yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] ondrejvaroscak:
TA_POC is intended to work with STOCK kernels. There is no guarantee that it will work with any custom kernel.
[Sony Cross-Device General] diosdetiempo:
How does one use this?
[Sony Cross-Device General] GryTEcHoG:
Read the readme file inside the zip.
[Sony Cross-Device General] pjohn23:
Thanks for enlightening me, but that's kind of unnecessary since its just the same as having locked BL :confused:
[Sony Cross-Device General] ondrejvaroscak:
That is the purpose of it. TA_POC can succesfully "fake" locked BL. It means that you can have your device rooted, while retaining your original DRM keys for Stock ROM and Stock apps... device thinks it is locked, but it is in fact unlocked, with TA_POC making it looking as locked for the Stock ROM. Bootloader will of course know that it is unlocked (it will show "Your device cannot be trusted" on boot), but the stock ROM will see device as locked. And of course all security keys in place and commissioned.
[Sony Cross-Device General] RaXelliX:
Speaking of wich...has anyone figured out how get rid of the "Your device cannot be trusted" on boot. As i understand this is Android warning and not Sony specific.

Also - Oreo support and maybe move this from Proof of Concept to Alpha as it clearly works.
[Sony Cross-Device General] ondrejvaroscak:
"Your device cannot be trusted" is implemented in Bootloader and not in ROM/Kernel. You are not going to get rid of it, unless you either manipulate Bootloader (you are bootloader developer) - and I wonder anybody would do it, because the probability of ****ing your bootloader = hardbricking your device is simply to high,

or develop a way how to relock bootloader on shutdown and unlock in on booting kernel ... and that is possible mot probably only by manipulating bootloader, because once the bootloader is locked, it will not allow booting custom kernel and hence providing any way of unlocking bootloader on boot.

And if you would be able to manipulate bootloader, you wouldn't need to bother about locking/unlocking anyway....
[Sony Cross-Device General] angelouss:
Is there something to do to make magisk work (boot loop every time I flash it) with ta_poc ??

Please help !its really worth it to keep this kernel
[Sony Cross-Device General] ondrejvaroscak:
Yes. Read the instructions and follow the instructions. There is no issue having stock kernel modified by TA_POC and Magisk with MagiskSU.
[Sony Cross-Device General] angelouss:
please tell me where i'd found the instructions you are talking about

ps im in stok kernel modified with ta poc then flashed magisk from twrp 3.1.1
[Sony Cross-Device General] alex.do:
Which firmware were you talking about? I did try with latest oreo on xperia xz and got bootloops all the time, both installation methods.

Prior to oreo, it does work. you can give another try with the 2nd method (using MagiskManager and select your stock kernel boot.img... (read the install guide). But if you are currently on oreo, looks like we gonna have to wait or:

- use supersu

- give up ta_poc and use drmfix :(

---------- Post added at 04:21 PM ---------- Previous post was at 03:25 PM ----------

To those who are on xperia and wanna try oreo. Read here first.

Basically ta_poc seems to work on oreo (at least on my XZ with latest Oreo). However looks like it isn't compatible with both Magisk and SuperSU. Both require patching boot image and both cause bootloops.
[Sony Cross-Device General] angelouss:
Im on 7.1.1 z5 premium

