yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] :
need to change somehow ta_info= parameter from kernel cmdline, as i'm wrote to you, it have precedence over tad_static command line ( i'm sure this is why ta_poc not sometimes not working on kernels with ta_info=1,16 )

this ta_info= line appended to kernel cmdline by semcboot.

tad_static only using start_block,number_of_blocks from it

if we can't modify kernel cmdline, then your idea with dummy block for kernels with ta_info=1,16 was absolutely correct ( copy empty 128k-block to the beginning of TA.img )
[Sony Cross-Device General] munjeni:
Yes mate that's a reason for my workaround!

Edit:

I have tried to change cmdline parameter but stil getting the same ta_info=1,16,256! Another thing which I found now is poc is not workingfor me with 1,16 :( One more thing which I found, kernel gets that appended cmdline parameters from tad_static! We definitelly need to make patcher for tad_static if we need cmdline ta_info=0,16,256
[Sony Cross-Device General] munjeni:
1. your phone model

2. your rom version

3. custom kernel or stock kernel

4. log of the poc

5. last kmsg

Wihout all that nobody can help you, we are not magicians to predict... :)
[Sony Cross-Device General] munjeni:
I have provided in latest version some patchingh mechanism for that type of boot.img, just look into patch_things.sh commented lines :)
[Sony Cross-Device General] xRevengerZee:
Phone model z2 D6503 rom existenz kernel is stock ofcourse I'll get u the poc log but how i can get the last kmsg?
[Sony Cross-Device General] munjeni:
You must use kernel from existenz rom, you can't use diferent kernel with diferent rom, thats first thing you must check
[Sony Cross-Device General] :
nope, this line comes from S1Boot

it is not problem to patch tad_static to ignore kernel cmdline, most easy way :

search for 2F 70 72 6F 63 2F 63 6D 64 ( /proc/cmdline ) and change it to anything, like 2F 63 72 6F 63 2F 63 6D 64 ( /croc/cmdline ) :)

after such patch tad_static will use arguments from command line, as we need.

but why tad_static not working with ta_info=1,16 and appended null block to ta.img ? all should be fine in such case ... what is error ?
[Sony Cross-Device General] xRevengerZee:
Yeah i know i ectracted kernel elf from this rom now tell me how can i provide you with last kmsg?
[Sony Cross-Device General] Hamidreza2010:
[MENTION=4471890]whalesplaho[/MENTION] bro find any solution for recovery?

[MENTION=4120742]munjeni[/MENTION] i think if somebody can make script for add recovery to kernel this problem will fix nah ? ( not used tobias script , just new one )
[Sony Cross-Device General] munjeni:
Please ask somebody in your device forum, I have z1c and I have no idea what is a name of the last_kmsg on your phone model, for me its in /proc/last_kmsg
[Sony Cross-Device General] munjeni:
I realy have no idea why I have no signal when I use 1,16 and appended dummy block to begin of the ta.img :(

Also tried...I have patched tad_static, changed ta_info= string to ta_aaaa=, searched for another ta_info string in /sbin and also in /system/bin found no more ta_info string, than appended ta_info=0,16,256 to the kernel cmdline in boot.img, booted and found that 1,16,256 again in kernel cmdline, wth? Seems ta_info is provided by bootloader? But on LP rom it is by default 0,16,256 and allso by default service tad_static /dev/block/mmcblk0p1 0,16, seems kernel is responsible for two diferent changes which bootloader doing? Used the same bootloader!

Does tad_static uses cmdline or tad_static patches cmdline? If I change to /croc do tad will use parameter from .rc??
[Sony Cross-Device General] munjeni:
No signal with this changes too:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00010C00 6D 20 41 72 65 61 20 64 61 65 6D 6F 6E 20 73 74 m Area daemon st
00010C10 61 72 74 69 6E 67 2E 0A 00 2F 63 72 6F 63 2F 63 arting.../croc/c
00010C20 6D 64 6C 69 6E 65 00 55 73 69 6E 67 20 74 72 69 mdline.Using tri
00010C30 6D 20 61 72 65 61 20 69 6E 66 6F 20 28 25 73 29 m area info (%s)
00010C40 20 66 72 6F 6D 20 2F 63 72 6F 63 2F 63 6D 64 6C from /croc/cmdl
00010C50 69 6E 65 2E 0A 00 25 75 2C 25 75 00 46 61 69 6C ine...%u,%u.Fail
00010C60 65 64 20 74 6F 20 70 61 72 73 65 20 74 72 69 6D ed to parse trim

