[Sony Xperia XA1 ROMs, Kernels, Recoveries, & Other] Chainedge:
Backing up TA partition

My phone just went out of warranty, got into rooting business, struggled quite the bit about that TA partition. I see people here (albeit a year ago) not knowing how to as well.

It's doable via a Mediatek exploit that gives you (temporary) root access. Then you can use dd to copy off the partition. The dev did an exceptional job documenting, but it's good to have a wrap up here for the next person searching. (and yes, you can use that to install a locked Magisk, but lots of strings attached)

You need to understand a few things first:

If you have unlocked your bootloader without backing the partition up, sorry for you. These are specific to the device.

As they are bound to the device, there is no TA partition on stock firmware you download, nor you can use another phone's (even if it's the exact same phone) TA, you'll just brick your device.

Bootloader needs to be in a locked and untampered state to be able to utilize the DRM keys stored. The intention of backing them up is so you can reflash them after you unroot. They can't be used on a rooted phone unless some bright person shows up with a way. (Apparently there might be patchers that can patch keys on root, but that's up to you to look at.)

You can check the status of DRM keys by dialing *#*#7378423#*#* then tapping Service Tests>Security. All of them should be OK and FIDO should say Provisioned.

For the love of Linus, DO NOT LOSE THE TA.IMG FILE. If you do, you can say goodbye to those DRM features forever.

Obviously, just because it worked for me does not mean it will %100 work for you. Even though it involves a really low risk process compared to what people here call it a day, it still involves root commands (and gaining root access through an exploit) and may result in things not to be spoken of. Your call doing it or not. Read the docs, be sure your phone is on the list, double check each root command. And I, nor the devs behind the programs, don't take responsibility.

This will not wipe data off your device. Still, take a backup.

Woah, the warnings are already long. What you'll need is:

A copy of mtk-su, by Diplomatic, from https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213. Take note of your architecture before downloading (AIDA64 Mobile is a good way to know)

The dd-backup script by bigrammy (which will create a handy text file full of dd commands for each partition that'll let you copy them off) from https://xdaforums.com/xa1/how-to/april-2019-ta-backup-unlocking-t3922565

A MTK chipped, compatible phone that is not patched against mtk-su exploit (Your security patch date should be before March 2020. As I remember XA1 Plus G3421 is August 2019), If patched, you will need to downgrade.

Termux Android app or ADB through a PC to to use a shell (I'll explain Termux becase ADB and mtk-su does create a bit of security concerns. If you still want to use that way, the page has it all)

A tiiiiny bit of knowledge about terminal commands such as cd, pwd, dir etc.

Some free space on your phone (TA is pretty small but if you want to back up all partitions including userdata and system, be sure to have 4-20 GB of space at hand. You can use the SD card, but you'll need to make a few changes to the DD commands for that. Will explain)

Optionally a file manager to see things around graphically.

The capability of thanking the devs who made it possible.

NOTE: The moment you download mtk-su, whatever security program you have on your phone or PC will scream bloody murder. It's normal, you're downloading a known security exploit that can grant root access to an intruder. Make exceptions if you need to. Also, if you are backing it up all over the SD card make sure it's NOT FAT32 formatted or dd will fail once a single file exceeds 4 GB. Formatting it right inside Android will do the job.

First step, install Termux and get things needed. Run the app and run these:

apt update && apt upgrade

termux-setup-storage

(sets up storage access)

Optionally, to create a bash script to run the dd commands in one go (I won't explain how, but you can google that)

pkg install <code editor of your choice>

Then, time to pull the scripts into Termux's storage. First off copy the dd-backup.sh and mtk-su files to the root directory of your internal /sdcard, then run

cp /sdcard/mtk-su $HOME

cp /sdcard/dd-backup.sh $HOME

You'll need to grant executable permissions for these before running.

chmod 755 mtk-su

chmod 755 dd-backup.sh

Time to cross fingers and let the exploit do its job.

./mtk-su -v

You should see:

new UID/GID:0

and the icon before your command line should be a # instead of $. If not, run again a few times. If yes, congratulations, you now have root access through that Termux session. It'll be gone the moment you close it though. (pro tip: DO NOT try to mount /system partition as read-write. You'll need to reflash stock to be able to barely boot thanks to dm-verity. Hopefully this code does not need that to work)

If all is well, run the dd-backup script

./dd-backup.sh

This will create a folder inside /sdcard called dd-backup and a dd-backup.txt inside it full of dd commands that'll each copy off a partition from the device, and pack it to an easily flashable .img file inside that dd-backup folder. The backup is not done yet, you need to paste each one, one by one, to the rooted Termux shell to do it.

(Optional)To use an SD card as the destination for backing up, you should open a new Termux shell, then path your way to the SD card using the cd (cd <folder> to go to the folder, cd .. to go up one directory) dir (show what's in the current folder) and pwd (shows the current path) commands. Hint, go up a few directories until you see the storage folder. The SD card is in it, most likely marked up with 8 alphanumeric characters, four, dash, another four. Such as 9021-4E27, NOT sdcard. Then note down the path. Then go create a new folder named dd-backup on the root directory of the SD card. After that, edit the dd-backup.txt the script just created, replace every /sdcard/dd-backup/blabla.img to /path/to/sd/dd-backup/blabla.img. Grant permissions and run mtk-su, then run the new commands to copy partitions to the SD card.