yashsingh1/xdaforums huggingface dataset:
[Xperia Z5 Android Development] jugglerpl:
I confirmed that although status bootloader "Bootloader unlock allowed: YES" it is possible flash new kernel. It is very strange because earlier only "Bootloader unlocked: YES" allow flash kernel. I think so, but if I am not sure please correct me.

Some people reported that after using tutorial they have "Bootloader unlock allowed: NO" . Please check does this status allow flash kernel.

For people who have older Marshmallow and they would like update firmware without lose root:

1. Download last firmware

2. Flash via Flashtool (with or without wiping data)

3. Create and flash repack kernel (first post)

4. Go to recovery and flash SuperSU

I checked update 32.1.A.1.163 -> 32.1.A.1.185 without wiping. Everything is ok, but I flashed via Flashtool not OTA. OTA can be dangerous I think so. But of course if someone tried I would be cheerful for feedback.
[Xperia Z5 Android Development] swagie:
No on my d drive
[Xperia Z5 Android Development] ninestarkoko:
Tried on my Z5 compact still running Lollipop .200 :

MARLIN Ok Active

WIDEVINE Ok Active

CKB Ok Active

....

FIDO KEYS: Provisioned

It works. Thank you also for fixing kernel creation for Lollipop kernels :)
[Xperia Z5 Android Development] devilmaycry2020:
@tobias.waldvogel

I've tried to patch kernel E6683_32.0.A.6.152 but failed. No rootedkernel.img created. here is my log file. Help me please. thanks
[Xperia Z5 Android Development] tobias.waldvogel:
New version V4.0

I just published a new version V4.0 ;)
[Xperia Z5 Android Development] devilmaycry2020:
C:\rootkernel_v4.0_Windows_Linux>fastboot boot rootedkernel.img
downloading 'boot.img'...
OKAY [ 0.958s]
booting...
FAILED (status read failed (Too many links))
finished. total time: 1.050s

I put my phone into fastboot mode (Volume Up + connect USB) the led turn red then turn blue and error show as above.
[Xperia Z5 Android Development] tobias.waldvogel:
That was an issue with the old LP kernels. It is fixed in V4.0 ;)
[Xperia Z5 Android Development] tobias.waldvogel:
Probably this is related to an outdated fastboot binary
[Xperia Z5 Android Development] devilmaycry2020:
so how to update it ? and why there are too much lines when i run this command "rootkernel.cmd kernel.elf rootedkernel.img" over 20K lines
[Xperia Z5 Android Development] allayarov.i:
Yes it is possible. See here:

https://xdaforums.com/showthread.php?p=70618834
[Xperia Z5 Android Development] YasuHamed:
YESSSS

ROOTED beauty of XPERIA Z5P in my hand on android N

DRM FIXED, DM VARITY OFF

thank you [MENTION=3989065]serajr[/MENTION]
[Xperia Z5 Android Development] bruno$0:
Thx for asnwer me, but i don't understood the link that you added.

I refer for a neutral twrp that works in any version android. Someone can share a twrp fota_recovery image for z3+ dual model? to flash a twrp fota_recovery is just give the fastboot flash recovery twrp.img???

Every image that i have tested don't blink red led....

it's better put the recovery in kernel or fota_recovery?
[Xperia Z5 Android Development] Hamidreza2010:
Do you have recovery?
[Xperia Z5 Android Development] YasuHamed:
when you are updated on ANDROID N and have modified kernel for N prepared by workaround posted by [MENTION=3989065]serajr[/MENTION]

https://xdaforums.com/showpost.php?p=70595975&postcount=1702

and SR5 2.78 supersu . zip , all in sd card

in adb (command prompt window)

connect your device in fastboot mode and run z3+ dual (or whatever device you have), LAST MODIFIED KERNEL IMG FILE having TWRP. MM KERNEL boot.img

type fastboot boot boot.img and enter and see your xperia screen and when the led comes, volume UP or touch screen it will go to twrp!

flash first the drmfix having Nougat kernel (modified)

and flash superSU

reboot

so far this is the only way to have root access!

