yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] Sonic Dash:
Thank you so much for this [MENTION=962182]rayman[/MENTION], I have a question regarding root..

Is it currently possible to be rooted and have the bootloader locked? As I'm aware the stock kernel which is required has protection to stop root from working.

If it is possible to root would this be system or systemless root? as i'm hoping to find a way to use Android pay but I think that might be asking a bit much :p
[Sony Cross-Device General] mbc07:
First I would like to thank you [MENTION=962182]rayman[/MENTION] for the tool, second, for anyone wondering, this tool also works with Mediatek-based Xperias, at least I can confirm it worked with Xperia M5. I tested it on my E5643 while running on 30.2.B.0.100, 30.2.B.0.110 and 30.2.B.1.21 (all of them are Marshmallow firmwares with different security patches -- the most recent being the 1.21 firmware, with September, 1 security patches). It probably works with the Lollipop firmwares too, but I haven't bothered to test because iovyroot already support those old Xperia M5 firmwares...
[Sony Cross-Device General] gregbradley:
It depends which device you have. As this thread is the Sony cross device development area it is not device specific. However, as I have seen you post in the XZ section I will presume you have that device, in which case the answer is no. You cannot have locked bootloader root at the moment
[Sony Cross-Device General] Sprudeldudel:
Has anyone tried this with z3 compact before?
[Sony Cross-Device General] Myself5:
No but with Z3 and they are basically the same device [emoji14]

If you really want, I could confirm it as working again by diffing the dd img and the TA Backup dumped image, but usually I'd trust rayman. A lot of testing went into this already before it got released.
[Sony Cross-Device General] skiba112:
Working on XPERIA Z4 newest firmware and security patches
[Sony Cross-Device General] DannyWilde:
I did backup with z3 compact. But didn't restore.
[Sony Cross-Device General] istux:
To restore you can also rename the .img file to TA.img, then open the old good DevShaft's BackupTA tool, convert TA.img to a backup.zip and then restore it!

That was the way I restored [MENTION=7891388]p0kemon[/MENTION] 's TA ;)
[Sony Cross-Device General] shoey63:
That requires root, and I was anxious to test without flashing things, (except recovery.img) so I did it through TWRP. ;)
[Sony Cross-Device General] esps:
I made a TA backup of a XZ (F8332), I made a downgrade to 6.0.1-->made backup-->made a upgrade to 7.0 again...

My question is: can I unlock bootloader and restore this backup (6.0.1 TA) to my updated version (7.0)??
[Sony Cross-Device General] gregbradley:
Yes
[Sony Cross-Device General] Sonic Dash:
Thanks for the answer! Yes It's the XZ as I think it was you who helped me when I missed the OEM unlock option.

My question is how is the Z3 able to have its TA backed up, rooted and then fully restored back to being locked again on 6.0.1 and the XZ can't? Did they add extra security since the Z3?
[Sony Cross-Device General] PRODIG4L:
Confirmed working with:

Xperia X (F5121) build 34.0.A.2.301

Xperia XC (F5321) build 34.1.A.3.49

Been waiting for this exploit , thanks
[Sony Cross-Device General] paphonb:
Do you have to factory reset after downgrading from 7.0 to 6.0?
[Sony Cross-Device General] shoey63:
You have to factory reset when downgrading or upgrading between different android versions (as I'm sure you are well aware), but TA can be backed up on any version and restored on any version without factory reset.

Just be sure to flash a stock rom before rebooting after restoring TA. (Exclude wipe Userdata if on same android version)
[Sony Cross-Device General] webwude:
Great job. I managed to backup my trimarea as well :)

Gesendet von meinem F8331 mit Tapatalk
[Sony Cross-Device General] darwusch:
On my Xperia XA Ultra it doesn't work, I get this output:

D:\Download\Android\New\Xperia XA Ultra\backupTA\backupTA>backupTA.cmd
Picking 64-bit version
Running on F3211 on 64-bit platform
Pushing files
253 KB/s (9984 bytes in 0.038s)
2607 KB/s (6088 bytes in 0.002s)
4367 KB/s (14280 bytes in 0.003s)
1759 KB/s (10184 bytes in 0.005s)
284 KB/s (876 bytes in 0.003s)
Running scripts to dump ta to "TAIMG" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Dumped TA as TA_F3211_WUJ01NB0DP_zo11-12-201617-5014.img
Pulling image
Cleaning up
TA Sucessfully pulled to TA_F3211_WUJ01NB0DP_zo11-12-201617-5014.img
****NOTE: Please verify filesize is 2MB ****
Press any key to continue . . .

