yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Does I understood it right :

the patch for misc-locked is only for and in combination TWRP, so that the TWRP recovery will be start in the first moment or via fastboot command?

There is no effect for other feature or save/restore any other keys as before.

I have rooted the XPZ without this new add steps. Sonys Recovery will start on my side if I hold only a short time Power and the volume button. TWRP start on my side, if I hold the volume and power button as long as I can see the page from TWRP.

Does the patch make sense to add in behind? Maybe the recovery partition is broken?

I have need to use Sonys Recovery during upgrade after root, because I must wipe/reset one time the phone (from the rooted FW to Pie) . After that I upgrade in 2 steps: over the latestest Orego to Pie.... I was thinking, that there was somewhere my mistake...

Gesendet von meinem viennalte mit Tapatalk
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sieghartRM:
I just got a brand new Sony Xperia XZ1 Compact and I was wondering could I backup my DRM keys by following the method in this thread after my warranty for this device has ended and my device is on Android Pie 9.0 or later Android?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
I didn't get it [MENTION=4418980]j4nn[/MENTION] I mean, what's the point of mid-backups img files if we have already done the full backup before the unlock bootloader process?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
Understanding how precisely

unlock itself

affects all the various "reserved" partitions, rather than just the normal mundane secd services that starts on boot (for as much as there are chances UEFI's LinuxLoader might still linger as a confounding variable)

For other and more info on that (including why 835 and newer phones are in fact demonstrably different with relocking than previous ones), I'd like to remember to all interested people of my discussions dump on page 3 of this thread.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9652322]Pixel Shader™[/MENTION], it is only a test to see if the unlocking process is or is not flawed.

If sony screw up and let the removal of device master key to be done in the recovery script (handled by their stock fw recovery), we could find the key still present in the TA-mid-twrp.img.

In that case we would not need the renoroot exploit.

And if it was flawed that way for other devices too, like xz2c, it would provide nice method to backup the key for them.

I assume it will not be the case unfortunately.

But I like to verify that in order not to miss such (even though marginal) possibility.

That is why I need all the TA backups to compare them.

In any case this test should also prove that there is a possibility to unlock and still keep all the data and apps that were on the phone before unlock - still quite useful scenario (although only for those who do not need to downgrade to get TA-locked backup).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
Oh thanks [MENTION=4418980]j4nn[/MENTION] I understand now. By the way, do you still mids backups or I should wait and not unlock my Xperia XZ1's bootloader? I have the three backups so far the "TA-locked.img", the "misc-locked.img", and the "persist-locked.img".
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9652322]Pixel Shader™[/MENTION] or anybody else with XZ1 or XZ1c who wanted to unlock BL - please do so following instructions in post#515 and post#520.

Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Does it help you, if I send you from a XPZ (which was when I've buy it on Pie.. downgrade to CE1 latest version, downgrade to the FW for the exploit) the TA from a locked, unlocked and after upgrade device?

Maybe not... but for sure the question... every 3 TA images looks different

Gesendet von meinem viennalte mit Tapatalk
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7055162]mad0701[/MENTION], these additional steps do not influence any features - see above post#527 please.

I do not have a patched twrp for XZP to test this and in any case this test is only for those who have bootloader still locked and want it unlock now.

I read that twrp on XZP is working probably different (see here) than it is a case with XZ1 or XZ1c (that is probably the reason why [MENTION=4297219]modpunk[/MENTION] builds twrp only for xz1c and xz1 and not for xzp).

[MENTION=8562650]sieghartRM[/MENTION], you can backup TA by following the howto in the first post. I cannot guarantee that you will be able to downgrade from a fw released later by Sony - they can anytime implement the "feature" where downgrade would be forbidden (since android oreo there is all the infrastructure prepared for this with verified boot watching patch levels and upgrading keys, it only is not yet enabled/enforced by sony even though google recommended to enable that).

If you do not like to unlock, you still can downgrade now just only to backup your TA and postpone unlock to anytime later.

In that case even if sony on some fw stopped the possibility to downgrade, you would have the TA backed up already, so you could just unlock, flash anything and restore the TA.

But I would not worry too much about that statement loosing warranty with unlock - if there is a hw problem that you did not cause it would be there regardless the lock/unlock, it should be possible to claim the warranty. You might check your country law about warranty, usually it is not possible for vendor not to provide warranty for such case as bootloader unlock.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] russel5:
[MENTION=4418980]j4nn[/MENTION] thanks for your work.

use exploit on 2.324, backup only TA & persist

now on pie. :good:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Wyzco:
IMEI SHOWING
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4688377]russel5[/MENTION], did you by any chance tried the unlock procedure with the in the middle twrp test described in post#515 and post#520?

I am wondering about TA state after unlock code is entered before the erase is done on reboot.

