yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy A20 Questions & Answers] Imyou:
So i did a clean install , delete data+ caches+ system and stuck in a bootloop

Tried formating data , still stuck ..

Tried formating data then delete data + caches+ sytem and reinstalling image still stuck in the google logo ..

I have no idea what to do anymore ..
[Samsung Galaxy A20 Questions & Answers] physwizz:
I have not had much luck with that GSI but others have installed it easily.

Instructions are in the GSI thread.

https://xdaforums.com/galaxy-a20/how-to/gsi-galaxy-a20-t3964546
[Samsung Galaxy A20 Questions & Answers] Imyou:
Yeah i dont know , i will try with a older version of the gsi
[Samsung Galaxy A20 Questions & Answers] physwizz:
I'm on MSM-Xtended 9
[Samsung Galaxy A20 Questions & Answers] Imyou:
Is it any good ?

I got stuck on a bootloop on that too..

The only one that pleases me so far it's Havoc ..

And BTW do you know any Google camera we can install ?
[Redmi K20 / Xiaomi Mi 9T Questions & Answers] EnzoGolami:
Hi all hope you are all good

I'm wondering about getting this device but I need to be able to run 3 users (multi user feature) on this device.

I've read it can only handle 2 is this true ? Is there a way to have it run 3 out of the box or does it require some special steps etc ?

Thank you so much and have a nice day
[Touch CDMA General] Deepeyes:
I need to find a program for my sprint touch that can play aacPlus audio streams at 48kbps does anyone have a suggestion? will resco radio play that?
[Touch CDMA General] TheChampJT:
Don't fully quote me yet on this, I have it unistalled temp so can't see, but CorePlayer supports a ton of different file types.
[Touch CDMA General] Deepeyes:
Thanks for the info, I have tried resco so far and it does play that format
[Touch CDMA General] hurbin:
i use a program called "streaming media" allows me to play whatever i want. dont remember exactly where i got it, but im sure you can google "streaming media cab" and you will find it. hope it helps some =/
[Touch CDMA General] TheChampJT:
I think your referring to the HTC Streaming Media Player.
[Touch CDMA General] hurbin:
It's a possibility,

Here is the cab, give it a try and lemme know. :]

http://www.winmobiletech.com/sekalaiset/RvBCrS_HTC_Streaming_Media.rar
[Touch CDMA General] eder:
gsplayer also works wonders, google it.
[Sony Cross-Device General] anaconda875:
Hi [MENTION=4418980]j4nn[/MENTION], it's done for my XZ1 DUAL. Many thanks. But when I unplug the phone from computer, then temp root will be reset, it is normal?

Ps: Do I need to worry/care about dm-verity?
[Sony Cross-Device General] p@to:
I can permanently uninstall bloatware, install adaway and other applications that need root..

I think it's said. But I need to ask.

Thank you
[Sony Cross-Device General] Klaus N.:
Yes, you can install and use e.g. adaway, AFWall+ etc.

But - as already mentioned in the op - it's not possible to modify /system and /vendor, due to dm-verity, which is still present with a locked bl. Therefore you can't get rid of bloatware, which is placed in /system or /vendor ;)
[Sony Cross-Device General] j4nn:
Actually you can remove bloatware permanently, but without gaining any storage space.

It is possible to do that via oem partition - there you can make modifications, dm-verity does not check oem partition.

It is possible to define which applications would be "removed", then even factory reset would not enable them again.

This way of bloatware removal is quite tricky, as you may need to test factory reset to see if the phone boots or not.

Such debloating can be done via early_config.xml in oem partition - there you can permanently blacklist apps with entries like this:

<string-array name="config_packagesBlacklist">
<item>com.amazon.mShop.android.shopping</item>
</string-array>
<string-array name="config_packagesFullBlacklist">
<item>com.amazon.mShop.android.shopping</item>
</string-array>
[Sony Cross-Device General] j4nn:
temp root for new targets available with bindershell-v2 - following targets added:

Xperia XZ1

G8343_47.1.A.12.150 (Freedom Canada)

G8343_47.1.A.12.205 (Freedom Canada)

SO-01K_47.1.F.1.105 (Docomo Japan)

SOV36_47.1.C.9.106 (AU Japan)

Xperia XZ1 Compact

SO-02K_47.1.F.1.105 (Docomo Japan)

XZ Premium

SO-04J_47.1.F.1.105 (Docomo Japan)

(offsets extracted from kernels from fully downloaded firmwares)
[Sony Cross-Device General] bigrammy:
Nice work j4nn :good:
[Sony Cross-Device General] p@to:
[MENTION=4418980]j4nn[/MENTION]

Thank you very much for the possibilities you give us due to your great work.

