yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] DeadXperiance:
I don't know about scripting and more about command line. I have taken boot.img from vanir amami rom and ta.img from my backup of ta and proceed with latest PoC

------------------------------------------------------------------------
Trim Area PoC kernel image patcher by Munjeni @ 2017
------------------------------------------------------------------------

hash:0x09BC3A5F calc_hash:0x09BC3A5F
hash:0x6A4A73CF calc_hash:0x6A4A73CF
hash:0x1F3C1788 calc_hash:0x1F3C1788
device: D5503
serial number: CB5A2434U9
drm key: 0001046B 0010 3F 3D 7C 18 52 06 BC 7A 37 63 F9 5F 21 5C 90 AC
Trim area dump is a valid.
Locked bootloader.
Deleting old folder ramdisk if exist...
command ret: 0.
New directory ramdisk created.
Created ouput folder "out"
opening C:\Users\Patel\Downloads\ta_poc\boot.img
C:\Users\Patel\Downloads\ta_poc\boot.img is Android image format.
Dumping to out...
BOARD_KERNEL_CMDLINE androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3b7 ehci-hcd.park=3 androidboot.bootdevice=msm_sdcc.1 dwc3.maximum_speed=high dwc3_msm.prop_chg_detect=Y coherent_pool=8M vmalloc=400M
BOARD_KERNEL_BASE 00000000
BOARD_NAME
BOARD_PAGE_SIZE 2048
BOARD_KERNEL_OFFSET 00008000
BOARD_RAMDISK_OFFSET 02000000
BOARD_SECOND_OFFSET 00f00000
BOARD_TAGS_OFFSET 01e00000
BOARD_DT_SIZE 258048
Done.
No file exist out/boot.img.elf .
Gunziping...
setting up infflate...
infflating...
infflate returned: 0
gzpipe: ok.
unziped: ok.
Extracting ramdisk.cpio...
Runing user script...

Making ramdisk/stufs folder

Found android version equal or greater than Marchmalow.

Making ramdisk/init.ta.sh script

Found string in ramdisk/init.qcom.rc@0750
patching ramdisk/init.qcom.rc@0750

installing ramdisk/stufs/TA.img

Found string in ramdisk/init.rc@0750
patching ramdisk/init.rc@0750

Found plaintext ramdisk/file_contexts@0644
patching ramdisk/file_contexts@0644

Patching ramdisk/sepolicy@0644

Searching for old drmfix and removing...

dm-verity:
dm-verity is already disabled!

Sony RIC:
No Sony Ric.

force-encrypt:
force-encrypt is already disabled!

Press any key to continue . . .
command ret: 0.
Repacking ramdisk...
ramdisk.cpio done.
Making ramdisk.gz
defflating...
defflate returned: 0
setting up infflate...
infflating...
infflate returned: 0
gzpipe: ok.
gzip: ok.
ramdisk.gz done.
Found kernel dt.
Found QCDT magic string.
Packing new_boot.img
cmdline="androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3b7 ehci-hcd.park=3 androidboot.bootdevice=msm_sdcc.1 dwc3.maximum_speed=high dwc3_msm.prop_chg_detect=Y coherent_pool=8M vmalloc=400M"
base="0x00000000"
pagesize="4096"
ramdiskoff="0x02000000"
tagsoff="0x01e00000"
making new_boot.img
new_boot.img created.
Done.

Press any key to continue . . .

create new boot.img

Is that everything fine? Can I flash new boot.img?
[Sony Cross-Device General] x_one:
Just make backup of current boot with twrp and flash new one. If something goes wrong just revert backuped boot.
[Sony Cross-Device General] levone1:
OK, I got successful dmesg for this one. DU ROM, marshmallow, only poc, no other mods, boot IMG successfully created, and when boot, no sim, and no change in camera.

http://pastebin.com/mCUG8bUz

Thanks
[Sony Cross-Device General] munjeni:
I didn't found anything about tad, anything about init.ta.sh, any denial, almost anything in your log, only which I can say is that kernel is not stock based, it is aosp based on jerpelea 3.10, seems usupported with poc! Even if you somehow get it working you will not notice any camera improvement since sony stock camera stufs is not implemented on that kernel/rom. I don't have idea why it not working :(
[Sony Cross-Device General] 2ddssa:
$POC toolbox toolbox capability dac_override $SEPOLICY $SEPOLICY NULL >/dev/null 2>&1

added this seinject in latest poc and after realy working on LOS, your great tool your efforts become more compatible with a large number of kernel%)
[Sony Cross-Device General] munjeni:
New version is out, implemented function which will check incopatible file_contexts.bin and report error if found it.
[Sony Cross-Device General] up2dateneurosis:
Thanks for the update and for your quick answer for my problem with the integration of poc and root in one kernel. Now it works with SIM.

