yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=10771859]hzy1994[/MENTION], it is quite a long time, so I do not remember it exactly, but you are right, that I had to patch the smc calls.

Concerning console - I remember first compiling a test kernel enabling some serial console driver compatible with qemu and once that worked, compiled it as a module to be compatible with the target kernel binary and load it from custom initramfs.

But save yourself a lot of effort please - first check Xperia 10 kernel sources to see if the vulnerability is present and in which version.

My guess this bug has never been present in any kernel of Xperia 10, but I did not check that.

There is another question - as Xperia 10 is running Qualcomm SDM630 Snapdragon 630, I do not know, if it supports in hw (and has enabled in kernel) the CONFIG_ARM64_UAO kernel option.

In that case the bug could not be exploited, similarly as it could not be in case of XZ2 - see here.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Inerent:
Did you opened the camera app while running The exploit?

---------- Post added at 06:27 PM ---------- Previous post was at 06:23 PM ----------

The drm keys are located on emmc momory, therefore another hardware. But they must be checked and copied by,/in kernel either at boot or, maybe, when calling an app

Good luck! ???
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7543898]Blu-eyes[/MENTION], just tested it with stamina and ultra stamina modes. It did not help.

With ultra, I cannot run all components as needed (only few selected apps are allowed to run).

With normal stamina it runs very similar as normal mode.

The point is that it needs to be run over usb cable otherwise the hit rate is even worse.

It seems that allowed power saving is counter productive, possibly less predictable and therefore worse hit ratio.

I need to set it up to always on when on usb cable and wake all cpus to get it work as described.

Obviously I have had wifi/data disabled in "normal" mode to avoid any influence of some system apps accessing internet or whatever, so that may be other reason that normal stamina makes no difference to the way I use the normal mode.

[MENTION=8615083]Inerent[/MENTION], usually I try not to run anything that could influence predicability. But tried it with cam started first, but I need my app in front, so I am not sure if cam had been running in the background. But it was at least started before the exploint on this last test. Unfortunately I could not find any related change in kernel log buffer when compared logs case with and without camera started before the exploit.

You know, having arbitrary read does not mean I can simply search all memory for keys - the problem is not only that I do not know what exactly to search for, but the main problem is that not every address is mapped, so if tried to access wrong address, the kernel would page fault and phone would reboot.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] freeZbies:
I think you should post this in a more general forum, so as to get more exposition. Posting something like this in a device specific forum is a sure way to make your work go unnoticed
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Motolav7:
This exploit isn't very general and is developed to exploit this kernel which is why it's on this forum only.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5583097]freeZbies[/MENTION], particularly the post you've quoted - I tried to get it noticed posting also in general security forum that time, see this /general/security/android-oreo-exploits-to-temp-root-t3801895 thread.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Anyway, is here anybody with still locked xz1c willing to try TA partition backup (when temp root is ready), official unlock and then TA restore?

You know, there is some risk, that TA might not get restored (I mean the keys could be somewhere else), so this is kind of one try test.

If it did not work, I could not continue with further analysis.

Still I guess it could work as it seems a device key is present in the TA.

On my still locked temp rooted xz1c I get 16 not null hex bytes from the following command:

./readta -i TA.img -u 0x1046b -h

So I hope that with restore of the TA we would get back drm keys conditioned camera functionality with stock fw possibly with re-locked bootloader.

Downgrade to 47.1.A.2.324 fw would be required (I guess factory reset would be needed when downgrading).

Any volunteer please?

And could someone please post TA partition image from already unlocked (and rooted) device?

You may read it with something like this:

adb shell
G8441:/ $ cd /data/local/tmp
G8441:/data/local/tmp $ su
G8441:/data/local/tmp # dd if=/dev/block/platform/soc/1da4000.ufshc/by-name/TA of=TA.img
4096+0 records in
4096+0 records out
2097152 bytes transferred in 0.107 secs (19599551 bytes/sec)
G8441:/data/local/tmp # chown shell:shell TA.img
G8441:/data/local/tmp # ls -l TA.img
-rw------- 1 shell shell 2097152 2018-10-05 00:04 TA.img
G8441:/data/local/tmp # exit
G8441:/data/local/tmp $ exit
adb pull /data/local/tmp/TA.img

Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] freeZbies:
oh, that's nice then
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tramtrist:
I'll be your guinea pig. Though I'm going to need step by step instructions. I know how to unlock the boot loader and downgrade but relocking and using whatever temporary root tool you come up with, obviously, I have no idea how to do.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] pbarrette:
Here you go.

Because a TA partition contains IMEI and serial number, the zip file is encrypted and I have sent you a PM with the password.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tramtrist:
Nevermind.. Figured it out :p
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Thanks.

If not comparing content and checking just the presence of TA units (my locked vs yours unlocked), it looks like this:

+unit 0x008a2 2210
+unit 0x009af 2479
+unit 0x00a2b 2603
-unit 0x1046b 66667

(+ means it was not present on my locked TA but is present on yours unlocked, - means it was present on mine but is not present on yours)

There are 3 units with 0 length (2465, 2486, 2553) but they are on both mine and yours.

So clearly the 66667 unit (device master key?) is removed from TA with unlocking.

The 2210 new unit contains just G8441 string, the 2479 unit is set to 01 00 00 00 hex and the 2603 contains just 00 byte. I guess at least some might also be due to different fw version used.

Could you please post (or send me) dumps of 'devcfg' and 'devinfo' partitions too?

Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
That is nice of you. Thanks a lot.

Could you please let me know, what fw version (including region code) do you run currently?

Could you please check this post: android-attest-key-lost-bootloader-t3829945.

Maybe post similar screenshots or just check if Android Attest Key is still PROVISIONED (together with the others)?

Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] pbarrette:
Not much to see in those partitions beyond what you'd expect

I've attached a screenshot of the relevant portion of devinfo. The remainder is filled with 00.

The devcfg partition is just the

devcfg_X_BOOT_MSM8998_LA1_1_O_82.mbn

file that you can extract from the bootloader SIN but is extended to 131072 bytes (1Mb) by being filled with 00.

EDIT:

I also did a dump of the readable TA units before I unlocked my bootloader:

unit 0x008a2 2210 = "G8441"
unit 0x009af 2479 = protected
unit 0x00a2b 2603 = 0x00
unit 0x1046b 66667 = protected
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
ok, I was wondering about that

00000090 01

in devinfo.img - if it got set to 00 or if there is any other change (I think I've read some post, where there were just 00 apart from that ANDROID magic).

Also this post made me wondering, if devinfo gets some changes with unlock.

It looks like that's not the case.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tramtrist:
Build Number 47.1.A.16.20 currently.

Not 100% sure which region but I think it's UK

I'll PM you the screenshot

---------- Post added at 09:17 AM ---------- Previous post was at 08:46 AM ----------

Also let me know which options you want me to set in flashtool for my downgrade so I don't screw anything up.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5677791]tramtrist[/MENTION], thanks, your screenshot looks good (android attest key present).

Please don't do anything just yet. I will send you detailed info when it's ready.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SilverGamer_YT:
If you can relock the bootloader it will works on the xzp too?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arslancn:
any chance for poplar(G8341)?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7306291]SilverGamer_YT[/MENTION], I do not know (yet) if we can relock the bootloader. I hope to extract TA partition before unlock, then unlock it and try to restore the TA from the backup. Not sure what would happen, if the bootloader gets relocked or not. In any case that information has nothing to do with the possibility if the exploit could work on xzp or not.
[MENTION=7290782]arslancn[/MENTION], I guess if anything else than XZ1c should be supported, it would be XZ1 (G8341).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] xrenoix:
hey [MENTION=4418980]j4nn[/MENTION] good hard work !!! [MENTION=4120742]munjeni[/MENTION] can help you i think !!! look this tread https://xdaforums.com/crossdevice-dev/sony/progress-newflasher-xperia-command-line-t3619426 !!!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hzy1994:
[MENTION=4418980]j4nn[/MENTION] , Thank you very much for your quickly reply, it save me a lot of time, I can get a working console on the Xperia 10 stock kernel with some binary patch and pl011 kernel module now.

After I can got a working console, I modified the kernel symbol offset part in the offsets.c, But the exploit not works, It seems the vulnerability is also not present in Xperia 10 as you said.

PS: I checked that CONFIG_ARM64_UAO is not enabled on Xperia 10 stock kernel, may be there are some other reason make the Xperia 10 not vulnerable.

Thanks for your hints again, I will check the Xperia 10 kernel source code and confirm the CVE-2019-2215 vulnerability first.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Twin.Twiggs:
Hello, first I have a big thanks for you, j4nn. I try to your intruction and pdf guide, step by step. I've unlocked my booloader successfully but

* When I restore TA_Unlocked.img I didnt run

cd /data/local/tmp

dd if=/dev/block/bootdevice/by-name/TA of=TA-unlocked.img

chown shell:shell TA-unlocked.img

sync

sync

(because pdf guide not say that)

So when I typed adb pull /data/local/tmp/TA-unlocked.img , it shows error. But I tried to skip that and type adb push TA-locked.img /data/local/tmp.

2. When I tried to restore again, i had perfomed steps by steps. And when I restored successfully, when I access to Service Info > security to check DRM. its show like that.

But some functions like DSEE HX and Color Gamut working fine. Camera and 960fps mode working, too. But it likes DRM losed.

So can u give me some solution to fix that?

:)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
It doesn't look lost, and the solution you're looking for is in the OP, which links to this - https://xdaforums.com/xperia-xz1-compact/development/rooted-kernel-hiding-bootloader-unlock-t3898711
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Twin.Twiggs:
Thanks. I've got fully DRM. i did in this post https://xdaforums.com/showpost.php?p=79880858&postcount=1029

So can I flash some Q Rom without anybug and when i revert to stock pie drm will be fine?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
Yes, but you'll be flashing the kernel for that ROM don't forget. Restoring the TA partition is a one time process.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Twin.Twiggs:
I have to flash rooted kernel after install custom rom, isn't it? Can I flash rom without flash rooted kernel and TA_Locked and when I revert back to pie stock, I restore TA and flash rooted kernel? Sorry if my English is bad
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
You flash the kernel of whatever ROM you're flashing first. Now you've already restored the TA forget about it.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Twin.Twiggs:
I dont fully understand your solution, but it mean simply after i flash any custom rom, then i flash rooted kernel and dont mind about TA and DRM when i back to stock, is it right?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
NO! The custom ROM has its own kernel. Only flash the rooted kernel when using stock ROM.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Twin.Twiggs:
Yes thanks. Both kernel+TA_locked.img when come stock?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
NO! Just the kernel. You only need to flash the TA one time.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Twin.Twiggs:
Yes. I know. Thanks for your helping
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[XZ2/XZ2c/XZ2p/XZ3] temp root exploit via CVE-2020-0041 [android 10]

Just released a temp root exploit for sony xperia TAMA platform phones with still locked bootloader - see the thread here please.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] anm991:
J4nn's (not tagging him cuz this is probably a **** post) efforts to unbind us from Sony's rules is commendable. I've got my DRM keys on my XZ1 backed up, and waiting patiently for that bootloader exploit that was showed off a little when back.

Thank you for the effort you put in mate!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] ErenHarmandal:
I have successfully done all of them until step 8. But when I'm trying to get temp root again, events count reach over 200.000. I have tried reboot but it didn't work.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9347642]ErenHarmandal[/MENTION], as mentioned in the guide:

As an alternative to renoroot you may use 'bindershell' to get a temp root shell for TA backup - it is available here
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] ValeV008:
Hi,

my xperia XZ1 Compact will come in a couple of days, freshly bought. I am already studying this guide on how to root it. I have 2 questions.

1. Does it matter which Android version I am using (Oreo or Pie)? And if I use Oreo, can I update to Pie after rooting phone with this guide?

2. Step #10 says to flash TWRP, but links to latest post where it says to flash TWRP and also Magisk. This guide is flashing Magisk at step #13, after flashing recent firmware (step #12). I wonder which step sequence is correct? "flash TWRP->flash Magisk->flash recent FW", or flash "TWRP->flash recent FW->flash Magisk"?

I will surely be donating a couple bucks if I will successfully root my XZ1c, I hugely appreciate free help. :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7517292]ValeV008[/MENTION], you need to be on one of the listed oreo firmware version in order to get a temp root shell for TA backup. You can either use renoroot or the new alternate exploit linked in the guide too.

When unlocking, you can do it on pie. It should be ok to even restore the locked TA backup on pie, but it might be safer to restore in on the firmware that was used to back it up. But it has been tested several times to restore the backup on pie, so it's your choice.

As for the twrp I would recommend to flash the latest pie and flash latest twrp for pie and from it flash magisk and the kernel hiding bootloader unlock.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[XZ2/XZ2c/XZ2p/XZ3] implemented magisk setup from temp root

Finally got magisk from temp root working including permission asking feature - released as tama-mroot.zip - get it here
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] ValeV008:
Thank you! So just to make sure, I do: on Oreo -> backup TA -> unlock bootloader -> restore TA -> update from Oreo to Pie -> install TWRP -> install Magisk and Kernel Hiding Bootloader Unlock.

Correct?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7517292]ValeV008[/MENTION], correct. Although there is a rumour that unlocking on latest version possibly removes less drm functions. I cannot confirm that, personally I doubt. But probably nothing to loose if unlocking on the latest pie.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] ValeV008:
So I can do it all on Pie, with one of the supported firmwares? I must say, I don't know much about differences between Android software versions and firmware versions. Are certain firmwares available only on certain Android versions? Are supported firmwares for your renoroot exploit available for Anroid Pie?

Maybe I am asking offtopic questions now ...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7517292]ValeV008[/MENTION], you just back up TA using a listed fw (all oreo only, even in case of the alternate exploit). If wanted to go the rumour route, you would need to upgrade after backup to the latest fw version, which is pie, before doing the actual bootloader unlock.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] ValeV008:
Oh I see, I didn't fully understand your previous comment. I think I will do the more safe way and unlock before upgrading, and will report here when I am done or when I will need some help. :good:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Samir96:
Hi, sorry for off topic

I have BL:No Xperia XZ1 compact SO-02K. Currently on pie. I have several questions to ask before sacrifice my device data to revert back to Oreo.

1. Does anyone successfully obtained permanent magisk using this method?

2. Does anyone successfully enabled Camera2API RAW photography using Magisk Module?

3. Does anyone successfully install Google Camera on Oreo with magisk ?

Any answers are very appreciated. Thanks xda community
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5932767]Samir96[/MENTION], if you have 'bootloader unlock allowed: no', I am afraid you cannot obtain permanent magisk with this temp root method.

There have been somewhere a thread mentioning a paid service that can switch 'bootloader unlock allowed: no' to 'yes' by providing access to some server using a special tool, but not sure which xperia subforum I've seen that and how reliable/proven that service is.

You can however downgrade to 16.20 oreo and use this alternate temp root method, which is very fast and reliable and includes magisk start from the exploit too.

Concerning camera, I am not sure, never tried, but just by noticing some comments in the forum, camera 2 api with raw feature is not supported with xz1 phones. Someone please correct me if I am wrong.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Samir96:
Dark service like that indeed exist my friend jb his iphone untethered from darknet

But i wouldn't dare though :angel:

I does want to stick with oreo and magisk if gcam works but like you say, sony did heavy tweak with their camera api, even linked with bootloader (drm)

I guess I'll have to sit and cry as I'm not brave enough to try those considering how easy is to brick an xperia, and losing my current userdata for nothing :p

Anyway, thanks sir for your reply. Your time is very appreciated :good:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] foresto:
success report with 47.1.A.2.324_R5B

Device: Xperia XZ1 Compact (lilac)

Firmware: G8441_Vipnet HR_1310-5280_47.1.A.2.324_R5B

Attempt 1: reboot

Attempt 2: reboot

Attempt 3: 554 events, 1 overwrite, success

Total time: roughly 15 minutes (from memory; I forgot to check the clock before I started)

Thanks, j4nn!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hertell:
Hi all,

I have tried to read carefully this thread, but obviously i am missing something.

I had to send to warranty repair my own xz1 compact, but got back a new device (my phone had a defect in the screen that showed as an orange spot next to the power button). Now with a factory clean device, i would like to backup the DRM-keys. Running the root-script, I noticed after several hours of the exploit did not work. I then noticed that i had the 5th of August 2017 patch which to my understanding fixed the exploit-possibility for the 47.1.A.2.281 build..

If i got it right, on the first page of this thread there is an other exploit that would work with the August 2017 verision, but i did not understand how i should compie it.. If anyone could shead a bit light in my direction, then i should be able to continue from there :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
The OP is pretty much comprehensive. Re-read until the penny drops.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hertell:
I have read the first post several times, and what i understand, renoroot does NOT work with build 47.1.A.2.281 / patch level 5th of August 2017. In last part of the post is a sourcecode to an other exploit, but i have no clue how i should compile this.. crap :(
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=2180618]hertell[/MENTION], no need to compile anything. Either renoroot or the alternate temp root exploit via CVE-2019-2215 need specific fw version to succeed.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hertell:
[MENTION=4418980]j4nn[/MENTION] So did i get it right: With 47.1.A.2.281 and patch level 5th of august 2017, renoroot does not work? I then need to flash an alternative firmware instead?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=2180618]hertell[/MENTION], both exploits work only with the listed firmware versions.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hertell:
[MENTION=4418980]j4nn[/MENTION] I have the 47.1.A.2.281 firmware with the august 2017 patchlevel. Does this mean that my fw is rootable? Then I have understood completely wrong that the patchlevel would have fixed the exploit...

I have run renoroot for hours with this script without any success... Maybe it should not be run this way?

#!/bin/bash
count=1
while true; do
echo "Round: ${count} $(date +'%d.%m.%Y %H:%M:%S')"
adb shell "cd /data/local/tmp && ./renoroot"
sleep 120
count=$((count + 1))
done
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] theanh201:
[MENTION=4418980]j4nn[/MENTION] the exploit you are woking on is cve 2019-2215 right ? is a kernel exploit so will it work an other phone has exploitable kernel . My phone is a xperia x performance, it has a unlock bootloader allowed no i have try to contact sony but they say they can't help :(
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=2180618]hertell[/MENTION], the 47.1.A.2.281 firmware is listed only with Sony Xperia XZ1 Dual (G8342) - are you running renoroot exactly on this phone?

How many times should I repeat that the exploits run only with the listed fw versions and targets and even in the guide mentioned that it would not run on anything different.
[MENTION=10398297]theanh201[/MENTION], the same answer applies to your question too. Both exploits are tailored only for specific kernel binary images and so cannot work on any other kernel build even if the version number is the same.