yashsingh1/xdaforums huggingface dataset:
[Xperia Z5 Android Development] butilities:
Hi sorry if I make mistake. My device is Xperia Z5 dual. I am having problem using the flash_dk tool you provide. I have the TA backup, tested on windows and linux, both giving the error:

"Could not find device key in TA (Unit 0x1046B)"

I figured it was the wrong unit for my TA backup. I have been looking to find the right unit value but have no idea on the DRM key format. Can someone shed light on how do I recognise the keys. Been trying this:

bootimg readta -i TA -u 0x1046B -h

for several differrent units value.

I can share my TA for you as well if you like.

The command:

bootimg readta -i TA -u 0x8a2

also doesnt work as it might reside in different unit(address I presume)

Thank you in advance
[Xperia Z5 Android Development] tobias.waldvogel:
The unit is not a memory address, it is and identifier, which is equal for all Sony Android devices, even the older ones.

It looks like something is wrong with you backup. If you send me your image I will have a look.
[Xperia Z5 Android Development] butilities:
I sent you the TA image and my service security image as well. Thank you
[Xperia Z5 Android Development] uripiruli:
Someone that repacked his drm Keys could tell me if miracast, noise cancelling and the others sony functions works?? I remember when drm Keys are simulate some Sony's function don't work....

Thanks in advance

Enviado desde mi E6653 mediante Tapatalk
[Xperia Z5 Android Development] josephnero:
Why does it close as soon as I open it?Sorry but I tried everything. Windows 7. I extract it to a folder and as soon as I click to open it it closes
[Xperia Z5 Android Development] Bronnel:
I also have exactly the same problem on LP, on MM it works great without any problem, I have Z5 Dual (E6633) 32.0.A.6.152_Generic_1297-9122_R7B

---------- Post added at 06:35 PM ---------- Previous post was at 06:24 PM ----------

So Can I use my MM kernel for LP?
[Xperia Z5 Android Development] tobias.waldvogel:
There was a bug in the unit read routine which led in your particular case to an error.

This bug is fixed in now in version 4.22. Please try one more time ;)
[Xperia Z5 Android Development] tobias.waldvogel:
No, you can't use a MM kernel for LP. I forgot that there is still no MM for Z5P. Unfortunately the recovery startup is pretty hard to track. Nevertheless I will do some investigation.

There IS MM for Z5P. May be you want to upgrade and try again ;)
[Xperia Z5 Android Development] Infy_AsiX:
It already is on AOSP. Devs use a method similar to the original DRM fix https://xdaforums.com/crossdevice-dev/sony/xperia-z1-z2-z3-series-devices-drm-t2930672
[Xperia Z5 Android Development] tge101:
Oh, it's already baked in?

Sorry, I'm fairly new to it and I was under the assumption that stock quality couldn't be reproduced in LOS.
[Xperia Z5 Android Development] Infy_AsiX:
Yep. That's ok, it's not generally known. I just found out for sure as described after all.
[Xperia Z5 Android Development] tge101:
With what you're trying to do, did it get all of the stock processing done? Even with what you showed in AOSP, I still don't get the same quality.
[Xperia Z5 Android Development] Infy_AsiX:
Don't need to do anything. That was for fixing the camera becoming black after restoring to another Z3C. I guess it may be device dependent or maybe the DRM fix isn't set on your AOSP sources.
[Xperia Z5 Android Development] tge101:
I really wouldn't know. I'm on Carbon.
[Xperia Z5 Android Development] serajr:
Thanks bro!

No, this only mean that /system dm-verity check is somewhere out of fstab.qcom file.

