yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] 88%:
Thanks, that did it!

It was an issue with my adb install. I fixed this by finding an install script issued as a part of a YouTube video and installing adb that way. Then I cd'd into the BackupTA folder and ran

backupTA.sh

Thanks again! :)
[Sony Cross-Device General] rayman:
put source in external/backupTA

mmm external/backupTA

This assumes you've built a full android for the device in question beforehand.

There's no trivial way to build this, it requires some android libraries/headers to work, so needs a properly setup AOSP checkout.
[Sony Cross-Device General] rayman:
If the phone is already rooted, there's little point in using this tool..., just dd the TA partition out.

BUT: There is some issues with certain older ROM versions, so I suggest you upgrade to latest and try again.
[Sony Cross-Device General] STreeTNerD:
hey shoey, i am a bit confused, I know you renamed your ta.img file to TAbackup.img but where do i place that file on my PC to push it using ADB? Sorry if this is a stupid question, but never used ADB and/or fast boot before.
[Sony Cross-Device General] M1chiel:
It should be in the same folder as the folder you run ADB from.
[Sony Cross-Device General] todonormal:
I am interesting in BackupTA for Xperia L C2105 ¿It's possible?
[Sony Cross-Device General] alpine101:
Delighted to confirm this has worked on my Z3+ 6533 which came today with MM.
[Sony Cross-Device General] manhhung1420:
Dear

Can do withe XZ running android 7 ? or must be downgrade to android 6 ?
[Sony Cross-Device General] M1chiel:
In Android 7 the Dirty Cow vulnerability was repaired. So it cannot be used to extract the TA anymore and you will need to downgrade to MM to do so.
[Sony Cross-Device General] maXDAmn:
Error connecting to unix socket: Permission denied

i got that error output with my Xperia M4 Aqua E2353 running latest MM Build 26.3.A.133. and also my TA Backup result is 0 byte
[Sony Cross-Device General] Licaon_Kter:
post the whole output
[Sony Cross-Device General] maXDAmn:
sorry i forgot to take screenshot, but the error is like this post

Picking 64-bit version

Running on E2303 on 64-bit platform

Pushing files

Pushing files/dirtycow64 to /data/local/tmp/dirtycow

Pushing files/run-as64 to /data/local/tmp/run-as

Pushing files/exploitta64 to /data/local/tmp/exploitta

Pushing files/dumpta64 to /data/local/tmp/dumpta

Pushing files/checkta64 to /data/local/tmp/checkta

pushing push files/backupTA.sh /data/local/tmp/backupTA.sh

Running scripts to dump ta to "TA_E2303_YT911BP5XP_19022017-1907.img" on device

Overwriting run-as

Attempting to dirtycow

Done dirtycowing

Overwriting secondary payload (screenrecord)

the error message i got is after Done dirtycowing and the command is trying several time with same error connection to unix socket. after 6 or 7 error then pulling TA backup is done. check the size of the TA about 2mb. press any key to continue. something like that. but i checked my TA backup, the size is 0 bytes. my device is M4 Aqua running 26.3.A.133 and still virgin (no root, no ubl)
[Sony Cross-Device General] HEKER510:
EDIT @ ALL

Thought occured to me and it works

Tabackup is made in 2016, which means that it is necessary to downgrade to the older version of the software by 2016

Backups successfully with two megabytes That problem is the last update xperia x f3111 is from 2017 and TAbackup v1 and v2 is from 2016, so you need to downgrade to version FW35 FW81 or FW105 OTHERWISE not go

Then you are backing up DRM key OK 2 megabytes
[Sony Cross-Device General] shoey63:
You can restore TA on any stock rom, regardless of how you backed it up. Drm keys will still be there.
[Sony Cross-Device General] nathan30:
I have a question : I first backuped my TA Partition before unlock bootloader. After I had to relock bootloader so I did this, with restoring the TA partition. Now I want to re unlock bootloader, can I unlock it directly from Nougat without re-backup my TA partition ? Or do I need to backup it again, under MM ?
[Sony Cross-Device General] M1chiel:
Nope, if you still have your saved TA Partition, there is no need to make a backup again.
[Sony Cross-Device General] nathan30:
Perfect, thanks a lot :)
[Sony Cross-Device General] PRO>KOMP.<:
Hi, I have installed on my Z2 Existenz Rom. Now I want to install stock system. What first I need to do? I backup TA before unlocking my BL.
[Sony Cross-Device General] M1chiel:
Check post #257: https://xdaforums.com/crossdevice-d...-ta-backup-t3514236/post70903982#post70903982
[Sony Cross-Device General] PRO>KOMP.<:
Thanks!