Once TA backup has been carried out, Magisk installed and changes made using root example install adaway, some Magisk module, etc.

These changes are maintained if we update firmware to Pie?

Can we continue using root with Magisk in Pie?

Thanks in advance
[Sony Cross-Device General] j4nn:
[MENTION=6283701]p@to[/MENTION], it's only a temp root. Once you power off / reboot, it is not rooted anymore, you would need to start the exploit again - just the last command starting magisk. Using magisk modules might work or not, it depends - magisk is used in a way here that it has not been designed in (normally it should be started from kernel's ramdisk before the original init).

You need to unlock and restore ta backup in order to get possibilities like custom kernels or full roms, pie or whatever...

The only permanent customizations may be done in oem partition. You could tune the blacklisted apps there in an oem version from pie firmware to prepare it for pie upgrade and then manually flash the rest of the pie fw skipping oem to keep the modded/debloated seetup in oem while running pie with still locked BL, obviously without root.

Or stick with the exploitable fw version (latest oreo) to be able to startup magisk after each boot, if you cannot unlock your BL.
[Sony Cross-Device General] anaconda875:
Hi [MENTION=4418980]j4nn[/MENTION], can we modify /etc or /cache? Of course we cannot with /system /vendor, but I have no idea about another place.
[Sony Cross-Device General] j4nn:
[MENTION=7338614]anaconda875[/MENTION], I believe /etc is a symlink to /system/etc. You could redirect it somewhere else and make changes there. But it would be only temporal, because content of / is coming from kernel's initramfs, that is not possible to modify persistently with just a temp root. You can modify /cache, but I am afraid there is not that interesting stuff to change there.

In my opinion, the most interesting stuff you can modify is the content in /oem, where you can permanently block apps (debloat) or change stuff related to wifi/lte calling.
[Sony Cross-Device General] anaconda875:
Many thanks [MENTION=4418980]j4nn[/MENTION]
[Sony Cross-Device General] Aviv_Gopax:
not works sov36 LB .

Solved

Realle work thanks j4nn
[Sony Cross-Device General] j4nn:
[MENTION=6019835]Aviv_Gopax[/MENTION], please do not full quote the very big opening post for no reason at all.

Instead you could provide some details from your test - what fw version do you have and a log from your test.
[Sony Cross-Device General] Aviv_Gopax:
Sorry hehe , Im Using Fw Oreo Build 106
[Sony Cross-Device General] j4nn:
[MENTION=6019835]Aviv_Gopax[/MENTION], I did recheck the SOV36 target offsets and I do not see a reason why it would not work.

Please post the log from the run of ./bindershell as shown in the OP in usage howto section - is not any error there?
[Sony Cross-Device General] tombbb:
downgraded to supported fw (G8342_47.1.A.16.20), and also followed all procedures on both old and new temp root posts, but only showed:

my bad, eventually learned how to backup TA with new method, thank you j4nn!

but I'm gonna unlock and restore some other day.
[Sony Cross-Device General] tb_:
[MENTION=4418980]j4nn[/MENTION] how did you find the offsets? from the stock kernel source code? I'm btw also interested in extracting the keys from the trustzone exploit before upgrading my device
[Sony Cross-Device General] j4nn:
[MENTION=1190484]tombbb[/MENTION], thank you for your donation, really appreciated.
[Sony Cross-Device General] j4nn:
[MENTION=1017159]tb_[/MENTION], cannot get to my PC for some more days to provide the details, but in the case of this cve the most important thing is the offset of the wait queue inside the binder_thread struct - the original poc assumes 0xa0 offset, while for yoshino 0x98 offset is used. That fundamentally changes the core of the exploit. I tried to adapt it similarly for XZ2,there 0xa0 is used,so original poc needs to be adapted. It would never work though, because of hw based mitigation - see my post here:

https://xdaforums.com/showpost.php?p=81689337&postcount=1528
[Sony Cross-Device General] jazzdglass:
I have an issue with my XZ1. Xperia companion app software repair couldn't fix it. I have tried many times. software is download and repaired but doesn't fix issue.

issue is that IMEI is null, WiFi Mac address is null, Bluetooth mac too null.

so cant connect sim card, cant connect wifi. it wont even turn on.