I could confim this after reverse engeneering dtb file to dts (you can use ubuntu's dtc for that) and reading its contents (as you can see below):

firmware {

android {
compatible = "android,firmware";

fstab {
compatible = "android,fstab";

vendor {
compatible = "android,vendor";
dev = "/dev/block/platform/soc/7464900.sdhci/by-name/vendor";
type = "ext4";
mnt_flags = "ro,barrier=1,discard";
fsmgr_flags = "wait";
status = "disabled";
};

system {
compatible = "android,system";
dev = "/dev/block/platform/soc/7464900.sdhci/by-name/system";
type = "ext4";
mnt_flags = "ro,barrier=1,discard";
fsmgr_flags = "wait[B][COLOR="Red"],verify[/COLOR][/B]";
status = "ok";
};
};
};
};

Rootkernel (UNOFFICIAL 2) is ready, and also handling Oreo (stock) kernel flawlessly, but I still need to find a way to handle this editing ^ inside the tool, before sharing it.

Magisk installation does the job ^ , I do know it, but sometimes its installation fails on some twrp (don't know why), so it's better to have dm-verity disabled within the tool (if possible, ofc), so users can choose what root solution they will use!

Edit:

What about?

Rootkernel V5.23 (UNOFFICIAL 2)

- Unpacking kernel
Found elf boot image
Kernel version: 3.18.66-perf-g27a9189
Found appended DTB
- Detected vendor: somc (Sony), device: dora (Xperia X Performance), variant: row
- Unpacking initramfs
- Detected platform: 64-bit
[B][COLOR="Blue"]- Detected Android version: 8.0.0[/COLOR][/B]
- dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] Y
[B][COLOR="blue"]Patching fstab in dtb to disable dm-verity[/COLOR][/B]
- Sony RIC is enabled. Disable? [Y/n] Y
Disabling Sony RIC
[B][COLOR="blue"]- force-encrypt on Android Oreo requires additional files! Continue? (Say yes to copy) [Y/n] Y
init.rc (patched)
fstab.qcom (copied)
init.qcom.rc (copied and patched)
init.target.rc (copied and patched)[/COLOR][/B]
- force-encrypt is enabled. Disable? (Say yes if you wipe and decrypt /data) [Y/n] Y
Disabling force-encrypt
- Install DRM fix? [Y/n] Y
[B][COLOR="blue"] 1. DRM fix preload line added sucessfully!
2. DRM libraries still need to be flashed manually on TWRP recovery!!
System mode, flash: - DRMfix-System-Mode.zip[/COLOR][/B]
[B][COLOR="Red"]- All done! Continue? [Y/n] Y[/COLOR][/B]
- Creating new initramfs
- Creating boot image
- Cleaning up
Done

Relevant info in blue (red is just the last pause before compiling).

Soon!!
[Xperia Z5 Android Development] juanpirulo:
great job. You are a genius. cheers
[Xperia Z5 Android Development] phoenix.xie:
[MENTION=3989065]serajr[/MENTION] Hi boy, the drmfix with xperia XZs and XZP is different with Z1~XZ? from https://xdaforums.com/xz-premium/development/hack-mod-sony-xperia-xz-premium-twrp-t3695171 So Should we do a fix?

The supersu was no safe at all while it has selled to CCMT. So could you please make a version that can use magisk and phh supersuer instead of it. And xposed with 7.x?
[Xperia Z5 Android Development] serajr:
Xperia XZs does use same old and good drmfix, correct me if I'm wrong (X Perfomance and XZ do use old one, too)!

XZ Premium and onwards (XZ1, XZ1c) do use new drmfix from sToRm//.

Version I'm working on is for Android O only! I won't mess with new features, I leave this task for the OP (tobias)!

Also, do not install contents you do not trust in!
[Xperia Z5 Android Development] juanpirulo:
I try and runs succesfully. just a couple of thins

1- I tried yes to the forceencriptyng and got and error of the script.

2 I saw you didnt added to the script the possibility to add poc TA.img. Is that correct?

thank you very much for the job . cheers

edit

i just realized i didnt copy the system files thats why didnt work the forceencrypted sorry. now its ok
[Xperia Z5 Android Development] serajr:
1- Great news mate... thanks for your feedback!

