[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Thank you! Really interesting, because the content is almost the same. Compared the files with my own db. I have exported the credentials from my TA and compared them with my credmgr.db (exactly the same), too.There are only a few differences between the databases to other devices.

I think that is a proof for my theory that the credentials are NOT encrypted with an individual device key.

I bet they are encrypted with an global standard key for all devices. So maybe Sony fool us about that. Hahaha... Because encrypted data is never the almost same content. Never! Would be nice, if I could get more databases to get more hints for the differences.

Comparison:

A = XZ Premium unlocked (my device)

B = X Performance

C = DB from karrouma (don't know which device)

Table:

"Compare Type"	"Source Offset"	"Source Count (dec)"	"Source Count (hex)"	"Target Offset"	"Target Count (dec)"	"Target Count (hex)"

A <=> B

A <=> C

B <=> C

Nice... There are differences on the exact same offsets with the same size (100 bytes). Note: It looks like the differences are unique to the devices! But the rest is complete the same! Is that nice or is that nice? Now I will think out loud...

1. Are the credentials exported from the TA at runtime, to get file-access to them via credmgr.db or will the credentials be decrypted and exported to the TA?

My answer: They are exported from the TA, because on every boot the system checks for the file and generates it, if it is not there. So maybe the differences in the databases are only like "checksums" or something that tells the device security "Hey security system, the keys are there, the device key also, phone ident is xxx, now you are allowed to decrypt and use the credentials.". The result is: The global key to decrypt the credentials is stored in the TrustZone, together with the relevant applications and internal checks for legit keys. That was also my thinking at the beginning. And if I am right with this, then there MUST be a possible way to realize a universal DRM fix and maybe something like a keygen for the unique device keys. Hahaha.... I bet the Sony devs would **** bricks if I could get this done! :silly:

2. What exactly are the differences and for what are they used at runtime?

To get more useful informations and a better understanding, I would need TA backups ( /dev/block/bootdevice/by-name/TA ). From locked devices, unlocked devices without fix and unlocked devices with working DRM fix (no matter which model - only for comparison and theory). It would be really awesome, if some users could send them to me. But please, do NOT POST THEM HERE to download! The reason is, that maybe there is sensitive data stored on it and also there are for sure users that would try to flash the TA from other users (this will KILL their phones!). So if you want to share your dumped file with me, please send it via pn system if possible.

:cowboy:

If it's possible you could send me your /date/credmgr/credmgr.db file, to compare it with the others. :)

That's really hard to say... I have a fix here, but it doesn't work so far, because Sony changed the communication to the TA and the handling of the credentials. So I can't use the same way as tobias waldvogel did with his patch.

I have it already so far that the device security is tricked. The checks show that the relevant keys are okay, active and provisioned. The device configuration is tricked, too. It shows that the bootloader unlock is not allowed instead of the bootloader is unlocked. The security configuration is "Live", too. So the system thinks that all keys are legit and active, the device is not rooted/unlocked and the configuration is live (clean customer level). Now we only need to get the keys working and that's really complicated. In my life I hacked almost every possible web application (banking sites, government, ecommerce, ...), security system and software (my job is moving in this area), but it's the really first time I do something like that on a mobile device.

So it's like a virgin (... pwned for the very first time) :laugh: