yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] MajorCliffAllisterMcLane:
I want to unlock the bootloader on my XZ1c and backup the TA partition before.

Android Pie (47.2.A.11.228) is installed and because Renoroot only works under Oreo, I have downgraded to Android Oreo (47.1.A.8.49). Under Android Pie, the service menu shows me: **Bootloader unlock allowed: Yes** and after downgrade under Oreo: **Bootloader unlock allowed: unknown**.

Hence my question what did I do wrong?

I use Windows 10 x64 and the following programs:

- Xperia Companion 2.10.3.0 (https://www.sony.com)

- Android SDK Platform-Tools 30.0.5 (https://developer.android.com/studio/releases/platform-tools)

- newflasher_v38 (https://xdaforums.com/t/tool-newflasher-xperia-command-line-flasher.3619426/)

Image:

- oreo 47.1.A.8.49_CE1 (https://www.androidfilehost.com/?fid=11410932744536993396)

Preparation for downgrade:

- unpack image (Directory: G8441_47.1.A.8.49_CE1)

- unpack the file **partition.zip** in **G8441_47.1.A.8.49_CE1\partition**

- delete the *.ta files

boot\Lilac_XBootConfig_MiscTA.ta

auto-boot.ta

cust-reset.ta

fota-reset.ta

master-reset.ta

osv-restriction.ta

reset-kernel-cmd-debug.ta

reset-non-secure-adb.ta

reset-wipe-reason.ta

simlock.ta

- copy program files from newflasher_v38 to directory G8441_47.1.A.8.49_CE1\

Perform downgrade:

- start G8441_47.1.A.8.49_CE1\newflasher.exe

Rebootmode after flashing: poweroff

Gordongate flash driver: skip

Dump trim area: skip

.

.

.

End. You can disconnect your device when you close newflasher.exe

Press any key to continue...

After the basic setup, switch to the service menu (dial *#*#7378423#*#*):

Configuration - > Bootloader unlock allowed: unknown

I successfully backed up the TA-Partition with Renoroot and saved it to my PC.

I stopped my attempts at this point and gradually updated Android Oreo to Pie using Xperia Companion. I am now back to version 47.2.A.11.228 and the service menu again says: **Bootloader unlock allowed: Yes**.

The entries in the service menu have changed in one place: Security -> Args (Before: 0x000000, 0x00000001; After: 0x6f656d50, 0x00008000).

I did not notice any other changes.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] BBComputerBwoy:
Hi, I am using an XZ1 Japanese model running Docomo, firmware number 47.2.B.5.38 (locked bootloader) Is it possible to flash this device using the methods mentioned here...or do I need to downgrade my firmware?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] J.M.Siyath:
Is this forum still active?

I like to use custom roms; before unlock bootloader I want to confirm that is DRM keys backup worthy?

if yes how to backup in simply? there are lot of things in first post I cant understand those all things.

please anyone reply me.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] greenchap:
I have a SOV36 JP

flashed the target 8341 with newflasher

renoroot success, copied TA-locked

and then impossible to unlock bootloader.... fastboot command not allowed... rooting status says: NO

blocked here. I will try the biondershell now but my level of hope is very low after one full day on this with no success.

thanks anyway, I learnt a lot on xperia and I think it's the first time I'm running an exploit lol ;-)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] asis9393:
Hello.. can you actually root xz1c docomo and install custom roms?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hupengwei:
In fact that i don't approve you opinion.last week i used your ways to get a temp root shell.and i believe that only if i extract the x-flash-boot.sin and get the abl.mbn from the test-version firmware that i could use the dd command to get the rights to unlock my bootloader of my xz1c(so-02K,the docomo japanese version).

To confirm my thought i used dd command to back up the abl partition,abl.img got.

i compared the abl.img back-uped from my device & the abl.mbn (extracted from the same version firmware) in hex mode using Ultra Compare,it's EXACTLY THE SAME,which indicates the signature is also flashed into my device.

edit: by the way,DO NOT TRY WHAT I'VE DONE，my phone is now a hard brick in EDL mode,and recognized as a somc flash device with vid ADE2,can't be repaired by Flashtool,emma,newflash. sad about it,how silly i am.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
This ^^ - by deleling the .ta file under boot directory your bootloader has not been downgraded with the rest of the firmware, that makes the security stuff not working. Upgrading back made it functional again.

I believe no difference for your TA backup, no need to do it again.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Did you use dd command to write different abl.img into abl partition?

Where did you get that abl.img - you mentioning some test firmware?

Sorry to hear you get a brick now.

I have managed to obtain sony firehose/edl boot image (very difficult to get, not free), but it would not help you - it is basically useless, because all commands are protected by sony sake authentication (rsa2048). Tested boot into EDL, the loader is accepted then, but no use after that:-(

We would need a service providing sony sake auth to be able to use it for bricks recovery.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
There are some possibilities for these Japanese XZ1 phones, could be very interesting to test.

Please pm me. Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hupengwei:
first of all , i've downloaded firmware SO-02K_47.1.F.1.105_1311-8845_R14B,in ftf format from google drive and successfully downgraded to oreo with newflasher,and got root with your ways.

you need extract the ftf firmware for newflasher,from boot folder,i found boot_delivery.xml.and 3 boot.sin:

i noticed this in boot_delivery.xml :

and the " <CONFIGURATION NAME="DEVELOPMENT"> " makes wonder wheather it's a test version for developers and enables the bootloader-unlock function.what's more attractive,it says "<ATTRIBUTES VALUE="DEFAULT_SECURITY=&quot;OFF&quot;"/>".

so i unsin the "bootloader_X_Boot_MSM8998_LA1_1_O_82_X-FLASH-ALL-5ADA.sin" and got a lot of mbn files,like abl.mbn,Xbl.mbn,etc.

so i just use dd command to override the abl partition,xbl partition,etc with the mbn files.

which makes me a hard-bricked phone.

before these actions,i decided to confirm that whether the abl partition in my phone is the same from the abl.mbn in "bootloader_X_BOOT_MSM8998_LA1_1_O_82_X-FLASH-ALL-99C3",since the log of newflasher says i've flashed this file and only this file into my phone during the downgrade-process.

if they're the same,i think i can just use dd command,if not,maybe some information was disposed,just like signature.

i compared the abl.img back-uped from my device & the abl.mbn (extracted from the same version firmware) in hex mode using Ultra Compare,it's EXACTLY THE SAME,i believe this indicates the signature is also flashed into my device.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
@hupengwei, there are multiple version of bootloader files exactly because only one of them is suitable for each type of device, meaning a normal commercial or a development or early sample whatever unit.

So all of them have their own signatures in them, but the signatures verify with different root certificates each type of phone has. So flashing different xbl, abl, etc. with dd is sure way for hard brick.

I am sorry, but I am not aware of any method to recover from this as we cannot use EDL.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] infinitylook:
If i got this right, i will download that firmware for my xz1 dual, delete the persist file then flash by newflasher? After doing that on my XZ1 dual, it got into a bootloop, i was wondering if that firmware link is for xz1 compact or xz1 dual?thanks
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
With downgrading you need to flash also userdata sin to do full data erase otherwise it won't boot.

Flashing master-reset.ta might help too.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SGH-i200:
If you don't understand the instructions, please learn about the mentioned topics. Don't unlock the bootloader before you habe a backup of the DRM keys!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Dago1992:
Excuse me, I don't see the guide. How do I download it?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mstrnemo:
Is what is said in this news article correct ?

Unlocking the bootloader no longer breaks the camera on Sony Xperia devices running Android Pie

Unlocking the bootloader of Sony Xperia devices running Android Pie no longer totally breaks the camera like before, but not every feature will work still.

www.xda-developers.com

So i can just unlockbootloader without losing anything and flash customrom ?

Does this mean i dont have to do what is described in this thread ?

what for me might as well be quantum fysics ? hahaha
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
That article is about *breaking* the camera altogether.

Which used to happen once every odd generation ever since the xperia Z1.

Quality and that other bunch of things mentioned are still an unknown though, so you better backup everything possible.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mstrnemo:
Thanks
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] hibikase:
Hello, I have XZ2 and trying to backup TA using this method. well I have temporary root. but the problem is when the Events count will end? last know is 140000 and I thought something wrong. then I reboot it, and temporary root again, then run reno again. but still after 3x

what should I do?

thanks
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Charlestai1225:
how do you backup your ta? can you help me please tq
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Charlestai1225:
Sir im also interested to test can i join it? Thx
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] shahid044444ali:
sir i have a request can u please make a nethunter kernal for xz1 andriod 9 so that we can use nethunter with external wifi adapters bcz in normal linux kernal it does not suport TL WN722N v1 so please make a flashable kernal for xz1 andriod 9 its a request
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Fabian_9297:
I guess so, I unlocked the bootloader without knowing about the drm keys and the camera remains the same, everything the same (on pie).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] dfg555:
Will this kernel allow me to bypass this? (Xperia Backup & Restore)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] faisal.gooner:
I have the Japanese variant, 701SO (Softbank) followed the steps as if my phone is a G8341 until I restored the TA after unlocking the bootloader. Camera works but other than that how to check if the DRM functionality is fully restored?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] KuroShion0329:
at least ur G8341 SO can bypass ,recently i purchased a sov36 ,the seller told me that can be bootloader unlock but in the end ,i got two bootloader not allowed unlock device
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] faisal.gooner:
Actually my 701SO was "Bootloader unlock allowed: No". Using qUnlockTool, it changed to "Bootloader unlock allowed: Yes". You need to purchase credits to use it though. The one I got was from https://www.unlockingshop.co.uk/server/80/Sony-Xperia-USB-Unlock-Tool. Paid £22.55 (including PayPal fee) for it. Got fast and helpful reply. You can then obtain unlock code from Sony website.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sam.fisher190:
I got your same model a weak ago and i've been testing for the past couple of days and nothing seems to crack that little batard!

It's hard to believe that that little thing got us all locked up!

When it's in flash mode mine also shows as SOMC flash so it's been identified as flash storage of some sort so i don't think yours is hard bricked!

I just wanted a simple custom rom and i don't care about drm keys as the camera sucks anyway.

I've never seen a device so stubborn!

Info :

model : SO-02k docomo

Allow bootloader unlock: NO

ANdroid 9 firmware :47.2.B.5.38

Flashtool methods didn't work!

Fastboot unlock command(s) didn't work with unlock code!

Changing firmware to global with new flasher/ flashtool didn't work!

Temproot didn't work of course as it's on ANdroid 9

My question to you is : what would you do differently? should i accept the fact that i'm stuck with the stock firmware?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] sam.fisher190:
@j4nn Will the following method work on SO-02k Docomo with a locked bootloader? :

Downgrade to a supported firmware via flashtool then applying temproot, then flash twrp recovery from within the signed stock system using flashify then reboot into recovery and flash any android 9 custom rom!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Xt1572:
Hi ,

I have xperia XZ1 G8341 with locked bootlaoder EU fw 47.2.A.11.228 , want to downgrade to oreo ,idid some research on XDA forums regarding attest key and not flashing persist .sin and all Ta files .

idid download ftf file from here ,this post target G8341 but befor flashing i would like ask ,do i need to flash partition zip after been unzipped within newflasher directory and boot .ta file in the boot folder ?

Im trying downgrade without any problems or hard bricking my device .

any answer would be appreciated,Thx you in advance.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] drater2:
Impressive work. Thanks to the excellent instructions all worked flawlessly.

I used .254 to restore the TA keys. If I flash a newer stock rom will it overwrite the locked TA key I restored using this tool?

Can I restore the key in a rooted custom rom?

Best regards
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] thibouille:
Has anybody any mirror for 47.1.A.2.324_CE1 or 47.1.A.8.49_CE1 ?

I have a very hard time getting those from these links.

I just need to be able to root so I can get whatsapp files to go on SD card. I don't care about Bootloader unlock but I guess one comes with the other. Just wanna backup the TA first.

Thank you !
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] bob1791:
Hello everybody, can I use this tool to backup the DRM key of my xz1 compact ? It runs the 47.2.B.5.38 build with the October 2019 security patch. I need to go back to oreo or there is something else that woks with this version ?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] rogat92:
anyone still have the newflasher guide?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] martin_sz:
hi all,

I've searched in this thread but couldn't answer a few things:

I have a XZ1c on Android Pie (47.2.A.11.228) and I am considering to unlock Bootloader and root,

in order to use Link2SD to move apps to SD card on Stock ROM.

So what is not working as before unlocking? What are disadvantages of unlocking?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mortalgen:
First of all, great work to j4nn and all the contributors, I managed to load Havoc OS onto a SO-02K, original firmware was 47.2.B.5.38 and bootloader unlocked not allowed. But I screwed up after that and can't figure out how to get it back =P

Here's the steps for it, for anyone else who wants it. Highlighting the extra step required for SO-02K, since the bootloader unlock has to be set to allowed first. Also specifying the probable error I made, so others do not make the same mistake.

Just to be clear, the S1 network unlock tool here is required, and money required to be spent if your bootloader is not unlocked yet. I used the temp root exploit for all the times where root is required, as mentioned in the OP. So stock firmware 47.1.F.105 is required. I got the FTF by googling "47.1.F.1.105 xz1 compact". Unzip the FTF. Unzip the partition.zip into a folder named partition.

Before starting, make sure ADB and fastboot drivers are installed, i.e., the device is recognized when in either mode.

1) Downgrade to 47.1.F.1.105 using newflasher. Do not flash persist.

2) Temp root with bindershell, backup TA.

3) Use the S1 network unlock tool to do a network unlock. Follow the steps by Sony to unlock bootloader after that.

4) Temp root with bindershell, backup unlocked TA if you want to, restore locked TA.

5) Flash TWRP

6) Flash custom ROM

If all goes well, it should be working with custom ROM and DRM keys intact. Do not flash back to stock. (Do a Format Data in addition to clearing system, data and cache in TWRP when flashing new ROM, see Edit). I made the mistake of flashing back to stock (47.2.B.5.38), intending to check attest status, then repeating the steps all over again. After flashing custom ROM, WiFi doesn't work. It shows scanning for networks, but zero networks are ever found even though there are many around. The settings app also crashes sometimes when attempting to turn on WiFi.

Tried Havoc OS 4.6 and LOS 18.1, same error on both. Reflashed back to stock 47.1.F.1.105, WiFi is good. Reflashed back to stock 47.2.B.5.38, WiFi is good. Tried repeating the whole process multiple times to no avail. Even tried flashing to 47.1.F.1.105 and doing FOTA update to Pie, still no WiFi when on custom ROM. Emma doesn't work for SO-02K, it shows no services available even though the correct model is detected.

Edit:

After some more testing, I found that not doing a Format Data in TWRP causes WiFi problems when flashing a new ROM, be it custom or stock. In stock, the whole system would be very slow and after a while, it ended up in bootloops. In custom ROMs, the WiFi never detects any networks.

Conclusion:

Follow steps for flashing ROM, but do a Format Data as well.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] erlang1234:
I looking programmer who can extract Widevine from phone or Android and explain how to do it.

I looking files…
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Quigley:
Hi, I have a bootloader locked XZ1C, planning to install LineageOS on it. Am I correct in assuming that the DRM keys are only useful for the stock ROM? So when I am planning to use a custom ROM anyway, there's no need to backup the keys right?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] 4qx:
This was probably answered before, but is there any point in restoring the keys (or even backing them up) and tinkering with secd as per step 11 if a custom rom will be used?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] erlang1234:
Can can you extract l1? What your price?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] bob1791:
Has anyone tried to root using this CVE-2022-0847 security flaw ? It should be affecting the stock rom with android 9 so we can avoid to downgrade to android 8 to make a temp root....
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] 4qx:
TWIMC: Been trying to downgrade my SO-02K with newflasher, the latest version v50 didn't work, an error reading something about the firmware files missing update.xml

newflasher v20 worked though
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kdolum:
Thanks again to j4nn for all the work. I was able to backup and restore the TA on a G8441. (Not the SO-02K that I was trying before. That worked also but I was never able to get it working on either AT&T or T-Mobile.) I first checked that I had "Bootloader unlock allowed: yes". Then I downgraded to 47.1.A.16.20_1310-7123_R7B, got temp root with bindershell, and backed up the TA. But then when I went to unlock, "OEM unlocking" was grayed out and *#*#7378423#*#* said "Rooting status: unknown". So I upgraded to Customized US_47.2.A.11.228-R7C, and then I could select "OEM unlocking", unlock the bootloader, get root with Magisk, and restore the previously locked TA. I don't know how to test whether my DRM keys are actually working.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SXUsr:
Check the service menu/service info/security
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kdolum:
What do I look for? Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] maidmeow4:
It looks like this kernel (kernel-G8342-47.2.A.11.228-hideunlock.zip) does not compatible with Magisk v24, I flashed Magisk v24 with this kernel and my phone stuck at Sony logo won't boot.

Magisk v23 works fine.

Edit 1: the above process was done by following this post .

Edit 2: update from magisk v23 to v24 inside magisk app also works fine, zygisk can be enabled too.

TL;DR: flash magisk v23.0 with this kernel, then update to magisk v24 inside the magisk app, choose "Direct Install (Recommended)" as install method.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] maidmeow4:
You can download DRM info from Google play, it gives all the infomation you want to know.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kdolum:
Thanks, @maidmeow4. What do I look for in the DRM info output to know if my keys have been correctly restored?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] maidmeow4:
Look for "Security level" under "Widevine CDM", if it shows L1 then it's good.

Edit: You may also check "Video image enhancement" by going to "Settings -> Display -> Advanced -> Video image enhancement", toggle the On/Off switch and see if there is any quality changes to the demo video below. I remember that if no keys were restored, this feature will not have any effect (and maybe all other Sony specific features, like ClearAudio+).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] shamllakh:
mortalgen,​

i need a help: can you tell me how i can manage to p.a.y for the "qUnlockTool" and get a credit for the sim-unlock? thanks in advance.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] 4qx:
Sony Xperia Cable Unlock / FRP Removal – 0 Counter Supported – qUnlock S1 Unlock Tool – Network Unlocking – Phone Unlocking | Unlocking Codes | iPhone Unlocking

networkunlocking.com
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] norabitox:
Hello shamllakh

Is VoLTE working with the so-02k custom ROM?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mortalgen:
Hi,

I do not use VoLTE so I can't confirm.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] norabitox:
Is that so

thank you for your reply.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] norabitox:
I ordered here yesterday but haven't received a reply yet.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] 4qx:
Hmm. It doesn't say anything about unlocking a hardlocked bootloader. Is that what you're trying to do? If yes, please let us know if it works. If it doesn't, you can try this (that's how I was able change Bootloader Unlock Allowed "No" to "Yes") https://networkunlocking.com/shop/sony-xperia-cable-unlock-0-counter-supported
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] norabitox:
The Z5C(SO-02H) was able to be unlocked, so I think it's probably okay.

When you receive your ID and password, we will let you know the result.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] norabitox:
Hello 4qx

It took a while due to the seller's trouble.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] multiwirth:
Hi!

I just successfully gained root shell and backed up the drm-keys as described.

So since i had to downgrade the firmware, i´d like to NOT unlock the bootloader now and restore the IMG, but run through all OTA updates to get to the last official firmware without the need of fancy methods of downloading random stuff at super slow speed to flash the current firmware manually.

So my question is:

Will i be able to downgrade the firmware later on coming from pie to restore the img containing the drm keys in case it is ever needed?

I´m planning to update, unlock BL and then flash lineage anyways so i don´t currently need drm-keys.

Or will the trim area get an inreversible change when upgrading to pie firmware?

Would love to hear your thoughts :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] kdolum:
@multiwirth, after downgrading and saving keys, I upgraded to latest stock, unlocked boot loader, got root with Magisk and only then restored my saved keys. This seemed to work fine. So I think as long as you have the saved keys you can restore them any time you need them.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] multiwirth:
alright thanks for your info :)