yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anaconda875:
Thank you [MENTION=4418980]j4nn[/MENTION]. Let's me summarize the steps: Downgrade without persist.sin -> renoroot and backup TA -> UNLOCK BOOTLOADER -> re-flash TA.img -> install suitable firmware -> flash hide unlock kernel -> install magisk. Are they correct?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Klaus N.:
Correct.

But don't forget to check that the TA-locked.img is saved on your pc (see no. 6. and 7. in the op of this thread)!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7338614]anaconda875[/MENTION], just in case of testing with oreo, make sure to flash magisk before the hideunlock kernel in zip format (according to instructions).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
new very fast temp root method available for xz1c/xz1/xzp

I just released the CVE-2019-2215 based exploit for XZ1c/XZ1/XZp phones - it allows very easy and instant temp root while running 47.1.A.16.20 firmware (may be used instead of renoroot for TA backup).

Source code has been released too. Check the following thread in "Sony Cross-Device General" section:

[XZ1c/XZ1/XZp] temp root exploit via CVE-2019-2215 including magisk setup [Locked BL]

I have also implemented a script to start up magisk from the temp root, allowing to use magisk with still locked phones on oreo fw. See the thread for more details.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anaconda875:
Hi [MENTION=4418980]j4nn[/MENTION], sorry for stupid questions,

1. Does this method support xz1 DUAL?

2. What is CVE-2019-2215?

3. Whenever rebooting the phone, we need to re-exploit again?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7338614]anaconda875[/MENTION],

1. yes

2. see few posts above, it's discussed and linked to there

3. yes (or you can just backup TA and unlock instead)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
So... This month is offering us another vulnerability to our resident friend binder

And even an issue with critical severity

https://source.android.com/security/bulletin/2020-02-01.html

Also friendly reminder that as already discussed there is already the once-in-a-lifetime trustzone exploit working up to XZ2.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
temp root extended with support for Canada and Japan variants

G8343_47.1.A.12.150

G8343_47.1.A.12.205

SO-01K_47.1.F.1.105

SO-02K_47.1.F.1.105

SOV36_47.1.C.9.106

SO-04J_47.1.F.1.105

Check the bindershell-v2.zip in the thread here.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
A donation I can't associate with a user here has been received on Thu 13 Feb 2020 07:35:05 PM UTC.

Thank you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tb_:
son of a ... so it's back to the cereal bus exploit?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] maplefzh:
Hello, I did all steps. But there is one wrong.

Service Menu -> Service Info -> Security

"...........

Credential Manager, ver 2.27

Secondary [ERROR]

"

Video image enhancement doesn't work. Others work well. I don't know why.

My device is XZ1 Dual. I have flashed kernal-G8342-47.2.A.11.228-hideunlock.zip
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Lukapetr:
So i followed the guide, i restored TA locked file that of course was previously backed up when my device was locked but i cant take photo, when i click it does nothing. and security is says "none".Now that i remember is was labeled "none" also before bootloader was unlocked.That make me wonderif i made some mistake when flashing the 47.1.A.8.49 firmware compatible with TA backup drm files , i followed this guide for flashing firmware on my previous PIE 47.2.A.11.288.Maybe bootloader is wrong ? Any advies would be appracieted thanks

EDIT: ok solved.It was the bootloader not flashed properly.In fact the guide i mentioned stated that all TA files were to be deleted icluding the one in boot folder but it was wrong.I re-flashed again without delete any TA files and now its working properly including Camera and security info displays all drm working,
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
https://twitter.com/Synacktiv/status/1234852706545741838

EDIT: video of presentation available, in french
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] p@to:
Could this be provided permanent root in locked bootloader?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] digiscales:
J4nn can the new CSV binder exploit be used? Useful?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] xdafanboii:
Hello, has anyone succeeded in installing GordonGate drivers from the Newflasher? I've tried installing it on Windows 10 failed and reinstalled OS to Windows 7 just for newflasher to work and these GordonGate drivers still failed to install.