When I start tad_static from terminal getting "Illegal instruction" which is part of the tad_static function. Does something other also uses ta_info? I have grep whole system and can't find anything. Also not understand why tad_static looks for cmdline, what is than usage of the .rc tad parameter? Why we have two parameters, one in .rc and another in kernel cmdline?
[Sony Cross-Device General] munjeni:
Hey, its ok using appended ta with 1,16 if this is fixable :)

I/tad ( 3314): Failed to query /data/local/tmp/TA.img as block device (Not a typewriter)
E/tad ( 3314): TA location is (partly) outside the device or file 4096 < 4352
E/tad ( 3314): Failed to configure TA library.
[Sony Cross-Device General] munjeni:
By this definitelly ta must have size of the 0x200000 ???

[COLOR="Red"] if ( v20 >= (((v6 + v5) << 8) & 0x7FFFFF) )[/COLOR]
{
//blabla
}
else
{
sub_AFFC(
3,
6,
"tad",
"TA location is (partly) outside the device or file %d < %d",
v20,
((v6 + v5) << 8) & 0x7FFFFF);
}
}

Edit:

yes definitelly! (0x11 << 8) & 0x7FFFFF) gives 4352 where 0x11 in dec is 17 blocks but trim area have 16 blocks only (0x10). Definitelly trim area must be 16 x 4096 so appended no chance to work! Don't know how it works for you :(
[Sony Cross-Device General] :
1.

tad_static using /proc/cmdline FIRST and if it can't find ( parse ) ta_info= from it, it is using arguments .

2.

i'm charged mine d5503 ( z1 compact ) phone, flashed it with 14.4.A.0.108

used ta_pos with dummy block + ta.img, ta_info=1,16

trim area working okay from first try ( all copied okay )

noticed, that tad_static failed to parse ta_info=1,16,256 ( using sscanf(ta_info, "%u,%u", start_block, nbr_of_blocks) == 2; ) so it always take arguments from command line ( from .rc file ) !

to be 100% i'm checked with ta_pos without dummy block + ta.img, ta_info=0,16

trim area working okay from first try

conclusion :

IF ta_info= from kernel cmdline will be ta_info=1,16,256 ( 3 digits ) - we do not need to add empty block and use ta_info=1,16

but things working even if we do it !

IF ta_info= from kernel cmdline will be ta_info=1,16 ( 2 digits ) - we NEED to add empty block and use ta_info=1,16
[Sony Cross-Device General] munjeni:
For me 1,16 not working (have no signal), and also one with appended block not work anyway! After looking into logcat (appended ta) getting some errors, see post above! Trim area definitely must have 16 x 4096 blocks (as you can see in ida)
[Sony Cross-Device General] munjeni:
By this definitelly we must use 0,16 see:

(((v6 + v5) << 8) & 0x7FFFFF)

where v6 is first parameter in our case it must be 0 and v5 is 16, it gives 4096 as expected, but if we use 1 + 16 its gives "TA location is (partly) outside the device or fil"

Stil have no idea what usage is ta_info when we have using things from .rc? FOr me 0,16 working, when I set 1,16 and/ornot apend dummy block its not working for me
[Sony Cross-Device General] munjeni:
But how you set ta_info=0,16 to commandline?? When I can mine /proc/cmdline its always 1,16,256 and no chance for change
[Sony Cross-Device General] :
told you -

tad_static failed to parse string from kernel ( /proc/cmdline ) ta_info=1,16,256 and it is using parameters 0,16 ( or 1,16 or whatever ) from .rc line

and i'm getting error:

I/tad ( 229): Using trim area info (1,16) from arguments.
I/tad ( 229): Failed to query /data/local/tmp/TA.img as block device (Not a typewriter)
E/tad ( 229): TA location is (partly) outside the device or file 4096 < 4352
E/tad ( 229): Failed to configure TA library.

