yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] ecksdeeay:
success:svetius:

Many tries (may have been down to the fingerprint key popup not showing before going ahead with this step and/or not knowing where the allow Unknown app install option was changed USB port and all was fine) and button pressing it finally booted the unlock-hide with keys restored and camera back to it's best.

8.24 France fw so shall either wait for latest or find a more suitable 10.24 10.28 fw.

Thanks [MENTION=4418980]j4nn[/MENTION] a small token of gratitude on it's way:svetius:

Edit; shall post screenshots in a short while.

I've installed magisk and lost the camera enhancement and some changes in the security keys or was that just because I've rebooted without fastboot? I've been stuck in MM for too long and it's like a new system.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] khanhesham:
[MENTION=4418980]j4nn[/MENTION] any trick to relock yoshino bootloader ?

i had xperia xz back in 2017 and when we restored the TA the BL would automatically got locked without any extra command.

i used drmfixed BL unlocked XZs for a year but nevermind i relocked the BL with flashtool

but XZP is such a pain to relock BL ?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=8231331]OmaeKumiko[/MENTION], ad 1. - that is normal, xzp never had Android Attest Key, with pie all xzp/xz1/xz1c phones no more list SOMC Attest Key.

ad 2. just continue with the guide - why did you stop with step 9.? Follow links in step 10. and use the kernel hiding bootloader unlock.

[MENTION=4800473]ecksdeeay[/MENTION], if you do not like always booting the BL hiding kernel from usb, you need to flash the bootloader unlock hiding kernel following the Alternate usage part of the guide.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=6250451]khanhesham[/MENTION], relocking bootloader is not possible with yoshino platform, not even with user-supplied signing keys for Verified Boot (that I've hoped for too) - see answers from sony representatives here on their oss kernel github:

https://github.com/sonyxperiadev/kernel/issues/1838#issuecomment-444004080

Bootloader lock/unlock status is not stored in TA, like it had been with previous xperia generations.

Security is greatly improved with recent android platforms having verified boot protected in hardware, with a supervisor OS running in Trust Zone, that even android kernel cannot reach.

Bootloader unlock/lock state is most likely represented by a chipset fuse not reachable from any software except bootloader itself, which needs sony signed control message to accept any request.

On the other hand, it is a positive thing that with locked TA restore, we can restore DRM keys and keep the bootloader unlocked to allow rooting of android.

So running unmodified stock firmware with root _and_ full TA restored including drm keys is possible without a need to inject dynamic libs to load drm key backed up into alternate TA unit like it was with some previous xperia phones.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
I've repacked kernels hiding bootloader unlock from version 10.28 for stock pie firmware version 10.45, uploaded on androidfilehost into my experimental folder for those not patient enough to wait until sony releases source package for the 10.45 version - see here please:

boot-G8441-47.2.A.10.45-hideunlock-rooted-kernel-10.28.img

boot-G8341-47.2.A.10.45-hideunlock-rooted-kernel-10.28.img

boot-G8342-47.2.A.10.45-hideunlock-rooted-kernel-10.28.img

boot-G8141-47.2.A.10.45-hideunlock-rooted-kernel-10.28.img

boot-G8142-47.2.A.10.45-hideunlock-rooted-kernel-10.28.img
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SunJu22:
Thank you a lot j4nn. I followed the procedure yesterday night and it worked flawlessly!

Both times, root granted in less than 2.5mn.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] alagga:
Working on XZP (G8141)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] OmaeKumiko:
Thank you very much for your help.

I got some more question,

1. In case xzp never had Android Attest Key, is it still necessary to remove "persist_X-FLASH-ALL-42E5.sin" for every time flash a stock firmware?

2. After I restore TA on temp root exploit firmware, If I want to flash a recent stock firmware, need I remove some files in Firmware folds? Or just flash it, without doing anything?