---------- Post added at 12:33 PM ---------- Previous post was at 12:31 PM ----------

after updating to N

i used LATEST MM KERNEL came in DEC2016.

temp boot using fastboot command

went in to twrp and flashed the modified kernel of N with DRM FIX workaround by [MENTION=3989065]serajr[/MENTION] and flashed SR 2..78 SuperSU .zip and rebooted
[Xperia Z5 Android Development] bruno$0:
Thx 4 the info!

I just imagine that twrp will really flashed not just booted. ;)
[Xperia Z5 Android Development] serajr:
DO NOT include twrp! Please read instructions/pages carefully!!

Glad to know I've helped out somehow!
[Xperia Z5 Android Development] Hamidreza2010:
I did exactly as you told but my phone didnt root ( e6633 )

when i open supersu , its says there is no su binary installed and .......

---------- Post added at 02:23 PM ---------- Previous post was at 02:17 PM ----------

then how can we flash it?

recovery not present for N
[Xperia Z5 Android Development] boyq:
In case anyone is experiencing the same (maybe for Windows 10 users?) and wondering why boot.img, etc. isn't showing in the same folder, all outputs are saved in below folder:

C:\VTRoot\HarddiskVolume5\rootkernel_v5.0_Windows_Linux

Also, incase anyone is experiencing fingerprint hardware not available error after unlocking bootloader, here's a quick solution.
[Xperia Z5 Android Development] shoey63:
Looks like I need to build a whole bunch of TWRP's to flash to FOTAKernel.

TO DO list.

- Z5

- Z5 compact

- Z5 Premium

- X

- X Performance

(I own Z5 and X)

Any other suggestions?

Edit: I have Omnirom sources. Any compatible device will be easy to build. Others - maybe not.
[Xperia Z5 Android Development] serajr:
Create it once again!

Flash twrp first (Androplus twrp img, mentioned some pages ago). Or you can also use your own MM kernel which has twrp included to flash the zip!
[Xperia Z5 Android Development] serajr:
It would be awesome, but I know this task can be difficult.

I also have the correct script to initialize fotakernel recovery at the Sony logo, which we can later introduce into ramdisk!

(I own XP)

Edit: Recovery works perfectly with a "decryptable" device (wiping /data may be necessary)! I think you do not have to worry about trying to use the default twrp encryption for now.
[Xperia Z5 Android Development] Sal868:
Boot to recovery and flash SuperSu 2.78
[Xperia Z5 Android Development] whalesplaho:
yeap no recovery. so yhu ll fastboot tha kernel with recovery (advisable stock kernel with twrp or any) den flash tha deodex patch zip & also tha drm fix zip (from here; https://xdaforums.com/xperia-z5/general/ub-drm-fix-dm-verity-off-root-t3539999) and reboot...

---------- Post added at 04:10 PM ---------- Previous post was at 04:07 PM ----------

superb..... TWRP coming soon!!!:highfive::good:

- XZ

- Z3+/Z4

---------- Post added at 04:11 PM ---------- Previous post was at 04:10 PM ----------

if i understand, TWRP work fine on N OS?

super duper buddy...:good::victory:
[Xperia Z5 Android Development] DiscMan55:
[MENTION=3989065]serajr[/MENTION] Is there anyway to get the kernel modified only for DRM fix without losing dm-verity ? I use magisk, and I like the extra security that /system is not tampered with.

Also, all the TWRP available on the forum currently cannot decrypt stock-encrypted /data, I hope you got it working (is this supported even on omnirom-sources ?) I tried to build from cm13 sources with SonyKitakami repos and sony kernel in local_manifest but couldn't get the build going due to missing files.

Finally, I noticed that the LED doesn't glow orange and I can't access recovery flashed TWRP except if I enabled internal TWRP using this tool (even though I never booted it), does the new bootloader fix that ? (so only stock kernel + drm fix will give full functionality ?)

I use Sony Z3+ Dual (E6533). Thanks a lot in advance.
[Xperia Z5 Android Development] serajr:
The workaround does use /system/vendor/ lib folders, but original rootkernel tool does the same with systemless mode, which means that it's possible! But for now, I really don't know how to do that! I will ckeck it out.

