yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] mbc07:
Apart from the camera and the extra gigabyte of RAM, Xperia XZ and XZs are exacly the same. The exploit works with initial Marshmallow firmware that launched with XZ, but XZs launched with Nougat instead. What you can do is flashing Marshmallow from XZ on your XZs, doing the backup, then flashing back the original XZs firmware...
[Sony Cross-Device General] RintSo:
error backup

got error message

Sorry trim area dump is corupted and not a safe, please try again!

xperia x, 6.0.1

any solutions?
[Sony Cross-Device General] josephnero:
[MENTION=4675598]shoey63[/MENTION]

I backed up and unlocked my bootloader a while ago the relocked it using drm keys. After a bit I unlocked the bootloader again this time without backing up the drm keys. Now I want to relock the bootloader is it safe to use my first TA-back up? Would I risk a brick?
[Sony Cross-Device General] shoey63:
If it worked before, it will work again. Don't forget to flash a stock firmware afterwards.
[Sony Cross-Device General] josephnero:
Thanks a ton
[Sony Cross-Device General] john97:
gets down to last step and then..TA Backup Failed!!

Hi,

I have a locked X compact F5321 running 6.0.1 with USB debugging enabled.

I have Minimal ADB and Fastboot + X compact drivers installed on W7-64.

I can connect and see the device with "adb devices".

I run the TABackup.cmd many times, I have lost count how many but I think > 25 times, usually with rebooting inbetween.

It fails at various points, but sometimes it seems to get right to the end.

It has the file of the correct size, 2097152 bytes

Exploit successful!

Dumped TA as TA_5321_BH901P8M5P_2019-02-182316-1232.img

Trim area dump is valid.

Pulling image

3690 KB/s (2097152 bytes in 0.555 sec)

Cleaning up

but then: TA Backup Failed!! Please reboot and try again.

I wondered if something was blocking the transfer of the files to the PC. I saw that i had not noticed that adb.exe which is in the subdirectory "windows" was not allowed through my firewall, so I allowed it to pass.

That didn't do it so I turned off the firewall while running TABackup.cmd. That did not change anything either.

The instructions say to run it several times. So just how many times do I have to run this thing? 50? 100?

What are the reasons that it might fail at the very end?

Thanks in advance
[Sony Cross-Device General] john97:
never mind -- I was in a read only directory so the dump could not be written -- problem solved
[Sony Cross-Device General] surfzoid:
Hi, you say " Overwrite run-as binary with a custom binary", when operation is done, original binary is restored?

If am i understand, this tool make an tempory root acces, can i modify the script to backup all my phone partitions with "dd" ?

Thank by advance.
[Sony Cross-Device General] surfzoid:
another question :D , okay for backup, but how to restore?
[Sony Cross-Device General] rafik23:
help

hi

I have unlocked the boot loader and i backup the TA 1 and 2 with flashtool version 0.9.22 it isn't binary but txt format,when i want to restore the TA , the key are not provisioned , i have used this tool now , and i want to compare with another TA.IMG if possible

send me your ta img for trying reconstructing mine plz

for XZ dual on MM 6.01

Thanx
[Sony Cross-Device General] surfzoid:
Backup ta is before unlock after Wath it is definitly loose
[Sony Cross-Device General] rafik23:
TA Image

hi Guys ,

at what adress are situated DRM KEY ?

Thanks
[Sony Cross-Device General] 64801965:
And how to restore TA?
[Sony Cross-Device General] casouzaj:
The whereabouts of your TA partition may be referenced in different ways. I'll give you 2 examples: in my Sony Z3 Compact it is referenced at /dev/block/platform/msm_sdcc.1/by-name, for what the command line to have its TA backup restored would be:

dd if=TA_backup.img of=/dev/block/platform/msm_sdcc.1/by-name/TA

On the other hand, in my Sony Z5 Compact, it is found at /dev/block/platform/soc.0/f9824900.sdhci/by-name. So the command line would be:

