yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9509161]d3dm[/MENTION], thanks, the pdf looks interesting, even though I have not read it yet.

Currently I do not need any help, I have already managed to get temp root on my XZ1c.

The problem is that the exploit is not stable enough for general use, I guess there is some bug causing unexpected behaviour resulting with extremely long run without getting the wanted hit in the shaped kernel heap. Or it just causes the phone to reboot.

Concerning that "most phones can be bricked if selinux is down for more then several seconds" - I was a bit afraid about that too, checked xperia kernel source and did not find any code taking care about that, so unless something like that is in proprietary sony binaries, we might be ok.

In fact it seems that's not the case with xz1c - I've risked it already as I had selinux disabled with temp root shell active for hours. And it seems to be ok after reboot.

As soon as I have the exploit working more reliably I want to test TA backup followed by unlock with help of [MENTION=5677791]tramtrist[/MENTION] who is willing to risk such very first trial.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] d3dm:
Sounds like you're just around the corner there :)

Good luck!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arslancn:
awesome work bro! I'm waiting for your good news and I'm not gonna install Pie update because I heard there is no way to downgrade to Oreo from Pie update.

(XZ1 G8341 user)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Here a preview video with the temp root.

renoroot-preview.zip (158MB)

I've provided the 1st version of the tools to [MENTION=5677791]tramtrist[/MENTION] for the initial test of TA backup, unlock and restore.

Let's see what happens - big thanks to [MENTION=5677791]tramtrist[/MENTION] who is exposing his locked phone to this very first test.

The last screen of the renotrap app in the video attached here as a screenshot for better readability.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tramtrist:
Thanks j4nn. I'll take a look at the process and steps tonight. I'm hoping to have it all tested and feedback in no later than Sunday night. Hopefully it works and you can spread the love thereafter...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Baalsson:
Wow! That sounds promising.
[MENTION=4418980]j4nn[/MENTION]: If you need more volunteers I also have an unmodified XZ1C.

Thanks for all the time you are investing in this project.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Just to share current status and test results from [MENTION=5677791]tramtrist[/MENTION]:

- downgrade to G8441 47.1.A.2.324_CentralEurope1 firmware caused loss of Android attest key, similarly as happened to me (described in this thread)

- before the downgrade, attest key was present and there was 47.1.A.16.20 UK firmware

- temp root worked, TA partition has been backed up together with kernel bootlog

- phone was unlocked via sony, booted (camera did not work - green pic), temp rooted, TA and boot log retrieved for comparison

- TA partition was restored from the backup, after reboot the phone remained unlocked, but camera did work again

- all 3 keys from key provision daemon are "not provisioned", CBK and WIDEVINE are both OK and ACTIVE, Suntory blobs report "error"

I like to test a patched kernel which hides unlocked setup coming from bootloader into kernel command line to see if that makes any change (sent to [MENTION=5677791]tramtrist[/MENTION] via pm).

Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] meowthink:
Thank you j4nn and all the others for your work on this.

I think downgrading may always cause the lose the attest key (though I still don't know what role this key plays), as it contains SecurityLevel info.

Anyway, since the temp root exploit is based upon CVE-2017-7533 which is fixed in android patch level 2017-12-05, maybe fw 47.1.A.2.374 and 47.1.A.5.51 are also worth to have a try?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tramtrist:
As j4nn mentioned camera works in this process same as before.

I think if there are any other locked users out there as some have mentioned that he run through this process again with you from scratch. It's entirely possible I ****ed something up in the process which threw off my results.

All in all though still pretty good result :) I'm presently waiting to see if OTA comes through on its own. If so I'd say we have a winner.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] greatpatel007:
any support for XZ Premium

Is it possible to compile something for xz premium, I have xzp locked (unlockable) in spare and I can test it on it. If you can tell me on which firmware (date before) it worked on then I can try the same thing as well.

Thanks
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Inerent:
Congratulations, J4NN! ? ?You are the best!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
guys, I know you all would like temp root with TA backup for your phone variant.

Unfortunately it is not that simple as to "recompile" for another phone.

Each phone has it's own kernel build, which is not binary identical to kernel of other phone models, even though they have the same base chipset. The exploit needs to be tuned for each kernel that it should support.

