[Xperia Z5 Premium Android Development] Fragmentation:
The updated cross-device Sony thread tested with Nougat is here.

Guide updated on 21 October 2016.

PREFACE

First of all, this guide will probably work for all recent Sony phones.

This guide is based on a work of number of people. The information how to get this goal achieved is very sparse and it is scattered across the Internet. There are lot of guides, but typically they require a strong familiarity with many things, so inexperienced users may became confused. I decided to assemble a detailed newbie-friendly guide myself. So here it is.

Get rooted stock Sony firmware is not a straightforward and easy task, but if all steps covered in this guide are performed well, the goal will be achieved. Since the creation of this guide, stock firmware versions got bumped multiple times, but nothing has changed fundamentally in terms of rooting.

In this guide I (and you) will use the stuff from these notable people:

@Androxyde — Flashtool

@IgorEisberg — XperiFirm (integrated into Flashtool)

@Dees_Troy et al. — TWRP

@Chainfire — SuperSU

@tobias.waldvogel — Kernel repack script and DRM fix

@zxz0O0 — iovyroot

The whole process divided into the following steps:

Getting your phone recognized by your computer (driver installation).

Backup your DRM keys.

Unlocking a bootloader.

Flashing stock firmware with Flashtool.

Repacking and flashing a kernel.

Rooting with SuperSU.

Restore your DRM keys.

Optional tasks.

The one thing to consider before the flashing of your Xperia phone is the unlocking of the bootloader. There is the official way of doing this provided by Sony. It's easy and straightforward. Check step #3 below.

Before unlocking, one should know the main caveat: once you have unlocked your phone, you have lost your DRM keys. These keys are used to make certain proprietary Sony functions to work, such as X-Reality for Mobile, camera noise suppression and some others. It is possible to backup your keys in beforehand and restore them once the phone is rooted. This will be covered in this guide.

The repack script mentioned before, incorporates a so called DRM fix which effectively emulates lost DRM keys and most of proprietary functions remain in a working state. This fix will suffice for most users, so you probably may want to root your phone straight away, nevermind the keys. I hadn't myself extracted and restored DRM keys ever, since DRM fix works perfectly for me, so you may want to forget about these keys too. Some users are not ready to just erase them, however. The choice is up to you, but if the camera performance is your sole concern, I can confirm that with DRM fix it works perfectly.

After the completion of this guide, your phone contents will be completely erased, so you may want to backup all what is important to you to some external locations. External microSD card will not be erased, so you may copy your stuff to it. If you are on a rooted Lollipop or older Android, you may want to use some specialized tools like Titanium Backup or like. TWRP also have a nice backup features, if you have one already installed.

The guide was tested on Windows 10 Pro 64-bit and Sony Xperia Z5 Premium Dual-SIM E6883 official model for the Russian market. During the course of this guide you will get a specific firmware for your particular market so don't worry, this guide is market-agnostic. It is even model-agnostic. I believe this guide works for most Xperia phones on the market, but I personally tested it just with my Z5 Premium.

Let's go.

1. GETTING YOUR PHONE RECOGNIZED BY YOUR COMPUTER (DRIVER INSTALLATION)

During the course of this guide, your phone will comminicate with your computer in Fastboot and Flashmode connection modes. When connected in these modes, for the phone to be properly recognized by a computer, you have to provide special drivers. Thanks to Flashtool creators, it comes bundled with generic drivers compatible with all recent Windows operating systems, so at first you should install Flashtool. You can get installer from the official website.

Next, you should install Fastboot and Flashmode drivers for your phone.

One caveat here however, these drivers are not from a "recognized Windows developer", that is they are not Windows-certified, so to get them installed on Windows 8/10, you should reboot with the disabled driver signature enforcement. Use Google to know how to perform this.

Once booted in the aforementioned mode (or in a regular mode if you are still on Windows 7), proceed to the actual driver installation. The drivers are packed into the Flashtool\drivers\Flashtool-drivers.exe executable, but it didn't work on my system, perhaps because it is 64-bit (but feel free to try it yourself), so I simply unarchived it with 7-Zip (right-clicked it and chose 7-Zip > Extract to "Flashtool-drivers"). I got a Flashtool-drivers folder, which contained all the drivers from the executable.

Once drivers are unpacked, connect your phone in a Fastboot mode. Recent Sony devices can boot in Fastboot just like this: shutdown the phone, press and hold Volume Up rocker button and connect USB cable to the phone while the other end is connected to a running PC. The phone's LED will turn blue shortly. That's it, you are in a Fastboot mode. Open Device Manager (Win + X, Device Manager) and check if there is some unknown device (with the name S1Fastboot or something like this).

Double-click this unknown device in the Device Manager, click Update Driver..., then Browse my computer for driver software, and choose the Flashtool-drivers folder created earlier with 7-Zip (leave Include subfolders checked). Shortly you will get a red warning dialog window, which inform you that this driver doesn't have a proper signature:

​

Very scary. Just proceed with the install despite all the red flags, it's safe.

Once Fastboot driver is installed, plug out the USB cable off the phone and connect it in a FlashMode mode. This is done just like for Fastboot, but in this case you should press and hold Volume Down rocker button during the cable plugging in. The LED in this case will be green and not blue. The procedure to install the driver is exactly the same.

After the successful installation, try to reconnect the phone in these modes again couple more times to make sure all devices get properly recognized by Windows. If all seems good, proceed to the next step.

2. BACKUP YOUR DRM KEYS

There is a tool called iovyroot, with which you can backup your DRM keys from an unrooted phone, but at the time of the writing it doesn't support latest firmwares. It does support a lot of older firmwares so it may be useful to not upgrade your phone before checking up this tool.

If you're into this backup DRM thing, go to the original thread, download the latest version and check if it is working for you. For now I just skip this step. Basically, you want to download the zip, connect your phone in USB Debugging mode, run the tabackup.bat script and see the output.

I will not cover DRM keys extraction/restore in details, since I never did it, so I don't want to write about something I haven't myself performed. Please check corresponding threads.

Note that most proprietary Sony features will work even without DRM keys, such as X-Reality for Mobile, camera denoise filter and some others. DRM fix will be covered later in this guide. Some features will not work with DRM fix, Widevine for example. Most users will not even notice these.

3. UNLOCKING A BOOTLOADER

Sony does provide its own guide. It is a plain and simple and — good news! — if you have followed the previous steps, you just got all the prerequisites covered!

4. FLASHING STOCK FIRMWARE WITH FLASHTOOL

The Flashtool was installed on the completion of the first step, so let's start it. If you are on 64-bit Windows, start Flashtool64 (there is a shortcut in the Start menu). It does require administrator privileges.

Once you are in Flashtool, at first you need to obtain the most recent official stock firmware from Sony. Press the "XF" icon (the right-most one in the toolbar) to start XperiFirm. The window will open, choose the phone from the left part of the window (Xperia Z5 Premium (Satsuki)), then choose your particular model (I chose E6883 Dual) and after that choose your market and operator from the right part of the window. I chose 1299-4828 Russia Customized RU. Of course, you don't have to choose exactly this, click on the entries of your own choice. The entry will become highlighted and shortly there will be some info in the last column (Latest Firmware). This definition will be also in the right-most part of the window just under the phone thumbnail, click on it. Not a brilliant design decision, but that's it. Here is a screenshot for your reference:

​

The new window will pop up, press Download. The stock firmware will be downloaded to your computer and unpacked. Once the download is completed, close all XperiFirm windows to return to the main Flashtool window. Flashtool will begin creation of the .ftf file from the downloaded files which will be used for a (subsequent) flashing. FTF-files are similar to ZIP-files, and may be opened with 7-Zip. I've got E6883_32.2.A.0.305_1299-4828_R4C.ftf after the completion of this procedure. Flashtool places firmwares in the C:\Users\<Your Windows Username>\.flashTool\firmwares.

