[Xperia Z4 Tablet General] najoor:
** DISCLAIMER: I AM NOT A DEV AND THIS IS MY HOBBY. I ASSUME NO RESPONSIBILITY IF THIS BREAKS YOUR DEVICE **​

The following is tested on model SGP-771. For Wifi-only model the procedure is the same but you should use the files and kernels for the Wifi model. Do not flash the ftf and kernel files intended for the cellular model on a Wifi-only tablet.​

I am not taking credit for any of the tools and kernels here. They are all developed by others. I am only telling you how to use them.

Credits: [MENTION=3975929]zxz0O0[/MENTION], [MENTION=5169444]AndroPlus[/MENTION], [MENTION=357342]tobias.waldvogel[/MENTION]

0- Prerequisites

You need to have a functioning installation of adb and fastboot tools. You need to have proper Sony drivers installed on your PC to detect your tablet when it is connected to the PC. You should be able to flash an ftf file using flashtool. If any of these sound unfamiliar to you, stop reading, go learn about them, and then come back.

1- How to unlock your bootloader without losing the DRM keys

Sony has designed this tablet such that if you unlock your bootloader you lose your TA partition PERMANENTLY which includes some of the Xperia features and licenses that have to do with image processing etc. forever. You will also no longer receive OTAs. So in theory, without a copy of this TA partition (which is unique to each tablet and cannot be copied over from another tablet) unlocking the bootloader results in an irreversible loss of some of your tablet's features. Relocking the bootloader will not bring them back.

A hack exists that allows you to backup the TA partition before you unlock the bootloader. This backup will make the process completely reversible so if you ever need to send the tablet to Sony for repair or just want to return it to its original state you have a way. Follow these instructions carefully:

1.0- Before you begin keep in mind that this procedure, especially the unlocking step, completely erases your tablet. Disable myXperia and remove your google account before proceeding. The following will likely not work well with encryption.

1.1- Start by clean flashing any 28.0.A.8.260 firmware, For this tutorial I used SGP771_Customized HK_1296-4830_28.0.A.8.260_R10A. You can download it from https://mega.nz/#!YsUWwY5Y!0775_vLpjV9-UkoGjMWP6-Yu8L31LkJVHEyUwA7X9NA. For the wifi only model SGP712 use

https://mega.nz/#!wlIl0JDa!DR0lRL6dDn5Y-K_4768oJnLGWQyrxNV0xLHgKVVesFw (thanks to [MENTION=3530073]kuroneko007[/MENTION])

1.2- Enter service Mode by dialing *#*#7378423#*#* -> Service info -> configuration, and make sure the device is unlockable. (To access service menu on SGP712 (Wi-Fi only model) see: http://xdaforums.com/showpost.php?p=66164176&postcount=5) Also check -> Service Tests -> Security and you will see a bunch of "active" and "OK" attributes. You can take screenshots for your reference.

1.3- Turn on usb debugging mode on your tablet.

1.4- Download iovyroot zip v0.4 or higher from here.

1.5- Unzip this zip file into a folder of your choice and open a command terminal there.

1.6- Connect the tablet which is now in USB debugging mode to your PC and answer yes when it asks to authorize the PC to access the tablet in USB debugging mode. You can check that the PC indeed sees the tablet by running this command

adb devices

1.7- Run the following command:

tabackup

1.8- VERY IMPORTANT: Make sure the command completes with no errors. If all goes well you will have a file with a name like TA-07102015.img (the name may be different for you) with a size of 2MB in your folder.

1.9- Save this file in a very safe place. Save it on your hard disk, AND email it to yourself, AND put it on your google drive. If you lose this file you can never reverse the bootloader unlocking process.

1.10- Reboot the device.

1.11- Now you can unlock the bootloader. Follow the instructions at Sony's official website at http://developer.sonymobile.com/unlockbootloader Also save your unlock code that you obtain in this step somewhere. You may need it some day.

1.12- Reboot the device and it will briefly enter recovery and then start the tablet initial setup.

