yashsingh1/xdaforums huggingface dataset:
[Xperia Z5 Android Development] munjeni:
Hey mate I have downloaded kernel.sin from the previous post but seems thats not a kernel.sin? I can't extract it, whats going on with that sin? Is sony changed something related to the sin format? Or kernel from the previous post is not a valid sin file? Can you confirm?
[Xperia Z5 Android Development] moutonnoireu:
The .sin works for me (i use flashtool to extract/flash it). Do you want the extracted kernel.elf ?
[Xperia Z5 Android Development] munjeni:
Mate, you have unlocked bootloader and that mean you have lost your drm keys forever! There is no way for you to get your drm key since its lost forever! Whole things related to drm fix and etc have no sense for you since you lost your drm keys forever by unlocking bootloader! The first thing you was need is to dump trim area (partition which contain drm key), but since you unlocked your bootloader your keys is deleted and there is apsolutly no way to get it back!!! Do not waste your time there is no back! Do in mind if you continue to play with your trim area your device will dead soon or very soon!
[Xperia Z5 Android Development] munjeni:
Yes if possible :)
[Xperia Z5 Android Development] moutonnoireu:
Can you explain, then, why on MM i had a drm-fix on my kernel who made me able to use the camera as i wanted to and some others functions ?

Edit : here is the extracted .elf : https://mega.nz/#!RMJxTACD!ESTfdSCA0p2YmWaVHohdpbLY41TQc7DkxTGzPkRm-5k
[Xperia Z5 Android Development] munjeni:
Probably you had that drm key from your device and thats a great if you realy have them saved :)
[Xperia Z5 Android Development] moutonnoireu:
I don't know, i did follow the official sony intructions and developper website to unlock my bootloader.
[Xperia Z5 Android Development] shoey63:
Yeah I extracted it to kernel.elf with flashtool

BOOTIMAGE and VERSION PROPERTIES

# BOOTIMAGE_BUILD_PROPERTIES

#

ro.bootimage.build.date=Tue Dec 13 15:08:50 JST 2016

ro.bootimage.build.date.utc=1481609330

ro.bootimage.build.fingerprint=Sony/suzu/suzu:7.0/LOIRE-1.1.0-161213-0550/1:user/dev-keys

#

# VERSION_PROPERTIES

#

ro.semc.version.sw=1300-4911

ro.semc.version.sw_revision=34.2.A.0.273

ro.semc.version.sw_variant=GLOBAL-LTE2A

ro.semc.version.sw_type=user

Here is a zip with the kernel.elf and MY ORIGINAL pre-unlocked TA.img

View attachment 3987755

Edit: Tried [MENTION=4688377]russel5[/MENTION]'s method and got no sim and no DRM restoration. Could have something to do with Concept rom ramdisk. Will try on official N stock. Can you post a modified boot.img for me to test based on my TA.img?
[Xperia Z5 Android Development] russel5:
[MENTION=4675598]shoey63[/MENTION] this is because you are don't have a selinux permissions for this.

Check your dmesg after reboot your phone. Search all what grep "audit" and you will see.

In my case i made permissive init, tad and kernel. Only after that all works.
[Xperia Z5 Android Development] munjeni:
I saw file_context indeed is in binary form :( it can be patched I think or reverse enginer, no problem at that, but [MENTION=4688377]russel5[/MENTION] we didn't get POC in SE force mode? Its working in permissive mode but that is no point since in permissive mode we are not secure, will be great if [MENTION=4688377]russel5[/MENTION] get that in force mode! Nougat have no permisive mode thats a problem! I have no free time now, working hard to get my tool (see last line in my signature) compatible with sin v3 :( Sin v3 uses lz4 compresion and I curently investigating hoe to decompress lz4 data from sin version 3, anybody help?

