yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] shoey63:
If you restore TA.img directly, it will relock your bootloader. This means you can only be on pure unmodified stock rom afterwards due to dm-verity or else the phone wont boot up!

If you want DRM key functions on unlocked bootloader, you have no choice but rootkernel or POC..

Edit: In my test I didn't modify anything except for recovery, and that automatically reverts to the stock version after relocking the bootloader by restoring TA.img.

Edit2: TA.img restore which relocks bootloader is the same as DK.ftf + DRM-fix on unlocked bootloader.

What is it you are trying to achieve? Restore TA.img and still have unlocked bootloader?
[Sony Cross-Device General] WanderMax:
So, to root with FIDO-KEYS and DRM key functions, I can just as below:

1. do rootkernel with DRM-fix, then flash DK.ftf or use adb shell dd command to copy the TA.img to TA partition

2. use POC method

Is this right?

Thanks again.
[Sony Cross-Device General] shoey63:
You cant flash TA.img back, it will relock bootloader.

Procedure is

1. Do rootkernel with DRM-fix and Fastboot it to boot partition, then flash DK.ftf (Or use POC method)

2. Fastboot TWRP to FOTAKernel

3. Enter TWRP and flash Magisk or SuperSU to root.

Please take further question to their respective threads, or start one in Q&A.

This thread is about backup, not what to do afterwards. I Just posted my test to confirm the integrity of the script.
[Sony Cross-Device General] kokokmt:
I already back up ta img how could i restore that friend.

I already back up ta img file .how could i restore that friend.pls help me
[Sony Cross-Device General] kokokmt:
How to verified it bro

I booted to twrp and then pushed TAbackup.img to data/local/temp after that how to do it bro.pls help me
[Sony Cross-Device General] shoey63:
In TWRP terminal

cd /data/local/tmp

Then:

dd if=TA.img of=/dev/block/bootdevice/by-name/TA

Then flash a stock ftf.

Edit: it's /data/local/tmp (not temp)
[Sony Cross-Device General] kokokmt:
I try from terminal and then write

what u told above text but it was say

File not found and the second text

I have to write dd if=TA.img ... right?

I can't find = on my keyboard ???
[Sony Cross-Device General] shoey63:
See my edited post above.

Edit: It's a regular keyboard. Just switch to caps and symbols as you would normally. Bottom left somewhere? Your on your own from here. You'll have to work it out yourself. Enough info has been provided.
[Sony Cross-Device General] kokokmt:
According to your instruction

Aftet put TAbackup.img in data/local/tmp

How to verified md5sum bro
[Sony Cross-Device General] kokokmt:
Bro could you make the boot.img

for me i will upload a ta.img of mine

Because i think i am not enough knowledge

for this.Step was so difficult for me

Even i found symbols in my keyboard

Showed me the text can't open and not found

Find ???
[Sony Cross-Device General] shoey63:
Go to this thread>> https://xdaforums.com/showthread.php?t=3301605

Then you can can unlocked bootloader with DRM keys
[Sony Cross-Device General] Thundahawk:
Have the same problem as AguxOne; Marshmellow (33.2.A.4.70 build number). I installed the xperia XA ADB drivers, having the phone with USB debugging activated and in MTP mode.

However the tool doesnt seem to work, the image it pulls seems to be 0 bytes (and no file at all to track in the tool folder).

Here is the log:

Picking 64-bit version

Running on F3111 on 64-bit platform

Pushing files

Pushing files/dirtycow64 to /data/local/tmp/dirtycow

9 KB/s (9984 bytes in 1.000s)

Pushing files/run-as64 to /data/local/tmp/run-as

382 KB/s (6088 bytes in 0.015s)

Pushing files/exploitta64 to /data/local/tmp/exploitta

864 KB/s (14280 bytes in 0.016s)

Pushing files/dumpta64 to /data/local/tmp/dumpta

620 KB/s (10184 bytes in 0.016s)

Pushing files/checkta64 to /data/local/tmp/checkta

633 KB/s (10184 bytes in 0.015s)

pushing push files/backupTA.sh /data/local/tmp/backupTA.sh

68 KB/s (1094 bytes in 0.015s)

Running scripts to dump ta to "TA_F3111_RQ30013MZM_di13-06-201718-5053.img" on device

Overwriting run-as

Attempting to dirtycow

dirtycow failed

Attempting to dirtycow

Done dirtycowing

Overwriting secondary payload (screenrecord)

Attempting to dirtycow

dirtycow failed

Attempting to dirtycow

dirtycow failed

Error during dirtycow, please reboot and try again.