2- I didn't try PoC yet on Oreo, that's why this option doesn't appear for you, but it is there inside rootkernel.sh. If you wanna make a try, do this way:

- Edit rootkernel.sh with notepad++

- Scroll down to the end of the file and look for this line:

[COLOR="Red"][ "${VERSION}" != "8.0.0" ] && [/COLOR][ -z "$DRMFIX_INSTALLED" ] && [ "$VENDOR" == "somc" ] || [ "$VENDOR" == "qcom" ] && add_ta_poc

- Delete red part and save the file

- Run the script, say N for DRM fix, and Y for PoC

- Report back here later

That's it!

( [MENTION=4898998]Klaus N.[/MENTION] init_sony.zip is still working ;) )
[Xperia Z5 Android Development] dr4go:
@ serajr: I am a bit confused regarding the current state of ta poc / drmfix method in combination with magisk. As chainfire left / gave up the development of supersu I wanted to give magisk a try. Now I read various statements, that either...

...magisk works fine with ta poc (see latest post in ta poc discussion / thread for example),

...magisk currently only works with drmfix.

Which of those statements is true? I began using drmfix, then switched to ta poc at some point in time, but I guess that drmfix + magisk should be the way to go?

Thanks in advance
[Xperia Z5 Android Development] YasuHamed:
[MENTION=3989065]serajr[/MENTION]

because of you only :D i am NOW gonna buy XZ :D :D :D
[Xperia Z5 Android Development] serajr:
Mate, I didn't try PoC on Oreo yet, as you can read some posts above.

PoC and magisk must work together, I see no problem at all, but till I can try them out, I'd prefer stay with drmfix and magisk!

Aha... Enjoy it!! :highfive:
[Xperia Z5 Android Development] angelouss:
great work i confirm that it work on z5 premium dual e6833 on 7.1.1

even with the known ta_poc / magisk incompatibility everything was fine

safetynet pass

twrp 3.1.1 dont boot to system
[Xperia Z5 Android Development] alex.do:
[MENTION=3989065]serajr[/MENTION] thanks for updating the tool to make it work with oreo! thanks alot for that! still I have a question: according to your instructions, does it has to be wiping anything? can I keep my data intact? just flash anything except userdata?

also, [MENTION=3979060]juanpirulo[/MENTION] has already mentioned he ran the ta_poc script it didnt work with oreo yet. here.

Edit: i tried applying ta_poc method as per your instruction [MENTION=3989065]serajr[/MENTION]. it seem to be working and boot.img is built successfully. so with this ta_poc, if it works as expected i guess dont have to flash DRMfix-System-Mode.zip as im not using drmfix?

i will wait for a little time see if you say "ok" for the question i asked then i will try flashing my phone and update result here.
[Xperia Z5 Android Development] whalesplaho:
Yur BL is unlocked, yhu need drmfix so as to have tha Xreality n Vivid colours back!!!

Tha tool is working, he later commented dah he forget to copy tha required files mentioned by [MENTION=3989065]serajr[/MENTION]
[Xperia Z5 Android Development] serajr:
Thanks for your feedback about TA PoC :good:

If TA PoC is really fully working (I still need to check that out) , you don't need to flash the drm libraries zip!

Flashing instructions are general instruction for people that are switching (upgrading or downgrading) android API levels.

If you're already on android Oreo, I think you can skip /data wiping.
[Xperia Z5 Android Development] alex.do:
Thanks for replying [MENTION=3989065]serajr[/MENTION]! I tried using ta_poc method and looks like it works (i hope! see attachment). Even upgrading from N to O you can keep your userdata intact.

However I also got bootloops after installing Magisk. Did try both flash .zip method and patch boot image method then fastboot flash boot patched_boot.img. Still no luck. What should I do now to get root back?

