yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sohrab1985:
We're cool buddy :good:

Sorry for not getting back to you guys sooner. I've been busy the last few days.

So this is what I did:

I flashed kernel-G8142-47.2.A.11.228-hideunlock.zip from this post. Then I flashed Magisk v20.1 and that solved the problem which is weird because I did the same thing for many times before but I got bootloop everytime, but this time it worked the first time I flashed it. Maybe I've been doing something wrong before.

The things is I wanted to use DT2W (Double Tap 2 Wake) but with that kernel SOMC FIDO Key gets NOT PROVISIONED again so this is what I did to get DT2W and SOMC FIDO Key PROVISIONED at the same time:

I flashed a DT2W compatible kernel and obviously lost provisioned SOMC FIDO Key. Then from attachment of the OP I flashed secd-ignore-unlock.zip but nothing happened. After that I went to this post and flashed secd_ignore_unlock_XZ1_Compact_Android_9.0_47.2.A.0.306 which is originally for XZ1C but since someone reported that it worked on XZ1 as well I flashed it on my device and now I have both provisioned SOMC FIDO Key and DT2W.

[IMG="SOMC FIDO Key PROVISIONED"]https://dl.xda-developers.com/4/9/0/9/9/8/5/SOMC_FIDO_Key_PROVISIONED.png?key=NGhLcUGBLQXp7M5gSFUUKw&ts=1577219712[/IMG]

I also did the same thing on XZP and for the secd part I flashed secd_ignore_unlock_XZP_Android_9.0_47.2.A.2.33 from this post and the result is the same as XZ1.
[MENTION=2735402]SXUsr[/MENTION], you mentioned that I should flash the secd file from the OP, and I did with no luck but as I said before the attached file to post#395 did the work. the question is why the one attached to the OP didn't work for me?

Anyway, I just wanted to thank you guys for helping me to get this to work.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sohrab1985:
[MENTION=4418980]j4nn[/MENTION] [MENTION=2735402]SXUsr[/MENTION]

someting is bugging me.

I want to push my backed up TA again (not that its needed. just because I get an error and don't know the reason)

I use these adb commands:

adb push TA-locked.img /data/local/tmp
adb shell
cd /data/local/tmp
dd if=TA-locked.img of=/dev/block/bootdevice/by-name/TA
sync
sync

When I use this command line

dd if=TA-locked.img of=/dev/block/bootdevice/by-name/TA

I get this error

dd: /dev/block/bootdevice/by-name/TA: Permission denied

I did this without any problem when I wanted to do it or the for first time.

could you please tell me what I'm doing wrong and what are the commands to push the locked TA.

Thanks
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=3723095]sohrab1985[/MENTION], secd patch attached in the OP had been supposed to be used only with oreo fw and only for initial testing, before kernel hiding bootloader unlock was created. It will not work on pie. The clones for pie kind of work, but I am not sure if all drm functions really work.

With adb shell, you need "root shell" in order to be able to restore TA. Either use 'su' with magisk installed to switch to 'root shell' or use adb shell with twrp boot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sohrab1985:
Both 'su' with Magisk and adb shell with recovery booted, did the work. thank you so much.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anaconda875:
Hi [MENTION=4418980]j4nn[/MENTION], all,

I've read your post about renoroot. It help us backing-up DRM key by (somehow) by-passing the security and temporarily grain root permission - if I understand correctly. An idea is just happen in my mind that whether we can run directly script within superSU.zip to install full root permission without a custom recovery? It's very helpful if you can help to confirm this information.

Thank you
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7338614]anaconda875[/MENTION], not sure what do you mean. It's not possible to get persistent root from temp root.

Although It is possible to setup magisk from temp root to get temporal "gui root support", it is not very practical and it is quite difficult (renoroot needs to succeed after each reboot, system may not be stable after exploiting with renoroot).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anaconda875:
Hi [MENTION=4418980]j4nn[/MENTION],

If you try to download and open superSU.zip (from [MENTION=631273]Chainfire[/MENTION]) and open the zip file, then open META-INF/com/google/android/update-binary, you will see the script to install su binary.

Normally, we will flash this zip file via a custom recovery, but is it possible if we extract the file and then execute the update-binary with the temp root permission? Just like the way we execute the normal .sh file
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7338614]anaconda875[/MENTION], it is possible to start the script you mention to install su binary - it would probably go through if run from temp root shell. But with next boot, dm-verity would be triggered due to the change in /system (or /vendor) and most likely it would not boot at all. There is a tiny chance that the change would be reverted due to redundancy checksums, but that may be possible for really small changes only.

So you could expect red triangle followed by power off or reboot to fastboot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] wasdroger:
I think it's not broken, just wanted to let you know

Mainly following munted's guide.

- I started on 47.2.something T-Mobile NL, never rooted or unlocked with all 3 keys provisioned.

- Flashed 47.1.A.8.49_CE1, without the persist.sin leaving the rest intact (I ran into some trouble the first time, I did a flash without the .ta file in the boot folder (following this guide that is being pointed to a lot), not going into any details now but for anyone downgrading for TA backup leave the boot folder alone...)

- Let the exploit work for about 10 hours, decided that it wasn't going to work

- After some reading I figured a lower firmware version will probably work better

- Flashed 47.1.A.2.324_CE1, keys still provisioned

- The exploit worked almost flawlessly, under 10 minutes 1 reboot - 1 overwrite - 326 events

- Got temp root and backed up TA

- After unlocking, SOMC FIDO and SOMC Attest keys NOT PROVISIONED, camera has green pics

- Got temp root again (took a bit longer with 1 reboot - 2 overwrites - 12518 events)

--So far so good--

- Then when trying to back up the unlocked TA partition I got this

C:\adb>adb pull /data/local/tmp/TA-unlocked.img
adb: error: failed to stat remote object '/data/local/tmp/TA-unlocked.img': No such file or directory

- Switched to the root shell and .....

G8441:/data/local/tmp # ls -al
total 660
drwxrwx--x 2 shell shell 4096 2019-12-26 14:56 .
drwxr-x--x 3 root root 4096 1972-04-14 21:19 ..
-rw-rw-rw- 1 shell shell 12288 2019-12-26 14:56 g+fffffffffffffff+fffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffff
-rwxr-xr-x 1 shell shell 265 2018-11-03 06:09 renoroot
-rwxr-xr-x 1 shell shell 14536 2018-11-03 06:08 renoshell
-rwxr-xr-x 1 shell shell 609064 2018-11-03 06:08 renosploit

I was tired, didnt't even try to back up the file. Going to do that after posting.

Now I am wondering is there a step missing from the guide?

The first TA backup came from somewhere

dd if=/dev/block/bootdevice/by-name/TA of=TA-locked.img
chown shell:shell TA-locked.img
sync
sync

So should I run

dd if=/dev/block/bootdevice/by-name/TA of=TA-unlocked.img
chown shell:shell TA-unlocked.img
sync
sync

and back that up?

And what's up with the g+fffffffffffffff+fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff file?

Guess I'm going to finish up just following my own suggestion here, [MENTION=3463150]munted[/MENTION] maybe you should edit the guide (for which I want to express my gratitude here, thank you :)) for the 2nd dd command, I know it's just logic but well... I'm not following a guide for nothing ;)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=10324403]wasdroger[/MENTION], your logic is right. Would not it help to follow/check the primary (official) guide? Which is always the most up to date one?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Elwood_It:
Hello everyone, I have a question. I don't follow the modding scene closely so pardon me if the question is a bit dumb. I seem to recall that with android 9 the camera worked on custom rom even if the DRM keys are not present, is it correct?

I'm on the latest stock rom, but I want to go to lineage os. Do I need to backup the DRM keys? Do you suggest I do it?

