yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4688377]russel5[/MENTION], camera works if you flash particular firmware properly, i.e. including bootloader.

If for some reason incompatible bootloader is used while the system is possible to boot with it, it may happen that camera does not work and there are errors in the security screen.

This is something I tested on purpose yesterday.

[MENTION=4917204]c_tho[/MENTION], that could be, do you mean that you have TA restored with unlocked bootloader, having magisk installed, safety net passed and still google would not offer netflix app for installation?

That would confirm my theory that google should be able to get true status of bootloader unlock if wanted using hw backed attest key (and if not available, assume unlock).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] pr0jesse:
Damn, just updated to Android 9 this morning before I found this thread.. Is it possible that (after I downgrade and do the whole root process) to go back to Android 9 while rooted?

Thank you very much for this exploit! Will pay my part of the bounty thread right now :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arslancn:
video image enhancement is not working my device too(g8341) after pie update. how to fix this?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Unbounded:
Ask to [MENTION=4688377]russel5[/MENTION], he might know the answer.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arslancn:
how did you do bro? in my device video image enhancement not working too..
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] russel5:
A is pure phone, not unlocked. Or change something
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sohrab1985:
@j4nn

My XZ1 Running on latest Android 8 firmware and I just checked my security in service menu section and as you can see on attached screenshot my Android Attest Key is NOT PROVISIONED although I've never downgraded and the bootloader is locked. I've never even used flashtools to flash a firmware and since I've bought the phone I updated my device over ota.

So how could it happened and should I experience any issue?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] c_tho:
apologies, i must confess that i didn't realise those steps were required to get netflix to install. have now got twrp and magisk working and can download netflix from google play just fine, so, false alarm, sorry!

on that note... i now have unlocked bootloader, intact drm keys, twrp, magisk and substratum! the holy grails! thanks so much for all your hard work.

edit: add security check screenshot
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4917204]c_tho[/MENTION], does it mean that netflix encrypted hd content works? And video enhancements?

Everybody ([MENTION=7290782]arslancn[/MENTION], [MENTION=4688377]russel5[/MENTION]), please, when mentioning that something works or not, be sure to let us know, if you have TA restored or drm keys lost with unlock or a still locked phone.

I am not sure if it is safe to assume that everybody posting here has TA restored (to be on topic in this thread).

[MENTION=5089926]pr0jesse[/MENTION], just backup your TA, unlock, restore it, flash you favourite stock version, twrp, magisk... All as in the howto. The root for TA backup is only temporary for that purpose. With unlocked phone you can root easily. Having TA restored gives advanced sony stuff back to you (in most cases).

[MENTION=3723095]sohrab1985[/MENTION], that is very strange, but that key is not very useful anyway - you may check the Android Attest Key lost thread for more details.

In any case the state of that key in security menu does not really mean anything - if you temp root and put 5 empty files in a specific directory under /persist you will get that key provisioned even though it is not true. You can test the Auditor app as mentioned in the Android Attest Key lost thread to see if the key is available for use or not in reality.

The only purpose of that key is to provide a signed proof that your phone is "virgin, still locked, android verified booted" to an external entity like google.

When unlocked, even if the key worked and be accessible, the only message that could be signed with it would be "unlocked, verified boot not active" kind of message because the state cannot be faked as all of that is done in Trust Zone.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Just found an interesting app that can (hopefully) be used to check for widevine key usability - not just displaying drm info, but playing various video content:

Exoplayer Sample

It is a build of google's Exoplayer:

https://github.com/google/ExoPlayer

https://developer.android.com/guide/topics/media/exoplayer

Everybody wondering about WIDEVINE key - could you please test that?

This hopefully is a free way to check if protected widevine level 1 content can be played.

It would be interesting to see results for:

still locked phone (oreo and maybe also pie)

unlocked phone with lost drm (oreo and maybe pie)

unlocked phone with TA restored (oreo and pie)

Just tested oreo still locked xz1c, did not find any sample that would not work.

I guess for widevine level 1 tests, we need to check particularly Secure HD/UHD variants.

Not tested all of them though, tried some from Widevine DASH Policy Tests, Capability Tests, Widevine DASH MP4 H264/H265 -> Secure HD/UHD.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sohrab1985:
[MENTION=4418980]j4nn[/MENTION]

Just a question, downgrading in order to use your temp root can't cause anything except Android Attest Key Not Provisioned which in my case it already happened. Is that right?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=3723095]sohrab1985[/MENTION], if you do not flash persist.sin, it seems even the attest key can remain provisioned AND usable.

As mentioned above, I tried even to upgrade to pie and downgrade back to exploitable fw, having bootloader still locked. Just make sure you flash also the bootloader (the boot subdirectory with newflasher).

I am not going to tell you that it is 100% safe to do - no flashing is safe. There is some risk always involved.

What if power of your PC would be lost in the middle of flashing bootloader? I have no idea what would happen then.

Similarly it's always dependent on what you flash. Just check the howto and other linked threads for more details please.

btw, is it really necessary to full quote a big post which is a second post above yours?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sohrab1985:
[MENTION=4418980]j4nn[/MENTION]

Thanks for the help and sorry for quoting the whole post, didn't mean to break any rules. just edited it.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] 4rz0:
I still got a locked BL XZ1c on build 47.1.A.12.179.

Is there something we need to test with this version? If not, I'll just do the OTAs.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
So I've been chatting with J4nn and testing some things before I finally unlocked yesterday.

I rooted, backed up my TA, unlocked, and backed up again.

But I have *not* restored my TA yet.

My camera is still green (well, it looks OK in the preview, but it saves green photos).

In the security settings screen, my Attest Key is provisioned, the two SOMC keys are not, and the Suntory blobs is an error (where it used to say READY and WILDVINE ACTIVE.

However, if I go to one of the drm tool checks (e.g. https://play.google.com/store/apps/details?id=com.androidfung.drminfo&hl=en_US), I see Wildvine CDM populated with a device ID. It shows L1, and a Device Unique ID that is identical to the one before unlocking.

When I go to test sites, e.g. https://bitmovin.com/demos/drm, I see the video, and it says "Chrome, using Wildvine." (if I don't give it access, it says "No DRM" instead.

I just tried Exoplayer, All of the random Youtube DASH and Wildvine (DASH, HDCP, etc) tests that I tried showed up just fine. I didn't try all of them (there are a lot!), but I did tr ysets that looked important (e.g. I tried one from "WV: Secure video path required", but didn't try all three codecs). The "30s license duration" test worked as expected - failing at 30 seconds.

In fact, the only thing I could find that *didn't* work was the one entitled "Super speed (PlayReady)", under "SmoothStreaming", with the error "This device does not support the required DRM Scheme), but I'm completely unfamiliar with whatever this protocol is, so I'm not even sure if it worked before. (Can anyone confirm - [MENTION=4418980]j4nn[/MENTION]?)

So I guess my question is: how certain are folks that WildVine is supposed to break after unlocking? Because as far as I can tell, it works just fine, despite showing the blob error in the security test screen. I care more about the functionality than a status message that we already know is a bit wonky because touching some files is sufficient for the atest key display....
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kpgc10kai:
So, Is there any way to relock the bootloader for TA restored device? Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arslancn:
i ve backup TA by using your guide and unlocked my bootloader a couple days ago. I was restored my TA partition on oreo, with patched secd everything working fine but I dont get system update yesterday and upgraded my phone via newflasher. after boot I ve checked my service menu, in service info/security screen it shows:

Rooting status DONE

Suntory blobs ERROR

and

SOMC FIDO Key NOT PROVISIONED

Android Attest Key PROVISIONED

camera works fine but video enhancement doesnt work.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Did you upgrade already or are you still at 47.1.A.12.179 version?

I could have something to test...

[MENTION=4403504]tonsofquestions[/MENTION], that are interesting results indeed. Thanks for the testing.

I am not aware of any.

Maybe you can try to use sony unlock code again with oem lock command?

That most probably would not work, but I guess it's better to test than miss on that - I am not sure if anybody ever tested that with xz1c.

fastboot -i 0x0fce oem lock 0x<insert your unlock code>

Please be sure to flash full stock firmware first without any changes.

Please let us know what error message you got or if it went fine.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
I get the message

FAILED (remote: unknown command)

If I try to unlock again (fastboot oem unlock), I get the error

FAILED (remote: Device already unlocked)

instead, so I know things are generally working there.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] c_tho:
i have this combination of security info too but am not clear on what "video enhancement" is or how to check it, are you able to explain?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] eidglfvsgkj:
https://xdaforums.com/showpost.php?p=78145861&postcount=310
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] c_tho:
oh. nope, no dice. :crying:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kpgc10kai:
I tried that command, but result was same as tonsofquestions.

And also I tried another command, but result was failed.

fastboot flashing lock

FAILED (remote: unknown command)

fastboot flashing lock_critical

FAILED (remote: unknown command)

And I tried relock by flashtool, But off course Flashtool did not support to relock the bootloader for G8342 yet.

17/016/2018 19:16:21 - INFO - Sending Read-TA:2:2226
17/016/2018 19:16:21 - INFO - Read-TA status : FAIL
17/016/2018 19:16:21 - WARN - Unable to read TA unit 2226, error=-22 ( Hex unit value 000008B2 )
17/016/2018 19:16:22 - INFO - Sending Sync
17/016/2018 19:16:23 - INFO - Sync status : OKAY
17/016/2018 19:16:23 - INFO - Sending powerdown
17/016/2018 19:16:23 - INFO - powerdown status : OKAY
17/016/2018 19:16:23 - WARN - Your device cannot be relocked

Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Guys, as mentioned in the post#287 - your donation money did not get wasted - the brand new xz1c arrived on Friday.

So I can now test on a second device - thank you very much for all the donations and particularly the few exceptionally generous that made this possible.

I was wondering about fw version it arrived with but did not want to boot it - started it straight into flash mode and running newflasher in empty directory revealed, that current version was 47.1.A.12.179.

I hoped that sony would not boot it at all so that downgrade flashing only minimal set of files would be possible.

Tried to flash only adspso, bluetooth, fotakernel, fsmetadata, kernel, modem, system, vendor sin files, that resulted with a boot loop.

Flashed also userdata to get it erased and the phone booted fine into 47.1.A.8.49!

Temp rooted immediately, taking full backup with backup tools.

Tried to check about the attest key - it seems to be present and working - see my post#51 in the Android Attest key lost thread, with Auditor app testing that (not that it would be useful for anything, just for pure interest sake).

Attached a photo showing both xz1c, the new one on the right still having the brand new display protection foil...

Thanks again to all who donated and to all who may still consider to.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
One question in between for interest :

You mentioned in the step by step :

"

You can use newflasher tool from [MENTION=4120742]munjeni[/MENTION] and use instructions there to flash the firmware

"

Why we need a own tool to downgrade?

From which I have read on the Sony HP, there is tool called "Xperia[emoji769] Companion" which can be also flash a Firmware (from my understanding) Or does the tool only flashed only Firmware which could is currently online available?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] flykites:
Correct. Xperia Companion flashes latest available firmware
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Yurienu:
Hi everyone,

Can anyone help me with (what looks like an easy step) 10: flash twrp recovery

I did:

I then boot into normal system and type the following:

It shutdowns and reboots into normal system, what did I miss?

(BTW, is there any better way to start recovery than command line?)

And thank you for your work, j4nn, so far I was able to confirm that I'm able to take pictures, will confirm with WIDEVINE when I am able to get past this step :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Cyanogen_Mod:
There is no "fastboot reboot recovery" command in the fastboot.

You could use "fastboot boot [Your recovery image name]" after flashing it successfully to enter recovery mode, or just reboot to recovery manually.

P.S. Sorry for bad English. ?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Yurienu:
Hi, Cyanogen_Mod, I did the "adb reboot recovery" command from normal system after flashing recovery.

I edited my post to reflect that.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Cyanogen_Mod:
As I discussed above, use

fastboot boot [Your recovery image name]

to boot recovery with command line or just pull the cable out and boot to the recovery manually.

Hope I could solve your problem. : )
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Yurienu:
Thank you Cyanogen_Mod, however I got stuck on SONY logo when doing this command.

When I pull the cable out, I don't know how to boot into recovery other than what I did with the adb command line but nothing shows up.

twrp-3.2.3-0-lilac-1.img is the latest version if you sort by date: https://androidfilehost.com/?w=files&flid=232371&sort_by=date&sort_dir=DESC

I also checked integrity with the signature. My device is unlocked (I can see the warning screen) and I restored TA partition so I'm out of ideas :/
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] 4rz0:
I'm actually still on that version.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
I've experienced this as well. When a rom that "supports" reboot to recovery, it just reboots the phone. Inside recovery, reboot recovery works. I'm not sure of the fix, just offering another data point.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Cyanogen_Mod:
I'm really sorry that I didn't notice you were using ADB command in system last night... I think it could be a bug or something. Could you please try press the power and volume down button at the same time when device is off to enter recovery mode? I don't have xz1c but I think it's the same as the xz1.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
What rom are you using, [MENTION=8030733]Yurienu[/MENTION]?

I was going to post about something else in the TWRP thread, but was skimming through first, and found this:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Likesoft:
My brand new XZ1(G8341) is just in front of me.

Before I break up the seal of box, I'd like to ask some quesitons.

1. According to replies, downgrade and temp root doesn't affect to DRM or certifications. then, does bootloader unlock make 2 SOMC keys broken?

2. after bootloader unlock, the 2 SOMC keys are broken, what do the broken 2 keys affect while using the phone? I've seen some 'Suntory blob error' replies but I have no idea what is 'suntory blob'.

3. there's no way to relock the device until now? I'd like to know if there's way to completely roll back to 'Stock status'(stock bootloader, stock recovery, OTA avilable or so). I'm gonna use carbon rom, I'm wondering I can roll back to stock from carbon rom.

I've read replies as many as I can but maybe I missed some answers. I wanna apologize in advance if I missed the answers..
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Yurienu:
Hi tonsofquestions, I'm still using 47.1.A.8.49_CE1 since I'm still at step 10 (updating to latest version is at step 11).

This morning, I had to update to latest Pie from Sony since it's my daily phone but if required I can downgrade again for the testings.

Noted that adb reboot recovery is not working, however I can't seem to start in recovery mode. When I push Vol Up and right after Power, it doesn't do anything. When I push Power and right after Vol Up it keeps vibrating stronger and stronger so I had to stop. When I push Power and right after Volume Up, wait for the first vibration and release Power button, it boots normally (no recovery).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
Ahh, interesting. I'd missed that you couldn't boot into recovery at all.

I've always heard it as pushing *down* to get into recovery, not up, though trying right now, it seems like both work for me.

Are you keeping volume pressed? I press and hold volume down, press and hold power it takes a little longer than normally turning it on, but that might be in my head), and it turns on with a vibration, which it otherwise doesn't normally do. Once it starts booting, you can let go of the volume button. But it's definitely not just a "press one then the other" kind of thing.

Congrats on your new phone.

1. It affects DRM, but you can restore it, so it has the keys again. It's not 100% clear that nothing else is lost - but we don't think so.

2. Again, not 100% sure what they're for, but little seems to be affected. Maybe some kind of banking app might not work because it sees you're rooted. I don't use those on my phone, anyway, personally.

3. It's not an "until now" thing. There is not a way to relock the device, full stop. While someone might figure out a way, I wouldn't hold my breath, and it would probably require flashing a tweaked bootloader, which is extra risky, since if you do it wrong, recovery is unlikely.

It's certainly possible to roll back to stock rom and stock recovery, but the bootloader will still be unlocked (and tell you on boot). It's not clear if the OTA updates work, but signs currently point to no.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Yurienu:
It's because on my previous phones, Volume Down was for download mode ;) I was able to enter TWRP following your instructions, thank you very much!

On my previous phones I had to release the Power button much earlier and "adb reboot recovery" worked that's why I thought there was an issue.

I think it would be relevant to detail a bit more the step 10 (like how to enter fastboot, the command to flash TWRP and how to enter recovery (explain that "adb reboot recovery" doesn't work)).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Likesoft:
Thank you for reply.

I wondered if I can use finger print reader when the 2 SOMC key is broken.

I got the idea that there's no way to roll back to stock status after unlock bootloader.

I think Just downgrade the firmware and using temp root when I need superuser can be one of alternatives.

Anyway, after temp root, if I do something to system partition(modifying or something), will I get a brick?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
I'm not sure which phone you had, so I can't say for certain. On the recent phones I've had, things change whether it's the power button you press vs plugging in USB.

So for the XZ1:

Fastboot mode: hold volume up, insert cable.

Flash mode: hold volume down, insert cable.

Recovery: hold volume down, press power. (Not actually used on stock phones, because the Sony recovery isn't useful, as far as I can tell.)

Perhaps "hold volume up, press power" is just unused.

adb reboot recovery can work - just only in some roms where the kernel has been fixed.

A note in the OP could be nice, but the instructions don't actually use the recovery in any way, so it seems slightly out of scope of rooting/unlocking.

Yes, the fingerprint reader works just fine, assuming the rom supports it.

If you do something to system, I believe it will lock up the device the device. It won't boot (it might complain, or just bootloop) because the system doesn't match the signing signature. But you can easily recover it by re-flashing the system through flashmode, so I wouldn't call it "bricked" (which is typically unrecoverable). I'm not 100% certain, though. But it would be easy enough to test.

I don't know what you need root for, so I can't say whether the occasional temp root is sufficient. I like to back up my phone nightly (Titanium Backup), I install apps that need the elevated permissions, so repeatedly rooting would be a pain. (Not to mention the custom roms). If you only need it for the occasional action, it might be enough. But be aware that the more processes you have running on your phone, the harder it will be to get the right conditions to hit the exploit. It might take a while, or cause a lot of reboots - and you don't want to use your phone while it's going. Just a thought.

But yes, a "root on demand" (or startup) would be neat, because then not even the Android system/attest key checks could tell. Your call.