Is not here anybody who would do this test during unlocking your phone?

There are youtube videos linked in the posts where I managed to boot twrp in the middle and modded twrp avoiding the erase resulting from unlock.

Thanks to any volunteers in advance.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] russel5:
AND?

Is this a problem? you can do something with this IMEI?

Never not understand peoples who always crush it, never do it since z1 compact.

[MENTION=4418980]j4nn[/MENTION] no, sry but we have 100% working exploit.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
hmm, that is a convenient excuse, I am asking for help here and you consider the wanted test as not useful since you can use the exploit implemented by me?

oh well:(

You know, the thing is that if sony screw up and TA in the middle of the unlock still contained the device master key we would not even need any exploit at all?

And if that was the case, that it might be similar with other devices too? Where there is no exploit available at all? Possibly providing very easy TA backup for them?

I know the chance for that is tiny, but I would like to verify that rather than to miss it.

Anybody wanted to unlock, please do it with the in the middle test - it is not that difficult.

Thank you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] russel5:
May be im say not what im mean.

Im not see that post and not see any help request, sorry and im did not want to offend you.

Im already used your tool long time ago for wife's phone, today just used this copy in my comp again and post result here.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4688377]russel5[/MENTION], ok, it's a shame as running that test would probably be quite easy for you considering your knowledge (like our recent PM discussion about possibilities for modifications of TA partition with data from other phones).

Ask for that test is updated even in the first post, so it is rather difficult to overlook.

But I understand you probably did not need to read the howto again if you already did a TA backup for another phone.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
[MENTION=4418980]j4nn[/MENTION] I am about to start unlocking (preparing things). I will do the mid backups as described in post#515 and post#520 while unlocking my Xperia XZ1 (normal).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9652322]Pixel Shader™[/MENTION], thank you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
[MENTION=4418980]j4nn[/MENTION] - I followed all the extra steps on my G8341, but as I rebooted the device by the key combination, my device was wiped. The test app and test data is gone. But I will provide the mid twrp img files to you, after I have created the unlocked ones.

Sony: "fastboot -i 0x0fce oem unlock 0x<insert your unlock code>"

Hint: "You may get it to work by leaving out the -i option (leave out the following device code, as well) if only one device is connected."

---------- Post added at 12:15 AM ---------- Previous post was at 12:13 AM ----------

Maybe wait a little till j4nn has read my test results.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
secd ignore on G8341 is not working

I flashed the 'secd ignore' patch on my rooted XZ1, but the patch changed nothing at all for me in the security info.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
removed
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=1995555]SGH-i200[/MENTION], thank you for your test.

I've compared TA-locked with TA-mid-twrp and the device master key (ta unit 66667) is already gone, so as expected, we are not that lucky.

It is a bit strange that you got the erase even when you restored the misc partition, I am not sure about the reason, it worked for me with factory reset.

For [MENTION=9652322]Pixel Shader™[/MENTION], considering results from [MENTION=1995555]SGH-i200[/MENTION], it may be useful to copy twrp log to sdcard - in Advanced options of twrp, select Copy Log, please.

Thank you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
I had to type all commands into twrp's shell, since my XZ1 was not answering to adb commands while in twrp (why should it?). Maybe I misstyped the last dd command and didn't notice the error message? To bad I didn't take a photo of the screen.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
[MENTION=4418980]j4nn[/MENTION] I will try to copy the twrp log file anything else you need me to do before starting?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=1995555]SGH-i200[/MENTION], are you sure you had working adb shell without need to accept your pc fingerprint on usb connect right before reboot to fastboot where you started unlocking?

[MENTION=9652322]Pixel Shader™[/MENTION], please follow the howto closely.

I would recommend to check the linked youtube videos, particularly "unlocking with twrp in the middle" with enabled subtitles and then also the "ignore factory reset via twrp bumtest" video in order to get familiar with the test in advance.

Please make sure you have working adb shell without need to confirm anything right before rebooting for the unlock.

Try to use adb shell in the mid-booted twrp.

I wonder if adb shell in the middle of unlock was really disabled by the unlock or not. Certainly I could use it in the middle of my factory reset test (I did not use it, instead used twrp shell for demo purposes).

If adb shell does not work then there is no other way than to use twrp shell. Just make sure to type everything right.

Usually there is an error message if something is not right. Some command may not output anything, most likely meaning it was ok.

And use the mentioned button in twrp to copy twrp log to sdcard.

Thank you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
[MENTION=4418980]j4nn[/MENTION] I followed exactly what you said but the adb didn't work after the unlock process. Also, I noticed that "the test app" I've put before doing anything was no longer available. I boot directly to twrp after the unlocking and did the mid-twrp backups and then I kept trying the adb shell to back them up via windows command but it didn't work it keeps saying the following: "error device is not authorized" although I have allowed the pc adb print command. I think it was resetted during the unlock bootloader process.

---------- Post added at 08:14 PM ---------- Previous post was at 08:12 PM ----------

[MENTION=4418980]j4nn[/MENTION] Also, the copy log thing didn't work. It gave me error when trying to copy the log file.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9652322]Pixel Shader™[/MENTION], hmm, interesting. Thank you for the test.

Could you please send me the two misc img files?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
[MENTION=4418980]j4nn[/MENTION] Done. If you need the other backups and mid-backups lemme know
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Thank you both [MENTION=1995555]SGH-i200[/MENTION] and [MENTION=9652322]Pixel Shader™[/MENTION]. I hoped for better outcome, but it seems sony has done a good job with this (the device master key is erased already before the mid-twrp boots).

Even if we might eventually manage to unlock without erase, it is not worth the effort.

Only very few users probably still run exploitable (or lower) fw and would not require downgrade. Only for these rare cases might be useful to avoid wipe with unlock.

Otherwise the wipe that results from downgrade cannot be avoided.

So I would say no more testing is needed.

Thanks again.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
Yes, I'm pretty sure because I used the adb commands listed in your instructions to push the root files to the device. Which action after that and before the unlock could have deleted the accepted fingerprint?

Never mind, I have another G8341 waiting to be rooted. I want to root it in the next 24h.

---------- Post added at 11:42 PM ---------- Previous post was at 11:35 PM ----------

[MENTION=4418980]j4nn[/MENTION] - Why you advised against installing the patch in the OP?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=1995555]SGH-i200[/MENTION], I guess the bootloader handles it. With fastboot unlock, just your unlock code (or it's hash or whatever) is stored in TA. With next boot the bootloader verifies it and if valid, removes device master key and possibly resets other things, like adb and schedules full wipe, which is supposed to be done with stock recovery (that droid progress screen). Just my opinion. I do not know it.

As twrp can be booted before the droid progress screen, there is in my opinion a way to avoid wipe from unlock. But as said it's not worth the effort to analyse and test this further.

I have another very interesting thing to work on.

It will be very useful to those who stay on stock fw with unlocked bootloader with restored TA.

Stay tuned ; -)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
I can't wait to hear the news! :svetius:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Because I am afraid it does not work reliably - some report success with it and some not.

And it is not needed for camera functionality - you can see that restore of TA alone makes the camera working again with stock not at all modified firmware.

It was available and seeing it's internals I thought it might work, so it is there for testing.

You know, it is not always a benefit to make all lines in service security screen to check OK/Active/Provisioned.

An example which goes against those who unlocked is documented now in the Android Attest Key lost thread:

post#98 - how to truly verify Android Attest Key working presence

with tests results in following posts and final conclusion in post#103.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
After another shutdown and bootup I was surprised to see the Sony message about the availability of an fw update.

Conclusion: The patch is working on my G8341, but a real reboot is needed to activate the patch.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
If you think it's related to the next reboot after the unlock, then I have an additional test to try.

Instead of the order of steps suggested in #520

<boot fastboot>
fastboot -i 0x0fce oem unlock <the unlock code>
fastboot reboot bootloader
fastboot boot twrp-3.2.3-0-lilac-1-bumtest.img

I would be interested if anything is different if you reboot the bootloader *before* the unlock, so you can go straight into TWRP without a reboot. i.e.

<boot fastboot>
fastboot reboot bootloader
fastboot -i 0x0fce oem unlock <the unlock code>
fastboot boot twrp-3.2.3-0-lilac-1-bumtest.img

I doubt it would make any difference, but it's worth trying if you have another one you're going to unlock...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4403504]tonsofquestions[/MENTION], that is very interesting idea.
[MENTION=1995555]SGH-i200[/MENTION], could you please test that with your second phone?

If that worked, there might be still present the device master key in the TA.

My guess is that it will not be in unlocked state yet, as the actual unlock would be done on next reboot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
Ahh, and I think it's going to be the opposite. I think the reason the unlock takes 30 seconds is because it's clearing the necessary registers and writing the appropriate stuff to initiate the software reset next time.

I realize it's also possible that you won't be able to fastboot boot twrp.img before rebooting, just as you can't run it with the locked bootloader.

But I will happily be proved wrong for either!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
Guys do u know why X-reality doesn't work after restoring TA and upgraded to stock Android Pie?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] vofferz:
If you flash the secd ignore unlock patch for pie, the video enchantment starts working again. At least for xz1c.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
My phone didn't want to boot after trying to restore misc-locked.img by the following code:

cd /data/local/tmp

dd if=misc-locked.img of=/dev/block/bootdevice/by-name/TA

sync

sync
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9652322]Pixel Shader™[/MENTION], I am not sure I understand - you did the mid-twrp test yesterday and you did not mention that restoring misc-locked.img there in the mid-twrp did not allow you to boot the phone.

Did you restore misc-locked.img on your own today?

The only thing which is supposed to be restored is TA-locked.img after backing up TA-unlocked one.

Restoring misc-locked.img was supposed to be done only in the mid-twrp test.

Oh, I see it now, I hope you did not execute the above command?!

That command does not restore TA, it overwrites TA with misc-locked.img content!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
[MENTION=4418980]j4nn[/MENTION] I did that command and I have restored the misc-locked before unlocking the bootloader and now my phone seems dead. Nothing work no Flash mode no Fastboot. It is not recognizable by my computer anymore. I guess it is hardbricked
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9652322]Pixel Shader™[/MENTION], if you executed that 'dd' command as you posted above, I am really sorry, but with that command you've overwritten TA partition with garbage from 'misc' partition backup.

I just do not get why did you try to restore misc-locked.img?

Clearly you've missed-typed the destination for it, instead of of=/dev/block/bootdevice/by-name/TA there should have been of=/dev/block/bootdevice/by-name/misc if you wanted to again restore the misc partition from locked state (still I am not sure why you would want to do that after completing the mid-twrp test yesterday).

I am afraid you've hard-bricked your xz1c.

I am really sorry to hear that.

I have a personal experience with that too - I changed just one byte in TA for a test and it also resulted with a hard brick.

It could be flashed with newflasher, but flashing anything did not help. It would not power up to boot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Pixel Shader™:
It could be flashed with newflasher, but flashing anything did not help. It would not power up to boot.[/QUOTE]

[MENTION=4418980]j4nn[/MENTION] Mine is Xperia XZ1 not the compact version and neither flashtool nor new_flasher recognize it. Even my Windows 10 usb sound detection didn't recognize it. I would have tried to reflash it again if it ever been recognized although I don't think that will be any good lol

---------- Post added at 07:47 PM ---------- Previous post was at 07:46 PM ----------

If you used a different method to make it get recognized lemmeh know and try it my XZ1 only blinks a green light
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9652322]Pixel Shader™[/MENTION], exactly, a blink of a green light.

My xz1c brick went straight to flash mode when it was connected to PC though.

Newflasher kind of worked, it could flash, but there were following info logged:

Product: FAILproduct
Version: 0.4-SONY-0.31
Bootloader version: 1306-5035_X_Boot_MSM8998_LA1.1_O_79
Baseband version: 1307-7511_47.1.A.8.49
Serialno: FAILserialno not supported
Secure: no
Loader version: XFL-MSM8998-N-45
Phone ID: FAILPhone-id not supported
Device ID: <removed>
Platform ID: 2005E0E1
Max download size: 104857600
Sector size: 4096
Rooting status: ROOTED
Ufs info: SKhynix,H28U62301AMR,D003
Emmc info: FAILEmmc-info not supported
Default security: ON
Keystore counter: 1
Security state: 162509AE6B4B54D487F2496DDC4D4B6C6747A73B
Sake root: D159
S1 root: S1_Root_e69c
Root key hash: C30DEC2471CEA311E6918657367B51068A39583BBF89FD68B379BCD5A709AB1B
Slot count: 0
Current slot: F
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Almar033:
Perhaps you could use emma sony flash tool (not the known flashtool) a tool for unlocked devices ? It saved my ass once with a tablet z3 compact i thought bricked.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] lilbrat:
Have you tried Sony companion, go to repair software and check the small box at the bottom.. Phone won't turn on or something like that.. And see what happens..
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Almar033:
Sony companion doesn't work for devices with unlocked bootloader, you have to use sony emma flash tool as I said.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
Well, you did suggest it in the second set of instructions:

The typo is pretty disastrous (writing to /TA instead of /misc), but I imagine that's the reason for doing the step...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4403504]tonsofquestions[/MENTION], but as you can see in the previous posts - quoted here again:

Pixel Shader™ already went through the mid-unlock twrp howto completely yesterday. He has sent me both misc-locked and misc-mid-twrp images yesterday too.

But for unknown reason he tried to restore misc-locked again today - that is what I asked - why to try to restore misc again while the test had been fully completed yesterday?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
Ahh, you're right. I was getting Pixel Shader confused with SGH-i200, who had talked about a second phone they were going to try with.

For some reason I assumed Pixel Shader was also using a second phone. If it was the same one, then I agree I'm confused why the restore was tried after the reset.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] lilbrat:
Had a blonde moment.. Thanks.. Although he could fire up flashtool and attempt to relock his bootloader.. As i have borked my xz a lot an brought it back to life, that way..