yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Robin Banks:
First of all, nice work! And thank you soo much! This is exactly what I needed & I plan 2 donate on payday.

Out of the 7 or 8 times I ran this.. Lowest was 30s and highest was like 10mins (with a couple reboots). I did backup my DRM keys. But, then I realized I didn't need 2 unlock my bootloader. With this temp root, I copied the oem.sin files from the US Xz1c into my Xzp.

I now have fingerprint, VOLTE & WiFi calling (US tmobile) working on my XZP WITH LOCKED BOOTLOADER!!

AFAIK this was never possible on the XZP until you wrote this super code. Updating firmware is also possible by deleting the oem.sin file before flashing. But, I was not successful with pie YET. I did get the dsds_tmobile_ims modem loaded, but I guess the other VOLTE triggering parts are different. If the US pie update for the Xz1c ever gets released.. I will just use those oem.sin files in my pie.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tj2806:
twrp-3.2.3-0-lilac-pie-2.img

androidfilehost.com/?w=files&flid=286272

Yes, I tried USA oem file and was unable to get volte working on Pie as well. Also waiting for USA Pie release...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] cyylove:
I am sorry about that.（already edit）

I just looking for android 6.0 root tools.

Thank you.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kountry83:
Hey bud,

If you want volte and wifi calling on Pie could you possibly place the files in the correct directory in this zip file with temp root and set permissions? If so let me know how it goes.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
n

For 6.0? This is for Oreo (8.1) and for a very specific phone, so this is the wrong place.

What phone do you have? Perhaps you should start by going to the forum for it, instead.

Note that this is the XZ1 Compact. If, by chance, you have the Z1 Compact, that's in a different area.

I'm not sure offhand what the exploits for 6.0 were, but I know that they existed and were easier.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] schnurzelat:
Hi,

i have two XZ1s with the required Firmware (never upgraded since 2017, G8341_Customized DE_1310-4290_47.1.A.2.324_R9B) and patchlevel August 2017. Is there anything i can do, exept of a factory reset, to get renoroot working? I got reboots and over 140000 Events with 10 Overwrites without a root shell.

i tried "am kill-all". But that doesn't seem to help.

Any suggestions?

Thanks!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
Have you tried putting the phone in airplane mode, screen always on, and doing a fresh reboot of the phone?

You could also try disabling as many of your apps as you feel comfortable doing (I'd suggest Safe Mode, but then RenoTrap won't run). The problem is that the more that's happening on the phone, the less predictable it becomes.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=655778]schnurzelat[/MENTION], factory reset could actually help particularly if you did not need to downgrade having many apps installed on the phone.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Robin Banks:
That zip you posted contains the oem.sin folder from the US XZ1c firmware. That's what I am using now & it works great on Oreo. The only change I had 2 make was the text in modem.conf file that's in the modem-config/408 folder. Mine is dual sim so I had 2 change it from "tmobile_us_ims" to "dsds_tmobile_us_ims" then I copied it with temp root & set permissions. I also tried this on Pie but it would not change to the "408" overlay. I even tried forcing it 2 load the modem.conf file by copying it into the root dir of modem-config folder.

This actually loaded the modem in Pie, but still didn't trigger VOLTE settings. What MIGHT work is the Pie oem.sin files from the US XZ3. I downloaded that firmware & realized it also contains the US tmobile 408 overlay folders. But the modem-conf/408 folder structure is different & has multiple folders in it. And they all point 2 a totally diffent modem. I think if I copied my working modem.conf into all those folders in Xz3 oem/modem-config/408 & then temp rooted again, set permissions, then flashed Pie WITHOUT oem.sin file.. It might actually work. But this is time consuming for me 2 test. It would be much easier for someone with an unlocked bootloader 2 simply test this with TWRP.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arslancn:
I fix volte and wifi calling on my XZ1 with this steps.

-flash twrp, make a full wipe(system,data,dalvik,cache) and format data and reboot recovery

-flash m rom from this link and reboot

-after boot, go flash mode and flash .306 firmware from newflasher and boot your phone

-after boot, setup your phone and it will work

edit: also you guys can try this :

1)extract oem folder from m rom(and delete including ''deletable-app'' folder inside)

2)download this and delete oem folder inside the zip and change with extracted from m rom and flash
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] styr:
Hello,

will this work on XZ1 Compact with Android 9.0 - 47.2.A.2.33?

L.E. Seems to be working.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kountry83:
Hey bud,

This is what [MENTION=3944073]raven213[/MENTION] did with his Sony Xperia xz premium G8142 with unlocked bootloader and rooted did to get the file I posted working on pie.

flashed TMo-VoLTE-Fix-v3 after rebooting i had to go to oem/modem-config and edit modem.conf from "tmobile_us_ims" to dsds_tmobile_us_im" after that i went to system/etc/customization/modem and deleted amss_fsg_maple_dsds_tar.mbn and restarted the phone and it worked
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
In this case I'm happy :

In Pie I can add a Sip Provider once again... In Orego only Voice over WLAN was available.... So I can add a Sip Provider of my choice and can make calls from other countries via Wlan or Mobilinternet.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Robin Banks:
That's the same files I used.. I was able 2 get dsds_tmoble_us_im modem loaded in Pie.. But, I couldn't get "408" customization to load. So the VoLte switch was grayed out. XZ1c US pie should be out soon. That should contain the easy fix
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] schnurzelat:
Finally i got a root shell to backup my ta partition! I needed a lot of patience, turn on the flight mode and remove the sim card. I had many reboots without a root shell.

Now i tried to copy /system/sh to the oem partition. if i call /oem/sh i got the '#', but that's seems not to be root shell. I can't cat the /system/build.prop and couldn't start dmesg.

1|G8341:/data/local/tmp $ ls -lZ /oem/sh
ls -lZ /oem/sh
-rwsr-sr-x 1 root root u:object_r:oemfs:s0 298840 2018-12-14 10:49 /oem/sh
G8341:/data/local/tmp $ /oem/sh
/oem/sh
# dmesg
dmesg
dmesg: /dev/kmsg: Permission denied
# cat /system/build.prop
cat /system/build.prop
cat: /system/build.prop: Permission denied
# id
id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1026(drmrpc),1028(sdcard_r),2993(trimarea),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0
#

But thanks anyway! Now to the second XZ1......
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=655778]schnurzelat[/MENTION], that post with su copied to /oem and making it suid binary was just an idea for developers' discussion about possibilities for further exploiting to convert the temporal root into a persistent one without unlocking bootloader. But that post contained very important (not solved) note/question, what to do about selinux security context.

The suid sh binary in /oem is persistent root shell from linux without selinux point of view (as you can check it switches to root user indicated by # even after rebooting the phone), but it is still limited by selinux.

So this is just for experimentation / further development possibilities, it is not part of the howto, it would be in the OP otherwise.

You need to use the shell provided by renoroot for TA backup or dmesg or anything you like to do with full fledged root.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sepzs:
Big thanks! Installed Pie 47.2.A.2.33 Customized CH, Magisk 18.0 and secd_ignore_unlock_XZ1_Compact_Android_9.0_47.2.A.0.306.zip. In that order.

Safety net pass

Video enhancement works

Suntory blobs [READY]

CKB LIVE OK [ACTIVE]

WINEVINE LIVE OK [ACTIVE]

SOMC FIDO Key PROVISIONED, ver. 4

Android Attest Key PROVISIONED

So all seems like normal? Sent a donation.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Does we have in the meantime a solution for secd_ignore_unlock_XZ1_Compact_Android_9.0_47.2

in combination with a Sony xperia premium Xz?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7055162]mad0701[/MENTION],

android-attest-key-lost thread post#67
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] oppenbot:
I just received my new XZ1 compact (fw 47.1.A.12.179, cda 1310-7123). For the moment, I don't want to use any non-stock ROM like LineageOS yet, but seeing this fantastic work here, I thought it might be a good idea to back up my drm keys before really using the device.

Since this is all new to me and I don't want to make any silly mistake: Would performing only steps 1 to 6 from the guide in the first post be the way to go then? Not unlocking the bootloader should mean that nothing important will be lost or changed in a way that could not be reverted, right? :)

After backing up the TA partition that contains the keys, I would then flash the newest stock firmware (currently 47.1.A.16.20) for my region.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
That was also my intension : Let the the phone on stock, but rooted for things like Adaway, Titanium Backup, use the SD card so as I want (in some apk I can not change the DL directory to the SD card without root (I can compare this one with the phone from my wife (still on stock)) and so on....

If you have downgrade the phone and try to received temporary root to save your TA partition nothing is lost. Don't worry. On one hint from my side: Ensure in front, that all (really all) driver which you need are on the PC.

Then you can concentrate your work only on the phone without any heartattacks in the case that a driver is missing or doesn't work as expected ;)

[MENTION=4418980]j4nn[/MENTION]

Thanks a lot.!

This thread wasn'tin my focus...

It's working :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
[MENTION=7055162]mad0701[/MENTION]: You're suggesting something different from what [MENTION=8643297]oppenbot[/MENTION] is asking. In order to root, you have to unlock the bootloader. By doing that, you've made an irreversible change. (Permanently) rooted stock is still modified.

[MENTION=8643297]oppenbot[/MENTION]: you are correct in your understanding. Temp-rooting and backing up the DRM keys will not affect anything in the system: no keys will be lost, nothing irreversible changed (be sure not to flash any of the .ta files or persist.sin!). Making the backup now (for later, just in case) is a great idea, and then you're free to do what you want later. There's a teeny chance that unlocking and then flashing the TA taken from a different ROM image might mess something, but it's mostly in the "there's a remote possibility, and we're not completely certain" category. I haven't heard of anything, and I've personally flashed the TA from twrp without incident. So the upgrade to 47.1.A.16.20 (or even PIE) and then an unlock later should be fine as well. Happy exploiting!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] oppenbot:
Thanks for clarifying that. ;)

Is that a general advice when flashing or does it only matter in the special case of down-grading? And what about the "Lilac_XBootConfig_MiscTA.ta" in the boot folder, do I need to delete that as well?

I just found a long discussion about flashing or not flashing .ta files in the Newflasher thread - without any real conclusion. On the other hand, j4nn's guide in the first post says:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Yokurt815:
Hi oppenbot,

I'm waiting for my XZ1 compact and have the same in mind.

As I undestand it's a good idea and with the temp root and backup you don't loose anything.

But as j4nn mentions in the opening thread, you might loose the Android Attest key while downgrading. But as far as I read in the other thread, that's not really affecting anything (at the moment).

That is a general advice, as TA partition contains YOUR device specifiv keys.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Please see [MENTION=4120742]munjeni[/MENTION]'s newflasher source on github newflasher.c:2076, there is following big IF clause, skipping certain TA units:

if (memcmp(unit, "000008B2", 8) == 0 || /* unlock key */
memcmp(unit, "000007D3", 8) == 0 || /* hardware config */
memcmp(unit, "000007DA", 8) == 0 || /* simlock */
memcmp(unit, "00000851", 8) == 0 || /* simlock signature */
memcmp(unit, "000008A2", 8) == 0 || /* device name */
memcmp(unit, "00001324", 8) == 0 || /* device id */
memcmp(unit, "0001046B", 8) == 0) { /* drm key */
printf(" - Skipping unit %X\n", unit_dec);
continue;
}

So checking .ta files from 47.1.A.8.49 fw for example, keeping or deleting simlock.ta (000007DA) would make no difference - newflasher just skips it.

The unit 0x0001046B (i.e. 66667) - device master key - which we are restoring with TA restore after bootloader unlock - cannot be flashed at all even with already unlocked device (not even with patched newflasher with the above check-skip removed).

This we have tested with [MENTION=5677791]tramtrist[/MENTION] creating a devkey.ta file with the key from locked TA backup - flashing it is denied even by unlocked phone (so that check above may not even be necessary).

I am not sure about the other .ta files, but just guessing from their file names: master-reset.ta would probably cause a factory reset, so you may skip it or use it as a last resort to get out of a boot loop for example.

The rest like auto-boot.ta, cust-reset.ta, fota-reset.ta, osv-restriction.ta, reset-kernel-cmd-debug.ta, reset-non-secure-adb.ta, reset-wipe-reason.ta - they have a hint in them, mostly look like resetting some runtime flags, probably not that important - maybe except cust-reset.ta, which in my opinion is supposed to be used when you switch customization.

The .ta in boot looks like configuring boot sequence/boot device after flashing bootloader - but that is most likely already set, so skipping it or flashing the already set value probably makes no difference.

Please note, all this are just my personal guesses - I do not know it.

Just skip flashing persist.sin as that removes the Android Attest Key for sure.

But if you unlock, even having untouched persist partition with Android Attest Key does not provide any benefit, because that key can only be used with locked bootloader to verify that state from Trust Zone. Having the key with unlocked bootloader might possibly be used to prove your phone is _unlocked_ (this state in Trust Zone cannot be faked no matter what), so that is not very useful, is it?!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
I've flashed the update after unlook the BL so as described in the manual...

Delete all *. ta in the directory... but leave the TA in the boot subfolder. Delete the persist file... after that I start the flash process... Yes, I've restore the TA. image.. Yes I lost??? never seen any keys as SOMC Keys (the phone was original on Pie with a telekom image) the Android Attest Key.. once repea.. I've not see the key as valid key on my phone... Yes... all things are working on Pie, except the x-... Screen... after flash the patch also the x-screen is working... In this moment I didn't see any gaps... The risk of all just be clear... after recognize what could be happen... make or leave it...

Root.. for my person... give me the possibility to change things as I want.. which are not available without root.. and this in a StockFW... (so like as in older version of Android)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
There is a reason to grab screenshorts throughout all the process - having them allows to check what keys were available in each step. The screenshots are particularly important before unlock. Checking security screen of still locked device within exploitable oreo firmware would reveal what was available before unlock...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] ParkourPaul:
I have successfully backed up and restored .ta. OTA never came on downgraded FW so I updated to Pie manually. Suntory blobs error, SOMC FIDO not provisioned, WIDEVINE OK, Android attest key provisioned. Magisk and TWRP installed, safetynet passed, root active. Image enhancement not working.

[MENTION=4418980]j4nn[/MENTION], thanks again for this, I've sent you some beer money. Please let us know if/when we can restore image enhancement with Pie.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Flash the patch for Secd via TWRP ND all things are ok
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Gaaat:
[MENTION=4418980]j4nn[/MENTION] sorry for the possible OT but recently an update came out, do you know how I can update without losing root/provisioned keys/video image enhancement (and if possible without wiping userdata)?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Premium Unleaded:
I have a serious problem.

Followed the OP instructions to downgrade (via 47.1.A.2.324_CE1), backup TA, BL unlock, restore TA, install TWRP, flash Magisk & secd-ignore-unlock. No issues, all DRM keys still active/provisioned and camera bueno.

However, when I tried to update it to the more recent firmware for my region (47.1.A.16.20_R18B; Customized UK), it looks like the TA-partition got deleted, because all of the Suntory blobs have disappeared, both SOMC FIDO/Attest Keys are NOT PROVISIONED & my camera is completely borked now. It literally soft-crashes when I try to take a photo, freezing itself in the 'focus mode' and the only way to get out of it is through the home key or using the task manager key - the back key is non-responsive. Flashing secd-ignore-unlock after having done the update to 47.1.A.16.20 does nothing to resolve the issue. I've also tried to restore the TA-partition via "adb shell su" and my TA-locked.img backup, but it doesn't make any difference - Suntory blobs & both SOMC Keys gone, camera function still literally broken.

The method I used to flash the most recent 47.1.A.16.20 firmware is exactly the same as what I did to downgrade:

1. Prep firmware by deleting all *.ta files in main dir & boot dir, delete the persist-*.sin file.

2. Copy all of newflasher_v13's contents into the firmware main dir.

3. Turn off phone, then connect to PC in flash-mode (vol- & plug in usb).

4. Run newflasher, n for both steps.

Please help.

I've read on here that people have updated to this exact 47.1.A.16.20 firmware no problem, DRM keys all in check and camera working fine. Where have I messed up?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
The TA image looks different also on my side:

before unlook, after unlook and after restore the original TA, upgrade and run the phone. (Checked with a hex editor)

I haven't deleted the TA file in the partion folder.

I have only deleted the TA in the main folder and the persist file. After that I start to flash newflasher.

After upgrade I must make a factory reset and reflash once again because the phone was in a boot loop (long press Volume up and Power over 6 second; the phone vibrate several times) The first update was also a step in between to the latest 8.1. After that I upgrade to Pie (incl restore the TA) All keys are lost too, but camera was working and so on - I didn't found any negative effects. . Only the x enhanced wasn't working.. The Secd patch file has solved the issue.

btw: I'm also interested in the answer 2post above : if I want upgrade to a higher version in pie: which files should be flashed, which files not? Can I use the. 33 Secd file or does we need a new one?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] vofferz:
I used the TA backup and restore tools by [MENTION=4418980]j4nn[/MENTION] (Thank you!), updated to Pie with newflasher by flashing all but persist.sin and .ta-files. This of course resets data, but I had a new, empty phone anyway. Then I flashed magisk v18 and the secd patch for Pie. Everything works, all keys show provisioned and blobs ready.

Then I updated to the newest Pie version (customized ch) two days ago, after I got an OTA notification (didn't bother to try the OTA as it probably won't work anyway) by flashing all but persist, userdata, cache and .ta-files. The same secd patch worked fine. All settings, apps and data intact, everything works great. Magisk and secd patch have to be reflashed.

---------- Post added at 02:17 PM ---------- Previous post was at 01:47 PM ----------

The following contains a little bit repetition from previous post but starts at the beginning of the procedure:

My phone came with the latest Oreo (Nordic) so I had to downgrade for the renoroot tools to work. I followed the first post instructions and everything went smooth. First time it took about ~15 minutes to get temp root and phone rebooted once in process. Backed up TA partition, unlocked bootloader, checked that all keys except Android attest were not provisioned and DRM keys gone. Then I used renoroot again - this time it took over 30 mins to get temp root and I had to try several times because the phone booted a few times. Eventually renoroot did it's magic and got temp root again. Restored TA partition, rebooted and checked that DRM keys were back but SOMC keys not provisioned and suntory blobs error.

Then I updated to Pie (Customized CH) without flashing persist.sin and .ta files, flashed magisk v18 and secd patch. Everything worked, all keys provisioned and suntory blobs ready. After a few days I got a new Pie update notification. Decided not to try the OTA as it probably woudn't work anyway and downloaded the new firmware with Xperifirm. Deleted persist*.sin, userdata*.sin, cache*.sin and all .ta files and flashed with newflasher. After that I reflashed magisk and the same secd patch zip as before. Everything still works, data, apps and settings from previous Pie version remain and all keys show provisioned, DRM and suntory blobs ok.

Only thing is that Play store settings / Play Protect certification says "Device is not certified" but I don't know what it means or if it affects anything. Safetynet passes, banking apps work fine with magiskhide and I can find and install Netflix etc. from Play Store.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Does you've try to delete the cache and Dalvik to solve the Google Play store? You can also try to delete the cache from the app Google Services by himself
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] vofferz:
At least clearing cache from play store app didn't change anything. But anyway, I don't see any problems even though google play store tells that device is not certified. Somewhere it said that it might cause you not to be able to install google software, but I don't have any problems with that either. And I uninstalled most of the google apps that came bundled anyway as I don't need them...

Edit: SOLVED. I put my device id here: https://www.google.com/android/uncertified/ and cleared play store cache and data. Now it says that the device is certified.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
My guess is that you are using bootloader from different fw version - I got exactly that behaviour when I tried to test bootloaders compatibility with different firmwares.

Double check you have 'boot' subdirectory present with .sin files in it when you flash a fw with newflasher. That could resolve it. If not, try to do a factory reset.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tramtrist:
Seems I lost my FIDO keys with the pie upgrade