Problème solved with rootkernel 5.23 2 unofficial
[Sony Cross-Device General] juanpirulo:
Hi [MENTION=4120742]munjeni[/MENTION] are you planning to updated your tool for oreo? cheers
[Sony Cross-Device General] wzhy:
Has anyone a way to update our dump ta image with the new ta.sin from firmware tft ?
[Sony Cross-Device General] alex.do:
it's new year now and looks like he's no longer interested in his own amazing work. wondering whether he would be okay to pass this to someone else to continue :(
[Sony Cross-Device General] munjeni:
You want to say that sony made new sin version, version 5? All sin versions untill new year was fully supported, now I am unsure, can you post that sin file?
[Sony Cross-Device General] munjeni:
Tool is working and can be used on almost every firmware, tool have ability trought user scripts to become extended, that mean everybody is free to add support for newer firmwares, I can't support every new android version, that mean somebody need to figure out which modification is need inside an e.g. oreo ramdisk or e.g. magisk or e.g. supeuser , generaly you need to modify/create/extend byself and for your needs scripts in scripts folder and modify it for your needs. I simply have no free time to mess with it. For idea run ta_poc without arguments from command line to get list of commands
[Sony Cross-Device General] wzhy:
No, not that. When I flash frimware I found FlashTool has write something into TA partition from ta.sin in the ftf firmware. My meaning is this.
[Sony Cross-Device General] munjeni:
Sorry I not understand what you need. Can you explain a bit better? Never saw ta.sin
[Sony Cross-Device General] ondrejvaroscak:
It is nothing related to what TA_POC does...
[Sony Cross-Device General] wzhy:
ta.sin is in a ftf firmware file. When I flash firmware via FlashTool, I can see the logcat from FlashTool says that it has written some bits into /dev/block/mmcblk0p1(as you know it is the real TA partition).
[Sony Cross-Device General] munjeni:
I never saw ta.sin file in any ftf file. Can you attach that ta.sin file here? And can you attach log file?
[Sony Cross-Device General] Berni-0815:
In all ftf files of my device (sony z5c) is no ta.sin file!! ;)
[Sony Cross-Device General] wzhy:
ummmm, sorry it seems to be the *.ta files
[Sony Cross-Device General] Stunherald:
Sadly it does not work on Xperia X Performance Oreo FW (F8132_41.3.A.2.24_1302-9341_R2E)

Making ramdisk/stufs folder... done
Removing ramdisk/.backup folder... done
Found android version equal or greater than Marshmallow.
Making ramdisk/init.ta.sh script... done
Found string 'service tad_static' in ramdisk/init.sony-platform.rc@0750
patching ramdisk/init.sony-platform.rc@0750
installing ramdisk/stufs/TA.img
Found string 'mkdir /data/local/tmp' in ramdisk/init.rc@0750
patching ramdisk/init.rc@0750
Found binary ramdisk/file_contexts.bin@0644
scripts/patch_things.sh: arithmetic syntax error
converting ramdisk/file_contexts.bin@0644 to plaintext file_contexts
patching file_contexts
convert_plaintext: error reading 6!
command ret: 1.
Your script didn't returned 0, please check your script!

This is out of my knowledge so i can not fix it by myself but i can provide whatever is needed if someone would like to take a look on it.
[Sony Cross-Device General] wzhy:
upload your "file_context.bin" in "ramdisk" folder.
[Sony Cross-Device General] Stunherald:
[MENTION=1552108]wzhy[/MENTION] here you go
[Sony Cross-Device General] munjeni:
Some specific sefcontext string which my tool can't handle

8A FF 7C F9 05 00 00 00 10 00 00 00 31 30 2E 32 32 20 32 30 31 36 2D 30 37 2D 32 39 [COLOR="Red"]06 00 00 00 38 2D 38 2D 65 6C [/COLOR]0B 00 00 00 04 00 00 00 2F 64 65 76 00 07 00 00 00 2F 73 79 73 74 65 6D 00 07 00 00 00 2F 76 65 6E 64 6F 72 00 05 00 00 00 2F 64 61 74 61 00 04 00 00 00 2F 6D 6E 74 00 06 00 00 00 2F 63 61 63 68 65 00 04 00 00 00 2F 73 79 73 00 04 00 00 00 2F 69 64 64 00 08 00 00 00 2F 70 65 72 73 69 73 74 00 09 00 00 00 2F 66 69 72

you need to manualy hexedit/remove red part from your filecontext binary before you use poc, its on offset 0x1c, I can't update poc anymore sorry
[Sony Cross-Device General] RyTekk:
Where is the latest version? Sorry I've not followed the thread for a long time and I see that OP stopped updating the tool.
[Sony Cross-Device General] munjeni:
Page number 1, post number 1 :)
[Sony Cross-Device General] RaXelliX:
So if no Oreo support it is either:

Back to DRM Fix like it was before PoC

HEX edit PoC

Do i understand correctly?
[Sony Cross-Device General] Soheil_rf:
Try this from monster serajr

https://xdaforums.com/showpost.php?p=74724162&postcount=2793
[Sony Cross-Device General] Stunherald:
[MENTION=1881378]Soheil_rf[/MENTION] Thanks. Yea i am currently running that modified kernel with drm-fix (from day before the TA PoC part was added). So far so good so i might stick with it.
[Sony Cross-Device General] pw1nce:
im having the same issue , after flashing magisk my phone keeps rebooting on sony logo, using x compact , how did you fix it?
[Sony Cross-Device General] angelouss:
by using this tool "rootkernel_v5.23_Windows_Linux_UNOFFICIAL_2.1_OREO" it include the ta_poc

you have to put your ta in the same folder and skip the drm fix

here is the link of the topic

https://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605
[Sony Cross-Device General] wzhy:
That's a sad news:crying:
[Sony Cross-Device General] levone1:
[MENTION=3989065]serajr[/MENTION] has incorporated poc into latest unofficial rootkernel script, (https://xdaforums.com/showpost.php?p=74724162&postcount=2793). Confirmed working on O, (I also got 'script didn't return zero' error with latest poc download). If your phone has rootkernel support, you can use it to mount ta with poc, (or possibly extract scripts from rootkernel and replace in poc folder?...). [MENTION=4120742]munjeni[/MENTION] or serajr - could it be done easily that way, for those without rootkernel support?
[Sony Cross-Device General] serajr:
I will try adding android N and O compatibility to official PoC (here) when I have some spare time.
[Sony Cross-Device General] wzhy:
Thanks a lot, but I only use PoC's sepolicy de/compile feature and I apply TA by another way. ( Making a 2MB partition on sdcard for TA image )
[Sony Cross-Device General] GreyLeshy:
Could you share the instruction?
[Sony Cross-Device General] wzhy:
I remember I have post it in the past. You can find my post.
[Sony Cross-Device General] amakuramio:
I have used rpm.sin to extract and now on step 4 it's dumping boot cmdline and the file is getting bigger up to 1gb and bigger....something is wrong?

nvm used different partition now have rooted nougat preview + ta, thanks!
[Sony Cross-Device General] jutphaas:
Hi,

I have a question,

I had 2 z5c devices. one of them i do no longer have, the other has a broken touchscreen and is almost written off (but I may buy and replace myself a new touchscreen thought from ali..)Now I have found on my pc one backup of a z5c ta.img that i made in the past however I do not know for certain if it is from this device or from the other that i do not have anymore.

I know i could not relock bootloader with this because it is device specific,

But... maybe with this method is there a way that I can test this on this device without risk of bricking? because it is put into another partition space?

Any advice/"how to" would be appreciated :)
[Sony Cross-Device General] munjeni:
See picture carefully! An example how can you know that. If you get the same RCK_H like you found on your ta image, by your device unlock key, than that ta.img which you used to search for RCK_H is definitely from that phone. Hope this help :)
[Sony Cross-Device General] oF2pks:
(1000thx for all your contributions...) indeed :

echo -n 7229e9264a256ffa | xxd -r -p | sha256sum -b | awk '{print $1}'
b78809419d34e7309e8113a3700adf169d6e33a249d48cc84f4444082a06f5e1

[MENTION=4120742]munjeni[/MENTION] , (I just switched from op5 to xz1...) without flashing new firmware, I noticed ta.img changes (via multiple backups & vbindiff comparison): is every last boot "registered" in TA partition ?

I read that imei is store in TA.img (which must never been modified OK), also for Playstore <certified>, are there any credentials stored inside TA : after very first unlocking bootloader my Playstore was <certified>.

Now despite Magisk & SafetyNet ok, my Playstore stays <uncertified> even after factory reset (with original xperia /boot & /recovery);

I remember the fatal trick on op5 was to 2x re-toggle bootloader lock+unlock, via fastboot to really complete factory reset (with original /boot & /recovery)

: can I relock/unlock the device or do I need to restore(dd) my very first TA.img (the one after 1st unlock bootloader) or other ...?

Any link/suggestion appreciated.
[Sony Cross-Device General] munjeni:
Don't know realy how it working related to playstore. Did you tried reflash whole firmware to see if you get certified playstore? If that not help than probably you are right about ta, in that case ta is related to certified playstore. Yes you can restore ta from last backup using dd. If you have plan to modify your ta image, which I not recommend, do in mind you will get unrecoverable brick in most cases if you modify some protected units! Also adler32 hash of the trim area partition need to be modified and also partiiton info...etc, which also cause invalid ta in case it is not updated! To check valid ta you can use https://xdaforums.com/crossdevice-dev/sony/dangerous-tool-trim-tool-t3516007 , and again suggestion do not play with ta, soo danger :)
[Sony Cross-Device General] PiixJu:
Hi,

I have problem with my old Z1 Compact (stock 5.1.1 rom and kernel 14.6.A.1.236).

Service Tests - Security is showing None

Only thing I've installed is supersu (for dmesg).

TA.img is my own (relocking with it works). And I've already tried factory reset.

Also I edited init.ta.sh, because without editing init.ta-log.txt showed cp command doesn't exist.

https://pastebin.com/budrPNry Dmesg

https://pastebin.com/UeXqDk1Q ta_poc log

https://pastebin.com/hNtx1nQy Edited init.ta.sh

root@D5503:/ # ls /data/local/tmp -la
-rw-rw---- tad root 2097152 1970-02-07 07:27 TA.img
-rw-rw-rw- root root 89 1970-02-07 07:26 init.ta-log.txt
root@D5503:/ # cat /data/local/tmp/init.ta-log.txt
init.ta.sh
Prepare to run ua modem switcher
Run ua modem switcher finished with status 0
root@D5503:/ #
[Sony Cross-Device General] munjeni:
Don't know realy, I realy have no free time to maintain and watch our thread, on quick look I can see that tad service not exist in your dmesg just for idea, don't know sorry, I hope somebody will help you here about it
[Sony Cross-Device General] PiixJu:
munjeni it's understandable.

If someone is willing to help then here's a logcat with lot "Failed to connect to tad." errors. Sadly I don't understand why they appear (I've used that same TA.img to relock the bootloader).

Sorry I cant upload it to pastebin because the size limit.
[Sony Cross-Device General] munjeni:
Nothing for getting idea. You must post dmesg log till after android boots
[Sony Cross-Device General] PiixJu:
https://pastebin.com/SLR8ngSV I hope that's what you meant.

btw it seems that you experienced that problem yourself https://xdaforums.com/showpost.php?p=71116940&postcount=597
[Sony Cross-Device General] munjeni:
Strange but in your dmesg nothing about tad and also no selinux denials, can't help sorry have no idea
[Sony Cross-Device General] PiixJu:
Does anyone has any idea how to fix this?

I've tried older FW (14.6.A.1.216) and it didn't changed anything.

Sadly any rootkernel version won't work. And my last hope DRM FUNCTION RESTORATION doesn't work either. :(

Can it be something to do with real recovery and the latest bootloader?
[Sony Cross-Device General] munjeni:
Watch your dmesg for tad service and for avc denials, if you found any of these post it here, right now I don't see anything which can give any idea
[Sony Cross-Device General] PiixJu:
I got it working. :)

From logcat I saw that updatemiscta was started before tad.

So I moved exec /init.ta.sh from init.rc to init.sony-platform.rc to on post-fs-data (before # SONY: Start early TA-users).

And

# SONY: Start the TrimArea Daemon. It must be started before fota-ua
class_start trimarea
exec /sbin/wait4tad_static

# SONY: checkabortedflash should be started as early as possible.
# Dependant on the TrimArea Daemon.
exec /sbin/checkabortedflash

from init.sony-platform.rc on init to beginning of the on fs.

Everything seems to be working, calls, data, wifi, camera and security under service test shows all keys OK.

The strange thing is that logcat doesn't show Trim Area daemon starting. anymore.
[Sony Cross-Device General] munjeni:
Yes thats strange, booth logcat or dmesg don't have that startup line. But logcat shows about tad service which sucesfully read/write trim area:

I/bs_updatemiscta( 371): Version info filename defaulted to: /version
W/bs_updatemiscta( 371): read_sw_version_info_file: Can not open file: '/version'
I/tad ( 213): MiscTA Unit 2202:
I/tad ( 213): NOT WRITTEN (Identical)
I/tad ( 213): MiscTA: Write of unit 2202 completed - OK

Anyway I'm glad you got it working. :)
[Sony Cross-Device General] levone1:
wzhy, [MENTION=4120742]munjeni[/MENTION] - I am running SailfoshOS on my Xperia X compact, with official rom, (Jolla SailfishX - https://www.google.com/url?q=https:...MBc4QFggLMAA&usg=AOvVaw1CTmTM1sBs3sK9Ltwaz8-_), and I wondered 1) would it be possible to attach ta to Sailfish boot img, (I tried with poc, and script hangs, and I was going to try with post by wzhy, but /dev folder in ramdisk contains nothing inside.. AIK detects boot img as AOSP), and 2) would there be any reason to want to do it, (i.e. would it even have the same effect, or would it just do nothing)?
[Sony Cross-Device General] levone1:
[MENTION=1552108]wzhy[/MENTION] - I went ahead and did the steps for sdcard. All ok, and TA is now mounted at .../mmcblk1p2. I'm not clear on how to get the kernel to look there. Unpacking boot img shows nothing in /dev folder, but I think you don't mean to copy folders, but something else?...

Edit - ok, I think I'm starting to put it together, (actually I remember now going over this in early days of poc - I forgot). The strings to be edited are in init files in ramdisk /. So, there are none of those files in my ramdisk, (not Android), but there is only one file, 'init', which is small, and has a couple of lines. I guess I can experiment with editing that...
[Sony Cross-Device General] Garrsett:
Success in Xperia X Compact SO-02J. Thank you so much. :D
[Sony Cross-Device General] wzhy:
Sorry for late reply. you need look for the service "tad_static" in init.sony-platform.rc. change the second path to /dev/block/mmcblk1p2. also you will need to add sepolicy with mmcblk1p2 as same as the poc script do.
[Sony Cross-Device General] simply F:
Hi

How can I backup my DRM with Android Oreo?

Thank you
[Sony Cross-Device General] darknessmc:
I can't make it work on aosp based rom. I got no signal. It's working perfect in stock rom. My temp log like this "init.ta.sh

cp: bad '/stufs/TA.img': Permission denied"

Is there anyway to use drm in oreo aosp rom?

---------- Post added at 06:58 PM ---------- Previous post was at 06:49 PM ----------

I can make a partition in extsdcard but need to know if there is something else to change than you wrote.
[Sony Cross-Device General] shoey63:
AOSP needs unlocked bootloader, which assumes lost DRM keys. Attempting to simulate restoring them would, at best, do nothing.
[Sony Cross-Device General] darknessmc:
Thanks for your reply. I know that and I'm using it with custom kernel in stock rom but if there's another way to load ta in a spare partition.
[Sony Cross-Device General] darknessmc:
[MENTION=1552108]wzhy[/MENTION] I did all in sdcard partition and replaced mmcblk0p1 with mmcblk1p2 as my ta in sdcard but I got bootloop (sony logo then restart). I can enter twrp but cannot load system.

Is unpaking or repaking kernel can do this issue?
[Sony Cross-Device General] lordalireza:
Trim area dump is a valid.

Locked bootloader.

Deleting old folder ramdisk if exist...

command ret: 0.

New directory ramdisk created.

Using folder "out"

opening D:\Xperia Z2 Flashfiles\Oreo\ta_poc\boot.img

D:\Xperia Z2 Flashfiles\Oreo\ta_poc\boot.img is Android image format.

Dumping to out...

BOARD_KERNEL_CMDLINE androidboot.hardware=qcom msm_rtb.filter=0x3b7 ehci-hcd.park=3 dwc3.maximum_speed=high dwc3_msm.prop_chg_detect=Y vmalloc=300M buildvariant=user

BOARD_KERNEL_BASE 00000000

BOARD_NAME

BOARD_PAGE_SIZE 2048

BOARD_KERNEL_OFFSET 00008000

BOARD_RAMDISK_OFFSET 02000000

BOARD_TAGS_OFFSET 01e00000

BOARD_OS_VERSION 8.1.0

BOARD_OS_PATCH_LEVEL 2018-08

BOARD_DT_SIZE 251904

Done.

No file exist out/boot.img.elf .

Gunziping...

setting up infflate...

infflating...

infflate returned: 0

gzpipe: ok.

unziped: ok.

Extracting ramdisk.cpio...

Runing user script...

Making ramdisk/stufs folder... done

Removing ramdisk/.backup folder... done

Found android version equal or greater than Marshmallow.

Making ramdisk/init.ta.sh script... done

Found string 'service tad_static' in ramdisk/init.camera.rc@0750

patching ramdisk/init.camera.rc@0750

installing ramdisk/stufs/TA.img

Found string 'mkdir /data/local/tmp' in ramdisk/init.rc@0750

patching ramdisk/init.rc@0750

Error, no file_contexts!

command ret: 1.

Your script didn't returned 0, please check your script!

Press any key to continue . . .

plz can some one help me? i am using xperia z2 with carbon rom for oreo and after i select boot.img and ta.img this happens. what should i do?
[Sony Cross-Device General] rizky_zulfikar:
great work [MENTION=4120742]munjeni[/MENTION] :D !!! i've done with my F8322 and S0-02J repack my kernel n TA.img using ta_PoC and rootkernel, with the latest magisk and it's done without any error :D
[Sony Cross-Device General] behrooz4:
hi

Can I use the stock kernel?

boot.sin stock kernel D6502_23.5.A.1.291_Customized MAA.ftf
[Sony Cross-Device General] sabotage154:
so i have my TA backup.

1. when i use the munjeni tool to preserver my TA image do i need to use the marshmallow kernel or use the latest .118 kernel when running that tool?

2. the munjein tool says to open DOUBLECLICKME.bat with text editor and change kernel name! does that mean i modify the .bat file where it says ("Chose your kernel!") and add my kernal file name there?
[Sony Cross-Device General] Hari Nguyen:
Can you be more specific about what sefcontext your tool can't handle, I did remove that hex but only error message change from 6! To 8! ?
[Sony Cross-Device General] klausstoertebeker:
Hi munjeni,

just a question:

Would it be possible to write an app that will apply the TA_POC magic to the kernel of a rooted device by simply selecting the TA.img and then just touching a "DO IT"-button?

Or is it possible to add a script which installs a Magisk.zip file in the process of TA_POC'ing? Similar to the script to add a recovery?

I ask this may be stupid question because I'm not able patch my Sony Xperia Z4 Tablet with both TA_POC and Magisk. Applying the TA_POC patch to a stock kernel elf file works fine, so does patching a kernel.img with the Magisk app.

BUT combining both by modifying a TA_POC'd image with the Magisk app generates an error saying "Unknown format" (or something like that) or by TA_POC'ing a Magisk-patched kernel.img doesn't generate an error while patching but ends up in a bootloop after flashing.

Regards from Germany
[Sony Cross-Device General] &(*):
I think it's bootlooping because you patched a production (.sin) image and that will be flagged to not boot. You have to repack it as AOSP with AIK (does it automatically) then apply the patches to run stock kernel with TA_PoC and Magisk root permissions.