How can i check now that my DRM Keys also work? *#*#7378423#*#* Service tests -> Security ?

I got no errors here :) But is there a nother way to proof everything?
[Sony Cross-Device General] levone1:
Just for curiosity tried with straight AOSP N, and Vanir MM, and both the same. I guess I'll just keep hoping. Our phone hasn't seen a decent camera since LP, but so many great roms... Maybe someday...

Thanks for your work and help.
[Sony Cross-Device General] xvit096:
Nvm, resolved. Thanks mate! - 2 TA's on data/local/temp folder -
[Sony Cross-Device General] shoey63:
So you deleted both and ended up with one after a reboot?
[Sony Cross-Device General] munjeni:
Did you checked if TA.img is autocopied to /data/local/tmp ? I am pretty confused with your log, didn't believing that nothing is on your log, apsolutly nothing which will point me for fixing that, so thinking that you maybe doing something wrong, can you write each step you have done? Maybe you have missing something I don't know realy. Is your dmesg full or you cut them? Can you catch more dmesg for example 3 dmesgs, each after ten seccons - after boot? I must see status of the TAD which curently not exists in your log!
[Sony Cross-Device General] levone1:
OK, I'll check it out again when I can and get back to you with details. Thanks
[Sony Cross-Device General] xvit096:
[MENTION=4675598]shoey63[/MENTION] no mate, just let it to be there, I do not see any harm having two, or deleting one. I have two ta.img because I pushed using adb
[Sony Cross-Device General] s.hossein:
My phone is z5 dual. new boot.img created and everything is good but now twrp was missed. I find twrp for recovery parttion for e6653, but it can't find my SD card on twrp. Any suggestions.
[Sony Cross-Device General] munjeni:
New version is out! I have added support for recovery (didn't tested), you must put working recovery.img for your phone model in the same dir with poc before patching. I didn't tested if thing work so let me know!
[Sony Cross-Device General] levone1:
OK, did another test on AOSPA MM ROM. Same result. I found that TA.img is not auto-copied to /data/local/tmp. If I manual copy, and set permissions 660, then permissions get reset to 600 after reboot.

Here is dmesg from new_boot IMG - http://pastebin.com/CssURqYy

Thanks

---------- Post added at 03:34 PM ---------- Previous post was at 03:27 PM ----------

Here's a link to new_boot img, if helps...

https://mega.nz/#!E0s1nawA!Zz6tSOW9yhMNEwLDITQrCGUacqXLcK4lgLMbsoD9SlA
[Sony Cross-Device General] munjeni:
You have signal after manual copy?
[Sony Cross-Device General] levone1:
Ko

No. I didn't wait a long time to see, but a minute or 2...

---------- Post added at 08:31 PM ---------- Previous post was at 07:34 PM ----------

OK, munjeni, I finally got it. I don't know what I did different, except changing ta IMG permissions in recovery, (/data/local...), but I started over and did it from scratch, and working now. Thanks
[Sony Cross-Device General] gr8st:
I tried latest poc with support for recovery on Kernel12s for concept rom . I'd love to have recovery added as you have to boot into fastboot mode (with PC) just to be able to access recovery.

Sadly the latest version caused a true soft brick, no boot logo just black screen. The older poc version (without recovery) had no problem when used on Kernel12s. The recovery image I used was stable 3.0.2 version. Needless to say, I couldn't access kmesg or dmesg logs.

Here is download to kernel and also kernel source.

