yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4120742]munjeni[/MENTION], I am wondering where exactly did you see the console enabled?

Just checked the above mentioned images, and console is disabled in init.rc in both, bootloader embedded kernel image and in the main boot kernel image.

Anyway, I guess that even if the console was enabled in init.rc, it would not help - there is the

seclabel u:r:shell:s0

statement in the console block of init.rc, so in my opinion, that would be equal normal adb shell over usb:

G8441:/ $ ps -Z
LABEL USER PID PPID VSZ RSS WCHAN ADDR S NAME
u:r:shell:s0 shell 17132 17098 8804 1856 sigsuspend 7ac0fbffe0 S sh
u:r:shell:s0 shell 17135 17132 10220 2092 0 73ee13a988 R ps
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] den191097:
Can this be ported to Xperia XZs? Our phone has old firmwares and I think we have firmware without 2017-12-05 patch.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] munted:
Does it matter if you don't remove *.ta files or the remove persist (and optionally Qnovo, amss*, ssd) sin files??? (My Android Attest Key was NOT PROVISIONED anyway when I started.) I err just left all the files and flashed them, camera is working though and I have working root and TWRP.

I've also attached a guide, have a look, honestly because I was fumbling around this whole process took me many hours over 3 days and I'm really glad to get responses to my questions. I hadn't done a lot of this stuff for over a year so I basically had to research from scratch on how to install TWRP etc. But I think the guide should change the degree of difficultly from, "this is quite an involved process, you need to have prior experience with installing multiple tools like TWRP, magisk etc. and know where to find the right Google and Sony drivers from as well as have some UNIX knowledge" to more like, "doable for intermediate users who can download and unzip files and can put commands into Command Prompt." It's a small contribution but I'm hoping it should make your work more accessible and more people will use it. :laugh:

Again thanks for making this tool j4nn and thanks to tonsofquestions and j4nn for all your help and answering questions, no guarantee I won't ask more questions though! Again hopefully this guide will mean less questions from others! :D

If anyone has tried to follow this guide and has any suggestions or found it useful let me know :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=3249741]den191097[/MENTION], I am sorry, but I am afraid that cannot be done without having a phone to test the timing with. XZs has different hw, it has snapdragon 820 instead of 835, just 4 cores instead of 8 with different frequencies. Porting to another kernel is not trivial either (involves reverse engineering work)...

[MENTION=3463150]munted[/MENTION], your guide looks good, except the part with /oem/sh - that is misleading, please remove it.

That post with /oem/sh was just a hint for a way to develop a persistent root backdoor.

But the "important question" at the end of the post is _really_ important and without solving that it is not very useful...

It might also help to convert the guide to .pdf instead of a .doc file...

I may add a link into the first post if you like.

Thanks.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Mad07:
only for sure:

" remove persist (and optionally Qnovo, amss*, ssd) sin files"

If there are files with the name

persist.sin

Qnovo.sin

ssd.sin and

some amss*. sin

in the upper directory, which must be deleted before?

Should only all *. ta files in the upper directory which contains the FW, deleted?

If there are any *. ta files in a subdirectory : leave it as it is?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
For sure delete persist.sin to avoid losing Android Attest Key (but in either case, the result will be the same due to unlocked state).

You may have a look here for some hints about partitions:

[INFO] ANDROID DEVICE PARTITIONS and FILESYSTEMS

Qnovo probably contains some history about charging, some of the other partitions contains other logs.

No big deal if they are flashed or not.

The dangerous .ta files are skipped automatically by newflasher, so it may be possible to keep them as well. Removing them might be a bit safer. But in case of problems, they may help to resolve some issues.

Be sure to flash boot subdirectory as it seems that some bootloader versions allow to boot different fw versions but possibly resulting with strange errors, including strange behaviour of camera. Or only partially (or not at all) working system menu security screen.

Not exactly sure what that .ta file in boot does. But flashing it together with boot/*.sin is probably more complete/consistent than without.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] munted:
Thanks for reviewing, I have made the changes you suggested however I wasn't sure what the "important note" bit was? If you reply with the text you want me to add it into the guide :)

Version 3 of the guide is attached to my previous post, https://xdaforums.com/showpost.php?p=78255334&postcount=382 if you want to have a look ;)

Sounds good :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] S-trace:
Hello.

My phone's (XZ1 Compact) history:

Started with 47.1.A.12.270

Then flahsed 47.1.A.8.49 using newflasher (without persist.sin and simlock.ta).

Then got root using renoroot by [MENTION=4418980]j4nn[/MENTION]

Then saved TA_unlocked.img and pulled it to PC

Then pulled /dev/block/sda, /dev/block/sdb and /dev/block/sdc to PC via adb pull (to be sure i have complete device backup at 'almost virgin' state - all keys was still provisioned at this state)

Then unlocked bootloader, all keys and blobs was lost (and camera started to take solid green pictures)

Then got root using renoroot (again), pulled TA-unlocked.img and /dev/block/sd{a,b,c} from phone (now with unlocked state) and then restored TA and persist from backup taken before unlocking bootloader. CKB blob, WIDEVINE blob and Android Attest key was restored (camera works again)

Now the phone has:

Suntory blobs [ERROR]

CKB OK [ACTIVE]

WIDEVINE OK [ACTIVE]

SOMC FIDO Key NOT PROVISIONED

SOMC Attest Key NOT PROVISIONED

Android Attest Key PROVISIONED

Is this state normal after bootloader unlock and TA+persist backups restore?

What can i try to get Suntory blobs and SOMC keys back?

I already tried to restore TA and persist backups again, but nothing changed, still Suntory blobs error and SOMC Keys are not provisioned.

UPD: Tried to flash secd-ignore-unlock.zip again, now all keys and blobs are provisioned and working. So, i still need to use secd-ignore-unlock.zip to have all keys provisioned after each FW update?

Thank you.

For statistics:

Just got root on XZ1 Compact (47.1.A.8.49) in 0m17.09s real, in 285 events and 1 overwrite. But it is not always such fast, of course
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
I received my XZP (used) with a Telekom Branding... with Pie.

There was only the SOMC FIDO Key Provisioned. No others keys are visible (provisioned or not). After Downgrade to Orego CE suddenly the SOMC Attest Key Provisioned was visible, too. An Android Attest Key I haven't seen till now on the phone.

OTA is still working. Bootloader in this moment still locked.

The reason to downgrade was, that the OEM Bootloader key was greyed. After downgrade, the option was available to change (in the developer menu)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] KnightRider2008:
Slightly unrelated question: Is there a way to give titanium (or other root app) su permissions while on temp root because i want to try that with my xz1
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] OldDroid:
worked for xz premium, dowgraded to the known working fw and did the exploit - thanks for this!

Building aosp now :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
SOMC Fido Key not provided?

Maybe I'm wrong, but I think this key should be available after restore the TA. img, isn't?

One question more (also after reading the new manual) :

In the thread of Newflasher is written :

"If you no want to flash something just move file which you no want to flash OUT OF FOLDER! Partition.zip .sin files can be flashed only if you extract partition.zip into newly created folder called partition!"

Does it make sense to flash the file Partition.zip into the phone? The partition are only flashed, if the zip is extracted into a subdirectory" Partition" otherwise the zip file is flashed on the phone as it is(if I've understood the statement correctly.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] OldDroid:
thats because i didn't use the secd patch, i'll try to create a magisk module to replace it without actually touching the unmodified partition. BTW someone knows if the patched secd works aswell on sonys android 9 releases?

EDIT: i didn't backup my persist.img before, since i had to downgrade to the supported version and forgot to delete the persist.sin, so probably my attest keys are lost - anyway, camera works like intended - my guess: only the blob keys are required for camera and the other features except video enhancement.

Regards
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] eidglfvsgkj:
Does the Video image enhancement work fine on pie?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] OldDroid:
nope, doesn't work

Regards
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] S-trace:
secd_ignore_unlock for XZ1 Compact with Android 9.0 (47.2.A.0.306)

Hello.

Here is the patched secd for XZ1 Compact with Android 9.0 (47.2.A.0.306).

Android Attest Key shows as NOT PROVISIONED even with this patched secd, but other keys and blobs works.

Logcat shows this about it:

11-27 01:24:12.753 693 693 E KeyMasterHalDevice: Attest key send cmd failed
11-27 01:24:12.753 693 693 E KeyMasterHalDevice: ret: 0
11-27 01:24:12.753 693 693 E KeyMasterHalDevice: resp->status: -10003

You may need to restore your TA-locked.img backup after flashing this patched secd to get your keys.

This is NOT DRM Fix.

It will work only if you have TA-locked.img backup with your keys (got temporary root with renoroot and backed up your TA before unlocking bootloader).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] arslancn:
hi,

I just flashed it to my rooted XZ1(G8341) and it worked, thanks mate!

now video image enhancement working.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Is this right, that this point is not for the XZP?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] karrouma:
it should works

do a backup first and flash to xzp

same system as xz1/xz1c
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] LYNXEMS:
Some questions

Hello, I have some quick questions

I already backed up my keys, but did not unlock the bootloader, just flashed back the newest stock, because I am unsure.

1. If I were to unlock bootloader now, would there be an easy way to get the keys back inside with root, without downgrading again?

2. All I really am currently looking for in root is changing the theme a bit with substratum, would there be a way to do that, and have it working in pie without losing the warranty by unlocking the bootloader?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=9588469]LYNXEMS[/MENTION], ad 1) it could be possible. For example you might restore TA from twrp instead. Or possibly from a root shell provided by magisk on runtime. But in my opinion the most safe way is to restore the TA to exactly the same fw from which it was backed up. That way the best compatibility can be assumed. Just be careful when saving & restoring TA...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] c_tho:
thanks for this, question: any functional difference that you can find? does restoring these keys/blobs affect video enhancement?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Must the secd modified / reflashed with each new update or it is enough to restore its on time?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] karrouma:
reflash on every update
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Mad07:
let me repeat one question
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] camaro322hp:
i have flashed the partition files (extract the files into a partition folder) in previous flashes. i don't see it specifically excluded here, so i am planning on flashing them for this process.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Is in the phone the zip file also available?

This would not make sense from my point of view; it's need only memory space
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Sebi673:
Hi, renoroot had 1 reboot on the first run, and after it got stuck whenever it had an overwrite with no events progress and no shell change.

hit ctrl c and redid the renoroot command, had 3 more overwrites (had to redo the script after each one) and now it's just counting events for the past half an hour - had another overwrite at event ~75.000 and this time it didn't get stuck but how long does it take? :D

Should I let it do it's thing? It's been running for about 7 hours, 3 overwrites with an event count of over 700.000. Or should I try the backup anyway.

Or did I do something wrong? Flashed the specivied XZ Premium fw, moved the phone to airplane mode and did the scripts - however in the tutorial video shows a near instant process. :(
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Can I use this file (from you) with each following Software versions or must the file change for each other version?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
You have stop the first time with CRTL-C and restart the script...

Does you've try to restart the phone and try again?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] camaro322hp:
[MENTION=4418980]j4nn[/MENTION] - I just want to again offer a huge THANK YOU for your devotion in getting this process created. I sent a donation last week, but just went through the process today, and it went perfectly. After using this phone unrooted for the last 6 months, it feels very satisfying to now have the phone rooted and TA backed up and restored. I was trying to avoid using an xperifix or similar tool as opposed to waiting for a true TA backup/restore method. So thanks again, I really appreciate it.

Also, thanks to [MENTION=3463150]munted[/MENTION] for creating the detailed guide that helped me along the way in a couple places I got stuck.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5482294]Sebi673[/MENTION], please double check you really run the supported firmware version for your phone variant.

If so, it may help to factory reset before running the exploit. With unlock you get factory reset anyway, so no big difference if you do it in advance. It could be possible that you have many apps installed some of them running in background after boot automatically interfering with the exploit timing.

[MENTION=7055162]mad0701[/MENTION], the script can be interrupted with ctrl-c and started again without reboot. Sometimes it might help.

Thanks again to all who donated / donate.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] munted:
No worries, let me know if anything needed further explanation or didn't make sense :)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Sebi673:
Hey :D

It was a clean install - only that it automatically connected to the internet for about 4 mb of data. I redid the flashing with no sim and it got temp root at event ~3500 - 2 overwrites

For theta restore I had to reflash the rom again cause I was getting high numbers of events (with ~10 overwrites). After a fresh reflash it went as smooth as the first time. :D:D

Thank you!!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Gaaat:
Hi! Yesterday I managed to unlock the bootloader on my Xperia XZ premium following the pdf provided. Then I updated to the latest version of Android pie, during this process SOMC Fido key became NOT PROVISIONED, even though I always deleted the persist file before every flash, X-reality was working.

For a series of reasons today I had to reflash the same Pie firmware, but when the procedure ended I discovered that X-reality was no longer working. I restored the TA backup made before but video enhancement it is still not working. Any idea on why is this happening? Is it possible to recover it?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mad0701:
Yesterday I use also the renoroot:

After save the TA, unlocked the BL, restore the TA, install TWRP also no SOMC Keys are available.. Other keys wasn't displayed before (only the 2 one)

Downgrade historyfor the XPZ

Pie (DE Telecom) - > Orego 47.1A.12.34 - > 47.1.A.3.254_CE1

To received tmp I used some time 2 runs at maximum or direct after the first run.

In case of reboots the time need max 10Min. For success max 5 Min.... around 13000Events.

The upgrade direct to Pie 47.2.A.2.33 failed about write error..... I was upgrading to 47.1.A.16.20 (after reanimated the phone)

Btw there is a small gap in the first manual (Doc) After unlook the BL, the root process must be repeat, the TA-unlocked must first created before the file can be DL (pull).

Maybe it's help also following User the note that TWRP must be compatible to the phone. Not that other user flashed a wrong TWRP version on other phones.

Now I try to flash the 47.2.A.2.33 once again (after new DL) let see what's happen....

edit on:

I deleted only all *. ta files and the persist.... sin file. Maybe the ssd. sin must be also flashed in this case.... Now the phone is on Pie....

? Which feature doesn't work in the posting above?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Gaaat:
In settings > display > video image enhancement is sony proprietary X-reality engine which slightly improves video "sharpness", not a big deal but I don't understand why this happened. Not sure if camera quality got worse, but I'm almost sure that ClearAudio+ and DSEE HX which I think are also sony's proprietary algorithms are working.

Also nothe that SOMC key was lost after the upgrade to Pie
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Mad07:
How can you flash zip?

I received at every time an error from TWRP, it doesn't matter if the zip is located on the SD-Card or in the internal memory

After

Maybe its importend: For Central Europe is only 47.2.A.2.33 available
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Mad07:
Does it will help, if I post the temp. file which should be created during flashing with TWRP "/tmp/config" from the script?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] DavidSnake:
Hi guys, noob questions here.

I unlocked my bootloader and rooted my phone with DRM fix long ago (before this tutorial was up). I'm now planning to upgrade to Pie and root it after.

This tutorial is just for people who haven't yet unlocked and lost TA right? In my case there is no point in trying to follow it and I should just flash the new FW and proceed to root? With Pie no DRM fix is needed for the camera so no problem am I correct?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Gaaat:
Yes, unfortunately you can't get your ta partition back. No drm fix is needed after you update to pie for the camera to work but I'm not really sure if picture quality is still the same or if it's worse.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] DavidSnake:
Thanks for the reply, that's what I thought. I'll check about the camera first then.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] goofnorf101:
great

Just want to say this works perfectly and is really awesome!

xz1c g8441 47.1.A.16.20

My suntory blobs show as ready and ckb and widevine ok and active. SOMC and Attest keys are all provisioned.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] williamgrant:
Error when try to pull.

Hi!

Everything was great, I downloaded and flashed the 47.1.A.8.49_CE1 fiwmware (XZ1 Compact phone, and removed the persist_X-FLASH-ALL-42E5.sin), install the explot files, and start the trap with temp root, it find the solution after 2.000 events, overwrites 1, the # char before the cursor was appears. After I started the backup (no any restart) and the commands are runs well, but the ADB PULL (when I try to backup to my PC ) writes an error message: not found.

Oh, I tried again, but always "not found".

I restarted the phone, start the trap again, but now the count is over than 33.000 and a lot of time has passed. I can't reach the temp root again.

Do you have any idea what was my mistake, or what is the problem?

Without TA backup, I don't want to unlock my phone.

Okay, it was my mistake, I can't enter the pull command when I'm in the shell. Just interrupted the process, and make a full command in CMD and the backup is completed well.

Kay, I reached the TA restore part, but the temp root don't works. The phone restart sometimes, and the events count go higher and higher, but never reach the overwrites to 1.

Any idea?

Thanks!

WG.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] williamgrant:
I cant reach the temporary root again.

The TA partition recoverable via TWRP or Magisk? If it possible, probably its easier than the exploit... :(
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
You may backup unlocked TA and restore locked TA from twrp too. The recommended way is to restore TA in the fw where it was backed up, i.e. via the exploit again, in order to guarantee the best compatibility and avoid third party software influences and problems - i.e. if you were able to backup locked TA with the exploit, it is surely possible to restore it the same way. Bringing other sw in the process could complicate the procedure.

Did you go online after unlock, starting updates? Try to factory reset, remove sim card, do not configure wifi - follow the steps in the howto to avoid any apps load on the cpu. That allows fast hit for the exploit.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] cyylove:
hi guys.

I want to use this tool to root my another device.

but the apk install failure.(INSTALL_FAILED_NO_MATCHING_ABIS)

can you build a universal apk?(my device is arm 32)

thank you!

----------edit----
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tonsofquestions:
Do you really need to quote the entire OP? It's long and takes up a lot of space for no reason

It might also help you to read it it a little closer. In particular:

Emphasis mine.

So there's no point in building a universal APK. If you're trying to root anything other than an XZ1, XZ1C, or XZP on one of these firmwares (which is sounds like, if it's an arm32 phone), then it won't work.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Anybody had a faster run to get a temp root?

I get a hit in 6 seconds - see the screenshots (0m06.03s real) - events count 53, overwrites 1.

Pure luck I guess 8-)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tj2806:
Great guide. There was only a few small things-

pg.33 calls for 'adb pull /data/local/tmp/TA-unlocked.img' however this file was never instructed to be created.

pg.36 you may want to warn users that they will need to different version of twrp if they are flashing straight to Pie instead of 47.1.A.16.20 (this is what I did)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] munted:
Thanks for the feedback :)

I'll update the guide when I get a few minutes, what version of TWRP did you use to flash to pie?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] camaro322hp:
Interesting. My low was around 7,000 events and my high was over 80,000 events.