XA Ultra Single Sim, firmware 36.0.A.1.111

Android 6.0

Security patch: May 1st 2016

The TA img file is created but is 0 bytes.
[Sony Cross-Device General] rayman:
Have you tried rebooting and trying again? It can occasionally fail for various reasons...
[Sony Cross-Device General] darwusch:
Several times, same result.
[Sony Cross-Device General] rayman:
Alright, could you get me a logcat after running it?

It's possible there's some difference on XA Ultra that prevents it from working, but logcat should give more information..
[Sony Cross-Device General] sam.foro:
Hi people.

Please, Where I can download the tool for TA Backup my Sony Xz?

I don't see link to download.

Thanks in advance.
[Sony Cross-Device General] Desperanto86:
here
[Sony Cross-Device General] sam.foro:
Thanks,

I did not know that option, and from the mobile impossible.
[Sony Cross-Device General] Androxyde:
Hello,

I also tried on XA and got exact same output. I tried on Xperia E5 either and same output.

All those devices are MTK based devices. I think it will fail on any MTK based devices.

Edit : tested on Xperia C5 dual, MTK based too and it's working fine :)
[Sony Cross-Device General] darwusch:
[MENTION=2807379]Androxyde[/MENTION] Ok, could you send a logcat from the XA to rayman? I don't have the device with me now.
[Sony Cross-Device General] casouzaj:
Backup TA of Z3 Compact done!

Thank you, [MENTION=962182]rayman[/MENTION], for your tool! I was able to make a backup up of my D5833's TA partition. My phone is rooted and runs MM 23.5.A.1.291 firmware. Generated file is 2097152 bytes long. Guess it's fine!
[Sony Cross-Device General] itandy:
I created TA backup using 2 different firmware versions, both 6.0.1. The MD5 checksum are different. Are they supposed to be different?
[Sony Cross-Device General] mbc07:
It works on Xperia M5 too, which is also MTK. Maybe it's an issue with Xperia MTK devices from 2016 lineup only...
[Sony Cross-Device General] gregbradley:
Yes, check out post #2
[Sony Cross-Device General] rayman:
Very interesting. I don't have any MTK based Sony's unfortunately, but maybe we can connect on hangouts and try and figure out the issue?
[Sony Cross-Device General] Androxyde:
check your PMs
[Sony Cross-Device General] janflapjes:
Thanks! I was able to successfully backup my TA Partition on my Z5 Compact.

How about extending the script a little to make a full device backup? I know I can do that with a custom recovery, but for security purposes I would rather keep the locked bootloader and no root. I can see what the script is doing, wouldn't it just be a copy/paste job to include the other partitions? Unfortunately, I know nothing about the android file structure, so I don't want to start experimenting.
[Sony Cross-Device General] rayman:
Not possible. SELinux prevents it.

You'd need to take over a context that has full access to all partitions AND find a way to switch to it.

Also, it's not impossible it could be done with dirtycow, but well outside the scope of this tool
[Sony Cross-Device General] Myself5:
No. Thats not easily doable.

TA Dump is using the Dirtycow exploit to override a certain binary. In this case, the binary is tad_static (the binary that is responsible for reading data from the TA Partition). Thats the only binary that has access to read from the TA Partition (SELinux would block others). However it doesnt have access to all other partitions. AFAIK.

I also don't see how its important to do a backup of the other partitions. There is nothing that can break, or can get deleted by accident. And in case there is, just use Flashtool and flash the latest Stock ROM.

If you for whatever reason still want to do a backup, backup TA, unlock the device, flash a recovery, make a backup of the ROM and then restore the TA Partition (That relocks the bootloader).
[Sony Cross-Device General] alex.do:
Hi [MENTION=3989065]serajr[/MENTION], can I do the same with a TA backup from MM and a kernel from Nougat? basically I'd like to have latest Nougat + unlocked BL + root + xposed + working DRMs (and of course ability to relock BL with my TA backup whenever I want). is it possible? And I'd appreciate if you could help with a detail instructions (step by step) coz I dont want to hard brick my XZ :(

Thanks in advance
[Sony Cross-Device General] serajr:
Yes you can!

Xposed Framework for Nougat has not yet been released!!
[Sony Cross-Device General] esps:
Thank you so much for support [MENTION=3989065]serajr[/MENTION].

I want to know: Can I use Kernel from N ftf, downloaded by XperiFirm?
[Sony Cross-Device General] serajr:
Why not? Just use it!