Thanks again [MENTION=4120742]munjeni[/MENTION]
[Sony Cross-Device General] mobiware:
Hi there,

I backed up my TA keys, unlocked the bootloader and flashed the E6683_Customized MY_1298-9654_32.3.A.0.376_R1D firmware without problems. I flashed the FTF after deleting the "fwinfo.xml" and excluding the TA files, and everything worked fine.

I have the following questions, if you could enlighten me:

1. I didn't see anything about restoring the TA keys back to the Nougat firmware. Do you know if I can use the "tarestore.bat" file from iovyroot?

2. Do I need to download TWRP and somehow put it in the flash subdirectory so that it's flashed?

3. If I use TWRP, can I flash "superuser" instead of "SuperSU" which has a lot of battery drain?

4. Is there any way to remove "DM-Verity" and "Sony RIC"?

5. Does this method give access to the external microSD card?

Thank you so much in advance,

MW
[Sony Cross-Device General] fluffi444:
After patching with latest tool incl recovery.img the resulting file exceeds 20 MB - Is this not too big for many boot partitions? Z3C has 20MB (only) for instance. Maybe also the reason for this sofrtbrink.

I didn't falshed this this because of the size. So no proper answer regadring test here.
[Sony Cross-Device General] munjeni:
1. don't know and never tried

2. you need recovery.img, put in the same dir with ta_poc, than run doubleclick

3. if you using builtin super(SU|USER) its related to twrp itself if it going to work

4. doubleclick doubleclick script and folow dialogs

5. this method patches your kernel and have nothing related to your micro sd card
[Sony Cross-Device General] munjeni:
New version is out, recovery patching mechanism is a bit diferent now, tested on my z1c and it working perfectly now, now recovery.gz is created instead of whole recovery.img so size is now a lot less. Yelow color is indicator for volume key press, blue light indicating recovery boot, red light indicating android boot. In case volume keys is not 42 you will need to change it in binaries/init script (just look into /bootlog.txt to see right volume key if default one from init script is not 42 on your device model
[Sony Cross-Device General] fluffi444:
For me still too big: 20,1 MB (21.176.320 Bytes) - as you already did cpio and gzip, don't know if more compression is possible...

I must admit that I have two busyboxes in ramdisk... yours and the one from custom kernel (in vendor/bin).

I think i can remove this because old twrp was removed buy me (EliteKernel had one already). Will try...
[Sony Cross-Device General] munjeni:
If you remove one of these you must modify init script to use right path to BB and also first line too. I will try to update install_recovery.sh and add auto removal in case BB already exist
[Sony Cross-Device General] oziris11:
On my Z3+ recovery is not established.:(
[Sony Cross-Device General] munjeni:
Do in mind you must have working recovery.img firtst! To be sure if recovery.img is working temp boot it first with "fastboot boot recovery.img", if it working than you can use with poc, if not working it will not work too in poc
[Sony Cross-Device General] fluffi444:
Yes - already did. Better to say was not needed because I used your is sbin and removed the one in vendor/bin...
[Sony Cross-Device General] munjeni:
In boot_androXZ.img I found 3 busyboxes :laugh:

Install Recovery:
- Install? (Say yes to install) [Y/n] Y
Installing recovery. . .
Found ramdisk/bootrec/busybox@0775
ramdisk/sbin/busybox@0777
ramdisk/vendor/bin/busybox@0766

I realy not going to fix anybody boot images since peoples doing unbelievable things like having 3 busybox's in his boot images
[Sony Cross-Device General] oziris11:
Itself recovery.img works.
[Sony Cross-Device General] munjeni:
New version is out, another busybox will not be copied in case an busybox allready exist
[Sony Cross-Device General] munjeni:
Try new version! In case not works for you it would be great having your /bootlog.txt
[Sony Cross-Device General] munjeni:
Is blue light when you press volume key? In case not... I have told about it, you will need to look into your /bootlog.txt to get right volume key and modify init script - change 42 to right key num!
[Sony Cross-Device General] oziris11:
TWRP 3.03. No indication, only when cykloreboot 4 times blinking red led.
[Sony Cross-Device General] munjeni:
Can you push keycheck from binaries folder to your device /data/local/tmp and execute it? Seems keycheck tool which I have provided not compatible with 64bit device?
[Sony Cross-Device General] oziris11:
I have no keycheck in the specified folder.