OEM unlock in developer settings is greyed out.

last resort I think is to use QUALCOMM repair tool. I still have my original imei and mac address.

but te tools don't recognize my device.

I don't know what driver exactly goes for XZ1 e.g. Qualcomm HS-USB Diagnostic loader 9091 or 801...… so many drivers in the QUALCOMM driver package to install manually. im not even sure whether to go in fastboot mode or download mode or adb mode to run the qualcom tool.

with the temp root, can I enable USB diag mode? I have seen the usb diag mode tool adb code. but wil it work with temp root?

or you have any other solution for me?

thanks.

PS I have flashed with newflasher,flashtool various FTF and nothing brings back the imei..
[Sony Cross-Device General] j4nn:
[MENTION=4179503]jazzdglass[/MENTION], I am not sure I fully understand your problem - your phone does not show an imei?

You can enable diag mode with temp root. But I am not sure if that could help.
[Sony Cross-Device General] jazzdglass:
Yes. It doesn't show an imei. And no mac address too. I'm surprised downgrading, and upgrading OS doesn't fix it. Xperia companion app repaired phone successfully but still no imei or WiFi mac.

Kindly check attached picture. I got that screen via a USSD code I got through Google. It shows there's an imei somewhere.

What do you think coukd help restore imei?

I need diag mode to rewrite thesame imei.

Imei tool can't currently detect phone
[Sony Cross-Device General] j4nn:
[MENTION=4179503]jazzdglass[/MENTION], your screenshots are in my opinion normal, there is wifi mac shown in the first line, the other lines would be used only if there were more than one wifi interfaces. imei is also shown in that second screenshot.

I would not recommend using any tool to "write" imei - all security stuff is most likely depending on imei or other device specific id. You may easily brick your phone for good.

I would recommend to flash full stock fw via newflasher including userdata.sin, so your phone would be on proper stock fw with factory reset. Just be sure you flash also the bootloader (you need boot subdirectory with 3 .sin files, .xml and .ta in it) and skip flashing persist.sin (but in your case that would not matter as your attest key is lost already anyway).

Do you have your TA backup from the time the phone still worked properly? Restoring that might also help in some cases.
[Sony Cross-Device General] jazzdglass:
No. I have no backup.

Yes that screen seem normal.

But *#06# brings nothing.

Wifi cannot turn on.

Check attached picture

Some guy on xda said he fixed a similar problem by writing imei with qualcomm tools. Here's the guy on post number 8.

https://xdaforums.com/xz-premium/help/imei-missing-t3887604#post81905237
[Sony Cross-Device General] j4nn:
[MENTION=4179503]jazzdglass[/MENTION], hmm, that is really quite strange.

Anyway, I would not try any "imei repair" tool, would consider that very risky to permanently brick the phone.

Try to downgrade to oreo 16.20 firmware, prepare the files as following, be sure all files are there as shown:

adspso_X-FLASH-ALL-C93B.sin
amss_fs_1_X-FLASH-ALL-C93B.sin
amss_fs_2_X-FLASH-ALL-C93B.sin
amss_fsg_X-FLASH-ALL-C93B.sin
appslog_X-FLASH-ALL-C93B.sin
bluetooth_X-FLASH-ALL-C93B.sin
boot/Lilac_XBootConfig_MiscTA.ta
boot/boot_delivery.xml
boot/bootloader_X_BOOT_MSM8998_LA1_1_O_82_X-FLASH-ALL-5D31.sin
boot/bootloader_X_BOOT_MSM8998_LA1_1_O_82_X-FLASH-ALL-C93B.sin
boot/bootloader_X_Boot_MSM8998_LA1_1_O_82_X-FLASH-ALL-5ADA.sin
cache_X-FLASH-ALL-C93B.sin
cust-reset.ta
elabel-G8441-row-row_201709190503668.1_47.1.A.12.205_X-FLASH-LTALABEL-C93B.sin
fota-reset.ta
fotakernel_X-FLASH-ALL-C93B.sin
fsmetadata_X-FLASH-ALL-C93B.sin
kernel_X-FLASH-ALL-C93B.sin
master-reset.ta
modem_X-FLASH-ALL-C93B.sin
oem_X-FLASH-CUST-C93B.sin
system_X-FLASH-ALL-C93B.sin
userdata_X-FLASH-CUST-C93B.sin
vendor_X-FLASH-ALL-C93B.sin

It happened to me one time that the phone would boot but reset in a minute or something. It seemed like there had been a problem to initialize modem, failing that caused a reboot, but that's just my guess, not really know, but I tried to do a factory reset, all userdata erase but nothing helped.

