yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] ggow:
https://xdaforums.com/showpost.php?p=69972315&postcount=21
[Sony Cross-Device General] hylde:
I am having exact same problem, Z5P Dual E6883 and 0 bytes TA img and same warnings.

Did we miss anything?

Thanks
[Sony Cross-Device General] piotr7543:
It is possible to flash TA.img from other model of XZ because i lost my TA backup :( can someone help me i try to restore that from my HDD but without success :(
[Sony Cross-Device General] M1chiel:
No you cannot use another TA backup. You need to provide more info if you want us to help you out.
[Sony Cross-Device General] Simplyeh:
i can't backup ta on sony xa fs3111 , all adb drivers are ok running android 6 i get this error always no matter how much i try.

Any solutions? running win 10 x64 enterprise and home still the same error on both comps

*******************************************************************************************************************************************

Picking 64-bit version

Running on F3111 on 64-bit platform

Pushing files

Pushing files/dirtycow64 to /data/local/tmp/dirtycow

2432 KB/s (9984 bytes in 0.004s)

Pushing files/run-as64 to /data/local/tmp/run-as

1983 KB/s (6088 bytes in 0.002s)

Pushing files/exploitta64 to /data/local/tmp/exploitta

2786 KB/s (14280 bytes in 0.005s)

Pushing files/dumpta64 to /data/local/tmp/dumpta

2485 KB/s (10184 bytes in 0.004s)

Pushing files/checkta64 to /data/local/tmp/checkta

2044 KB/s (10184 bytes in 0.004s)

pushing push files/backupTA.sh /data/local/tmp/backupTA.sh

407 KB/s (1094 bytes in 0.002s)

Running scripts to dump ta to "TA_F3111_RQ3002NZ07_Thu0201-201815.img" on device

Overwriting run-as

Attempting to dirtycow

Done dirtycowing

Overwriting secondary payload (screenrecord)

Attempting to dirtycow

dirtycow failed

Attempting to dirtycow

dirtycow failed

Error during dirtycow, please reboot and try again.

Pulling image

remote object '/data/local/tmp/TA_F3111_RQ3002NZ07_Thu0201-201815.img' does not exist

Cleaning up

TA Backup Failed!! Please reboot and try again.

NOTE: If you are running Android Nougat, you need to downgrade to use this tool.

Press any key to continue . . .
[Sony Cross-Device General] Garrsett:
Is this tool still on project for Nougat? I want to root my XZs but this tool can't work with Nougat. And XZs doesn't have ftf with Marshmallow build. Phew.
[Sony Cross-Device General] M1chiel:
No, the dirty cow vulnerability was repaired in the Nougat builds.
[Sony Cross-Device General] Garrsett:
So basically we can't backup TA Partition for XZs because that? OMG unlucky.
[Sony Cross-Device General] M1chiel:
Correct, at least not with this method.
[Sony Cross-Device General] nailyk:
m4 aqua (tulip/E2303) backup

Hi.

Am attempting to backup a tulip (m4 aqua) with your tool (the only one available for Linux. Many thanks!!!) but it fail each time.

I tried the stock bloated by Orange rom

26.3.A.1.33

Tried another one:

26.1.A.3.111 (still Orange bloated)

and finally downgrade to

26.1.A.2.99 despite my flashtool biterness, but still got dirtycow failed.

What am I supposed to do to get the dirty cow exploit ?

(kernel is jul. 5 2015 dated, no way it get patched, right ? )

Thanks in advance, Id really like to start dev on it.
[Sony Cross-Device General] shoey63:
You can use iovyroot exploit.

https://xdaforums.com/showthread.php?t=3349597

iovyroot - (temp) root tool
[Sony Cross-Device General] nailyk:
Hi [MENTION=4675598]shoey63[/MENTION] Long time didn't see you on xda ;)

Thanks for the tip!