Pulling image

remote object '/data/local/tmp/TA_F3111_RQ30013MZM_di13-06-201718-5053.img' does not exist

Cleaning up

TA Backup Failed!! Please reboot and try again.

NOTE: If you are running Android Nougat, you need to downgrade to use this tool.

Press any key to continue . . .

Any ideas?
[Sony Cross-Device General] diosdetiempo:
will this work for the xperia xa1?
[Sony Cross-Device General] M1chiel:
I don't think there is a marshmallow rom for the xa1, so it's not going to work.
[Sony Cross-Device General] diosdetiempo:
i'm guessing the 2017 xperias are going to have to wait for new exploits in that case?
[Sony Cross-Device General] munjeni:
CVE-2017-0638

Details of the bug https://android.googlesource.com/pl...+/master/en/security/bulletin/2017-06-01.html on line 353!

That points to the patch here https://android.googlesource.com/pl...+/a98943dd4aece3024f023f00256607d50dcbcd1e^!/

heap overflow! Hope this help somebody figure out an local exploit by loading an specialy made PSD image :)
[Sony Cross-Device General] nailyk:
Useless post

Just got a backup in 3sec. Amazing.

Sorry for useless post but I would really thanks everyone who made that script & payloads exploits, this is awesome :)

And especially many thanks for providing a .sh!!!! Why others dev make things windows only? Some of us get rid of that crap long time ago!

And you for providing it with source code too ;)

Sorry for the spam, many thanks for the tool rayman!
[Sony Cross-Device General] newguyknowsnothing:
Thank you for this awesome tool !! It worked well on my d6503. But how can I restore the backed up TA?
[Sony Cross-Device General] M1chiel:
You can find the answer on the previous page of this thread.
[Sony Cross-Device General] RomanSkyline:
Why its impossible to backup TA partition with nougat? I mean, in the flashtool page changelog is saying that its possible since 9.23 version ??

Enviado desde mi F8331 mediante Tapatalk
[Sony Cross-Device General] M1chiel:
The tool is basically a hack. It exploits a vulnerability in Android (google 'dirty cow'), that was repaired in Nougat.
[Sony Cross-Device General] newguyknowsnothing:
-Deleted-
[Sony Cross-Device General] Hhunted:
Hi guys,

Downgraded my Z5 to E6653_32.0.A.6.200 to extract my ta.img before unlocking my phone.

However, having developer mode enabled and MPT set I get the following error... With the ta.img being 0 bytes.

Being a n00b doing this on my Z5, I guess I'm doing something wrong. Any help / suggestions?
[Sony Cross-Device General] Hamidreza2010:
Hi

I was backup my drm key in Xperia z3 and know I want to restore it

Would you please tell me completely what should I do exactly?

Thanks
[Sony Cross-Device General] shoey63:
CONFIRMATION OF TA RESTORE!

- Ran tool on Xperia X

- Unlocked bootloader

- Flashed TWRP

- Booted to system

- Got nag about being unsafe due to unlocked bootloader and wanted password. I don't have a pasword?? (nevermind)

- Booted back to TWRP (Also wants a password due to encrypted data - ignored!)

- Pushed TAbackup.img (I renamed it) to /data/local/tmp and verified md5sum is same as original backup.