To access flashed recovery you need to turn device off, wait few seconds, turn it on by pressing Power and Volume Down buttons, then release Power buttom only (after the vibration).

About twrp, the only way I got it fully working was by decrypting (formating) /data partition, but I can also confirm that this one does work with default encrypted data (at least on MM).
[Xperia Z5 Android Development] angelouss:
hi everyone. i just followed [MENTION=3989065]serajr[/MENTION] methode but no root at the end ( supersu installed but it says: no binaries ... ect) i used the last one .79 could any one confirm if it worked for him ?

im with a z5 premium dual e6833

---------- Post added at 09:18 PM ---------- Previous post was at 08:26 PM ----------

wiped caches ... didnt work

so i reflashed the rom and flashed the .78 r5 its working
[Xperia Z5 Android Development] DiscMan55:
Thanks, I hope you can get it working in systemless mode!

You mean it works with Snapdragon 810 encryption used by Sony Stock ROM ? The problem as I could see it was related to missing drivers in omnirom source to talk to snapdragon 810 secure chip (I reported the error here: https://xdaforums.com/showpost.php?p=69369110&postcount=30). The most interesting part seems to be in the following lines:

I:Is encrypted, do decrypt page first
I:Switching packages (TWRP)
I:Set page: 'decrypt'
I:Set page: 'trydecrypt'
I:operation_start: 'Decrypt'
crypt_ftr->fs_size = 48365536
Using scrypt with keymaster for cryptfs KDF
could not find any keystore module
Failed to init keymaster
Signing failed
kdf failed
failure decrypting master key
Failed to decrypt master key
crypt_ftr->fs_size = 48365536
[Xperia Z5 Android Development] YasuHamed:
sir plz help building patchtool for N kernel that support BIN format in order to

-switching off dm-varity / sony ric / drm fix / embedding twrp

- in MM days, i never patched SUPERSU in to kernel because of battery draining issues

---------- Post added at 07:26 AM ---------- Previous post was at 07:22 AM ----------

i have E6833 and rooted perfectly with the method shown by [MENTION=3989065]serajr[/MENTION]

plz read my detail work in page 173/174
[Xperia Z5 Android Development] bruno$0:
Please, add support to Z3+ model.
[Xperia Z5 Android Development] DiscMan55:
[MENTION=3989065]serajr[/MENTION] Maybe you can try writing the DRM fix only as a magisk module :)

This way people who only want DRM fix can use the stock kernel without any repacking at all! and do all mods such as root and xposed using magisk in systemless mode.

Then only needed would be allowing TWRP to be reachable using vol down + power when flashed to recovery partition (and no need to touch FOTAKernel at all!).
[Xperia Z5 Android Development] deepongi:
There's twrp for XP since a while back..

https://basketbuild.com/devs/AdrianDC/Dora/TWRP-Recovery

I don't see why you need to build it. If you wanna go to the trouble, make for X, since me and Adrian weren't able to get it working yet.

Regards.
[Xperia Z5 Android Development] serajr:
Just follow the workaround instructions and you're good!

I've never used magisk before, neither even know it well! Anyway, I will check it out!

Btw... Please guys, do not put all your hopes on me, I'm not a kernel developer like OP is (I'm a java developer). I'm just sharing my personal workarounds over his tool. We are all still waiting for [MENTION=357342]tobias.waldvogel[/MENTION] return!!
[Xperia Z5 Android Development] shoey63:
Well there is another problem. N kernel symlinks system/vendor to the ramdisk, and this tool creates a /vendor folder in the ramdisk. Can't have both.

Good thinking:good: Another way could be to create an su.d script to systemlessly bind mount the libdrmfix.so module to /system/vendor/lib

Thanks for that. There are no Omnirom or CM/Lineage sources for the Tone platform, so I wouldn't have been able to do it. :o

Edit: I have no problem building TWRP for X with Omnirom 6.0.1 sources and /bootable/recovery 7.1.1 branch. I just cant get TWRP to read encrypted /data with default password. Apparently the XP TWRP can. Any idea how it's done?

Well we all know your credentials as a java dev. Legendary actually :highfive: We just need a simple way of systemlessly adding the DRM fix to the ramdisk without interfering with the /vendor symlink.
[Xperia Z5 Android Development] serajr:
Thank you bro :highfive: ^^ exactly what I was trying to fix up!
[Xperia Z5 Android Development] ric69:
How can you deodex as system cannot be modified without RIC disabled ? Are you sure it's working ?

I did not tried patch, but I tried to flash XnextCamera.project with step 6/7, it's not working (and I checked SuperSU with system users trust)
[Xperia Z5 Android Development] deepongi:
We are stuck on the same. Decrypt data/internal memory.
[Xperia Z5 Android Development] fluffi444:
[MENTION=4120742]munjeni[/MENTION] [MENTION=4688377]russel5[/MENTION]

This is f**king awesome guys! Outstanding Work! Full DRM with own TA.img and custom kernel!

For me I used Z3C Elite Kernel (SELinux permisive), removed libdrmfix.so and deleted its loading (in init.target.rc)

After that it was needed to delete the following folders and including files (to reset DRM from former installed DRM fix)

/data/credmgr
/data/drm
/data/mediadrm

That was the key! Works! :good:

Works here with russels modification for Z3C.

Maybe its time to move this stuff out of this thread! It was an coincidence that I found this great work of you guys.

Maybe that is the reason why you did not get the response which this work deserves! This stuff is really hidden in this thread.

Maybe you can add here the changes in file_contexts especially for Z3C (Z3? as well)

I now know that you wrote the changes to tad_block_device it but it was quite heavy to find :)

/dev/block/loop0	u:object_r:loop_device:s0
/dev/block/loop1	u:object_r:tad_block_device:s0
/dev/block/loop[2-9]*	u:object_r:loop_device:s0
[Xperia Z5 Android Development] allayarov.i:
I just got deodex patch from 4pda.ru and installed it. Nothing more. Everything was ok, no errors during the install.
[Xperia Z5 Android Development] s.hossein:
Can you share deodex patch with us.
[Xperia Z5 Android Development] mbc07:
Actually I did create a Magisk Module with the DRM Fix library last year, you can check it on my GitHub. Keep in mind that it is completely untested, you still need to include the LD_PRELOAD directive in the RAM Disk like [MENTION=3989065]serajr[/MENTION] posted and that you must be using Magisk v10 or newer, as previous versions of Magisk would bootloop when adding files to /system/lib(64)...
[Xperia Z5 Android Development] rocker00:
[MENTION=4962787]fluffi444[/MENTION] i applied drm fix by this tool and i didn't test the new method yet but i want to check something, after you applied the new method do you have that unknown error line like the one in my screenshot or not ? could please post screenshot from your device ? thanks in advance.
[Xperia Z5 Android Development] fluffi444:
No. I do not have this line...
[Xperia Z5 Android Development] rocker00:
/dev/block/loop0	u:object_r:loop_device:s0
/dev/block/loop1	u:object_r:tad_block_device:s0
/dev/block/loop[2-9]*	u:object_r:loop_device:s0

[/QUOTE]

this really helped me a lot, i did it now and no more unknown error.thank you so much :).

also [MENTION=4688377]russel5[/MENTION] & [MENTION=4120742]munjeni[/MENTION] brilliant work guys you are awesome :).
[Xperia Z5 Android Development] allayarov.i:
Here is it: https://yadi.sk/d/uIxcssWV39VNN9
[Xperia Z5 Android Development] x_one:
I can't solve it on my Z3C..

I've tried follow steps writen by [MENTION=4120742]munjeni[/MENTION] and [MENTION=4688377]russel5[/MENTION] but still can't make it working, still no sim, no camera, no keys.

With kernel posted by [MENTION=4688377]russel5[/MENTION] is the same..