Making the exploit compatible with another kernel is not trivial task. There is even reverse engineering work of the target kernel needed. Currently only XZ1c is supported, even the bigger variant is not.

You should know, that I have spent extremely lot of time working on this - I've started already in February 2018!

Is here anybody with still _locked_ XZ1 Compact still having 47.1.A.8.49 (or earlier, i.e. older) firmware (and never downgraded before), willing to test with me please?

The 47.1.A.8.49 is the last fw which has the exploitable inotify/rename vulnerability.

It would be interesting to temp root that without need to downgrade and check about those strange keys nobody knows what they are for - the Android Attest Key, SOMC FIDO Key, SOMC Attest Key.

I am a bit afraid that these keys are related somehow also to FOTA upgrades.

Android Attest Key seems to get lost with any downgrade of stock fw even without unlock.

The other two get lost with unlock and seems not to be possible to recover them via TA partition restore from backup done before unlock.

As I do not know for sure if every downgrade destroys the android attest key, let me ask this way:

Is here anybody with all the three above mentioned keys in status PROVISIONED and is running still 47.1.A.8.49 or older firmware?

If anybody with newer fw but still provisioned those 3 keys can test downgrade to 47.1.A.8.49 just to check if android attest key gets lost or not, it would be great too.

Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sebollah:
Hi j4nn,

I have locked XZ1C, but with 47.1.A.12.179. I never downgraded it nor did anything with it, and I'm willing to help. I will need step-by-step instructions, as I'm not very familiar with unlocking/downgrading etc.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Hi, just check service menu -> service tests -> security screen if you have all those 3 keys mentioned above in PROVISIONED state. Document that by taking screenshots, including screenshot of the current fw version on the phone: settings -> system -> about phone (bottom part).

BACKUP everything you may need from your phone! With downgrade, factory reset is done.

What region is your current fw customized for? Maybe grab also service menu -> service info -> software info screen and service menu -> service info -> configuration screen.

It would be best to try to downgrade without changing customization but that may not always be possible if we do not have that fw somewhere.

I have 47.1.A.8.49 only for Central Europe 1 - available here.

When your backup is done, flash the 47.1.A.8.49 fw with newflasher (use instructions there to flash the firmware).

Then grab the screenshots again for comparison.

The main question is if Android Attest Key would get lost or not.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tramtrist:
Let it sit overnight but still no Ota :(
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sebollah:
All 3 are PROVISIONED - I already took screenshots. As soon as I figure out how to attach images here I'll upload them.

What is best way to do it? Sony Companion?

My region is probably CE1 - Customisation Version: 13010-7123_R7B

Does Attest Key has any impact on phone operation?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
well, this could be expected, normally when you bootloader unlock, FOTA upgrades would be disabled, because with unlocked bootloader vendor cannot know, if system was not modified and therefore if the incremental upgrade can be safely done or not.

It may be related to those 3 keys discussed or may not. Instead it may simply be connected to the fact, that unlock was done, which is visible even after TA restore from backup before unlock.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
No need to upload all the screenshots here (or mask your imei / serial num at least) - rather keep them just for reference.

Best way of backup? Good question. I do not know. Depends what you value.

I would backup stuff from internal storage like photos/videos and so on at least, that should be easy.

Ok, CE1 it is, that's good.

What impact any of those 3 keys have - I do not know. Does anybody know?

We know we can restore camera functionality after unlock without need to modify anything in stock fw if TA is backed up before unlock. It also seems like WIDEVINE is re-activated with TA restore (so some protected multimedia content should again work after unlock I guess, but I have not ever used any such service).

I guess the camera functionality without need to patch anything is the major benefit. Even if FOTA upgrades stopped coming after unlock, manual flash of newer stock fw would get you the same result (upgrades probably do not need to erase anything).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] 4rz0:
Out of interest: Why is unlocking bootloader still required even though we already get temp root before that?

Wouldn't it be possible to install some SU binaries trough temp root to gain full root without having to unlock the BL, deleting the keys in that process?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Dfis:
Hi. I have the same question :) T

Hi. Joining the question :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] gidews2it:
i don't know why or how, but the attached file seems to be missing from view. somehow found it on the internet, it should be attached for anyone like me who's missing it.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Alefello:
Hello everybody

I've a strange behavior in backing up the TA partition on my XZ1c. I did the operation on an XZ1 successfully but when I did the same thing on an XZ1c it doesn't work as expected.