Edit:

got lz4 sin things \o/

Edit:

I will look into your files, please stay download links on page
[Xperia Z5 Android Development] russel5:
[MENTION=4675598]shoey63[/MENTION] can you test this kernel ---> HERE
[Xperia Z5 Android Development] core720:
Support for 511?
[Xperia Z5 Android Development] sxtester:
We're a bit late to the party, aren't we?! https://xdaforums.com/showpost.php?p=69869590&postcount=1484
[Xperia Z5 Android Development] Klaus N.:
My nephew's Z1 Compact doesn't pick up the DK.ftf I've flashed via FlashTool. The device is on Sony 5.1.1 stock and stock kernel, of course. So I'm wondering, if the procedure [MENTION=4120742]munjeni[/MENTION] described a few pages back could also work with that device and Android 5.1.1?

Suggestions are very appreciated :)

Thanks in advance!
[Xperia Z5 Android Development] munjeni:
I am on z1c so yes, sure!
[Xperia Z5 Android Development] shoey63:
Not booting on my version of the firmware. I have 266, this one is 273. Are changes only TA.img in ramdisk and edits to initsonyplatform.rc?
[Xperia Z5 Android Development] russel5:
:confused: this is your kernel and i'm don't know why yesterday you are have 273, but today 266 :p

and no, all changes in zImage-dtb
[Xperia Z5 Android Development] shoey63:
Yeah, I just unpacked and re-uploaded the kernel.sin from the other user with my TA.img. Forgot about different version. I will upload 266 in a while. I had problems unpacking image-new.img though. Got segmentation fault. Had to use rootkernel to pull it apart and repack it.
[Xperia Z5 Android Development] russel5:
But can you update to this version and test?
[Xperia Z5 Android Development] mbc07:
Well, that got a little confusing, I'll try to clarify...

AFAIK there's two ways of getting DRM related functions working on an unlocked bootloader, the first one involves the DRM Fix library from the OP and it works by modifying the kernel in a way it preloads libdrmfix.so (included in Root Kernel BTW) for everything. This library then patches the DRM checking instructions on-the fly in one of the two different methods, the first one is the "emulation" mode, where it can trick apps and processes that verify the DRM keys into thinking the device still have it's bootloader locked and that's enough to get most of the DRM related features working, like the proprietary camera algorithms, Mobile BRAVIA Engine/X-reality, etc, although it'll fail on apps that depends of Widevine, for example. The second method is by loading the unique device key from an alternate TA unit (which you've extracted and "flashed" previously), and on that method everything DRM related works exactly the same as when the device had its bootloader locked.

The second method is the recent PoC made by [MENTION=4120742]munjeni[/MENTION], where you simply mount a backup of your TA partition from when your bootloader was still locked into a loop device then modify the kernel in a way it'll mount the loop device instead of the real TA partition of the device. This is a clean approach because you won't need to patch anything else, it just works, but the downside is that we don't have a script that do that automagically like Root Kernel does with the DRM Fix library, so you have do manually edit your kernel's RAM Disk with the required changes.

TL;DR, on the DRM Fix method you modify the kernel to preload libdrmfix.so, if the device key is available in an alternate TA unit, it'll use that and restore all functionality, if the device key isn't available it'll work in emulation mode, where most of the DRM functionality will work except for Widevine. On the "backup in a loop device" method you modify the kernel so it mounts the TA partition from a file (in case, your TA backup from when the device had a locked bootloader) instead of the real TA partition from the device...
[Xperia Z5 Android Development] shoey63:
Problems with WiFi ATM, but I will update and report back when I can.
[Xperia Z5 Android Development] munjeni:
Great explaination [MENTION=5604590]mbc07[/MENTION] ! Who is author of the libdrmfix? I am working on trim area generator and curently Ibhave no idea against which routine drm key is checked, it would be ideal if author of the libdrmfix fix know more about drm...
[Xperia Z5 Android Development] munjeni:
After android 7 there is no more permisive selinux mode so it will not work for sure! You guys must find a way first on earlier android versions to get poc working as I done on z1c in selinux force mode, thats a first thing you must do. Russel5 was soo close, was missing only right selinux label. As I described in my first post of the poc I got it on z1c in se force mode, have tried to make similar for z5 but things is a bit diferent and it worked only in permissive mode since wrong selinux label not allowed thing in force mode. You need to try to get it in force mode too if you want it working on android 7
[Xperia Z5 Android Development] russel5:
[MENTION=4120742]munjeni[/MENTION] i'm set permissive when compiling the kernel from source code. That's why is zImage-dtb most important part and that's why we need to test this.