- Did

adb shell dd if=/data/local/tmp/TAbackup.img of=/dev/block/bootdevice/by-name/TA

- Rebooted

- Everything back as it was. Original TA restored and DRM keys all active:victory:

NOTE/EDIT: Due to dm-verity, you cannot restore TA on a rooted phone (Z3+ onwards). It won't boot up. Boot and system have to be pure untouched stock.
[Sony Cross-Device General] serajr:
Thank you bro! :good:

The waiting game is over then. Flashaholics, what are you waiting for?
[Sony Cross-Device General] Desperanto86:
why didn't flash supersu? :)
[Sony Cross-Device General] shoey63:
I will - later. I just wanted to confirm restoring TA works first. Flashing stuff is beyond the scope of this thread anyway.[emoji6]
[Sony Cross-Device General] Desperanto86:
your data was wiped after restoring?
[Sony Cross-Device General] alex.do:
Great thanks!!!!!!
[Sony Cross-Device General] shoey63:
No, restoring didn't wipe data.
[Sony Cross-Device General] paphonb:
Didn't work on my XZ with 39.2.A.0.327 but it said "Done dirtycowing" once.

Picking 64-bit version
Running on F8332 on 64-bit platform
Pushing files
1361 KB/s (9984 bytes in 0.007s)
1188 KB/s (6088 bytes in 0.005s)
2323 KB/s (14280 bytes in 0.006s)
1988 KB/s (10184 bytes in 0.005s)
293 KB/s (876 bytes in 0.002s)
Running scripts to dump ta to "TAIMG" on device
Overwriting run-as
Attempting to dirtycow
Done dirtycowing
Overwriting secondary payload (screenrecord)
Attempting to dirtycow
dirtycow failed
Attempting to dirtycow
dirtycow failed
Error during dirtycow, please reboot and try again.

From Android Security Bulletin, the exploit was patched in November 6 patch. But it also doesn't work on my Nougat XZ with November 1 patch.

Will try this again on MM with the same patch level.

Thanks a lot.
[Sony Cross-Device General] gregbradley:
The readme says it will not work recent N builds,
[Sony Cross-Device General] paphonb:
I know. I even quoted in in my post.
[Sony Cross-Device General] shehabskull:
HI all.. I am using XZ5 on latest official MM build.. Tried to use this tool and it worked, but the file is 0 byte.. Does that mean my TA keys are missing from my phone?
[Sony Cross-Device General] karrouma:
i am on 3.30 sony xperia xz dual f8332 unlocked bootloader

how can i flash this .img

to revert to stock like on the box to can update ota without any error to android 7

any help please

step by steps

thank you
[Sony Cross-Device General] kistigun:
What TWRP did you use? Can you share a link?
[Sony Cross-Device General] Desperanto86:
I know, that restoring is no wiping data. I know that unlocking was wiping all user data (in Z2 and Z3)
[Sony Cross-Device General] gregbradley:
If you have already unlocked its too late, your TA partition is already wiped so there is nothing to backup
[Sony Cross-Device General] karrouma:
trying in my xz android 6

Picking 64-bit version

Running on F8332 on 64-bit platform

Pushing files

243 KB/s (9984 bytes in 0.040s)

5 KB/s (6088 bytes in 1.000s)

1394 KB/s (14280 bytes in 0.010s)

994 KB/s (10184 bytes in 0.010s)

85 KB/s (876 bytes in 0.010s)

Running scripts to dump ta to "TAIMG" on device

Overwriting run-as

Attempting to dirtycow

and stop

waiting for 5 minutes and no result

still stopping

any help
[Sony Cross-Device General] gregbradley:
There is nothing to backup if you have unlocked your bootloader already....
[Sony Cross-Device General] kistigun:
you ca still back it up with this tool with UB. It worked for me, got a backup img but it's probably useless
[Sony Cross-Device General] gregbradley:
True, it may still back it up, but its not backing up the content you need to relock the bootloader and restore DRM keys. That's the point of this tool. If people have already unlocked they have formatted the TA partition, nothing useful is there to backup
[Sony Cross-Device General] Myself5:
Not exactly. It's not fully formatting the TA Partition (The TA partition also contains highly important data, that, if corrupted can result into a hardbrick of the whole device), its just deleting the DRM Keys.

After all, [MENTION=7891388]p0kemon[/MENTION]s research provided intresting information. It seems like the DRM Keys exist twice, and only one copy is getting deleted. A early proof of concept actually revealed, that it might be possible to reconstruct a locked bootloader TA out of the unlocked bootloader TA.