My TA.img is located at /data/local/tmp/

in dmesg.log I can find

[ 139.057557] init: Starting service 'tad_static'...
[ 139.070437] init: Service 'tad_static' (pid 7721) exited with status 1
[ 139.077416] init: Service 'tad_static' (pid 7721) killing any children in process group

[MENTION=4962787]fluffi444[/MENTION] can you share your patched kernel for me to test if it will work?
[Xperia Z5 Android Development] fluffi444:
Sure! I must admit that I did some further modifications.

For me the chmod/chown in TA script (as [MENTION=4688377]russel5[/MENTION] made it) didn't work. But I still wanted to keep the alternative loading of original TA mounting (by-name/TA). For that I put the permission setting back to init.sony-platform.rc. So all in all this is a mix of both ways... But works...Also important to use that busybox (1.629kb) posted here in the thread! Latest 1.26.2 from Osmosis did not work. Guess some tools are missing in that... Don't know... Furthermore DRM fix (original part of Elite K) is removed...

on post-fs-data
chown tad tad /data/local/tmp/TA.img
chmod 0770 /data/local/tmp/TA.img

# SONY: Start early TA-users

and reduced the TA script in sbin that it looks like this

#!/system/bin/sh

BB=/vendor/bin/busybox
ta=

#check TA.img in /data/local/tmp
if [ -e "/data/local/tmp/TA.img" ]; then
${BB} losetup /dev/block/loop1 /data/local/tmp/TA.img
ta=/dev/block/loop1
else
ta=/dev/block/platform/msm_sdcc.1/by-name/TA
fi
exec /sbin/tad_static $ta 0,16
exit 0

The attached zip is without TA.img... Just copy it to folder /data/local/tmp/...

Also important: Do NOT only reboot. Shutdown phone and reboot from scratch after flash from TWRP... I got crazy while testing and found out that only a proper full shutdown helps to accept new flashed kernel completly... I use img flash (not zip) via TWRP

If it still do not work us a fresh copy of your saved TA.img - For me that helps after testing. Looks like that something wrong/bad was written to TA.img during my several boots etc...

FILE DELETED (its was systemless prerooted)

Try this one: https://xdaforums.com/showpost.php?p=70671335&postcount=1824
[Xperia Z5 Android Development] zacharias.maladroit:
How about bind mounting files inside system/vendor ?

Would that work ?

http://unix.stackexchange.com/questions/44373/single-bind-mounted-file-gets-out-of-sync-in-linux

http://unix.stackexchange.com/questions/198590/what-is-a-bind-mount

There however still would be the dmverity / RIC issue, no ?

or did I miss anything ?
[Xperia Z5 Android Development] tatomolina11:
[MENTION=1729195]zacharias[/MENTION].maladroit I've been using your kernels since the first day I bought my Z5 they are awesome, waiting for your N version kernel... Still have to wait for ric issue and recovery right?
[Xperia Z5 Android Development] whalesplaho:
Waiting might take long in respect of sony pulling out N OS from there servers but dey promised quick fix to bugs complained n fast roll out back!
[Xperia Z5 Android Development] x_one:
Still not working. It's the same when I remove TA.img. No sim, no camera, but if I understand it should be like before without keys. In service menu->service tests->security It says "None".

I'll try clean flash and then check.
[Xperia Z5 Android Development] fluffi444:
I had this "none" also during my tests several times. As far as I remember (actually I don't know it anymore in particular) a cold boot helped. But be sure that your TA.img is working. Maybe also your original TA partition as some bad information as well in the meantime - but don't know...

Give me some time - I will do some further test... How do you rooted? Systemless? SuperSU?

[MENTION=3697891]x_one[/MENTION] - Try this one - I build this from scratch with original EliteKernelV3.

I must admit that my first one was with systemless supersu installed. Could be a problem.

Last thing I can recommend is to delete:

/data/credmgr

/data/drm

/data/mediadrm

And delete data of apps:

Image optimizer

CredentialManagerService

Album

I also useed app cleaner and system cleaner with app SDMaid to get rid of old cache and files.

Again - don't really know if this is needed or not (this data cleaning) - But I did it....