dd if=TA_backup.img of=/dev/block/platform/soc.0/f9824900.sdhci/by-name/TA

Bear in mind that after applying the dd command don't boot your phone up without a stock boot image already flashed to it, because that command will, automatically, relock the phone's bootliader. And, most importantly, only restore the TA partition to the very same phone the TA backup was taken from. Restoring it to another phone, or the TA backup file from another phone into yours, will turn the phone into a brick. There would be no way to bring it back to life by software means.
[Sony Cross-Device General] 64801965:
Thank you advanced. And this method applies for XZ Premium?
[Sony Cross-Device General] casouzaj:
I don't have one, to be 100% sure, but I think it would work for all smartphone models manufactured by Sony.
[Sony Cross-Device General] maverick6664:
Then, how about xz2? I did this two days ago...
[Sony Cross-Device General] casouzaj:
Again, if you have a backup out of the TA partition of that Sony smartphone, it should work, but do you have it? As far as I remember, the PC tool which makes such backup only works with Marshmallow, and I think the XZ2 was launched with Oreo.
[Sony Cross-Device General] maverick6664:
hmmmm.....sorry it's my mistake. The phone I tried was Xperia Z3 Compact. Not XZ2.

I don't know it's a backup out of the TA partition or not. All I can say is I just have run backupTA.sh on Fedora 30 and got 2097152 byte-long TA_D5803_YT9119D5EF_20190817-1348.img w/o any error. It actually runs marshmallow, so it should be in the list, I guess.

Sorry for my mistake, please add z3c to that list..

best regards,
[Sony Cross-Device General] casouzaj:
Yes, it is, and it will definitely work, provided that your Z3C ID is YT9119D5EF.. Prior to have that backup copied to the TA partition (through the dd command), make sure you have a stock ROM flashed.
[Sony Cross-Device General] maverick6664:
Yes, I'm sure, because I flashed the stock rom and rooted.
[Sony Cross-Device General] randisaaputra:
Hey, can you help me

So I try to backup my ta, my phone is Xperia xz so-01j with mm 39.0.b.1.19, but every time I've tried to backup always fail with with message that says that trim area is corrupted

I also tried with another version of ta backup but the file size is only 0B
[Sony Cross-Device General] rakionowner:
Xperia XZ F8332 MM 6.0

I get this, with UNLOCKED BL/NO ROOT/USB DEBUG ON. Solution? is this bc my drivers has problem? :rolleyes:
[Sony Cross-Device General] RogerR2:
Error during dirtycow on Xperia Z3

I ran backupTA.cmd on a D6603 running Android 4.4.4, with the result below. Any ideas of what I am doing wrong? Thanks!

Running on D6603 on 32-bit platform

Pushing files

Pushing files/dirtycow32 to /data/local/tmp/dirtycow

2792 KB/s (13644 bytes in 0.004s)

Pushing files/run-as32 to /data/local/tmp/run-as

2145 KB/s (5364 bytes in 0.002s)

Pushing files/exploitta32 to /data/local/tmp/exploitta

3482 KB/s (9512 bytes in 0.002s)

Pushing files/dumpta32 to /data/local/tmp/dumpta

2014 KB/s (5416 bytes in 0.002s)

Pushing files/checkta32 to /data/local/tmp/checkta

554 KB/s (5364 bytes in 0.009s)

pushing push files/backupTA.sh /data/local/tmp/backupTA.sh

442 KB/s (1094 bytes in 0.002s)

Running scripts to dump ta to "TA_D6603_BH90PL0X1L_12062020-2107.img" on device

Overwriting run-as

CANNOT LINK EXECUTABLE: cannot locate symbol "getpagesize" referenced by "/data/local/tmp/dirtycow"...

CANNOT LINK EXECUTABLE: cannot locate symbol "getpagesize" referenced by "/data/local/tmp/dirtycow"...

Error during dirtycow, please reboot and try again.

Pulling image

remote object '/data/local/tmp/TA_D6603_BH90PL0X1L_12062020-2107.img' does not exist

Cleaning up

TA Backup Failed!! Please reboot and try again.