Edit: Just to confirm what I did was correct. I used patch boot image method, in latest Magisk Manager I pressed Install then selected the boot.img generated using your rootkernel script (+ ta_poc option), then Magisk Manager downloaded a Magisk.zip file and flashed it. after that I got a patched_boot.img. and I fastboot that one and I got bootloop
[Xperia Z5 Android Development] juanpirulo:
You can try with supersu, Poc is still giving problems with magisk. Cheers

Enviado desde mi F8331 mediante Tapatalk
[Xperia Z5 Android Development] serajr:
Thanks again for your feedback. Pic does show us that PoC is really working! :good:

I can't help out with PoC/Magisk from now on. This' an known issue that their devs must (or should not) check out!
[Xperia Z5 Android Development] FakeMobile:
POC don't work on Xperia XZ (Single SIm )on oero , no keys in security and no sim bug
[Xperia Z5 Android Development] alex.do:
[MENTION=3979060]juanpirulo[/MENTION] tried supersu today. got bootloop too... thing is i knew v2.82 causing bootloops on xperia so i used v2.79! not sure if i did it incorrectly or ta_poc isn't compatible with... anything :crying:

what i did were re-fastboot ta_poc boot.img, then flash supersu 2.79... looks like it also patches boot image and maybe that causes bootloops.

to those who encountered the same problem, dont panic just re-fastboot your ta_poc boot.img then it should be fine.

Thanks alot [MENTION=3989065]serajr[/MENTION] you re very supportive as always
[Xperia Z5 Android Development] juanpirulo:
cant work with mine either. same problem, no keys no sim. cheers

how you make your boot.img with poc? [MENTION=906645]boydzethuong[/MENTION]
[Xperia Z5 Android Development] alex.do:
I did exactly as serajr instructions, plus enable ta_poc option here (serajr instructions too).

[MENTION=3989065]serajr[/MENTION]: what funny here is i was trying to switch to DRMfix method, as a temporary solution to have root back (hopefully). however i couldnt get DRMfix to work. I got

Blobs: generic error!

so no "key: OK" in security tests. Dual sims still functional though. Any ideas on this?

FYI, I do have TA key backed up long time ago. I did the flash_dk once too. Should I flash the DK.ftf (generated by flash_dk and my TA) once again?
[Xperia Z5 Android Development] juanpirulo:
have your try with this supersu? SR3-SuperSU-v2.79-SR3-2017011422374?. cheers
[Xperia Z5 Android Development] alex.do:
Not yet. What makes it different from the stable one?

BTW you have any ideas why i couldnt get DRMfix to work? Have tried several times already, flash stock ftf -> fastboot boot.img (selected DRMfix option) -> fastboot recovery -> enter recovery -> flash DRMfix-System-Mode.zip -> reboot system -> lost ALL DRM functionalities such as X-Reality,...:crying::crying:

Edit: I still prefer ta_poc method, but im trying this DRMfix just in order to get root back :crying: how come you couldnt get ta_poc to work and I couldnt get DRMfix to work :crying::crying:
[Xperia Z5 Android Development] serajr:
Try to create a new boot.img exactly as initial instructions are, and do whole procedure again!

Also, did you already try deleting the following folders (or wiping all their contents) to reset DRM from former installed DRM fix?

/data/credmgr

/data/drm

/data/mediadrm

Edit: About flashing DK.ftf again, I don't think so, once OP stated this's a one-time task!

Edit 2: Attached is a flashable zip to delete only old DRM data (it will only wipe mentioned folders above and /cache, too)!
[Xperia Z5 Android Development] alex.do:
[MENTION=3989065]serajr[/MENTION] i already tried several times from the very first step. still no luck :( is there any chance that drmfix libraries somehow doesnt work with DK.ftf flashed?
[Xperia Z5 Android Development] serajr:
No, there isn't! My X Performance has DK.ftf properly flashed, and everything is working flawlessly over here!!

Weird indeed.
[Xperia Z5 Android Development] juanpirulo:
when you said (fastboot boot.img) i guess you used correctly de command fastboot flash boot boot.img.cheers

after installed drmfix you also intall magisk. cheers

anywaw trying to install poc version make my system a little mess up so i lost sim functions and i have to restore again system with flashtool.

---------- Post added at 09:40 PM ---------- Previous post was at 09:29 PM ----------

how can i know if dk.ftf is being properly flashed? and working? cheers
[Xperia Z5 Android Development] serajr:
So am I. PoC over Oreo needs some rework!