My bootlog.txt

Wed Jan 21 03:55:22 UTC 1970

+ /vendor/bin/busybox rm -f /init

+ /vendor/bin/busybox mv /init.bin /init

+ /vendor/bin/busybox mount -t proc proc /proc

+ /vendor/bin/busybox mount -t sysfs sysfs /sys

+ Check for cmdline

/init: line 1: Check: not found

+ /vendor/bin/busybox grep -q warmboot=0x77665502 /proc/cmdline

+ /vendor/bin/busybox mkdir -m 755 -p /dev/input /sys

+ /vendor/bin/busybox mkdir -m 555 -p /proc

+ /vendor/bin/busybox seq 0 12

+ /vendor/bin/busybox expr 64 + 0

+ /vendor/bin/busybox mknod -m 600 /dev/input/event0 c 13 64

+ /vendor/bin/busybox expr 64 + 1

+ /vendor/bin/busybox mknod -m 600 /dev/input/event1 c 13 65

+ /vendor/bin/busybox expr 64 + 2

+ /vendor/bin/busybox mknod -m 600 /dev/input/event2 c 13 66

+ /vendor/bin/busybox expr 64 + 3

+ /vendor/bin/busybox mknod -m 600 /dev/input/event3 c 13 67

+ /vendor/bin/busybox expr 64 + 4

+ /vendor/bin/busybox mknod -m 600 /dev/input/event4 c 13 68

+ /vendor/bin/busybox expr 64 + 5

+ /vendor/bin/busybox mknod -m 600 /dev/input/event5 c 13 69

+ /vendor/bin/busybox expr 64 + 6

+ /vendor/bin/busybox mknod -m 600 /dev/input/event6 c 13 70

+ /vendor/bin/busybox expr 64 + 7

+ /vendor/bin/busybox mknod -m 600 /dev/input/event7 c 13 71

+ /vendor/bin/busybox expr 64 + 8

+ /vendor/bin/busybox mknod -m 600 /dev/input/event8 c 13 72

+ /vendor/bin/busybox expr 64 + 9

+ /vendor/bin/busybox mknod -m 600 /dev/input/event9 c 13 73

+ /vendor/bin/busybox expr 64 + 10

+ /vendor/bin/busybox mknod -m 600 /dev/input/event10 c 13 74

+ /vendor/bin/busybox expr 64 + 11

+ /vendor/bin/busybox mknod -m 600 /dev/input/event11 c 13 75

+ /vendor/bin/busybox expr 64 + 12

+ /vendor/bin/busybox mknod -m 600 /dev/input/event12 c 13 76

+ /vendor/bin/busybox mknod -m 666 /dev/null c 1 3

+ set_led_color 255 255 0

+ set_led_color_comp /sys/class/leds/led:rgb_red 255

+ local max

+ read max

+ [ -z 154 ]

+ echo 154

+ set_led_color_comp /sys/class/leds/led:rgb_green 255

+ local max

+ read max

+ [ -z 511 ]

+ echo 511

+ set_led_color_comp /sys/class/leds/led:rgb_blue 0

+ local max

+ read max

+ [ -z 460 ]

+ echo 0

+ /vendor/bin/busybox timeout -t 3 /vendor/bin/bootimg keycheck

Terminated

+ KEY=143

+ [ 143 -eq 115 ]

+ [ 143 -eq 114 ]

+ echo Booting Normally

Booting Normally

+ set_led_color 0 0 0

+ set_led_color_comp /sys/class/leds/led:rgb_red 0

+ local max

+ read max

+ [ -z 154 ]

+ echo 0

+ set_led_color_comp /sys/class/leds/led:rgb_green 0

+ local max

+ read max

+ [ -z 511 ]

+ echo 0

+ set_led_color_comp /sys/class/leds/led:rgb_blue 0

+ local max

+ read max

+ [ -z 460 ]

+ echo 0

+ /vendor/bin/busybox umount /proc

+ /vendor/bin/busybox umount /sys

+ /vendor/bin/busybox rm -rf /dev/console /dev/input /dev/null /vendor/bin/bootimg /vendor/twrp.xz

