[Sony Xperia XZ Questions & Answers] DHGE:
[Guide] Here is the DHGE guide for rooting SONY devices 2019-04

Changelog at the bottom of this post.

No - but you can find all you need to know here in this forum or in the devices-fora later than Z3+ or SONY-cross-device.

https://xdaforums.com/crossdevice-dev/sony

Good introductory (written for devices before Z3+):

https://xdaforums.com/crossdevice-dev/sony/noob-guide-to-sony-ericsson-xperia-t3209012

It is still valid but the 2015 and newer devices are not rootable anymore as described thanks to DM-Verity.

For rooting the current device you have to open the bootloader.

Any claims to the contrary found "on the web" are only tricks to have you install "interesting" software on a Windows PC.

Do you want root?

A classic post to help you decide

No:

wait for the OTA-updates from SONY (over the air - prosaic?)

don't like waiting or want to downgrade: get Flashtool http://www.flashtool.net

it comes with Xperifirm that finds you the latest ROM

https://xdaforums.com/crossdevice-dev/sony/pc-xperifirm-xperia-firmware-downloader-t2834142

Unfortunately Xperifirm only finds the latest ROM (the only available on SONYs servers) so you better keep your downloads (>2 GBytes each) or find an older ROM in case you need it (xda has a search function). Here you'll find some ROM-versions: https://xpericheck.com

since my Xperia XZ/XZ1 I occasionally have problems with Flashtool that it requires a FSC-script which does not come with it or can not easily be copied from a similar device.

Now I use Newflasher https://xdaforums.com/crossdevice-dev/sony/progress-newflasher-xperia-command-line-t3619426 by @munjeni. This is a command line tool that for me unfortunately only works under Windows (have JDK issues under Debian).

You unpack the ROM (ftf-file) and place the newflasher.exe in the directory where you unpacked to. Then you start the device in flash mode (power on while holding the volume down key) and run the tool from the command line as administrator/root.

If you do not delete userdata.sin you will initiate the equivalent of a factory reset (aka loose all your data and settings!). For an upgrade within the same Andoid version I always delete userdata.sin before newflashing.

Yes:

As stated above, you need to unlock the bootloader to modify the system software on your device. Fortunately SONY gives (for non-carrier-locked) devices the option to unlock the bootloader.

Check if unlocking is allowed: in the service menu (dial *#*#7378423#*#* or *#*#SERVICE#*#* ) check under "Service Info"->"Configuration" the line "Bootloader unlock allowed:"

If you read anything other than "Yes" Stop here!

No: flashing another SONY Rom ("Customized CountryX") does not help you.

Hint: there is an app "SONY service menu" in the app-repository (F-Droid or Google).

OK - you can :) Now it is your last chance to save your device keys or "backup the trim area partition"

You should do this if you ever want to return to a SONY "blessed" state. e.g claiming service in countries where warranty is not for devices with unlocked bootloader or you want to sell it.

There are some device specific kernels out there whose authors state that they mitigate all DRM issues once the TA is restored. I guess you need these kernels otherwise restoring the TA locks up your device ...

Otherwise do not bother with restoring the TA-partition. Doing so after the next steps will soft brick your device.

Now you have to prepare your PC with some drivers in order to start the backup process:

Go to SONY's developver world http://developer.sonymobile.com

Under "Downloads" you will find the drivers for the XZ or any other device https://developer.sony.com/open-source/aosp-on-xperia-open-devices/downloads/drivers

These drivers are for Windows, do not bother if you are running a free operating system.

To get fastboot running you might additionally have to find the "fastboot_driver" in the download area. Put the content of the ZIP-file into the directory where you you unzipped the device driver and install it via right-clicking on the file android_winusb.inf.

Install these drivers if you are a Windows user. Under Windows 8 and newer there could be problems with installing "non signed" drivers.

Do a web/xda search to circumvent this security measure of Microsoft or do click on reboot while holding the shift-key and figure it out yourself.

http://www.flashtool.net/win8drivers.php

When you are installing: You also need to install the programs adb and fastboot.

https://xdaforums.com/showthread.php?t=2317790

If you are running a free operating system: search for adb/fastboot or Android SDK in your repository and install these.

Running Linux it helps to insert the udev-rule mentioned in http://www.flashtool.net/lininstall.php otherwise you have to run esp. fastboot with root-privileges (not recommended, although the udev rule saves no punches ...)

On Android on your SONY device you have to be root to save a partition - catch 22 :crying: ...

https://en.wikipedia.org/wiki/Catch-22

Don't fear the ... / catch: For Android Marshmallow ROMs, e.g. up to version 39.0.A.3.30 of the Xperia XZ ROM, exists an exploit of the copy on write function in the Linux kernel that gets you root privileges temporarily.

On newer devices where there is no Marshmallow ROM with a vulnerable kernel available you are out of luck until another exploit is found.

Follow https://xdaforums.com/crossdevice-dev/sony/universal-dirtycow-based-ta-backup-t3514236

Hint: In post #21 is described how to restore the TA (read the last sentence! -> you have to flash a stock ROM after restore).

If it does not work the first time let the tarnished bovine do its stride several times more.

Or: Repeat the process until success.

If you are already on Nougat you must downgrade the system ROM (see above) to use the exploit and backup the TA-partition.

The latest exploit that is available for devices that came out with Oreo uses a different exploit.

Search for this exploit in the specific forum or on "Sony Cross Device". If you are already on Pie you have to download an Oreo ROM for your device.

This is similar to the procedure described above that has the Xperia XZ in mind.

TA-partiton backed up?

Now the non-reversible part:

Under http://developer.sonymobile.com/unlockbootloader/ you request an unlock code.

READ, READ what SONY have written there!

- You will lose some DRM functionality: https://xdaforums.com/z3-compact/general/loss-drm-keys-t2890936

- Your device will factory reset. You have a backup?

You can get the IMEI-number from the original package of your phone (if you have good eye sight and nobody swapped the boxes) or pull a tab from the side of the phone (you do not want to do that) or print a screen shot of the relevant page of your service menu or head into settings->about device->status->IMEI-Info.

You follow SONY's instructions to unlock the bootloader and hold your breath as after a long reboot everything on your device is wiped. On the newer devices you get an ugly warning "the device can't be trusted anymore".

NEVER EVER enable the MyXperia software from now on!

On some devices this in combination with an unlocked bootloader will hard brick your device.

Here was a link to fxpblog where they destroyed two devices.

Hey, you have been warned. With the TA-backup you always can return to the chicken den. :p

Become a "developer"

- Tap seven times on the build number of your device. (settings->device info)

- then enable "OEM unlocking" (new for the 2016 and later devices like XZ) and "USB-debugging"

You have read the SONY advice?

Next decision: Root stock ROM or go Custom Rom?

I am VERY happy with LineageOS on a Tablet Z and other devices in my household. I liked the Resurrection Remix ROM on my SAMSUNG phone.

Your mileage may vary: Testing a ROM and reversing will cost you with a proper backup minimum 4-5 hours.

If you choose a custom ROM:

- read the thread to get a hunch if you really want to install it (get over the off topic noob questions and annoying full quotes)

- Follow the instructions of the first page of the ROM-thread to install it. If you can not do this: stop or be prepared for searching and learning.

From February 2017 until May 2017 I had eXistenZ N on my Xperia XZ and like the UI tuning modifications. This "ROM" does not come pre-rooted it is a patch for the stock ROM (match the versions exactly!) that enhances the settings/look.

On SONY devices I recommend rooting stock ROMs.

Shortcut: Pie users can proceed to step 7 here :)

Having a custom kernel might still be advantageous for you.

You need a custom (or modified stock) kernel (aka boot image) with DM-Verity and SONY-RIC OFF.

This kernel has to be in sync with your ROM. Flashing an unsuitable kernel (e.g. MM-kernel on N-Roms) will result in a boot loop aka "soft brick".

You even can bake one yourself (no easy task) if you find/adapt the sources for your device. -> first stop SONY developer world

This is might be easy! THANKS to the efforts of @AndroPlus, @janjan and others.

You have to look into the device specific fora to find a proper kernel for your ROM-version.

They have also included many patches to improve battery life, mitigate some (e.g. camera) issues from the loss of the device keys ...

Download the kernel and recovery for your device and ROM-version and follow the kernel makers' instructions.

On devices where there is no custom kernel, you can try patching the stock kernel to switch off RIC and DM-verity. In reality behind the scenes it is a bit more than just patching (=modifying) the kernel. You also get some updated init-scripts and as a end result a new boot.img

Very useful is [PoC][Work in progress] Trim Area Proof Of Concept developed by @munjeni

These scripts not only prepare a stock kernel for rooting but also put your TA backup from above to such a use that you regain the DRM-features lost by opening the bootloader! So you do not need a custom kernel with partial DRM-fixes!

For Oreo it is more complicated (it might be easier to search for a suitable boot.img aka kernel and I have not tested it on Pie but see next step):

@serajr enhanced a script specifically for Xperia X Performance, XZ and XZs

https://xdaforums.com/showpost.php?p=74724162&postcount=2793

Under Linux I had to set the executable attributes on the shell scripts and binaries (chmod +x).

You get the required kernel.elf via the tools menu in Flashtool. Dump "kernel.sin".