Since android 6 you can set permissive mode only with sepolicy-inject (for some parts of types) or change some code in source code for full permissive kernel. In android 7 this tool not work, work only supolicy, but only with fake-permissive. In source code i'm steel see this code in /security/selinux/ and this mean that i'm can set permissive only this way.

For my z3c i'm compiling kernel with full permissive mode and don't change anything in file_contexts. For me it's a most simple way to full working drm-keys and custom boot.
[Xperia Z5 Android Development] munjeni:
Agree, indeed it works with custom kernels and permissive mode, but on my z1c I have it working under enforced mode! Just need to be set right file_context to get it working which is not a case on z5, don't have idea why it not working. But in permissive mode its working indeed. :)
[Xperia Z5 Android Development] mbc07:
AFAIK the author is [MENTION=357342]tobias.waldvogel[/MENTION] (the OP), but they didn't publish the source so far and apparently vanished from these forums too...
[Xperia Z5 Android Development] Mario.D:
munjeni

Any thoughts on what will happen if we mount a ta from another phone will it be hardbricked?

I have my own ta but maybe its posible to test some things in the ta to be able to use/modify someones else.

Skickat frÃ¥n min E6653 via Tapatalk
[Xperia Z5 Android Development] Klaus N.:
I'm wondering that, too. The reason is, unfortunately I've created a DK.ftf from the TA.img [MENTION=4675598]shoey63[/MENTION] has provided in the past (it's been removed, because another user bricked his device after relocking by restoring it on his device), and I've already flashed that DK.ftf. But now I'm insecure, maybe it also would brick my device, when it could pick it up. But until now, it didn't (probable fortunately ;)). Therefore - to be on the save side - my question is: Is there a way to delete/remove the already flashed TA (DK.ftf) from the "alternative unit", wherever that is? :confused:

---------- Post added at 22:43 ---------- Previous post was at 21:48 ----------

The 2nd file I've already found and modified, but I don't find the first one "service tad_static" (maybe I'm blind).

I'd be very kind, if you give me a hint (I've extracted the kernel.elf of the Xperia Z1C, 236 fw, stock kernel) :)

Thanks in advance!

Edit:

Just to make it clear, the 1st part of this post is related to my XZ, the 2nd one is my nephew's z1c device ;)
[Xperia Z5 Android Development] shoey63:
You flashed a DK.ftf using my TA.img? It writes it to an unprotected unit in the secondary part of the TA partition, that's why you didn't brick straight away. Try flashing a kernel with DRM fix to see if you get full DRM functionality back. *#*#SERVICE#*#* >service tests > security and see if everything is active.

Edit: You can't brick because the bootloader has already validated the TA partition BEFORE the DRM fix is loaded.

Edit2: Look for service tad_static in init-sonyplatform.rc under #Sony: TrimArea Daemon in the "on boot" section.
[Xperia Z5 Android Development] Klaus N.:
Ok, thanks for your reply. I'm still on the last XZ MM rom, with the appropriate AndroPlus kernel. The drm fix works, but as it doesn't pick up the TA. img (fido keys not provisioned, and it doesn't show "bootloader unlock allowed: yes").

So I don't know what to do.

Thanks in advance!
[Xperia Z5 Android Development] shoey63:
You need to look at service info > configuration for bootloader status.

