yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] ninestarkoko:
For 5823:

http://www.xperiablog.net/forum/forums/Firmware/?prefix_id=88 , Austalian and Malaysian, register to download

https://mega.nz/#!w05k3QTL!gMSXZbDPYajLfE34js4G6dvSpYjfn1TCtS1leyxMk-A Australian

https://xpericheck.com/device/E5823, you can download Customized NL

https://drive.google.com/file/d/0B1AAC4lt7nzOdkhQUU1sM29iMDA/view?usp=sharing Customized ITalian

all these links found on the Web, not tested by me, i don't take any responsibility for that

Yes, You should always disable myXperia security before unlocking and NEVER reenable it on unlocked bootloader
[Sony Cross-Device General] zxz0O0:
You unlocked bootloader. Now you want to restore TA partition and relock bootloader again =>

Method 1:

Flash stock firmware from flashtool (supported by iovyroot) (you are now unrooted)

Use tarestore.bat from iovyroot

Method 2 (rooted & unlocked bootloader):

Use BackupTA and option "Convert v4 backup"

Restore backup with BackupTA

Flash stock firmware with flashtool
[Sony Cross-Device General] Duvel999:
After Backup TA, Unlock Bootloader at Lollipop, it's easy to flash a MM custom rom.

And if you want to reverse it, Restore TA. It won't give problems?
[Sony Cross-Device General] engineer000:
I just enabled the oem unlock and nothing else. its a clean rom installation so i dont have that my xperia

---------- Post added at 02:43 PM ---------- Previous post was at 02:40 PM ----------

When I try earlier to restore the TA backup, here's what I did:

I dragged the TAxxxxxx.img to tarestore.bat and it open a new CMD window and I just follow instruction. then it was restore within few minutes
[Sony Cross-Device General] charlie460:
Thanks a lot! Didn't want to root without being able to backup TA even with the "DRM restore" method, just in case Sony patched it.

Donated!
[Sony Cross-Device General] karrouma:
Please manage TAxxxxxx.img in root file to habe one file yo have safe root
[Sony Cross-Device General] 3Shirts:
I have an issue. When I run tabackup I get as far as "Removing JOP" then my phone reboots so the rest of the commands give 'device not found.

What am I missing?
[Sony Cross-Device General] amintox:
repeat again and check adb in taskmanager and close it. reboot computer and phone. extract iovyroot from winrar and try again it should work if you are on lollipop 200 on z5
[Sony Cross-Device General] 3Shirts:
Thanks, I did all that and it still failed again but I retried and then it worked! Weird but I'm happy :)
[Sony Cross-Device General] ninestarkoko:
The exploit can randomly crash the phone or might not be 100% successful.

As you did, repeating it after a reboot should do the job.

Also, after using the exploit for TA backup, always restart the phone as it might crash/reboot spontaneously later
[Sony Cross-Device General] ahsid:
Hi !

I'm feeling kind of noob right now, I have to ask the question : how do you execute these scripts ? I tried directly from a console on windows and macOS in and out of the sdk with no success whatsoever...

PS : I have the android sdk on my computer & drivers installed
[Sony Cross-Device General] hartmark:
Can you add this to the FAQ to easy access in the future? I'm going to try this later when I have more time to sit and setup phone again as I need to downgrade to lolipop. I'm on marshmallow now on my Z5 premium.
[Sony Cross-Device General] RyTekk:
There's a new 0.3 version with more warning in tarestore.bat.
[Sony Cross-Device General] frostmore:
you unlocked bootloader and you want to restore TA?

how does that work? i thought unlocking bootloader would mean the loss of TA partition forever?
[Sony Cross-Device General] devilmaycry2020:
You have to backup TA before unlock bootloader if not you will lost TA forever
[Sony Cross-Device General] jon1234444:
is it possible to flash the LP kernel only (using flashtool?) on a MM device? will it just bootloop? I'm hoping to avoid a full wipe and downgrade to LP in order to backup my TA.
[Sony Cross-Device General] zippy01:
It won't boot and doesn't boot far enough for adb
[Sony Cross-Device General] tobias.waldvogel:
For all of you who managed to backup for TA partition I created a new version of my kernel repack tool, which extracts the device key from your TA backup and reactivates it after unlocking your bootloader. This will make your DRM keys work the same ways as before.

http://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605/post64990566#post64990566

Cheers Tobias
[Sony Cross-Device General] tobias.waldvogel:
Request for TA from EE683 (Z5 Dual)

If someone managed to backup the TA partition of an EE683 I would be interested in a copy for comparing it to mine.

