yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] Dave_247:
I made sure to re-flash my phone using the stock image each time, then patch the boot image and then use either Magisk or Super SU, but not both of course as I know that stuffs things up. Point is even after trying to install SuperSU properly after a clean flash it crashes too, and I have to use ta_poc as otherwise it fails trying to install when trying to mount the ramdisk. This was using version 2.82 SR3

I've attached the crash log and sepolicy too from the crash with SuperSU for you to compare if you want to see if it's any different.

Anyway I just realised I can give you the kernel image from the downloaded Sony image for you to exact can't I? I've attached that to the post, the same file I've been using to run through ta-poc each time to path it.
[Sony Cross-Device General] munjeni:
im not at home now but on firstblook intonkernel crash log I can see the same vendor sepolicy isue! Will let you know when I compare sepolicy! Thanks!
[Sony Cross-Device General] salsabreak:
I flashed the new_boot.img but still no keys. Is my TA.img broken?
[Sony Cross-Device General] mbc07:
Some advice on Magisk: you guys should debug this while running on Magisk v13.1 at least, topjohnwu did some changes specifically aimed at Sony devices on that version, like properly detecting Sony ELF boot images. I know the device generally randomly reboots before reaching the lock screen when Magisk works on top of ta_poc but you still have a small time frame where you can catch the crash logs through ADB.

Another thing I discovered recently that should be very useful, at least on recent Xperia devices (I can confirm that on Xperia X), there's a hidden system application on stock Sony firmware that allows enabling non-secure ADB, so you should be able to use ADB as soon as the Sony logo appears when booting the phone (e.g. to pull log files before the phone reboots after installing Magisk), to use it, you should start the activity com.sonymobile.coresettings/.CoreSettingsMainActivity either through ADB shell or through an app like Activity Launcher, then mark the checkbox and reboot the device to apply. Keep in mind you must not be using a ta_poc generated boot image whenever you want to toggle this setting (the old DRM fix is fine), otherwise nothing will happens. For a more detailed (and a little lengthily) explanation of why, read the spoiler below...

When you mark/unmark the checkbox, the app will tell tad binary to write the preference into a specific TA unit. Due the way ta_poc works, if you're using a ta_poc generated boot image when toggling this option, that TA unit would get written to the local TA.img in /data/local/tmp instead of being written on the actual TA partition from the device, and as such, on subsequent boots, the bootloader wouldn't know you've enabled this option and thus ADB won't start early on the boot process. If you want an easier way to revert this setting to default (e.g. without needing to switch back and forth through stock boot image and ta_poc boot image), there's a file named reset-non-secure-adb.ta on FTFs of all Xperia devices that supposedly have this feature, you can simply flash it through FlashTool (Advanced => Trim Area => S1 => Flash TA file) to revert this setting to default.

That's the same reason of why you can't factory reset your phone when using ta_poc. If you never tried, trying to do a factory reset while using ta_poc will simply reboot the phone without doing anything. My guess is that when you choose factory reset in the settings app, it also writes into a TA unit before rebooting the phone to inform the bootloader it should format the data partition on the next boot, but since that unit would get written to the local TA.img in /data/local/tmp instead of being written on the actual TA partition from the device, the bootloader never get informed that the user triggered a factory reset and thus don't do anything...
[Sony Cross-Device General] munjeni:
To make this clear, PoC is apsolutly unrelated to crash caused by magisk! PoC is tool made for mounting trim area dump to loop to emitate real trim area partition, PoC can't be a cause for curently boot loop caused by magisk! If you don't believe just use stock kernel without PoC and the same boot loop isue you will notice!
[Sony Cross-Device General] munjeni:
Hi thanks! On first look (didn't made comparation right now but today I will make a full diff) I have noticed that stock sepolicy have size 379kb but patched one have size 304kb :eek: , thats first indicator for messed up sepolicy because 75kb is removed from stock sepolicy!! SuperSu-crash zip is after supersu installation or after magisk installation?
[Sony Cross-Device General] Dave_247:
[MENTION=5604590]mbc07[/MENTION]

Thanks for the tip about non-secure adb. I wouldn't have even thought to look for something like that and it would be very useful to access the phone in it;s early booting state.

However I must concede and apologise that a big part of this has been my fault, as I have been acting under my own false pretences.

It was my understanding that the only way to retrieve the kernel crash log, and sepolicy located in the root directory I would need root, and that the phone would need to at least successfully boot once for root to take effect. However, the I seem to have been wrong on the second part, as I have been able to access both directory's in my phone using the file manager in TWRP despite the phone having not successfully booted after being rooted. It was how I was able to get the files after installing SuperSU.