Here are the things I did:

- installed G8441_47.1.A.8.49_CE1 downloaded from this thread using Flashtool (I made the ftf removing device info.xml and selecting only sin files)

- no account setup on phone

- backup TA using renoroot to temp root it

- installed G8441_47.1.A.16.20_Germany ftf selecting only sin with Flashtool

- no account setup on phone

- backup TA using bindershell to temp root it

- checked checksum of the two backups and they are different! When I did the same operations on my XZ1, they were the same and I went on witn bootloader unlocking, restore of TA, upgrade to latest official firmware, etc. In this case with XZ1s the checsum were different!

- so I installed G8441_47.1.A.8.49_CE1 again and backupped the TA partition again using renoroot, and the checksum was different from the previous 2 times.

What am I doing wrong? Which is the right backup of the three? Or should I backup TA in another way?

Thank you

[EDIT] I checked again the XZ1 backups and they're different too. I backupped twice using renoroot, and then twice using bindershell. The two renoroot backups have the same hash, the two bindershell backups have the same hash, but renoroot backup has a different hash from bindershell backup. Anyway I restored the first backup I did, and camera works, so I think it was a correct backup. Idk.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
@Alefello you can never get an identical TA from two different boots.

Each boot stores bootloder log into TA, so that each boot changes the TA in multiple units.

Even backing TA up in a single boot two times might result with a different image if some sw component writes to TA in between the times you make the two backups.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Alefello:
Oooh ok. I didn't expect that. I thought as there was unit specific data in the TA partition it was fixed. Why does it change instead? And why does it work restoring it (or one single backup of it, to be precise)?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] rootgremlin:
i purchased a XZ1c recently to use as a "walkman" device because of the 3,5mm jack, the device.Size, the SD,- and the USB-C Slot. the fact that there is a current android / LineageOS rom is also a plus.

BUT......

what functionality am i going to loose if i simply unlock the bootloader, install twrp and lineageOS with MicroG on it without following this guide. The phone seems to be on its original Software/Locked (and latest patched) state.

What functionality would be lost without the device specific TA Partiton / keys

DRM / official status (obviously OK for me) so Netflix, and other vidwhine apps

Camera (are there still only green pictures, or does it not work at all? both cams, front and Back?)

NFC

GPS

other sensors

Audio device something

Bluetooth Codecs

(fast) Charging

eneything else?

Thanks!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] zpunout:
I haven't confirmed this, but I suspect microphone quality for phone calls becomes too quiet. I've read about others complaining of volume issues when using a custom OS whereas my XZ1c is fine (mine has a backed up and restored TA partition running LOS17.1 ).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] craspo:
Hello. I have an issue while trying to back up DRM keys. Actually according to what I was looking everything went sucessfully. I was able to unlock BL, I was able to execute the exploit a second time, saved the TA-locked and re uploaded it to the phone. But when I unplugged it from the computer and tried to reboot to check the camera for a successful attempt, phone is dead. When I connect it to a charger, the green light lights up for like an instant and goes off again and keeps on doing this forever. When I plugged it into the computer the green light stays on and on the device manager shows up : "SOMC Flash device". Any idea what could have happened?

Thanks on advance for your time!

EDIT: Retracing my steps this morning, it looks like I have pushed a different TA-locked file from another XZ1C to this one ....
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
If it boots into flash mode, that's a good sign that you didn't break something really badly.

Try re-flashing the stock rom (via newflasher) and see if that gets it booting again.

As to what happened, I'd have to see the commands, perhaps you flashed TA to the wrong partition? It's hard to say without more detail.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] craspo:
Hi! Thanks for your prompt response. I woke up today and tried to retrace my steps. I believe I have uploaded TA-locked of another XZ1C to this new phone. I am having a hard time believing I can be that stupid. Is there something I can do to fix this?

Thanks again for your time!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] norabitox:
I don't think there is a solution.

