[Sony Cross-Device General] Fragmentation:
At first I created a guide about rooting stock Marshmellow of Sony Xperia Z5 Premium. After some time I realized that it may be useful to users of virtually any recent Sony phone or tablet, so here is my Sony Cross-Device general rooting thread. I will mostly copy-paste bits from my previous guide, but using renewed screenshots and firmwares'/tools' versions.

Please write back in this thread which model of Sony phone you was able to root with the help of this guide.

This guide does not work for MediaTek devices.

INTRODUCTION

Sony historically provides own versions of Android OS, modified for Sony phones. These firmwares with added Sony apps are known as a stock firmware, contrary to vanilla Android developed by Google.

This guide will lead you through the process of rooting the stock firmware for your particular Sony phone. At the same time, your phone will be supercharged with TWRP recovery image, a useful tool for things such as an installation of system behavior altering apps to a whole device backup including all system partitions.

WHY ROOT?

Sony, just as any other smartphone vendor, ships its devices without the ability to alter inner system workings of Android OS. Technically speaking, default OS only allows use of non-administrator accounts, which have access only to their own user space.

Rooting is a process of allowing access to the administrator account, also known as root. This enables a possibility to alter/remove system parts of the OS: apps, settings, behaviors. For example, with root access you can block ads system-wide, from apps to browsers.

WHAT ARE CAVEATS

During the rooting procedure, the unique DRM keys will be removed from the phone. These keys are used to make some proprietary Sony features work, such as X-Reality for Mobile, camera denoise filter etc.

During the course of this guide a so called DRM fix will be apllied, which effectively emulates DRM keys, so many Sony features remain in working condition, even without actual keys. Some features, such as Widevine, will not work but majority of typical users won't even notice this. I think most of you even don't know what Widevine is.

However, in this guide I will present a way to backup your DRM keys, if you still think you need them. I will not deep dive though, since I never bothered with DRM keys export/import procedure myself and have no experience in doing this.

Some apps will refuse to work on rooted device, Pokemon Go and Android Pay are couple of notorious examples. Research your apps for rooted device compatibility. If you find such app and cannot live without it, don't root your phone.

ACCOLADES

The rooting of Sony stock firmware will not be possible without the work of these brilliant community developers:

@Androxyde — Flashtool

@IgorEisberg — XperiFirm (integrated into Flashtool)

@Dees_Troy et al. — TWRP

@Chainfire — SuperSU

@topjohnwu — Magisk

@tobias.waldvogel — Kernel repack script and DRM fix

@zxz0O0 — iovyroot

@rayman — TA Backup v2

STEPS

The whole process of rooting your stock firmware is divided into the following steps:

Getting your phone recognized by your computer (driver installation).

(optional) Backup your DRM keys.

Unlocking a bootloader.

Flashing stock firmware with Flashtool.

Repacking and flashing a kernel.

Installing SuperSU or Magisk.

(optional) Restore your DRM keys.

Optional tasks.

After the completion of this guide, your phone contents will be completely erased, so you may want to backup all what is important to you to some external locations. External microSD card will not be erased, so you may copy your stuff to it. If you are already use some rooted Android, you may want to use some specialized tools like Titanium Backup or like. TWRP also have a nice backup features, if you have one already installed.

Also, use Sony's own Backup & reset tool from the settings. You may backup your local contacts, messages and much of such stuff directly to your microSD card. After the rooting, same tool may be used to restore some (or all) of these things back.

I usually make a whole backup with TWRP, Titanium Backup for user apps and the Sony's Backup & reset for conversations and call logs.

The guide was developed using Windows 10 Pro 64-bit and Sony Xperia Z5 Premium Dual-SIM E6883 official model for the Russian market.

Let's go.

1. GETTING YOUR PHONE RECOGNIZED BY YOUR COMPUTER (DRIVER INSTALLATION)

During the course of this guide, your phone will comminicate with your computer in Fastboot and Flashmode connection modes. When connected in these modes, for the phone to be properly recognized by a computer, you have to provide special drivers. Thanks to Flashtool creators, it comes bundled with generic drivers compatible with all recent Windows operating systems, so at first you should install Flashtool. You can get installer from the official website.

