yashsingh1/xdaforums huggingface dataset:
[Xperia Z5 Android Development] YoLO13:
Ahh thank you very much for saying that! Perhaps one quick question would be:

I read that the DRM keys would survive any upgrade or factory reset - if I was add the DRM fix within the

boot image, does that mean the DRM keys are now forever stored, and even if I flashed stock ftf on top of that,

(which removes the rooted boot image), will the DRM functionality still remain intact?

Btw, just restored the TA before even seeing this post and thankfully it went well! Now knowing how to get out

of these situations makes life easier!

Btw, to anyone who restores the TA and forgets to flash a stock firmware after, youll be presented with:

'' Your device is corrupt. It cannot be trusted '' + Red Triangle + ''Press here to power off'' (and may say something else afterwards). The best thing to do is:

- Press the button to power off the device --> it might bootloop or something, cant quite remember

- Wait for several seconds for the device to shut down

- Press Vol Up + Power button to restart the device (that's what I did)

- Then attempt to get it into flashmode via flashmode keys (Volume Down and Plug into PC whilst device is off) --> connect to Xperia Companion and Repair the Software!

Thank you so much for your help!

---------------------------------------------------------------------------------------------------------------------------------------------------

[IMG="Verity Failure"]https://source.android.com/security/images/boot_red2.png[/IMG]

Edit: found this image when unpacking a kernel - trying to add DRM fix into the kernel using this tool but it seems to stop working so don't quite know what's going on! But thats the image I'm on about if you dont flash stock after locking the bootloader!
[Xperia Z5 Android Development] munjeni:
About flash_dk... OP what you think abut achieving all that but by next steps:

1. Dump locked trim area

2. Copy ta.img to external sd

3. Unlock bootloader

4. Modify stock ramdisk by mounting locked ta.img to loop device

5. Modify rc file by using tad_static and previously mounted ta to loop device, so use loop instead of mmcblk0p1

I think thats a better idea and (in case) if working definitelly all devices compatible. I not tried but in theory it will work like having locked bootloader.l What you think?
[Xperia Z5 Android Development] mbc07:
[MENTION=4120742]munjeni[/MENTION], could you try a PoC of what you're proposing? Seems promising, the OP doesn't visit those forums since September :(
[Xperia Z5 Android Development] munjeni:
Tried allready but not with modified ramdisk, done that on allready runing android, but getting sockets errors which is in most case because tad_static allready using that socked. I am pretty sure it will work :) Will try in next few dsys to do that on ramdisk level
[Xperia Z5 Android Development] shoey63:
Perhaps you could try packing the TA.img into the ramdisk itself, seeing as it's only 2MB?

Edit: what's the command for setting it up as a loop device? I wouldn't mind trying it on my Z5 and X.
[Xperia Z5 Android Development] L1K3AB055UK:
Will this work for Xperia E5 F3311?
[Xperia Z5 Android Development] Klaus N.:
I was never asked that while repacking a kernel with this tool. Is the kernel you're trying to repack a custom kernel or a stock one? I take it that your bootloader is unlocked?

About Sony RIC: Normally, it should boot up, even if it's enabled. But then you only can modify /system via twrp. But afaik, there was reports, that some people got into a bootloop when it's not disabled. I can't say anything about that, because I always repacked my kernels with Sony RIC disabled.
[Xperia Z5 Android Development] munjeni:
I think ta can go into ramdisk since boot partition is ~20mb? Busybox is need for some things so ta+busybox hmm let see :) Command for mounting to the loop is

losetup /dev/block/loop1 /pathtotheTA.img

than

tad_static /dev/block/loop1 0,16

In theory on ramdisk level it must work the same like real ta partition
[Xperia Z5 Android Development] Dilesh Perera:
hi

my issues solved

i uese custom kernel and - This adbd requires authentication. Add your public key? [Y/n] comes when i say Y to install TWRP. but after that i used N since my kernel already has TWRP

thanks buddy
[Xperia Z5 Android Development] Yooooomi:
I used this, it worked : https://xdaforums.com/showthread.php?t=2292598
[Xperia Z5 Android Development] munjeni:
Updates and status:

Done! Working perfectly! :) TA.img is packed into ramdisk but must be copied to read/write location, in my case its copied to /data/local/tmp, sepolicy context for loop1 device is changed to block device contents and wholaa, unlocked bootloader with custom kernel have status bootloader locked as like having locked bootloader with all valid drm and other keys :laugh: , maybe I will do an tool for making things simple! Anybody provide me stock z5 kernel for test?

