possible to root without flashing recovery as the one I found is said not working even for regular Z5. Is this boot.img out of boot.zip working by itself?

Merry xmas

François
[Xperia Z5 Android Development] _Dennis_:
Yes you need to unlock your bootloader via a code from songs development website. This will cause certain things (x-reality, low light camera algorithms, etc) not to work permanently.

If you use the one for dual Sim model posted above you can use just the boot.img from the boot.zip to have a root able kernel. Then you will need to use a recoveryv(I used the one in the OP) via fastboot boot recovery.img to install supersu (I would download it before starting, I was unable to get add sideboard to work in TWRP).

Steps:

Download supersu.

Unlock bootloader.

Fastboot flash boot.img boot

Fastboot boot recovery.img

Install supersu

Reboot
[Xperia Z5 Android Development] MacGyver78:
Z5 dual sim

Thank you so much!

I have the boot.zip (dual sim), the UPDATE-SuperSU-v2.46.zip

Just checking : is there a specific recovery for dual sim version or I can use one (probably available on this post somewhere) for regular Z5?

François
[Xperia Z5 Android Development] _Dennis_:
The one by [MENTION=5169444]AndroPlus[/MENTION] worked for me.
[Xperia Z5 Android Development] tobias.waldvogel:
Here is a new stock kernel boot.img with DM_VERITY and SONY_RIC disabled

This is archived by changing just two files in the ramdisk:

fstab.qcom

remove "verify" from the line for /system (disables DM VERITY)

init.sony-platform.rc

add "write /sys/kernel/security/sony_ric/enable 0" (disable RIC)

I also created a TWRP recovery image for the Z5 dual with the stock kernel, so you can easily flash SuperSU and xposed from the GUI

For now you have to enter recovery still with fastboot, but when I have some time I will adapt the scripts from dual recovery for other xperias in order to access it without fastboot.

BTW: I also have already some ideas for a hack to get the functions back, which you lost by unlocking the bootloader (X-Reality etc). But it will take a little bit more time to implement it.

Cheers,

Tobias
[Xperia Z5 Android Development] Duvel999:
If you can manage that Tobias, then you're the King :D

Did you saw, that there's a Bounty for Root with Locked Bootloader?

Sent from my E6653 @ XDA Portal
[Xperia Z5 Android Development] RAM GUY23:
I had speak with a japanese who works at sony with security. He knows how to get full working root without lose anything from UB. I will need to translate from japanese to english when he tells me or release..
[Xperia Z5 Android Development] AndroPlus:
Great! Will Sony provides the way officially, or the person releases unofficially?
[Xperia Z5 Android Development] monx®:
Pls ask him whether can provide preproduction fw builds at least to help us stay loyal to Sony. Else goodbye Sony. (i need preproduction rom for Z5Dual :p )

✓ χρєʀια™ z5
[Xperia Z5 Android Development] Divine Wind:
Hi guys. I'm new here so i'd really appreciate if you all could use really simple terms with me. First android phone and trying it out. Regrettably, i've already unlocked the bootloader from my Z5(and sucessfully root via this threads meta) but that's besides the issue.

I'm trying to install a modded play store and been trying a few methods to no avail. Anyone can advise how do i install busybox or Xposed to get lucky patcher to work ? When i try to install busybox via multiple installers on Play Store, i keep getting the error message to select a different version/location and still no luck. Would greatly appreciate if anyone can help.