Finally get it working with some random ftf files (Had to flash 1.128 to get some exploited flaws), then had to flash 2.99 to get bootloader unlock option in settings.
[Sony Cross-Device General] orjanraberg:
Bricked phone

I have managed to brick my Xperia X Performance when restoring the TA partition. My phone has been repaired and got a new motherboard and I restored the TA partition from the old motherboard. Stupid mistake I know but what's done is done. I wonder if there is any way to unbrick the phone now?

The phone is not completely dead. It appears to be possible to connect the phone in Flashmode to the computer. The green LED lights up and the phone is recognized as "SOMC Flash Device" by my computer when connected with USB. But adb doesn't recognize the phone and fastboot will not work either.

I have the correct TA partition backup file as an .img file. I have seen that there are some options in Flashtool to flash TA files but none seems applicable.
[Sony Cross-Device General] M1chiel:
I did the same thing and sent the phone to an official repair center. They replaced the mother board...
[Sony Cross-Device General] orjanraberg:
Sorry to hear that. Did they charge you a lot?
[Sony Cross-Device General] M1chiel:
I was lucky; it was repaired under warranty :D
[Sony Cross-Device General] nailyk:
SOMC flash device is a (emergency loader) allowing you to flash raw emmc. This is *heavily* risky and you should not try without being absolutely 200% sure of what you are doing.

If you can reach another mode, try to unlock bootloader. I already mixed up TA partition of device, but all unlocked, not much problem so far.

Good luck!
[Sony Cross-Device General] orjanraberg:
Ok but what can I do? I cannot get adb or fastboot to recognize the phone. The bootloader was unlocked before I flashed the wrong TA. Do you say that you have managed to salvage a bricked phone where the TA partition was damaged? How?
[Sony Cross-Device General] nailyk:
If the wrong flashed TA was BL locked, you have a brick. Until someone publish a tool to reflash the whole emmc through qdloader.

I need some experimental device to work on this BTW :angel:
[Sony Cross-Device General] orjanraberg:
The bootloader was unlocked when I flashed the TA image, but the TA image itself was backed up when the phone had the bootloader locked. Is the bootloader locked status part of the TA? Then my phone is bricked.

I got the phone repaired recently and don't want to try to get it repaired under warranty because the fault was entirely my own. I don't want to spend too much money repairing it either since I don't like Xperia X Performance that much. So if you think you could have use for the phone to develop a tool to reflash the whole emmc I could possibly send it to you.
[Sony Cross-Device General] nailyk:
if it is under warranty you should try to send it. They will probably replace it.

Anyway probably off-topic, if you need something else, feel free to send a PM.
[Sony Cross-Device General] orjanraberg:
I sent it in eventually and got it back with a new mainboard two days later. :)

I will be much more careful next time I try to restore the TA partition on a phone. :)
[Sony Cross-Device General] treoking:
¿Can I backup the TA partition in Oreo or I need downgrade the phone to Android MM?
[Sony Cross-Device General] mbc07:
DirtyCow supports Xperia XZ on its Marshmallow firmware from launch. Xperia XZs is essentially the same phone, except for the new Motion Eye camera and the extra gigabyte of RAM, but it launched with Nougat. Has anyone tried flashing Marshmallow firmware from XZ on XZs to backup the TA partition?
[Sony Cross-Device General] bromoxitos:
permission denied

after i give the 2on command it says permition denied it is normal or i must od something else!!:confused::confused:
[Sony Cross-Device General] shoey63:
If you do it in TWRP, there should be no "permission denied"
[Sony Cross-Device General] munjeni:
If you restored wrong TA backup you can't do anything with your phone mean software way, apsolutly! Only a solution is to connect phone hardware way e.g. using z3x easy jtag hardware + emmc adapter https://gsmserver.com/item/cables-and-adapters/emmc-z3x-jtag-pro-3-in-1-adapter/ to get direct connection to your emmc ic, no other way. But if you have no ta backup from your current motherboard than nothing can help you to unbrick phone. If you planning to get z3x do in mind you will need emmc pinout, search google to see if you see any pinout picture for your model, if not don't waste your money and nervs simple buy new motherboard and be very carefull next time, hope this help. :)

Edit:

Whats going on when you disconnect battery and put your phone in flash mode, what you see in device mannager? Just asking because maybe device without battery is in development mode and no need sake authentification in flash mode!? I'm unsure for this, right way for somebody try this :)
[Sony Cross-Device General] bromoxitos:
nothing happen! again! so i stuck here now!

at last it works!!!

both commands pass!! you have right it wolks in twrp recovery!!
[Sony Cross-Device General] RURon:
I have a problem getting the TA backup done. Hopfully someone can help!

I have flashed E5823_32.0.A.6.200 to my Xperia Z5 compact and the basic connection looks okay.

Here is what I get on my Windows10 machine when I run the script:

Picking 64-bit version
Running on E5823 on 64-bit platform
Pushing files
Pushing files/dirtycow64 to /data/local/tmp/dirtycow
845 KB/s (9984 bytes in 0.011s)
Pushing files/run-as64 to /data/local/tmp/run-as
259 KB/s (6088 bytes in 0.022s)
Pushing files/exploitta64 to /data/local/tmp/exploitta
1198 KB/s (14280 bytes in 0.011s)
Pushing files/dumpta64 to /data/local/tmp/dumpta
848 KB/s (10184 bytes in 0.011s)
Pushing files/checkta64 to /data/local/tmp/checkta
9 KB/s (10184 bytes in 1.000s)
pushing push files/backupTA.sh /data/local/tmp/backupTA.sh
1 KB/s (1094 bytes in 1.000s)
Running scripts to dump ta to "TA_E5823_CB5A29LHYU_26062018-1156.img" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
WARNING: linker: /system/bin/run-as: unused DT entry: type 0x6ffffef5 arg 0x288
WARNING: linker: /system/bin/run-as: unused DT entry: type 0x6ffffffe arg 0x6c0
WARNING: linker: /system/bin/run-as: unused DT entry: type 0x6fffffff arg 0x1
CANNOT LINK EXECUTABLE: empty/missing DT_HASH in "/system/bin/run-as" (built with --hash-style=gnu?)
Dumped TA as TA_E5823_CB5A29LHYU_26062018-1156.img
WARNING: linker: /data/local/tmp/checkta: unused DT entry: type 0x6ffffef5 arg 0x288
WARNING: linker: /data/local/tmp/checkta: unused DT entry: type 0x6ffffffe arg 0x760
WARNING: linker: /data/local/tmp/checkta: unused DT entry: type 0x6fffffff arg 0x1
CANNOT LINK EXECUTABLE: empty/missing DT_HASH in "/data/local/tmp/checkta" (built with --hash-style=gnu?)
Pulling image
Cleaning up
TA Successfully pulled to TA_E5823_CB5A29LHYU_26062018-1156.img

The resulting file has 0 bytes.

Any idea?

Thank you! :)
[Sony Cross-Device General] munjeni:
CANNOT LINK EXECUTABLE says that one of the binary is not working on your device which mean you can't use this tool for your phone curently.
[Sony Cross-Device General] mirhl:
Are you sure about no TA backup == perma-brick?

I seem to remember some good old discussion, about bootloader unlock, saying that "technically it could always be achieved everywhere" as long as you were willing to loose GSM functionality (since IMEI was used to hash or something the unlock key or whatever)

Am I rambling?
[Sony Cross-Device General] munjeni:
I mean in case hi didn't made any ta backup from his phone BEFRE RESTORING ta file which is from totaly diferent phone, in that case his phone is a no way for repair apsolutly because he overwrote 3 signed units which is esential for low low level bootchain boot! Low level bootchain can't boot in that case and there is no tools (mean software tools) which can regenerate broken trim area partition, whatever you try you get error code. Only you can do it by using some hardware tools like easy jtag or something similar. Without trim area backup you can't repair even if you have hardware tool. Also there is no tool out here which can generate new ta file (there is one I have made but that tool can't make new ta.img file if you don't have .ta backup made by that tool). Trim area is unique per device and you can't use it from diferent phone. You can brick some trim area partitions and use s1tool to repair but if you mess trim area partition in which partition lives 3 signed units, permabrick happen! You can mess trim area a bit thats nothing a new (but only in case you have updated adler32 hash of the trim area partitions) but some units is signed and hash protected and you can't touch it because perma brick happen! Yes, no ta backup mean = if you mess trim area

and you not have trim area backup, chance for repair that perma bricked phone is null, you must buy new motherboard (as I done one time after I bricked my trim area partition, later I have bought easy jtag but it was too late since I have broke emmc chip during researching for pinout - broke pinout bals)
[Sony Cross-Device General] Samir2298:
Hey guys I have a backup of TA that I created 1 and a half year ago. But I dont remember which tool I used to make the backup because there are many available here on xda. Also I dont really remember the backup that I created was before unlocking the bootloader or after the unlock. But 99% chances are that the backup was before unlocking bootloader. I am not so tech savvy and dont have much idea about checksum thing. So basically I did not take note of anything like checksum. Is there anyway to know whether the backup was created before unlocking bootloader or after the unlock? Would that backup still work on my xperia z2? Are there any chances of permanent brick?
[Sony Cross-Device General] munjeni:
Use this tool -> https://xdaforums.com/crossdevice-dev/sony/dangerous-tool-trim-tool-t3516007 , tool will tell you if your dump is locked or unlocked. If tool show you drm key than its definitelly dump from locked device, if you not see drm key its definitelly from unlocked bootloader :)
[Sony Cross-Device General] N'ayam Amarsh'e:
PLEASE HELP ME!

Getting this error in Xperia XA Dual F3116. The OP said that it supports the device but I don't think it does...

Picking 64-bit version
Running on F3116 on 64-bit platform
Pushing files
Pushing files/dirtycow64 to /data/local/tmp/dirtycow
1950 KB/s (9984 bytes in 0.005s)
Pushing files/run-as64 to /data/local/tmp/run-as
2972 KB/s (6088 bytes in 0.002s)
Pushing files/exploitta64 to /data/local/tmp/exploitta
3487 KB/s (14280 bytes in 0.003s)
Pushing files/dumpta64 to /data/local/tmp/dumpta
3315 KB/s (10184 bytes in 0.003s)
Pushing files/checkta64 to /data/local/tmp/checkta
2486 KB/s (10184 bytes in 0.004s)
pushing push files/backupTA.sh /data/local/tmp/backupTA.sh
534 KB/s (1094 bytes in 0.002s)
Running scripts to dump ta to "TA_F3116_RQ3000XX1C_Sat0818-201815.img" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
dirtycow failed
Attempting to dirtycow
dirtycow failed
Error during dirtycow, please reboot and try again.
Pulling image
remote object '/data/local/tmp/TA_F3116_RQ3000XX1C_Sat0818-201815.img' does not exist
Cleaning up
TA Backup Failed!! Please reboot and try again.
NOTE: If you are running Android Nougat, you need to downgrade to use this tool.
Press any key to continue . . .
[Sony Cross-Device General] maXDAmn:
dirty cow only present on mm and lower.
[Sony Cross-Device General] N'ayam Amarsh'e:
I was on Marshmallow 6.0. Anyways, I unlocked the bootloader so no chances to go back now.
[Sony Cross-Device General] Yoid:
Please help me

XZ Docomo or SO-01J (MM patch 1 december 2016) UBL:YES error in backup ta "Error during dirtycow,please reboot and try again". I reboot several time but still error

Please help me sir i want unlock bootloader for root my device
[Sony Cross-Device General] RomanSkyline:
Dont do it, I tried too many roms and finally I am on the official stock because is the best and most optimezed rom, best battery and screen hours and the camera best choice compatibility with the rom

Enviado desde mi F8331 mediante Tapatalk
[Sony Cross-Device General] local__hero:
Which firmware are you running? Are you on Android 7 Nougat or Android Oreo?
[Sony Cross-Device General] xisque:
Nice tool!!

Thank you very much!

Z3 Compact on MM 291

D:\backupTA_v2>backupTA.cmd
Running on D5833 on 32-bit platform
Pushing files
Pushing files/dirtycow32 to /data/local/tmp/dirtycow
426 KB/s (13644 bytes in 0.031s)
Pushing files/run-as32 to /data/local/tmp/run-as
5 KB/s (5364 bytes in 1.000s)
Pushing files/exploitta32 to /data/local/tmp/exploitta
589 KB/s (9512 bytes in 0.015s)
Pushing files/dumpta32 to /data/local/tmp/dumpta
1627 KB/s (5416 bytes in 0.003s)
Pushing files/checkta32 to /data/local/tmp/checkta
334 KB/s (5364 bytes in 0.015s)
pushing push files/backupTA.sh /data/local/tmp/backupTA.sh
1 KB/s (1094 bytes in 1.000s)
Running scripts to dump ta to "TA_D5833_BY900FCF77_18112018-1033.img" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Reading dumpta from stdin...
Read dumpta from stdin at 5416 bytes
Attempting exploit with buf of length 5416
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Bad reply received, failing...
Attempting exploit with buf of length 5416
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Got a total of 2097152 bytes
Exploit successful!
Dumped TA as TA_D5833_BY900FCF77_18112018-1033.img
adler32:0x6B942131 calc_adler32:0x6B942131
adler32:0xF91EE34A calc_adler32:0xF91EE34A
adler32:0x7762AB37 calc_adler32:0x7762AB37
adler32:0x434695ED calc_adler32:0x434695ED
adler32:0x716B3D4F calc_adler32:0x716B3D4F
Trim area dump is valid.
Pulling image
4516 KB/s (2097152 bytes in 0.453s)
Cleaning up
TA Successfully pulled to TA_D5833_BY900FCF77_18112018-1033.img
[Sony Cross-Device General] koekoek91:
Hi guys,

I need to restore my TA backup (I have it) for warranty purposes because my charge port seems to be broken.

I have restored TA backup before but it was months ago and now I dont remember how I did it.

Can anyone guide me?

Thanks.
[Sony Cross-Device General] M1chiel:
Look at p3 of this thread for shoey63’s post.
[Sony Cross-Device General] koekoek91:
Thank you for the response.

I did see his post and I am trying to do his procedure but it is failing.

I flashed back to stock ROM to see if issue would fix itself but sadly no, and then I flashed TWRP.

Then when booted into TWRP I tried the following command: adb shell dd if=/data/local/tmp/TAbackup.img of=/dev/block/bootdevice/by-name/TA

See attached print screen.

I have the TA backup file saved in my adb directory as can also be seen in my print screen.

Just look at the part marked inside the blue line. The rest above it is just me trying to get connected to fastboot but its really a hassle with a broken cable and chargeport lol.

I think you can ignore the part that is above the area that is marked with blue.

[MENTION=4675598]shoey63[/MENTION] or anyone else have any idea what else I can try?
[Sony Cross-Device General] koekoek91:
deleted (double post).
[Sony Cross-Device General] shoey63:
You need push the backup to /data/local/tmp first.

So:-

adb push TAbackup /data/local/tmp/TAbackup. img

Then run the dd command.
[Sony Cross-Device General] koekoek91:
Thanks for the quick reply!

One more question... is it necessary to flash another stock firmware after running the dd command?
[Sony Cross-Device General] shoey63:
Yes. Any stock firmware for your device. Can be different to the one used for the backup too.
[Sony Cross-Device General] koekoek91:
Thanks for the info.

I have done a second attempt but im still failing.

Please see the attached printscreen.

- Booted my phone into TWRP.

adb devices shows my device but its not visible on my PC. though.

-Then attempted the command to push TAbackup: adb push TAbackup /data/local/tmp/TAbackup.img

Getting adb: error: cannot stat 'TAbackup' : No such file or directory.