Now, once the stock firmware is downloaded, packed into .ftf and ready to be installed, let's do this. Disconnect the phone for now, physically extract microSD card (if any) and press the left-most button on the Flashtool's toolbar (the "Lightning" one) and choose Flashmode. The Firmware Selector window will appear with a selected default folder and list of all firmware available for a flashing. I've got a single entry, the firmware I just downloaded. Before actual flashing, you can check some checkboxes from the Wipe section, I usually check all to start clean (all the data on the phone is erased). Once again, just to be safe, extract the microSD card from the phone at this moment. It is not needed for a flashing anyway. Here is how the window looked to me:

​

After all is set up, press Flash. The flashing process will begin. At first Flashtool will prepare files for a flashing. After a while, window will appear which will ask you to connect the phone in the Flashmode mode. Shutdown the phone, hold the Volume Down button, connect the USB cable. Once Flashtool detects the phone in the Flashmode mode, it will start the actual flashing automatically.

After the completion of the flashing procedure after some minutes, you'll get a stock Sony firmware installed, and now it is perfect time to proceed to the next step. You may leave your phone off at this moment, but if you are curious, start it up and check if the new Android is actually there. Note however that first start after the firmware installation takes a long time.

5. REPACKING AND FLASHING A KERNEL

To get the stock firmware rooted, you need a way to install SuperSU. SuperSU is some tool which enables root access to the Android system. To install SuperSU, you need TWRP. To run TWRP, you need a kernel, which supports both TWRP and your Android version.

You can extract the kernel from .ftf file, prepared by Flashtool earlier, repack it and integrate TWRP (and DRM fix) into it, and finally flash it to your phone back modified. Sound like a complex task but it's definitely achievable.

At first you should extract the actual kernel from the .ftf file. Reminder: it's in the C:\Users\<Your Windows Username>\.flashTool\firmwares folder and may be titled E6883_32.2.A.0.305_1299-4828_R4C.ftf or something like this. Open it as an archive (right-click on a file, 7-Zip > Open archive) and extract kernel.sin. It's your phone's packed kernel.

If it is packed, obviously you need to unpack it. Thankfully the almighty Flashtool can do this. Open Flashtool, navigate to the Tools > Sin Editor, select a kernel.sin you've just extracted and press Extract data. As a result, you'll get a kernel.elf file in the directory where your packed kernel was. As you may have guessed, kernel.elf is an unpacked kernel. It can be modified, repacked and flashed back to the phone. Let's do this.

You will need a Stock kernel repack script from @tobias.waldvogel. Here is the original thread. Grab the script there. I used v5.0 and it worked perfectly for .253 and older.

Once the contents of the zip-file are extracted to some directory, copy the kernel.elf there and summon command prompt in this directory (right-click in the empty space of this folder in File Explorer with the Shift button pressed and choose Open command windows here).

In the command line type the following:

rootkernel.cmd kernel.elf boot.img

You'll get some questions about adding some features/tools to your kernel, feel free to answer "Yes" (type Y) to all of them. Screenshot for your reference:

​

If all went smoothly, you'll get a repacked kernel, boot.img in the script folder, supercharged with TWRP and DRM fix, and most importantly, which also supports rooting. Now it is time to flash it to your phone.

Turn off your phone and connect it in a Fastboot mode: hold the Volume Up rocker button and connect USB cable. The LED on the phone will turn blue.

Flashing images in this mode is typically done with a fastboot.exe from the Android SDK. Android SDK weighs many gigabytes but thankfully you don't need to download it. Fortunately Flashtool contains fastboot.exe from the SDK. It's in the Flashtool\x10flasher_lib folder. For the brevity of the following steps, copy the newly generated boot.img to this folder. Shift-right-click in the empty space of this folder window and choose Open command window here entry from the context menu. Windows console will appear.

At first try this command:

fastboot.exe devices

If all is good, there will be one device in the output of this command, just like this:

​

If not, perhaps there is some driver issue, so head back to the step #1 and make sure the drivers are installed correctly.

If your device is shown correctly, let's flash some files to the phone. Execute the following command to flash the modified kernel:

fastboot.exe flash boot boot.img

The proper output of this command will be like this:

​

If you get any errors, the first and more likely reason is that you still have a locked bootloader. Head to the step #3 to verify its state and unlock it if necessary.