Changes in ramdisk needed to make this working:

1. edit rc file which contain service tad_static

change:

service tad_static /sbin/tad_static /dev/block/mmcblk0 1,16

to:

service tad_static /sbin/tad_static /dev/block/loop1 0,16

add few lines to section on post-fs-data:

exec /sbin/busybox cp -fr /TA.img /data/local/tmp/TA.img

chown root system /data/local/tmp/TA.img

chmod 0660 /data/local/tmp/TA.img

exec /sbin/busybox losetup /dev/block/loop1 /data/local/tmp/TA.img

2. modify sepolicy contents in file_contexts:

change:

/dev/block/loop[0-9]*	u:object_r:loop_device:s0

to:

/dev/block/loop0	u:object_r:loop_device:s0

/dev/block/loop1	u:object_r:block_device:s0

/dev/block/loop[2-9]*	u:object_r:loop_device:s0

3. put your locked bootloader TA.img to the root of the ramdisk

4. use busybox from attachment and put it to the sbin folder. Chmod busybox to 750

5. repack your ramdisk and make boot.img

6. done. Enjoy locked bootloader features on your unlocked bootloader device!
[Xperia Z5 Android Development] Berni-0815:
Is it not necessary to put a colon (":") between "root" and "system"?

While trying to unpack your file busybox.rar, following happens: busybox.rar is not RAR archive
[Xperia Z5 Android Development] shoey63:
In ramdisk, you don't use colons.
[Xperia Z5 Android Development] Berni-0815:
Oh, did'nt know this. Tnx!
[Xperia Z5 Android Development] munjeni:
Sorry! Reuploaded busybox now
[Xperia Z5 Android Development] shoey63:
Nice work! Will test later. The big problem will be with Nougat. file_ contexts is in BIN format?
[Xperia Z5 Android Development] munjeni:
Thats a reason why I requesting stock kernel.sin file, it would be a great if somebody upload!
[Xperia Z5 Android Development] Hamidreza2010:
Here you are bro.its for E6633_32.2.A.0.253 and dual sim.hope you make a tool for making things simple.

http://s8.picofile.com/file/8280712168/E6633_32_2_A_0_253.rar.html

thanks again
[Xperia Z5 Android Development] goofnorf101:
Thanks for your advice but I got this problem before installing anything like supersu and the error appears to be coming from the widevine system not the app itself. I do now have xposed and that module and have added it to the configuration but its exactly the same.

Any UK people have the All4 app working with this rootkernel method? I'm not sure how safely I can revert to locked bootloader and restored TA partition to verify the problem.
[Xperia Z5 Android Development] jugglerpl:
goofnorf101 you can flash firmware .152 or .200 (this same when you backing TA, you should know) and restore your TA backup on this firmware. It should restore your TA completely.

I would be very grateful if you could check working DRM on .152 or .200.
[Xperia Z5 Android Development] lionelbac:
I'm getting the same error on windows 7 32 bit. I have kernel.elf extracted from 6.0 ftf firmware. How did you solve it?
[Xperia Z5 Android Development] devilmaycry2020:
Hi all

I've tried to patch kernel E6683_32.0.A.6.152 but failed. No rootedkernel.img created. here is my log file. Help me please. thanks.
[Xperia Z5 Android Development] Bronnel:
Thank you for the great tool tobias, if I want just to test my modified kernel.img and not unlocked the bootloader yet, is it going to work, and how to get fastboot.cmd file?

