[Sony Xperia M5] mbc07:
Before starting, your phone must have an unlockable bootloader. If your Xperia M5 have a permanently locked bootloader, unfortunately you can't use this kernel.

As you may already know, Sony enabled verified boot on Xperia M5 starting with the Marshmallow firmwares just like on their recent flagships (Z3+/Z5/X Performance/etc) and thus, dd Flasher Minimal won't work anymore because it writes into system partition, and so, dm-verity would fail and the phone would refuse to boot.

How it works?

The main issue is dm-verity, which prevents any kind of modification on system partition, so we must disable it. Unfortunately, you need to modify the RAM Disk of the kernel to disable dm-verity, and to flash a modified kernel, you'll need to unlock the bootloader, wiping your device unique DRM keys in the process. Fortunately, @tobias.waldvogel developed a tool which includes a DRM fix, aimed mostly at the Xperia flagships, but it also works very well with Xperia M5, and thanks to iovyroot/iovySU and the previous exploitable firmwares, we can make a TA Backup without much trouble!

So, in other words, this modified kernel comes in 3 different variants and is exactly the same as the stock Marshmallow kernels despite the following changes:

• Verified boot (dm-verity) disabled on the SuperSU variant (and it'll get automatically disabled after you install a root solution on top of the DRM Fix variant).

• SuperSU v2.78 SR2 in system-less mode (and a small modification to make it survive factory resets) on the SuperSU variant.

• DRM fix library (more about that later) on the SuperSU and DRM Fix variants.

Supported Firmwares

For single SIM variants (E5603, E5606 and E5653):

• 30.2.A.0.100

• 30.2.A.0.110

• 30.2.A.1.21

For dual SIM variants (E5633, E5643 and E5663):

• 30.2.B.0.100

• 30.2.B.0.110

• 30.2.B.1.21

Requirements

• Your device must have an unlockable bootloader. (you can check that in the Service Menu, on your phone, open the dialer and enter *#*#7378423#*#*, then go to Service Info => Configuration => Rooting Status).

• You must be running one of the supported firmwares and should flash a variant that matches the firmware version you're running.

• ADB drivers and fastboot should be installed on the computer.

• (Optional, but highly recommended) A TA backup of your device, taken before unlocking its bootloader, to restore DRM-related functions, if using the SuperSU or the DRM Fix variant.

Kernel Variants

Before continuing, you should pick and download one of the three variants (you can get them on the "Downloads" tab from the top of this thread Edit: use the alternate download link at the end of this post). Remember to pick the version that matches the firmware you're running, otherwise you might experience bugs or incompatibilities! The available kernel variants are:

• DRM Fix: this variant is the stock kernel with the DRM Fix library included. You must install a root solution (like Magisk or SuperSU) after flashing this variant, otherwise you won't have root access and dm-verity will still be enabled (it'll get automatically disabled after you flash Magisk or SuperSU). That's the variant I recommend for all end-users, and I strongly advise flashing Magisk instead of SuperSU, especially if you want to pass on SafetyNET checks.

• SuperSU: this variant is the stock kernel with the DRM Fix library included, dm-verity disabled and SuperSU v2.78 SR2 pre-installed in systemless mode. Keep in mind if you plan to use Android Pay or other SafetyNET enabled apps that this variant won't pass any SafetyNET check. I only recommend this variant for end-users who don't care about SafetyNET and just want root access quick and dirty, but even then I strongly suggest considering DRM Fix variant + Magisk route instead.

• Stock: as the name implies, this variant is identical to the stock kernel without any kind of modification, repacked in a standard Android Boot Image format file, thus, bypassing all incompatibilities with kernel patching and editing tools caused by the ELF format + Mediatek header that's used on the stock firmware. This version won't disable dm-verity, won't provide root access and doesn't include the DRM Fix, it's aimed at modders and developers only.

Instructions

The instructions are split into three smaller sections. If you already have unlocked the device's bootloader, jump straight to the 2nd section.