It should say bootloader unlocked: Yes

Did you have Fido keys provisioned before flashing DK.ftf based on my TA.img, or never checked?
[Xperia Z5 Android Development] Klaus N.:
Yes, I know, and yes, it shows unlocked. No, they haven't been provisioned before flashing the DK.ftf, because I've unlocked my device before it was possible to do a TA-backup. My hope was, after flashing your TA-backup as a DK.ftf it could be reactivated...
[Xperia Z5 Android Development] shoey63:
Don't worry about it then. It's having no effect.
[Xperia Z5 Android Development] munjeni:
Remember for ever, never use anybody trim area to flash on your own phone, never do that! When you brick trim area there is no back! Also never post your trim area since somebody non experienced will download and brick own phone!
[Xperia Z5 Android Development] munjeni:
No brick since you mount file instead of the real partition. Anyway no sense mounting anybody trim area since it for sure have no effect. :)
[Xperia Z5 Android Development] Klaus N.:
Yes, I can confirm that - that way you won't brick your device, but it's senseless, no effect.
[MENTION=4120742]munjeni[/MENTION]

Is there a way to get rid of the DK.ftf on the alternative unit FlashTool has flashed it? If possible, where do I have to search for it (e.g. with rootexplorer), which path do I have to look for?

Thanks in advance!
[Xperia Z5 Android Development] mbc07:
Having the device key on the alternate unit is completely harmless but if you really want to get rid of it you can do that by restoring any TA backup taken from your device before flashing DK.ftf...
[Xperia Z5 Android Development] munjeni:
Just restore your original trim area and you have done!
[Xperia Z5 Android Development] Klaus N.:
I haven't made a ta-backup before unlocking, because the temp root for the Speria XZ came about 2 weeks after. So my ta partition is wiped. Is it possible anyway by downgrading, relocking the bl, and doing a backup of the wiped ta partition? :confused:
[Xperia Z5 Android Development] Soheil_rf:
Anyone can confirm this tool working with kernel Xperia XZ android 7 ?
[Xperia Z5 Android Development] meistr91:
Yo guys just to be sure, if I have flashed once my own DK.ftf file which i got from my TA back up, it will always be there? doesnt matter how many factory reset i have done or flashed stock ftf or any rom?
[Xperia Z5 Android Development] Klaus N.:
Yes, that's correct. Even if you check all boxes of the wipe section in FlashTool, before flashing a <rom>.ftf, it will be untouched.

---------- Post added at 17:21 ---------- Previous post was at 17:10 ----------

@munjeni

Regarding your tutorial:

If I want to modify my nephews z1c, when I open init.sony-platform.rc, it shows this:

service tad_static /sbin/tad_static /dev/block/platform/msm_sdcc.1/by-name/TA 0,16

and not that:

So what's my mistake? I took the kernel.sin right out of the <rom>.ftf...

Thanks in advance!
[Xperia Z5 Android Development] munjeni:
Some tad_static uses mmcblk0 directly but some uses mmcblk0p1, in first case tad_static uses 1,16 which mean block1,16nextblocks since trim area in mmc starts on block1, but in seccond case when partition mmcblk0p1 is chosen instead of mmc first block is 0 so it looks like 0,16nextblocks, hope clean now? So since you going to mount trimarea.img to loop1 it will start from 0,16. One more thing, you must use excatly the same kernel as your curent rom or android will not work correctly!
[Xperia Z5 Android Development] Klaus N.:
Thank you very much for your expanation. So - in my case - I should change

service tad_static /sbin/tad_static /dev/block/platform/msm_sdcc.1/by-name/TA 0,16

to:

service tad_static /sbin/tad_static /dev/block/platform/loop1 0,16

or also to:

service tad_static /sbin/tad_static /dev/block/loop1 0,16

:confused:

Thanks for your patience!