Edit:

Never mind, I figured it out.
[Xperia Z5 Android Development] Elfeno:
I unlocked and rooted with restoring DRM keys with my TA backup and custom stock kernel, it show bootloader unlock allowed : no

But all drm keys are active.
[Xperia Z5 Android Development] jugglerpl:
It's very strange :o I have locked bootloader but I can unlock. Another User in this topic had this same

Wysłane z mojego E6653 przy użyciu Tapatalka
[Xperia Z5 Android Development] Bronnel:
If we use our own modified kernel from this guide, then we don't need AndroPlus kernel, right?
[Xperia Z5 Android Development] sovanyio:
It may be a 64-bit binary..
[Xperia Z5 Android Development] jugglerpl:
Yes

Wysłane z mojego E6653 przy użyciu Tapatalka
[Xperia Z5 Android Development] celderic:
Anything I try and play I get 'network error please try again' on 4g or WiFi, but I can still use the website.
[Xperia Z5 Android Development] Bronnel:
How to verify that my drm keys are working?
[Xperia Z5 Android Development] goofnorf101:
Ok, I can do that but I am not quite sure where to get the older version.

Also, is it possible to get the source or a 32bit version for libreadta.so as I wondered what happened if we used a 32 bit version with drmserver service?

---------- Post added at 06:08 PM ---------- Previous post was at 06:06 PM ----------

Your problem sounds the same as mine. Although the app says "network error" - the error is most likely due to widevine not working as can be seen via logcat. Mine definitely did work before though. I feel like the drm features are not fully restored yet.
[Xperia Z5 Android Development] jugglerpl:
I can paste link with order firmware if you want. Please choosing: 152 or 200?

Wysłane z mojego E6653 przy użyciu Tapatalka
[Xperia Z5 Android Development] Arturiuz!:
one of some ways to find out: dial on your phone:

*#*#7378423*#*# (*#*#service#*#*)

under 'service test', go to 'security'..if the first 2-3 lines says, [Key Ok] [Active], you're good! cheers!
[Xperia Z5 Android Development] Bronnel:
It's Exactly like you said, thank you very much sir.
[Xperia Z5 Android Development] celderic:
Yes after looking into it I see widevine errors in the log when trying to use it. Never used the All4 app before so I didn't notice.
[Xperia Z5 Android Development] tobias.waldvogel:
Testers with TA backup for Version 4.0 RC

V4.0 is released now (attachment removed)
[Xperia Z5 Android Development] tobias.waldvogel:
Sorry about this, I just published a test version here http://xdaforums.com/showpost.php?p=66260826&postcount=158 which includes the correct binaries
[Xperia Z5 Android Development] tobias.waldvogel:
drmserver does not read TA units. Therefore a preload library would not have any effect. What is the status of the FIDO keys in the service menu?
[Xperia Z5 Android Development] munjeni:
Done allready :( and downloaded whole rom which is ~2gb, no prob at all :)
[Xperia Z5 Android Development] munjeni:
No, just checked right now! :)

Changes for z5 (in most case will work):

Changes not staged for commit:
(use "git add <file>..." to update what will be committed)
(use "git checkout -- <file>..." to discard changes in working directory)

modified: file_contexts
modified: init.sony-platform.rc

Untracked files:
(use "git add <file>..." to include in what will be committed)

sbin/busybox

no changes added to commit (use "git add" and/or "git commit -a")
root@Ubuntu-14:/home/munjeni/Desktop/sony_flashers/out/ramdisk2# git diff
diff --git a/file_contexts b/file_contexts
index 0fce421..7de32a4 100644
--- a/file_contexts
+++ b/file_contexts
@@ -42,7 +42,9 @@
/dev/binder u:object_r:binder_device:s0
/dev/block(/.*)? u:object_r:block_device:s0
/dev/block/dm-[0-9]+ u:object_r:dm_device:s0
-/dev/block/loop[0-9]* u:object_r:loop_device:s0
+/dev/block/loop0 u:object_r:loop_device:s0
+/dev/block/loop1 u:object_r:block_device:s0
+/dev/block/loop[2-9]* u:object_r:loop_device:s0
/dev/block/vold/.+ u:object_r:vold_device:s0
/dev/block/ram[0-9]* u:object_r:ram_device:s0
/dev/bus/usb(.*)? u:object_r:usb_device:s0
diff --git a/init.sony-platform.rc b/init.sony-platform.rc
index 086b90e..552166b 100755
--- a/init.sony-platform.rc
+++ b/init.sony-platform.rc
@@ -16,7 +16,9 @@ on init
# SONY: Start the TrimArea Daemon. It must be started before fota-ua
wait /dev/block/mmcblk0p1
chown tad tad /dev/block/mmcblk0p1
+ chown tad tad /dev/block/loop1
chmod 0770 /dev/block/mmcblk0p1
+ chmod 0770 /dev/block/loop1
class_start trimarea
exec u:r:tad:s0 system -- /sbin/wait4tad_static