when using TA.img WITHOUT dummy block ( TA.img size 2097152 bytes ) with params 1,16

but all working fine, when we using params 1,16 and TA.img WITH dummy block ( TA.img size 2228224 ) :

I/tad ( 230): Trim Area daemon starting.
I/tad ( 230): Using trim area info (1,16) from arguments.
I/tad ( 230): Failed to query /data/local/tmp/TA.img as block device (Not a typewriter)
I/tad ( 230): TA library configured on /data/local/tmp/TA.img (virtual block size 128kB, 16 blocks, start block 1)

check your TA.img size
[Sony Cross-Device General] munjeni:
I am a bit confused with your post and word "ta_info". ta_info is part of the kernel cmdline, rc file do not have ta_info! So please make this clear. For me conclusion part which you posted not working with 1,16 in .rc file even if I add empty block, but I have by default 1,16,256 in my kernel cmdline!
[Sony Cross-Device General] 2ddssa:
try repeat the latest stock .236
[Sony Cross-Device General] :
sorry for confusion, under ta_info in .rc line i'm understanding parameters

and i'm checked with 14.4.A.0.108 firmware :

- tad_static fails to parse ta_info=1,16,256 from kernel, so it using arguments from .rc line

- dummy block + TA.img working with parameters 1,16

- TA.img without dummy block NOT working with parameters 1,16 ( check in my previous post )

- TA.img without dummy block working with parameters 0,16

double check your TA.img size and .rc arguments

---------- Post added at 08:42 PM ---------- Previous post was at 08:41 PM ----------

please full firmware version
[Sony Cross-Device General] munjeni:
Hey, you are right! I am stupid since I forgot about ta script which copy ta img to destination only if there is not allready one, so my wrong :o Things is clear and I can confirm it working! So scripts no need to be changed even if ,256 is missingin kernel comandline, right? We are ok with dummy block in that case?
[Sony Cross-Device General] 2ddssa:
14.6.A.1.236
[Sony Cross-Device General] munjeni:
I can confirm this! Everything is ok but under service menu keys "none"
[Sony Cross-Device General] :
yes - we can add dummy and use 1,16 or we can NOT add dummy and use 0,16

---------- Post added at 08:52 PM ---------- Previous post was at 08:50 PM ----------

i'll get this firmware and check it

did you checked logcat right after boot and dmesg ? what is kernel cmdline and is tad successfully configured trim area ?

better to see logcat and dmesg outputs, of course ;)
[Sony Cross-Device General] 2ddssa:
If so - then great :)
[Sony Cross-Device General] munjeni:
Excatly, great! Can you check 14.6.A.1.236 , I didn't figured out bug, nothing in dmesg and nothing in logcat, everything ok but under service tests / security keys is NONE, strange :confused: , sim lock ok, bootloader status "unloc kallowed" ...and etc all ok except that keys none
[Sony Cross-Device General] munjeni:
Try to delete TA.img from /data/local/tmp and reboot!
[Sony Cross-Device General] munjeni:
Sorry but I don't know since I have xperia z1 compact so can't help you with it, hope somebody allready know about it and help you with it. Check maybe TA.img is deleted somehow from your data/local/tmp folder, don't know realy :)

New version is out! Fixed user script execution, now definitelly you can use your own script with our poc, see example script.bat for idea! Output path is provided to the script so you no need to search for your output patch, just use %1 parameter inside script to retrieve output path provided to program. :)
[Sony Cross-Device General] Soheil_rf:
Something wrong with dual sim phone, i test it on xperia z5 dual, results is same

Everything's good but without mobile signal
[Sony Cross-Device General] munjeni:
Is not you said it worked last time? I can eventualy fix only if you post your kernel message (dmesg) to http://www.pastebin.com
[Sony Cross-Device General] Soheil_rf:
Yes but after some random reboot signal is gone

