[Sony Cross-Device General] serajr:
Bro, you are insane!!

I can also confirm that [MENTION=4120742]munjeni[/MENTION] 's PoC does work on Nougat, F8131 (after manually copying TA.img)!

E:\Android\ta_poc>DOUBLECLICKME_NOUGAT
------------------------------------------------------------------------
Nougat Trim Area PoC kernel image patcher by Munjeni @ 2017
------------------------------------------------------------------------

hash:0x4A2463D0 calc_hash:0x4A2463D0
hash:0x1847E017 calc_hash:0x1847E017
hash:0x7E6F8C67 calc_hash:0x7E6F8C67
hash:0x8BFE56C7 calc_hash:0x8BFE56C7
device: F8131
serial number: CB512AD0TJ
drm key: 0001046B 0010 B8 1F 52 03 D0 39 6C 60 85 C0 A9 9D FE 4F D1 B8
Trim area dump is a valid.
Locked bootloader.
Deleting old folder ramdisk if exist...
if exist ramdisk (rd ramdisk /s/q)
returned: 0.
New directory ramdisk created.
Created ouput folder "out"
opening n_39.2.A.0.417_kernel.elf
Extracting file n_39.2.A.0.417_kernel.elf
ELF magic found
Entry point : 0x80080000
Class : 64-bit objects
Program Header start : 0x40
Program Header size : 0x38
Program Header count : 3
PH[0], type=1, offset=0x000000E8, virtual=0x80080000, phy=0x80080000, size=0x01BC9C00
PH[1], type=1, offset=0x01BC9CE8, virtual=0x82200000, phy=0x82200000, size=0x0059FDA8
PH[2], type=1, offset=0x02169A90, virtual=0x82000000, phy=0x82000000, size=0x001AFB54
0. Dumping out/boot.img-zImage
1. Dumping out/boot.img-ramdisk.gz
2. Dumping out/boot.img-dt
Seeking to cmdline address = 0x023195EC
3. Dumping cmdline to out/boot.img-cmdline
Done.
No file exist out/n_39.2.A.0.417_kernel.elf.elf .
Gunziping...
setting up infflate...
infflating...
infflate returned: 0
gzpipe: ok.
unziped: ok.
Extracting ramdisk.cpio...
Searching for file_contexts...
ramdisk/file_contexts.bin@0644 file is binary.
Converting ramdisk/file_contexts.bin@0644 to plaintext...
Converted.
Patching file "ramdisk/init.sony-platform.rc@0750"
Patching file "ramdisk/init.sony-platform.rc@0750"
Patching file "ramdisk/ueventd.rc@0644"
Patching file "ramdisk/file_contexts@0644"
Converting plaintext file_contexts to binary...
---- Now you have some chance to modify plaintext file_contexts
---- before it is converted to the binary.
Pressione qualquer tecla para continuar. . .
Converted.
Create ta scipt.
Create busybox.
TA.img (TA.img) installed.
Making sepolicy backup: ramdisk/backupsepolicy@0644
Patching sepolicy...
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18233 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18233 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18234 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18235 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18235 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18236 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18237 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18237 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18238 rules, 0 cond rules
Success
libsepol.policydb_index_others: security: 1 users, 2 roles, 1387 types, 0 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 63 classes, 18239 rules, 0 cond rules
Success
-------------------------------------------------------------------------------------------
No users script found in current directory.
Right now you have chance to modify folder "ramdisk" manualy, press any key when done!
If you need to automate ramdisk modification, make an script.sh (lin) or script.bat (win),
and put in the same dir with nougat_ta_poc.
-------------------------------------------------------------------------------------------

Pressione qualquer tecla para continuar. . .
Repacking ramdisk...
ramdisk.cpio done.
Making ramdisk.gz
defflating...
defflate returned: 0
setting up infflate...
infflating...
infflate returned: 0
gzpipe: ok.
gzip: ok.
ramdisk.gz done.
No QCDT magic string.
Packing new_boot.img
cmdline="androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff coherent_pool=2M"
base="0x00000000"
pagesize="4096"
ramdiskoff="0x82200000"
defflating...
defflate returned: 0
setting up infflate...
infflating...
infflate returned: 0
gzpipe: ok.
gzip: ok.
zImage-dtb , dt appended.
making new_boot.img
new_boot.img created.
Done.

Pressione qualquer tecla para continuar. . .
Pressione qualquer tecla para continuar. . .

E:\Android\ta_poc>fastboot flash boot new_boot.img
target reported max download size of 268435456 bytes
sending 'boot' (17808 KB)...
OKAY [ 0.547s]
writing 'boot'...
OKAY [ 0.120s]
finished. total time: 0.700s

E:\Android\ta_poc>fastboot reboot
rebooting...

finished. total time: 0.016s

[COLOR="Blue"]E:\Android\ta_poc>adb push TA.img /data/local/tmp/TA.img
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
1650 KB/s (2097152 bytes in 1.240s)

E:\Android\ta_poc>adb shell
F8131:/ $ ls /data/local/tmp
TA.img
F8131:/ $ exit

E:\Android\ta_poc>adb reboot
[/COLOR]
E:\Android\ta_poc>

Respect!!!