@@ -122,6 +124,12 @@ on post-fs
chmod 0440 /cache/recovery/fota/.keepme

on post-fs-data
+ #make ta.img loop ready
+ exec /sbin/busybox cp -fr /TA.img /data/local/tmp/TA.img
+ chown [COLOR="Red"]tad tad[/COLOR] /data/local/tmp/TA.img
+ chmod 0770 /data/local/tmp/TA.img
+ exec /sbin/busybox losetup /dev/block/loop1 /data/local/tmp/TA.img
+
# SONY: Start early TA-users
mkdir /data/etc 0755 root shell
exec /system/bin/taimport
@@ -298,7 +306,7 @@ service xssm /system/bin/xssm

# SONY: TrimArea Daemon
# Last 2 args: start block(blk size 128k), number of blocks(partitionsize(kb)/128(kb))
-service tad_static /sbin/tad_static /dev/block/bootdevice/by-name/TA 0,16
+service tad_static /sbin/tad_static /dev/block/loop1 0,16
user tad
group tad root
socket tad stream 0660 system trimarea

TA.img must be put to the root of the ramdisk.

busybox must be put to sbin and chmod 750

line marked with red I am not sure if is right, maybe root.tad or tad.root ownership will need?
[Xperia Z5 Android Development] Hamidreza2010:
Oh its bad.i saw late :rolleyes:

bro i didnt understand.would you please tell us step by step what should i do?

thanks bro
[Xperia Z5 Android Development] munjeni:
Already explained :) just read last two pages for more info.

PS please do not quote big posts, it makes whole page wasted, please use @ somebodyname instead
[Xperia Z5 Android Development] Hamidreza2010:
ok thanks i edited. ;)

and ok i read hope make it successfuly :good:
[Xperia Z5 Android Development] munjeni:
Use diff file for reference since tutorial from previous page is for z1c, and please if not working see red line! Try root tad or try tad root for example if tad tad not working
[Xperia Z5 Android Development] Hamidreza2010:
sorry bro.where is red line?

i saw this tut from you:

https://xdaforums.com/showpost.php?p=70330773&postcount=1575
[Xperia Z5 Android Development] darwusch:
Great work :) here is the kernel.sin for the Z5 Compact also.
[Xperia Z5 Android Development] darwusch:
And the XA Ultra (F3211) too, if it also fits this method.
[Xperia Z5 Android Development] munjeni:
Use tut for understannding what is need but use this as a reference for z5 ->https://xdaforums.com/showpost.php?p=70336138&postcount=1584 see red line
[Xperia Z5 Android Development] munjeni:
Guys I already got kernel I no need more! Thanks anyway, but this is z5 related forum :)
[Xperia Z5 Android Development] russel5:
[MENTION=4120742]munjeni[/MENTION] thanks for tut, but in my case this is not work at all.

have z3c and i trying all comb - tad tad, root tad, tad root, but always in logcat see only "tad failed to open /dev/block/loop1 (permissions denied)"

no sim, no camera - nothing work
[Xperia Z5 Android Development] munjeni:
You must modify file_context as per tut!
[Xperia Z5 Android Development] russel5:
bro, i did it in the first step ;)
[Xperia Z5 Android Development] munjeni:
You can post your ramdisk with included ta? I can check for you
[Xperia Z5 Android Development] russel5:
[MENTION=4120742]munjeni[/MENTION] HERE you go.
[Xperia Z5 Android Development] darwusch:
Yes it is, but do you think this method would work on other xperia models too?
[Xperia Z5 Android Development] munjeni:
Ofcourse!
[Xperia Z5 Android Development] munjeni:
I see everything right, but one thing which I have noticed is size of the busybox. Did you used your own busybox? You can verify if TA.img is copied to the /data/local/tmp ? Mounted to the loop device?
[Xperia Z5 Android Development] russel5:
your busybox not downloading

and yes i see TA.img in /data/....

