[Sony Xperia XZ1  ROMs, Kernels, Recoveries, & Othe] j4nn:
rooted kernel hiding bootloader unlock

with working sony stock fw fota updates

for Sony Xperia XZ1​

Firmware Over the Air system updates have been disabled/not working with sony xperia phones with unlocked bootloader.

Also many sony drm functions are disabled if fw detects unlocked bootloader even if device master key was recovered.

I've implemented a kernel patch for xperia XZ1 Compact / XZ1 / XZ Premium phones that properly masks bootloader unlock status so it appears as still locked for sony stock firmwares.

This allows FOTA updates to be installed if running completely unmodified stock firmware. This is possible if this kernel is just booted from usb via fastboot instead of flashing it.

The kernel is pre-rooted, so you can have root as usual with magisk when running this kernel (you can use magisk system less patching to make changes to system/vendor partitions without actually modifying them).

For oreo fw the boot process is patched to hide magisk from sony ric daemon that stops the boot in case it thinks the bootloader is still locked. This special patch allows to pass safetynet including cts while having properly working magisk.

This kernel may be used (flashed) just to properly enable sony drm features, like video image enhancements, if device master key was recovered via locked state TA restore.

The bellow described way to install FOTA system update works with both - phone with TA restored and phone with drm keys lost. Both variants have been tested with xz1c.

How to use this kernel while planning to do FOTA system update eventually

Update:

please see here for the latest usage instructions for kernels in flashable zip archive.

Please see screenshots bellow for this kernel in action (with xz1c) doing fota system update from oreo to pie and from pie to next pie version. There is also a video documenting this here. Few longer waiting parts have been cut out to fit the video under 15 minutes of youtube limit for not verified accounts.

if your bootloader is still locked

Use renoroot exploit to backup your TA, unlock your bootloader and restore TA-locked to recover device master key as described in

[XZ1c/XZ1/XZp] temp root exploit to backup drm keys implemented thread.

select one of the prepared kernels and download it

make sure you are running unmodified stock firmware

You need the version corresponding to the selected kernel - reflash the firmware to make sure it is unmodified.

Please note: any mount of /system or /vendor partitions in write mode would result with modifications even if nothing is copied there.

Be aware that some zip packages flashed from twrp may mount the partitions for write access even when that is not needed.

reboot the phone to fastboot mode

Use either "adb reboot bootloader" or

enter fastboot by holding powered off phone's volume up key while connecting it to PC via usb cable and use 'fastboot reboot bootloader' command.

boot the downloaded kernel via fastboot

For example (xz1c):

fastboot boot boot-G8441-47.1.A.16.20-hideunlock-rooted.img

enjoy your rooted phone which thinks it is still locked

Sony apps will be offered to install/update. System FOTA update may come.

Magisk will provide your root when magisk manager app is installed (offered on the first boot).

if you need to use a custom recovery, like TWRP

Do not flash it. If you do, FOTA update verification will fail.

Instead use 'fastboot boot' the same way as with the kernel above, but instead of the kernel, boot the twrp image without flashing it.

to install a FOTA system update

just start the update as usual

let it run until it finishes the installation

try to catch the restart then and hold volume up that time to enter fastboot

you need to use following command to make next boot working

fastboot reboot bootloader

use 'fastboot boot' to boot kernel for fw to which fota updating to,

for example (xz1c):

fastboot boot boot-G8441-47.2.A.4.45-hideunlock-rooted.img

if you miss the restart (or do not have the right kernel version),

it does not matter, the installation will finish even when bootloader unlock is detected with the last reboot to updated system,

so just 'fastboot boot' the corresponding 'hideunlock-rooted' kernel then

Alternative use of this kernel

If you do not like booting from usb via fastboot to startup your phone, you can flash the kernel and boot normally.

But if you like to install FOTA system update then, you would need to flash the stock kernel first in order to make the fw untouched again (assuming no other changes to the fw, like system or vendor partitions, have been done) and boot the patched kernel via 'fastboot boot' as described above.

You can backup stock kernel (and recovery) to avoid need to download full stock fw when you need to restore stock kernel & recovery when you decide to install fota system update - see here and following post for more details please.

If you do not care about FOTA, just do not install it.

And use this kernel just to enable all sony drm features that are available on a locked phone (assuming locked state TA has been restored).

In case you like to make some modifications to system or vendor partitions (as you do not care about fota), you would need to disable verity in the kernel - please see post#3 for noverity variants of oreo kernels and linked post describing howto switch verity off via magisk in all pie kernels.

Downloads

See the post#2 please.

Source code

patched kernel sources to hide bootloader unlock (my-bluhide/* branches)

https://github.com/j4nn/sonyxperiadev-kernel-copyleft

patched magisk sources to hide magisk from sony ric daemon on early boot phase (v19.1-manager-v7.1.2-ric branch)

https://github.com/j4nn/Magisk/tree/v19.1-manager-v7.1.2-ric

The patches are provided under GPL (that means you may include them in your builds, but you need to provide buildable source of released binaries /true for any kernel change btw/).

Credits

Thanks to [MENTION=4403504]tonsofquestions[/MENTION] for lot of initial testing of this concept when I did not have a phone with unlocked bootloader and for discovering the need to reboot to fastboot by a command to make the 'fastboot boot' command properly boot the supplied kernel image.

Thanks to [MENTION=4470081]topjohnwu[/MENTION] for his excelent magisk tool.

If you find my work useful, consider donating here please:

https://j4nn.github.io/donate/

Thank you.

XDA:DevDB Information

kernel_bluhide_poplar, Kernel for the Sony Xperia XZ1

Contributors

j4nn

Source Code: https://github.com/j4nn/sonyxperiadev-kernel-copyleft

Kernel Special Features: proper hiding of bootloader unlock, sony ric with magisk hack

Version Information

Status: Stable

Stable Release Date: 2019-02-10

Created 2019-02-10

Last Updated 2019-08-07