If someone is intrested or wants to help by providing data to p0kemon, you can read about it here: http://xdaforums.com/xperia-x-performance/how-to/dirtycow-temp-root-t3503918

But always keep in mind, its a dev thread ;)
[Sony Cross-Device General] M1chiel:
Check the previous page. Make sure you restore the correct file.
[Sony Cross-Device General] Hamidreza2010:
Exactly which post?
[Sony Cross-Device General] antryout:
Hello. My device is Z3C D5803 (23.5.A.1.291_1288-4954-R11D) Rooted by "russel5" method.

"DevShaft"s unmaintained TA Backup method didn't work, but this one did. At first, I thought something was wrong. Because after backing up, I wanted to check DRM keys. I typed *#*#7378423#*#* I tapped on Service Tests/Security The menu shows "UNKNOWN" Nothing else..

Then I tapped Service Info/Configuration Rooting Status=UNKNOWN, Hw Config rev= UNKNOWN

At first I was scared. After rebooting, checked everything. All are displayed correctly. Keys are Active/OK now.

Here is the screenshot of my backup process. Blurred parts are device serial number.

[IMG="Screenshot"]https://i.imgur. com/oq7QhB6.png[/IMG]

Thanks [MENTION=962182]rayman[/MENTION]

The question is how to restore it when needed. Sorry, because I'm the rookie of the year :o
[Sony Cross-Device General] tomhtg90:
check on page 3
[Sony Cross-Device General] levone1:
Just got my hands on an XA, (MM), and want to back up TA. Used this tool successfully on Z1c (LP) , so familiar with it. I also have read through, and seems like there's confidence that it should work. I keep getting '... Failed... not exist' error message. I've tried rebooting, disabling av, and checking drivers. PC is Win10. I plan on keep messing around, but just wondering if anyone knows if I'm missing something. Thanks.
[Sony Cross-Device General] levone1:
[MENTION=962182]rayman[/MENTION] Here's log:

Picking 64-bit version

Running on F3113 on 64-bit platform

Pushing files

Pushing files/dirtycow64 to /data/local/tmp/dirtycow

624 KB/s (9984 bytes in 0.015s)

Pushing files/run-as64 to /data/local/tmp/run-as

5 KB/s (6088 bytes in 1.000s)

Pushing files/exploitta64 to /data/local/tmp/exploitta

13 KB/s (14280 bytes in 1.000s)

Pushing files/dumpta64 to /data/local/tmp/dumpta

9 KB/s (10184 bytes in 1.000s)

Pushing files/checkta64 to /data/local/tmp/checkta

9 KB/s (10184 bytes in 1.000s)

pushing push files/backupTA.sh /data/local/tmp/backupTA.sh

1 KB/s (1094 bytes in 1.000s)

Running scripts to dump ta to "TA_F3113_RQ300183AY_Sun0723-201718.img" on device

Overwriting run-as

Attempting to dirtycow

Done dirtycowing

Overwriting secondary payload (screenrecord)

Attempting to dirtycow

dirtycow failed

Attempting to dirtycow

dirtycow failed

Error during dirtycow, please reboot and try again.

Pulling image

remote object '/data/local/tmp/TA_F3113_RQ300183AY_Sun0723-201718.img' does not exist

Cleaning up

TA Backup Failed!! Please reboot and try again.

NOTE: If you are running Android Nougat, you need to downgrade to use this tool.

Press any key to continue . . .

Another attempt showed similar, but including message, 'sorry, ta dump is not safe...'
[Sony Cross-Device General] rrvuhpg:
[MENTION=6283426]levone1[/MENTION] downgrade your MM firmware to an older, Dirtycow exploit doesn't work on recent MM firmwares.
[Sony Cross-Device General] Mlobon:
I have a nugat 42.0.A.3.32 xa1 ultra patched june/7/17.

Can this phone be downgraded to a previous nugat? Or even to MM so the ta could be backed up? If so, would someone give some directions to those images for downgrading?

Thanks
[Sony Cross-Device General] desiromeo719:
Hi can you please explain how you got it to work? I have X compact and OSX with adb installed properly. When I run adb devices I am able to see the device connected. But when I run backupTA.sh command in the folder I get an error saying I need to downgrade from Nougat. I am running MM build .198.