Side note, when i just did the root, my camera and flashlight stopped working. However, 1 day later it seems to be working fine. Anything i should be looking into in case of future errors?
[Xperia Z5 Android Development] Joeisgood99:
He all. I'm yet to unlock my boatloader so happy to test any exploits/security hacks on my phone. Tbh I'm holding off official unlock just incise something comes up and I can help out... But badly want to start testing AOSP builds on my phone so will unlock soon!
[Xperia Z5 Android Development] arismelachrinos:
i am on .200 fw , what should i do ? the proccess is a bit complex and i want first to ask some questions just to make sure . androplus has released kernel perimissive v8 ( https://dl.androplus.org/Xperia Z5_E6653/) do i have to flash this instead of what you've said in the instractions? also the z5 stock fixed img is updated? because you said its for .11 and i am on .200 thanks :)
[Xperia Z5 Android Development] langeveld024:
Maybe you could flash the 32.0.A.4.11 firmware via flashtool before unlocking your bootloader and install stagefright detector from playstore, make a screenshot and share the results here?
[Xperia Z5 Android Development] tobias.waldvogel:
Work on getting lost functionality back after unlocking the bootloader

Hi everyone,

I'm still working on getting lost functionality back after unlocking the bootloader (x-reality, etc.).

Could some of you send me the file /data/credmgr/credmgr.db of your Z5s in order to compare the contents?

Cheers,

Tobias
[Xperia Z5 Android Development] Joeisgood99:
Sure. Im new to Sony from HTC. How do I get firmware that isnt the newest. XperiFirm only shows the newest. 32.0.A.6.200?
[Xperia Z5 Android Development] langeveld024:
Strange, for me xperifirm shows the . 11 fw also. Did u click "check all"? And are u sure u use latest version of xperifirm?

If u click "check all" and after it loads up all releases, u can click the release tab to get it sorted by release. It should appear at the top named "internal" and "service exchange unit".
[Xperia Z5 Android Development] bazhip:
From a locked or unlocked BL? I can send you mine from an unlocked one. What do you mean when you say still working on it? Were you doing something before?
[Xperia Z5 Android Development] Joeisgood99:
Cool Thanks.

I found and downloaded the .11 FW (suposedly) but I cant for the life of me figure out where its downloading to (Ubintu 15, latest FlashTool and latest XperiFirm) The FW is not in my download folder. When I try to do it manually through a download manager the url returns a 404 error. All the tutorials I could find were for older versions of both running Windows.

Anyone have experience with this and can help me out?
[Xperia Z5 Android Development] Beetle84:
Is it in the .flashtool/firmware folder?

Thats where mine goes....
[Xperia Z5 Android Development] langeveld024:
I'm not sure about Ubuntu, but on Windows 7, it downloads firmwares in the flashtool installation directory.

---------- Post added at 09:35 AM ---------- Previous post was at 09:33 AM ----------

It needs root to open that directory, so yes, you have to be unlocked for that.

I can try via adb though.
[Xperia Z5 Android Development] Joeisgood99:
Note to ubuntu users

FINALY got Flashtool to work on ubuntu. Will be updating my github account and sending pull request to Flashtool maintainer coz the git source code, as is, does not work on ubuntu. (well not for me anyway)

FW 32.0.A.4.11 is vulnrable to stage fright!

OK what next....
[Xperia Z5 Android Development] langeveld024:
Whew thanks! Good work bro! So now we know the first build has good potent because it's very vulnerable!

Now we need to find a way to exploit one of those CVE vulnerabilities (which I honestly don't know how)

But I'm gonna read a lot about it and perhaps taking my old Z back in daily use so I can test on my Z5 and flash it back to. 11 fw.

I'm pretty sure there are pro's out there already busy on this, but the more people putting effort the sooner we get root on BL

Regards

BTW, maybe kingroot works out of the box on this firmware. [edit] it doesn't
[Xperia Z5 Android Development] Duvel999:
Great news

I use Linux Mint 17.2 & Windows ?.

Looks like a breakthrough :D

Sent from my E6653 @ XDA Portal
[Xperia Z5 Android Development] tobias.waldvogel:
From unlocked bootloader is good enough. The credential table is decoded first using the key from ta unit 66667 and then stored in credmgr.db. If you unlock your bootloader unit 66667 is wiped.