It would help me to further improve my DRM restore tool.

Cheers,

Tobias
[Sony Cross-Device General] zike47222:
Guys is there any .200 for E5823? Mega or Drive? My net is to slow and Xperiafirm crashes. Or can i flash LP kernel on .163?
[Sony Cross-Device General] devilmaycry2020:
Good job
[Sony Cross-Device General] zippy01:
Read 3 posts up
[Sony Cross-Device General] darkmen:
Hi, D6603 23.4.xx works too

Good job
[Sony Cross-Device General] gustav_b:
Mac OS X/Linux version of the backup/restore scripts

I have ported the tabackup.bat and tarestore.bat to POSIX shell. These should work under Mac OS X, Linux, etc. and with any shell (Bash, ZSH).

Please note: The scripts require a working adb in your PATH.

Usage

:

Download and unzip the iovyroot tool

Download the attached ta-backup-unix.zip and unzip in the same directory as (1)

To create a backup, run ./ta-backup.sh in the same directory

To restore a previous backup: ./ta-restore.sh <backup-file>

Disclaimer: I take no responsibility whatsoever – I've only tested these scripts under Mac OS X 10.10 with Bash.
[Sony Cross-Device General] Vanta-Chan:
ok, so i got an error with my E6853 32.0.A.6.170 which I can't really replicate the output 1:1 but i had a problem at

adb shell "rm /data/local/tmp/tabackup/TA-*.img"

It couldn't find that file. So I just retried it and got the error:

...
[+] Start read thread
[+] Done
[+] Removing JOP
error: protocol fault (no status)
error: device not found
error: device not found
error: device not found
Press any key to continue . . .

When I looked at my phone screen, the display faded off with weird stripes and the red LED lighted up. After some seconds (while panicking >_>) it restarted itself and the first thing i did is to check the keys. They're still active.

So what did I do wrong? Sadly there isn't any fool proof instructions :silly:

These are my dev settings in my phone:

Dev Settings: on
Keep display active: on
OEM-Unlock: off
USB-Debugging: on
Fake positions: on
verify apps over usb: on

Edit:

Now the tabackup.bat gives out this message:

iovyroot by zxz0O0
poc by idler1984
[+] Changing fd limit from 1024 to 4096
[+] Changing process priority to highest
[+] Getting pipes
[+] Allocating memory
[+] Installing JOP
[+] Patching address 0xffffffc001950630
[+] Start map/unmap thread
[+] Start write thread
[+] Spraying kernel heap
[+] Start read thread

Now after some minutes, it gives this message when the display goes off:
error: device not found
error: device not found
error: device not found
error: device not found
Press any key...
and then the phone restarts.
OR
when I close the cmd window before the error: device not found message,
Screen fades off, some weird stripes appear and the color changes, then red LED and it restarts.

REEDIT:

Sorry for bothering, but I think i got it and it was really a weird process. Now I got the backup.

How it worked for me: after my phone restarted and stayed on lockscreen, I launched tabackup.bat, unlocked phone and the .bat continued to extract the TA.

The last messages were those:

[+] Removing JOP
got root lmao

TA.img copied successfully

Do you still need a TA, [MENTION=357342]tobias.waldvogel[/MENTION] ?
[Sony Cross-Device General] Eienkei:
Thanks a lot for all the effort!