NOTE: If you are running Android Nougat, you need to downgrade to use this tool.

Press any key to continue . . .
[Sony Cross-Device General] casouzaj:
U

I guess this tool works with a stock Marshmallow ROM only. For what I remember, the Z3 and Z3C phones loaded with a Marshmallow stock ROM are able to be booted up with their corresponding Lollipop kernels.
[Sony Cross-Device General] Raskaipika:
Hi mates:

At this moment, I want to install LineageOS 16.0 (Pie) at my cousin's SONY XPERIA X F5121 (Single SIM), his smartphone has Android 8 OREO installed, and of couse, before to proceed, I want to make a backup of the TA partition, I've been able to obtain the next:

* Firmware F5121 34.0.A.292.Customized+DE.ftf (It's a version from Germany, but We're from Spain).

* USB drivers working on PC (ADB and Fastboot modes working on).

* flashtool-0.9.28.0-windows.exe (lastest version).

But before to do the downgrade to make the backup, I've a few questions:

1. Can I downgrade from lastest 8.0 to the 6.0.1 version posted above without problems??, or do I have to downgrade first to 7.0 / 7.1.1 and then, downgrade to 6.0.1?

2. When I will make the TA backup in 6.0.1, how can I update to 8.0?? (Sony Companion or other tool)

Thanks for your time and help guys, keep up the hard work.

Regards.
[Sony Cross-Device General] M1chiel:
You can downgrade to 6 in one jump. You can always use Odin for updating. Sony companion or OTAs may not work with an unlocked bootloader (I do not own this device anymore, so I'm not sure).
[Sony Cross-Device General] Raskaipika:
I've downgrade succesfully to 6.0.1 Marshmallow, but using the software XPERIA Flashtool, at the Wipe section, from the six available options, I didn't select the options "Persist and NOOQ (or something like that)", could be a problem with calls, Wi-Fi, LTE (4G) and other related things because of didn't have select the Persist Wipe and the other option??

One more thing, I downgraded with a Germany customized stock rom, because I didn't found a sapnish customized version, could be a problem??

Thank you so much guys.

P.S.: TA backup released succesfully.
[Sony Cross-Device General] M1chiel:
The German version should be ok. You can now update to the most recent version (it does not matter which region) in the same way you downgraded, unlock your bootloader, flash TWRP and install LineageOS.
[Sony Cross-Device General] Raskaipika:
Thanks mate, I asked about the German version used to downgrade, mainly, about the normal use of the smartphone (calls, sms and similars) because of I don't know if in my country we use different frequencies for 2G / 3G /4G from the frequencies used in Germany, because after the downgrade, the coverage is worse than with the original stock rom.

Regards.
[Sony Cross-Device General] M1chiel:
I don't know and it is off-topic for this thread anyway; I'd suggest to ask this question in the forum of your device.
[Sony Cross-Device General] biqguy:
Donwload link has broken.

404 not found
[Sony Cross-Device General] penguin Lin:
I found a mirror in sony xperia xz thread. It worked on my z3 (android 6.0.1).

https://xdaforums.com/t/backup-ta.3759477/
[Sony Cross-Device General] Andro1dism:
Nice, just what I was looking for.

Download there still works.

Thanks!
[Sony Cross-Device General] dautheluu:
new link update for download this???
[Sony Cross-Device General] Ran-dom:
Hey, sadly the download link is dead ( 404 error ). Is there a mirror for this? Thanks
[Sony Cross-Device General] steve8x8:
If you don't want to follow the link cited in #518, https://androidfilehost.com/?fid=10763459528675600319 should do?
[Sony Cross-Device General] Tux111:
Doesnt seems to work. Tried on Z3, restored and wrote the file, but reactivated nothing.
[Sony Cross-Device General] shoey63:
Bootloader never unlocked before the procedure? If it has been it won't work.

Anyway, can't really help with troubleshooting. I've moved on to other devices long ago.
[Sony Cross-Device General] Tux111:
It has worked in the past, but i guess i miss some steps. It restores, it blocks bootloader but TA functions doesnt restore. Weird.
[Sony Cross-Device General] Tux111:
Also, how im supposed to have unotuched boot/recovery partitions if i have to use twrp to restore TA (thus, "corrupting" recovery?)
[Sony Cross-Device General] project_2501:
The trick shoey and I used was to clean flash a stock build with the bootloader unlocked and then immediately boot into recovery at which point you dd the original TA.img back that you extracted before unlocking the loader. Behind all this are the loader.sin configs provided with older builds that were excluded later on when Sony discovered the vulnerabilities were able to circumvent the wipe of the original TA. My only thought is try flashing the original Oreo build and look to see if there is a loader.sin + configs included with the build. Essentially the loader is written back into a locked state and without the loader partition and it's configurations you can't. I did it with an XZs like shoey did with an X; the difference with mine was I had to apply the official stock build again after placing the original TA back so that it was detected to rewrite the loader.
[Sony Cross-Device General] karrouma:
if i re-lock my bootloader

flashing stock firmware

can i backup my TApartition

or it is gone forever

---------- Post added at 05:11 PM ---------- Previous post was at 05:10 PM ----------

can anyone who have xperia xz dual share us his TA
[Sony Cross-Device General] Myself5:
It's gone.

The DRM Keys are device specific. As I wrote above, there is other data on the TA Partition too, flashing someone elses TA, will result into a lovely new paperweight that previously was your phone.
[Sony Cross-Device General] KWOKSFUNG:
This is awesome, and I hope someone could make a noob guide for me in how to backup and restore TA :)
[Sony Cross-Device General] gregbradley:
No, never restore some one elses ta partition, it will permantly hard brick your device
[Sony Cross-Device General] gregbradley:
I will have a look at this, thanks.
[Sony Cross-Device General] rayman:
I'll need a full log from the run to really take any guesses on this...

So it's a Z5 or? It's confusing to write XZ5 when there's actually both a Z5 phone and an XZ phone ;)
[Sony Cross-Device General] rayman:
Reboot and try again - sometimes it can fail because of the way dirtycow works and a reboot sometimes fixes it.

What exact ROM version?

This was developed on an XZ (not dual), so it _should_ work, but I'm not 100% sure of the differences between the two.
[Sony Cross-Device General] karrouma:
no working

maybe cz of unlocked bootloader

now i got

Picking 64-bit version

Running on F8332 on 64-bit platform

Pushing files

975 KB/s (9984 bytes in 0.010s)

594 KB/s (6088 bytes in 0.010s)

697 KB/s (14280 bytes in 0.020s)

497 KB/s (10184 bytes in 0.020s)

0 KB/s (876 bytes in 1.000s)

Running scripts to dump ta to "TAIMG" on device

Overwriting run-as

Attempting to dirtycow

Pulling image

* daemon not running. starting it now on port 5037 *

* daemon started successfully *

remote object '/data/local/tmp/TA_F8332_CB512BFRGR_Wed1207-201618.img' does not

exist

Cleaning up

TA Sucessfully pulled to TA_F8332_CB512BFRGR_Wed1207-201618.img

****NOTE: Please verify filesize is 2MB ****

Press any key to continue . . .
[Sony Cross-Device General] Aaskereija:
yes.

in relation to the other one, but u gave me already a reasonable answer, so i think i get it :)
[Sony Cross-Device General] rayman:
Looks like something is killing your adb mid-process? (on your PC)

Make sure you don't have android studio, eclipse, flashtool or similar running while you do this process...