P.S.: Yes, it's exactly the same kernel of the rom he uses.
[Xperia Z5 Android Development] munjeni:
service tad_static /sbin/tad_static /dev/block/loop1 0,16
[Xperia Z5 Android Development] EMMANUEL PM:
please, can you help us with the last support (32.2.a.305) for xperia z3+ dual. thanks a lot
[Xperia Z5 Android Development] x_one:
I'm glad to see it for Z3C, but can you tell me something before I start flashing?

I don't think i need DRM-Verify and SONY RIC off, just want restore DRM Keys...

I need kernel that passes Safety-Net because of banking app.

I'm using now systemless SuperSu +suhide +rootswich scripts and systemless xposed.. Everything is working nice for now, but I can't and I don't want make system partition changes.

The kernel doesn't make any changes in system partition after this mod? Can I use systemless root with systemless xposed as earlier?

I see that I can compile it by myself and leave DRM-Verify and RIC as stock, but will those DRM keys working?

Thanks in advance!
[Xperia Z5 Android Development] munjeni:
Excatly! Thats a point of my PoC!!! You guys need to find a way to mount trim area as I mentioned without disabling selinux and etc! I got it under z1c fully working and I am 100 percent sure it will work on other models too, you just need to setup right selabel to get it work! I mentioned how to do it but seems no body want it thus nobody going to try byself. I can't help total noobs and learn him about basic things like unpacking/repacking ramdisks and etc, basic skills is ned for this. I got a lot of questions and private messages where guys asking me that basic things, sorry I am not teacher and sorry I have no free time teaching anybody, sorry but teach byself.

Ofcourse you no need to modify system partition but you can get root, locked like bootloader and everything by sistemles mode ofcourse! Purpose of my poc is: unlock bootloader and mount trim area to loop device trought custom stock kernel for having fully locked like bootloader mode after that kernel boots up with all drm and etc keys like locked bootloader mode. Its working PoC definitelly (I am pretty sure further workaround)!!! A have explained what is need, just figure it out for your device! Enought from me? ;)

I have allready started working on an universal tool which I can extend for my PoC purpose e.g. for implementing an automated patching mechanism but firstly we realy need to find an "universal" way doing that for all devices in compatibility mode, that is a hard figuring out I know since every device have diferent ramdisk, but possible. Curently I saw that working only on my device and not believing that nobody here interested for it, and nobody tried-got it under his own device :( (except Russel5 which got it in selinux permisive mode only, I am prety sure it can work in force mode as like I got on my z1c device)
[Xperia Z5 Android Development] darwusch:
Maybe it reaches more people if you move the topic to the cross-device section for Sony:

https://xdaforums.com/crossdevice-dev/sony

I will try it for sure, both for my Z5C and XA ultra, as soon as I have time.

Thanks for this great solution!
[Xperia Z5 Android Development] mbc07:
If that brings you hope, I'm gonna try your PoC on my Xperia M5 really soon, didn't do before because I was busy with real life stuff, and from a preliminary look I did at the RAM Disk, implementing your PoC should be pretty straightforward...
[Xperia Z5 Android Development] erveemoskovic:
I had no problems with 32.2.A.5.11.

I just flashed 32.2.A.5.11 (E5823_32.2.A.5.11_1299-7245_R5C / Customized NL) and patched the boot (copy 3.10.84-perf-g4a67e86 to 3.10.84-perf-g0802f10) with the latest SuperSU-v2.79-201612051815.zip and xposed-v87-sdk23-arm64.zip and it all runs fine. Still have root and xposed.
[Xperia Z5 Android Development] Klaus N.:
On my device (Xperia XZ, F8331), the script of [MENTION=357342]tobias.waldvogel[/MENTION] works well so far. I've repacked the 3.30 mm stock kernel with DM-verity off, Sony RIC off, SuperSU (SR2 of v2.97), Xposed Framework v87-sdk23-arm64 and DRM keys. The only thing is, unfortunately it's not possible to integrate TWRP. Therefore I've to flash the official one made by AndroPlus separately. But that's the problem, because this way it's not possible to neither reboot into TWRP directly from system, nor it's possible to mount/unmount /system in TWRP. But on the other hand, flashing this repacked kernel, it's the only way (for me) to get the kernel working with SELinux enforcing. I did a try repacking the kernel only with DM-verity and Sony RIC off, and SuperSU flashing via TWRP, and a check of the SELINUX state (via #getenforce) shows "permissive".
[Xperia Z5 Android Development] serajr:
Yes it is! Internal TWRP is fully working on my XP F8131 (MM) with proper changes I made. It may be possible on XZ, X as well.