If there were no errors, you now just flashed a custom kernel with TWRP recovery and DRM fix. You're almost done! You may plug out the cable from your phone. If you are attentive to the details, you'll notice that now, once your phone is started, its LED turns amber for 2-3 seconds. This is a special signal for those looking to boot into a recovery (TWRP).

Although @tobias.waldvogel claims his script is able to also integrate SuperSU during the kernel repacking, I didn't managed to get this working, so the SuperSU installation is a separate step in my guide. The next step.

6. ROOTING WITH SUPERSU

Now when you have TWRP in place and Marshmallow installed, let's root it. SuperSU distributed in a TWRP-friendly .zip archives, so you should copy one to your microSD card. I used beta version 2.78 SR1 from here. At the time of your reading, there probably will be some newer versions available, try them instead.

Once SuperSU zip-file is copied to your microSD card, reboot to recovery (TWRP). To do this restart or power up your phone and look at the LED. Once it lights amber, press Volume Up rocker button and you'll get into recovery — TWRP 3.0.

To install SuperSU, press Install, go to the /external_sd and select the .zip (in my case SR1-SuperSU-v2.78-SR1-20160915123031.zip). Swipe right to confirm installation. Once it is installed, press Reboot System button. Phone will reboot twice. Do not interfere with the phone during these multiple reboots, the things are getting done right, so just wait once Android is started. Once it's started, the phone is rooted and functional!

7. RESTORE YOUR DRM KEYS

If you had successfully backed up your DRM keys in step #2, it is now time to restore it back to the device. There is a flash_dk.cmd script shipped with the Root kernel repack script you used in the previous step. flash_dk.cmd can be used to flash the DRM partition back to your phone.

At first prepare the flashable .ftf:

flash_dk.cmd <ta backup image> dk.ftf

And then flash dk.ftf via Flashtool, just like you flashed the whole firmware in the step #4, but don't wipe anything this time.

8. OPTIONAL STEPS

8.1. Xposed installation

Since Z5P uses Lollipop and later, you should install Xposed APK from here. At the time of writing there is XposedInstaller_3.0_alpha4.apk installer there.

Once APK is installed, grab the latest .zip from the repository, I've got xposed-v86-sdk23-arm64.zip. Install it in a regular TWRP way covered in step #6.

Once all these steps are done, you should have Xposed Installer app in your phone, and if you open it and check Framework section, if everything is alright, there will be text in green, something like "Xposed framework version 86 is active".

Installation of actual Xposed modules can be performed in different ways. For example you may install HideSimIcons module from @tobias.waldvogel if you've got dual-SIM Z5P and you're mad at SIM-card icons in the system tray. Get the APK from the original thread and install it just like you install regular APKs.

8.2. Resolving Voice Search and random volume up/down issues while using regular headphones

See this thread.

8.3. Disable startup notification if there is a newer firmware available

Some people get annoyed by a persistent notification, which is displayed once the new firmware become available (new Android version from Sony). Rooted users cannot just tap it and update over-the-air, because they need to perform a complex rooting procedure in beforehand (covered in this guide). It is possible to disable this notification. You may get these notifications by email anyway.

The easiest and safest way is to use some autorun manager. I used Autorun Manager Pro and disabled all receivers of system apps com.sonymobile.fota.service, fota update service and Software update. Notification vanished after a restart.

You may even freeze or remove these apps via some app manager like Titanium Backup Pro.

THAT'S IT

At this point you have a stock Sony Android enhanced with root privileges. SuperSU app is also installed, so you are ready to use root right away. SuperSU now can be updated in a regular way via Play Store.

P.S. WHEN NEW FIRMWARE IS AVAILABLE

Once the new firmware is released, you may perform the same procedure for it beginning from the step #4, but if it is a minor upgrade, you may want not to wipe anything during Flashtool flashing this time. If it is a major upgrade, e.g. Marshmallow > Nougat, you probably may want to start with a clean system and wipe all.