in the terminal i repeat the command losetup and see that device is busy
[Xperia Z5 Android Development] munjeni:
Hmm. I had same problem with permission denied and it was because loop device had loop file context instead of block context. After I changed that selinux related thing it started working. I haave no idea by now but for sure that loop1 permission denial is related to the selinux. Did you saw permission denial in dmesg? Curently I have no idea what cause denial but 3 things can do that denial, wrong ownership, wrong mode or wrong selinux context. For example try things from my first post (mean without setting ownership and permission to the loop device). Verify if loop1 is mounted by: losetup -d /dev/block/loop1 ...I have no idea by now, it must work a but tricky. See dmesg! Also verify /dev/block/loop1 things by ls -lk which will display selinux context, ownership, mode and etc, see if it is changed at least, it must be the same as /dev/block/mmcblk0p1
[Xperia Z5 Android Development] munjeni:
One more... Verify if you can mount -o remount,rw /

If not you must disable ric! I had that problem too
[Xperia Z5 Android Development] russel5:
[MENTION=4120742]munjeni[/MENTION] ok bro, all works now. thanks again.

what i do

file_contexts /dev/block/loop1 set tad_block_device same as /mmcblk0p1

and set to permissive init, tad and kernel contexts, because only that give me a lot of denied in dmesg.

after that all works like a charm.

one more thing is make the script for check /data/local/tmp/ta.img if yes not copy ta.img again (because it's old) if no that used tad_static for mmcblk0p1 (or we will have not working sim, camera and other things, like on z3c)

thanks again for your great tut :)
[Xperia Z5 Android Development] munjeni:
I'm, glad it worked. But I think better idea is having fully working selinux, you just need to figure out which file context need to be set to loop1, on my device its block but on your I don't have idea why giving permissin denials..

I thinked to make tool for this but thats a hard work since every model have diferent ramdisk and things. Anyway you guys have a working POC :) But hey, Happy New Year to All \0/
[Xperia Z5 Android Development] core720:
Sorry, how restore original backup TA in Custom Kernel???
[Xperia Z5 Android Development] russel5:
Ok guys, if you want use your custom kernel with your TA.img or without, you don't needed TA.img in boot.img anymore.

Just edit your init.sony-platform.rc like this:

on init
# SONY: Start the TrimArea Daemon. It must be started before fota-ua
wait /dev/block/mmcblk0p1
chown tad tad /dev/block/mmcblk0p1
[COLOR="red"] chown tad tad /dev/block/loop1[/COLOR]
chmod 0770 /dev/block/mmcblk0p1
[COLOR="red"]chmod 0770 /dev/block/loop1[/COLOR]
class_start trimarea
exec u:r:tad:s0 system -- /sbin/wait4tad_static

Then find

# SONY: TrimArea Daemon
# Last 2 args: start block(blk size 128k), number of blocks(partitionsize(kb)/128(kb))
service tad_static [COLOR="Red"]/sbin/ta [/COLOR]

Then create a new file in sbin folder named ta (ie /sbin/ta) and paste this:

#!/system/bin/sh

BB=/vendor/bin/busybox [COLOR="Red"]<--this path for busybox if you are used tobias.waldvogel's script if not change this[/COLOR]
ta=

#check TA.img in /data/local/tmp
if [ -e "/data/local/tmp/TA.img" ]; then
${BB} chown tad tad /data/local/tmp/TA.img
${BB} chmod 0770 /data/local/tmp/TA.img
${BB} losetup /dev/block/loop1 /data/local/tmp/TA.img
ta=/dev/block/loop1
else
ta=/dev/block/platform/msm_sdcc.1/by-name/TA
fi
exec /sbin/tad_static $ta 0,16
exit 0

How you see this script check your TA.img in /data/local/tmp and if it not preset your phone will use standart path for your DRM keys. This solution will help you avoid problems with not working sim, camera and other.

If you want have custom kernel and use your own DRM keys, just copy your TA.img in /data/local/tmp then reboot your device.

Check this few times, delete TA, copy TA and all works as it should.

