yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] x_one:
This script is initialize twrp or boot normally if no user interaction.

I don't use rootkernel, just munjeni's poc and I've add twrp manually into boot.img but the same way as rootkernel doing it.

Rootkernel's init script definitely have wrong keys catching as munjeni said. It wasn't working for me when I've tried it (before munjeni released his poc). Changing key codes helped (for me).
[Sony Cross-Device General] exvargos:
After reading the script more, yeah you're right. He does the same at the end of booting into fota_recovery as well as TWRP recovery. I'm genuinely confused then, I've always had issues doing successive boots into twrp using rootkernel.

Did you just extract the twrp code portions to run with ta_poc?

---------- Post added at 04:43 PM ---------- Previous post was at 04:27 PM ----------

@munjeni This is the dmesg from a successful boot (only ran ta_poc with scripts to disable ric + verity), however I get no signal and security tests report no blob/failed.

here is my pastebin, there seems to be a recurring message

http://pastebin.com/veNP6dz6

healthd: miscTA is not initialized
healthd: TimeStamp Read error

although i'm not sure if that's what you are looking for.
[Sony Cross-Device General] Hamidreza2010:
then how can fix it?
[Sony Cross-Device General] exvargos:
DISCLAIMER: I use the Z5 Premium E6853 on Android Nougat 376 (might be a reason for invalid key number), everything i say pertains to my experience with this device.

My idea (what i did for now) is to comment that line out, you add a # in front so kernel ignores that line.

However as pointed out to me later (read the above exchange between me and x_one), that shouldn't be the reason why TWRP fails successive boots for me (trying again results in orange led and frozen Sony boot screen, I get the key error 143 if i press no key in the interval for pressing it according to bootlog.txt). For now I'm rolling with that until I read more into the scripts to see if I can find out why (even if it is a security risk).

Something else might be going on with my computer as well (running Windows 10), i'll try these scripts on my macbook later too since I don't get signal when I run ta_poc first (even though TA.img is copied on; regardless of if i use rootkernel or not).
[Sony Cross-Device General] Hamidreza2010:
didnt work :confused:

---------- Post added at 05:59 PM ---------- Previous post was at 05:56 PM ----------

you mean i removed that line?
[Sony Cross-Device General] exvargos:
You can try my idea (doesn't cause bootloops :D )

Replace

${BB} rm -rf /dev/* ${BOOTIMG} ${TWRP}
exec /init $@

with

# ${BB} rm -rf /dev/* ${BOOTIMG} ${TWRP}
exec /init $@
[Sony Cross-Device General] Hamidreza2010:
I did it but not work
[Sony Cross-Device General] exvargos:
I'm sorry to hear that. Out of curiosity how are you attempting to boot into recovery?

Once the sony boot logo shows up for me (right after RED led light), I repeatedly press the volume up key until it goes into recovery. I've tried just holding the button down but it has never worked for me.
[Sony Cross-Device General] Hamidreza2010:
I do this but when i use booth tools ( mungini and tobias ) happen this issue
[Sony Cross-Device General] munjeni:
Mate you misunderstand that script! This is how that script works:

# Check for keys
${BB} mkdir -m 755 -p /dev/input /sys
${BB} mkdir -m 555 -p /proc

for i in $(${BB} seq 0 12); do
${BB} mknod -m 600 /dev/input/event${i} c 13 $(${BB} expr 64 + ${i})
done
${BB} mknod -m 666 /dev/null c 1 3

[COLOR="Red"]# Recovery prompt
set_led_color 255 255 0
${BB} timeout -t ${KEY_EVENT_DELAY} ${BOOTIMG} keycheck
KEY=$?[/COLOR]

[COLOR="SeaGreen"]# Volume up or reboot recovery: Use internal recovery
if [ $KEY -eq 115 ]; then
echo "Entering internal TWRP Recovery Mode" >> ${LOG_FILE}
start_internal_recovery
fi[/COLOR]