It says "The folder you specified doens't contain a compatible software driver for your device. If the folder contains a driver, make sure it is designed to work with Windows for x64-based systems." How do I install this damn driver, so my phone gets recognized in Newflasher, so I can get to downgrade my firmware.

EDIT: Figured this out. Basically GordonGate drivers from extracted 7z package from Newflasher are broken. At least on two different PC's and two different Windows versions in my case. However there is a workaround. Download and install Flashtool. Go to it's install directory and run setup "Flashtool-drivers.exe" from "drivers" folder. This setup will successfully install GordonGate drivers for you. After that you can run Newflasher to flash firmware.

Also big thanks for [MENTION=4418980]j4nn[/MENTION] for making this awesome tool.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Amy07i:
It seems only devices with kernel 4.9 and 4.14 were impacted.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] p@to:
Hi [MENTION=4418980]j4nn[/MENTION]. I hope you are good.

What's your opinion about this?

Thanks in advance
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=6283701]p@to[/MENTION], a kernel vulnerability could provide a permanent root only if still locked bootloader would boot an unsigned kernel.

I am afraid that's not the case with xz1/xz1c/xzp phones.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] MrNikeR:
I have a problem - after flashing firmware 47.1.A.3.254_CE1 for G8141 XZ Xperia then after unplugging the USB cable from the phone it is now stuck on sony screen. Any help please.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] PeppeBove:
In case of problem, reflash stock firmware with flashtool and then start again [emoji14]

Inviato dal mio G8441 utilizzando Tapatalk
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=10676977]MrNikeR[/MENTION], did you flash the fw including userdata.sin?

When the fw is downgraded, userdata partition needs to be erased, that is what flashing userdata.sin does.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] MrNikeR:
I believe I did but I give it another try after going back to stock firmware. Can I find that here ?

Thank you
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=10676977]MrNikeR[/MENTION], what do you mean going back to stock? The fw you tried to flash to is also pure stock, just old version.

Do you have the BL still locked? Assuming you are trying to backup TA?

If userdata is flashed and also bootloader (the boot subfolder is present including .sin, .ta and .xml files in it when using newflasher), the phone should boot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] MrNikeR:
I have another issue now, Win 10 device manager not recognising the phone.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] MrNikeR:
I started from scratch... I am at the point of Firmware has been unzipped in Newflasher folder but I have a question on this. I noticed on Munted's PDF he has a folder 'Partition' inside Newflasher. I don't have this but the Partition Zip is there so do I unzip it also within Newflasher folder then put the files into a folder 'Partition' ?

Thanking you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] digiscales:
Yes thats correct as far as i know
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Flamefire:
Can confirm this. Used the same procedure with XZ1C and same results: SOMC keys NOT PROVISIONED, suntory blobs [ERROR], SPC [CRASH] but camera working
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Flamefire:
[Removed]
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Fisuxcel:
problem with adb

I cannot put renoroot apps to my phone with adb push. Any help?

adb push renoroot /data/local/tmp

adb: error: cannot stat 'renoroot': No such file or directory
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Either you did not restore the TA-locked.img or you do not run the kernel hiding bootloader unlock. Or your bootloader version does not correspond with the firmware version.

Please note, the pdf guide is not the official guide. You should always follow the guide in the OP and use the pdf guide only in case something is not clear in the main guide.

That way you would also notice there is already an easier exploit available that works with the latest oreo firmwares, so that can be used for locked TA backup too as an alternative to renoroot.

[MENTION=9263200]Fisuxcel[/MENTION], you need to extract the zip and run the commands from the directory with the extracted files. You should be familiar with such basic things, if not, I would not recommend unlocking the bootloader at all.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Flamefire:
Yes I didn't flash the kernel (I was going to install LOS anyway), this could have helped. Still wanted to report the status after restore of TA

Haven't even seen a PDF, followed the guide in the OP and it did work although I had the same reboot on first try.