Hard brick state.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] craspo:
Thanks for your reply. That is what I am afraid of but since the green light stays on and I can see it as "SOMC Flash Device" I thought there could be hope to do something
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] craspo:
Thanks for your reply!

I made an edit in the post: Retracing my steps this morning, it looks like I have pushed a different TA-locked file from another XZ1C to this one.

Newflasher is able to see the phone and interact with it. What ROM should I reflash? Should I try to re-flashing the same stock Rom it had or the Stock Rom that has the exploit?

Thanks for your time!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
So my previous memory was that if you mess up your TA, you can't even get into flash mode.

But if you have actually pushed a TA for the wrong device, then there's no solution I know. of - your device is stuck. You cannot flash a new TA via flashmode.

If you really want to, you could try re-flashing a ROM - I doubt it would matter which one - but I also don't believe it would make any difference.

My condolences for your loss - that's a tough mistake to make.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Comparing the newflasher log from bricked state provided by @craspo with TA backups of both his xz1c, it really looks like the wrong TA backup is now used in the phone.

So it seems that flashing TA from a different xz1c only "half bricks" the device as it still boots at least into sony flash mode.

That is still pretty bad situation, but lot better than "real brick" state, that would not do anything except the mentioned "green light lights up for like an instant" and that's it for all ways to bring it up.

We may try to use patched newflasher to restore some TA units extracted from the right TA backup for that phone, hoping the fw would validate the security stuff and allow boot to continue. Newflasher needs to be patched as certain (dangerous) TA units are explicitly forbidden to be flashed in the source code of newflasher.

The big question though is what TA units to try to restore this way?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
Definitely interested to hear how that turns out. That could be a gamechanger for recovery.

Is there any reason not to just try and flash all the TA units? i figured the direct TA backup/restore via root would essentially do that anyway. And it seems safer than risking a mismatch between any of the units.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Not a game changer, we just did not know, that flashing a consistent TA backup from a different device (in this case the exact same model) did not fully brick it, instead it forcefully boots into sony flash mode.

This may not be the case for TA from a different xperia model or if complete garbage is flashed into TA partition.

Yes, flashing all TA units would be great for consistency, but that is not possible, because the phone will refuse to flash specific TA units without sony SAKE auth.

Also the tools extracting TA units from TA image are not exactly parsing the structures as sony implemented it, it is rather reverse engineered heuristic extraction, so trying to flash everything would be probably more risky.

I hope we can retrieve bootloader logs with newflasher, maybe there would be some hint what is wrong - if it even pointed to specific TA units, that would help a lot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] norabitox:
In the case of older Xperia, I have seen information on how to restore the motherboard by flashing the firmware in SOMC flash mode using test points.

Unfortunately, I could not find any such information for the xz1c.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] nlra:
It may actually be that XZ1 models and beyond handle invalid TA data with more "grace" than past models did, because it was absolutely the case before that when people would try "trading" TA partitions with each other from the same models, that they quickly discovered it would completely brick their phones...not even flash mode worked any longer. There are many such sob stores on this site...I'm having trouble at the moment quickly coming up with an example of one that is just a TA flash from one identical phone model to another, but here is a good example of one (came to mind because I'd replied to it) involving a Z3 Compact that some poor sap did a bit-for-bit copy of the entire flash chip from one Z3c to another. Oops! Of course that touches more than just the TA partition, so possible in retrospect it wasn't just TA's fault. But I'm sure I have read other stories specifically involving only TA with the exact same outcome.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] craspo:
OK, update on my case. Phone is back to working condition!! Still on firmware for the root temp exploit, but everything is working as it should! LTE, GPS and Wifi.

****Infinite thanks to @j4nn ****

He guided me and saw the possibility on how to fix the phone. Since the phone was stuck in flash mode (green light on) After getting many connection logs and information on the state and connection of the phone thru newflasher, he came up with the idea of flashing 3 .TA files to the phone. We did, and the phone was able to boot normally and also is able to get into fastboot mode.

I was then able to upload the right TA-locked file into the phone, I still have to check if this was made successfully, but the phone is on working condition as I stated before.

My explanation is very basic because I do not have the knowledge to perform this procedures by myself, that is why I really want to thank everyone who brought ideas and specially @j4nn for the guidance and the patience thru this whole process 🙏