[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
howto unlock with twrp booted in the middle

Assuming post#515 has been followed.

Download twrp patched to skip execution of recovery scripts:

- xperia xz1 compact: twrp-3.2.3-0-lilac-1-bumtest.img

- xperia xz1: twrp-3.2.3-0-poplar-1-bumtest.img

Please put any test data and apps into your phone for test if they can survive the unlock.

Also please make sure adb debugging is enabled and your PC fingerprint is added as allowed to use adb without any more confirmations asking.

Copy your misc-locked.img to micro sd card which is in your phone (not internal storage, use real sd card please).

Follow the sony's unlock howto.

When you are done with fastboot -i 0x0fce oem unlock command, use following commands (do not reboot / usb unplug / power cycle the phone):

fastboot reboot bootloader
fastboot boot twrp-3.2.3-0-lilac-1-bumtest.img

Just replace lilac with poplar in case you test with XZ1 instead of XZ1c.

Phone should show the unlocked warning screen and boot into twrp as it was showed already in video in post#517 but hopefully would not show errors and would not reboot automatically.

Please check following video where I tested the twrp-bumtest in the middle of a factory reset - it should work the same in the middle of an unlock procedure:

ignore factory reset via twrp bumtest

except that with unlock you are already in fastboot mode while with factory reset I've hold volume up when the phone started to reboot having it connected on usb to PC to enter fastboot mode.

You may use the twrp's shell directly on the phone as showed in the video or you may possibly use 'adb shell' from your PC instead for more comfort typing (or copy pasting) the following commands:

dd if=/dev/block/bootdevice/by-name/TA of=/sdcard1/TA-mid-twrp.img
dd if=/dev/block/bootdevice/by-name/misc of=/sdcard1/misc-mid-twrp.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard1/persist-mid-twrp.img
sync
ls -l /sdcard1

The above commands would backup state of TA, misc and persist partitions from the state right after enter of unlock command before the device is fully wiped.

Now to avoid the wipe that normally results from bootloader unlock, you would use following commands, having your misc-locked.img on the sdcard:

dd if=/sdcard1/misc-locked.img of=/dev/block/bootdevice/by-name/misc
sync
sync

As the twrp has been patched to avoid reboot, reboot from menu does not work.

You can now reboot by holding volume up key together with power on key as showed in the "ignore factory reset via twrp bumtest" video.

Let the phone boot up and check if it kept the setup / apps / data that you had there before unlock.

Now you can continue with the step "8. get temp root again to restore TA" of the main howto.

Please be sure to retrieve TA-unlocked.img - it may be different than the TA-mid-twrp.img.

This test is all about checking differences of TA state in the middle of the unlock versus the state after the full wipe (or in our case full wipe skipped but with new boot up of the phone) versus the locked state.

I would kindly ask you if you could share following files (privately) with me please:

TA-locked.img
TA-mid-twrp.img
TA-unlocked.img
misc-locked.img
misc-mid-twrp.img

so I can check the differences.

Thanks a lot.

Credits:

thanks to [MENTION=4297219]modpunk[/MENTION] for his build of twrp for xz1c and xz1 - I've just replaced /sbin/recovery binary with a recompiled one from twrp source patched to skip recovery scripting and avoid reboot

thanks to [MENTION=4403504]tonsofquestions[/MENTION] for discovering that 'fastboot boot some.img' works if fastboot is entered by another command instead of by hand (already mentioned in post#517)