Update : Sent it :

http://pastebin.com/u7zMsaQQ
[Sony Cross-Device General] munjeni:
That happened after you disabled ric and dmverity?
[Sony Cross-Device General] Soheil_rf:
Yes
[Sony Cross-Device General] munjeni:
Well, I have made another version, and updated some tools and also provided new example script.bat, you can look into your dmesg and try to fix things by self. I can see a lot of denials in you dmesg including one for ric! Writing to ric is denied from some reasons, you will need to fix byself all denials. I will help you a bit with this example from your log:

avc: denied { [COLOR="Red"]write[/COLOR] } for pid=641 comm="rmt_storage" name="rmts" dev="debugfs" ino=8165 scontext=u:r:[COLOR="DarkGreen"]rmt_storage[/COLOR]:s0 tcontext=u:object_r:[COLOR="RoyalBlue"]rmts[/COLOR]:s0 tclass=[COLOR="DarkOrchid"]file[/COLOR] permissive=0 ppid=1 pcomm="init" pgid=1 pgcomm="init"

You can fix that denials one by one by next way. Make script.bat file and put something like this into that file e.g:

nougat_ta_poc [COLOR="Green"]rmt_storage[/COLOR] [COLOR="RoyalBlue"]rmts[/COLOR] [COLOR="DarkOrchid"]file[/COLOR] [COLOR="Red"]write[/COLOR] %1/sepolicy@0644 %1/sepolicy@0644 NULL

or e.g. more permisions in the same time:

nougat_ta_poc [COLOR="Green"]rmt_storage[/COLOR] [COLOR="RoyalBlue"]rmts[/COLOR] [COLOR="DarkOrchid"]file[/COLOR] [COLOR="Red"]read,write,open,relabelfrom,relabelto[/COLOR] %1/sepolicy@0644 %1/sepolicy@0644 NULL

or if you need to make permisive type for e.g rmt_storage you can do it this way:

nougat_ta_poc NULL NULL NULL NULL %1/sepolicy@0644 %1/sepolicy@0644 [COLOR="Green"]rmt_storage[/COLOR]

Its 8 parameters. What mean every one:

<source type> <target type> <class> <perm>[,<perm2>,<perm3>,...] <policy file> <output policy file> <permisive_type>

So in short, you need to fix all denials from your dmesg and this is I think very clean how you can do it, I have no free time to mess with every device model its a lot of work, from that reason I have made free space for everybody to fine tune by using user script.

For more info I have provided an example script.bat fie in new version! I can eventualy fix some bugs if you found but I definitelly not going to work on 10 diferent models and 10 diferent roms, I think this PoC is enought from me. :) Fill free to make your own script for your device model and your android version, post it and hope everybody enjoy your script.bat, that will help other peoples understanding things a bit better, ofcourse I am here for any help :)
[Sony Cross-Device General] Hamidreza2010:
[MENTION=4120742]munjeni[/MENTION] bro i have question:

as you know if i want to make advance kernel ( or custom kernel ) which have twrp recovery or disable ric and .... , i should you this tool and guide:

https://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605

then , can i make and edit my stock kernel with above tool then used last kernel ( which have recovery or disable ric and ..... ) in your tool? ( for patch drm )
[Sony Cross-Device General] munjeni:
I have told about drm fix and our poc. Our poc is not working with perevious drm fix poc! Do not use our tool if you uses drm fix from tobias, that have no sense. By the way you can execute whatever you need trought script.bat including tobias tool or whatever you want. You can patch previously tobias patched boot image for paching with our poc, yes but you need to remove drm fix from tobias patched boot image first! Maybe better idea to patch your stock kernel with this tool first that use tobias tool for patching the rest (skip drm fix prompt).
[Sony Cross-Device General] Hamidreza2010:
bro i dont know how to make script.bat including tobias tool.

then i patch my stock kernel with your tool ( for patch drm ) then patch this kernel with tobias tool for add recovery and disable ric ( press all ting yes except drm fix )

is it true way?
[Sony Cross-Device General] munjeni:
First of all script about what I say is not for non experienced users, it is for experienced users who know what he can do with it, script can extends a lot our tool, but if you are not experienced remove script.bat and forget about script.bat! Download new version from here first http://munjeni.myiphost.com/ta_poc.rar , than patch first your kernel with my poc, than use tobias tool for the rest (skip drm fix on prompt) and you are done. Make sure after all that copy TA.img to your device /data/local/tmp , done.
[Sony Cross-Device General] Hamidreza2010:
Ahhha thats exactly which i want.

thanks.

just for last question:

how can i copy TA.img to my device /data/local/tmp ?