Btw... quote is enough, you don't need to quote and mention at same time!!
[Sony Cross-Device General] rayman:
It's great you told people about the options etc, but let's keep stuff not directly relevant to backing up TA outside of this thread :)
[Sony Cross-Device General] serajr:
Post #86 last words... but!
[Sony Cross-Device General] DarkerJava:
Hey! Our (dying) M4 Aqua forum has been looking to root the M4 on MM without losing locked bootloader. As our device doesn't have dm-verity, we can relock our bootloader by flashing back the TA partition and be fine right? I'm pretty sure the M4 is vulnerable to DirtyCow...
[Sony Cross-Device General] rayman:
Good news. With remote access to Androxyde's Xperia XA, I've managed to find & fix the issue.

I'll release an update version as soon as I can. It should fix it for all the funky MTK devices :)
[Sony Cross-Device General] KWOKSFUNG:
Guys, I am planning to unlock, just have few questions left

1. Where is my TA backup going to be saved? I see u guys can flash the TA.img thing in TWRP, so it's stored in the phone by default? In my experience when u UB sony wipe everything in your phone, so how do u guys keep it?

2. Can I keep the TA backup in my pc just to be save?

3. How exactly do I use "dd command" to restore my TA backup file? Never used it before

sorry i'm a noob, big noob >< TA backup and restore used to be simple those days

thanks in advance
[Sony Cross-Device General] rayman:
1. It gets pulled to your PC during the process if it's successful.

2. See 1.

3. Restoring is not within the goals of this project.
[Sony Cross-Device General] rayman:
Try running it a few times in a row. If that doesn't work, reboot and retry. This is a dirtycow issue that happens sometimes.

I'll try and make it more clear when it actually succeeds in the next version. (Check the size of the file. If it's not 2MB, it's not successful)
[Sony Cross-Device General] P.Fan:
I did this on my Xperia Z5 and now it won't boot up, pressing the power button results in a vibrate with nothing displaying, just black screen/display isn't turned on, the led is also flashing red when connected to a charger
[Sony Cross-Device General] darwusch:
That's great news, can't wait to try it. :)
[Sony Cross-Device General] zohaib0001:
Playing with TA is always dangerous

I brick my Xperia Z few years before while backing up its TA, and because there are some issue in backup tool at that time, its brick my Z

I am afraid you bricked your phone also.
[Sony Cross-Device General] Myself5:
Did you actually confirm the image had a size of 2MB, like the tool told you to do?
[Sony Cross-Device General] P.Fan:
I've managed to make my phone working again by using Xperia Companion's Software Repair feature :)

Yes the TA image that's backed up is 2mb
[Sony Cross-Device General] Myself5:
Hehe, then it thankfully wasn't the TA that was screwed. Glad you managed to fix it again.
[Sony Cross-Device General] jatyeo:
Hey, if I have 2 xperia ZR phones, can backup withe TA from one and flash it on the other without adverse effects to either?

Thx.
[Sony Cross-Device General] STreeTNerD:
No!
[Sony Cross-Device General] jatyeo:
Ok, thx

Why? What happens?
[Sony Cross-Device General] STreeTNerD:
You will permanent brick your phone.
[Sony Cross-Device General] Sprudeldudel:
Z3 compact - contradictory information

Hey guys a few posts back I had asked about Z3c.

Shortly after there were two posts on this:

1. one guy replied he made a backup, which wouldn't restore on z3c

2. another guy said he tried on D5833 and it worked.

I have D5803 - working or not :) ?
[Sony Cross-Device General] shoey63:
No reason why it shouldn't work on Z3c. But why do you need it? TA backup was cracked on Shinano devices a long time ago.

Or am I missing something?
[Sony Cross-Device General] tommy1616:
XA ultra F3215 has success. Thanks
[Sony Cross-Device General] STreeTNerD:
Did you have success with restoring the ta as well or just the dump?
[Sony Cross-Device General] tommy1616:
BTW, how to restore TA partition?

I never try it.
[Sony Cross-Device General] zohaib0001:
[MENTION=5909996]tommy1616[/MENTION]

See this post

http://xdaforums.com/showpost.php?p=69991950&postcount=85
[Sony Cross-Device General] gregbradley:
Or if you do not have root see this post
[Sony Cross-Device General] STreeTNerD:
How about a tutorial on this. Did you unlock BL with Sony or flashtool. Why couldn't you leave the BL unlocked?
[Sony Cross-Device General] shoey63:
The purpose of the post was to prove the tool generates a valid TA image that can be restored. Method used to unlock bootloader and restore TA image are beyond the scope of this tool and thread.
[Sony Cross-Device General] EMJI79:
The process was successful according to the command line, but I can't find the TA Backup file on my PC. Where should it be?

OK, nevermind, I found it with a file explorer research.
[Sony Cross-Device General] s6182:
Hello we can convert ta.img to ta.zip ?

