yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
I would need a /data/credmgr/credmgr.db from an unlocked device., XZ oder XZs... with working DRMfix Just to compare it with others. That would be really helpful.

Does radare2 decompile and produce pseudocode for arm64? So far as I know there is only IDA 6.9 with decompiler, which can produce good pseudocode for elf for arm64 natives. :confused:
[Sony Xperia XZ Premium Guides, News, & Discussion] ex3meex:
Unfortunatly i don't have XZor XZs device :( maybe someone else have it, sorry bro

I don't know radare2 but if you want i found IDA Pro 6.8 + all decompilers, there isn't a 6.9 pro version cracked
[Sony Xperia XZ Premium Guides, News, & Discussion] karrouma:
From unlocked bl

But no ta backed up
[Sony Xperia XZ Premium Guides, News, & Discussion] the_kms:
Hello Storm! Great work you're doing for the community, you're a hero!

I have a bone stock XZP (dual sim), how can I help?
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
From which device?
[Sony Xperia XZ Premium Guides, News, & Discussion] serajr:
- Xperia X Performance

- Flashed device key from my ta.img (dk.ftf)

- Fully working drm-fix

Hope that helps too!

Edit:

File got!
[Sony Xperia XZ Premium Guides, News, & Discussion] RJASSI21:
Not asking for an eta or anything but just curious what the progress on this is like how far in is this now? Are we close to getting drm fix on unlocked bootloader? Thanks.
[Sony Xperia XZ Premium Guides, News, & Discussion] FartyParty:
Why would you need drm fix for locked? Unless you meant unlocked.
[Sony Xperia XZ Premium Guides, News, & Discussion] RJASSI21:
Yeah I do mean on unlocked guess I should edit that.
[Sony Xperia XZ Premium Guides, News, & Discussion] karrouma:
Xz dual
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
I was at same stage, I can reconstruct trim area fully from .ta file backup, (search for "dangerous tool" on xda), but I am stuck at only one thing "how to simulate drm key routine", what is drm key? Drm key is hash? Is it?? I wanted to simulate drm by openssl but whatwer I tried I can't get that hash. Tried to generate hash of the certificates unit but whatwer I tried hash is not tje same like drm key. Probably device unique key from trust zone need to be used with openssl simulation? If you somehow understand what drm key is and you somehow can simulate things usingnopenssl to get drm it would be of good start point. I'm believing that drm key is hash instead of key! Can you reverse enginer drm key routine and use that info to simulate that proces with openssl?

Here is function which uses trim area unit 0x8b2 (unlock key) and trim area drm unit 0x1046b (drm key):

signed int __fastcall sub_1AB80(int a1, unsigned int a2, int a3)
{
int v3; // r5@1
unsigned int v4; // r4@1
char v5; // zf@9
int v6; // r4@12
char v7; // zf@17
unsigned int v9; // [sp+4h] [bp-1Ch]@1
int v10; // [sp+8h] [bp-18h]@1

v9 = a2;
v10 = a3;
v3 = a1;
v4 = a2;
if ( sub_1AB44(a1, a2, a3) < 0 )
return 0x80120028;
if ( v4 <= 0xF )
return 0x80120003;
if ( !sub_235DC(v3, 0x7C833701, 2) && v4 == 18 )
{
v3 += 2;
goto LABEL_7;
}
if ( v4 != 16 )
return 0x80120003;
LABEL_7:
if ( !v3 )
return 0x80120003;
sub_1D104(v7C8457EC, 2089048061, 0);
if ( !v7C8457FD )
return 0x80120028;
v5 = v7C8457FD == 5;
if ( v7C8457FD != 5 )
v5 = v7C8457FD == 2;
if ( v5 )
v6 = 0;
else
v6 = 1;
if ( !v5 )
{
v6 = sub_18A00(v3, 0x10u);
if ( v6 >= 0 )
{
v6 = sub_1D104(v7C8457EC, 2089048061, 0);
if ( v6 >= 0 )
{
v7 = v7C8457FD == 5;
if ( v7C8457FD != 5 )
v7 = v7C8457FD == 2;
if ( v7 )
{
sub_1BCF0();
if ( sub_22174(0x1046B) )
sub_221B0(0x1046B);
if ( sub_22174(0x8B2) )
sub_221B0(0x8B2);
sub_21EF8(0x8B2, v3, 16);
BYTE3(v9) = 2;
sub_21EF8(0x9F6, (char *)&v9 + 3, 1);
}
else
{
sub_23360(2088975019, 2088971268, 0x8B7);
v6 = 0x8012000A;
}
}
}
}
return v6;
}

Can you help me understand it? Can we simulate that with openssl? If you need I can provide you locked trim area and unlock key for that trim area (how things working on xperia: unlock key unit 0x8b2 replaces drm key unit 0x1046b after bootloader gets unlocked. Unit 0x8b2 is just plain text "unlock key received from sony site"), I can provide you unlock key for that trim area too if you are interesting! (provided in next post)
[Sony Xperia XZ Premium Guides, News, & Discussion] serajr:
Sent!

( [MENTION=4120742]munjeni[/MENTION], if you need them too, just let me know it )
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
Thanks mate, I have study TA dumps long time ago, no need it realy. Two post above curently interest me :)
[Sony Xperia XZ Premium Guides, News, & Discussion] benengyj:
All the legends in one thread. This is starting to get interesting! Thanks for all the hard work no matter if this works out or not.
[Sony Xperia XZ Premium Guides, News, & Discussion] Lirannl:
Hey, I have a fully locked, unrooted XZ Premium, which I can't wait to unlock. Is there anything I can do to help? (That won't wipe my DRM keys before they can be backed up and restored)
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
[MENTION=3989065]serajr[/MENTION] Big thanks! I have it on my desk now. :)

[MENTION=4120742]munjeni[/MENTION] I'm ready for brainf*** now. Will take a look at it.
[Sony Xperia XZ Premium Guides, News, & Discussion] GeramanX:
OMG OMG OMG!!!

I don't know what you guys are talking about but sounds like something is going to happen!

OMG OMG OMG!!!
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Because I'm so lazy... And I want it all in one tool... Hahaha...

Sometimes I myself have no f*** idea what I'm talking straight. :laugh: But the absolute best is still the face of my girlfriend when I tell her what I've done all day. It's somehow like a cow at a gas station. => :eek:
[Sony Xperia XZ Premium Guides, News, & Discussion] FartyParty:
WOW, calling your gf a cow? Haha just kidding. Although cows are incredibly adorable and gentle creatures :).

Keep up the good work :good:
[Sony Xperia XZ Premium Guides, News, & Discussion] serajr:
Wow... Sounds very promising! Great job bro :good:

Keep it up!!

It would be so more easy if we could hack .sin files and still be able to flash them without issues (yeah, I know we can't do that)... just wondering!!
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
Sometimes I myself have no f*** idea what I'm talking straight. :laugh: But the absolute best is still the face of my girlfriend when I tell her what I've done all day. It's somehow like a cow at a gas station. => :eek:[/QUOTE]

Legend! hahahaha Can you tell which software you use for making ui?

---------- Post added at 03:52 PM ---------- Previous post was at 03:44 PM ----------

Hi, not possible anyway, all sin files is signed! But since whole bootchain is signed (expect pbl), only a chance unsigning whole things is hacking pbl. But getting pbl location curently nobody know for sure :( I'm believing it lives in one of the 8 pin chips (like on smart tv) on board and can be read with rt809f for example :o I don't have microscope for look :)
[Sony Xperia XZ Premium Guides, News, & Discussion] serajr:
Aha... great one!

I would never dare say that "munjeni cannot do that!" You will always prove me I'm wrong!! ;)

I think, no, I'm sure, that with all these incredible people here involved in trying to bring to xperia users a new drm-fix (or the existing one, but fully functional)... will succeed somehow!
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
Yes sure, it's a matter of time, I'm believing sToRm// will bring us that very soon :)
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Maybe... But only if my gf doesn't read that I call her a cow... But I'm almost sure she wouldn't read on xda... Hahahahaha...
[Sony Xperia XZ Premium Guides, News, & Discussion] zxz0O0:
You could have used my tool https://github.com/dosomder/ta-info/blob/master/TAInfo/trimarea.h
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Dammit! :laugh: Very useful! Thanks for the hint!
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Unit 0x8b2 is empty on my TA (unlocked).

Unit 0x1046b is empty, too.

Wait... Ahm...

Unit 0x1046b (66667) is the unique device key, right? But... Who said that this key is deleted when we unlock the device? I bet it's not irreversible deleted. Just moved to another place. If you are a vendor of smartphones and you know that a lot of customers would try to root the device and they send it for repair if it fails or maybe something else would f*** up the device security (bugs in firmware, apps from Sony, ...) you wouldn't be so dumb and send the unique key to hell. You would move it to another place and give your service team relevant tools, to reconfigure the TA with the working key.

Take a look at this:

Let's be a bit nooby and do a primitve compare between an untouched TA image and an unlocked TA image from the same device (Xperia X Performance).

TA.img (clean / locked): Unit 0x1046b => @ offset+ 0x000420A8:

B8 1F 52 03 D0 39 6C 60 85 C0 A9 9D FE 4F D1 B8

Wohooo key is there, no problems at all.

TA.img (clean / unlocked): Unit 0x1046b => @ offset+ 0x000420A8:

10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10

Oh dammit... No I'm really f*** up. My key is gone forever. I will end my life, because it's useless without 19mp selfies.

Okay.... We would think the system has written this unit and the key is lost.

But... Wait... I remind my theory and oh, what's this?

TA.img (clean / unlocked): @ offset+ 0x00089688:

B8 1F 52 03 D0 39 6C 60 85 C0 A9 9D FE 4F D1 B8

Stop! Sony... Are you kidding me? Wait... I'm sure it's just some other useless part in the TA and I bet it's there in the original locked clean TA, too. Sure... it's a coincidence. But I'm dumb, so I will take a look at the locked TA, just to be sure it's a coincidence.

But... Wait...

TA.img (clean / locked): @ offset+ 0x00089688:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Now.... THIS is interesting!

Fact:

The unique device key (drm key) is in unit 0x1046b on a fresh locked device. The key is found only ONCE in the locked device! If we unlock the bootloader, the unit 0x1046b will be overwritten and also a lot of things around it. But if we search the key on the unlocked TA, we will find it! In an area that is empty on locked devices. And there is a lot of interesting stuff around it. Looks like the credentials db.

I will take a deeper look at this. Maybe it's nevertheless possible to reconstruct the TA and mount it with a modified boot image (-> ta_poc).

I'm just rubbing my hands now. That's really interesting stuff! :laugh:
[Sony Xperia XZ Premium Guides, News, & Discussion] the_brad:
Simply WOW.

That could change everything known about unlocking Xperia-devices.
[Sony Xperia XZ Premium Guides, News, & Discussion] BigBrainAFK:
I already had this feeling that the key gets moved somewhere else since i read somewhere that the new unlocked ta doesnt look like other unlocked ta's from other devices.

Great to have it confirmed tho

//EDIT: i wonder if we can just move the key from its new offset to the original (locked) location... but its prob not that easy i assume
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
I have told many times about no unit 0x8b2 on xzp! On all devices before xzp unit 0x8b2 replaces unit 0x1046b when device gets unlocked! Seems xzp have something diferent. I didn't found unit 0x8b2 on [MENTION=8004595]FartyParty[/MENTION] unlocked trim area dump of the xzp!

About backup location of the 0x1046b, yes I have it on my z1c! But I don't have it on my xperia go. Also I thinked it probably can be found on other devices in the backup location and I made this tool -> https://xdaforums.com/crossdevice-dev/sony/dangerous-tool-trim-tool-t3516007 but later we found that not all devices have backup of the unit 0x1046b, I realy have no idea why my xperia z1c have 0x1046b in the unused part of the trim area after I unlock my bootloader, thats strange realy. If you have backup of the your unit 0x1046b you can use this tool https://xdaforums.com/crossdevice-dev/sony/dangerous-tool-trim-tool-t3516007 to reconstruct whole trim area! :)

I dont think that 0x1046b is unique device key, I believing its an hash the same like 0x8b2, please look into some posts earlier, I have posted appsboot and some parts of the trim area, I'm believing we can figure out 0x1046b ofcourse with your help. Hm I don't tried to use 0x8b2 data into 0x1046b, hmm maybe it works (in case booth keys gives the same RCK_H hash???)? Thats interesting and that why I wanting to figure out what is that 1046b, 8b2 is clean (sha256 hash of the 8b2 unit gives RCK_H, but 1046b I have no idea how to simulate)

---------- Post added at 12:24 PM ---------- Previous post was at 12:10 PM ----------

At least on [MENTION=8004595]FartyParty[/MENTION] ta dump I didn't found backup of the unit 1046b and also didn't found unit 8b2, I have searched for hex string 6b040100 it not exist, the same with 8b2! So key lost 4ever sure! I'm believing restoring locked trim area dump will not work anymore in case unit 0x8b2 is stored inside trust zone, in worst case if it is stored in boot rom (fuse is one time programable?) there will be apsolutly no chance to lock device again!!!!! Somebody need to confirm this. Seems sony finaly fixed all relocking bugs hahha

---------- Post added at 12:37 PM ---------- Previous post was at 12:24 PM ----------

I'm stuck at this -> (please read whole page) https://xdaforums.com/crossdevice-dev/sony/dangerous-tool-trim-tool-t3516007/page5 , that's the end, whole things which the_laser says is somehow confused, he say its for crypt, but I think its more for decrypt, what you think? This might help http://bits-please.blogspot.rs/2016/06/extracting-qualcomms-keymaster-keys.html too. If we figure out means of the 1046b and we sucesfully simulate things on local pc we probably can start on further steps, without knowing means of the 1046b I think we have no chance since nobody know what 1046b mean. Hm who knows, maybe we can crypt or decrypt 8b2 to get 1046b!!?? I'm believing 8b2 and 1046b is very conjuctive.
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
As a system user on z1c I can read drm unit :)

ta_param_loader -t 66667 -d 0 -c 16 -f "%02x" -p
[Sony Xperia XZ Premium Guides, News, & Discussion] jaseman:
What I want to know is this: If Sony allows us to unlock the bootloader then why don't they just provide us with the answer to these questions????

What is the point of making something they approve of so hard to accomplish???
[Sony Xperia XZ Premium Guides, News, & Discussion] FartyParty:
That's not how it works. You unlock the bootloader on your own risk, you lose warranty and you don't get support from Sony.

Who said they approve of it? Offering it doesn't mean they officially support it. It even says on the page that you're on your own.
[Sony Xperia XZ Premium Guides, News, & Discussion] RJASSI21:
It would feel like freedom if devices were sold unlocked to begin with as if they did approve, but no theyre locked beyond prison bars. Does security really need to have that much priority? Since snap 801 Xperias and before security there was enough. Why did Sony make the choice to toughen the security with new Xperias since the Z4(64-bit Xperias)? Is it really necessary? Well one thing is for sure? Asking all these questions wont make the job any easier. I wish it did though.

Just trying to jog your minds to maybe remind you of something more from the past that might further help. All the hexadecimal code im reading here is far in depth beyond anything id have imagined for drm keys. Whatever the outcome im sure it will be good. Eventually you guys will crack it :good:

Keep it up! I feel your not too far from cracking the solution!
[Sony Xperia XZ Premium Guides, News, & Discussion] jaseman:
OK, so if we're on our own without any warranty then why hide/delete/lock down features that we still want/need to make the phone functional?

It's as if they're punishing us for unlocking the phone! We're already losing the warranty and will receive no help from them....they don't offer any substantial help as it is, so why do this? How does it hurt them to let us unlock the phone and they are out of the picture? They already got our money! :eek:
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
Anybody try something?

1. Put an su binary to the /data/local/tmp

3. try with adb shell to execute: (cd /data/local/tmp ; chmod 755 su ; ./su -l system)

Probably selinux will deny booth but let me know :) In case it succedd you are ready to dump drm key using next command from quote :)

In case not working, no need root, system user is enough, hope somebody make an app to exploit things to get user system ;)
[Sony Xperia XZ Premium Guides, News, & Discussion] Sadman Khan:
This is my favourite bit about getting a new Sony device. I love following this entire process even though I don't understand anything ? Thank you devs. Your constant effort and dedication makes it all possible.

Sorry for the off-topic! Carry on folks, while I enjoy some reading ;)
[Sony Xperia XZ Premium Guides, News, & Discussion] the_brad:
Sadly:
[Sony Xperia XZ Premium Guides, News, & Discussion] Dutchdeveloper:
First commands works wel can execute the su command.

And then? what command next? as: ta_param_loader is not found
[Sony Xperia XZ Premium Guides, News, & Discussion] the_brad:
Stupid me! Didn't realize, I need to execute that over adb shell.
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Hey friends, sorry that I was absent the last days. I was at a funeral...

Will check-in back these days.

[MENTION=4120742]munjeni[/MENTION]

Interesting stuff. Maybe we can use this way and misuse some functions in system apps from Sony, to get a complete dump of the TA?
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
I think main goal is getting drm key :) What is a pie? That mean we can use binary as a lib, right? If we reuse an binary, call will be from that binary with its selinux context, or selinux context will be from caller binary??

Edit:

Interesting stuf... /system/bin/usbeng reads flag from trim area and enables enginering usb?
[Sony Xperia XZ Premium Guides, News, & Discussion] mirhl:
Position Independent Executable I guess?
[Sony Xperia XZ Premium Guides, News, & Discussion] FartyParty:
Gonna donate more when I get money. Lots of people are thanking you and some even sent you a donation while you never asked for one.

That's how you do it, when people appreciate you, they press thanks/donate.

But some people seems to be so fixated on the thanks button, sad :).

Anyway, regardless if you manage to ever find a solution or not I still appreciate all your hard work and research and for that I want to reward you.

Also because you don't act like a total manchild.
[Sony Xperia XZ Premium Guides, News, & Discussion] FartyParty:
[MENTION=8363210]sToRm//[/MENTION]

I accidentally found out that the stock camera works in all situations while in Creative/AR.

What is it that makes it unable to take pics in Manual/Auto but it works fine in Creative/AR.

It's literally the same app but with effects and suddenly it can take pics? Strange!
[Sony Xperia XZ Premium Guides, News, & Discussion] dazza9075:
its called Sony being a complete Bugger about it all, ie, you cant possibly do better than us so we will make sure you cant :)
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
Is xzp first rom version vulnerable to BlueBorne exploit ??? https://play.google.com/store/apps/details?id=com.armis.blueborne_detector
[Sony Xperia XZ Premium Guides, News, & Discussion] schickel:
LineageOS become also the new patch now and the Google devices.
[Sony Xperia XZ Premium Guides, News, & Discussion] mirhl:
Almost granted, given the patch was only released this month.

I'd also expect XZ1 to be vulnerable.
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
My whole home bt network is vulnerable :p , found patches

https://git.kernel.org/pub/scm/blue.../?id=9e009647b14e810e06626dde7f1bb9ea3c375d09

https://git.kernel.org/pub/scm/linu.../?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3

hmm but didn't found any poc, only that app on play store, will try to decompile and see how it detect vulnerability :)
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Hey guys, I will take a deeper look into it this night. The last week I had to get my mood back to steady. The last 3 months 3 persons of my family died. Had to take a pause. But I will invest the upcoming night.
[Sony Xperia XZ Premium Guides, News, & Discussion] serajr:
I don't think so.

Sony stock firmwares with september 1 security patch, have been already patched against this vuln. I've already tested it out on XP F8131 running 41.2.A.7.65 fw.

Maybe the firmware leaked by xperifirm is (XZ1 and XZ1C 47.1.A.2.281)! I don't know, anyway, already downloaded both (just in case).
[Sony Xperia XZ Premium Guides, News, & Discussion] serajr:
Bro... It is terrible to hear about your loss, and I express my sincere sympathy to you and your family!

Take care!!
[Sony Xperia XZ Premium Guides, News, & Discussion] mirhl:
[MENTION=3989065]serajr[/MENTION]

First stock rom for XZ1 has august security patch
[Sony Xperia XZ Premium Guides, News, & Discussion] Lirannl:
Do you're saying we might use the Bluetooth exploit to backup the DRM keys? That's interesting! I can't wait to unlock my bootloader already!

I knew it was a smart idea to avoid updates!
[Sony Xperia XZ Premium Guides, News, & Discussion] serajr:
Which is great indeed! Thanks for the info!!
[Sony Xperia XZ Premium Guides, News, & Discussion] munjeni:
Yes thats a new way, but nobody curently have poc for it, lets hope somebody make one :)

---------- Post added at 05:19 PM ---------- Previous post was at 05:15 PM ----------

So XZ1 is awaiting root for drm backup, he released rom without releasing device and he didn't know that bt will contain security hole, haha thats funny :) But hmm that rom is realy xz1 rom?
[Sony Xperia XZ Premium Guides, News, & Discussion] sToRm//:
Thank you!

I already checked munjeni's idea about getting dumps with manipulated function calls. It would be possible with an self built native, but I was not able to gain system user rights. Maybe we can call a native binary from the system itself and do that recursevly to get a whole dump from the ta. I will check this.
[Sony Xperia XZ Premium Guides, News, & Discussion] FartyParty:
You can just flash a previous version, no need to sit on old firmware waiting for something that might not happen.
[Sony Xperia XZ Premium Guides, News, & Discussion] chefboyct:
Love your avatar... that is a very old ancient anime I haven't seen for years! Good for you! XD
[Sony Xperia XZ Premium Guides, News, & Discussion] karrouma:
It is terrible to hear about your loss,

take care about your self.

may their soul rest in peace
[Sony Xperia XZ Premium Guides, News, & Discussion] GeramanX:
Thank you!

I like it a lot, I'm actually working in a project to add spanish to a Blu-ray version, someday, if I have the time I'll finish it...
[Sony Xperia XZ Premium Guides, News, & Discussion] the_brad:
[MENTION=8363210]sToRm//[/MENTION] did you see, seems like someone made it into the arm-trustzone

https://blog.acolyer.org/2017/09/21/clkscrew-exposing-the-perils-of-security-oblivious-energy-management/

Maybe that's a chance for us...
[Sony Xperia XZ Premium Guides, News, & Discussion] GeramanX:
I don't know what that means but I can't wait to get root and DRM fix XD
[Sony Xperia XZ Premium Guides, News, & Discussion] FartyParty:
Welp
[Sony Xperia XZ Premium Guides, News, & Discussion] dazza9075:
very interesting stuff. it doesn't look like this can easily be fixed without buggering up other things which means... time!

Is it device specific certificates or do we have range specific certs on the XZp?
[Sony Xperia XZ Premium Guides, News, & Discussion] ex3meex:
Any news storm? It's all ok?