Backing up the TA partition and unlocking the bootloader

Before unlocking the bootloader, I highly recommend making a backup of the TA partition of your device as it'll allow relocking your bootloader and restoring your device unique DRM keys in the future and it'll also allow restoring full DRM related functionality on your phone through the DRM fix library included in the DRM Fix and SuperSU variants of this kernel.

To make a TA backup, your phone should be already rooted (you can do that on Xperia M5 by downgrading to one of supported firmwares and then using iovySU, click here for more details), after that, use Backup TA to make the backup. Also, keep in mind that the TA partition is unique to every device and you should NOT EVER restore or use a TA backup of another phone, even if it's from exactly the SAME model and variant! Doing that will hard brick your device, most of times beyond repair.

After making a TA Backup you can safely unlock your bootloader, start by going to Sony Developer World and follow the instructions to request your bootloader unlock key. Note: Xperia M5 isn't in the list of unlockable devices but you can pick any other device on the list (I picked up Xperia Z5, for example), it'll also work without issues.

After you got your bootloader unlock key, simply turn off your phone, hold the Volume Up key and plug the USB cable. Keep holding Vol Up until notification LED becomes blue. Now, run the following commands to unlock your bootloader (this will wipe all data on internal storage, make sure to backup important data first!):

fastboot oem unlock 0x<your device key>
fastboot reboot

(since internal storage will be wiped, the first boot after unlocking the bootloader will take a while to complete)

Flashing your device key

You need a TA Backup from when your bootloader was still locked to perform this step, if you didn't make a TA Backup before unlocking the bootloader, your device keys are gone forever thus you can't flash your device key, so, skip directly to the next section.

On Xperia devices, when you unlock the bootloader, the unique device key get deleted forever and so some proprietary Sony features (X-Reality/Mobile BRAVIA Engine, proprietary camera denoise algorithms, etc) and DRM-related features cease to work. The DRM fix library included in the DRM Fix and SuperSU variants of this kernel fully reactivates all DRM-related functionality by loading your device key from an alternate TA Unit (which we'll flash now).

First we need to extract your unique device key from the TA backup, you can do that with Root Kernel. Extract it somewhere and put your TA backup on the same folder (if you did your backup through iovyroot, it's a file named TA-xxxxxx.img, if you did your backup through Backup TA it's a file named TA.img which will be inside the .ZIP file) then run the following command through Command Prompt (or Terminal if you're on Linux/Mac):

flash_dk <ta backup image> DK.ftf

If everything went well, you'll now have a FTF file of around 500 bytes named DK.ftf on the same folder. Using Androxyde's FlashTool, flash this file in your phone through flash mode. An alternative method is opening DK.ftf with WinRAR or 7-Zip to extract the file DK.ta and then using FlashTool Pro Mode (File => Switch Pro then Advanced => Trim Area => S1 => Flash TA File). You only need to do this step once, no need to reflash the key even after flashing other FTF files or doing a Factory Reset.

After that, you're ready to flash the kernel, follow to the next section.

Flashing the modified kernel

If you have downgraded your device to make a TA backup on the previous sections, it's time to go back to one of the supported Marshmallow firmwares before continuing!

Now, unzip the kernel variant you've downloaded earlier, then turn off your device, hold Volume Up and plug the USB cable. Keep holding Vol Up until the notification LED turns blue, then run the following commands to flash the kernel (replace the file name with the appropriate version of the variant you've selected):

For example, if you have an E5603, E5606 or E5653 on 30.2.A.1.21 and have chosen the DRM Fix variant the command would be:

fastboot flash boot boot_m5_ss_30.2.A.1.21_drmfix.img
fastboot reboot

Or if you have an E5633, E5643 or E5663 and have chosen the SuperSU variant the command would be:

fastboot flash boot boot_m5_ds_30.2.B.1.21_supersu.img
fastboot reboot

If you've flashed the SuperSU variant, that's it. Upon rebooting you should see SuperSU in the app drawer. If you've flashed the DRM Fix variant you should now boot into TWRP recovery and install either Magisk or SuperSU to finish the setup. And thanks to the DRM fix library by @tobias.waldvogel, if you have flashed either the DRM Fix variant + Magisk/SuperSU or the SuperSU variant alongside your device key, you can also redo the Security Test on the Service Menu (open the dialer and enter *#*#7378423#*#* to open) to see it still passes, even with the bootloader unlocked!

