[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Guys, I am not that optimistic about that TA backup/restore test on "devices with userdebug build, which runs as root as default" - that may be completely different firmware, with all security checks switched off, so even behaviour of unlock might be different to commercial devices, particularly while that fw cannot be flashed to normal devices.

But surely I would be happy to be true, still it hardly can serve us as a confirmation for our devices.

[MENTION=4120742]munjeni[/MENTION], I guess you mean the images in boot subdirectory? I am not sure, are they even flashed when flashing the fw?

Your findings are interesting, but I am afraid, that the kernel inside it, cannot be started easily - if extracted, it would not be signed. If the whole boot image was used, probably boot loader would start?

It's question under which condition the bootloader starts the kernel in the image, but it might be some recovery case. Also serial console is probably difficult to reach - if it is not accessible via the usb port (I doubt that), I would not try to open the device, which is designed not to be possible to open.

The 47.1.A.2.281 fw's 'bootloader' LA1_1_O_77 sin image contains many files, the one with xfl prefix contains the kernel, ramdisk and device tree of what I could extract. The kernel there is v4.4.67 with very simplified kernel config.

The kernel 'boot' image in that fw contains kernel v4.4.74, with bigger config, bigger ramdisk.

Command line of bootloader kernel image:

androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 sched_enable_hmp=1 sched_enable_power_aware=1 service_locator.enable=1 zram.backend=z3fold androidboot.selinux=permissive

Command line of main kernel 'boot' image:

androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 sched_enable_hmp=1 sched_enable_power_aware=1 service_locator.enable=1 zram.backend=z3fold

Concerning console, it looks similar with both kernels to me, at least if I compare grep CONSOLE of kernel config, similar options are enabled - MSM and PSTORE consoles.

And console is disabled in ramdisk's init.rc in both, bootloader embedded kernel image and in the main boot image.

What I do not understand, why there is yet another sin image with kernel, the 'FOTAKernel'? What is purpose of that one?

And what I am really wondering - is it possible to downgrade the bootloader?

I am currently at LA1.1_O_79, the 2.281 fw contains LA1.1_O_77, so can we downgrade to test for boot loader vulnerabilities?

Anyone tried to downgrade the bootloader?

[MENTION=5697586]moofesr[/MENTION], RAMpage exploit - very interesting, unfortunately, poc is not released, the app only does some test.

Built and tested the 'drammer' tool which is provided with source - it seems not to trigger the bug on xz1c (first it did not detect the rowsize: 'Could not allocate 256K chunk for row size detection: No such device' and if -r 65536 is used, it seems not to trigger the bug - I wonder if the allocation works at all).

Anyway, exploit development from scratch would be very very hard in my opinion, no way to go for us I am afraid.

I think the inotify/rename vulnerability has still good potential, after all it was demonstrated on that hacking conference as a way to get root on latest android devices.

Any ideas concerning my previous post?