[COLOR="YellowGreen"]# Volume down: Use recovery from fotakernel partition
if [ $KEY -eq 114 ] ; then
echo "Entering Recovery Mode" >> ${LOG_FILE}
start_fota_recovery
fi[/COLOR]

[COLOR="RoyalBlue"]echo "Booting Normally" >> ${LOG_FILE}[/COLOR]

red code is when boot process checks user interaction on volume keys. If volume up key is 115 or if volume down key is 114 recovery thing starts. If none of these two keys match blue thing starts (in that case android boot continues ). [MENTION=5096181]Hamidreza2010[/MENTION] device doesn't produces any of these keys (114 || 115) and it was a reason why he wasn't able to enter into recovery mode!
[Sony Cross-Device General] munjeni:
What you did??? Did you found key for volumeup and also key for volumedown?? What is keys for your device?
[Sony Cross-Device General] exvargos:
I didn't misunderstand the script, if you read the messages in between I specified that at least for my device, 115/114 is the right combination, 143 seems to be no button or something else (but for me it's not volume up). I understand that it's possible thats the problem with [MENTION=5096181]Hamidreza2010[/MENTION] , hence i added a disclaimer that I use Z5 Premium E6853 and that it works for me, but might not work for anyone else. I just told him what i tried and what worked for me.
[Sony Cross-Device General] munjeni:
You said that problem is this:

${BB} rm -rf /dev/* ${BOOTIMG} ${TWRP}

It is not a problem I think, it just removes temporary things after ramdisk is extracted to the "/" than init is executed, I didn't see any problem about it
[Sony Cross-Device General] exvargos:
Again, in my exchanges with x_one, and after, i specifically stated that's what fixed it for me for whatever reason, i'm still investigating. it worked for me but might not for anyone else, even if it is a flawed solution. I even provided my own device model for reference.

Look man, your tool is a very interesting and cool idea and best of luck to you, but for me it's broken and every time I ask for help it's been ignored, and every time I try to offer some help to others having similar issues, my posts are read incorrectly/ignored. I won't be posting here any more since it seems i am unwelcome here.
[Sony Cross-Device General] munjeni:
Man, you are welcome, always! You must understand something, some peoples including me have not a good english, sometimes I must read 3 times to understand things, and also if you look into my posts you can notice that all my posts have edit, thats because I doing my best to write things in english language and in the same way make that what I wrote redadable and understandable.

I see you have copied manualy your trim area backup to /data/local/tmp, and you set permission for it 0660? Did you set owner and group too? It must be tad.root !
[Sony Cross-Device General] x_one:
[MENTION=7383357]exvargos[/MENTION] have you checked permissions and owner/group of the TA.img file that is in /data/local/tmp ?

if you have installed terminal emulator run it with root access and "cd /data/local/tmp" and inside that folder type "ls -la" and check if the file have permissions 640 and owner tad/root.

If it's different it won't work.
[Sony Cross-Device General] munjeni:
owner must be tad and group must be root, permission must be 0660
[Sony Cross-Device General] munjeni:
You will need to contact tobias and tell him about problem with recovery init script
[Sony Cross-Device General] x_one:
Ummm.. right.. 660..

You can take twrp from rootkernel. Just copy twrp.xz from /ramdisk/vendor folder when you compiling boot using rootkernel before it clean files.
[Sony Cross-Device General] munjeni:
Maybe better idea for me to help tobias integrate poc on his tool? And also to give him source code of the sin extractor? I realy want to leave our tool and move to something better
[Sony Cross-Device General] munjeni:
One guy told me something interesting about tad_static... We no need to mount TA.img, instead we can use it directly as a file :)
[Sony Cross-Device General] x_one:
Cooperation always gives good results :)

---------- Post added at 08:31 PM ---------- Previous post was at 08:29 PM ----------

Really?