-So then I decided to try a slightly different command to see what would happen: adb push TAbackup.img /data/local/tmp

Then it shows: [100%] /data/local/tmp

So that made me think maybe that worked to push the TAbackup.img

-So then I went on with the dd command: adb shell dd if=/data/local/tmp/TAbackup.img of=/dev/block/bootdevice/by-name/TA

At this point im getting: dd: can't open '/data./local//tmp/TAbackup.img' : Not a directory

What am I missing here? :silly:
[Sony Cross-Device General] shoey63:
adb push TAbackup.img /data/local/tmp

is wrong. It should be

adb push TAbackup.img /data/local/tmp/TAbackup.img
[Sony Cross-Device General] koekoek91:
[MENTION=4675598]shoey63[/MENTION]

After doing some more reading I found the problem myself.

I literally took over the adb push command you gave me in your previous post: adb push TAbackup /data/local/tmp/TAbackup. img

But it needed to be: adb push TAbackup.img /data/local/tmp/TAbackup. img :silly:

But now I have a new problem.

After restoring TA I flashed the latest firmware for my device but now after powering on my phone its saying:

To start Android, enter your password:confused:
[Sony Cross-Device General] koekoek91:
Was literally writing my new post when you replied to me lol :laugh:

You have any idea about the new issue im having about the password?
[Sony Cross-Device General] shoey63:
Yeah, I forgot about windows hiding extensions.

It's booting, that's the main thing. You need to factory reset (expected after unlock or relock).

Enter bogus passwords until it forces a reset. 20+ times from memory ?
[Sony Cross-Device General] koekoek91:
I almost thought I had bricked my phone but after putting in 30 passwords it made the factory reset lol.

The only thing I am very displeased with is that it also erased the content on my external sd card :crying::crying:

Anyway thanks for your guidance and happy holidays ;)
[Sony Cross-Device General] koekoek91:
Here I am back again.

So after receiving a different cable that I ordered it turned out it was only just my old cable that was broken so I did all the relocking and restoring my TA and losing my SD card data for nothing. My phone charges fine with the new cable.

But now I am trying to re-unlock and root again but I am failing.

I used to be rooted for months before and then a few days back I restored my TA and relocked my bootloader.

Now after finding out it was just my cable being broken I enabled oem unlocking and usb debugging and then started flashtool and pressed the BLU button to unlock my bootloader again. The code was already filled in automatically I think because of previous unlock so I continued.

Now I have been trying to flash a different firmware for an hour but it keeps being stuck on flashing data as can be seen in the printscreen.

Normally flashing a new firmware only takes a few minutes. so after waiting for an hour I have just unplugged my phone once and tried a different firmware but with the same result.

After another hour of waiting I unplugged again and tried to start my phone but I am presented with the black screen and message: The software update failed. Make sure your phone is connected and try again.

I've tried multiple times a couple hours ago and now im trying again but no luck.

No way to get into my phone now, but I can still get into flashmode and fastboot but flashing takes ages and I don't think its ever going to complete. Is that normal after re-unlocking?

Im thinking i've probably bricked it.. unless you have any ideas?
[Sony Cross-Device General] shoey63:
No it's not normal. The TA partition has nothing to do with phone charging or FlashTool errors.

Looks like a connection problem still, but I don't use FlashTool any more so I can't really help.
[Sony Cross-Device General] koekoek91:
Well I guess I will have to send in my phone for repair after all then.

Wish I would have been more patiënt and waited doing anything until I received the new cable.

None of this would have happend lol.

Lesson learned :silly:
[Sony Cross-Device General] shoey63:
Why not ask for help in your device forum? Somebody there may have had similar issues.

It could be something simple.
[Sony Cross-Device General] koekoek91:
Thanks but I already sent it in.

Dont think it was something simple.
[Sony Cross-Device General] paijoe88:
can this be used on Xperia Xzs?

or there are other ways to backup TA on xzs?

Thanks for attention