(There's nothing preventing it from running on an unlocked device. It just won't get a full backup with DRM keys etc)
[Sony Cross-Device General] shehabskull:
It is Xperia Z5 ^^.. Excuse me but how to take a log?
[Sony Cross-Device General] rayman:
Copy paste everything it writes in the commandline window :)

or if that's an issue, take a screenshot ;)

Can you provide exact model number of software version (from about phone) as well?
[Sony Cross-Device General] DannyWilde:
X compact running 34.1.A.3.49 :

Picking 64-bit version
Running on F5321 on 64-bit platform
Pushing files
312 KB/s (9984 bytes in 0.031s)
381 KB/s (6088 bytes in 0.015s)
13 KB/s (14280 bytes in 1.000s)
637 KB/s (10184 bytes in 0.015s)
0 KB/s (876 bytes in 1.000s)
chmod: chmod '/data/local/tmp/flatland' to 100755: Operation not permitted
chmod: chmod '/data/local/tmp/flatland64' to 100755: Operation not permitted
Running scripts to dump ta to "TAIMG" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Attempting exploit
Attempting to dirtycow
dirtycow failed
Waiting for result....
Bad reply received, failing...
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
dirtycow failed
Waiting for result....
Got a total of 2097152 bytes
Exploit successful!
Dumped TA as TA_F5321_QV7028NP0B_07122016-1727.img
Pulling image
4376 KB/s (2097152 bytes in 0.468s)
Cleaning up
TA Sucessfully pulled to TA_F5321_QV7028NP0B_07122016-1727.img
****NOTE: Please verify filesize is 2MB ****
[Sony Cross-Device General] nikanorov:
Thank you so much! Works fine on Xperia X and OS X.
[Sony Cross-Device General] Kzawww:
Xperia X doesn't has working recovery yet.

How can I restore my Ta?

Can I use BackupTA's convert v4 backup tool or Iovy root's TArestore bat?
[Sony Cross-Device General] karrouma:
Okeyy

I will try tomorrow on my desktop
[Sony Cross-Device General] Sonic Dash:
Came back to give this a go but there is no download.. was it removed?

EDIT: My bad.. found it, was looking at the main post.
[Sony Cross-Device General] BITS74:
Thanks Bro. It works on a device Z5 Dual E6683 and E6553 on Z3 + firmware 32.2.A.5.11 :good: :good: :good:
[Sony Cross-Device General] Inata135:
Hello,

I tried to back up three times by TA Backup.

The 3 files obtained was 0 mb

After unplugging, reconnected I got a file TA_F5321_BH900AAW5P_07122016-1914 doing a bit more than 2 Mb

Being a novice, I ask you if you can help me :

Here is the capture of the script obtained. Can you tell me if I managed to save TA bakup correctly?

Is my TA file good?

http://imgur.com/dd4SWho
[Sony Cross-Device General] BITS74:
Screenshots
[Sony Cross-Device General] BITS74:
And I just. I think that the backup is received.
[Sony Cross-Device General] spider623:
what the heck is the difference? in europe they are forced to fix the device if it's a hardware failure, they can't say not even if you have unlocked the bootloader, they just can't provide software support, also from the times i needed the sony rma service they never charged and they even kept the custom os untouched, even if one time they forgot the device open and shipped it....
[Sony Cross-Device General] rayman:
There are several reasons one might want to return to original TA

DRM keys

Return to stock, including OTA updates

Since you have to register your IMEI to unlock, they will by definition always know whether your phone was unlocked or not, even if you restore it. But it does potentially increase sellability if you can actually take OTA updates...
[Sony Cross-Device General] gregbradley:
Is not true that they know if you have unlocked. Just because your get the code based on your imei does not mean that you actually went ahead and unlocked it....
[Sony Cross-Device General] Sajad Askari:
Root Needed???
[Sony Cross-Device General] gregbradley:
No, that's the point.....
[Sony Cross-Device General] spider623:
that is true, about the ota
[Sony Cross-Device General] realtuxen:
Thanks! Seems to work fine on Xperia Compact firmware v.34.1.A.1.205 also.
[Sony Cross-Device General] mcvisster:
Nice job :)
[Sony Cross-Device General] aidy.lucas:
Guessing this will only work on qualcomm powered xperia x devices?
[Sony Cross-Device General] Myself5:
Thats actually a good question. Depends on weather DirtyCow has been fixed on the kernel. Its not a Qcom general bug, but a bug in the Linux Kernel.

After all, since there is nothing that could break, you should really try it.
[Sony Cross-Device General] JenItols:
Any chance of releasing the source code for your compiled programs?
[Sony Cross-Device General] goldenevil47:
A quick question...

I made 2 backup files of my TA before unlocking BL of my Z2 D6503. One with BACKUP TA 9.11 Tool and 2nd with TWRP 3.0.2 MM Recovery... Can either of that backups be used with this tool?
[Sony Cross-Device General] rayman:
Yup, as I write in the original post, source will be out pending some cleanups, license headers etc.
[Sony Cross-Device General] rayman:
This tool only backs up TA. It literally doesn't do anything else, so if you already have backups, there's nothing it can do for you.
[Sony Cross-Device General] rayman:
Very good question.

There's nothing inherently preventing it from working, but it's quite possible it doesn't work now.

Please give it a try and report back :) If you do that and it doesn't work - i'll grab a copy of the ROM and see if I can figure out how to make it work.
[Sony Cross-Device General] itandy:
Anyone tried to use this TA backup to reactivate the device key using the tool by tobias.waldvogel on X devices?

http://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605
[Sony Cross-Device General] shehabskull:
No need.. It is working now ? thank u very much u saves my phones life ❤

* my fault was not setting USB mode for transfering files *

Thanks again :*
[Sony Cross-Device General] zohaib0001:
Is anyone backup his Xperia XZ Ta Backup, then unlock his bootloader, and then restore TA, to check that its actually restore all the DRM keys ????

If anyone do that then please type *#*#7378423#*#* in dail pad then select third option then go to security and see all the line.

they should look like same as the attached picture, if DRM Keys restored successfully.

Or you can try OTA Update it, if its completely updated via ota then its means Keys restore completely

[MENTION=3989065]serajr[/MENTION]

[MENTION=3843529]gregbradley[/MENTION]
[Sony Cross-Device General] fluffi444:
Seams to be working on Z3C (MM 6.0.1 - 23.5.A.1.291).

TA img was pulled successfully.

I must addmit that I'm rooted with UB already but I guess this makes no difference for the functionality of this tool.

I removed root access for ADB SHELL befroe testing...
[Sony Cross-Device General] Sonic Dash:
Im not sure how to restore this TA backup that I have..

I backed it up, unlocked the bootloader and now later on have fully reset to stock but how do I go about restoring this? I assume root isn't required to restore?
[Sony Cross-Device General] rayman:
It currently is, yes.

There's not really anything preventing this method from being used to restore as well, but it wasn't really part of the goal of this.

I think the general idea is:

Flash some TWRP or similar

dd file to TA

Reboot to flashmode and flash stock rom with flashtool.
[Sony Cross-Device General] shoey63:
Done it on the X, and yes, DRM keys were restored.

But you can still have DRM keys on UB too, using the method from here. http://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605

Edit: You will need to create and flash a DK.ftf, as well as include DRM fix in the kernel.

Also don't include TWRP or SuperSU. Flash a TWRP recovery.Img to fotakernel and install from there. (power off >power on while pressing power down > release power button)
[Sony Cross-Device General] goldenevil47:
Actually what I wanted to ask was; can I restore either of backups using this tool?

Plus I want to know about restoring TA (like simple steps and precautions)
[Sony Cross-Device General] DannyWilde:
How can I create DK.ftf?
[Sony Cross-Device General] zohaib0001:
All who want to restore TA

1- You need rooted device for that so flash a custom kernel flash recovery and then flash latest SuperSU.Zip

2- Then download this tool . Extract the zip file

3- Put your TA.img file in that folder

4- Convert your TA.img file using this tool

5- First try DRY install option if success then restore your TA

Try this method at your own Risk, playing with TA can Hard Brick your Phone

After try please share your result here.

.
[Sony Cross-Device General] BITS74:
:good: Good news. Thanks Bro :D