Next, you should install Fastboot and Flashmode drivers for your phone.

One caveat here however, these drivers are not from a "recognized Windows developer", that is they are not Windows-certified, so to get them installed on Windows 8/10, you should reboot with the disabled driver signature enforcement. Use Google to know how to perform this.

Once booted in the aforementioned mode (or in a regular mode if you are still on Windows 7), proceed to the actual driver installation. The drivers are packed into the Flashtool\drivers\Flashtool-drivers.exe executable, but it didn't work on my system, perhaps because it is 64-bit (but feel free to try it yourself), so I simply unarchived it with 7-Zip (right-clicked it and chose 7-Zip > Extract to "Flashtool-drivers"). I got a Flashtool-drivers folder, which contained all the drivers from the executable.

Once drivers are unpacked, connect your phone in a Fastboot mode. Recent Sony devices can boot in Fastboot just like this: shutdown the phone, press and hold Volume Up rocker button and connect USB cable to the phone while the other end is connected to a running PC. The phone's LED will turn blue shortly. That's it, you are in a Fastboot mode. Open Device Manager (Win + X, Device Manager) and check if there is some unknown device (with the name S1Fastboot or something like this).

Double-click this unknown device in the Device Manager, click Update Driver..., then Browse my computer for driver software, and choose the Flashtool-drivers folder created earlier with 7-Zip (leave Include subfolders checked). Shortly you will get a red warning dialog window, which inform you that this driver doesn't have a proper signature:

​

Very scary. Just proceed with the install despite all the red flags, it's safe.

Once Fastboot driver is installed, plug out the USB cable off the phone and connect it in a FlashMode mode. This is done just like for Fastboot, but in this case you should press and hold Volume Down rocker button during the cable plugging in. The LED in this case will be green and not blue. The procedure to install the driver is exactly the same.

After the successful installation, try to reconnect the phone in these modes again couple more times to make sure all devices get properly recognized by Windows. If all seems good, proceed to the next step.

2. (OPTIONAL) BACKUP YOUR DRM KEYS

I encourage you to skip this step, but if you feel like you should do this anyway, here is some info.

There is a tool called iovyroot, with which you can backup your DRM keys from an unrooted phone, but at the time of the writing it doesn't support latest firmwares. It does support a lot of older firmwares so it may be useful to not upgrade your phone before checking up this tool.

If you're into this backup DRM thing, go to the original thread, download the latest version and check if it is working for you. For now I just skip this step. Basically, you want to download the zip, connect your phone in USB Debugging mode, run the tabackup.bat script and see the output.

Some people suggest to use the newer Universal (Dirtycow-based) TA Backup v2 tool instead of ageing iovyroot to backup you keys. Please check the official thread to get instructions (linked in the previous sentence).

I will not cover DRM keys extraction/restore in details, since I never did it, so I don't want to write about something I haven't myself performed. Please check corresponding threads.

Note that most proprietary Sony features will work even without DRM keys, such as X-Reality for Mobile, camera denoise filter and some others. DRM fix will be covered later in this guide. Some features will not work with DRM fix, Widevine for example. Most users will not even notice these.

3. UNLOCKING A BOOTLOADER

Sony does provide its own guide. It is a plain and simple and — good news! — if you have followed the previous steps, you just got all the prerequisites covered!

4. FLASHING STOCK FIRMWARE WITH FLASHTOOL

Now we will flash the latest available Sony firmware to the phone. In this step it will be untouched vanilla firmware, without root yet.

The Flashtool was installed on the completion of the first step, so let's start it. If you are on 64-bit Windows, start Flashtool64 (there is a shortcut in the Start menu). It does require administrator privileges.

