[Xperia Z5 Compact General] smartphone-tester:
Hi everybody,

None of the following is my own novel work, I just took some time to go through the process step by step and document how to root the Z5 compact while preserving both the DRM keys (in a backup) and the functionality normally lost by unlocking the bootloader (using the DRM credentials patch). This post may serve as a tutorial for people starting to root their Z5 compact for the first time.

The device I tested it with is an E5823 with German firmware (originally shipped with CDA 1298-1220_R1C) that was already updated to build 32.1.A.1.163 (Android 6.0, patch level 2016-02-01) via OTA. For devices with other CDA regions, please adapt accordingly by using the respective firmware files.

1. Backup settings and apps

This will be required for restoring after unlocking the bootloader (which wipes the user data partition). For some reason, including the "-shared" option (i.e. contents of the internal emulated SD card, aka media storage) did not work, so make sure to save any media files (pictures takes with the camera, downloads, etc.) separately, e.g. via MTP.

Use Sony backup to SDcard functionality

adb backup -apk -all -f sony-xperia-z5c-noshared.ab

2. Backup TA partition (DRM keys)

Downgrade to exploitable firmware release (LP). Note that downgrading without wiping will make the phone unstable and may cause an automatic reboot after 1-2 min. Therefore either manually wipe the phone during flashing (ticking the checkbox in Flashtool) or be quick with the second (root/backup TA) step.

Download XperiFirm from http://xdaforums.com/crossdevice-dev/sony/pc-xperifirm-xperia-firmware-downloader-t2834142 (I use it under Linux with mono) - UPDATE: For downloading the .185 MM firmware, I had to update to XperiFirm 4.9.1. For downloading 32.2.A.0.253, I used XperiFirm 5.0.0.

Download firmware build 32.0.A.6.200 for the root exploit based on CVE 2015-1805. I used E5823_StoreFront_1299-6910_32.0.A.6.200_R2B downloaded with XperiFirm 4.8.2 (or newer) on 2016-04-01

Download flashtool from http://www.flashtool.net/index.php, I used flashtool-0.9.20.0-linux.tar.7z (or newer version)

Create FTF file in Flashtool with menu Tools->Bundles->Create

Flash in flashmode (flashing system.sln takes 8-10 minutes, be patient...)

Use temporary root exploit to backup TA partition (http://xdaforums.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597)

I used iovyroot_v0.3.zip as of 2016-04-02

Connect USB in ADB mode

adb push "root/iovyroot" "/data/local/tmp/iovyroot"

adb push "root/backup.sh" "/data/local/tmp/backup.sh"

open shell: adb shell

chmod 777 /data/local/tmp/iovyroot

chmod 777 /data/local/tmp/backup.sh

mkdir /data/local/tmp/tabackup

/data/local/tmp/iovyroot /data/local/tmp/backup.sh

exit

adb pull "/data/local/tmp/tabackup/" .

3. Upgrade again to MM and unlock bootloader with official method

Create FTF from E5823_Customized DE_1298-1220_32.1.A.1.163_R1C with Flashtool and flash in flashmode.

Optional: Verify that DRM keys are still OK: In dialer enter "*#*#service#*#*", then "Service tests" --> "Security" and it should look like this:

Allow bootloader unlock in developer settings

Follow steps from http://developer.sonymobile.com/unlockbootloader/unlock-yourboot-loader/ . There is not much to add here, as Sony describes the process well and in sufficient detail. Please note that this WILL WIPE YOUR DATA PARTITION, INCLUDING SHARED FILES. Make sure that you have a backup before executing this step (and best do it before downgrading to LP, because some parts will not work after the downgrade without a wipe, and may make the phone reboot after 1-2 min).

Reboot in fastboot mode: hold volume-up and connect USB cable to turn on

fastboot -i 0x0fce oem unlock <your unlock code>

After unlock: check key status

Optional: Try restoring TA partition (will lock bootloader again if successful!). This can be skipped entirely if you trust the tools used in this tutorial, but I chose to verify that restoring the DRM keys works as expected (not that you can do anything about it at that step if it doesn't work...).

Flash E5823_StoreFront_1299-6910_32.0.A.6.200_R2B again with Flashtool

Enable developer mode, connect USB in ADB mode

adb push "root/iovyroot" "/data/local/tmp/iovyroot"

adb push "root/restore.sh" "/data/local/tmp/restore.sh"

adb push TA-02042016.img "/data/local/tmp/TA.img"

open shell

chmod 777 /data/local/tmp/iovyroot

chmod 777 /data/local/tmp/restore.sh

/data/local/tmp/iovyroot /data/local/tmp/restore.sh

Flash E5823_Customized DE_1298-1220_32.1.A.1.163_R1C again with Flashtool

Check key status --> exactly the same as before, so successfully restored

Unlock again in fastboot mode (will wipe data again...)

fastboot -i 0x0fce oem unlock <your unlock code>

UPDATE: Updating to newer MM releases

After the first version of this post, Sony has already released an updated MM firmware (.253 at the time of this writing). If at any point in time you wish to update to a newer release, start at this point of the tutorial. Theoretically, this should be possible without wiping. However, I would not try it without a backup.