3. In other words, is TA not affected when flash a stock firmware?

I have read this thread [XZp] rooted kernel hiding bootloader unlock with working fota,

in step 3 you didn't mention remove some files in firmware or not, but I am really afraid of doing wrong thing irreversible...:eek:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=8231331]OmaeKumiko[/MENTION], in case of xzp, flashing persist might not have any visible influence. I would still avoid it - see here for more details.

Flashing anything from fw components would not remove any key stored in TA - that partition is not flashed.

But there may be other data you would be re-setting while it may not be necessary, like for example Qnovo containing some info about charging, when flashed, that stats would be erased.

No big deal but no benefit either.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
Thank you very much! It's hard to be patient when the update reminder is all over your face. The 'Please update message' popped up in front of a video I was showing the larger family via casting to a Chromecast which was really annoying since there is no 'remind me later' button in that pop-up. I had to choose the show me the update details button and only after that could return to the video.

In short: Is there an option to retain all the benefits of your kernel, but only to disable the update notification message and the pop-up reminder?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] OmaeKumiko:
Hello, thanks for your help, flash stock pie firmware via newflasher, the X-reality/ Video enhanced mode/X-enhanced ( I don't know which it is called in English FW……) still works very well.

And sorry for bother you again. :eek:

I tried fastboot flash boot-hideunlock-rooted.img after flash a unofficial rom via TWRP, my xzp just keep rebooting and rebooting, it seems like this kernel just work for stock firmware, though it's very reasonable……

I noticed that magisk can disable verity, but it seems that I should flash a stock FW untouched first……

I found one way might solve: secd_ignore_unlock_XZP_Android_9.0_47.2.A.2.33.zip, but for newest customized rom it's not work.

I know stock firmware and boot-hideunlock-rooted.img works very well, but I have some personally reason:

I am a Chinese user, and some features like VoLTE for Chinese telecommunications, is only on Chinese stock FW.

But Chinese FW are incomplete like lack of Gapps, more than that, the localization of it is very bad, too.

So a unofficial customized ROM is really good to use, even if I use a stock firmware, there still have very lots of things to modify, I should still lose FOTA.

So how could I do to make X-reality/ Video enhanced mode/X-enhanced works again on a modified ROM? :eek:

Seems patched boot.img in modified ROM or create a secd_ignore_unlock.zip for newer firmware both work, but I don't know how to do that cause I am just a new hand= =

I was totally wrong, secd_ignore_unlock_XZP_Android_9.0_47.2.A.2.33.zip works well on newer stock firmware based ROMs:eek:

( BTW, I have a struggle with TWRP, I thought TWRP on their official site will work well, but TWRP for XZP can not installed via fastboot, after flashed that, when I tried to swipe to factory reset, It always shows failed to mount /data, I was very confused where I did wrong. Until I flashed a customized TWRP found on a chinese BBS, I know it's TWRP's reason :silly:)

Thanks for your help and respect for your Efforts and results on Xperia development. ( I hope there do not exist grammar mistakes and it cost me a long time to write this reply:eek:)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] lilbrat:
You could delete the Sony update apk or freeze it with Titanium backup as i can't remember if it can be disabled.. But the only Sony apps on my phone are the basically the camera and album.. So I don't really worry about them and Sony sends me an email when there is a system update..
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hihiman1:
HI,

sorry for that noob question (I will get my XZ1 next week) - are the firmware files (*.rar) linked in post #1 somehow modified?

If the try to rename the rar file to *.ftf flashtool does not recognise the . I was wondering if the downgrade is also possible using flashtool.

Thanks in advance

HiHiMan
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Klaus N.:
1. You may not rename file from .rar to .ftf, you have to unpack it, e.g. with WinRAR or 7zip.

2. Don't use FlashTool for flashing. Use [MENTION=4120742]munjeni[/MENTION]'s newflasher - as described in the op.

And please, read the op very carefully and follow each step exactly -

everything

there is very important!!!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hihiman1:
Thank you! I tried to unpack the rar file with winrar. Due to whatever reason the file seems to be damaged. This was the reason I renamed it to ftf.

Yes, meanwhile I read that flashtool can not be used for sony generation 2017+

HiHiMan

EDIT: Also 7zip can't help. Unfortunately the rar-archive is apparently really damaged. I downloaded it three times... :(

EDIT2: works with the latest Version of 7zip portable :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] LaMotta82:
Possibility for root with locked bootloader?

Hi [MENTION=4418980]j4nn[/MENTION] (and other experts here)!

What do You think...

Could be happened in the future that we can have a root with locked bootloader?

I would be so happy If I would have not modified phone but with a rooted Oreo without any additional customizations like Magisk.

Next to that... I do not understand well how these programming working so it's a silly question...

Why we cannot do that if there is a rooted phone with unlocked bootloader and creating an image about the necessary parts of the phone and just pushing that with Newflasher to a locked bootloader phone?

Thanks!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Let try me to explain :

If the BL is locked, the BL accept only signed Software for flashing.

For the correct signature and check if the signature is valid, you need the privat and public key for encryption and decryption.

What does it's means?

If you are not owned the privat key from - in our case - Sony, you have not the possibility to passed the check from the BL. The BL checked the Firmware with the public sign. It is not enough to know the public key. This one is only for verification

The signature is generated with the private key.

An unlooked BL means, that the BL accept also unsigned or Software which has no signature.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Klaus N.:
Maybe the downloaded file is corrupt; have you already tried to download it again?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
I am not sure, but does the notification happen even if you set "Auto download system updates" to Off?

Maybe together with switching off the "Automatic system updates" in Developer options?

There may be few other similar options also in the google account settings of the google play store app.

[MENTION=8231331]OmaeKumiko[/MENTION], using secd ignore patch may satisfy your needs, but in my opinion, it is not fully masking the unlocked state of the bootloader to all components of a firmware.

If you are using stock based rom, I would assume stock kernel works, so even the patched kernel to hide bootloader unlock has to work - it is a pure stock with only a single patch to hide bootloader unlock.

The problem seems to be the modifications of stock rom that makes it "custom rom stock based" - you need to follow the "alternate use" of the kernel, disabling dm-verity in it and after that it will work in my opinion.

[MENTION=5009680]LaMotta82[/MENTION], we have "root" with locked bootloader - it is the temproot provided by my renoroot tools/exploit - running them in exploitable firmware will provide you adb shell with root user and disabled selinux, allowing you to backup locked state TA or do any other task.

Obviously it is not a user friendly "root" most supersu/magisk users might be used to use. It is simply an all mighty shell.

And as explained above, due to verified boot, you cannot make persistent changes while having bootloader locked (or precisely speaking you may do a persistent change from temproot, but it would result with bootloop most likely as verified boot / dm-verity would fail).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
I disabled both options/settings but got the permanent update reminder nevertheless.

Disabling/freezing the Sony Update APK sounds like a good idea! :good:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Evilmeisters:
I have some questions:

1. Renoroot give us temporary root? Need to still connected with PC or not?

2. I have lost "Android Attest Key" due flash, to change region, does it really matter?

3. I patched ftf Custom_FR (my phone originaly with SG firmware) used flashtool 9.25... To flash, i flash all *.TA files. Does it count as not original TA, ... Or something. (I'm still with locked BL, all fuctions working).

Now i need to backup ta, ULBL, root or install custom firmware.

Sorry for my bad English, thankyou!!!!!!!!!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9311692]Evilmeisters[/MENTION], renoroot is to be started from adb shell, i.e. connected to pc via usb cable. After it gives you a temproot shell, it may be possible to disconnect from pc and obtain another temproot shell by running ./renoshell until a reboot, if it had been a lucky trial with just one overwrite, so the system is not in unstable condition. Restart of adb server in the phone (caused for example via switching of usb access type when reconnecting to pc) results in most cases in reboot after renoroot. It may be possible to run ./renoshell from a terminal app directly on the phone without pc connection (after renoroot), but I am not sure how much that could be useful.

Android Attest Key - as mentioned many times already, not useful at all after unlock. Just read about it here or in the "Android Attest Key lost" thread.

Concerning 3), I guess it most likely does not matter - assuming flashtool skips dangerous .ta files - but I do not know, using only newflasher.

If you have your bootloader still locked, your TA would contain the device master key, which is the thing we backup here with the TA backup.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Updated the howto adding new supported target: Sony Xperia XZ Premium (G8188)

this Japan version can be flashed with fw for G8141 making it exploitable as standard XZp (tested by [MENTION=5637626]zatsune[/MENTION] as documented here) - thank you for discovering this cross flashing possibility.

This confirms there might be a possibility of TA backup for few other yoshino platform phone models that are possible to flash with one of the already supported firmwares (that boot ok even though designed for other phone variant).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] pattriccio:
any video totorials about this steps? many will apreciate it.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] khanhesham:
[MENTION=4418980]j4nn[/MENTION] open source archive for 47.2.A.10.45 are up so please make the drm fixed kernel for xzp and others if possible :D
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Updated post#2 in xzp/xz1/xz1c variants of "rooted kernel hiding bootloader unlock with working fota" threads: added hideunlock rooted kernels for 47.2.A.10.45 fw.

Sources available here on my github (my-bluhide/47.2.A.10.45 branch).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] alagga:
I've made a beginners guide for Rooting + Installing Recovery + Updating via OTA (using [MENTION=4418980]j4nn[/MENTION]'s hideunlock-kernel) after following this Tutorial for backing up & Restoring DRM.

I hope it can be useful for someone.

Here's the updated v2.

I'll add a short introduction to Magisk Modules and additional Screenshots to the steps in a later stage.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4976984]alagga[/MENTION], thanks for the tutorial, just few comments if I may:

- the red important note - it is not complete - not only stock vendor and system is needed, but stock recovery and kernel (i.e. boot partition) are needed too, that is why it is good to backup if wanted to flash over them to be able to restore them before starting fota

- the links like "here" in the pdf are not clickable (at least not with my pdf viewer)

- if your steps were followed, 'fastboot boot boot-G8XXX-...' command would not work (you are missing reboot by a command into fastboot)

- similarly in "Flashing stock boot + stock recovery" paragraph, the 'fastboot boot boot boot-yourdev...', but in addition, 'boot' is there twice incorrectly

- 'Updating (OTA)' starting with 'Power on'? that should start already via previous 'fastboot boot ...' command

It would be great (as you have that experience) if you could extend the guide to show also usage of 'systemless' magisk feature to avoid modifications of system and vendor partitions, possibly even including a howto for creating your own magisk systemless modules, showing that
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] p0ss7x:
Why can't I install the tool in steps 3 and 4?

I use adb but it doesn't work for anyone who can give me permission to work on a laptop with video so I have to use google to translate it a little hard to understand I'm having backup for my xz premium dua

install the tools

Unzip renoroot.zip (download it bellow). Use following adb commands to get the tools to the phone:

Code:

adb push renoroot /data/local/tmp

adb push renoshell /data/local/tmp

adb push renosploit /data/local/tmp

adb install -r renotrap.apk

start the tools to get a temp root shell

Use adb shell to get a command line terminal to the phone and use following commands:

Code:

cd /data/local/tmp

chmod 755 reno*

./renoroot

The last command above will start the exploit eventually resulting with a temp root shell (that should be indicated by # char before the cursor).

It may get the phone to reboot in case an overwrite does not hit the wanted shaped heap object.

You may wait few minutes after the phone boots to allow startup processes to settle down in order to avoid timing influence for next trial.

There is a video for example of this step available here.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] alagga:
1. My guide includes backup & restore of the boot & recovery partition, so I didn't mention it to not confuse anybody.

2. I'll check the links, I wrote it in Word, could be a problem with exporting to pdf.

3. I thought this is only needed in Step 3 in the step "Updating (OTA)". Atleast I never did a fastboot reboot bootloader in any other steps. Is it really needed in the other steps too?

4. Will be changed

5. In my experience fastboot boot just boots the device up to the offline battery charging symbol. I had to power it on from there manually.

Could it be that this is caused by not doing the fastboot reboot bootloader?(The same as the point 3 you mentioned?)

And I'll add a short Tutorial for creating Magisk Modules in the future (though i think this is too complicated for "beginners", I'll give references for anyone who's interested)

I'll upload the updated guide when we cleared everything :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5785072]p0ss7x[/MENTION], just follow the guide closely. Be sure you have adb working properly (you may need some driver installed).

[MENTION=4976984]alagga[/MENTION], you always need 'fastboot reboot bootloader' or 'adb reboot bootloader' before use of 'fastboot boot some.img' otherwise you end up booted into charging mode as you've experienced.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] alagga:
But from within charging mode you can just power-on the device and you boot the fastbooted some.img.

But I'll add the command anyway, thanks :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4976984]alagga[/MENTION], interesting, I guess this depends on the kernel itself, if such thing is supported (charging mode and normal boot from it via power on button), while booting directly after rebooting into fastboot is universal.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] modpunk:
Hi j4nn.

derf elot and I are currently working on LineageOS 16.0 we recognized that you don't need any workarounds for the camera, it just works. Looks like they simply allow to use the camera on rooted/unlocked phones now ...

If that will change we can always use the working blobs ;)

However have you diff'ed a locked and unlocked TA to see what exectly is removed and where? Are the removed keys always the same or differ they from device to device. Could we write them back in flasher mode?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] _Pano_:
does this procedure breaks warranty? thanks
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] YasuHamed:
FLASHED G8342_47.1.A.2.281_CE1 VIA "NEWFLASHER"

ran the RenoRoot

in 10 mins

i was done

works like a charm
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Hi [MENTION=4297219]modpunk[/MENTION],

with unlock, the ta unit 66667 (0x1046b) is removed. I believe it is a device master key.

If we restore TA-locked.img, the ta unit 66667 is restored too, but bootloader is not relocked, so that is good for us, no need to move that TA unit somewhere else and no need to inject special libs to load that unit from elsewhere. In fact it seems to me that the TA unit 66667 is not used in userspace at all - did not find any code loading it in oreo binaries. If not missed it somewhere, I would guess the device master key is used from bootloader when initializing trustzone or by the trustzone itself. Possibly to decrypt some other keys or provide some TZ api function?

There is some info also posted here.

It is not possible to flash only the ta unit 66667 with specially prepared TA file (and patched newflasher not to skip it) - it is refused to flash even with unlocked bootloader.

There are also some doubts about camera quality to be the same on pie after unlock vs still locked oreo - please see the the discussion since post#25 in the "[XZp] rooted kernel hiding bootloader unlock with working fota" thread. Some even tried to post comparison photos.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] modpunk:
So the key differs from device to device or is it the same?

If the key is always the same, we could create a TA backup modify it and flash it back.

If this is the case we either need a way to write back the key or I have to update the TA extension for Pie.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4297219]modpunk[/MENTION], device master key is device specific.

Do you have a method to change something in TA image with possibility to flash it and still boot?

There are checksums or whatever so simple changing TA image results with a hard brick - tried to change a single byte in dev master key to make it invalid and got a not recoverable hard brick!
[MENTION=4688377]russel5[/MENTION] also tried some changes in TA partition and if not mistaken, lost his phone too...

Concerning "ta extension" - if you mean your "secd extension", I am afraid that is not that easy.

As discussed already in the above linked thread concerning camera quality, there are libs compiled statically so injecting hacked suntory functions is no longer possible via preloaded dynamic libs.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] russel5:
yep, losted...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] modpunk:
The secd extension is only loaded to secd not to the camera. And the new secd doesn't look much different to the old one. Also libdevice_security was always statically linked.