Once you are in Flashtool, at first you need to obtain the most recent official stock firmware from Sony. Press the "XF" icon (the right-most one in the toolbar) to start XperiFirm. This is where it is:

​

The window will open, choose your phone from the left part of the window, then choose your particular model and after that choose your market and operator from the right part of the window. The entry will become highlighted and shortly there will be some info in the last column (Latest Firmware). This definition will be also in the right-most part of the window just under the phone thumbnail, click on it. Not a brilliant design decision, but that's it. Here is a screenshot for your reference:

​

If there are multiple firmwares available, pick the more recent (typically the top-most). The new window will pop up, press Download. The stock firmware will be downloaded to your computer and unpacked.

Once the download is completed, close all XperiFirm windows to return to the main Flashtool window. Flashtool will begin a creation of the .ftf file from the downloaded resources which will be used for a (subsequent) flashing. FTF-files are similar to ZIP-files, and may be opened with 7-Zip. For example, I've got E6883_32.3.A.0.376_1299-4828_R3D.ftf after the completion of this procedure. Flashtool places firmwares in the C:\Users\<Your Windows Username>\.flashTool\firmwares.

Now, once the stock firmware is downloaded, packed into .ftf and ready to be installed, let's do this.

Disconnect and switch off the phone for now, physically extract microSD card (if any) and press the left-most button on the Flashtool's toolbar (the "Lightning" one) and choose Flashmode. The Firmware Selector window will appear with a selected default folder and list of all firmware available for a flashing. I've got a single entry, the firmware I just downloaded. Before actual flashing, you can check some checkboxes from the Wipe section, I usually check all to start clean (all the data on the phone is erased). Once again, just to be safe, extract the microSD card from the phone at this moment. It is not needed for a flashing anyway. Here is how the window looked to me:

​

After all is set up, press Flash. The flashing process is not yet begun, since at first Flashtool just prepares firmware for a flashing.

After a while, a window will appear which will ask you to connect your phone in the Flashmode mode. With your phone off, hold the Volume Down button, connect the USB cable. Once Flashtool detects the phone in the Flashmode mode, it will start the actual flashing automatically. You may release the Volume Down button and go get some snack. The flashing will take some time.

After the completion of the flashing procedure, you'll get a stock Sony firmware installed, and now it is perfect time to proceed to the next step. You may leave your phone off at this moment, but if you are curious, start it up and check if the new Android is actually there. Note however that first start after the firmware installation takes a long time.

5. REPACKING AND FLASHING A KERNEL

Now it is a most interesting part: repacking and flashing a stock kernel. This procedure will allow the actual rooting.

To get the stock firmware rooted, you need a way to install SuperSU or Magisk. These are tools which enable root access to the Android system. To install them, you need TWRP. To run TWRP, you need a kernel, which supports both TWRP and your Android version.

Thankfully you can extract the kernel from the .ftf file, prepared by Flashtool earlier. Then you repack it, integrate TWRP (and DRM fix) into it, and finally flash it to your phone back modified. Sound like a complex task but it's definitely achievable. I did it multiple times mostly without any issues.

At first you should extract the actual kernel from the .ftf file. Reminder: it's in the C:\Users\<Your Windows Username>\.flashTool\firmwares folder and may be titled E6883_32.3.A.0.376_1299-4828_R3D.ftf or something like this. Open it as an archive (right-click on a file, 7-Zip > Open archive) and extract kernel.sin. It's your phone's packed kernel.

If it is packed, obviously you need to unpack it. Thankfully the almighty Flashtool can do this. Open Flashtool, navigate to the Tools > Sin Editor, select a kernel.sin you've just extracted and press Extract data. As a result, you'll get a kernel.elf file in the same directory where your packed kernel is residing. As you may have guessed, kernel.elf is an unpacked kernel. It can be modified, repacked and flashed back to the phone. Let's do this.

You will need a Stock kernel repack script from @tobias.waldvogel. Here is the original thread. Author of the script mentioned, that now it is hosted on GitHub, so let's just grab the latest version from there. Here is the link to the repository. In the upper-right corner there is a Clone or download button you may push it and choose Download ZIP from the menu. The script will be downloaded.