+ exec /init
[Sony Cross-Device General] munjeni:
Well. Since this is not part of the my recovery patching mechanism you can contact tobias since you using his recovery patching mechanism, as I told earlier I not going to mess with anything from his root kernel tool, so if you using something out of my poc please do not report anything in my thread, report it in proper forum thread e.g. thread of the that tool
[Sony Cross-Device General] oziris11:
Thank you for taking the time.
[Sony Cross-Device General] Hamidreza2010:
[MENTION=4120742]munjeni[/MENTION] bro would you please change this tool that we can use tobias recovery and put it poc folder and integrate to kernel?

its easy and dont need to find working recovery.img for our device because that was in "Android\twrp_common_kmodules " before but i dont know whats that formats :D

Thanks
[Sony Cross-Device General] munjeni:
No sorry. One more thing with my tool you can install any recovery not only twrp
[Sony Cross-Device General] fluffi444:
Recovery is not booting here.

Colors I get:

Yellow - I pressed vol up or down

Blue - comes immediately

Pink - right after blue

then blackscreen

then again sony logo, blue led followed by short orange, and blackscreen again - this in a loop

Recovery is not starting...

Normal boot to system works if I press no key.
[Sony Cross-Device General] munjeni:
You must find pure recovery (recovery.img) , not one which contains two ramdisks like cm boot.img! As you can see in my init.sh there is no pink color, your recovery seems contain another init script for recovery boot/android boot which looks like not pure recovery.img with single ramdisk
[Sony Cross-Device General] fluffi444:
I used this one...Only colors and partitions modded.

https://xdaforums.com/showthread.php?t=3557606

Which is a mooded one (by me) from Russel5's oringal work:

https://xdaforums.com/z3-compact/general/d5803-z3c-aries-twrp3-0-t3543113

Will try original from TWRP project page.

EDIT

Works! :good: - loads fast as hell!

with official TWRP https://dl.twrp.me/z3c/ (Z3C - TWRP 3.0.2.0)
[Sony Cross-Device General] munjeni:
Checked that right now, found init which is symlink to sbin/init_sony, so that colors which you gets is part of the init_sony, in most case something from init_sony cause a boot loop since init from me and init from sony is sum of the two init scripts, so it might be a reason for boot loop, you might need to press volume key on sony_init! I still not understand why that recovery contain sony_init binary since it is not boot image!
[Sony Cross-Device General] munjeni:
The ideal thing would be to repack that recovery.img and remove init_lnk_ and rename init.real@0750 to init@0750 , than it will not use init_sony from sbin! Anyway I didn't see any point why there is init_sony when it is pure recovery
[Sony Cross-Device General] munjeni:
Great!
[Sony Cross-Device General] fluffi444:
Thanks for your usefull tips (all the time).
[Sony Cross-Device General] mobiware:
THANK YOU SO MUCH; I REALLY APPRECIATE IT!

On #2, do I need to extract recovery.img from the .FTF then and put it in the ta_poc subdirectory?
[Sony Cross-Device General] munjeni:
No, recovery from ftf is stock recovery, it not going to work. You need custom recovery e.g twrp or cwm, to put into the same dir with ta_poc.exe...
[Sony Cross-Device General] shoey63:
[MENTION=4120742]munjeni[/MENTION]

I got integrated TWRP to work on Z5, but I had to replace busybox and keycheck binaries from https://github.com/jackfagner/twrp-sony-recovery-boot-script due to being 64 bit device.

But TWRP doesn't like running on top of stock kernel (can't mount /data or /cache, even though there is no encryption)

Booting into recovery using hardware keys (old school method - Flash recovery.img to Fotakernal, then power off and reboot holding power and volume down, then releasing them) is fine, as recovery.img uses its own kernel.

Is there any way to integrate TWRP using the recovery.img zImage for booting into recovery with your ramdisk integration method?

Edit: 64 bit Sony have a 64 MB boot partition, so no space issues.
[Sony Cross-Device General] fluffi444:
Tested this also. And can't mount the mentioned partitions as well. Also system can only be mounted as read only. Internal SD card is also not available.
[Sony Cross-Device General] munjeni:
You no need to change our 32 bit binaries since it will work even on 64 bit platform! About twrp runing on top of stock kernel, I have no idea realy! You will need to figure out why that happens an tell me for possible workaround! You will need to look into recovery log && dmesg to get idea why it fail to mount rw, I have 32 bit device & no problem with rw so no idea why it fail on your's 64 bit devices

Maybe selinux isue? Or fstab? Try to catch up your decovery log & dmesg and pastebin it
[Sony Cross-Device General] shoey63:
Worked it out. It's Sony Ric.

I disabled it in the TWRP ramdisk as well, and now it's fine?
[Sony Cross-Device General] zohaib0001:
And how you did that ?

in which folder in which file ?
[Sony Cross-Device General] shoey63:
- unpack your recovery.img

- open init.rc file in ramdisk

- put this

mount securityfs securityfs /sys/kernel/security nosuid nodev noexec
write /sys/kernel/security/sony_ric/enable 0

just before the "on late-init" section

- repack and use in poc tool.

Why? Because TWRP is using the stock (RIC enabled) kernel, so it need to be disabled to get access to /system, /data and /cache.
[Sony Cross-Device General] fluffi444:
Haha. So simple and easy. Big thanks for your findings...
[Sony Cross-Device General] rocker00:
still unable to get access even after this fix !

i attached init.rc if u can modify it please,maybe i am doing something wrong !

my device is z2 and am using the official twrp from here https://twrp.me/devices/sonyxperiaz2.html .thank you :) .

Edit:nvm got it working,thanks shoey for finding this fix.
[Sony Cross-Device General] munjeni:
Thanks! New version is out, now with recovery ric patching mechanism
[Sony Cross-Device General] serajr:
So it was indeed all about the damn ric!

Thanks alot for the info!! :highfive:

Bro, amazing idea of adding the script to integrate recovery image! Everything working, including data decryption (see screenshots)!

I've made some changes in the

install_recovery.sh

script to auto detect platform (32 or 64) and copy proper binaries out (busybox and keycheck). Also fixed small typos in the main script (

patch_things.sh

) and already added the log denials below:

toolbox shell_data_file dir remove_name
toolbox shell_data_file file unlink
init shell_data_file file append
toolbox shell_data_file file append
toolbox toolbox capability chown,fowner

Tool's output:

Install Recovery:
- Install? (Say yes to install) [Y/n] Y
Installing recovery. . .
[COLOR="DarkOrange"]Platform: 64 bit[/COLOR]
No Sony Ric in recovery!
Disabling ric in recovery. . .
[COLOR="DarkOrange"]Installing 64 bit binaries. . .[/COLOR]

Another thing I've added was an

init.ta.sh

script log (

/data/local/tmp/init.ta-log.txt

) which will output errors only (if any), as you can also see in the screenshots. Log shows us that TA.img has not been removed due r/o file system.

Going a step further, I also tried adding the blue lines below in the rc:

# Part of the TA PoC
[COLOR="Blue"]mount rootfs rootfs / rw remount[/COLOR]
exec u:r:init:s0 -- /init.ta.sh
[COLOR="Blue"]mount rootfs rootfs / ro remount[/COLOR]

This time

/stuffs/TA.img

was successfully removed, but

/data/local/tmp/TA.img

was removed too! Weird!!!

Is

/data/local/tmp/TA.img

symlinked to

/stuffs/TA.img

, or something like that?

I ended up removing those blue lines from script.

Well, All changes/additions are in the attached

ta_poc_changes.zip

file.

Edit: Attachment removed!
[Sony Cross-Device General] munjeni:
Thanks for typo, strange that /data/local/tmp/TA.img gets deleted :confused:

This is not portable:

local initzygote=$(find_file $RAMDISK/init.zygote64_32.rc)

About platform detection, thats not a portable and universal way looking for platform bit! It will not work in all case! Whole things which I done is universal and didn't depens on "fixed" file names, hope you have see that in scripts, I am more about to make "universal" thing instead of fixed file name search... But why we need 64 bit things? Is current 32bit not working? I have hacked all 32 bit binaries, hex modified pie bit and allso all is static, I am pretty sure booth is working on 64 bit device?
[Sony Cross-Device General] Hamidreza2010:
[MENTION=3989065]serajr[/MENTION] bro can you add script to integrate superuser ( its better ) or SuperSU in kernel ?

with this , this tools is complete