Create a backup, e.g. with adb backup or Sony backup.

Download new firmware with XperiFirm. At the time of this writing, I used "E5823_Customized DE_1298-1220_32.2.A.0.253_R2C", downloaded with XperiFirm 5.0.0.

Create FTF file in Flashtool with menu Tools->Bundles->Create

Flash in flashmode (flashing system.sln takes 8-10 minutes, be patient...)

4. Root MM

This will also give you TWRP recovery (which can be entered by pressing the volume up or down button a few seconds after power-on, as soon as the LED starts to change color).

DEPRECATED Alternative 1: with custom kernel but original system image: http://xdaforums.com/z5-compact/general/root-e5823-marshmallow-t3336346

Download Androplus kernel from https://www.androidfilehost.com/?w=files&flid=52185 (I used v22c)

Download TWRP 3.0 from http://xdaforums.com/z5-compact/orig-development/twrp-suzuran-twrp-3-0-t3334568 (I used "March 25, 2016 version") --> twrp-3.0-recovery.img

Download SuperSU v2.71 beta from https://download.chainfire.eu/932/SuperSU/BETA-SuperSU-v2.71-20160331103524.zip

With unlocked bootloader, you can now use fastboot mode. The easiest way is to do this from a running Android system:

adb reboot bootloader

Flash kernel:

unzip Z5C_AndroPlusKernel_v22c.zip

sudo fastboot flash boot boot.img

Flash recovery:

sudo fastboot flash recovery twrp-3.0-recovery.img

Install SuperSU:

boot into Android, copy BETA-SuperSU-v2.71-20160331103524.zip to internal storage (ADB sideload doesn't seem to work with this experimental TWRP at the moment...)

boot into TWRP by pressing volume-up when LED blinks immediately after turning on (and choose option "Keep Read Only" for the system partion)

Install SuperSU zip --> systemless mode

DEPRECATED Alternative 2: with modified system partition: http://xdaforums.com/z5-compact/development/kernel-stock-kernel-dm-verity-sony-ric-t3350341

RECOMMENDED Alternative 3: with stock kernel patched for root and original system partition: http://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605

Download rootkernel_V4.51_Windows_Linux.zip from URL above (or the newest version available at that time) and unpack

Patch the kernel from your currently flashed Sony firmware release:

Flashtool -> Tools -> SIN Editor to extract the kernel from kernel.sin in the directory created by XperiFirm --> .elf file

Copy latest SuperSU*.zip (v2.76 at the time of this last update) to the folder where rootkernel*.zip was extracted to.

Note: if using the firmware 32.2.A.0.224, you will need the latest beta SuperSU.zip from https://download.chainfire.eu/964/SuperSU/BETA-SuperSU-v2.74-2-20160519174328.zip . For 32.2.A.0.253 (the latest at the time of this update), use SuperSU v2.76 (non-beta).

./rootkernel.sh kernel.elf kernel-patched.elf

My personal recommendation for the options: don't disable RIC, install TWRP, don't install busybox, install DRM fix

sudo fastboot flash boot kernel-patched.elf

./flash_dk TA-02042016.img DK.ftf

Flash DK.ftf with flashtool for a more complete restore of DRM-based functionality with the original TA partition backup

UPDATED: Thanks to ninestarkoko for pointing out that also the AndroPlus kernel disables dm-verity to enable more flexibility for root-using apps. Originally I assumed that dm-verity would still be intact with alternative 1, which in fact it is not. As of 2016-05-11, I used alternative 3 instead of alternative 1.

Now that Xposed can be installed system-less (http://xdaforums.com/xposed/unofficial-systemless-xposed-t3388268), it should be possible to use with dm-verity intact. However, I have not tried this so far.

5. [Optional] Install Xposed

Sony MM firmware no longer seems to have the odex problem documented in http://xdaforums.com/crossdevice-dev/sony/z4-z5-z5c-fix-camera-fc-installing-t3246962/, so no additional steps before/after "normally" installing Xposed are required

Download latest arm64 "sdk23" framework from http://dl-xda.xposed.info/framework/ (I used v81)

UPDATE: There is now a system-less version v86, which may even support OTA upgrades of the system image. At the time of this last update, I used the version linked from http://xdaforums.com/xposed/unofficial-systemless-xposed-t3388268.

Download XposedInstaller_3.0-alpha4.apk from http://xdaforums.com/showthread.php?t=3034811 and install

UPDATE: For the system-less Xposed version, instead use XposedInstaller_by_dvdandroid.apk from http://xdaforums.com/xposed/unofficial-systemless-xposed-t3388268.

Install xposed-v86.1-sdk23-topjohnwu.zip via TWRP

6. Restore functionality relying on DRM credentials

Note: This is not necessary if you used alternative 3 for rooting above - that one already includes the DRM fix in the patched kernel image.

Using TWRP flashed in the step before, flash the ZIP to patch Sony credentials checks from http://xdaforums.com/xperia-z5/development/sony-credentials-restore-unlocking-t3296383 .

Copy drmrestore.zip from above link to internal storage and install via TWRP

That's it!