[MENTION=4120742]munjeni[/MENTION]

Now with that out of the way I am able to provide the files after installing any version of Magisk v13+ Attched is the kernel crash log and sepolicy after installing 13.1, 13.3 and 13.6

(Re-flashing my phone with the stock image through Flashtool each time of course and letting it boot normally at least once, before installing TWRP, the ta-poc boot image and then finally Magisk.

I also have not been manually wiping any partitions as the few times I have it did not seem to make any difference, and would just require me to go through the first time setup after wiping /data. I don't think this should be affecting the results, but seeing as I proved myself wrong once before I wanted to mention it in case I have been wrong again.)
[Sony Cross-Device General] Dave_247:
The SuperSU one was only ta-poc > SUperSU. Didn't use Magisk at all.
[Sony Cross-Device General] munjeni:
Uh, probably you gaved sepolicy of the recovery? Since diferencies between the two sepolicies in your attachment is soo huge (see attachment), lines with '-' is removed sepolicy stufs and lines with '+' is added sepolicy stufs, I'm believing you provided wrong sepolicy (probably one from recovery) :(

Can you dump boot partition trought recovery after installing magisk? Do that using adb "dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/boot.dump" than disconnect from adb and pull dump to your pc "adb pull /boot.dump"
[Sony Cross-Device General] munjeni:
Hey I will install your stock kernel right now to my device and install magisk and dump byself stufs, you no need to do that, I think thats the better way to save booth your and mine time. Thanks anyway!
[Sony Cross-Device General] munjeni:
Is ok to use magisk 13.6 ??
[Sony Cross-Device General] Dave_247:
Oh ok if you're sure, and sorry for the trouble. I didn't realise there was more then one sepolicy as the ones I had been copying were located in "/'.

It's up to you. I only tried 13.6 in case it made a difference at all.
[Sony Cross-Device General] munjeni:
Thats definitelly recovery sepolicy since you was in recovery mode and just copied stuff from / :)

How you got magisk installed? Using your stock kernel I'm getting recovery error "magisk can't be installed on stock kernel" :confused:
[Sony Cross-Device General] munjeni:
I will patch your stock kernel first with poc (hope I no more get magisk stock kernel installer error message), and will install magisk just for having sepolicy after magisk, will let you know the result

Edit:

done. Now rebooting to ubuntu and will provide full diferencie between two ramdisks and between sepolicy, let see whats going on :)
[Sony Cross-Device General] Dave_247:
It's why I had to patch the kernel with poc each time, even with SuperSU as it would error otherwise. I should note though that the kernel I gave you was from the 34.3.0 stock image, which is Andorid 7.1.1 that came out a few months ago.

I remember however that when I used to be on 34.2.0 which was only 7.0 that while I did have issues it was a lot less. I'm currently re-flashing the older stock ROM onto my phone and writing down what the differences are (ie what worked and didn't work) as by now I'm rather convinced that Sony seems to have changed something with their kernel in the newer version.
[Sony Cross-Device General] munjeni:
Hey but hope you know that allready, you can't just use diferent kernel e.g. kernel from lolipop inside marchmallow rom! Or e.g. aosp kernel inside lineageos! I'm hope you tested unmodified kernel first and was sure it boot?
[Sony Cross-Device General] munjeni:
Diferencie between boot image before and after magisk:

diff --git a/ramdiskstock/init.rc@0750 b/ramdiskstock/init.rc@0750
index 9a5ef91..7d517ea 100755
--- a/ramdiskstock/init.rc@0750
+++ b/ramdiskstock/init.rc@0750
@@ -4,6 +4,7 @@
# This is a common source of Android security bugs.
#

+import /init.magisk.rc
import /init.environ.rc
import /init.usb.rc
import /init.${ro.hardware}.rc
@@ -303,6 +304,7 @@ on post-fs
mount securityfs securityfs /sys/kernel/security nosuid nodev noexec
write /sys/kernel/security/sony_ric/enable 1

+
start logd
# once everything is setup, no need to modify /
mount rootfs rootfs / ro remount

And two new files is created:

ramdiskstock/init.magisk.rc@0750
ramdiskstock/sbin/magisk@0755

I'm not sure right now if I have removed dmverity or magisk done it allready, but thats ok no prob at all.

Going to give you now diferencie in sepolicy!
[Sony Cross-Device General] Dave_247:
Yes I know, I was always using the stock kernel from 34.3.A.194 which was the very same rom that I installed on my phone released by my carrier.