"Properly" what I meant is that it was successfully installed by Flashtool, and working... well, you must have everything as expected under Sevice Tests > Security menu (FIDO_KEYS: Provisioned, WIDEVINE/CKB: OK [ACTIVE], etc)!
[Xperia Z5 Android Development] juanpirulo:
every keys ok except i cant get fido keys as provisioned. I dunno why. i flash dk.ftf but no success. cheers
[Xperia Z5 Android Development] phoenix.xie:
In the xposed zip the app_process32 and app_process64 is different with sdk23. And I use UltraEdit to open them and libxposed32.so/ibxposed64.so. I saw they are very similar . So I think you should rename app_process32 and app_process64 to libxposed32.so and libxposed64.so.. And then cover with.. Then rerun the bat.
[Xperia Z5 Android Development] alex.do:
Thanks for the script. I tried all over again then I flashed your script. Still no luck. The only thing I have is FIDO_KEYS Provisioned. None of DRM functionalities works. Also tried re-fastboot the ta_poc boot.img I created earlier, without re-flashing anything. Just the boot.img only. It worked then. Too bad now im stuck with ta_poc and cant get root. :crying::crying:

On my side i got only FIDO_KEYS Provisioned :crying::crying:

Also tried the SR3 SuperSU 2.79. bootloops too. SR5 of 2.82 bootloops too.

Its funny we re like standing on different sides of a river. you want to come over my side. while i want to go your side. haha

If you read my recent posts along with serajr. there is pretty high chance that once you get ta_poc working, you will lose root, like me. believe me its not worth risking haha.
[Xperia Z5 Android Development] juanpirulo:
you will have to start with a clean install and flash a boot.img with drmkeys with magisk like me. I have got all the keys workings except fido but all seems work well. cheers

its funny yeahh. I just wanted to check about poc, the thing is if you mess with both drm and poc at the end you ve got a non working sim i dont know why. So finally i had to start again from clean install. cheers
[Xperia Z5 Android Development] alex.do:
Clean install you mean wipe ssd and userdata too? Because I have already tried several times. wipe everything except ssd and userdata. Still not get DRMfix working as expected.
[Xperia Z5 Android Development] serajr:
Did you already try this version of SuperSU (System-Mode)? This versions does not patch the kernel, instead it does install root files to /system!
[Xperia Z5 Android Development] serajr:
Yep, wiping EVERYTHING (with no exceptions) and excluding NOTHING!
[Xperia Z5 Android Development] alex.do:
Thanks Master! I will try it later today, with both DRMfix and ta_poc boot.img when I have some spare time. But this will end up breaking SafetyNet check for sure right?

Ok then I will also try to spend some more time to pull all of my data out, then do a full wipe.

But can you enlighten me a bit more? As I know the patching boot image approach (so called system-less) should not have anything to do with any other data. Why leaving ssd and userdata could be a culprit?

Well, except those ones /data/credmgr, /data/drm, /data/mediadrm. But even removing them gave me no luck.
[Xperia Z5 Android Development] alex.do:
Hey [MENTION=3989065]serajr[/MENTION] and [MENTION=3979060]juanpirulo[/MENTION],

If you been waiting for feedback from me, im here ;)

I did try a full wipe, then follow serajr instructions, finally flash Magisk (mine is v14.5) and it now works like a charm! No idea why and how my userdata (and / or ssd) could cause drmfix to fail mysteriously.

So here i put a summary, just in case anyone reaches here and needs help:

Follow this from serajr

If you go from Nougat to Oreo, you MUST do a full wipe, "wiping EVERYTHING (with no exceptions) and excluding NOTHING!" - serajr

ta_poc method seems to be working on Oreo too. Follow serajr's instruction to enable ta_poc option here. I'd also be happy to share my boot.img using ta_poc. Let me know if you need it. (41.3.A.0.401). So stupid I am. ta_poc boot.img cannot be used on other devices as my TA is only exclusive to my device. Thanks juanpirulo for correcting me.