I have also tried on windows 7 machine with all drivers installed but cannot even see the device when I run adb devices. I want to try to backup on mac osx. Can you please help?
[Sony Cross-Device General] Mostafa.Manouchehri:
Hi

My pc is running Windows 10 64 bit and my device(Xperia X f5122) is running Android 6

But it doesn't work

Every time I check the dirtycow for backing up, cmd shows:device's is not available and etc...

My drives (adb, device) is installed

And my device bootloader is lock and it's not root!

And I connect my phone in pc on normal mode(no Fastboot or flashmode)

Help me please?
[Sony Cross-Device General] SXUsr:
Have you enabled usb debugging in developer options? Worked fine for my X Compact.
[Sony Cross-Device General] Mostafa.Manouchehri:
Is it needed root?
[Sony Cross-Device General] nikanorov:
Sorry I do not remember now. Tool worked for me out of the box or with minimal script changes. I saved backup image to Evernote and never used it.
[Sony Cross-Device General] gspbeetle:
Just did it on a new XZ dual.

I noticed that if running flashtool at the same time, the dump will always fail and say the dump is corrupted or something. Possibly due to flashtool have its own adb interfering.

Strangely the "adb start-server" command did not return any error. But anyway, after exiting flashtool and restarted adb, dump was successful.
[Sony Cross-Device General] hene193:
I wonder what software version I should have on my X performance?

Edit: found it. 6.0.1 uk version.
[Sony Cross-Device General] HEKER510:
Xperia L1 nougat is worked backup drm key ?

Please reply very thanx bro
[Sony Cross-Device General] Fukel:
How do I restore my TA that was backed up with this tool? I have Z3 Compact and want to return to stock so I can sell phone.
[Sony Cross-Device General] moldowan:
https://xdaforums.com/showpost.php?p=69972315&postcount=21
[Sony Cross-Device General] Fukel:
Thanks, since I restore TA through TWRP does that mean I need to flash stock ROM after I restore TA?
[Sony Cross-Device General] moldowan:
I guess so. Never done that myself.
[Sony Cross-Device General] Fukel:
Couldn't do it in twrp it said there was no such path for /dev/block/bootdevice/by-name/TA. I decided to flash stock first then root it and restore TA from Android. That worked fine just had to change "adb shell" command to "adb shell su -c" or I would get permission denied error.
[Sony Cross-Device General] memphis77:
Could it be that the download link is down? Any alternativ

Gesendet von meinem F8331 mit Tapatalk
[Sony Cross-Device General] memphis77:
Solved

okay managed to download the file.

downgraded to mm run backup ta but it always says device not found. i tried it in fastboot, flashmode and in just regular on.

usb debugging is on and also unknown sources. whats the catch?

error: device not found

error: device not found

error: device not found

Running on on 32-bit platform

Pushing files

Pushing files/dirtycow32 to /data/local/tmp/dirtycow

error: device not found

error: device not found

Pushing files/run-as32 to /data/local/tmp/run-as

error: device not found

error: device not found

Pushing files/exploitta32 to /data/local/tmp/exploitta

error: device not found

error: device not found

Pushing files/dumpta32 to /data/local/tmp/dumpta

error: device not found

error: device not found

Pushing files/checkta32 to /data/local/tmp/checkta

error: device not found

error: device not found

pushing push files/backupTA.sh /data/local/tmp/backupTA.sh

error: device not found

error: device not found

Running scripts to dump ta to "TA___12102017-1033.img" on device

error: device not found

Pulling image

error: device not found

Cleaning up

error: device not found

TA Backup Failed!! Please reboot and try again.

NOTE: If you are running Android Nougat, you need to downgrade to use this tool.

Drücken Sie eine beliebige Taste . . .
[Sony Cross-Device General] HEKER510:
Xperia L1 no backup drm please update this program bro please
[Sony Cross-Device General] Wesley_NL:
guys somehow i get error device not found , how should i do this? i dont get this guide, its not as clear as rooting samsung guides, i downgraded to 6.0.1 for this
[Sony Cross-Device General] Macsek:
Of course you need to flash a stock ROM, losing root.

Restoring TA would re-lock your bootloader, locked BL can only load signed sony kernels, all of which contain RIC and dm-verity.