Plus, 7.1.1 is still Nougat so you wouldn't expect there to be that much of a change to 34.2.A.0.266 which was 7.0 and the previous rom that my carrier released, but from the added problems with rooting that obviously isn't the case.

[MENTION=5604590]mbc07[/MENTION] I noticed that from your signature you are currently using 34.3.A.0.217 which I assume is also 7.1.1. Is there anything you might have to add to this?
[Sony Cross-Device General] munjeni:
[MENTION=4925991]Dave_247[/MENTION] I see you have problem with supersu too, but did you tried another supersu? For example this one is working fine for me on LineageOS 14.1 http://munjeni.myiphost.com/LineageOS_14.1/SuperSU-v2.82-201705271822.zip it will in most case work corectly on any nougat
[Sony Cross-Device General] Dave_247:
Uh, well... don't worry about that. With all the rebooting (and me slowly loosing my mind in the progress) I was a bit of an idiot and forgot that SuperSU will always reboot once after installing before booting normally into Android. I tested it again with more patience and it worked, so no problems there.

I think I've said enough about this issue and there probabbly isn't much else I could add that would actuality be helpful going forward.

Thanks a lot [MENTION=4120742]munjeni[/MENTION] for all the hard work you've put into ta_poc, and trying to diagnose this issue even though it wasn't directly your problem. Hopefully now the magisk devs will be able to do something with the information you've uncovered, and trust what you have to say being a more experienced developer yourself.
[Sony Cross-Device General] DuskGolem:
[MENTION=4120742]munjeni[/MENTION], i am using modified kernel from your tool with SuperSu in Xperia Z5 Premium. Everything is fine. Problem is when i make system writeable by entering command in terminal "mount -o rw,remount /system" after about 10 seconds my phone reboots. I am using tremux terminal along with jrummy busybox and SuperSu. I didn't have this problem with previous poc, Please fix this....
[Sony Cross-Device General] munjeni:
Thats not poc problem. And how you know for sure that it was poc isue? It look like busybox problem! Try to use parameter "busybox mount ..." instead of "mount ...", standard mount command from stock rom is known to have problem, use busybox mount! At least you can catch kernel crash log to get more idea
[Sony Cross-Device General] DuskGolem:
[MENTION=4120742]munjeni[/MENTION], brother i have tried the command with busybox but the resuly is same. If i run the command with or without the busybox parameter my phone reboots within 10 seconds. I did not have this problem with root kernel. I am not even using magisk with your poc. I am using ta poc+SuperSU arrangement with absolutely no other problem then this.

P.S: PLEASE SOMEONE TELL ME HOW TO GET THE KERNEL CRASH LOG ON XPERIA Z5 PREMIUM. Gosh, need it desperately...???
[Sony Cross-Device General] mirhl:
su
dmesg > /sdcard/dmesg.txt

In another terminal window.

Or grab /proc/last_kmsg file after reboot.
[Sony Cross-Device General] DuskGolem:
[MENTION=4900593]mirhl[/MENTION], i cannot find the file /proc/last_kmsg after crash...
[Sony Cross-Device General] realtuxen:
From my dusty old memory I am pretty sure I seen the same reported in other posts around if sony ric is somehow being enabled after boot and you try to mount system. No idea if this is entirely correct or how to fix it, so please don't grill me for my 2 cents. :)
[Sony Cross-Device General] klausstoertebeker:
boot.img with TWRP installed

Hello,

I have just a simple question:

If I got it right the TA_POC tool will only process original stock ROM. My question is:

Is a boot.img with installed TWRP recovery (without any other modification) considered as stock ROM or is this already a custom ROM?

Thanks for help and greetings from Germany
[Sony Cross-Device General] munjeni:
You can try! I'm added support for most diferent boot images, just check for error, no error means that all is ok.
[Sony Cross-Device General] klausstoertebeker:
Hello munjeni,

first of all thanks for your fantastic work! Your tool is working fine and I can confirm that my Sony Xperia Z5 compact looks like never been unlocked and rooted :good: :good: :good:

But I've run into a problem installing a custom recovery ("TWRP 3.1.1-0") into the boot image using your tool. After flashing the patched boot image:

booting normally into operating system starts up the Andoid system without problems and it is running fine after finishing boot :)

booting into recovery (no matter if the boot is initialized via adb command or pressing some buttons during power up) ends up in a bootloop (first the "Sony"-logo is shown, then the LED lights up blue shortly and the boot process stucks in showing the "Sony"-logo") :(