I started applying the scripts to the Stock ROM in May 2017 since eXistenZ ROM lagged a bit behind in security patches and Android version:

- flashed stock ROM via Flashtool or Newflasher

- prepared a patched boot image with PoC and my kernel...sin and TA.img and answered all questions with "yes" (hit return each time)

./ta_poc kernel.sin TA.img ramdisk

I am on Debian as operating system.

On Windows you just run the provided batch files and follow the instructions here and in the thread for the scripts.

- flashed the resulting boot image with fastboot flash boot boot.img and test it works. Service menu/Security: keys provided YEAH :D

- flash recovery and from there root with SuperSU and flash Titanium Backup

- restored my apps with their data via Titanium Backup

==============

Some hints:

==============

Most of these commands emit useful info on the command line - read it, post their error messages if you are stuck.

Version numbers of the software used speeds diagnosis of problems. Often a good advice: "Use latest version."

adb reboot bootloader or switching OFF the device and then pressing the "volume up" button while plugging the USB cable gets you into fastboot mode. You see a black screen and the blue LED light.

I normally do not flash the kernel-ZIP-file via recovery but unpack it and flash this: fastboot flash boot boot.img

To get into recovery mode:

Switch OFF your device. Press the "power" button shortly to switch ON and hold "volume down" button more than 5 seconds (or when you see the yellow LED light on some devices).

Or: adb reboot recovery

If you can not get into recovery (e.g. AndroPlus has no kernel for your latest SONY ROM):

fastboot boot TWRP_latest_version.img

I use an SD card (content there survives factory resets) and there a directory "for_recovery" well stocked with the zip-files I intend to flash. In TWRP you can tell the file manager on what storage (internal, SD-card, USB ...) it will find the flashable ZIP-files. The default is "internal".

Pressing the Power button and "volume up" for about five seconds gives you a hard reset.

Good if you are totally struck - just flash a SONY ROM for your device with Flashtool and all the wipe boxes checked or use Newflasher (overwrites most partitions including your data).

If you like to read about the haarrrdddd way:

https://xdaforums.com/z4-tablet/help/enybody-root-t3154926

The first rooting of a DM-Verity secured device in 2015. Thanks to SONY for releasing source code and binaries.

Rooting - aaahh, finally

Flash the latest Magisk (up to late 2017 I used SuperSU which still works) from recovery.

https://xdaforums.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445

https://www.chainfire.eu/ Find the latest SuperSU from there. You will not find it there any more since Chainfire has sold the rights to the utility. I endorse Magisk since that is open sourced on GitHub.

No: flashing a custom kernel and recovery does not root your device.

For Android Pie users: On my Xperia XZ1 I can skip step 6 completely!

Just install/upgrade to the latest Pie ROM and flash Magisk and install the Magisk app.

Bonus: Debloat the device

https://xdaforums.com/search/forum/2522?query=debloat

Nowadays I use a debloat script written by @serajr for my devices https://xdaforums.com/xperia-xz2/development/oreo-debloat-script-v1-0-t3798979,.

I edit (comment out) the debloat_list.sh in order to keep "com.google.android.apps.maps" and "com.sonymobile.email" which I both use.

mine (you screened my script?):

flash the attached ZIP-file

View attachment 4000189

found in https://xdaforums.com/xperia-z5/general/discussion-bloat-sony-xperia-z5-t3518860 probably original work by @ganeshbiyer

=============================================================

With opened bootloader you will not get OTA updates any more!

You have to check with the Xperifirm program if there are newer ROMs for your device.

I have not had any problems with installing e.g. a Swiss ROM over a Central Europe. There could be some worries when switching continents.

Download the desired ROM via Xperifirm and follow the instructions of Flashtool to flash the device (over USB update = OUU :laugh:).

Accept the use of the FSC script.

Repeat the steps 5 to 6(7) for any other/newer SONY ROMs you flash followed by step 4 (if necessary).

If a wipe is needed I prefer the full wipe in TWRP compared to checking the boxes in Flashtool.

Or use Newflasher without flashing userdata.sin (just delete the file) in case of an upgrade.

=============================================================

CHANGES to this Guide

2023-09-17 updated the link for the SONY drivers @Whoopty did not find them

2019-04-23 updated for Pie, endorsed Newflasher, added link to serjars debloat script, link ckecks

2018-02-28 clarified getting kernel.elf for self patching, some typos, link ckecks

2018-01-31 link for better suited ta_poc added, toned down AndroPlus endorsement, added Magisk

2017-06-25 added link to xpericheck (find older ROMs), added hint for restoring TA for those TLDR-guys

2017-06-02 added procedure for patching stock kernel as alternative to custom kernels

2017-02-05 added recommendation for eXistenZ N ROM

2017-01-25 new URL for SuperSU, typos

2017-01-18 corrected the advice for booting into TWRP

2017-01-17 added info on fastboot driver for Windows users