Happy New Year guys :highfive:

P.S. attach boot.img for z3c .291 with this^^ new changes

Download HERE
[Xperia Z5 Android Development] Klaus N.:
First of all, a Happy New Year to all of you guys!

It's great, that there's some movement inside this thread :)

One question: To which alternative unit tobias' method saves the TA.img content while flashing it via FlashTool? And is it possible to get access to it (e.g. deleting it)?

Thanks in advance!
[Xperia Z5 Android Development] Hamidreza2010:
Special thanks dear.i want to do it on xperia z5

just how can i check it , if its works?

for be sure

thanks again

---------- Post added at 02:04 PM ---------- Previous post was at 01:36 PM ----------

bro seems we cant download from xda attachment , would you please reupload busybox on other host?

thanks a lot
[Xperia Z5 Android Development] russel5:
[MENTION=5096181]Hamidreza2010[/MENTION] you will see in *#*#service#*#* - service test - security all string as [Key OK][Active]
[Xperia Z5 Android Development] rubiicon59:
I've downloaded the zip several times but it's empty.....
[Xperia Z5 Android Development] russel5:
You can download it HERE
[Xperia Z5 Android Development] munjeni:
Attachments is not working by now, I have reported to moderators and got reaply: please use another hosts untill admins fix...
[Xperia Z5 Android Development] Hamidreza2010:
ok thanks but i dont have file

please upload this busybox to another host:

https://xdaforums.com/showpost.php?p=70330773&postcount=1575

thanks a lot
[Xperia Z5 Android Development] munjeni:
Ok, here is busybox
[Xperia Z5 Android Development] Pouya Rezaei:
Hi Guys

No way to build a DRM fix kernel for Android 7 Xperia X there?
[Xperia Z5 Android Development] moutonnoireu:
Any way to make this work with a Nougat kernel ? It crash when i try to apply the drm-fix :(
[Xperia Z5 Android Development] HaoZeke:
Which nougat kernel? There aren't any nougat stock kernels yet I guess?

On an AOSP or any other open-souce project kernel the drm-fix makes no sense, so it'll always crash....
[Xperia Z5 Android Development] shoey63:
X series has stock Nougat now. Z3+/ Z5 should be next.

file_contexts in stock N ramdisk for X series is now in bin format, so the tool can't patch it.

Advanced users can try the TA.img method in the last couple of pages.
[Xperia Z5 Android Development] moutonnoireu:
Exactly, i own a Xperia X (Suzu, F5121) and i was searching a way to apply a DRM fix after upgrading to Nougat & having a unlocked bootloader.

I'll see if i can use the TA.img method ! :)

Edit : the method to bypass DRM via some modifications in the kernel didn't seem to work :/
[Xperia Z5 Android Development] shoey63:
Same device as me. I'll give it a shot on the N concept rom boot.img
[Xperia Z5 Android Development] munjeni:
Can you give me your kernel.sin and your trim dump? I can try make it work for you.
[Xperia Z5 Android Development] moutonnoireu:
Yes ! That would be awesome. :D

kernel.sin : https://mega.nz/#!EFoikYAC!8Dwy3K5WK7QoBheGG6ggzMlt4f0RfmJjqJK1PLzOcUY

trim dump (if i did unserstand correctly what it is) : https://mega.nz/#!8Fg3gAbS!2Zu7RoGC0DI8psErBez3CnzDQxjCgaD5NH9rRBhVvRM

Note : i do not have any backyp of my DRM keys, that why i was searching for a way to bypass the whole DRM thing :)
[Xperia Z5 Android Development] munjeni:
You have unlocked bootloader and have no drm backup? If true than whole things have no sense for your since your drm keys is bye bye 4ever!
[Xperia Z5 Android Development] moutonnoireu:
I just want to be able to patch my kernel with the fixes proposed by the rootkernel script. I don't care about twrp or root, to be true, i just to apply the drm-fix.
[Xperia Z5 Android Development] munjeni:
You say that you have no trim area dump, is that true? And you have unlocked bootloader?
[Xperia Z5 Android Development] moutonnoireu:
Maybe i didn't correctly understand what is a trim area dump. But for now i don't have one, can you explain how to perform one ? And my bootloader is unlocked, yes.