A backup of credmgr.db is kept in unit 2500 and this backup is restored after a full wipe, so the credentials are still there after unlocking the bootloader or doing a full wipe. Unfortunately this is not enough for making x-reality work.

I would like to compare the contents on different devices.

Currently I am writing a library, which is injected via LD_PRELOAD into secd and keyprovd. By this I can wrap any call to any library used by these daemons. E.g. I can intercept the call to read ta units and QSEE calls. The idea is or just to generate a new key or to use the keys from another device. But this of course would require the image of the TA partion of an_unlocked_ phone. Unfortunately currently we don't have an exploit for this.

So there is still some work to do....

Cheers,

Tobias
[Xperia Z5 Android Development] langeveld024:
[MENTION=6300794]Joeisgood99[/MENTION]

i took my old Z back in use and downgraded my Z5 too now for testing purposes.

ive also found some interesting information and sample scripts about how to generate a mp4 file using python.

i dont know how to work with python (i know, i should investigate a bit more in it) but im pretty sure there are some smart guys out there who can make this work.

below source links for this information:

https://blog.zimperium.com/the-late...xploit-is-now-available-for-testing-purposes/

https://www.exploit-db.com/exploits/38226/
[Xperia Z5 Android Development] :
Stagefright doesn't exploit to root user.
[Xperia Z5 Android Development] langeveld024:
Kingroot uses stagefright, it just doesn't work on this device (yet)
[Xperia Z5 Android Development] :
if check this : https://source.android.com/security/bulletin/2016-01-01.html

then we can see few interesting bugs :

first is most promising : CVE-2015-6640

and it is only one with at least some details ;)

now, how to use this bug ?

next, probably CVE-2015-6639,CVE-2015-6647 will be interesing too, but no any details on them

for mtk-based sony also interesting CVE-2015-6637 , but again - but no any details on them
[Xperia Z5 Android Development] tobias.waldvogel:
system would be good enough.

With the system account we can extract the ta partition or at least ta unit 66667 with the key, which is wiped when unlocking the bootloader. With this we can restore it after unlocking. Although this is too late for everyone who already unlocked it.

I don't see any chance for root with unlocked bootloader, as any change to the system partition will break dm verity and stop your phone from booting.

Anyhow I am confident that I will be able to deliver solution for bringing back the missing functionality, i.e. camera and x-reality. This would be good enough, at least for me ;)

Cheers,

Tobias
[Xperia Z5 Android Development] tobias.waldvogel:
Anyone who can help with this? From unlocked bootloader is sufficient. As an alternative you could send me also a backup of the TA partition with

dd if=/dev/block/bootdevice/by-name/TA of=/sdcard/TA.img

I wote a program to parse it and extract all units. A copy of credmgr.db is place in unit 2500

Cheers,

Tobias
[Xperia Z5 Android Development] langeveld024:
I can share it from my (old) Z, not sure if u need it but maybe you can compare? , unlocked but backed up before unlocking.
[Xperia Z5 Android Development] Duvel999:
I got a TA backup from my Z1 also

Sent from my E6653 @ XDA Portal
[Xperia Z5 Android Development] Joeisgood99:
I can get shell on my locled Z5C via adb obviously, but unable to access, open or use dd on anything interesting as I don’t have root.....

shell@E5823:/ $ cd dev
shell@E5823:/dev $ ls
opendir failed, Permission denied
shell@E5823:/ $ dd if=/dev/block/bootdevice/by-name/TA of=/sdcard/TA.img
dd: /dev/block/bootdevice/by-name/TA: Permission denied
1|shell@E5823:/ $

Not surprised of the result but worth a try.....

---------- Post added at 11:10 PM ---------- Previous post was at 11:05 PM ----------

Thanks. VERY silly me was looking in flashtool/firmware NOT .flashtool/firmware...:silly:

---------- Post added at 11:14 PM ---------- Previous post was at 11:10 PM ----------

Thanks for the info....Have been thinking of learning python for a while now...
[Xperia Z5 Android Development] zxz0O0:
How would you restore it after unlocking? You can read it using the tad service but if I remember correctly you can't write it back because the unit is somehow special protected. Also you can't modify the TA img because we don't know the format.