I have question about this line:

adb shell dd if=/data/local/tmp/TAbackup.img of=/dev/block/bootdevice/by-name/TA

by-name - what I need to write? I have Xperia Z2 D6503
[Sony Cross-Device General] Licaon_Kter:
nothing, you don't modify the line.
[Sony Cross-Device General] M1chiel:
You have to copy it literally; there is actually a directory called 'by-name' in the boot partition.
[Sony Cross-Device General] PRO>KOMP.<:
Thanks for help!

All is working, stock installed with DRMs...
[Sony Cross-Device General] shazwansulleh:
How can i know that i successfully backup TA n DRM keys? is this considered success?
[Sony Cross-Device General] MrJones2k:
yes, files should be 2mb in size, so I guess it worked, also the logfile should tell you if it worked.
[Sony Cross-Device General] fredsky2:
Hi,

ive read all of the 30 pages of this thread and still couldnt figure this out by myself.

I have a brand new X Compact 7.0, ver. 34.2.A.0.292, kernel 12/21 2016, security patch 01/01/17, unrooted and locked BL. Im almost sure it didnt ship with Nougat and that this new auto-update OTA thingy got the better of me

I read that to do the TA backup i'd have to downgrade to MM

,

but how could i downgrade if to flash MM i'd need to unlock my BL

, wich would erase my DRM keys, making the whole process pointless? Am i missing something here?

Ive also read that flashtool (im using ver.0.9.23.2) is now compatible with Nougat and that i has TA backup v2 in it, but all i got was 1. a warning that it cant backup all of this trim area stuff and 2. two small files named 1.ta and 2.ta.
[Sony Cross-Device General] M1chiel:
The TA backup in Flashtool didn't work for me either. Downgrading to MM can be done with Flashtool without unlocking. You only need to find a MM tft with Xperifirm within FT. Then you should be able to run the tool of this thread.
[Sony Cross-Device General] TimeIsAll:
[/COLOR]

Will this code work for any device?
[Sony Cross-Device General] shoey63:
Should do. /cache should work as well.
[Sony Cross-Device General] TimeIsAll:
thank you for the reply :) i was wondering could i update to android nougat and then use this tool to restore the DRM keys?
[Sony Cross-Device General] shoey63:
Have you used the tool to backup TA partition on MM?
[Sony Cross-Device General] TimeIsAll:
Yes i used this tool on marshmallow and saved the files after i done that i updated to nougat
[Sony Cross-Device General] shoey63:
In that case this tool has done it's job.

There are various methods to restore the TA partition, and therefore get DRM keys back. And they will work regardless of which Android version they were backed up on, and on which version they are restored to, including N. Of course, it will re-lock your bootloader in the process.

(It's beyond the scope of this thread BTW - Title says backup, not backup and restore).

But you should only restore TA partition if selling or sending in for repair.

For full DRM function (and TWRP recovery) on unlocked bootloader, you should visit these threads

https://xdaforums.com/crossdevice-dev/sony/poc-real-trim-instead-drm-fix-t3552893

or

https://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605
[Sony Cross-Device General] EMJI79:
I am confused because you said it is not a restore thread but I didn't find one so can i ask you:

I have flashed stocked (non rooted) firmware on my Z5 Premium so I don't have access to TWRP so how push TAbacku.img to /data/local/tmp ? Can I put TAbackup.img in /Android/data and change your command line to

adb shell dd if=/Android/data/TAbackup.img of=/dev/block/bootdevice/by-name/TA

or is it wrong?

I want to sell my phone.
[Sony Cross-Device General] MrAnonymous_:
I try this, but when I do the

adb shell dd if=/data/local/tmp/TAbackup.img of=/dev/block/bootdevice/by-name/TA

command I get the error: "CANNOT LINK EXECUTABLE "/system/bin/sh": cannot locate symbol "__write_chk" referenced by "/system/bin/sh"...