I don't know what's going wrong so may be you can help me to be able to boot into recovery. To build my new kernel I used the following files and settings:

Stock kernel extracted from "Android "Marshmallow 6.0.1" (Build 32.2.A.0.253_1298-1220_R2C)"; please don't ask but I want to use this kernel for some reasons

Recovery "TWRP 3.1.1-0 for Sony Xperia Z5 compact (Suzuran)"

my TA image (not attached to this thread; size is about 2 MByte and it was usable when building a boot image without recovery)

"dm-verity" disabled

"Sony RIC" disabled

Thanks for help

"klausstoertebeker"

PS: It would be nice if you would implement the possibility to integrate/install ".zip" files into the patched boot image so that you can install for example "Magisk" in the same step building the new boot image :)

Edit 1:

I tried the same process for my Sony Xperia Z3 Tablet compact (SGP) with firmware "SGP621_23.5.A.1.291_1290-4945_R3D.ftf" (download via "XperiFirm"), "TWRP-3.0.2-0 for Sony Xperia Z3 Tablet compact (Scorpion)", my TA Image and the same settings as above. And the Android System as well as the TWRP recovery boot without Problems.

Edit 2:

After searching the Internet if there were issues with "TWRP 3.0.2-0" for Sony Xperia Z5 compact I found ourt that I pressed the wrong Buttons (correct process: press power and volume down, release power immediatly after phone vibrates and hold volume down until the TWRP-Screen shows up) and TWRP recovery is entered without Problems. But I still haven't found out why I can't enter recovery via fastboot.

I was happy to be able to flash zip files again and installed Magisk v14 for which I needed TWRP :) But now I'm stuck in a bootloop starting Android :rolleyes:
[Sony Cross-Device General] YamiYukiSenpai:
Man, I wish I found this before I switched to LineageOS on my Xperia Z5 Compact.
[Sony Cross-Device General] Meloferz:
Hi, someone that tried PoC with Xperia X or a model above please can confirm if boot up message “your phone is untrusted ” is gone after using PoC?

Enviado desde mi Xperia X corriendo Sailfish OS
[Sony Cross-Device General] RaXelliX:
I'm using it on X Compact and no - PoC as far as i know does not remove the unlocked bootloader message. This assumes PoC would be able to mask unlocked bootloader at phone start. It can do it after but not at start (correct me if im wrong). Currently the only way to remove this message would be to modify resource files.
[Sony Cross-Device General] DHGE:
No

This message comes from the bootloader.

PoC does not modify that at all.
[Sony Cross-Device General] militiaOfDeath:
Has anyone tried (and succeeded) in using ta_poc with 32.4.A.1.54_R5E and TRWP 3.1.1. and getting root and xposed on Z5C? If so, what are the steps?

Tried the following now;

1) Extracted kernel.elf and made a boot.img with rootkernel v5.23, selecting Y to disable dm-verity, Sony RIC and adding superuser (with intrusive option).

2) Made new boot.img with ta_poc using boot.img created with rootkernel, ta.img and recovery.img (TWRP 3.1.1).

3) Flashed FTF with Flashtool and new_boot.img with fastboot.

When powering on I got a red LED and phone stuck on Sony logo, so that didn't work. Will try without adding superuser to the boot.img before making new boot.img with ta_poc, but then I wonder how the hell I'm supposed to get root w/o using SuperSU (which I've read drains the battery on 7.x)?

Edit: Maybe root through MagiskSU is a better solution? E.g. copy untouched kernel.elf from newest stock ROM to ta_poc dir together with TA.img and recovery.img (TWRP3.1.1) and then make a new boot.img with dm-veriy and Sony RIC disabled and then flash Magisk when inside TWRP?

Edit2: Tried almost everything now, getting Xposed to work without using the systemless version in Magisk doesn't seem to work. Just hangs after Android logo, so seems like something more needs to be done.

Edit3: Giving up on getting Xposed to work in v7.x, so I don't need answers to the questions above any longer.
[Sony Cross-Device General] realtuxen:
You get root by flashing supersu or magisk with twrp after you flashed the poc'ed boot.img where you left supersu out. Just as you normally would with any other boot.img. Very simple, and btw supersu does not cause battery drain on 7.1.1 at all.

Edit: as you will ser if you read some of this thread, there might be a compatibility issue with magisk. I have no idea if this has been fixed, maybe you will find info about it 'over there'.
[Sony Cross-Device General] klausstoertebeker:
[MENTION=5006742]militiaOfDeath[/MENTION]:

Just the question: Why do you use "rootkernel" to remove Sony RIC and dm-verity? For me I just used it for simple rooting the kernel, letting TA_POC remove Sony RIC, dm-verity and creating a boot image including TWRP 3.0.2-0 and my TA image. And it works fine :) [MENTION=5908784]realtuxen[/MENTION]:

I do have still the problem that my Sony Xperia Z5 compact (E5823 running a TA_POCed Android Marshmallow 6.0.1) get stuck in bootloop after installing Magisk v14. I've posted this problem in some "threads" but it seems that nobody else have this problem. Would be nice to have support from other Sony Xperia Z5 compact users to show that this IS a problem for us...

By the way: I'm not sure that there is a TWRP 3.1.1-0 version for the Sony Xperia Z5 compact. I had a dispute with GreyLeshy in his "TWRP 3.1.1 for Xperia Z5, Z5c, Z3+" thread which let me conclude that there is only TWRP 3.0.2-0 available...
[Sony Cross-Device General] militiaOfDeath:
I used rootkernel to begin with since I didn't know TA_POC also did the same things, but I've tried with both tools, and so far I haven't been able to run Xposed (native or systemless), e.g. I end up in a boot loop no matter what I do once I flash/install Xposed.

As for the recovery, I flashed the same recovery.img from the thread you're linking to, and when I boot into it it says v3.1.1. Both on splash screen when entering recovery and in the top bar when entered. I enter it by holding power+volume down, releasing power as soon as phone vibrates, and holding volume down until I see the purple LED - then it's ok to release volume down. I flashed this with fastboot flash instead of integrating it into boot.img as e.g. rootkernel does. So to me it seems to exist, but for all I know it could v3.0.2 but with just the version number changed, e.g. I don't know what v3.1.1. brings to the table that v3.0.2. doesn't have.
[Sony Cross-Device General] GryTEcHoG:
I am using this, and never see bootloader unlocked warning at boot like others mention in my Z3+. Is this same for others ?
[Sony Cross-Device General] RaXelliX:
That's because only the newer X and XZ series added this warning. I'm not sure of this is a Sony or an Android thing in general. Besides on older Z series phones you could gain root without unlocking the bootloader. Unfortunately that's not the case for X and XZ series.
[Sony Cross-Device General] 8oldemar:
What about android 8?
[Sony Cross-Device General] carlero:
I join the question
[Sony Cross-Device General] alex.do:
Hello [MENTION=4120742]munjeni[/MENTION] you have any plan of supporting android 8?
[Sony Cross-Device General] juanpirulo:
hi, [MENTION=4120742]munjeni[/MENTION] oreo is released on xz, i tried your tool but its not working. I attach the kernel so you can have a look when you got time. cheers
[Sony Cross-Device General] pjohn23:
munjeni can i use this on a custom kernel built for xperia Z to use both the advantage of Custom kernel and Camera Quality (in LB device) ?
[Sony Cross-Device General] juanpirulo:
this is only for unlocked bootloader mate. cheers
[Sony Cross-Device General] pjohn23:
Yes bro i know what i mean is can i TA poc a custom kernel made for xperia z and use it on a stock based rom so i can use features of custom kernel + camera quality like LB, im already on UB tnx
[Sony Cross-Device General] juanpirulo:
Then you can try with any other kernel you want, i did it allready. cheers
[Sony Cross-Device General] Berni-0815:
I'm one of these guys who are building LineageOS 14.1 for their own needs. Maybe somebody knows me... :angel:

Curious as I am I just created a bootimage using this tool including my ta.img and recovery.img without any problems.

After flashing this bootimage by typing

sudo fastboot flash boot boot_new.img

the device is booting as usual. Unfortunately I can't see if anything is working differently than before.

How can I see that?
[Sony Cross-Device General] juanpirulo:
As i know the TA backup only works with Sony app. So dont think you can get any improvement on lineage. Cheers

Enviado desde mi F8331 mediante Tapatalk
[Sony Cross-Device General] Berni-0815:
I think so, too, but...

...what about the recovery? Does this make any sense included in a LineageOS bootimage? Or is there any other thing I don't see? Busybox i.e.
[Sony Cross-Device General] ondrejvaroscak:
No, ta_poc is tool for stock kernel images. Lineage uses different approach and there is absolutely no need, no point and no use of ta_poc with Lineage OS
[Sony Cross-Device General] pjohn23:
Unfortunately it doesnt work, i tried TA poc on this kernel and repacked it on the zip, the device boots but the screen doesn't turn on so all i see is black, restored my TA ang locked my bootloader for now, hopefuly someone can teach me how to do it properly :angel: