yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ Premium Guides, News, & Discussion] deconfrost:
What about the drm fix on the z5 for users who unlocked before the drm backup was available? Can the same be applied to THE XZP? I have 2 z5 here one using drm fix with no drm backup and the other has backed up and restored, I don't see any difference between the 2

Although I'm not too fuzzy about unlocking the bootloader on the XZP, other than I like to remove all the bloatware, or just find an unbloated firmware will do me happily
[Sony Xperia XZ Premium Guides, News, & Discussion] FartyParty:
No, which is why this thread exist.
[Sony Xperia XZ Premium Guides, News, & Discussion] Let1107:
Yes please I unlock my bootloader and now I can't even take a picture -_- I have the xperia xzp and I'm looking for relock my bootloader do you have any idea how to relock my bootloader back?
[Sony Xperia XZ Premium Guides, News, & Discussion] Lirannl:
You can relock it, but it won't help. It's permanent (unless there's a DRM fix).
[Sony Xperia XZ Premium Guides, News, & Discussion] dazza9075:
Yup.

Sadly people don't read everything before jumping in with two feet
[Sony Xperia XZ Premium Guides, News, & Discussion] supermaus100:
that will not do
[Sony Xperia XZ Premium Guides, News, & Discussion] sq_dev:
You can set the resolution to 12MP.
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Had a few strange days. But I'm alive...

Sorry, but I wasn't able to do any updates. My brain needed a break to get back clear. I'm back in now. Let's do some things.

Whoop... Some good old music for this: https://www.youtube.com/watch?v=_gMuFNGCVvo
[Sony Xperia XZ Premium Guides, News, & Discussion] SilverGamer_YT:
Hi, I have unlocked bootloader without do it a drmkeys because I didn't know I need it . Storm what if we do an update of drmrestore.zip in z5/z5c/z5p to XZ/xzp
[Sony Xperia XZ Premium Guides, News, & Discussion] ex3meex:
**** yeah :svetius: :cool:
[Sony Xperia XZ Premium Guides, News, & Discussion] LukeyWolf:
Sweet! Glad someone didn't give up unlike the people in the bounty thread
[Sony Xperia XZ Premium Guides, News, & Discussion] ponytojas:
Maybe is a stupidity, but does xz premium support the A/B partition system of google for seamless updates? If so, maybe the DRM is in two partitions and could be restored no?
[Sony Xperia XZ Premium Guides, News, & Discussion] mracer164:
https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html

I think it could lead to something there are 3 RCE vulnerabilities and Android devices are affected.
[Sony Xperia XZ Premium Guides, News, & Discussion] baster72:
Now everybody also have official xposed for nougat and we still can't make root without messing the camera :(
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
@ DEVS

Is there any way to emulate the firmware in a virtual device? I think no, but maybe somebody has a better info. It would be absolutely awesome if I could sniff a little bit in a live system from another device, where the old fix works.

I noticed that there are multiple functions in the XZP system, that are wrapped by other functions and the old fix doesn't hook and manipulate them.

For example: SuntoryTee_VerifyBlob() is wrapped by _Z21SuntoryTee_VerifyBlobPKhjP28suntory_blob_verify_status_t()

The old DRM-fix by Tobias Waldvogel tries to hook SuntoryTee_VerifyBlob and his hack returns 0 (=> Blobs there and legit). But on XZP it doesn't work, because the wrapped function isn't affected. I had to create a new hook (own preloaded library) with both functions! Like so:

int SuntoryTee_VerifyBlob(int a1, int a2, int * a3, int a4) {
*a3 = 0;
return 0;
}

int _Z21SuntoryTee_VerifyBlobPKhjP28suntory_blob_verify_status_t(int a1, int a2, int * a3, int a4) {
*a3 = 0;
return 0;
}

After that, the function is hooked like it should and hacked => Blob status is legit!

Maybe there are other wrapped functions, too. And that's the real deal why the old fix doesn't work?
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
That's impossible, because Sony changed a lot of things in the new devices. The old fix doesn't work because of this.
[Sony Xperia XZ Premium Guides, News, & Discussion] Mobius-1:
Welp I spent a few hours digging into these vulnerabilities... while they're cool, I don't think it's a way in for our phone. These exploits require sending requests to the dnsmasq binary in /system/bin on our phones. The binary definitely exists but it's locked down (can't run it via termux or even see file permissions on it). I don't believe there are any native Android processes that run this binary as part of their function (someone please correct me if I'm wrong, I can't find crap as far as documentation goes). We'd either need a native Android process to run this binary to get elevated code execution via an overflow, or we'd have to run the binary ourselves as an elevated user, which implies we already have root.
[Sony Xperia XZ Premium Guides, News, & Discussion] jcbwebdesign.com:
À

Hi, first thank you so much for trying to work things out !

just my 2cents , don't know if it can be of any use

.. Seems like the Wifi access point functionality is using dnsmasq, that's what i understand from a post on cli of android.

https://a3nm.net/blog/android_cli.html

[IMG="dnsmaq on android"]https://photos.app.goo.gl/3EHpkXik99JDSGmB3[/IMG]
[Sony Xperia XZ Premium Guides, News, & Discussion] Hazou:
Afaik u can't emulate firmware in an emulator.

And yes that could be the solution, just like getting old blobs working with newer Android versions by manipulating or adding functions with shims.
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
This might be interesting to somebody with linux machine which have bt, I can't get it on my android device since don't have bluez and don't have bt on my linux machine to test with bluez on linux, but this might help somebody figure out further, this is blueborne exploit writen in C which I found here -> https://github.com/mailinneberg/BlueBorne/blob/master/Blueborne C.zip
[Sony Xperia XZ Premium Guides, News, & Discussion] iKlutz:
I keep checking back here daily in hopes of some progress or fluke. To all the devs putting their time into this, it must be a real bummer of a job. Sorry about that. But thank you for putting in the effort. Keep it real ?
[Sony Xperia XZ Premium Guides, News, & Discussion] Saadkhalid786:
Me too. :)
[Sony Xperia XZ Premium Guides, News, & Discussion] LukeyWolf:
Yeah, good thing is that they won't give up unlike the idiots over at the bounty thread have
[Sony Xperia XZ Premium Guides, News, & Discussion] Mobfigurz:
That is because those people think money can solve all problems, like these devs have been sitting on a solution, waiting for someone to pay for it. It is as though they were trying to buy an instantaneous solution which was never likely and utterly naïve and when they did not get the instant solution, they gave up. Forget them, they will be the first to take up any solution these intelligent devs come up with but will be the last to give thanks.

Sorry guys, for polluting this thread and much respect for doing what most of us are not capable of, kudos to you all.
[Sony Xperia XZ Premium Guides, News, & Discussion] LukeyWolf:
Who even pays for root anyway? These devs on this thread are so much better doing it during there own time and not getting paid at all, massive kudos to all the devs in this thread for the efforts and future efforts
[Sony Xperia XZ Premium Guides, News, & Discussion] yacloo:
XZp bootloader is uefi based "LinuxLoader.efi" :confused: complex loader like PCs have it

maybe there is chain protection from EFI/TZ that blocks the manipulation

if there is EFI firmware and must be have UEFI NVRAM that store efi's variables so maybe NVRAM may contain DRM key

at least UEFI works on PC that way :D
[Sony Xperia XZ Premium Guides, News, & Discussion] Macs1209:
Quick question: If I can backup/restore the whole TA, restore will apply on DRM keys too? (so no other place where it stored/referred?)
[Sony Xperia XZ Premium Guides, News, & Discussion] Mangtas_666:
Someone posted Ta backup tool at guides and news section.
[Sony Xperia XZ Premium Guides, News, & Discussion] gengi:
TA backup tool. Can someone check this?

https://xdaforums.com/xz-premium/how-to/ta-backup-g814x-t3691603
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
I didn't found ta unit 0x8b2 inside trim area from unlocked device, which is not the case on oldest xperia devices. So this might be a truth! I have told about that many times. In that case restoring locked trim area on unlocked device have apsolutly no sense, which mean bye bye waranty 4ever after unlocking bootloader, and mean bye bye drm keys 4ever too!
[Sony Xperia XZ Premium Guides, News, & Discussion] Lirannl:
So basically the TA backup is useless for the cause of a DRM backup?
[Sony Xperia XZ Premium Guides, News, & Discussion] yacloo:
I didnt look deeply into yet but efi loader payloads the sony's boot lib i don't know it is a CSM module(legacy) or efi module that's why S1 procotol still intact we can dump small part of TA

we need root with lockedbootloader to continue further
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
Yes sure, without root we can gues only.
[Sony Xperia XZ Premium Guides, News, & Discussion] ex3meex:
With the official android 8.0 oreo release on xzp, the things will have been changed for find drm key?
[Sony Xperia XZ Premium Guides, News, & Discussion] mracer164:
Yup, it would likely be even harder :D
[Sony Xperia XZ Premium Guides, News, & Discussion] ex3meex:
Is the ID Xperia the DRM key? Sorry for the stupid question, i'm a newbie
[Sony Xperia XZ Premium Guides, News, & Discussion] Lirannl:
If it was, this thread would never need to exist.
[Sony Xperia XZ Premium Guides, News, & Discussion] pbarrette:
Hi all,

Any chance that the QCom chips are using the faulty Infineon library for key generation internally?

I already extracted the public keys from the XZ1c's

keymaster_X_BOOT_MSM8998_LA1_1_O_77.mbn

file and tested them here, but those aren't susceptible. I'm wondering if, perhaps, the SAKE-Authentication for privileged bootloader commands might, though, be based on key generation handled by a faulty implementation in TZ.
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
I found something interesting in secd... In older versions there was a special function to check the rooting status and bootloader status of the device. I reported earlier, that I was able to get the drm fix working and the only missing thing is the credential table with the needed blobs in credmgr.db. That was really confusing, because on earlier devices it worked without problems. And if the drmfix is able to manipulate the credmgr.db and my own fix lib is able to trick the system and get "all active and ok" status, then there is only a problem with getting the converted blobs out of the TA.

And now the juicy stuff:

In earlier versions the root/unlock check was a special function in the device security system. In newer versions I noticed these checks in the secd, too! There is a subfunction with the "huj huj huj" inside aaaaaaaaaand after that it opens another subfunction and more subfunctions (strange brain**** routines) to check for rooting and bootloader status. Well... After that there is a jump before the blob conversion and the session opening. So... If the returned rooting status is 2 or 5, the conversion and session opening is bypassed. And I think that could be the problem which ends up in an empty credmgr.db table and the dependency errors in the logs (no keys in the table). I will try to fix that...

Maybe there is somebody who has more knowledge about these things. Remember... I never did these things before. I have to study everything from scratch... :eek: It would be easier if there would be the source from Tobias (old drm fix / rootkernel), but I guess there is nothing like that in the wild.

I have a little bit more free time these days. Maybe I can get things done... I hope so...
[Sony Xperia XZ Premium Guides, News, & Discussion] Saadkhalid786:
Eyy brother!

i really appreciate the fact that you are working hard on this device. i still havent unlocked the BL cause i need root on locked BL or drm backup/fix. Thank you so much for your efforts. i keep on checking this thread daily for updates. and i think you guys are getting closer and closer :D .

i have a feeling that all those working on root will succeed very soon. lots of love and respect :)

have a nice day, sir!
[Sony Xperia XZ Premium Guides, News, & Discussion] ex3meex:
Storm we can write directly to Tobias for some tips and tricks, no?
[Sony Xperia XZ Premium Guides, News, & Discussion] pbarrette:
Hi sToRm,

I don't have an older Xperia, but I do have an XZ1c and have pulled the non-credential-required portions of the TA with the tool found here.

I noticed that one of the sections happens to be a SQLite database, so I extracted that and found this:

View attachment 4313055

Is it possible that that's the credmgr.db that you need the blobs from?

I've attached a zip of the extracted db file as well.
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Yepp, it's the credmgr.db (or a part of it). ;)
[Sony Xperia XZ Premium Guides, News, & Discussion] pbarrette:
Well, on the XZ1c, it's sitting at TA unit 0x9C4.

Or.. Are you saying that some other component is decrypting those keys and stuffing the decrypted versions into another location?

EDIT: Also.. You're up way too late :) Or too early :(
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Exactly! In the TA are the encrypted credentials. The system then exports them to the credmgr.db while it boots the droid up. After that, a service takes the credentials and decrypt them if the device key is legit. ;)

Hahaha.... you are right. It's 3:20 am here... But I don't want to go to bed now.
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Hahahahaha.... Hey dudes...

I spent some time this night. And... ahm... I found a way to patch system files without loosing functionality (like i reported a few weeks ago). So... now I am able to get things done MY WAY! And you should know that MY WAY works 99,9999% of the time. And you know what? I will pwn that b***...

Sony you are out of the comfort zone... Hahaha...
[Sony Xperia XZ Premium Guides, News, & Discussion] non.verbal:
got my eyes on this thread 24/7. waiting for the results :good:
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Hey my friends...

Please, do the following...

1. Listen to this...

https://www.youtube.com/watch?v=NMGqbXiAY20

2. Open the spoiler...

I... DID... IT... !!!

DRM is FIXED!

Hahahaaaaa... I never give up... Like I said...

I will do some testing. After that I will make a flashable kernel and flashable patch.

:cowboy::cool:
​
[Samsung Galaxy S8+ Questions & Answers] From0toHero:
Yesterday i was talking with a guy who was arrested because he committed a crime (in Switzerland).

He told me after the police searched his flat, they found his mobile. After they found it he told me that they hade a Laptop with them, than they connected his mobile with the laptop and were able to extract all informations of the mobile. I asked him if he hade a pin or equal programmed and he told me yes. My question is it possible to extract informations when a mobile is locked?
[Samsung Galaxy S8+ Questions & Answers] kxdaorbit:
Yes. This is why manufacturers like Samsung advise and provide end users with the tools to encrypt their devices whilst locked.
[Samsung Galaxy Core Prime ROMs, Kernels, Recoverie] steveharman:
Does anyone know the stock cache partition size for the Core Prime?

We're having issues with one of our apps being listed as "Unsupported" in the Play Store, and I'm wondering if it's simply too big to fit on the cache partition so isn't offered to users of the Core Prime. All other specs seem ok for our app.

Thanks,

Steve
[Samsung Galaxy Core Prime ROMs, Kernels, Recoverie] nitroxsl:
Dude...are you re partition the phone??
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] yellman:
Thank you very much for a new ROM ! Going to try.

EDIT: aaah can´t try this one is not for H870 EU
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] FrankRr:
Will DU come for H870 as well?​
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
Coming soon in a few more hours!
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] FrankRr:
That is fantastic news.. Thanks.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
Check it out and try the new one now!
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
Sorry hours came quick its up already just edited op! Report back!
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] EvilHowl:
Is camera focusing working? Thank you!
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
On my US997 I can seem to focus well enough while only one camera works but at the same time I'm not really a good cameraman. I would say yes but if the bug is present in official lineage then its most likely present here.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] martepato:
Camera doesn't focus like on all the other builds (H870)
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] bossofindy:
Is rom rooted or do we need to flash root
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] yellman:
Ladies and gentlemen this rom is pretty damn good so I can recommend as daily driver. So smooth from very first boot. Gracias !
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] jimbomodder:
About to try, been waiting a while for a asop based rom
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] yellman:
better flash supersu right after rom flashes... no problem here

---------- Post added at 07:04 PM ---------- Previous post was at 07:02 PM ----------

OP: Can we port stock LG6CameraApp.apk ? I copied stock files into //system/private-app/lg6camera ... seems It´s not good workaround. I wanted to figure out if focus would work in stock lg app.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
From what I've seen and tried is the camera was tied into frame works because I have been really wanting to use wide angle on aosp personally but I'll probably dig into that here shortly. As far as focusing goes [MENTION=4662457]Rashed97[/MENTION] has probably been slaving many of hours into that issue
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
I would personally recommend magisk because it restored safetynet in the rom.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] FourOne82:
Ty for this Rom!

Are u going to update to 11.7 since this is the final nougat release?
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
Most definitely, I hope you enjoy this room as much as I have in the past and future!
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] charklos:
Great looking rom! Any idea on a volte fix for Verizon? Thank you!

---------- Post added at 04:49 AM ---------- Previous post was at 03:52 AM ----------

Anyone else's speakerphone not working? When I put it on speaker the other person can't hear me, like the mic turns off or something.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
So funny thing is I actually had synced 11.7 and built it just never realized it was 11.7 XD your build should already be there too updating op now
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
I can look into getting an ims service (which leads to volte) running, I'm not quite sure though if volte
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] charklos:
That would be AWESOME! That and the speakerphone issue are the only things I noticed (not deal breakers) otherwise I love this rom! Thanks again!
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] EvilHowl:
Microphone isn't working :(
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
On what and where? I've had no issues nor other reports? Did you clean flash? Please provide a more detailed description and possibly a logcat of the issue.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] b0uNz:
For me it works!

Gesendet von meinem LG-h870 mit Tapatalk
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] martepato:
Call someone with the default phone app and put them on speakerphone, they won't hear you. I'll get you a logcat when I get home in some hours
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] charklos:
My mic stops working when I turn on speakerphone. I think I captured a logcat (logcat noob here). It won't let me upload, do your have another way I can send it to you?

Thx!
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] FourOne82:
If u turn on speakerphone on Stock its using the mic on the top instead on the bottom, probably just the mic on top is not working.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
I know exactly what you're talking about, it's a mixer issue I'll track it down and dig into what I can do.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] EvilHowl:
I have a question for you. Because of the camera focusing isn't working, I took a logcat while using Google Camera and I saw something:

08-16 11:21:13.815 553 19736 E QCamera3HWI: CAM_DEBUG: Setting compensation:0
08-16 11:21:13.815 569 19730 E mm-camera: <E> 5263: af_port_restart_proxy_value: af_port_restart_proxy_value
08-16 11:21:13.817 569 19725 E mm-camera: <STATS_AF ><E> 556: af_core_set_param: [AF_EVENT:AF_CORE_SET_PARAM_HDR_MODE]lgaf_algorithm->is_zzhdr_mode = 0
08-16 11:21:13.823 569 19730 E mm-camera: <SENSOR><E> 1861: sensor_set_frame_rate: max fps 30.000000 min fps 2.000000,fixed_frame_rate=0
08-16 11:21:13.823 569 19730 E mm-camera: <SENSOR><E> 4006: sensor_get_resolution_info: [PD_DBG] PD_conversion_coeff[0] = 668
08-16 11:21:13.823 569 19730 I mm-camera: <SENSOR><I> 4127: sensor_get_resolution_info: sensor info: name: imx258_imtech, res: 0, max_fps: 30.000000, w: 4160, h: 3120 op pix clk: 480000000, FLL: 3168, LLPCK: 5352, mode: 1, PDAF support: 1
08-16 11:21:13.823 569 19730 E mm-camera: <STATS_AF ><E> 6132: af_port_handle_set_focus_manual_pos_evt: not in CAM_FOCUS_MODE_OFF(Manual) mode, ignore the settings
08-16 11:21:13.842 569 19730 E mm-camera: <E> 5263: af_port_restart_proxy_value: af_port_restart_proxy_value
08-16 11:21:13.843 553 19736 E QCamera3HWI: CAM_DEBUG: Setting compensation:0
08-16 11:21:13.843 569 19725 E mm-camera: <STATS_AF ><E> 556: af_core_set_param: [AF_EVENT:AF_CORE_SET_PARAM_HDR_MODE]lgaf_algorithm->is_zzhdr_mode = 0
08-16 11:21:13.844 569 19730 E mm-camera: <SENSOR><E> 1861: sensor_set_frame_rate: max fps 30.000000 min fps 2.000000,fixed_frame_rate=0
08-16 11:21:13.844 569 19730 E mm-camera: <SENSOR><E> 4006: sensor_get_resolution_info: [PD_DBG] PD_conversion_coeff[0] = 668
08-16 11:21:13.844 569 19730 I mm-camera: <SENSOR><I> 4127: sensor_get_resolution_info: sensor info: name: imx258_imtech, res: 0, max_fps: 30.000000, w: 4160, h: 3120 op pix clk: 480000000, FLL: 3168, LLPCK: 5352, mode: 1, PDAF support: 1
[B]08-16 11:21:13.845 569 19730 E mm-camera: <STATS_AF ><E> 6132: af_port_handle_set_focus_manual_pos_evt: not in CAM_FOCUS_MODE_OFF(Manual) mode, ignore the settings[/B]

Look at the last line. I think there is something weird with the Camera3 HAL. Could you get a little inside of this issue? This and the microphone are the only issues with custom ROMs...

Thanks!
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] strikerdj2011:
The mic problem is on the h870 same on los and rr of you have a h870 it doesnt work unsure why tho
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] jimbomodder:
Ok cool, really looking forward to this as currently on same ROM on N6
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
It's definitely a audio_mixer_tasha.xml or something along those lines issue with probably routing the sound hold up if you're willing there is a fix but you have to manually install the files because the zip isn't working right I don't know if it also fixed auto focus too but it could. Let me find it really quick.
[LG G6 ROMs, Kernels, Recoveries, & Other Developme] Cameron581:
https://xdaforums.com/showpost.php?p=73274731&postcount=105