BUT once you go with ta_poc, both Magisk and SuperSU (systemless mode) will likely cause bootloops because they all try to patch your modified boot image (and fail). This means you cannot have root if you use ta_poc. serajr also suggested using SuperSU System Mode but I didnt try. Maybe you wanna try it.

If you get bootloops, dont panic. Re-fastboot the boot.img and you will be fine.

I hope this could help.

Again thank you both! you guys been very nice and helped me a lot.
[Xperia Z5 Android Development] juanpirulo:
thanks, but never never never share your boot.img with a poc, your ta.img is only exclusive from your device. Flashing a boot.img with a ta from diferent device will cause a hard brick so never never share your ta or mess with diferent device. cheers
[Xperia Z5 Android Development] sToRm//:
In some devices I have seen /userdata includes the /data partition which has drm relevant files in it. Also there are persistent configuration files that are generated by the credential manager. So it's possible that the drmfix is well installed but the system ignores it, because of the configuration. The secd for example checks some props and only continues if the system is in an untouched state. I think that was your problem.

:)
[Xperia Z5 Android Development] serajr:
Thank you for the relevant info bro :good:

Edit: Just figured out!

Does your fix work without patched secd? Just guessing, but I don't think so, right?

Btw, do you know if we can have permanent root shell (if possible ofc) by patching kernel pieces (ramdisk, cmdline, etc), for debugging purposes only (not for public sharing)?

Or how can we take kernel logs (dmesg, etc) without root on Oreo?

PM me if you prefer! Thanks in advance!!!
[Xperia Z5 Android Development] DHGE:
How is your suucess running the script on Linux?

[MENTION=357342]tobias.waldvogel[/MENTION]

Running it on Debian 9 I get these error messages:

/home/rest/zzz/rootkernel_v5.23$ ./rootkernel.sh kernel.elf boot_41.3.A.2.24_mod.img

-e Rootkernel V5.23

kernel.elf: kernel.elf: Kann die Datei nicht ausführen.

Looking at the script I do not expect it to run properly. There are execute bit missing (fixed here) and some files (guessing, renaming did not help).

What should I do?

Seems to run under Windows 7 (as ordinary user) though I had to CTRL-C the batch file twice...
[Xperia Z5 Android Development] Berni-0815:
Change the first line of the script to:

#!/bin/bash
[Xperia Z5 Android Development] DHGE:
Thanks - as easy as that...

I tried sh rootkernel.sh
[Xperia Z5 Android Development] Berni-0815:
bash ./rootkernel.sh ...

should also work...
[Xperia Z5 Android Development] DHGE:
For Xperia XZ follow serajr in post #2793

Finally I succeded:

I also set the execute bit on the executables in the subfolder ./Android

(without these bits set the script halts at "OS version detected")

and followed the modified script of [MENTION=3989065]serajr[/MENTION] in post #2793 in this thread.

As he writes I had to use Magisk since SuperSU gave me a bootloop.
[Xperia Z5 Android Development] othmane.os:
Hi Bro , I've also try to restore mine with flash_dk script using V5.23 and My drm keys didn't restored I think there's a problem with this ver when trying to create Dk.ftf

Can you anyone try create a new dk.ftf with this V5.23 ver
[Xperia Z5 Android Development] Klaus N.:
With this tool you mainly

1. Repack a stock kernel

2. Create a DK.ftf

The 2nd one (creating a DK.ftf) is - ofc. - only related to people who managed to backup the ta partition before unlocking the bootloader of the device.

If you have such a ta backup file, you have to put it (ta.img) into the parent folder of the Rootkernel tool, then via command line:

==> replace "<ta backup image>" with the correct name of your ta.img (case sensitive!!!)

Right after that, you'll find the created DK.ftf in the mentioned parent folder. But this tool will not flash the DK.ftf onto your device!

You have to copy the DK.ftf, navigate with the explorer to /.flashTool/firmwares, and paste it there. Then run FlashTool and flash it via Flashmode (like a firmware.ftf) ;)

Btw, Tobias already mentioned that in the op: