yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
47.2.A.10.28 hideunlock pre-release kernels

For the just released 47.2.A.10.28 fw version you may check my pre-release of hideunlock kernels here:

https://androidfilehost.com/?w=files&flid=290714

boot-G8441-47.2.A.10.28-hideunlock-rooted-PRERELEASE.img

boot-G8341-47.2.A.10.28-hideunlock-rooted-PRERELEASE.img

boot-G8342-47.2.A.10.28-hideunlock-rooted-PRERELEASE.img

boot-G8141-47.2.A.10.28-hideunlock-rooted-PRERELEASE.img

boot-G8142-47.2.A.10.28-hideunlock-rooted-PRERELEASE.img

Please note, sony has not released the open source archive for this fw version yet, i.e. kernel source is not yet officially available.

Similarly as with my previous pre-release, I am here predicting the kernel source changes.

For this fw release, I guess there are none - so the kernels are just repacks of kernels for 47.2.A.8.24 version (not rebuilt from source, just replaced ramdisk with the one extracted from 47.2.A.10.28 stock fw).

That means sources for the kernels have been released already with 47.2.A.8.24 (available on my github).

I've tested the fota system update from 47.2.A.8.24 to 47.2.A.10.28 with my xz1c - worked nice including the new kernel hiding bootloader unlock with the new fw too, with working magisk and safetynet cts passed.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] GT500s:
Hi. Can someone give me quick advice for unlocking bootloader on my XZ1 Compact? I'm still on stock firmware 47.2.A.8.24 and want to get bootloader unlocked and magisk with working root. The only thing is i don't want to loose drm keys and camera working properly. I know how to unlock bootloader or flash recovery but just want safe method to get it working fine. If anyone can give me some quick tutorial it would be great. The only way is to downgrade to oreo and backup TA?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9470066]GT500s[/MENTION], the only way is to downgrade to oreo and backup TA.

You have nice howto in the first post in this thread.

I wonder why you do not like to downgrade the fw temporarily for the exploit to work for the TA backup?

With unlock your phone will be factory reset, the same you get with fw downgrade, so in any case you need to backup your stuff.

This is a quote of my reply to your previous question in other thread:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] GT500s:
j4nn

Yep You're right. I just want to have clear way how to get everything right. I have Z1 Compact and Z3 Compact both rooted with flashed recoveries TWRP and did everything 100% right at first try with great tutorials from xda forums. Z3 with LineageOS on android 9 is right now best phone i have and battery life on this rom is just amazing.

So first is to downgrade my xz1 compact to oreo and backup TA partition, unlock bootloader and next get back TA to my phone with already unlocked bootloader and then it is good to flash recovery. After all is done and working i can just flash newest CE1 firmware with android Pie and i'm done?

---------- Post added at 10:26 AM ---------- Previous post was at 10:24 AM ----------

Sorry if i ask too many questions but i just need to be 100% sure i won't break my XZ1 Compact:o
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] vofferz:
Some people are reporting problems with Camera functionality after downgrading to Oreo from Pie in ways that seem similar to the effects of unlocking bootloader without drm backup. Without unlocking that is.

I'm wondering if the downgrade from Pie to Oreo is completely safe...

I asked one of them to check the security info to see if there's something weird, so let's see.

The reports are in the Pie to Oreo downgrade thread: https://xdaforums.com/showpost.php?p=79207900&postcount=39

Edit: all the keys show up fine in security info at least when the user went back to Pie so the camera issue after downgrading is caused by something else...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] alagga:
This is caused, when the boot isn't unzipped before flashing with newflasher. Then you run Oreo with Pie Kernel, which makes the Camera not work correctly.

Look at here: https://xdaforums.com/xperia-xz1-co...its-temp-root-to-backup-t3795510/post78995578
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7803472]vofferz[/MENTION], [MENTION=9470066]GT500s[/MENTION], as already pointed out, camera and other security/drm issues (like getting "None" in security service screen) is likely caused by running incompatible bootloader with a firmware.

You need to flash corresponding bootloader (i.e. unzip boot.zip to flash 'boot' subdirectory as is with newflasher) when flashing a firmware.

The thing is that bootloader contains TrustZone applications that get loaded before linux kernel. So it looks like sony updates those tz applets with bootloader. If api between TZ and kernel changes, you get camera and other security/drm issues, if you run incompatible bootloader. It happens particularly when running oreo BL with pie FW or vice versa.

Concerning risks - in my opinion downgrade involves less risk than "TA not yet backed up upgrade": Sony may anytime decide to disable fw downgrade with locked bootloader, so after upgrade, it may be too late to notice that downgrade is no more possible unless bootloader is unlocked. There is already all the infrastructure to disable downgrades implemented - as intended by google as a security measure (older kernel does not boot with newer fw) - that is also the reason that if downgrade is enabled, it erases the phone completely. It would be very easy for sony to disable downgrades with bootloader locked while not preventing developers to do anything after unlock.

I wonder what sony changes with each bootloader version:

47.1.A.2.281: LA1_1_O_77

47.1.A.5.51: LA1_1_O_79

47.1.A.12.235: LA1_1_O_82

47.2.A.0.306: LA2_0_P_104

47.2.A.4.41: LA2_0_P_105

47.2.A.4.45: LA2_0_P_106

47.2.A.6.30: LA2_0_P_107

47.2.A.10.28: LA2_0_P_110

(these are the changes spotted, but may not be a complete list of all BL version changes)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Danko Jones:
fastboot driver

Hi all,

first thanks [MENTION=4418980]j4nn[/MENTION] for your great tool! Donation will come when I'm done.

Actually I'm stuck at point 7 (bootloader unlock). I generate unlock code, enabled oem unlock and booted in fastboot mode with vol+ and connecting usb cable the same time. The flash light is blue, so I think the phone is in fastboot mode. Now on sony website is displayed "Windows users: Open the Devices and Printers directory, right-click on the fastboot driver and press Update. Browse and point towards the location of the new android_winbus.inf file."

On my side there's only a other device "android" and I cannot update the driver. I select the "usb_driver" where the mentioned "android_winusb.inf" file is located. But my windows 10 doesn't accept/find the driver.

Here the link to the sony website im following:

https://developer.sony.com/develop/...er/how-to-unlock-bootloader/#bootloader_guide

Please someone here who can help me out or know what I may did wrong?

Thanks in advance for any hint!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
I found the solution on Win7: https://xdaforums.com/xperia-xz1/de...iding-bootloader-unlock-t3898833/post79221714
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Danko Jones:
Thanks for the hint. I tried to combine the xz1c adb driver with the fastboot driver but no luck for now.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] lilbrat:
Have you tried this.. https://xdaforums.com/showthread.php?t=2317790
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Danko Jones:
Yes, I already have the tools. And I know how to enter the command for unlocking bootloader. But my phone isn't recognized because of failing driver update/installation.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Have you checked the pdf guide?

There is also something concerning windows drivers installation.

I cannot provide good hints about this as I am running linux - you do not need to install any drivers there for use with adb or fastboot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] shoey63:
If that is supposed to be your fastboot driver, uninstall it and let windows install the generic s1 fastboot driver.

Then you can use Zadig https://zadig.akeo.ie/

Which distro?

I want to replicate your build environment as mint 19.1 isn't cutting it when it comes to building tama kernels with the merged dtbo fastboot fix.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
You have to make sure that the INF file includes the VID and PID of your device. What values are shown in the properties dialog of the "android" device?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] GT500s:
I have a problem at step 5 - '' start the tools to get a temp root shell

Use adb shell to get a command line terminal to the phone and use following commands:

Code:

cd /data/local/tmp

chmod 755 reno*

./renoroot ''

but events count are still rising and overwrites shows 1 . Can someone help???

Downgraded to 47.1.A.8.49 and did factory reset . When flashing with newflasher i've removed persist.sin and phone running great after fw flashed. What can be wrong that renotrap can't get that temp root shell ?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5553627]Danko Jones[/MENTION], [MENTION=1995555]SGH-i200[/MENTION], that is quite crazy that you need to that driver inf fixes on windows to get fastboot working.

I would expect install in "next, next, next" experience with windows ;)

[MENTION=4675598]shoey63[/MENTION], I do not think linux distro matters when building android kernel as a standalone build (following README_Xperia) - you use tools mentioned in the readme, so there is not much that linux distro might influence. I can imagine problems differing with distro when building full android, like aosp or lineage, but not likely with just kernel.

Should it help you in any way I am using gentoo based linux - sabayon - but highly customized for various needs (many packages rebuilt from sources using gentoo infrastructure flipping features).

[MENTION=9470066]GT500s[/MENTION], please focus on the "preparation" part of the howto. Remove sim card, do not enable wifi at all when doing setup after factory reset, wait some minutes after boot up before starting renoroot.

If it goes on for like 5k to 10k events without increasing overwrites, it may help to interrupt it with ctrl-c and start it again.

Please follow the howto closely - you may check also my video linked in the howto that goes through the preparation too.

Edit: if you did factory reset before fw downgrade, it would not insist to authenticate your google account, so you could do the initial setup completely offline.

You may do another factory reset in such case to remove your google account dependency to allow you to do the initial setup without enabling wifi and without mobile data connection, keeping offline status all the way before and during renoroot runtime.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] GT500s:
I'm trying it totally offline after factory reset and downgrade.For now it's i think my 8th attempt to get it working but still stuck on getting temp root working.I guess i'll need to try and maybe i'll hit it.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9470066]GT500s[/MENTION], maybe double check you are running exactly the fw version for your phone model as described in the howto.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Danko Jones:
Thanks! The Zadig tool did the trick for me. First I uninstalled the driver and reconnected to see if I get the "generic s1 fastboot driver" shown. But it was still only "Android". Nethertheless I tried the linked tool and after that fastboot was available.

Also thanks [MENTION=1995555]SGH-i200[/MENTION] for your advices!

Now I finally can go on! :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9250730]GT50001[/MENTION], in my opinion, if partition.zip is not unpacked, partitions setup is not flashed. That said, I've never tried to flash it and it all seem ok to me.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] GT500s:
I'm trying over and over but still no luck. When getting another attempt on renotrap i need to repeat commands

adb push renoroot /data/local/tmp

adb push renoshell /data/local/tmp

adb push renosploit /data/local/tmp

adb install -r renotrap.apk

or just

cd /data/local/tmp

chmod 755 reno*

./renoroot

in adb shell ?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
I've compared kernel command line on still locked xz1c with unlocked one - so it comes from still locked phone. But maybe the meaning of those flags can be googled out in some android docs? I've not tried so.

If you are running with my full patch (fixing kernel command line and hiding BL unlock in response from trust zone), I guess you may be getting problems only because of magisk stuff or other customization being detected. I am not sure about /proc/keys - no idea about that.

To be honest, I did not test google pay yet at all.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9470066]GT500s[/MENTION], just

cd /data/local/tmp
./renoroot

in adb shell should be enough (like after the phone reboots). Just make sure you wait like 5 minutes after phone boots up before starting renoroot.

If you ctrl-c it after like 5k to 10k events, you may just run renoroot again for another attempt.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] GT500s:
Thing is that my phone rebooted only 2 times of all 15 tries so far but even after reboot i couldn't hit it. i need to hit it :) Will try again:D

Thank You very much j4nn for very quick tips .
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9470066]GT500s[/MENTION], you might get better success rate with 47.1.A.2.324_CE1 instead of 47.1.A.8.49_CE1 fw version - that was my feeling when compared running it with those two versions, but it may be only a placebo feeling - if the preparation step is done properly, it works with both versions - it is important avoid any background processes interference.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] russel5:
[MENTION=4418980]j4nn[/MENTION] i'm trying full stock firmware and your kernel. gpay tells that i'm have root.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4688377]russel5[/MENTION], do you run it from fastboot boot or did you flash it?

Do you have verity disabled or enabled?

Could you try with magisk v19 beta?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] russel5:
Flash it

both

yes
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Danko Jones:
process done!

So I finally finished the whole process! Everything has worked as described. Many thanks again to [MENTION=4418980]j4nn[/MENTION] and all others who helped me out with my fastboot driver problem.

Donated!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] GT500s:
YES YES!!!! Finally it worked ! I've flashed to lower fw 47.1.A.2.324_CE1 and renotrap hit it after 3rd attempt. After unlocking bootloader and backup TA i can flash newest PIE firmware and flash 'boot-G8441-47.2.A.8.24-hideunlock-rooted' kernel to get FOTA and other stuff ?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
It's good to hear that it worked eventually for you both.
[MENTION=5553627]Danko Jones[/MENTION], thank you for the donation.
[MENTION=9470066]GT500s[/MENTION], you need to follow the howto with the kernel hiding bootloader unlock in order to be able to install fota system update.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
A generous donation received about 50minutes ago (cannot associate it with a user here) - but thank you very much.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] cecato:
sorry for my english [MENTION=4418980]j4nn[/MENTION] many thanks for the support you give to this device.

I followed the guide: done downgrade firmware from pie to oreo.

I backed up the drm and saved the "TA-locked.img" file on my pc, but I didn't unlock the bootloader and went back to android pie with locked bootloader.

I would like to ask a question: If I unlock the bootloader on pie can I restore TA-locked.img directly on pie?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=6240805]cecato[/MENTION], I guess it should be fine to unlock on pie if you already got your TA backup - you could restore it either from recovery (unfortunately adb seems not to work with pie twrp from modpunk) or from runtime if magisk was installed already.

I have been switching between TA-locked and TA-unlocked (to get to lost drm keys state for testing) restoring them on recent pie runtime - it worked nice.

Still TA restore is a bit dangerous operation - double check what commands you type - writing incorrect data to TA would brick your phone irreversibly.

The reason for recommendation for restoring on the same fw version is just that time it was assumed to be the safe side way to do it (and it still is, it just seems to work with any fw version).

But we obviously cannot know if sony would not make some incompatible change with next fw making incompatible TA restored a problem of some kind - so no guarantees here...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Homer-J:
I also restored the locked TA under recent pie, the result can be seen below.

It all goes so far, but the service menu (since bootloader-unlock after downgrade to 47.1.A.2.324_CE1) shows me the loss of two keys (third available), the third has disappeared since installing this kernel

https://xdaforums.com/xperia-xz1-co...nel-sony-xz1-compact-16-january-2018-t3736068

current constellation with rooted kernel see pictures, i hope the keys are working anyway?

DRM1

DRM2

service menu

versions
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9830462]Homer-J[/MENTION], are you sure you have restored your TA-locked.img?

To me it looks like you did not.

To be honest, it looks to me even worse than state usually seen after unlock on oreo with not restored TA.

Please describe exactly what you did including fw versions.

Do you have both TA-locked.img and TA-unlocked.img files?

Could you try to restore TA-locked again to be sure that you have it right?

If it did not help, maybe you can send me those two TA images so I can have a look if device master key is there.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Homer-J:
Out of the box 47.1.A.16.20---> downgrade with newsflasher to 47.1.A.2.324_CE1(all *.ta deleted, scatterbrained except the one in the boot folder, but newsflasher did it obvious right) all keys provisioned (seen in pic downgraded)

--->backup locked TA--->unlock bootloader (seen pic unlocked_bootloader)

--->backup unlocked TA-->restore locked TA

G8441_Customized CE1_1310-7123_47.2.A.8.24_R1C (via xperifirm)---> decrypted with flashtools--->all *.ta deleted---> flashed with newsflash except all *.ta

--->this kernel flashed drm fix

--->this kernel flashed hide/ root kernel

I just tried flashing locked TA again, same result. both TA´s could i send, by pm?

downgraded

unlocked_bootloader

latest_pie_flashed

current
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] russel5:
You should have removed persist.sin from firmwares or you lost your keys forever. It posted in OP.

And if you makes all right you should see this
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9830462]Homer-J[/MENTION], I guess the problem you have is caused by flashing drmfix from janjan's kernel thread - you have TA backup (restored) so you do not need any drmfix. Just flash stock vendor and system images to revert flashing of drmfix. Use my BL unlock hiding kernel and check security screen again.

I wonder, why do you have widevine L3 instead of L1.

Please send me you TAs by pm.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] yamquad:
Can it be possible, that twrp-3.2.3-0-lilac-pie-2 is not working anymore with 47.2.A.10.28? Is there any other way to flash Magisk, then?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] cecato:
For security today I did a new downgrade to oreo and then I unlocked the bootloader and backup TA-unlocked.img and TA-locked.img.

Finally I followed this guide and everything works great.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4879254]yamquad[/MENTION], I am not sure about twrp with the latest pie version - I might have it booted ok or not booted it with that fw at all. I've already reflashed to other fw, so can't test it right now.

But if you use the kernel hiding bootloader unlock - there is magisk integrated already, so no need to flash it from twrp. You would just install magisk manager app linked in magisk thread if you did not have it installed from before.

[MENTION=6240805]cecato[/MENTION], that is good to hear. I believe it is better to unlock with known to work fw version. It possibly would not make a difference if TA is restored from locked state backup. But who knows what sony might change in a new fw.

Still there is also a (not very probable) chance that sony actually improves something with newer fw release regarding unlock - it happened already with tama platform (xz2*, xz3 phones) - if unlocked with certain older fw version, camera would not work properly with any newer fw version - if I remember/understood it right - but if unlocked with recent fw, it would be ok? Not really sure, but something like that. There is no TA backup there, so it actually matters a lot in their case...

In any case, if I understood [MENTION=9830462]Homer-J[/MENTION] right, he did not unlock on pie, he unlocked with the exploitable 47.1.A.2.324 oreo fw version, he just restored TA after upgrading to pie? At least that was what he had written in his first post here.

But I guess the problem there is caused by use of drmfix which must not be used if TA-locked was restored. And it is even more strange that he tried to use drmfix for oreo with pie firmware - if I understand it right?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Homer-J:
[MENTION=4688377]russel5[/MENTION] I also excluded the persist*.sin during the downgrade to 47.1.A.2.324_CE1.

during the following flashing to G8441_Customized CE1_1310-7123_47.2.A.8.24_R1C I flashed the persist*.sin as well,

that shouldn't be a problem, because i did the TA-backup before, right?

Did you get the 47.2.A.10.28 via OTA and keep root?

[MENTION=4418980]j4nn[/MENTION] Your approach with the unnecessary drmfix makes sense to me now, I will see that I get a stock vendor flashed.

And where L3 comes from I would also be interested, unfortunately only now checked.

And I'm sorry for the error in my last post, I already corrected it there, of course I had pie flashed before I installed the drmfix and hide kernel!

Inattentiveness due to lack of sleep before getting the thing to work as it should.

I had the TA restored immediately under oreo, under pie I had tried it again due to the uncertainty.