Just a quick question, does the TA partition change after each reboot? I have made 3 backup files and none of them have the same MD5! Is it fine?
[Sony Cross-Device General] Elfeno:
Seems strange to me... Made 2 backup exactly same MD5, but doesn't rebooted. Restored using tobias's tool works very nice :) is the ta backup you made 2048ko ?
[Sony Cross-Device General] Eienkei:
Yes, the TA Backups are 2MB but they are different. Would anybody else confirm it?
[Sony Cross-Device General] zxz0O0:
Yes, it can change after reboot. :)
[Sony Cross-Device General] liveasx:
Hi guys@zxz0O0 My phone is Z5C! TA file backed up MD5 is different, please explain what the situation on the #2,Thanks!
[Sony Cross-Device General] zxz0O0:
What's the output of the tool? Did you try running again?
[Sony Cross-Device General] bruno$0:
How can i cehck if the backup was did correctly? MD5?
[Sony Cross-Device General] Vanta-Chan:
Can confirm, backed up two times yesterday with rebooting and today two times without rebooting.

TA.img changes after every reboot. So why? Is this going to affect something or are these changes irrelevant?
[Sony Cross-Device General] zxz0O0:
There are many things saved on the TA partition. Some stuff can change. That's irrelevant.
[Sony Cross-Device General] darkmen:
[MENTION=3975929]zxz0O0[/MENTION]

Is there a way to mount /system rw after getting the temproot and preparing /data/bin/su ?

root@D6603:/ # id
id
uid=0(root) gid=0(root) context=u:r:init_shell:s0
root@D6603:/ # mount -o remount,rw /system
mount -o remount,rw /system
mount: Operation not permitted
255|root@D6603:/ #

Unlocked BL

Thanks in advance
[Sony Cross-Device General] zxz0O0:
If you unlocked the bootloader you should use a custom kernel with ric and dm-verity disabled. Something like that: http://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605
[Sony Cross-Device General] rhapsody01:
E6683 on Marshmallow owner here !

I'm following this thread with great interest, but I noticed my build number (32.1.A.1.163) is not listed by OP.

Tried this tool but without surprise got an error : Device not supported.

I assume that the exploit doesn't work on this version ?

Any insight would be appreciated.

And thanks for this great work !
[Sony Cross-Device General] Duvel999:
Yes, if you followed it. You might knew that the exploit only on a certain Lollipop fw. works.

Not on MM.

So try again after a downgrade.

It's in the first post.

Good luck
[Sony Cross-Device General] linuxct:
If you could post a pre-compiled 32 binary would be nice to try on my device :)
[Sony Cross-Device General] frostmore:
i got very strange results with 2 of my z5 premiums.

1 phone randomly reboots after backup TA. that phone was completely wiped.took a few tries and errors to do the backup.

1 phone remains normal after backup TA and can function normally like any other phone.this phone only took 1 try and hell even after the second time it's still functioning normally as if nothing happened.

is this why the exploit is considered not 100% working all the time???
[Sony Cross-Device General] daniel_loft:
So, I've read this thread several times but, just to be sure about things and to make it easier for others, I am looking forward to some confirmations and answers:

1. The full procedure to obtain permanent root is:

- Flash one of the supported firmware versions (with flashtool)

- Backup the TA partition using the script in the original post

- Let the phone update itself to newest firmware

- Unlock the bootloader (with flashtool and Sony site)

- Flash a pre-rooted kernel (like the one mentioned a few posts back)

2. Going back to stock (in case of need):

- Flash one of the supported firmware versions (with flashtool)

- Restore the TA partition using the script provided in the original post

- Re-lock the bootloader (using flashtool)

3. Is there any way to confirm that the backup of the TA partition was correctly done and can be properly restored?

4. The OTA updates will not work anymore after unlocking the bootloader, right?

In case I missed something at the first 2 points, please correct me.

Thank you!
[Sony Cross-Device General] darkmen:
Here you are
[Sony Cross-Device General] linuxct:
Thank you, I'll try when I arrive home. :good:
[Sony Cross-Device General] zxz0O0:
Sometimes if the kernel heap spray is not working it can crash. This normally occurs at the message "Starting read thread"

Most things are correct. However, after restoring TA partition your bootloader is already locked. While doing the TA backup the script checks the MD5 hash of the backup and original, if this matches it was most likely successful.
[Sony Cross-Device General] devilmaycry2020:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\1CM12.1\iovyroot_v0.3>tabackup.bat
* daemon not running. starting it now on port 5037 *
OK
* daemon started successfully *
728 KB/s (23280 bytes in 0.031s)
0 KB/s (683 bytes in 1.000s)
mkdir failed for /data/local/tmp/tabackup, File exists
iovyroot by zxz0O0
poc by idler1984

[+] Changing fd limit from 1024 to 4096
[+] Changing process priority to highest
[+] Getting pipes
[+] Allocating memory
[+] Installing JOP
[+] Patching address 0xffffffc00194f630
[+] Start map/unmap thread
[+] Start write thread
[+] Spraying kernel heap
[+] Start read thread
[+] Done
[+] Patching addr_limit
[+] Patching address 0xffffffbfb098c008
[+] Start map/unmap thread
[+] Start write thread
[+] Spraying kernel heap
[+] Start read thread
[+] Done
[+] Removing JOP
pull: building file list...
0 files pulled. 0 files skipped.
error: protocol fault (no status)
error: device not found
error: device not found
error: device not found
Press any key to continue . . .

C:\1CM12.1\iovyroot_v0.3>

I've tried 3 times always crash and reboot phone itself. but before i could backup TA no problem. why ?
[Sony Cross-Device General] Duvel999:
Got Windows 10? Looks like a driver problem..
[Sony Cross-Device General] Bronnel:
after restoring TA backup, how to verify that the bootloader is locked?
[Sony Cross-Device General] Arturiuz!:
use Flashtool for Xperia devices then click the BLU button..you'll know!
[Sony Cross-Device General] zippy01:
What's that got to do with knowing if the bootloader is locked?
[Sony Cross-Device General] Arturiuz!:
my bad,really!i was thinking out of nowhere!tried editing my response as possible i cpuld but i guess i was too slow..haha..sprry!peace!
[Sony Cross-Device General] gm007:
I service menu you can know if bootloader is unloked or locked.this screenshot for locked bootloader, if it's unlocked you will see some error.
[Sony Cross-Device General] zippy01:
Yeah but not at the location mentioned
[Sony Cross-Device General] 4RM4N1:
Same problem as devilmaycry2020
[Sony Cross-Device General] zxz0O0:
Did you flash a custom kernel or change anything else?
[Sony Cross-Device General] devilmaycry2020:
No,nothing changed, as you saw in my log,

[mkdir failed for /data/local/tmp/tabackup, File exists
iovyroot by zxz0O0

. Before I could backup successful many times
[Sony Cross-Device General] najoor:
Is there a change log? I cannot find it on github. Thanks in advance.
[Sony Cross-Device General] Wess.a:
I have some questions:

1. Will i be able to update to MM again after rooting and UL?

2. Will i be able to use the stock kernel?
[Sony Cross-Device General] zxz0O0:
After rebooting do not unlock the device. Wait one minute and let it go to sleep again. Then run the tabackup.bat

There is a commit history on github.

1. Yes

2. Depends. Full stock kernel does not allow root, you have to use a slightly modified stock kernel

Please see your specific device forum for more info.
[Sony Cross-Device General] Wess.a:
Thanks :) and my phone is z5, where should i go?
[Sony Cross-Device General] azeez77:
[MENTION=3975929]zxz0O0[/MENTION] sorry bro how to run this in Linux im trying to move away from windows and still a noob with linux any help or suggestion would be really appreciated
[Sony Cross-Device General] devilmaycry2020:
Nothing was backup. Used v0.4

Check "mkdir failed for /data/local/tmp/tabackup, File exists" again please. how to delete that file ?

P/S: OK. I've got it working. Just delete all files in local\temp folder in C drive
[Sony Cross-Device General] igvk:
Hello Tobias,

Did you mean E6683?

I've just made backup of TA on my Z5 Dual. I may send it to you if interested.
[Sony Cross-Device General] devilmaycry2020:
So is it a problem if i restored one of my own TA backup ? And your tool always 100% successful ?
[Sony Cross-Device General] zxz0O0:
Someone posted a linux script here: http://xdaforums.com/showpost.php?p=66211176&postcount=90

No it doesn't matter, it just has to be your own TA backup.
[Sony Cross-Device General] darkmen:
The thing is, i actually disabled dm-verify and ric service, also i have patched the sepolicy with CF's supolicy tool but still i have:

root@D6603:/ # mount -o remount,rw /system
mount -o remount,rw /system
mount: Operation not permitted

root@D6603:/ # dmesg | grep avc
dmesg | grep avc
<6>[ 447.941751] type=1400 audit(1425128838.300:13): avc: denied { remount } for pid=8009 comm="mount" scontext=u:r:shell:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem op_res=0 ppid=8003 pcomm="sh" tgid=8003 tgcomm="sh"
[Sony Cross-Device General] acabreram:
Thank you for your amaizing work!!

Donated
[Sony Cross-Device General] raspdeep:
I've tried this on LG G Flex 2 H959 5.1.1 LMY47S but it says Error: Device not supported?
[Sony Cross-Device General] zippy01:
Please delete
[Sony Cross-Device General] zxz0O0:
Currently there is LG-H955 supported. Can you upload the boot.img of your device so I can add it too?
[Sony Cross-Device General] frostmore:
[MENTION=3975929]zxz0O0[/MENTION]

not sure if this was asked but, if you flashed a modified stock kernel with dm-verity and ric off, restoring TA (which relocks the bootloader),should still allow you to boot with root right?
[Sony Cross-Device General] raspdeep:
H955 and H959 are very similar that even their partition table for system is similar. if you add support, i can try.
[Sony Cross-Device General] timduru:
M5 Dual 5633

V0.4 working great on the M5 Dual 5633 -30.1.B.1.33 after minor modifications in the backup.sh script

The default stock kernel is linking the partitions as lowercase:

$ adb shell ls -l /dev/block/platform/mtk-msdc.0/by-name/
lrwxrwxrwx root root 2016-04-10 15:08 apps_log -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2016-04-10 15:08 boot -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2016-04-10 15:08 cache -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 2016-04-10 15:08 diag -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 2016-04-10 15:08 expdb -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2016-04-10 15:08 flashinfo -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 2016-04-10 15:08 fotakernel -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2016-04-10 15:08 gen -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2016-04-10 15:08 lk -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2016-04-10 15:08 logo -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2016-04-10 15:08 ltalabel -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2016-04-10 15:08 metadata -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2016-04-10 15:08 nvram -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2016-04-10 15:08 oem -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 2016-04-10 15:08 para -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2016-04-10 15:08 proinfo -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2016-04-10 15:08 protect1 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2016-04-10 15:08 protect2 -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2016-04-10 15:08 seccfg -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2016-04-10 15:08 secro -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2016-04-10 15:08 system -> /dev/block/mmcblk0p24
[COLOR="red"]lrwxrwxrwx root root 2016-04-10 15:08 ta -> /dev/block/mmcblk0p1[/COLOR]
lrwxrwxrwx root root 2016-04-10 15:08 tee1 -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2016-04-10 15:08 tee2 -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2016-04-10 15:08 userdata -> /dev/block/mmcblk0p23

so modifying the backup.sh script to reflect the lowercase "ta" path:

dd if=/dev/block/platform/$platform/by-name/ta of=/data/local/tmp/tabackup/TA-${curdate}.img &> /dev/null

..

md5orig=`md5 /dev/block/platform/$platform/by-name/ta`

and it worked nicely. :)

Thanks for your work !
[Sony Cross-Device General] slaskbak:
Worked like a charm!

Xperia Z5 Premium E6853 with Win10 x64.

Had to retry a couple of times. Worked when I ran cmd as an administrator. Maybe just a fluke.