Also, I'm updating the tool to support Nougat's kernel, including file_contexts.bin file, and also with some new features (marked blue). Up until now, this is its output:

E:\Android\rootkernel_v5.0_Windows_Linux>rootkernel n_kernel.elf boot.img
- Unpacking kernel
Found elf boot image
Kernel version: 3.18.31-perf-g6af3ae9
Found appended DTB
- Detected vendor: somc (Sony), device: dora (Xperia X Performance), variant: row
- Unpacking initramfs
- Detected platform: 64-bit
[B][COLOR="Blue"]- Detected Android version: 7.0[/COLOR][/B]
- dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] Y
Disabling dm-verity
[B][COLOR="Blue"]- forceencrypt is enabled. Disable? (Say yes if you wipe /data) [Y/n] Y
Disabling forceencrypt[/COLOR][/B]
- Sony RIC is enabled. Disable? [Y/n] Y
Disabling Sony RIC
[B][COLOR="Blue"]- Install TWRP recovery? [Y/n] Y
Converting file_contexts.bin into file_contexts (required due the choice)
[/COLOR][/B] Installing TWRP
Compressing TWRP image
- Install DRM fix? [Y/n] Y
- Install busybox? [Y/n] Y
- Creating new initramfs
- Creating boot image
- Cleaning up
Done

MM - OK

N - Never been tested

I've made this for my personal use only, but if all the tests which I'll still need to do are successful, why not share it? No ETA.

Edit:

New output, and conversion of file_contexts.bin into file_contexts is now immediate (also it will only be converted if necessary, due the choices)!
[Xperia Z5 Android Development] Rizal Lovins:
great work [MENTION=357342]tobias.waldvogel[/MENTION] simple tool to save my time compiling kernel :good: just tested today and is working Xperia Z5 E6683 Build 5.11 MM

is there anyway to rework DRM key even i wiped all data? never know that DRM key can simulated on unlocked bootloader since i use xperia again a few weeks ago :cowboy:
[Xperia Z5 Android Development] Klaus N.:
Thanks alot for your reply - looks very promising! But yes, I'll not ask for eta, of course [emoji106]
[Xperia Z5 Android Development] whalesplaho:
buddy yhu stated dat yhu have XP F8131 (MM) but in tha logs, it shows Android Nougat 7.0.... i dnt understand!

thumbsup brov.....:good::highfive:
[Xperia Z5 Android Development] serajr:
Log shows us output with N's kernel, but I've not tested it yet cuz I'm on MM!
[Xperia Z5 Android Development] whalesplaho:
okay... Please update to N so yhu can explore and give us something great... Thanks always for yur work!
[Xperia Z5 Android Development] Klaus N.:
The same as me, because I need Xposed (your Super User Mode X + the XPrivacy module) ;)
[Xperia Z5 Android Development] D1kiy:
Is it other way to flash DK.ftf or unpacked *.ta file without FashTool? Can I use adb or fastboot for that?
[Xperia Z5 Android Development] zeletrik:
Hey guys!

My friend need to root his Z5C and he told me it hase a pre-unlocked bootloader.

So he can skip the DM-Verity kex backup and restore and jsut need to patch the kernel? :confused: