yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] alagga:
Thanks for the clarification :)

You're right i didnt unzip Boot (there was no hint to do so). I've already updated to pie again (flashed pie via newflasher to get the customized DE Version and not the CE1).

But the TA-Backup normally should be alright, doesnt it? (dont really want to Flash Oreo again, as i already setup the device)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
47.2.A.8.24 hideunlock pre-release kernels

You may check my pre-release of hideunlock kernels for 47.2.A.8.24 fw here:

https://androidfilehost.com/?w=files&flid=290714

boot-G8441-47.2.A.8.24-hideunlock-rooted-PRERELEASE.img

boot-G8341-47.2.A.8.24-hideunlock-rooted-PRERELEASE.img

boot-G8342-47.2.A.8.24-hideunlock-rooted-PRERELEASE.img

boot-G8141-47.2.A.8.24-hideunlock-rooted-PRERELEASE.img

boot-G8142-47.2.A.8.24-hideunlock-rooted-PRERELEASE.img

Please note, sony has not released the open source archive for this fw version yet, i.e. kernel source is not yet officially available.

I've tried to include the fixes for 2019-02 patch level though.

My xz1c works very nice with this kernel and the latest fw, so just enjoy this fine early pre-release:)

-- edit --

Attached kernel source code patch to comply with GPL.

Let's see how close this would be to the official release;)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
Next time Sony will wait till you post your kernel with the new patch level, and will include your work instead of having to patch the kernel on their own! :D
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] cynthi4:
Successful TA Backup and OEM Unlock with XZ1C (G8441)

Thanks [MENTION=4418980]j4nn[/MENTION] for these awesome tools and tutorial!

My Experience

Initial Conditions

I started with my XZC1 running 47.1.A.2.374 firmware (and PC running Window 10).

Downgrading Firmware

I could not open either of the downgraded G8441 firmwares .RAR files with 7-Zip. [47.1.A.2.324_CE1 and 47.1.A.8.49_CE1]

So instead, I installed winRAR which was able to open them and used the 47.1.A.2.324_CE1 fw.

Then I deleted persist*.sin file and flashed with newflasher.

TA Backup

j4nn's instructions on how to backup the TA were clear and helpful. No issues.

Bootloader Unlock

Sony's command to unlock the bootloader only works for Platform tools 26.0.2 or older. The command Sony listed used an depreciated option to identify your device by vendor ID. I had a newer version of Platform tools and used the following commands:

fastboot devices

This showed me my device USB ID. I then used:

fastboot -s MyUSBDeviceID oem unlock 0xMyOEMUnlockCode

After reboot, the bootloader was unlocked, but all pictures were green.

TA Restore

No issues here, the process is nearly identical to TA Backup.

After TA restore, the camera worked again but only the Android Attest Key showed provisioned in the Security Test.

FW Upgrade

I used XperiFirm to download a newer firmware.

I went with Customized CE1 with FW version 47.2.A.6.30.

This time, when I flashed the FW I deleted

based on a comment someone said to maintain the settings.

No problems occurred here.

Modified Kernel Boot

I followed j4nn's link to boot the modified rooted kernel to hide OEM unlock and include Magisk.

I used the boot-G8441-47.2.A.6.30-hideunlock-rooted kernel since that matched my updated FW version.

I had to do this twice to get OEM unlock hidden properly. I'm not sure why.

OEM now looks like its never been unlocked in the settings and Security Tests show SOMC FIDO and Android Attest Keys provisioned. Camera works perfectly as well.

However, during reboot, the screen still displays a unlocked bootloader message. It seems like we are stuck with this.

Renoroot Statistics

TA Backup: Took 2 runs for success. Successful run had Events Count of 14693 and 3 Overwrites. The time of this run was around 9 minutes.

TA Restore: Also took 2 runs. Successful run had Events Count of 7844 and 5 Overwrites. This run took about 5 minutes, 40 seconds.

Thanks all! <3
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kfrin:
Successful TA Backup and OEM Unlock with XZ1 (G8341)

Thank you very much [MENTION=4418980]j4nn[/MENTION] for your great work and tutorial!

My Experience

Initial Conditions

I started with my XZ1 running Sony 47.1.A.2.281 stock firmware. The device was untouched.

I tried the renoroot xploit directly on this firmware but it didn't work.

Flashing Firmware

I flashed my G8431 with 47.1.A.2.324_CE1 firmware with newflasher. Great tool, easier than Flashtool.

TA Backup

With this new firmware, renoroot worked like a charm (after 2 tries). TA Backup was very easy.

Bootloader Unlock

Tried with the latest platform tools but the -i argument was deprecated so I had to use platform tools v26.

After reboot, the bootloader was unlocked, but all pictures were green.

After TA restore, the camera worked again.

Using XperiFirm I downloaded 47.2.A.6.30 fw and flashed it with newflasher tool because Flashtool didn't have the script to flash it.

I launched the latest TRWP in fastboot mode to install Magisk and now I'm rooted!

Thank you again [MENTION=4418980]j4nn[/MENTION], you're the man :D
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
Thanks for patching! I will try 'boot-G8341-47.2.A.8.24-hideunlock-rooted-PRERELEASE.img'. I was the first to download this file! :cool:

Edit: Flashed the kernel and Magisk afterwards. Up and running! :good:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4420923]kfrin[/MENTION], you may benefit from use of bootloader unlock hiding kernel. If not wanted to use fota, just flash it, possibly followed by flash of magisk to disable verity if direct modifications of system were needed. That should enable few other sony drm functions.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] autobanned:
i'm sorry for asking this, but i have same problem with alagga, where camera doesnt work and in Security Screen in Service stays empty and says "none". after downgrade from pie to oreo

i have download firmware from first post for xz1 compact 47.1.A.2.324_CE1,

in this firmware, i didnt extract partition.zip, i just delete all *.ta file (including in boot folder) and persist*.sin then flash it

is there any mistake or miss that i have done?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Didgesteve:
Don't delete boot folder or anything in it.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] john_david9000:
410 Gone

Guys the renoroot.zip is returning a '410 Gone' error. If anyone has this zip, please provide a link.

Also [MENTION=4418980]j4nn[/MENTION] please fix this soon.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] autobanned:
ah, yes it should be not deleted.

unfortunately, i have flash with .ta file deleted in boot folder, backup TA then unlock the bootloader.

i redo the step, but now without deleting .ta file in boot folder, and then restore TA

but SOMC FIDO and SOMC attest key status are NOT PROVISIONED.

does this mean i have lost DRM or wrong backup TA because at first i delete .ta file in boot folder then flash it to my xz1 compact?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Didgesteve:
There's a lot of detail about attest keys here.

I don't think it effects anything.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Smugl:
Hey J4NN, how do I use this patch for OTA 47.2.A.8.24? Thank you
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
What are you trying to do? Upgrade via OTA to the newest firmware? Which version is on your device right now?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Smugl:
I'm trying to install the firmware via OTA 47.2.A.8.24 to 47.2.A.6.30, so I have a phone bootloader (G8441) bootloader unlock. But it does not work.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] reiriop:
Has anyone else tried this one? I am unable to get it to boot properly via fastboot or flashing via twrp I just get stuck on the white Sony logo screen. Would combining firmware cause an issue for this? I have combined US/VN so I can have the fingerprint sensor as I am in US.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] khanhesham:
since the open source archive is available for 47.2.A.8.24, [MENTION=4418980]j4nn[/MENTION] could you upstream the kernel from pre-release drmfix patch to stable patch for xzp ?

https://developer.sony.com/file/download/open-source-archive-for-47-2-a-8-24/
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
That's probably going to become relevant in the near future

https://www.xda-developers.com/android-fido2-certified-passwordless-access/
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
Which steps do you took? 47.2.A.8.24 is the newest one. Do you really want to downgrade?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Updated post#2 in xzp/xz1/xz1c variants of "rooted kernel hiding bootloader unlock with working fota" threads: added hideunlock rooted kernels for 47.2.A.8.24 fw.

The pre-release versions have been already pretty good. The only difference in compiled kernels is in "QTI WCD CODEC Soundwire controller" - the official released source code for xzp/xz1/xz1c contains an older version.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] DrYak:
Apparently, sir ThomasKing (Yong Wang) is presenting "From zero to root: Building universal Android rooting with a type confusion vulnerability" at an upcoming conference.

Given the name, it looks like CVE-2018-9490 is applicable to exploits on unpatched firmwares (older than october 2018), bringing hopes to XZ2c, the whole XA2 family, etc. if some knowledgeable developper decides to pick it up.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] dustinzahn:
Hi!

I was a little bit sorry for my English exam, but the beer was caught properly, so I can rely only on the google translator. I trust it will be understandable and I will not get into the top 10 reversal. :D

So it is a pity that the whole topic is almost dead for this phone (XZ1 Compact) because after reading the last few conversations I think some people don't know ABC and numbers.

So for some time now, I have been wondering why I am reading XZ2-related things in an XZ1 Compact forum, because they differ not only in letters, but in many other ways. Do not misunderstand, I am not afraid of being off on a particular topic, but I have been sucking about 1 month ago, because of my own stupidity and the lack of reading after that I opened my bootloader and failed the keys of my personal DRM. :crying:

Fortunately, the landlord reminds me of this error at every boot. Guys, I've tried everything I read through all the posts, and I realized that either I accept the fact that it is, and there are things that can't be backed up or I buy a new motherboard (maybe I will give it a deep form, and I will give it a new IMEI that doesn't include it Anyway, the last one can be done? I'm sorry I'm windows, this linux is new to me, I'm tired of "adb reboot - it won't be like it was" commands. Maybe someone has a sensible suggestion about this winter (XZ1 Compct), what more I'm sorry for my English once again, I hope the point is over. I'm tired of getting up and lying with the XDA XZ1C Topics. I never want to see that stupid Sony dum by "closing the bootloaders" when they don't do it themselves. :eek:

The irony of life is that it was not possible to open the bootloader at my Z1Compact, and I fought against it for months and now I'd rather shut down Pandora's box whit this s.h.i.t. (XZ1c)

Nevertheless, I will remain a xperia fan.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9733705]dustinzahn[/MENTION], the posts related to xz2 (or any other tama platform phones) are here because they concerned possibility to port my bootloader unlock hide kernel patch to that platform.

I do not own any of those phones, so that's the reason I am not starting any threads in their forums.

It was an interesting challenge for me to port my patch there particularly also because 'fastboot boot' command did not work on tama platform due to dtbo partition and bootloader bug that (according to sony) could not be workaround.

With that regard, it is perfectly on topic (following posts about yoshino bootloader unlock hide kernel patch).

I am not really sure about your post - are you just crying that you see unlocked bootloader warning screen on boot of your xz1c?

If that bothers you that much, maybe you could try to claim it from Sony?

And I am not joking here. The message says it clear:

"Please lock the bootloader."

So I believe Sony should tell us the way how to do it.

We do not need to lock it back to stock state.

With unlock, verified boot key has changed (documented in Android Attest Key lost thread).

Sony could provide us a way to insert custom keys and lock the bootloader with them, so we could have verified boot enabled with custom signed kernel and firmware.

That would not make any harm to sony software (the verified boot key is different already), but could bring our custom roms better security.

I would really like to assume that the meaning of that bootloader message above is this - that we should lock the bootloader with custom keys and custom software.

We just need sony to tell us how to do it.

Could you (or anyone) claim that from sony please?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] dustinzahn:
Hi!

I'm glad you replied!

Breaking through the whole net, You and Russell are the ones who can talk about the subject matter. :highfive:

I don't like talking to Sony because I don't see the point. Especially here in Hungary is very official gas service. But I still have a pair of Sony, but now there's a little problem.

You're right, it's just "graves" (no other word I could find that would describe it better, so don't understand it literally). The bootlogo is disturbing because it reminds me of how vulnerable I was. I'm not a conspirator, I'm just aware of the risk. For example, in the days I've been to the net where even google translater froze rather than translating. Then my IS program (legal Kaspersky) cried without stopping, so that somebody "wants something from me"

Actually, I wanted to get the current version of XPerifix in a very "positive" way, in return I could reinstall Windows.

During the trip I asked the question, even if I was getting a legal source, how reliable?

Going back to the subject, I tried all of your recommended suggestions, but during the process I dropped to restore something that was lost.

How does this make sense? It motivates me at some level to fix a mistake, so I don't understand the word "graves" literally.

Anyway, the modification is alive, so if I buy the next Sony flagshipe mobile, the first thing I do is look at how I can modify it. :)

I hope you will be present with this type because I appreciate what you are doing, but unfortunately it is no longer helpful to me, but I follow the topic.

As I said, "Google Translater" is pretty interesting. I cried out laughing when I read your answer, I mean what I mean, but the compiler translated the funny words. :) :D

---------- Post added at 01:01 PM ---------- Previous post was at 12:48 PM ----------

I'm not Lassie (I can't find a good English word again, I hope you understand it) but what I've been reading in the past few weeks, I think you're also interested in Sony. I mean, there are some interesting innovations that you started talking about in the past.

In fact, I would be pleased if the Sony-s Emma program would be accessible and the right to correct it.

Instead, you can download the stupid version, which is good for the max defibrillator if the other programs have been shut down during recovery. I think that if it is so easy to open, then make it easy to restore it.

By the way, if I switch to the developer menu to believe it is closed, is it really closed, and is my system really "hacked" because of the changed boot?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] alagga:
No offense, but wtf are you talking about :D
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Let's get back to topic related discussion avoiding long hard to understand posts please.

That presentation will most likely be very interesting, but in my opinion, it will not be about CVE-2018-9490.

The linked conference webpage has following detail description of ThomasKing's presentation:

So it is about a possibly new but certainly _kernel_ exploit (the mentioned CVE-2018-9490 is an android userspace vulnerability as can be deduced from c++ source code that it targets).

I need to correct you in this and also this posts: KSMA is not used in renoroot tools.

I did not try to implement KSMA even though it is very interesting. For KSMA you need already kernel space read and write primitives. ThomasKing uses inotify/rename exploit to get those (and me too). But having kernel space mostly arbitrary read and write primitives allows to achieve root (after bypass of KASLR/PXN/PAN mitigations) even without KSMA - I am using different vulnerability for that.

Concerning chances of TA backup for newer phones: ThomasKing most likely will not release the exploit in any form, there might be available only his presentation as it was with his past exploits.

Somebody will need to reimplement the exploit, but it will not be me - I have no time for that unfortunately.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] dustinzahn:
I'm talking about (fuc* U :p) that I opening the bootloader before I thought about what I could do.

Sometimes I came up to the XDA to read about my current phone, and now when I accidentally threw an article out of here, I read a little into the conversations, and I looked at it curiously if I could open it and unfortunately wrote that yes. As I accomplished this, it was about. I've read about opening for as long as the flashtool installation takes. Since I'm not completely illiterate, I quickly made a backup, just the problem that my two saved partitions didn't really contain the lost data, so thanks to flashtools.

The flashtool made a 01.Ta and a 02.Ta backup. The first 12Kb, the second is 748Kb.

After opening, somehow it appeared that there was a logo before the departure, which tells us to lock it back. I've been around since then, I can't. In essence, I'm going to go to the XDA now, just like before.

I jump to each new info to see if I can use it. Maybe I should give it up because the forum is dead, almost no one is dealing with this type.

Do you have any idea about this? If you don't, don't su*k me please.

Thx.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] shoey63:
[MENTION=9733705]dustinzahn[/MENTION]

Even if you managed to make a proper ta backup before you unlocked the bootloader, you would still get the warning message if you restored it.

It has been this way since the x, x performance and xz where restoring the ta partition would truly relock the bootloader.

It is no longer possible to get rid of it.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] dustinzahn:
Hi!

THX the answer!

If it is just a picture that contains text, can't it be a more sympathetic "picture"?

As I said, I had some degree of computing at some level, I would have deeply shaped the whole system at windows, but it is not win. and if I report quickly, it cost me more than one month's salary. So there are certain limits that I don't want to go beyond, because it's still better to scatter with a text than to turn it on.

---------- Post added at 12:43 PM ---------- Previous post was at 12:32 PM ----------

Hi!

Android is also just an operating system, so it executes command lines in which file to find the bootloader to load this image?

I had a question before.

I am happy that some of them have lost their ranks, but as I wrote, my mother tongue is English, which I have translated to google translatter so far, and I have found a legitimate WTF issue.

My simple question was, if I do with Magisk, that the OEM part can be turned on and off, will it really do what it means? :confused:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] shoey63:
The message is embedded in the bootloader. Attempt to change it by one bit and you have a hard brick.

And it used to be worse, something like °Your device is corrupt and can't be trusted! ° in Orange letters and a triangle.

It appears before any other partition is loaded, so playing with OEM won't help.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] dustinzahn:
Well, I'm getting into some of these things on some level because I've been learning to use this platform ever since I've "spoiled".

But I have not yet realized that if I install a Magisk or boot with a j4nn moded kernel, by switching things in the delevopes menu, am I the "boss" again?

So the bottom line is that if I re-control the delevopers menu (OEM On-Off), then I'm really good and I just push a "stuck" boot logo for non-stop my phone?

So if I can enable the OEM function with a third-party program, will my phone be really "virgin"?

Indeed, I opened it out of thought and did not consider it.

Because it sounds good to install everything, but what about security ???

Magisk, Xposed mods is like having a Christmas night, but is the actual securyty patch working on my phone? The boot logo somehow suggests something else.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] vofferz:
If you opened the bootloader without backing up the DRM keys like the first post advices, you have lost them forever. You can get the phone to think on some level that the drm keys still exist by some fix, but the unique keys can not be restored.

The boot warning just states that your phone might be running some unauthorized programs but it doesn't mean that there's any risk unless you or someone else install something like that. And there's no info from Sony on how to relock the bootloader, and it seems the boot warning cannot be removed without relocking the phone, so we are stuck with it.

Personally I couldn't care less about the warning, and I think it's actually agood thing so that also the less technical people see that the phone might not be "as new" if they buy it used. Of course if you want to sell your own phone, it might be harder. But you chose to unlock it yourself in the first place...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] DrYak:
Ooops, missed the conf's desciption. Indeed, if it's kernel based, there's no chance in hell that C++ gets involved, as long as Linus is alive.

Sorry, my bad. I didn't understand correctly the credits on your website.

Too bad... though I don't really understand why keeping the code secret, once the vulnerabilities have been fixed.

But, hey! His code, his say.

Too bad... Yeah busy lives make things complicated.

(And it's way beyond my league. I actually work in the opposite direction: I'm the guy who fixes memory corruption when our scientists' code behaves weirdly on the cluster).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=8459357]DrYak[/MENTION], I guess the presentation to come might be about CVE-2018-9568 (kernel: Memory corruption due to incorrect socket cloning) fixed in 2018-12-01 android patch level. The conference description could fit it.

Or something completely different.

The Kernel Control Flow Integrity topic mentioned there (bypass of it) would be very interesting too!

Concerning KSMA - the slides explain inotify/rename exploit (even though lot simplified) before switching to ksma itself. So it helped me somehow, even though I did not start to reimplement ksma as that looked rather complicated and required first phase exploit anyway - ksma is used (only) to bypass PAN & PXN. Not using it was very difficult too unfortunately, so it's question, what would have been easier.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] andresukma_:
Helo sir my name is Andre Sukma

Hmm , im waiting for sharp sh04h/shv34/506sh. because this cellphone can't be rooted right now. Good job sir