[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] munjeni:
Forget it! Yesterday I have downloaded whole xa2 firmware and after extracting bootloader image found that console is not enabled on production images :( This is what I have fount on it:

build.prop

ro.loader.production=true
ro.loader.test=false

part of the init.rc:

on post-fs
start qseecomd

on property:sys.powerctl=*
powerctl ${sys.powerctl}

on property:ro.loader.production=false
setprop ro.debuggable 1
setprop service.adb.root 1

on property:ro.debuggable=1
# Change reset behavior to warm reset
write /sys/kernel/debug/spmi/spmi-0/address 0x846
write /sys/kernel/debug/spmi/spmi-0/data 0x01
write /sys/kernel/debug/spmi/spmi-0/address 0x2085a
write /sys/kernel/debug/spmi/spmi-0/data 0x01)
start console

on property:fs.serial_adb=1 && property:ro.loader.production=false
mkdir /dev/usb-ffs 0770 shell shell
mkdir /dev/usb-ffs/adb 0770 shell shell
mkdir /config/usb_gadget/g1/functions/ffs.adb
mount functionfs serial /dev/fs uid=2000,gid=2000
mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000
start logd
start loader-dbg
start adbd

on property:fs.serial_adb=1 && property:ro.loader.production=true
mkdir /dev/usb-ffs 0770 shell shell
mount functionfs serial /dev/fs uid=2000,gid=2000
start loader

on property:fs.serial_adb=1 && property:ro.loader.production=false && property:ro.loader.test=true
mkdir /dev/usb-ffs 0770 shell shell
mkdir /dev/usb-ffs/adb 0770 shell shell
mkdir /config/usb_gadget/g1/functions/ffs.adb
mount functionfs adb /dev/adb uid=2000,gid=2000
start adbd

on property:sys.usb.ffs.ready=1 && property:ro.loader.production=true && property:ro.loader.test=false
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "serial"
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/idVendor 0x0FCE
write /config/usb_gadget/g1/idProduct 0xB00B
symlink /config/usb_gadget/g1/functions/ffs.serial /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}

on property:sys.usb.ffs.ready=1 && property:ro.loader.production=false && property:ro.loader.test=false
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "serial_adb"
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/idVendor 0x0FCE
write /config/usb_gadget/g1/idProduct 0xB00B
symlink /config/usb_gadget/g1/functions/ffs.serial /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}

on property:sys.usb.ffs.ready=1 && property:ro.loader.production=false && property:ro.loader.test=true
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "adb"
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/idVendor 0x0FCE
write /config/usb_gadget/g1/idProduct 0xB00B
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}

service console /system/bin/sh
class core
disabled
console
seclabel u:r:shell:s0

So serial console definitely not reachable :(

Only interesting thing is lilo elf file, there is a ton of things related to unlocking bootloader, sake authentification, the most interesting thing is hardware config (sin file inside trim area unit 0x7d3) which is responsible for hardware switches, maybe only a chance doing something is having hardware config sin file from an non production phone.

Abaut exploits sorry can't help much, it blowing my head trying to understand, I'm realy not familiar with any exploits, never tried to understand completely how it working, my skils with it is not a good