To flash with recovery twrp

I have twrp and supersu and android 7 install on sony xperia xz

I want root with ta / drm

thank you
[Sony Cross-Device General] STreeTNerD:
Well have you restored the ta?
[Sony Cross-Device General] s6182:
Or do this

adb shell dd if=/data/local/tmp/TAbackup.img of=/dev/block/bootdevice/by-name/TA

twrp?
[Sony Cross-Device General] garikay:
Yes. Go to TWRP, connect phone to PC, run ADB and promt it.

But I have on XA Ultra Dual another: adb shell dd if=/data/local/tmp/TA.img of=/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/TA or adb shell dd if=/sdcard/TA.img of=/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/TA. (I renamed into TA).But I was not able to restore the TA. At the command prompt, all OK: 2097152bytes(2.0MB) copied, 0.029919 seconds, 66.8MB/s,then I rebooted the system and went into the service menu check DRM and see: Blobs:generic error! HUK: generic error! Maybe I'll write the wrong way: "=/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/TA" ?
[Sony Cross-Device General] porroni:
Same thing on Xperia M4 Aqua E2303, Android 6.0.1, firmware 26.3.A.1.33, Security patch July 2016. Found a solution to this?
[Sony Cross-Device General] garikay:
Maybe this not the case:

D:\Download\Android\New\Xperia XA Ultra\backupTA\backupTA>

? Put folder into C:/ and run script as administrator. On my Xperia XA Ultra it work good.

[IMG="TA"]http://imagizer.imageshack.com/img923/9877/sISbWN.png[/IMG]
[Sony Cross-Device General] porroni:
I didn't use that command lol, it's just the output that is the same. I mean the "Error connecting to unix socket: Permission denied" thing
[Sony Cross-Device General] garikay:
If this is the case both in the this code that you have unlocked bootloader and no DRM keys, sorry. You can not do anything in this case.

Picking 64-bit version
Running on F3212 on 64-bit platform
Pushing files
312 KB/s (9984 bytes in 0.031s)
379 KB/s (6088 bytes in 0.015s)
658 KB/s (14280 bytes in 0.021s)
633 KB/s (10184 bytes in 0.015s)
44 KB/s (876 bytes in 0.019s)
chmod: chmod '/data/local/tmp/TA.img' to 100755: Operation not permitted
Running scripts to dump ta to "TAIMG" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Dumped TA as TA_F3212_WUJ01MQ7GE_17122016-1829.img
Pulling image
Cleaning up
TA Sucessfully pulled to TA_F3212_WUJ01MQ7GE_17122016-1829.img
****NOTE: Please verify filesize is 2MB ****
[Sony Cross-Device General] porroni:
Uuuh nope! Not this at all. It's the same as the previous one I mentioned. I didn't unlock my bootloader yet, that's why I was searching for a method like this before going ahead. Here

Picking 64-bit version
Running on E2303 on 64-bit platform
Pushing files
624 KB/s (9984 bytes in 0.015s)
371 KB/s (6088 bytes in 0.015s)
13 KB/s (14280 bytes in 1.000s)
318 KB/s (10184 bytes in 0.031s)
0 KB/s (876 bytes in 1.000s)
Running scripts to dump ta to "TAIMG" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Attempting exploit
Attempting to dirtycow
Attempting to dirtycow
Done dirtycowing
Waiting for result....
Error connecting to unix socket: Permission denied
Dumped TA as TA_E2303_YT91139VHA_17122016-1703.img
Pulling image
Cleaning up
TA Sucessfully pulled to TA_E2303_YT91139VHA_17122016-1703.img
****NOTE: Please verify filesize is 2MB ****
Premere un tasto per continuare . . .

The bootloader as I said is still locked
[Sony Cross-Device General] garikay:
Go to the service menu: * # * # 7378423 # * # * then in service tests then SECURITY. If as the screenshot so the restart your phone and try again.

[IMG="Yes"]http://imagizer.imageshack.com/img922/8408/jqMn36.png[/IMG]
[Sony Cross-Device General] porroni:
What the... it's blank o.o there is nothing in there

EDIT: I don't know what happened but the phone froze all of a sudden, rebooted and now I can see stuff in the Security page <.<

EDIT2: Ok after this I retried and happened the same thing.... Basically after using the tool and getting the output I already posted, the phone loses the bootloader info :confused:

In Service Info-->Software Info, the S1 Boot Verification becomes "Unavailable", and the Current Modem Config becomes void

In Service Info-->Configuration, the Rooting Status becomes "UNAVAILABLE" and the HW Config rev becomes void

In Service Tests the Security page becomes void as well

All gets to normal after a reboot
[Sony Cross-Device General] garikay:
Something wrong is happening with the phone. Maybe it makes sense to reset to factory condition?