Thanks again!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] MrNikeR:
I restarted the whole process and have now encountered an error after got root - adb: error: failed to stat remote object '/data/local/tmp/TA-unlocked.img': No such file or directory

I am lost here
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
typo?

pls post the Terminal in AMD output
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Flamefire:
[MENTION=4418980]j4nn[/MENTION] Not sure if to post here or in LOS17.1 thread: I tried porting your patch to LOS17.1. https://github.com/j4nn/sonyxperiad...mmit/19be5bf0da5ce05bacda88d7c8f0bb0af5c573b1 applied cleanly although with a few changed line numbers. However I'm getting a Boot loop (SONY logo on white background for 3s, then restart)

What would be the best way to debug and fix this? I guess you have some workflow from back then when you developed this? General approach I think of would be add a couple printfs without changing anything to verify the structs used. Haven't done kernel debugging before so:

1. How to best build only the kernel (from the LOS 17.1 repo tree)? `allmod` doesn't show a target which looks right.

2. I guess I don't need to flash the kernel but can do `fastboot boot boot.img`? Or does this change anything important?

3. How do I access the output? `adb shell` and `dmesg` gets me permission denied. I haven't rooted (and don't really want to)

4. Once that is all done: How to debug the boot loop if I can't find a fix until then? No adb access or anything before it restarts...

Any help is appreciated :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5366259]Flamefire[/MENTION], just tested it - you are right, having the bl unlock hiding patch in full seems to result with a reboot to fastboot (when usb connected to pc).

There must be something either in the updated kernel or in los17 init or boot scripts that causes some enhanced security check failed (enforced when it thinks that it is in green verified boot state) resulting with reboot to fastboot, because when the change in drivers/of/fdt.c is not included, the kernel boots fine.

In any case it seems we do not exactly need the kernel command line fixes that mask unlocked state as it seems that sony proprietary binaries do not check that, instead relying on the qseecom tzxflattest api call to return the rooting status:

still locked xz1c

04-08 06:11:20.056 988 988 I libdevice_security_static: get_rooting_status.cpp:80 rooting_status 1

unlocked xz1c with kernel hiding bl unlock patch (drivers/of/fdt.c part not applied)

04-08 23:45:44.623 852 852 I libdevice_security_static: get_rooting_status.cpp:80 rooting_status 1

unlocked xz1c without the patch

04-09 00:18:13.235 854 854 I libdevice_security_static: get_rooting_status.cpp:80 rooting_status 2

The kernel command line fixes could probably be useful for safetynet pass, but that never has been the main purpose of the patch.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Flamefire:
[MENTION=4418980]j4nn[/MENTION] My behavior is slightly different as it doesn't reboot to bootloader but goes full boot loop. Not sure if I had the cable connected though. Pressing VolUP, connecting the cable and waiting for a reboot starts fastboot which is how I got out

I think there are some out-of-bounds reads as your code doesn't check them which causes the restart. I bit the bullet, installed magisk to get dmesg and slightly changed your patch. The 2 changesets in qseecom now look like this:

if (strcmp((const char*)data->client.app_name, "tzxflattest") == 0 && req->cmd_req_len >= 2) {
sb = (void *)__qseecom_uvirt_to_kvirt(data, (uintptr_t)req->cmd_req_buf);
if (sb && sb[0] == 0x07 && sb[1] == 0x04)
rb = (void *)__qseecom_uvirt_to_kvirt(data,	(uintptr_t)req->resp_buf);
else
sb = NULL;
pr_err("Found tzxflattest\n");
if (sb != NULL)
print_hex_dump(KERN_INFO, "myQSEE req: ", DUMP_PREFIX_OFFSET, 16, 1, sb, req->cmd_req_len, 1);
if (rb != NULL)
print_hex_dump(KERN_INFO, "myQSEE rsp: ", DUMP_PREFIX_OFFSET, 16, 1, rb, req->resp_len < 256 ? req->resp_len : 256, 1);
}

And:

if (rb && req->resp_len >= 0x31 + 16 && rb[0] == 0 && strncmp((const char*)rb + 0x31, "HWC_Yoshino_Com_", 16) == 0) {
pr_err("Found HWC tag with value %d\n", ((uint8_t *)rb)[0x30]);
// TODO Flamefire: Patch
//((uint8_t *)rb)[0x30] = 1;
// 0=not_allowed, 1=locked, 2=unlocked,
// 3=allowed_when_sl_is_unlocked,
// 4=allowed_since_sl_is_unlocked,
// 5=unsupported_bl_status->generic error
// (no info in security test screen "none")
}

I do get the "Found tzxflattest" messages but I never see the "HWC_Yoshino_Com_" in the hex dumps. Maybe something has changed there? Will retry with some minor changes today. My cmdline patch also didn't trigger, so got to check if that's another change or my code failed.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5366259]Flamefire[/MENTION], we get the same behaviour in my opinion, it's just that i just tested the kernel with full blu patch from fastboot via 'fastboot boot boot.img', so having the usb cable connected, resulting in fastboot again...

the bootloop is just the behaviour when usb cable is not connected and kernel is flashed...

i am pretty sure the patch works if the kernel command line fixup part is not applied - tested it yesterday.

it even works if the command line fixes are effectively no-op, like writing 'orange' when 'orange' was found and similarly for the numbers - enabled the commented out log line there, confirmed the code active, not throwing any exception with those writes (just thought it could have changed to be read only memory region but it is not the case)...

so that means the problem is the 'green' command line option causing something else to fail (or possibly the other numeric options, did not try to distinguish that further)

just comment out (or do not apply) the part with command line fixes and your kernel will boot no problem, you can grep then the logcat for 'rooting' status as posted to see it was effective

i am not sure how magisk helps you to get dmesg when you get a bootloop?

please note, it may happen that with magisk flashed it may behave differently, as it was the case with oreo sony fw as described in the commit message of the blu hiding patch.

there are also cases when magisk integrated helped to boot a kernel which did not boot before.

my testing yesterday - did not have magisk integrated at all in no test.

los17.1 allows in developer setting to enable root with adb, you can then use 'adb root' to restart adbd in phone into root mode, so next 'adb shell' will provide you already a root shell without need for magisk...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Flamefire:
I can confirm that behavior: The cmdline patch leads to a reboot when showing the SONY logo (to fastboot when USB connected)

I'm trying to find the cause of that. Some good news though: Using Magisk, Magisk Hide and Magisk Hide Change FingerPrint makes SafetyNet pass (tested with other SafetyNet test app and Wizards Unite)

A build problem I encountered which I can't solve:

When rebuilding after a change it does (sometimes? at least often) not regenerate the flashable zip with the whole OS. I'm just doing a `make -j` in the "repo" folder as usual

However I see a couple of error messages "fatal: Not a git repository..." which I traced to the build running `git reflog` and `git log -50 ~..HEAD` inside "out/target/product/lilac/obj/KERNEL_OBJ/drivers/staging/qcacld-3.0" and "out/target/product/lilac/obj/KERNEL_OBJ/drivers/staging/qca-wifi-host-cmn" which obviously doesn't make sense as that is not the git source.

Any idea how to fix building the zip and/or the git errors?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5366259]Flamefire[/MENTION], there seems to have been some development regarding the safetynet / attestation server side implementation - see here.

Concerning your build errors of los17.1 - I have no idea, did not happen to me.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Flamefire:
Ok that is very likely that it is based on a change server-side.

Resolved the zip issue (missed the bacon) and reported the other.

I'm also giving up on an updated kernel patch. You are right, once you change the cmdline something is triggered so it reboots. As I haven't found any way to get a log and tried many other things too I don't see a way to go further. I haven't found where ro.boot.verifiedbootstate is actually set, so I guess that seems to happen somewhere deeper. Resetting it requires quite some work as can be seen by the Magisk code (the property is readonly)

I'll go with Magisk Hide then...

If you find anything new let me know.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5366259]Flamefire[/MENTION], it seems, that hiding the unlock by patching orange state into the green one on command line enables setup of verity in los 17.1, that obviously failing, going straight to reboot.

[ 49.498189] init: [libfs_mgr]Failed to get verity metadata '/dev/block/platform/soc/1da4000.ufshc/by-name/system': Success
[ 49.498284] init: Failed to setup verity for '/system': No such file or directory
[ 49.498291] init: Failed to mount /system: No such file or directory
[ 49.498347] init: Failed to mount required partitions early ...
...
[ 49.503526] init: Reboot ending, jumping to kernel

It is checked in system/core/fs_mgr/, there is a fs_mgr_is_device_unlocked() function, which checks for the orange state, which if present, FS_MGR_SETUP_VERITY_SKIPPED is used to skip setup of dm verity.

But in green state, it seems to require valid verity setup.

Proper solution would be to build los with verity metadata and flash that too, so valid verity could be enabled.

Or return the FS_MGR_SETUP_VERITY_SKIPPED on that two places checked by fs_mgr_is_device_unlocked() function (not sure if this is a lib function called also from other modules, so it is question, if hacking the function itself is wise).

Please note, I did not test yet the above ideas, except getting the log that points out the first cause for reboot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5366259]Flamefire[/MENTION], just tested to ignore verity setup by commenting out both "if (fs_mgr_is_device_unlocked())" conditions present in system/core/fs_mgr/fs_mgr_verity.cpp so that FS_MGR_SETUP_VERITY_SKIPPED would be always returned instead. With such change, the kernel patch to hide bootloader unlock can be fully used, including the code to fix up kernel command line - the system boots up just fine.

This is obviously not very nice workaround - it would be rather interesting to test a build of los with proper verity support. But I am not sure how to enable (and flash) that.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
Well, it seems like we got a nice writeup and poc of some of those mysterious qualcomm closed source components.

TIL also about their own bulletins.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] jezPlot:
Hi guys,

I'm currently at step 10, specifically at the flash "kernel-G8341-47.2.A.10.62-hideunlock.zip" kernel step for my XZ1 G8141 phone. Unfortunately after flashing, I got stuck in the SONY logo (looks like a bootloop issue). Is there any way I can recover the phone? :( I've tried booting up the twrp image again using fastboot, but the phone ignores it and boot straight to the logo. I also tried using Xperia Companion, but that didn't work either. Am I running out of options?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
See what you've done there. You'll need to start over using the flashtool, newflasher or Sony EMMA.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] jezPlot:
Thanks for the help! I do apologize, it was a typo. What I meant was G8341 on both occasions. I tried flashing the old firmware with with newsflasher and thank heavens the device boots as normal! I then repeat all the steps, but instead of flashing kernel-G8341-47.2.A.10.62-hideunlock.zip, I decided to flash kernel-G8341-47.1.A.16.20-hideunlock.zip. And the result is... bootloop like before. If it helps, I'm currently running on FW 47.1.A.2.324_CE1 from the OP's thread and installed Magisk v20.4 with no problems. I suspect the problem is with me running 47.1.A.2.324, but the actual requirement is 47.1.A.16.20. If so, do I have to flash the newer 47.1.A.16.20 FW first before installing the hideunlock zip?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
Yes, the fw needs to match.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hzy1994:
[MENTION=4418980]j4nn[/MENTION], Thanks for your effort on this project first,

It's really a magic for running the stock kernel on QEMU, could you tell me more detail about this?

I want run the Xperia 10 stock kernel on QEMU as what you did on XZ1C, and then porting the CVE-2019-2215 exploit on Xperia 10.

I tried run the kernel-copyleft build by myself on QEMU, this is for finding what the binary patch I need to apply on the stock kernel.

Currently, I need two part of changes to make the kernel works and get a works shell cli on QEMU

1.remove some smc call,

2.enable the ARM PL011 uart driver kernel config:

CONFIG_SERIAL_AMBA_PL011=y
CONFIG_SERIAL_AMBA_PL011_CONSOLE=y

The first part is not hard to apply to stock kernel, but the second part seems not possible to apply.

And As I know, QEMU didn't provide the msm uart emulation,

Could you tell me how did you make the stock kernel console works on QEMU?

Did you implement the msm uart emulation on QEMU by yourself?