Any help?
[Sony Cross-Device General] EMJI79:
I wrote:

dd if=/storage/emulated/0/Android/data/TAbackup.img of=/dev/block/bootdevice/by-name/TA

and it gave Permission denied

Should I root again my smartphone before restoring TA?
[Sony Cross-Device General] EMJI79:
I have rooted my phone again and still had Permission denied
[Sony Cross-Device General] x_one:
Boot into TWRP and try again.
[Sony Cross-Device General] EMJI79:
That's what I did and finally succeeded.

You have to be rooted to lock the bootloader again and restore TA (as far as I experienced) and thenunroot if someone else wants to restore everything to factory like me.
[Sony Cross-Device General] shoey63:
[MENTION=3345240]f1reak[/MENTION]

You are on LP.

It works better on MM. Use FlashTool by Androxyde to flash MM and it will work.
[Sony Cross-Device General] f1reak:
Thank you for responding [MENTION=4675598]shoey63[/MENTION]

I was on MM before. I tried backupTA_v2, got 0 byte TA_E5803_xx.img files every time I tried.

I read TA backup (or maybe the exploit?) works better with LP.

Used XperiFirm to D/L “E5803_Service Exchange Unit_1296-9550_32.0.A.4.11 / R3B”

Removed fwinfo.xml

I used Flashtool 0.9.23.2 (patched up from 0.9.23.1 using x10flasher.jar) to build E5803_32.0.A.4.11_Service Exchange Unit.ftf (1.87 GB)

Flashed the FTF file, and here we are.

I tried USB 3.0 and 2.0 ports. I don’t think it is a comm issue. What do you think?
[Sony Cross-Device General] shoey63:
Only thing I can think of is try it with a new USB cable.
[Sony Cross-Device General] f1reak:
I tried a shorter USB cable (3rd cable); TA_E5803_xx.img files are still 0 byte.

[MENTION=962182]rayman[/MENTION] says in post #2

* Overwrite run-as binary with a custom binary

My log

CANNOT LINK EXECUTABLE: empty/missing DT_HASH in "/system/bin/run-as" (built with --hash-style=gnu?)
Dumped TA as TA_E5803_CB5A2995MH_04172017-904.img

So, DT_HASH is missing in "/system/bin/run-as"? Does that give any clue to what is going wrong?

Has anyone used the resulting img file with munjeni’s Trim Area Proof Of Concept?

Please confirm if below is true for Sony build numbers:

32.3.A.x.xx = 7.0 Nougat

32.2.A.x.xx = 6.0 Marshmallow

32.0.A.x.xx = 5.1.1 Lollipop
[Sony Cross-Device General] shoey63:
[MENTION=3345240]f1reak[/MENTION]

Turn off antivirus, re-download and try again. There is no reason it should not work if you are on MM or LP. For good measure, kill FlashTool and PC companion if running.

Edit: One more post and you will be eligible to post your logs via pastebin or the the like[emoji6]
[Sony Cross-Device General] f1reak:
Thank you [MENTION=4675598]shoey63[/MENTION]

Yes, I already tried it with Windows Defender disabled. FlashTool is not running and I removed PC companion. I removed USB drivers, rebooted and installed again.

What functionality will I lose if I unlock the BL and root the Sony Xperia Z5 Compact (E5803)?

Inbuilt camera app will stop working?

BIONZ image processor (worth it?)

X-Reality Engine (what is it?)

Audio enhancements

The reason I ask is, to make a decision to drop the idea of backing up the TA. Too much of a hassle.

PS. Thank you, if I get Pastebin Pro I can share my logcat (1086 KB). Pastebin free accounts can only paste up to 512 KB.
[Sony Cross-Device General] shoey63:
Say NO! to Satan my friend ;)

Your TA partition prior to unlocking is invaluable. You will never get it back to the virgin state in which you received your phone without it.

Yes, there are workarounds to cover the loss of low light algorithms when taking pictures in inferior light and screen mirroring etc. But what if you sell the phone or send it in for warranty? You want it in the state you bought it right?