Now fully rooted with unlocked bootloader but with drm-keys fully working thanks to tobias.waldvogel's excellent kernel repack tool.

Thanks for your great work!
[Sony Cross-Device General] devilmaycry2020:
If I fix the backup.sh as you talk. it can't backup TA on my Z5D. So is it work on M5 only ?

Unable to open /data/local/tmp/tabackup/TA-15042016.img: No such file or directory
chown: /data/local/tmp/tabackup/TA-15042016.img: No such file or directory
could not open /dev/block/platform/f9824900.sdhci/by-name/ta, No such file or directory
could not open /data/local/tmp/tabackup/TA-15042016.img, No such file or directory

Error copying TA.img
pull: building file list...
0 files pulled. 0 files skipped.
rm: /data/local/tmp/tabackup/TA-*.img: No such file or directory
Press any key to continue . . .
[Sony Cross-Device General] timduru:
Most likely yes, I only reported it for the M5 E5633 dual.

Since others reported it to work for some other models, try it without editing first,

and edit only if you see that it doesn't work and that your partitions are linked lowercase.
[Sony Cross-Device General] Masoud.Ser:
Thank you

I've tested on Z5Dual(E6633)

And it worked well without problem
[Sony Cross-Device General] a-st:
Thank you very much.

I've tested on my Xperia Z3+ Dual (E6533) and everything was fine.

I was coming from Lollipop, backed up my TA, upgraded to MM using flashtool and installed OTA 32.1.A.1.185. Now im bootloader unlocked and rooted. Sony DRM features seem to work too.

Gesendet von meinem E6533 mit Tapatalk
[Sony Cross-Device General] lordemperor:
Ran into some trouble during the backup. New retail unlocked Z5 Compact. Just updated itself to 32.0.A.6.200 and I'm holding off the Marshmallow update until I get my TA backed up.

http://i.imgur.com/jLvaGrj.png

Get the following output from tabackup.bat:

C:\Users\*\Desktop\PortableApps\iovyroot_v0.4>adb devices
List of devices attached
CB5A28PN8L device

C:\Users\*\Desktop\PortableApps\iovyroot_v0.4>tabackup.bat
iovyroot by zxz0O0
poc by idler1984

[+] Changing fd limit from 1024 to 4096
[+] Changing process priority to highest
[+] Getting pipes
[+] Allocating memory
[+] Installing JOP
[+] Patching address 0xffffffc00194f630
[+] Start map/unmap thread
[+] Start write thread
[+] Spraying kernel heap
[+] Start read thread
error: device not found
error: device not found
error: device not found
error: device not found
Press any key to continue . . .
[Sony Cross-Device General] werbemehl:
Hello,

i had the same problems with V4 of this Tool, please try V3, this Version worked like a charm

(and no :) i don't know why) :D

Greets
[Sony Cross-Device General] lordemperor:
Worth a try. Can you PM me a link to V3? I can only find V4 and V2 in this thread.
[Sony Cross-Device General] Arturiuz!:
make sure that usb cable is properly inserted into PC's port with the phone connected..as well as usb debugging,allow mock location & unknown resources are also ticked on..i have it working on my device with no problem!i just did a backup a moment ago..
[Sony Cross-Device General] lordemperor:
V3 worked for me first try. ¯\_(ツ)_/¯

G:\Users\*\Desktop\iovyroot_v0.3>tabackup.bat
iovyroot by zxz0O0
poc by idler1984

[+] Changing fd limit from 1024 to 4096
[+] Changing process priority to highest
[+] Getting pipes
[+] Allocating memory
[+] Installing JOP
[+] Patching address 0xffffffc00194f630
[+] Start map/unmap thread
[+] Start write thread
[+] Spraying kernel heap
[+] Start read thread
[+] Done
[+] Patching addr_limit
[+] Patching address 0xffffffc03f0a8008
[+] Start map/unmap thread
[+] Start write thread
[+] Spraying kernel heap
[+] Start read thread
[+] Done
[+] Removing JOP
got root lmao

TA.img copied successfully
Press any key to continue . . .