Thank you
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Didgesteve:
Yes, the camera works with Pie, even if you break your DRM partition. There is some evidence that the quality is not so good, but it's very slight.

You should follow this thread and back up your DRM keys before you do any sort of modding.

Then restore the keys once you have unlocked the phone.

It's a long and complicated proccess and if you haven't done anything like this before, I'd say read up as much as you can. Don't rush into the first how-to on the thread, do some reasearch, look further in, find someone who's done a better more comprehensive guide.

It's tempting to go straight into it, but there are lots of posts on the XZ1c thread from people who have bricked their phones or lost their DRM because they didn't read up and follow instructions.

Good luck.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Elwood_It:
Thank you for the clarification. I used to do these things with my nexus 4, but never with the xz1 and never these complicated. However, i found a guide in PDF in the XZ1 forums that is very complete.

I only have one question. After I install TWRP, I need to upgrade back to Pie in order to get the Pie vendor files, right?

Thanks
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Didgesteve:
Yes, sounds like you've done some reading up already :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anaconda875:
Hi [MENTION=10324403]wasdroger[/MENTION], why did you leave the file persist.sin? To keep attest key right?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] nextgoodone:
updating to 47.2.A.10.107 from 47.2.A.10.80

Hello. I have updated my XZ1 to 47.2.A.10.80 as mentioned, then flashed Magisk v20.1 and hideunlock.zip. Then I downloaded update to .107, selected install and then in fastboot flashed my stock boot.img from .80. After reboot the update is verifying and starting to install for a second and then it shows "rebooting" and it is rebooting to system.

What am I doing wrong? Can you help me? I'm on CE1 variant (G8341).

Cheers and thank you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anaconda875:
Hi [MENTION=8254887]nextgoodone[/MENTION], I think you should flash back the kernel from the version you are using
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=8254887]nextgoodone[/MENTION], if you are trying to follow the guide to perform system fota upgrade, you need complete unmodified stock fw first and only 'fastboot boot' the hideunlock kernel image, not flash it.

To revert the changes, you would need to flash stock kernel. If you flashed twrp, you would need to flash stock fotakernel.

If you ever started twrp, you may also need to flash stock oem and adspso because of a bug in twrp that causes changes there.

See here for more details and ask in the thread, if the fix has already been merged in.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] nextgoodone:
[MENTION=4418980]j4nn[/MENTION], thanks a lot. I've used TWRP and didn't know that it makes changes in OEM without flashing. At the moment I'm using full downloaded 47.2.A.11.228 fw but when update will come I'll try it! Happy New Year! ;D
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=8254887]nextgoodone[/MENTION], I am a bit afraid that we are not getting another update from sony:(

Happy New Year to everyone!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] munjeni:
Hope it is ok to share this here? Just to inform 1.4.5.6 done, here is some video https://www.youtube.com/watch?v=7ZL5ZhLg3Zw ;)

Edit:

HAPPY NEW YEAR TO ALL !!!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anaconda875:
Hi [MENTION=4418980]j4nn[/MENTION],

Sorry for a stupid question, if the device has been implemented dm-verity, it means that even we can root it successfully, we still cannot modify /system /vendor right? So that I still cannot remove bloatwares since my device will not be booted, right?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7338614]anaconda875[/MENTION], if you unlock bootloader, you can disable dm-verity and change anything you want. With still locked bootloader and a temproot, you can not change anything in /system or /vendor because your next boot would fail due to dm-verity.

You may disable some bloatware even with still locked bootloader by use of adb commands (find that in other threads please).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Felipe2077:
j4nn, you created this post over a year ago, yet you still actively reply to people. Wow, I love you for that.

I've read through many of your posts and replies on this thread, and don't want to waste your precious time, so I have only a single question (hopefully).

Question: Does following the OP instructions on my Sony Xperia XZ1 G8343 running Android 9/PIE, September 1st 2019 patch (build 47.2.a.11.228), fresh install, work still, or does this not work on Pie/Android 9?

Thank you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7038305]Felipe2077[/MENTION], yes, following the guide will allow you to backup TA with device key and restore it after unlock to keep drm conditioned functions working if running kernel patched to hide bootloader unlock. That means you need to downgrade to a listed fw version in order to get the temp root working.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Felipe2077:
I followed the guide, and you were right j4nn, it worked!!! Thank you!!! :D
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arifincaesar:
can you help me? because it doesnt work on 4.4.78perf+ kernel :crying:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
What fw did you downgrade to?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arifincaesar:
my device "ratel cell" running on android 8.0 and cannot unlock bootloader..

help me, i want to root this device.. T_T
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] avendish:
Hello everybody,

I have a quick question, I started "./renoroot" on my XZ Premium G8142 and the phone shows "events count" with over 130K number and it is still growing up. I have already been sitting over 1h (I guess) and wondering when it is going to stop?

Is it normal that it takes so long?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7940776]arifincaesar[/MENTION], the exploit is designed only for yoshino phones with only the listed fw versions, i.e. only very few specific kernel builds.

It will not work on other phones or different fw/kernel builds/versions.

[MENTION=10481967]avendish[/MENTION], did you downgrade to a listed fw version?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arifincaesar:
sorry sir, i'm not good at english..

here is my post can you help me?

https://xdaforums.com/android/help/help-ratel-cell-r1020-rooting-t4037255
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
If you can't unlock your bootloader you are out of luck.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7940776]arifincaesar[/MENTION], do you have your phone's firmware in a downloadable form? Can you obtain linux kernel source code for your phone?

I could imagine adapting this (exploit source code here) for your phone, but the kernel binary that is running on the phone is a must pre-requisite. Obviously it would be only a temp root.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] WniGr:
Does it normal for a XZP to have about 60k+ events during getting the temp root?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=10486043]WniGr[/MENTION], did you downgrade to a listed fw version?

Normally it should not be that long, but you need to prepare the phone properly as described in the guide.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] WniGr:
My device is downgraded in listed fw version before getting the temp root, and problem is settled, just reboot the device once and get temp root in 5k+ events and 1 overwrite:D And now is in Pie and everything works fine! Thank for your efforts and tutorials!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] avendish:
Sorry for my late answer. It already works fine.

If it helps somebody in the future, here is a story of what happened in my case.

My xzp G8142 (dual version) was on stock rom (ver. 45.0.A.1.229) and since I remember I couldn't update it because the phone always showed me that "you have newest software instaled already" (PC Companion shows the same and even on sony website after I put imei number, itwas the same). That's why I decided to find some help and solutions on the Internet. Back to the facts, first I tried to run "renoroot" with this firmware that was on my phone and I can confirm that it's not working. Then I flashed the phone with this firmware given in this post guide and then when "./renoroot" started I was waiting for a really long time (I think it was over 1,5h), "events count" shows around 170K number (I left my phone on the desk so I don't even know exactly how much time it was), "overwrites" was few digit I think. When I came back to my phone it was reboot so I started all script again and then (for the second time) it finished successfully very fast.

Sorry for my long story but maybe there will be some clue for anyone that will encounter a similar problem.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arifincaesar:
there is no way to get firmware of this phone sir..

and there's no way to unlock bootloader..

i think the only way to backup firmware this device is exploit and getting root access without ubl..

there is just said 4.4.78-perf+
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
Can you please stop the off-topic discussion? You can create a new thread in the matching device forum and invite us to discuss your problems there, but it is unkind to highjack a thread. Or simple send an personal direct message.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arifincaesar:
yes sir, i'm sorry
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] p@to:
[MENTION=4418980]j4nn[/MENTION]

Hello, do you continue the development to be able to root in locked bootloader? Would it be useful to use in SO_02K?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
So.. regardless of whether root could backup DRM or not on xz2 (or I don't know if there haven't been other progresses in the last 4 months)

I was wondering, couldn't you still at least have GSI boot with locked bootloader?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
No idea about that.

But I guess CVE-2019-2215 based temp root could work with XZ2 oreo firmware.

Temp root using that is nearly instant and nearly 100% reliable (adapted for xz1c and tested with oreo 16.20 fw already).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] biloool:
My device is xz1 with bootloader unlocked : no

Can i use this method to flash custom rom ?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
If you made it Pie based, couldn't it even work up to the Xperia 5?

55.0.A.7.115 was still august patch level.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4900593]mirhl[/MENTION], in my opinion that is unlikely.

It happens with yoshino and tama, that the bug in binder has been fixed with the kernel released with pie firmware.

You can check the kernel source if it contains the fix to decide, where it could be applicable and worth to try to adapt the exploit.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
Duh, right, that's the vuln I hard reported on page 104.

Darn sony and its rebasing their trees properly, rather than simply monkey patching.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4900593]mirhl[/MENTION], it looks binder is a "nice" source for exploits - the mentioned vulnerability on page 104 is a different one - CVE-2019-2025. While the one we discuss now is CVE-2019-2215.

Similar number, but they exploit different stuff in binder, even though both are "use after free" bugs...

I am not sure if there is a working exploit for CVE-2019-2025 publicly available (the poc in the vulnerability report needs a kernel patch to widen the race window).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
??

Anyway, the fix was this and there seems to be a fully fledged presentation and poc available.

https://bbs.pediy.com/thread-254812.htm
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4900593]mirhl[/MENTION], interesting, thanks.

Unfortunately the available poc is very simplified, targetted only for sailfish (i.e. Google Pixel) running 3.18 kernel.

It assumes fixed kernel base address, i.e. no KASLR. Kernel address space layout randomization is present in any recent android kernel, including 4.4 of yoshino oreo fw for example.

Moreover the poc simply patches ns_capable function in kernel code segment, which is not normally writable in 4.4 kernel.

I wonder if kernel code segment was writable even in 3.18 kernel.

As you can see in the slides, there is lot of stuff to do to exploit the vulnerability on recent kernels.

Lot of that is not present in the linked poc unfortunately (no kernel pointer leaking, no f_cred attack, ...).

The CVE-2019-2025 vulnerability could allow temp root on xz2 up to pie 52.0.A.8.14 fw version for example, but it is also extremely complex to fully exploit in my opinion.

Although the CVE-2019-2215 is a bit painful too as it requires two different approaches, depending on offset of the wait queue inside the binder_thread stuct, both exploit variants can be found.

Unfortunately I could make working only the less common variant with 0x98 offset that is needed by XZ1c 16.20 fw kernel.

The kernel of XZ2 has the more common 0xA0 offset of the wait queue, but none of the two exploits designed for 0xA0 offset did work (after adapting) with my XZ2. :(
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
I have the cve-2019-2215 based exploit working with my XZ2 - but it needs "CONFIG_ARM64_UAO not set" in the kernel, which is not the case with any stock kernel for XZ2. This means even though the kernel is vulnerable with the binder bug, using ARM64_UAO prevents it's exploitation (as also documented here - "CONFIG_ARM64_UAO hinders exploitation").

This option changes get_user() and friends to use the 'unprivileged'
variant of the load/store instructions. This ensures that user-space
really did have access to the supplied memory. When addr_limit is
set to kernel memory the UAO bit will be set, allowing privileged
access to kernel memory.

In my opinion this would most likely make the CVE-2019-2025 based exploit fail too.

HW supported security improvements (via new cpu instructions) seem to get further with Snapdragon 845 (xz2) vs 835 (xz1)...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anaconda875:
Hi [MENTION=4418980]j4nn[/MENTION], it seems that the tool work fine with xz1 dual, but some DRMs still error (see #230). Does it impact to the phone? Does any function has trouble?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7338614]anaconda875[/MENTION], if TA-locked.img had been restored and a kernel hiding bootloader unlock is running you would get the security screen without any errors, the same as before unlock.