[Xperia Z5 Premium Q&A, Help & Troubleshooting] DarkSilentSC:
A. TA partition Backup and Restore

1. Pre-requisite: Go To XperiFirm and Download the latest firmware and firmware version 32.0.A.6.170 (Commercial and Journalists)

2. Download iovyroot https://xdaforums.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597

3. All kinds of backup since from this point on any data inside your phone will be gone.

First use flashtool and flash 32.0.A.6.170 first. Make sure to make checkboxes on all lists under Wipe Sin and Misc TA before flashing. Once flash is finished, boot up your phone and get to the home screen.

From Home screen, go to Settings > About Phone > Tap Build Number 5 times to enable Developer Option. Settings > Developer Option > USB Debugging and connect your phone to the PC. Make sure to authorize USB access once the phone is connected.

Open iovyroot folder and simply run tabackup.bat file. Follow instruction and if successful, there should be a TA.img file created in that folder. This means your TA partition has been backed up.

If you want to restore it, use flashtool to lock the bootloader first. Then flash the same 32.0.A.6.170 right away. Once the flashing and rebooting phone is done, enable USB debugging as instructed above, press shift-right-click (in Windows 7) to open Command Prompt from here. If Win 8 or newer, Hit Windows key + X, open command prompt, get to the directory where the iovyroot (you know how to use DOS right?), and then run:

tarestore TA.img

and then follow instruction to restore the TA. Once this task is done, you can reboot or re-flash newer firmware to use the latest firmware with bootloader locked. Remember that iovyroot only works with the older firmware versions (if you check iovyroot xda thread, you can review what firmware version is compatible) So if you want to backup / restore TA, you MUST go back to older firmware to do it. This is my only proven case to successfully backup and restore TA, but if someone else has other solutions, feel free to respond below.

B. Install TWRP

1. Pre-requisite: Go to this thread: https://xdaforums.com/z5-premium/development/safetynet-stock-kernel-twrp-magisk-t3621404 and download the TWRP there. This one is really straightforward that you could've done this without any problem.

How to boot to recovery partition? Simply hold power and low volume button from power off state (with no cable connected) until phone vibrates briefly once. Let it boot to TWRP.

What about that yellow light that comes on when you normally power on, and then you press the down volume key and the light turns orange and then boots TWRP? Well what happened on that one is the kernel developer modified boot.img such that it also has TWRP within the boot partition, making recovery partition not necessarily useless. I had cases where I can launch two different version of TWRP from a same phone.

If you want to stick with stock ROM or stockROM based custom ROM, you can use Zacharia's kernels, where his boot partition embeds the recovery partition, which would make accessing TWRP much easier.

C. Install Custom ROM while keeping DRM functionality

Zacharia's kernels are built with DRM patch. You can use his kernel on stock based ROMs for that. I believe Moonbreaker ROM comes with the kernel that has DRM patch so that shouldn't be a problem (Mind that moonbreaker is marshmallow).

Personally, what I do is stick with stock kernel and stock ROM with bootloader unlocked. Because I just have yet to found custom ROM that works with what I have set up on the next section:

D. Root phone while maintaining Android Pay, and any other SafetyNet app functionality

So starting from the phone state where bootloader is unlocked, have the latest 7.1.1 stock ROM with stock kernel, flashed TWRP as above...

1. Go to this thread: https://xdaforums.com/z5-premium/development/safetynet-stock-kernel-twrp-magisk-t3621404

2. Follow instructions there. This is really straightforward.

3. Reboot and then basically you have a phone that is rooted as well as the phone passes SafetyNet.

Just to review the questions you have posted, other than backup and restore TA partition...

1. Watch out on selecting custom Kernels. EAS and Zacharia's kernels are based on Stock based ROMs, with specific firmware versions. EAS Version 3 only supports Firmware 2.33 (Nougat 7.0, which I personally have yet to make it booting on my phone...). Zacharia kernels have various versions-- You'll have to search through the list of all his postings and see which kernels are for what firmware versions.

2. When you are trying to use Stock based custom ROMs and/or kernels, make sure you flash the correct stock ROM version before. And let it boot the stock firmware fully before jumping into TWRP and flash the custom ROMs.

3. You "could" try to make custom ROMS to recognize a restored TA partition. There is a thread called "Rootkernel", where it fakes the system to think the bootloader is locked and it has proper TA partition. The program uses kernel and your TA partiton to build a modified kernel to do it. Here's the thread if you want to read it: https://xdaforums.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 But I will let you study and figure this one out on your own. Personally I don't find this useful if you try it on non-stock based custom ROM (LineageOS for example). But again, if someone else has other ideas, do reply...

4. Magisk is like a systemless Supersu (yes I just defined that in a super lazy man's term). Initially there are no "SuperSU" related files in system partition. Only at a certain time in the system booting the Magisk extracts its files themselves out and start deploying system apps that needs root access. Basically having a virtual partition inside system partition, collection of system files that allows root access. Go to Magisk Manager, open settings, enable Magisk Hide. This is the module that will allow to hide Safetynet detection for some apps. When this module is active, and then you look at Magisk Hide in main menu of Magisk, you can then make checkboxes on what apps you want to hide. Android Pay should be checked already... I think you need to have stock firmware and provided kernel to get Magisk to work. But again, if anyone else says otherwise, I'm at all ears.