Check in booted phone

root@D5803:/ # losetup -d /dev/block/loop1

output must be:
losetup: /dev/block/loop1: Device or resource busy

and

root@D5803:/ # ls -l /dev/block/loop1

output must be:
brwxrwx--- root tad 7, 1 1970-02-28 22:23 loop1

Otherwise - I'm out of Ideas :confused:

EDIT

As munjeni wrote: selinux permissive must work - and elite kernel is it. So actually this cannot be the issue with this kernel.

Even if permissive is not the main goal...
[Xperia Z5 Android Development] shoey63:
Thanks for the suggestion. bind mounting may be an option to explore. dm-verity is no problem, just need to remove "verify" from the /system line in fstab. As far as RIC goes, it is probably better to leave it enabled and do /system modifications in TWRP via flashable zips or TWRP's inbuilt file manager, and or terminal emulator.
[Xperia Z5 Android Development] munjeni:
First of all check what says logcat! You have problem with selinux enforce and wrong selabel for TA.img or to loop1, more details you can see in logcat. On my z1c I got thing fully working in enforce mode, reason was right selabel. On other phones I have no idea which selabel must be aplied to get it working under enforce mode, see logcat for idea! But definitelly you can get it working in permissive mode which is not a main goal of the PoC, you guys must figure out right selabel! Hope this help. :)

Edit:

Did you modified file_contexts as per instruction? Post your logcat please
[Xperia Z5 Android Development] munjeni:
BB=/vendor/bin/busybox

Use busybox from here https://xdaforums.com/showpost.php?p=70330773&postcount=1575 and install it to the /vendor/bin/busybox
[Xperia Z5 Android Development] x_one:
[MENTION=4962787]fluffi444[/MENTION], I rooted my phone with SuperSU Systemlessly because I need my banking app working and I've solve it with suhide (it's working nice here with xposed).

I did some investigations before Your post. I can't solve problem with keys if i had TA.img in /data/local/tmp/ or removed the file. After fresh flash I could boot without problems without TA.img in the right place, but when I place the file again no sim, no camera.

Maybe it's problem with my TA backup (it was made with Backup-TA 9.11 - the old one).

Now I've relocked device and restored TA. Seems all keys are working.

I did new backup with backupTA v2 (dirtycow).

[MENTION=4120742]munjeni[/MENTION], in dmesg i see only

Starting service 'tad_static'...

[ 139.070437] init: Service 'tad_static' (pid 7721) exited with status 1

[ 139.077416] init: Service 'tad_static' (pid 7721) killing any children in process group

I did modifications of file_contexts, but i thought that maybe I did something wrong so I've flashed [MENTION=4688377]russel5[/MENTION]'s kernel with he had working on his device - effect the same.

After that I've flashed [MENTION=4962787]fluffi444[/MENTION]'s kernel and the same. So it couldn't be a problem with wrong files editing. :(

Now I have technical problem. Just noticed that my front panel peel off and my warranty is ending (I have 3 weeks for warranty service).

Quick question.. DK.ftf is cleared afret full flash, or I should clear it someway, or maybe they won't see it if it's still there?

I'll Start ove on this project after I'll get my phone back, now it's pointless to flash it over and over.
[Xperia Z5 Android Development] munjeni:
[MENTION=3697891]x_one[/MENTION] I need logcat not dmesg
[Xperia Z5 Android Development] x_one:
[MENTION=4120742]munjeni[/MENTION] sorry...

Attached. This is logcat before flashing fw.
[Xperia Z5 Android Development] fluffi444:
Same config here. SuperSU systemless with suhide and 86.2 xposed... My TA backup (also with Backup-TA 9.11) works.

As I said already. russel5 Kernel only works after I set permissions of TA.img manually (root:root 0770)!

His script is not working for me in regard to permissions. Therefore I moved the permissions back to init.sony-platform.rc (tad tad 0770).

If your phone is now LB with working keys then you are fine... My old phone was also send to service... Was UB as well before. I relocked it and flashed 100% 291 stock... I got an new Z3C as replacement... But be informed that many users got an X compact as replacement... Looks like this depends on were you live and if local service as Z3C on stock or not.

Guess its time for logcat as master [MENTION=4120742]munjeni[/MENTION] recomended.