But it resolved by flashing full firmware but different version and booting it up.

Then I could flash the previous version to get it working again.

While you are at 16.20 oreo, you may backup your TA just in case for possible future use.
[Sony Cross-Device General] j4nn:
[MENTION=4179503]jazzdglass[/MENTION], please see my post here to enable diag mode. But as mentioned above, I would recommend first to try to switch stock firmware using newflasher and files as listed in my previous post.
[Sony Cross-Device General] yusuv:
Sir can you please check PM?

Or Ratel cell thread.
[Sony Cross-Device General] jazzdglass:
Thank you.

Unfortunately that didn't bring back the imei.

I honestly don't think no amount of flashing can fix that.

Something that targets the imei/efs partition is the only way.

After gaining root, the USB diag couldn't be enabled.

See attached
[Sony Cross-Device General] j4nn:
[MENTION=4179503]jazzdglass[/MENTION], did you test the diag mode with oreo or pie firmware version?

The diag mode is supposed to work with oreo firmware, while it is reported not to work on pie.

The beginning of my post here shows just 3 commands that enabled it in my case.

You would better check usb device properties listed on your PC (what interfaces the phone provides), when you do that - maybe you need some driver on windows.

With linux you can see the change in desktop's kernel log (dmesg -w) and nicely list the interfaces with lsusb.
[Sony Cross-Device General] jazzdglass:
I did with the 16.20 firmware required for temp root.

---------- Post added at 11:35 PM ---------- Previous post was at 11:32 PM ----------

I didn't get any message from you
[Sony Cross-Device General] j4nn:
[MENTION=4179503]jazzdglass[/MENTION], please check the Empty or 00000 imei happened on custom rom thread.

There seems to be someone with the similar problem...
[Sony Cross-Device General] rcmiku:
thank you for your time and hard work!
[Sony Cross-Device General] zeg33:
is there any way to keep root ? magisk will lost install in minutes after unplug from PC ~~~
[Sony Cross-Device General] lawong:
can i know what the benefit to have root in bootloader locked? tried to apply adaway but it failed .
[Sony Cross-Device General] j4nn:
[MENTION=4189287]zeg33[/MENTION], magisk root should be available after setting it up from temp root even after exiting adb shell and disconnecting from usb, but only until reboot.
[MENTION=2983581]lawong[/MENTION], well if someone is not allowed to unlock BL (or just does not want to), it is better than nothing. Some magisk modules may actually work, if implemented "system lessly" properly and would not need to be activated too early during boot. For some may help to restart involved/depending processes.

I can imagine that some form of ads removal can work, but not tested, cannot recommend a particular app or module.

And you can also use apps that require root, like iptables based firewall or any data backup apps.
[Sony Cross-Device General] zeg33:
oh I found the cause , the WifiADB restart the adb service make root lose ~~
[Sony Cross-Device General] Ajih96:
hye, sorry for asking, may i ask you how do you implement this to work on specific fw? i hope you dont mind if i asking you this. sorry for my bad english. btw can we use this with latest magisk?
[Sony Cross-Device General] j4nn:
[MENTION=9770595]Ajih96[/MENTION], well that would be hard to explain, it requires good knowledge of linux kernel internals and reverse engineering abilities. It is different case by case. There is no universal howto, sorry.

Only the listed magisk version is tested, replacing it with different one might work or most likely not as magisk init changes a lot between releases.
[Sony Cross-Device General] Ajih96:
[MENTION=4418980]j4nn[/MENTION] ohhhh thanks for your respond. its ok. its very hard for me to understand all of this. i will learn it later :laugh::laugh::laugh: .... btw i try with latest magisk now its work perfectly.
[Sony Cross-Device General] Tifs:
Thanks [MENTION=4418980]j4nn[/MENTION] for your effort.

Now, all the years I've spent with stock Android 8, denying any attempt to upgrade, make sense :)

Finally, I own the f**d phone, not the opposite.