Once the contents of the zip-file with script are extracted to some directory, copy the kernel.elf there and summon command prompt in this directory (right-click in the empty space of this folder in File Explorer with the Shift button pressed and choose Open command window here).

In the command line type the following:

rootkernel.cmd kernel.elf boot.img

You'll get some questions about adding some features/tools to your kernel, feel free to answer "Yes" (type Y) to all of them. Screenshot for your reference:

​

If all went smoothly, you'll get a repacked kernel, boot.img in the script folder, supercharged with TWRP and DRM fix, and most importantly, which also supports rooting. Now it is time to flash it to your phone.

ATTENTION! Since the script is mostly unsupported, when new firmware get released, its kernel modules are not getting automagically added to the script package. You will get "Skipping TWRP recovery. No kernel modules for 3.10.84-perf-XXXXXXX available" error due to this. But don't worry, you can extract the required modules yourself from the firmware.

1. Open the FTF-file (firmware you downloaded) with 7-Zip, and extract system.sin file.

2. Open Flashtool, navigate to Tools > Sin Editor, choose this system.sin file, push Extract data. You'll get system.ext4 in the same directory.

3. Use the cool free Ext2Read tool to get into the ext4 filesystem in the system.ext4 (File > Open Image). Linux users can mount this filesystem as usual. Once you get into the filesystem, go to the lib/modules directory and grab the following files from there (Tools > Save):

core_ctl.ko

ecryptfs.ko

kscl.ko

mhl_sii8620_8061_drv.ko

texfat.ko

4. Once you get these files, create the 3.10.84-perf-XXXXXXX folder in the script's Android\twrp_common_kmodules directory. In my case I created 3.10.84-perf-g5e25a09 folder, just as was mentioned in the script's output in the console (when it complained about Skipping TWRP recovery). Copy these 5 files into this newly created folder.

5. Voilà! Re-run the script and see that now TWRP gets properly integrated! Thanks to @sceryavuz for his initial instructions. I just elaborated them a bit.

When all is clear, turn off your phone if it's on and connect it in a Fastboot mode: hold the Volume Up rocker button and connect USB cable. The LED on the phone will turn blue. Release the button.

Flashing images in this mode is typically done with a fastboot.exe from the Android SDK. Android SDK weighs many gigabytes but thankfully you don't need it. Fortunately Flashtool contains fastboot.exe from the SDK. It's in the Flashtool\x10flasher_lib folder. For the brevity of the following steps, I assume you have all necessary files there. To make it true, copy the newly generated boot.img to this folder.

Now Shift-right-click in the empty space of this folder window and choose Open command window here entry from the context menu. Windows console will appear.

At first try this command:

fastboot.exe devices

If all is good, there will be one device in the output of this command, just like this:

​

If not, perhaps there is some driver issue, so head back to the step #1 and make sure the drivers are installed correctly.

If your device is shown correctly, let's flash some files to the phone. Execute the following command to flash the modified kernel:

fastboot.exe flash boot boot.img

The proper output of this command will be like this:

​

If you get any errors, the first and more likely reason is that you still have a locked bootloader. Head to the step #3 to verify its state and unlock it if necessary.

If there were no errors — congratulations! — you now just flashed a stock kernel supercharged with TWRP recovery and DRM fix. You're almost done! You may plug out the cable from your phone. If you are attentive to the details, you'll notice that now, once your phone is started, its LED turns amber for 2-3 seconds. This is a special signal for those looking to boot into a recovery (TWRP). But you don't have to start your phone yet.

Although @tobias.waldvogel claims his script is able to also integrate SuperSU during the kernel repacking, I didn't managed to get this working, so the SuperSU (or Magisk) installation is a separate step in my guide. The next step.

6. INSTALLING SUPERSU OR MAGISK

Now when you have TWRP in place and latest Android installed, let's install SuperSU to it. SuperSU distributed in a TWRP-friendly .zip archives, so you should copy one to your microSD card. I used version 2.79 from here. Download TWRP / FlashFire installable ZIP, not the APK. At the time of your reading, there probably will be some newer versions available, feel free to install them them instead. Copy the downloaded ZIP-archive to your microSD. Don't bother to unpack the ZIP.

Once SuperSU zip-file is copied to your microSD card, place it into your phone and reboot to recovery (TWRP). To do this restart or power up your phone and look at the LED. Once it lights amber, press Volume Up rocker button and you'll get into recovery — TWRP. In my case it was TWRP v3.0.2-0.

To install SuperSU, press Install, go to the /external_sd and select the .zip (in my case SuperSU-v2.79-201612051815.zip). Swipe right to confirm installation. Once it is installed, press Reboot System button. Phone will reboot twice. Do not interfere with the process during these multiple reboots, the things are getting done, so just wait once Android is started. When it's started, the phone is rooted and functional!

If you would like to install Magisk instead, the instructions are exactly the same. Grab the latest ZIP from the original thread and flash it with TWRP. That's it!

7. (OPTIONAL) RESTORE YOUR DRM KEYS

If you had successfully backed up your DRM keys in step #2, it is now time to restore it back to the device. There is a flash_dk.cmd script shipped with the Root kernel repack script you used in the previous step. flash_dk.cmd can be used to flash the DRM partition back to your phone.

At first prepare the flashable .ftf:

flash_dk.cmd <ta backup image> dk.ftf

And then flash dk.ftf via Flashtool, just like you flashed the whole firmware in the step #4, but don't wipe anything this time.

8. OPTIONAL STEPS

8.1. Xposed installation

If you use Lollipop and later, you should install Xposed APK from here. At the time of writing there is XposedInstaller_3.0_alpha4.apk installer there.

Once APK is installed, grab the latest .zip from the repository, I've got xposed-v86-sdk23-arm64.zip. Install it in a regular TWRP way covered in step #6.

Once all these steps are done, you should have Xposed Installer app in your phone, and if you open it and check Framework section, if everything is alright, there will be text in green, something like "Xposed framework version 86 is active".

8.2. Resolving Voice Search and random volume up/down issues while using regular headphones

See this thread.

8.3. Disable startup notification if there is a newer firmware available

Some people get annoyed by a persistent notification, which is displayed once the new firmware become available (new Android version from Sony). Rooted users cannot just tap it and update over-the-air, because they need to perform a complex rooting procedure in beforehand (covered in this guide). It is possible to disable this notification. You may get these notifications by email anyway.

The easiest and safest way is to use some autorun manager. I used Autorun Manager Pro and disabled all receivers of system apps com.sonymobile.fota.service, fota update service and Software update. Notification vanished after a restart.

You may even freeze or remove these apps via some app manager like Titanium Backup Pro.

8.4. Disable that damned green LED light while phone is charged and attached to the cable or docked

This is a historic Xperia behavior, not easily fixable without the root. The notorious green LED is on all night no matter which settings you set up. In fact, there is no setting to switch it off.

However, if you are rooted, you can solve this issue easily. One method is to install a free Light Flow - LED Control app. Once it is installed, you need to enable the following settings in the Settings > Device Settings and Root section: Direct mode, Root mode and Run every command as root. Then you can mess around with individual notifications in the Notification settings, but I just cleared all in there and hey! — the annoying green LED is gone!

THAT'S IT

At this point you have a stock Sony Android enhanced with root privileges. SuperSU / Magisk app is also installed, so you are ready to use root right away. SuperSU now can be updated in a regular way via Play Store. Magisk has it's own updating capabilities.

P.S. WHEN NEW FIRMWARE IS AVAILABLE

Once the new firmware is released, you may perform the same procedure for it beginning from the step #4, but if it is a minor upgrade, you may want not to wipe anything during Flashtool flashing this time. If it is a major upgrade, e.g. Marshmallow > Nougat, you probably may want to start with a clean system and wipe all.