So we need just copy it to place with r/w right and just point tad_static to use TA.img instead of loop?
[Sony Cross-Device General] Hamidreza2010:
bro i set to 143 as i saw in my bootlog

if wrong , how can i found correct key?

thanks bro

---------- Post added at 09:02 PM ---------- Previous post was at 09:01 PM ----------

Its excellent

both tools are excellent and if integrate together , its very good
[Sony Cross-Device General] levone1:
Can anyone tell me why chown doesn't recognize tad? Current owner is 2997. Only message I get in Term is 'bad user tad'
[Sony Cross-Device General] munjeni:
TA.img need to be in rw location with perm tad.tad 0600, than in sony_platform.rc change line service tad_static ...instead of loop type parth to the TA.img it will work probably. I not tested! Ofcourse if you move TA.img out of /data/local/tmp you will need to patch sepolicy! You can try change only sony platform rc to see if it will work, if yes I will update tool
[Sony Cross-Device General] munjeni:
Busybox didn't recognise user tad, you must type id instead, only toolbox from rom recognize user tad since thats part of the xperia tool
[Sony Cross-Device General] x_one:
Tested already.. It's working.. :)
[Sony Cross-Device General] munjeni:
Try first with volumeup and look into bootlog, than try with volumedown and look into bootlog, easy?
[Sony Cross-Device General] munjeni:
In next few days I will move all things out of exe to userscripts so it will be a lot better for everybody to play with scripts, maybe will try to integrate all things to tobias tool
[Sony Cross-Device General] x_one:
That would be great!

Users will be able to change parameters as they want :D
[Sony Cross-Device General] Hamidreza2010:
i get , both if them are 143

http://pastebin.com/ybv60yK4

http://pastebin.com/xC0U1uvp

didnt worked

---------- Post added at 10:14 PM ---------- Previous post was at 10:12 PM ----------

its very good and very easy for user which use both of them

can do all ting easier than before
[Sony Cross-Device General] munjeni:
Hmm seems wrong input device used. You need to contact somebody in your device forum to give you some info about it volumeup and volumedown input device and its values!
[Sony Cross-Device General] munjeni:
Will start on his source code and push him git pull reguest, hope accept
[Sony Cross-Device General] fluffi444:
Great idea and thanks that you are still one here. Even with this mess of discussions here [emoji5]
[Sony Cross-Device General] Hamidreza2010:
bro just 1 qestion:

when i use tobias tool , all thong was ok and can enter to recovery ( means volumeup and volumedown key is correct ) but when patch kernel first with your tool then tobias , happen this problem
[Sony Cross-Device General] Helmut.Hartmann:
Sorry, can anyone provide any help?

Device: 6503

Bootloader: unlocked

TWRP: 3.0.2

ROM: MX Rom 8.9 (Sony 6.0.1 - 23.5.A.1.291) from XDA)

- I made a new boot.img with ta poc (boot.elf from the rom)

- flashed them through fastboot flash boot new_boot.img

- no signal and no security entry after boot

- copied TA.img manually to /data/local/tmp, set owner to tad.root, permission to 0660

- no signal and no security entry after boot

what I'm doing wrong?

Thx
[Sony Cross-Device General] munjeni:
There was one bug which seems I forgot to fix... when tool pause open init.rc and change line"

exec u:r:init:s0 -- /stufs/bin/sh

to:

exec u:r:init:s0 -- /stufs/bin/ta
[Sony Cross-Device General] ch3mn3y:
Not sure if it was mentioned or changed, but I had sometime and I edited the bat scripts to look for any .img, .sin or .elf file.

However as TA.img is .img too, so for script to not use it as kernel, I "moved" it to TA folder (so it's TA/TA.img).