I rolled back to MM on my z5 and will try the tool again on Windows (It worked before on Linux).

I will let you know how it goes shortly.

Edit: Works perfectly after restoring my original TA partition and backing it up again.

Did you buy the phone new, untouched out of the box? Or online as refurbished or second hand off the web, or another third party?
[Sony Cross-Device General] quan97:
I tried on f5122 and got such TA file correct ?
[Sony Cross-Device General] f1reak:
I bought the phone new from Jumbo Electronics (Authorized Sony distributor in Dubai), used it sporadically (the constant OTA update notifications pi$$ed me off). So the rooted SGS6 was always my “main” phone if you will (running Xposed, AdAway, Greenify, Package Disabler etc).

I don’t care about the warranty, I won’t be selling it, and I sure as hell don’t want it in the state I bought it. Performance handicaps because of missing DRM keys bother me though.

From your response I gather the low light performance of the camera is compromised if I don’t use DRM fix? I never ever use screen mirroring. What else will I have to sacrifice if I don’t Flash the DRM keys?

flash_dk TA_E5803.img DK.ftf
[Sony Cross-Device General] shoey63:
If you can't backup TA, use this tool to make a boot.img with DRM fix after unlocking the bootloader https://xdaforums.com/showthread.php?p=64990566
[Sony Cross-Device General] f1reak:
If I unlock the BL, wouldn't that wipe the DRM keys?
[Sony Cross-Device General] shoey63:
Of course, but seeing as you can't backup TA partition, rootkernel is the next best option. It will simulate the DRM keys.
[Sony Cross-Device General] breakwaterr:
Guys, I am having a tough time restoring the TA img. I backed up the TA img and cant restore it. I am in twrp recovery mode and did the adb devices to check if it showed up and it does. It's when I put the command "adb push TAbackup.img /data/local/tmp/TAbackup.img" it gives me an error saying "adb: error: cannot stat 'TAbackup.img': No such file or directory". I installed the minimal and fastboot drivers under C drive. I moved the backup up TA img to this folder and running the adb commands from this folder. It keeps on failing regardless. Please can anyone help me with this?
[Sony Cross-Device General] doinkydoink:
Got this error when running it on my XZ.

Any ideas? seems that it managed to extract the data but is unable to write into my folders.

Not sure what I am doing wrong.

Many thanks in advance.

C:\Users\Shanice\Downloads\XZ\backupTA_v2\windows>adb devices
List of devices attached
CB512D939N device

C:\Users\Shanice\Downloads\XZ\backupTA_v2\windows>cd..

C:\Users\Shanice\Downloads\XZ\backupTA_v2>backupta
Picking 64-bit version
Running on F8332 on 64-bit platform
Pushing files
Pushing files/dirtycow64 to /data/local/tmp/dirtycow
423 KB/s (9984 bytes in 0.023s)
Pushing files/run-as64 to /data/local/tmp/run-as
2972 KB/s (6088 bytes in 0.002s)
Pushing files/exploitta64 to /data/local/tmp/exploitta
3486 KB/s (14280 bytes in 0.004s)
Pushing files/dumpta64 to /data/local/tmp/dumpta
3315 KB/s (10184 bytes in 0.003s)
Pushing files/checkta64 to /data/local/tmp/checkta
2485 KB/s (10184 bytes in 0.004s)
pushing push files/backupTA.sh /data/local/tmp/backupTA.sh
534 KB/s (1094 bytes in 0.002s)
Running scripts to dump ta to "TA_F8332_CB512D939N_??0105-20170.img" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Reading dumpta from stdin...
Read dumpta from stdin at 10184 bytes
Attempting exploit with buf of length 10184
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Bad reply received, failing...
Attempting exploit with buf of length 10184
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Got a total of 2097152 bytes
Exploit successful!
Dumped TA as TA_F8332_CB512D939N_??0105-20170.img
adler32:0xD4A10A21 calc_adler32:0xD4A10A21
adler32:0xEDF18E16 calc_adler32:0xEDF18E16
adler32:0xAFB1E9CD calc_adler32:0xAFB1E9CD
adler32:0x424D9E6C calc_adler32:0x424D9E6C
Trim area dump is valid.
Pulling image
cannot create 'TA_F8332_CB512D939N_??0105-20170.img': No such file or directory
Cleaning up
TA Backup Failed!! Please reboot and try again.
NOTE: If you are running Android Nougat, you need to downgrade to use this tool.
[Sony Cross-Device General] darknessmc:
Are you on Nougat? If yes, downgrade.
[Sony Cross-Device General] paphonb:
I think he isn't on Nougat because the exploit ran successfully.
[Sony Cross-Device General] doinkydoink:
Was on Nougat but download 39.0.A.1.213 from xrifirm and it says android version now is 6.0.1