With which command or which way?

thanks a lot for your great tool bro
[Sony Cross-Device General] fluffi444:
Thanks for your effort.

script.bat was renamed that it will not start.

Process looks ok

...but kernel is not booting. No nothing. Only black screen like phone is completely off. Its reacting on power button with usual short vibration - then nothing... Boot into fota recovery is ok and working...

Output of Tool (if usefull)

http://pastebin.com/h1TyHc4k
[Sony Cross-Device General] munjeni:
Use adb to push it
[Sony Cross-Device General] munjeni:
You have used my TA.img, thats a first thing I have noticed :) You must use your own TA.img not one from ta_poc, thats example only! Can you give me original kernel image?
[Sony Cross-Device General] mcgi5sr2:
This is great news, thank you for all the hard work [MENTION=4120742]munjeni[/MENTION] . One thing is I am unsure if I have the TA backup for this device or an older Z3c that had to go back to be fixed. Are the TA partitions unique for each device somehow? If not could we start shipping a general one for everyone at some point?
[Sony Cross-Device General] munjeni:
In you pastebin I see strange thing, first one is line 113, seems kernel command line contain new line! Seccond strange thing is line 116, ("amdiskoff="0x02000000)
[Sony Cross-Device General] munjeni:
I will update tool a bit
[Sony Cross-Device General] Soheil_rf:
I tested this tool and it works well on my XZ Dual .417 FW

DRM keys works as it should, DM-Verifiy disabled after i flash SuperSU

The problem is Sony RIC

I try to disable it with previous method, it works but I lose my phone signal.

Maybe [MENTION=3989065]serajr[/MENTION] can help

Thanks body
[Sony Cross-Device General] 2ddssa:
I rolled on my backups and restored the TA section, maybe tomorrow I have the night, most likely I'll go to sleep
[Sony Cross-Device General] serajr:
Guys, is this helpful?

kernel_cmdline binary is part of Adrian DC's Sony Stock Patcher (v1 only). Script code snippet:

# Inject the permissive cmdline
chmod 777 /tmp/kernel_cmdline;
/tmp/kernel_cmdline --inject="${BOOTIMAGE}" --cmd_append="androidboot.selinux=permissive";
/tmp/kernel_cmdline --inject="${BOOTIMAGE}" --cmd_append="enforcing=0";

Can kernel_cmdline change ta_info?
[Sony Cross-Device General] munjeni:
That tool injects command line to an allready compiled boot image, But no way changing appended kernel cmdline since bootloader append some of the new lines like sn, imei and etc on boot, anyway no need changing anything since we have workaround for appending dummy block to the start of the ta.img in case 1,16 and it works in all case :)
[Sony Cross-Device General] munjeni:
To all who uses newer poc, please delete TA.img from /data/local/tmp and reboot! New one will be auto created on next boot, do reboot again and you are done. Do this thing everytime when new poc version come out please, do the same if you change kernel!
[Sony Cross-Device General] whalesplaho:
no solution brov... really wishes to use poc!
[Sony Cross-Device General] serajr:
Bro, why do you actually need twrp integrated into kernel?

What about fotakernel's twrp recovery (Androplus / shoey63)?
[Sony Cross-Device General] whalesplaho:
thought its tha best way.... can yhu point me to dat or a small tut will be nice please.

thanks!
[Sony Cross-Device General] serajr:
- UB :p

- Download TWRP-3.0.2-2-E6653.img and rename it to twrp.img

- fastboot flash recovery twrp.img

- Unplug usb cable (do not reboot)

To enter TWRP:

- Turn device on by pressing Power and Vol Down buttons at same time, after vibration release Power button only, and later Vol Down

- You're done
[Sony Cross-Device General] xRevengerZee:
I can now confirm it's working great device z2 :D6503

Rom:Existenz

Kernel:Elite v3 but i thought it doesn't work on custom kernels?
[Sony Cross-Device General] x_one:
It should work or any, but while testing it's easier when you don't have custom mods that can bring some bugs.
[Sony Cross-Device General] xRevengerZee:
Aha great next step I'll test it on aosp pure nexus 7.1.1 rom
[Sony Cross-Device General] whalesplaho:
Isnt tha kernel already has drm fix?