1.13- (Optional) you can easily verify that your bootloader is unlocked by entering the fastboot mode, obtaining any boot image, and running the following command to boot your tablet with that image:

fastboot boot boot.img

1.14- (Optional) you can see that the DRM keys are erased from your tablet by repeating step 1.2 but this time you will see a bunch of errors under Service Tests -> Security.

1.15- As a side effect of unlocking the bootloader you lose the ability to receive OTA updates. Clean flash a Marshmallow ftf to continue. For this tutorial I used Marshmallow 6.0 SGP771_Customized DE_1295-6955_32.1.A.1.185_R4C (the latest firmware at the time of this writing.)

2- How to emulate DRM keys and/or root after unlocking the bootloader.

A hack exists that can emulate the DRM keys:

2.1- Obtain a kernel boot image. If you want to stick with the stock kernel you need to extract kernel.elf from the ftf that you flashed in step 1.15. If you want a custom kernel you can download one from https://kernel.andro.plus/kitakami.html Note that whatever kernel you are using in this step must match the firmware version currently installed on your system. For this example I downloaded Z4T_SGP771_AndroPlusKernel_v27.zip and extracted the boot.img file from the zip, which matches Marshmallow 32.1.A.1.185.

2.2- Download rootkernel_v4.42_Windows_Linux.zip (or a higher version) from http://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 and unzip it in a folder of your choice.

2.3- Copy the kernel (e.g. boot.img) to this folder. If you want root, place SuperSU 2.71 (or higher) in this folder as well. Make sure the name of the SuperSU zip starts with letters "SuperSU". The latest SuperSU can be obtained from: http://xdaforums.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133

2.4- Open a command terminal in this folder and run the rootkernel script. Your command should look similar to this:

rootkernel.cmd boot.img boot-patched.img

When prompted, answer as follows:

- Sony RIC is enabled. Disable? [Y/n] Y

- Install TWRP recovery? [Y/n] N

- Found SuperSU-v2.71-20160331103524.zip. Install? [Y/n] Y (if you want root)

- Install DRM fix? [Y/n] Y (if you want DRM emulation)​

This will create a new kernel image called boot-patched.img which you will now flash on your tablet.

2.5- Boot the tablet in the fastboot mode and flash your patched image using the following fastboot command:

fastboot flash boot boot-patched.img

2.6- (Optional) You can reboot the tablet and see that the DRM keys are indeed retrieved by repeating step 1.2. You can also open settings -> display, and look under Image Enhancement. If the DRM emulation is succesfull you will see this but if it hasn't been successful you will see this.

3- How to flash a custom or stock kernel

3.1- Whether you want to use a custom kernel or stock, and whether you have done the DRM patch described above or not, to flash it on your tablet you need to restart the tablet in fastboot mode.

3.2- To flash the kernel use this command:

fastboot flash boot [I]name_of_your_kernel[/I]

You will replace name_of_your_kernel with whatever your kernel is called (e.g. boot.img, kernel.elf, etc.)

4- How to flash recovery

4.0- To install TWRP recovery you need to flash AndroPlus kernel first (see sections 2.1 and 3).

4.1- Download a TWRP image from the same webpage. For this tutorial I used TWRP-3.0.2-0-20160417.img.

4.2- Reboot into fastboot mode and run this command:

fastboot flash recovery TWRP-3.0.2-0-20160417.img

4.3- Reboot the tablet. To enter recovery touch the volume keys when the LED turns yellow during the boot splash screen.

5- How to relock bootloader and return it to original factory state

5.0- To relock the bootloader along with restoring the DRM keys the tablet must have unmodified stock firmware.

5.1- Repeat step 1.1

5.2- Repeat steps 1.3, 1.4, and 1.5

5.3- Copy the TA backup image that you had obtained in section 1 in the iovyroot folder and use the tarestore command to flash the TA partition back onto the tablet. The command will look similar to this:

tarestore TA-07102015.img

Make sure the command completes with no error. If it fails the first time try again. Reboot the tablet. Your bootloader is now locked and your DRM keys restored.

5.4- (Optional) You can verify that you are back to the original locked state by repeating step 1.2.