---------- Post added at 03:58 PM ---------- Previous post was at 03:48 PM ----------

Thanks for this tool for [MENTION=962182]rayman[/MENTION] .

It works for my Xperia Z, but does not work for my previous nor current Z5c running stock Lollipop 5.1.1 (32.0.A.6.200 Australia).

However iovyroot 0.4 does work.
[Sony Cross-Device General] Mostafa.Manouchehri:
can someone please explain how to restore this?

from this topic.and the guides,i got nothing.

Thanks

p.s:My phone is xperia x
[Sony Cross-Device General] shoey63:
What are you trying to achieve by restoring? There are methods of simulating TA keys on unlocked bootloader, eg rootkernel, TA PoC.
[Sony Cross-Device General] Mostafa.Manouchehri:
Oh hi?

Before i unlock the bootloader,i made a backup of my drm.

Now i want to restore it(to pure stock)

If you know,Please help me
[Sony Cross-Device General] shoey63:
I did a test a while ago https://xdaforums.com/showthread.php?p=69972315
[Sony Cross-Device General] Mostafa.Manouchehri:
That what i ment.

I got nothing about this guide.

Push Ta backup to Where?Via what?(I mean file manager included in Twrp?)

And the next step

What should i do about Adb shell?

Enter the code in Terminal in twrp or something?

And terminal says:No adb shell

???
[Sony Cross-Device General] @kitokit:
reserved
[Sony Cross-Device General] rajdude:
works! Thanks!

Thank you!

I was able to backup my TA on my Z1 compact D5503

It created a .img file which is exactly 2.097.152 bytes
[Sony Cross-Device General] FallenSp:
I followed these topic tool to backup my Z3(D6633) DRM Keys backup, and I received this, my phone not is rooted and genered a file with 2048kb(2MB), a long time ago, I made a backup in my old Z1 and the requeriment to use that tool is the phone have to be rooted first and a file more smaller, that is not my case now, that worked fine? I attached a screenshot of the process, Thanks for all.

I know that is out of subject, but, if someday I want restore my backup, how I do that?

I saw something like run some adb commands, I need to be in the stock to run or can I run in a custom rom, turn off my phone, and flash the Stock?

I am using a ukrainian version of Marshmallow, because Sony roll out a Brazilian version too late, can I restore this in any stock rom?

D6633 - Android 6.0.1 - 23.5.A.1.291

Sorry for my bad english
[Sony Cross-Device General] FallenSp:
Up... Sorry about the flood, was nedeed ._.
[Sony Cross-Device General] josephnero:
[MENTION=4675598]shoey63[/MENTION]

I had an unlocked bootloader which I locked with my TA-back up.the question is if I reunlock my bootloader can I use the same TA-back up to relock or I need a new back up file?
[Sony Cross-Device General] shoey63:
You can restore the TA backup anywhere, anytime, any firmware if you have root. Just flash any pure stock firmware afterwards.
[Sony Cross-Device General] josephnero:
Thanks for the reply. Just to be clear the TA image always stays the same no matter how many times you unlock and relock?
[Sony Cross-Device General] shoey63:
It changes over time due to the logging area, but the original can always be reflashed.

You can safely restore on N or O, even if backed up on MM if that's what you are worried about.
[Sony Cross-Device General] josephnero:
Thanks a ton. I'm mashing the thanks button but getting unfortunately can't have more than eight thanks per day which is weird. Haven't thanked anyone recently. Will try again tomorrow. Thanks again
[Sony Cross-Device General] CAL7:
I'm getting an X Compact tomorrow, so investigating the root methods. After reading this entire thread, I'm confused by the above. I'd appreciate any explanation you might be able to provide.

If I backup the TA, then unlock the bootloader and root; does the quoted passage mean I can never restore to a locked state? Or does it simply mean that I have to flash a stock firmware and then TA restore is possible?

Thank you!
[Sony Cross-Device General] M1chiel:
The latter: if you restore the TA your bootloader relocks, and you can only boot a stock rom.
[Sony Cross-Device General] G-UN1T:
good one, thanks
[Sony Cross-Device General] toussaintjames:
what were all the steps u took to restore your TA.img

please tell me

what to type into command prompt