Known Issues

• DRM Fix library in the DRM Fix variant will only work if you install Magisk or SuperSU through TWRP recovery.

• Offline charging won't work anymore after flashing the SuperSU variant or the DRM Fix variant + Magisk/SuperSU. Your phone will boot up normally instead.

• If you're running firmware 30.2.x.1.21, you won't be able to reboot directly into recovery by running adb reboot recovery. That's a restriction implemented by Sony, but you can still boot into recovery manually by holding Vol Down + Power while the phone is turned off without the USB cable attached.

Frequently Asked Questions

Q: Help! Fastboot is stuck at "< waiting for any device >" message!

A: This means fastboot isn't "seeing" your phone, probably because you didn't install ADB drivers (you can use this stand-alone driver). If fastboot still can't see your phone, make sure you don't have emulators like BlueStacks or Genymotion running.

Q: I didn't make any TA backup before unlocking the bootloader, can I still benefit from DRM fix library?

A: Yes, but in a limited manner. Without your device key, the library will work in an "emulation" mode which is sufficient to restore some of Sony proprietary features (like Mobile BRAVIA Engine and noise reduction algorithms in the camera). However, Miracast might not work and any app dependent of Widevine DRM won't work too.

Q: I didn't make any TA backup before unlocking the bootloader, can I flash the device key of another phone?

A: No, those keys are unique for each device, even if they are from exactly the same model and variant. Doing that may also hard brick your phone.

Q: Service Menu indicates that my bootloader can be unlocked even through it's already unlocked. What's happening?

A: The DRM Fix library from the DRM Fix and SuperSU variants loads your device key from an alternative TA Unit, and thus, since the key is present, Service Menu thinks that the bootloader is still locked, even through it isn't. Just ignore it...

Q: Help! I formatted my /data partition / I reseted my phone to factory defaults and it's randomly rebooting at Sony logo. What's happening?

A: Don't worry, you flashed the SuperSU variant and that's just system-less SuperSU reinstalling itself back. During that process is normal that the phone reboots once or twice at Sony logo or shortly after, then everything will be normal.

Q: Does this kernel passes SafetyNET checks? Can I use Android Pay?

A: It passes SafetyNET checks only if you flash the DRM Fix variant and then install Magisk afterwards (you might need to enable Magisk Hide manually through Magisk Manager app). All other variants won't pass SafetyNET, not even the stock one due the unlocked bootloader.

Credits

The most important piece of the SuperSU and DRM Fix variants of this kernel (the DRM Fix library) was made by @tobias.waldvogel. He's also the developer of Root Kernel, which can patch kernels with this library on the fly. Unfortunately, Mediatek kernels have some oddities (like a 512-bytes header at the beginning of the zImage and RAM Disk) that prevents most tools from working without modifications, so I had to edit and patch those kernel variants manually. The system-less integration of SuperSU on the SuperSU variant was done using the official SuperSU installer from @Chainfire despite a minor tweak I did to make root access survive Factory Resets, so, credits (and thanks) to them.

XDA:DevDB Information

Stock Marshmallow Kernel with Root + DRM Fix, Kernel for the Sony Xperia M5

Contributors

mbc07

Kernel Special Features: stock kernel, pre-rooted

Version Information

Status: No Longer Updated

Stable Release Date: 2016-09-01

Created 2016-11-03

Last Updated 2017-08-11

Alternate download link here (XDA DevDB archive)