So dnt think its poc dah works...
[Sony Cross-Device General] x_one:
Yes. You have to remove drmfix lib and modify rc file (where lib is included) while ramdisk is decompressed. Then it will work. :)
[Sony Cross-Device General] levone1:
Please post about progress on AOSP. I've been messing around, but don't know much. I can get new boot IMG with ta backup, but when flashing, it boots fine with no sim and no DRM.
[Sony Cross-Device General] zohaib0001:
[MENTION=4120742]munjeni[/MENTION]

I used the latest version of POC on Nougat 7.0 Xperia XZ

its working fine, but one thing that not work is Sony_Ric disable script. It's always said while patching "Warning, no $RAMDISK/init.sony-platform.rc "

Any how i modify sony_Ric disable script to work with nougat firmware if anyone need it just download and replace it in script folder

Thanks for your Work
[Sony Cross-Device General] whalesplaho:
ta_poc/ramdisk/vendor/lib and delete libdrmfix for lib & lib64 folder but what do yhu mean by modify rc i dnt understand and after dah shud i run tha code in cmd again buh wont tha kernel img file still produce tha libdrmfix again since i didnt delete it in tha kernel img file itself.

Thanks.
[Sony Cross-Device General] xaaaj:
USB connection (MTP) and charging does not work when using Fotakernel twrp do you know how to fix this sir or some work around to fix it im using androplus Twrp build. thanks my phone is Z5 (E6653) :)
[Sony Cross-Device General] ab123321:
Hi [MENTION=4120742]munjeni[/MENTION] !

I have Sony Xperia XZ, running on Nougat and I got this PoC working without patching sepolicy.

I used /dev tmpfs instead of data partition. Also, I stored TA.img not in ramdisk, but in persist partition (it's very nice place to hold necessary files tho). Then moved ta script from /stufs/bin/ta to /init.ta.sh, removed busybox, and made it look as

#!/system/bin/sh

if [ -e "/persist/TA.img" ]; then
cp -fr /persist/TA.img /dev/block/fake-TA
fi

if [ -e "/dev/block/fake-TA" ]; then
chown tad.tad /dev/block/fake-TA
chmod 770 /dev/block/fake-TA
chcon u:object_r:tad_block_device:s0 /dev/block/fake-TA
fi

It works OK now

Also, it's possible to copy real TA partition to /dev/block/fake-TA if dump isn't found in /persist
[Sony Cross-Device General] serajr:
I'm not kernel and/or recovery developer. You should ask for help about that at Androplus Kernel thread (Z5 forum)!
[Sony Cross-Device General] serajr:
Are you patching stock kernel?

Why did you remove the sepolicy related lines (blue), which are responsible for allowing securityfs to be r/w?

[COLOR="Blue"]local sepol=$(find_file $RAMDISK/sepolicy)
$POC init securityfs file write $sepol $sepol NULL >/dev/null 2>&1[/COLOR]
[COLOR="DarkOrange"]if [ $? -eq 0 ]; then
ui_print " Success"
else
ui_print "$?"
fi
[/COLOR]

Also, orange lines are related to blue lines (POC function error handling)!
[Sony Cross-Device General] x_one:
I don't remember for sure but check init.target.rc and search for name of the lib you remove. If you find it remove it with : in front of the name.
[Sony Cross-Device General] munjeni:
OMG. Guys, I have tested recovery right now on my device, what I found? I found there is two functions related to volume up and volume down button. Volume up starts fine twrp recovery, so I can confirm it boots! Volume down is designed to start internal recovery (fota recovery) and in my case I have the same boot loop like you have! Reason - I have stock fota recovery! Bootloop is expected! I sugest you next time please try booth buttons! ;)
[Sony Cross-Device General] munjeni:
Can you give me strings which I need to remove, I will integrate autoremoval in next version if you give me info what I need excatly to remove
[Sony Cross-Device General] munjeni:
I found also bug about that on my device since my device string is totaly diferent, probably fix in next version!