Do I need to source .250?
[Sony Cross-Device General] darknessmc:
Maybe, according to this https://xdaforums.com/showthread.php?t=3541648
[Sony Cross-Device General] doinkydoink:
Thanks. Guess I need to try harder to look for. 250

Fir some reason they don't seems to be readily available [emoji29]
[Sony Cross-Device General] HtheB:
I see that some people managed to restore the TAbackup somehow.

But I couldn't do it on my Sony Xperia XA (F3111)

Right now, I have 3 files:

TAbackup.img (extracted from my phone using the Universal (Dirtycow-based) TA Backup v2)

DK.ftf (used Rootkernel v5.23 )

DK.ta (extracted from the DK.ftf file)

Any help would be appreciated! :)

Edit: I have been able to restore my DRM keys, but root will be gone again once it's been restored :(
[Sony Cross-Device General] shoey63:
You can't have root on locked bootloader for Xperia devices later than Z3, Z3C due to dm-verity.

Restoring TA partition re-locks bootloader.
[Sony Cross-Device General] HtheB:
Well, what about this?

https://xdaforums.com/xperia-xa/how...ia-xa-noob-t3430170/post72142587#post72142587
[Sony Cross-Device General] shoey63:
You need to modify the boot.img, so unlocked bootloader is still required.
[Sony Cross-Device General] HtheB:
It doesn't matter for me if the bootloader is locked or unlocked, as long as the DRM keys are restored while still having root.
[Sony Cross-Device General] shoey63:
There are 2 options presently available for unlocked bootloader and functioning DRM keys with possibility to root.

Rootkernel

and PoC

And 0 options for locked bootloader and root.

You should probably post further queries in those threads, as this one is about backing up TA, but not what to do with it afterwards.

Otherwise this might happen

:cyclops:
[Sony Cross-Device General] koekoek91:
[MENTION=962182]rayman[/MENTION]

Worked perfectly for my new XZ and i've checked file size and all is correct.

Thanks alot man :highfive::good:
[Sony Cross-Device General] jutphaas:
Worked perfectly for my Z3 compact (D5833) and i've checked file size so all seems correct. :)
[Sony Cross-Device General] WanderMax:
I found that you root the XC in Stock ROM 6.0.1 , could you tell me the steps below is right?

1. backup TA (optional)

2. unlock BL

3. install recovery --> any recommended one?

4. create custom kernel with ric/dm disabled

5. flash custom kernel

6. flash xposed/supersu

7. restore TA (optional)

thanks.
[Sony Cross-Device General] itandy:
Yes your steps are fine. Just search a bit and you should find the TWRP for XC.
[Sony Cross-Device General] hartmark:
Cool, thanks for awesome tool.

Got it working on Xperia Z3 Compact on firmware version: 23.5.A.1.291
[Sony Cross-Device General] WanderMax:
OK.

I will.

Thanks.
[Sony Cross-Device General] WanderMax:
how to load recovery from FOTAkernel?
[Sony Cross-Device General] link_it:
how can i check my TA backup is correct to restore later?? i've backup TA with this tool, everything work fine with done in log file, but i have some worry :)
[Sony Cross-Device General] AguxOne:
Hi, i am trying to backup the TA files with the tool provided. I am using an Xperia XA with Android 6.0 marshmellow (33.2.A.4.70 build number). I installed the xperia XA ADB drivers, having the phone with USB debugging activated and in MTP mode.

However the tool doesnt seem to work, the image it pulls seems to be 0 bytes (and no file at all to track in the tool folder).

Here is the log:

Picking 64-bit version

Running on F3113 on 64-bit platform

Pushing files

Pushing files/dirtycow64 to /data/local/tmp/dirtycow

9 KB/s (9984 bytes in 1.000s)

Pushing files/run-as64 to /data/local/tmp/run-as

5 KB/s (6088 bytes in 1.000s)

Pushing files/exploitta64 to /data/local/tmp/exploitta

892 KB/s (14280 bytes in 0.015s)

Pushing files/dumpta64 to /data/local/tmp/dumpta

9 KB/s (10184 bytes in 1.000s)

Pushing files/checkta64 to /data/local/tmp/checkta

9 KB/s (10184 bytes in 1.000s)

pushing push files/backupTA.sh /data/local/tmp/backupTA.sh

1 KB/s (1094 bytes in 1.000s)

Running scripts to dump ta to "TA_F3113_RQ30031JDS_08052017-1444.img" on device

Overwriting run-as

Attempting to dirtycow

Done dirtycowing

Overwriting secondary payload (screenrecord)

Attempting to dirtycow

dirtycow failed

Attempting to dirtycow

Attempting to dirtycow

Done dirtycowing

run-as: Usage:

run-as <package-name> [--user <uid>] <command> [<args>]

Dumped TA as TA_F3113_RQ30031JDS_08052017-1444.img

File: /data/local/tmp/TA_F3113_RQ30031JDS_08052017-1444.img with size: 0x0 is no

t a valid dump!

Sorry trim area dump is corupted and not a safe, please try again!

Pulling image

remote object '/data/local/tmp/TA_F3113_RQ30031JDS_08052017-1444.img' does not e

xist

Cleaning up

TA Backup Failed!! Please reboot and try again.

NOTE: If you are running Android Nougat, you need to downgrade to use this tool.

I would aprreciate any help and if there exists any hope to backup the TA in my device. (Maybe i have to install another stock rom known to work?).

Thanks in advance.
[Sony Cross-Device General] fatimarvin_15:
just want to clarify that if i restore the TA partition on rooted device, the phone will be unrooted? am i right?
[Sony Cross-Device General] shoey63:
If later than z3, it won't boot up because you either have a modified system partition and or boot partition. You will be forced to flash a stock rom and/or kernel, depending on what has been altered by rooting.

TLDR;

Restored TA partition only allows booting on pure untouched stock roms.
[Sony Cross-Device General] sceryavuz:
Just want to clarify, is this v2 work with MM 32.2.A.5.11?

[MENTION=4675598]shoey63[/MENTION] [MENTION=962182]rayman[/MENTION]
[Sony Cross-Device General] shoey63:
Should work on all MM.
[Sony Cross-Device General] sceryavuz:
I want to ask another question. To restore ta image, you mentioned that THIS POST, but then serajr mentioned that THIS POST. Which one should we do to restore backup, dd command or creating DK.ftf?

Edit: I read lots of posts, dd command should work. Thanks :)
[Sony Cross-Device General] WanderMax:
if flash a DK.ftf and kernel without DRM-fix, can the DRM keys be restored or FIDO_key failed?

1. kernel original + DK.ftf/TA.img --> FIDO_key provisioned

2. kernel with DRM-fix --> FIDO_key ? ?

3. kernel with DRM-fix + DK.ftf/TA.img --> FIDO_key provisioned

4. kernel without DRM-fix + DK.ftf/TA.img --> FIDO_key ??????

what is the result above?

if 2 and 3 are right, no clear flag to indicate the device key restored, is it correct?

Thanks!
[Sony Cross-Device General] shoey63:
DK.ftf deals with FIDO keys. DRM fix is for the rest. Obviously, from your research, you need to use both to get full DRM functionality back on UB. The other alternative is

POC by munjeni
[Sony Cross-Device General] WanderMax:
Thanks for your warm reply.

That's only the list of conditions.

However in your post https://xdaforums.com/showpost.php?p=69972315&postcount=21, the original kernel with TA.img flashed can also make TA restored and DRM keys all active, and you do no DRM-fix.

So the only TA.img can make TA restored and DRM keys all active. Is it means that TA.img is equal to DK.ftf + DRM-fix?

Thanks.