Edit:

Unit 0x1046B not in the list for TA_WriteUnit
[Xperia Z5 Android Development] tobias.waldvogel:
After investigating now for some days I do know the TA format [emoji6]

Anyway I prefer not to touch the TA partition and to overwrite miscta_read_unit and miscta_get_unit_size via LD_PRELOAD in order to inject unit 66667 again. I did some tests for secd and keyprovd and it works perfectly well.

Fortunately this unit is not read in QSEE, where it would be more difficult.

Cheers,

Tobias

Gesendet von meinem E6683 mit Tapatalk
[Xperia Z5 Android Development] zxz0O0:
Do you know the full format or just the basic for the units, i.e.

int unit;
int len;
int unk1; //0x3BF8E9C1
int unk2; //0xFFFFFFFF
char data[len];

Also good job with the hooking, I didn't think that would be enough to restore DRM functionality.
[Xperia Z5 Android Development] tobias.waldvogel:
Well, TA partition is basically organized as several sequences of units, all starting at multiples of 0x20000

Of course I only know the meaning of a few units. Unfortunately I have lost my key already, but returning any key for 66667 makes the first QSEE init command 0x01f5 for tzsuntory in secd happy.

The keys for Marlin, CKB and Widevine don't seem to be encrypted and are nust verified (Units 2022...). So patching rc for QSEE command 0x01f6 (verify blob) shows them as active again.

Anyway x-reality still doesn't work. Probably here it is easier to overwrite the response from secd.

I will continue to work on it next week when I'm back from holiday.

Cheers,

Tobias

Gesendet von meinem E6683 mit Tapatalk
[Xperia Z5 Android Development] ianrobbie:
Do our still need this file? I've unlocked my Z5's bootloader and can send you the file you need.
[Xperia Z5 Android Development] tobias.waldvogel:
That would be great. I got already one and another one would help to double check that the contents does not depend on the device.

From what I have seen it seems that the credential table is inside secd as an encrypted blob and then decrypted via QSEE app tzsuntory. This is why I would expect it is the same for all devices.

Cheers,

Tobias

Gesendet von meinem E6683 mit Tapatalk
[Xperia Z5 Android Development] ianrobbie:
Check your PMs, I've sent you a Dropbox link.
[Xperia Z5 Android Development] tobias.waldvogel:
Got it [emoji3] Thanks for your help!!

Gesendet von meinem E6683 mit Tapatalk
[Xperia Z5 Android Development] ninestarkoko:
If i understand well, you could partially restore DRM functionalities on unlocked devices, but to restore them completely (especially x-reality) we still need a root exploit on locked bootloader... is it right?

However, thanks for your work!
[Xperia Z5 Android Development] tobias.waldvogel:
If we are able to extract the key _before_ unlocking then we can simulate unit 66667 afterwards, which means fully conserve DRM. A system exploit would be good enough for this, it needn't be root.

For all of us who already unlocked the bootloader I am working on an alternative solution for getting back x-reality. Basically it boils down to wrap the QSEE call for getting the credential which mediaserver is asking to secd.

Probably next week I can provide a new boot image which contains this solution.

Cheers,

Tobias

Gesendet von meinem E6683 mit Tapatalk
[Xperia Z5 Android Development] zxz0O0:
If your method is hooking the library, are you sure all DRM features access the TA partition / key through this library? What about the camera?

By the way there is an exploit which allows system access. https://github.com/secmob/PoCForCVE-2015-1528

The vulnerability might be unpatched in one of the first Z5 firmwares.
[Xperia Z5 Android Development] tobias.waldvogel:
From what I have seen so far all applications (including the camera) communicate through libcredential_manager_services.so with the secd daemon. So there are two options:

- hook the calls to QSEE and miscta* for secd

This is what I am doing currently doing via LD_PRELOAD in the corresponding init*.rc

- hook the client calls by using LD_PRELOAD with zygote32/64

I prefer to hook secd rather than all applications.

In my logs I can see the matching calls to secd from the camera and mediaserver.

With LD_PRELOAD you can overload any call to an external library but not the calls within the library. Currently I am concentrating on the exports of libmiscta.so, libsuntory.so and libQSEECompAPO.so

Cheers,

Tobias

Gesendet von meinem E6683 mit Tapatalk
[Xperia Z5 Android Development] zxz0O0:
Why don't you create your own library which hooks the calls for drm keys and else passes the calls to the original libmiscta? That way it would be universal and not kernel dependent

Edit: Obviously I mean overwriting the original lib in /system and not using LD_PRELOAD
[Xperia Z5 Android Development] tobias.waldvogel:
This is precisely what I am doing. [emoji6]

You just need to modify the boot image in order to add the LD_PRELOAD for secd in the init*.rc files in the ramdisk.

The other option would be to replace a bunch of other libraries directly with wrappers, but then you have to implement a wrapper for each of them and for all exported functions, which would be a tremendous work.

With LD_PRELOAD you just create one combined library for all and implement only the functions you are interested in.

Gesendet von meinem E6683 mit Tapatalk
[Xperia Z5 Android Development] langeveld024:
It is unpatched in the .11 firmware
[Xperia Z5 Android Development] karimsaud21:
Do you plan on attempting to work on the system exploit method for those of us who haven't unlocked our phones? You might be able to cash in on the bounty if you do!
[Xperia Z5 Android Development] pattmyn:
So should we be trying to throw resources at exploiting this? If this is a potential solution, I'd hate to see it get lost in the noise of other comments and such.
[Xperia Z5 Android Development] langeveld024:
I think so, it has several stagefright bugs unpatched so it might be the solution. (see here: http://xdaforums.com/showthread.php?p=64618471)

We can safely downgrade to .11 using flashtool, exploit to system and backup TA, then unlock bootloader, drink a beer and flash what we want.

Though, I don't know how to create an exploitation in this scenario.
[Xperia Z5 Android Development] ninestarkoko:
I still have the 32.0.A.4.11 build (locked Z5 compact never updated) and also, as soon as i have some time, i'm going to bring it for repair under warranty as there are defects on the display. If anyone needs a tester, here i am, but please no bootloader unlocking before i get the phone repaired:D
[Xperia Z5 Android Development] na4hotx:
I have been trying to get past the boot loader part with no luck. After entering "adb reboot boot loader" it will reboot and read " waiting for device" or if I plug in and go right to boot loader I then get "device not found" Does any one know the fix for this?
[Xperia Z5 Android Development] whoosename:
bootloader is one word, there is no space between boot and loader.
[Xperia Z5 Android Development] pattmyn:
Well, I don't have tonnes of experience with this kinda stuff but I know my way around ADB and Fastboot and am currently sitting on a locked BL Z5P. I'm willing to help any way I can; Couldn't care less about the bounty, I just want root on this sucker already so I can properly change the DPI.
[Xperia Z5 Android Development] zxz0O0:
Checked 32.0.A.4.11 for CVE-2015-1528, seems Sony patched it themselves before Google's official fix
[Xperia Z5 Android Development] langeveld024:
I'm sorry, I read it wrong. I thought you meant the CVE-2015-1538. That one should be unpatched.

Check here: http://xdaforums.com/showthread.php?p=64618471
[Xperia Z5 Android Development] na4hotx:
Your response is a complete waste of yours and my time. Not helpful of my issue in the least bit. So yeah thanks for showing me that you suck. BTW using my phone to make post auto spaced bootloader. I know it one word so how about something that actually addresses my issue?