BTW. It's not my first batch script, but first with if's so it probably could be smaller :P

[MENTION=4120742]munjeni[/MENTION]

I seem to be missing this file? It's /ramdisk/init.rc@0750? There is no line like this.
[Sony Cross-Device General] munjeni:
Only nougat and marchmalow have that in init.rc
[Sony Cross-Device General] Hamidreza2010:
[MENTION=4120742]munjeni[/MENTION] bro when we unlocked our bootloader in sony device , camera quality was degrade , if we use this tool and flash kernel and copy ta.img to data / local/temp is camera quality revert to stocked or nothing changed?
[Sony Cross-Device General] x_one:
That's the point of this poc.
[Sony Cross-Device General] Hamidreza2010:
then revert to stcok

ok thanks
[Sony Cross-Device General] Soheil_rf:
Is this change fix No Signal issue?

edit :

I'm in nougat and there is no such line in that file
[Sony Cross-Device General] :
1 .

you must change ramdisk folder on THIRD pause - this is for nougat, for marshmallow it will be second pause.

2 .

i'm checked nougat_ta_poc.exe ( from 14.02.2017 ) and it is writing more or less proper line in init.rc ( mm_ta_poc.exe from 14.02.2017 writing totally wrong command ) :

# part of the TA PoC
exec u:r:init:s0 -- /stufs/bin/ta

i'm not like nougat and therefore not tested if it okay or not, but proper invocation ( tested on marshmallow ) will be :

exec u:r:init:s0 -- /stufs/bin/busybox /stufs/bin/ta

so try to change it like i'm wrote ( remember - for nougat on 3rd pause open separate folder and change init.rc )

3 .

i'm suggesting to use trim area dump from file without any loop device.

it is better to wait for munjeni to change ta_poc tool, but if you want to do it on your own, then

- on third pause ( for nougat, for marshmallow on second pause ) go to ramdisk folder and change in init.sony-platform.rc@0750

service tad_static /sbin/tad_static /dev/block/loop5 0,16

to

service tad_static /sbin/tad_static /data/local/tmp/TA.img

and in ramdisk/stufs/bin/ta delete line

${BB} losetup /dev/block/loop5 /data/local/tmp/TA.img

4 .

this device key emulation method can ( and should ) be used on kernels after rootkernel_v5.23_Windows_Linux.zip

- run rootkernel_v5.23_Windows_Linux.zip tool on your kernel

- run ta_poc on created NEW kernel

- on third (nougat) ( second - marshmallow ) pause open ramdisk folder, then change in init.target.rc@0750

on post-fs
export LD_PRELOAD libNimsWrap.so:libdrmfix.so

to

on post-fs
export LD_PRELOAD libNimsWrap.so

- do steps from p. 2,3 of this post

and continue ta_poc tool.

Thus, you will have kernel with twrp ( read : root ), disabled RIC, dmverity and transparent device key emulation.
[Sony Cross-Device General] ch3mn3y:
DELETED

See that there is answer...
[Sony Cross-Device General] munjeni:
But that script allready uses busybox (#!/stufs/bin/busybox sh) as a first line in ta script, and ta script allready have executable flag, what is a problem with it? It working on most peoples!

Guys, new version is out! Now the most of things is moved out of exe, its now fully scriptable, enjoy!
[Sony Cross-Device General] ShadowElite:
Thank you sir, I'm triying to implement this on my kernel, but for now I don't have luck, I will to report later.
[Sony Cross-Device General] Hamidreza2010:
bro what about combined this tool with tobias tool?

did he accept ?
[Sony Cross-Device General] munjeni:
I have used scripts from serajr and made new one for patching. I will help tobias when I get more free time, will try to implement things on his poc, he deserved that definitelly! Not going to use his recoveries on this poc since I realy regard his hard work.
[Sony Cross-Device General] Hamidreza2010:
Yes of curse.

i wait for this teamwork and hope fix enter to recovery bug

thanks a lot for your ( and tobias ) great / hard work
[Sony Cross-Device General] :
as i'm wrote, i didn't tested your tool on live phone with nougat firmware, so probably simple /stufs/bin/ta will be enough.

but it is "ethically correct" to use "/stufs/bin/busybox /stufs/bin/ta" ;)
[Sony Cross-Device General] munjeni:
Yes it works that way too I agree but thats only and only need if script don't contain first line #!, but if script allready contain directive like #!/stufs/bin/blabla than realy no need executing script with /stufs/bin/blabla :)

For exanple if I write this as a first line: #!/example/sh script will not work with that /stufs/bin/busybox , dmesg will say no such file or directory for /example/sh
[Sony Cross-Device General] serajr:
Bro, why don't you just forget about integrating twrp into kernel?

Make use of fotarecovery partition and flash a working twrp image onto it (just my opnion)!
[Sony Cross-Device General] serajr:
Thank you bro for your hard work! :good:

I've just tested out new version (script version) and unfortunately TA.img has not been copied to its destination folder > dmesg - XP - Nougat

After manually copying it and reboot, everything working as expected!
[Sony Cross-Device General] munjeni:
Hi, found one denial for class dir and perm write, I am not on pc now but tommorow I will update scrupt, this need to be seinjected:

audit(21047906.409:6): avc: denied { write } for pid=480 comm="busybox" name="tmp" dev="mmcblk0p54" ino=587522 scontext=u:r:init:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=0 ppid=479 pcomm="ta" pgid=479 pgcomm="ta"
[Sony Cross-Device General] fluffi444:
Not only yours. Since the possibility of fota recovery officially from Sony there is no reason to integrate twrp in any custom kernel. To have it on system is still useful for LB of course...
[Sony Cross-Device General] munjeni:
Great! You saved my time, updated! :good::)
[Sony Cross-Device General] Fauzi alaik:
Working perfectly with adding the line:victory:
[Sony Cross-Device General] fluffi444:
Guys! Great Work!

With latest version everything is working! Even with my setup, which creates some hassle during tests: Z3C SLiMM ROM with EliteKernelV3.

TA.img copy, ownership/permissions (tad:root 0660) and loading TA.img on startup! SIM/Signal working :good:

But I need a second reboot. On first reboot (after deleting of TA.img for test) I have "none" in security of service menu.

After second reboot keys are back and working...

Outstanding Teamwork! :highfive:
[Sony Cross-Device General] Hamidreza2010:
TA.img copied Successfully and everything working fine

I tested on z5

Thanks for great work
[Sony Cross-Device General] ondrejvaroscak:
X Compact success

Latest version, patched .311 stock kernel with [MENTION=357342]tobias.waldvogel[/MENTION] kernel, no supersu/superuser integration, just verity/ric disabled, encrypt disabled, busybox integrated, then re-patch of kernel using your tool and my TA.img, success, all keys provisioned and with Magisk als Safety Net passed. Great find....

I have also found a way how to partially partialy (remove provider customizatins) debloat a stock ROM and re-lock bootloader without going bootloops or trigerring dm-verity. It involves OEM partition. Maybe someone could take a look, if OEM partition can be of any use for other purposes like rooting on locked BL (or re-locking rooted).
[Sony Cross-Device General] serajr:
Glad to hear it!
[Sony Cross-Device General] whalesplaho:
I wanna use dis tool for a stock kernel patched with sony ric, dm verity, busybox, twrp, can i go ahead and use?

Also with a custom kernel like SunKernel for Z5 buh it jas drm fix.

Thanks buddy....

---------- Post added at 01:38 PM ---------- Previous post was at 01:29 PM ----------

Is OP updated with latest version?
[Sony Cross-Device General] munjeni:
If you uses ric,dmverity and other than skip it on seccond tool and viceversa, that's all! Do the the same with drm fix :)
[Sony Cross-Device General] munjeni:
Yes :)
[Sony Cross-Device General] munjeni:
I have replied to your thread :)
[Sony Cross-Device General] whalesplaho:
i only see script & binaries folder, which folder will i copy my TA.img & kernel files into?

thanks for yur continous support!
[Sony Cross-Device General] munjeni:
Put in same folder with .exe
[Sony Cross-Device General] whalesplaho:
works fine now.... i ll try flash tha boot.img created & post feedback.!!!

i ran dis code in cmd; "nougat_ta_poc.exe boot.img TA.img outputdirectory"

hope its okay?
[Sony Cross-Device General] munjeni:
If new_boot.img succesfully created than why not? :D
[Sony Cross-Device General] whalesplaho:
it created dat..... flashed but cant get into TWRP & phone keeps bootlooping!
[Sony Cross-Device General] munjeni:
If you folowed our thread... thats already mentioned and known isue! To get that fixed last_kmsg is need! To get last kernel log you must do https://sites.google.com/site/zhuow...onandroid60andabovesysfspstoreconsole-ramoops , do in mind it will exist only on next successfull boot, if you not done next successfull boot last kernel mesage will disapear! Temp boot an recovery after you get bootloop, just idea, and use adb to catch that kernel log
[Sony Cross-Device General] ondrejvaroscak:
Root with phh superuser

Hi, I was successfully able to get the DRM keys working, however, I got trouble to install phh's superuser.

By my understanding, I don't need to use [MENTION=357342]tobias.waldvogel[/MENTION] kernel patching tool, becuase disabling dm-verity, RIC and encryption is already integrated in thi TA PoC tool, right? So I just got my stock kernel (Xperia X Concept .311), my TA.img, patched it choosing to disable dm-verity, RIC and encryption. So far all right.

Then I flashed in TWRP phh's superuser zip. Got stuck at SONY logo after reboot. I am unsure, about conflict of superuser config.txt parameters, because supeuser can also be configured to disable dm-verity and encryption. Therefore I would like to know, which parameters I should choose in patching kernel with this tool and how to properly configure superuser.
[Sony Cross-Device General] munjeni:
Sorry I have old xperia z1c and can't test anything so can't tell you. Hope somebody tell you about it
[Sony Cross-Device General] whalesplaho:
okay i ll try see if i can get tha last_kmsg.... but i noticed dat i extract a new stock kernel & patch first with yur tool & it works fine without issues den afterwards i used yur patched boot.img in tobias tool & i only added busybox, kcal & twrp den flash..... it boot up fine too without issues but when i reboot & press volume+ to enter recovery, it freezes there.
[Sony Cross-Device General] munjeni:
Can't tell you without last kmsg
[Sony Cross-Device General] whalesplaho:
i cant access root folder cos it shows i dnt have root, cant enter recovery to flash superuser zip.... if i flash another kernel can i still get tha last kmsg of tha previous kernel?
[Sony Cross-Device General] munjeni:
Yes in case its next success boot after unsuccess bootloop! The best thing to get that last kmsg would be if you find an working recovery.img and boot it temporary with: fastboot boot recovery.img , than you will definitelly have access to that folder for catch log. Try to extract recovery.img from an cm or aosp rom!
[Sony Cross-Device General] Hamidreza2010:
bro i have same problem too and cant get last_kmsg.txt ( still try to found solution )

https://xdaforums.com/showpost.php?p=71024950&postcount=310

hope you can get that log
[Sony Cross-Device General] munjeni:
After bootloop, boot any recovery using fastboot command:

fastboot boot recovery.img

than if recovery boot, perform next command:

adb shell cat /sys/fs/pstore/console-ramoops

This will display the previous kernel log. If you can't see that console-ramoops do in mind thats because your boot was not first one after failed one! It must be first successfull boot after bootloop! Extract recovery.img from CM or AOSP rom if you have no idea where you can get recovery.
[Sony Cross-Device General] Hamidreza2010:
I try to enter to recovery but not successful , force turn of device with vol up and power button , flash another kernel and turn on device and go to recovery and try to get last_kmsg log via these command :

adb shell cat /sys/fs/pstore/console-ramoops-0 > last_kmsg.log

adb shell cat /proc/last_kmsg > kmsg.txt

but get this error : cat: can't open '/proc/last_kmsg': No such file or directory

wait for [MENTION=4471890]whalesplaho[/MENTION] , maybe ha can do it
[Sony Cross-Device General] munjeni:
Did you read link which I provided you? Proc/last_kmsg NOT EXISTS on newer androids! Again https://sites.google.com/site/zhuow...onandroid60andabovesysfspstoreconsole-ramoops

First command which you done seems right!