Even though there is no write access to /system and /vendor, it's possible to access all applications data directly, and control the system. It's not hard to apply the changes every time after reboot.

By the way, I found that adb shell is not necessary to root the phone after reboot. It's possible to setup proper SELinux context on /data/local/tmp/bindershell from root shell:

G8441:/data/local/tmp # chcon u:object_r:system_file:s0 ./bindershell

And after that, you can reboot and launch

G8441:/ $ /data/local/tmp/bindershell
...
got root, start shell
G8441:/ #

from your favorite Terminal app inside the phone on the go, there's no need for PC and adb.

I guess it's possible to setup Magisk that way too, or even create an app with desktop icon to automate this. So you will only need to click it once after reboot.
[Sony Cross-Device General] j4nn:
[MENTION=642207]Tifs[/MENTION], that is a good find, thanks.

And thank you very much for your donation, really appreciated.

Edit: added a link to post#41 into the first post.
[Sony Cross-Device General] KuriKai:
[MENTION=4418980]j4nn[/MENTION] I'm running G8441_47.1.A.12.235 Hong kong and compiled bindershell with

this added to offsets.c

{ "G8441_47.1.A.12.235",
(void *)0xffffff800a903460, (void *)0xffffff800a903270, (void *)0xffffff800a8ffdb4, (void *)0xffffff800a614490, (void *)0xffffff800a61deb0 },

and I believe I got root, is there any other way to confirm?

G8441:/ $ cd /data/local/tmp
G8441:/data/local/tmp $ chmod 755 ./bindershell
G8441:/data/local/tmp $ ./bindershell

bindershell - temp root shell for xperia XZ1c/XZ1/XZp using CVE-2019-2215
https://github.com/j4nn/renoshell/tree/CVE-2019-2215

MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: Reading leaked data
PARENT: leaking successful
MAIN: thread_info should be in stack
MAIN: parsing kernel stack to find thread_info
CHILD: **fail** problematic address pointer, e.g., 0
PARENT: Reading leaked data
PARENT: Reading extra leaked data
MAIN: **fail** retrying
PARENT: Reading leaked data
PARENT: Reading extra leaked data
PARENT: leaking successful
MAIN: it took 1 tries, but succeeded
MAIN: task_struct_ptr = ffffffea63750d80
MAIN: thread_info_ptr = ffffffea8191c000
MAIN: Clobbering addr_limit
MAIN: should have stable kernel R/W now
kaslr slide 0x63a600000
selinux set to permissive
current task credentials patched

got root, start shell...

edit1:

Whoops, I updated magisk without unlocking my phone. now I get,

"Your device has failed verification and will not work properly

Your phone will be powered off in 5 seconds"

I can get to fastboot mode and also flash mode

I did make a TA backup first though, is there any way to recover?

Edit2:

Nevermind i managed to flash XPERIASITE.PL_XZ1_Compact_G8441_8.0.0_47.1.A.12.235_Switzerland (i deleted persit and the .ta files from it before flashing with newflasher

I have also been able to do the temp root again using the bindershell i compiled
[Sony Cross-Device General] j4nn:
[MENTION=4110097]KuriKai[/MENTION], ouch, such a mistake, to upgrade magisk from temp root... glad you could recover though even without unlocking...

I was not that lucky one time (with different exploit) as flash mode could not be started (and even did not make any such mistake)...
[Sony Cross-Device General] initguru:
Dear [MENTION=4418980]j4nn[/MENTION],

I have G8341 with 47.2.A.11.228 fw.

Is there a temp root method to use on that device?

I would like to try another rom but also worry losing DRM.
[Sony Cross-Device General] j4nn:
[MENTION=5019006]initguru[/MENTION], just downgrade to G8341_47.1.A.16.20 firmware and use the temproot exploit in this thread including temporal magisk startup.

For trying custom roms (and permanent root) you would need to unlock though.
[Sony Cross-Device General] initguru:
I have a korea variant so that I checked fw sites and only can see this:

G8341 Customized KR_1310 7342 47.1.A.12.75 R8B.rar

Looks like 47.1.A.12.75 version.. Is it possible to use that fw?

Thx!
[Sony Cross-Device General] j4nn:
[MENTION=5019006]initguru[/MENTION], just flash the listed fw, it is compatible, different customization is not important.

Particularly if you wanted temp root for TA (drm key) backup - you could do it and then flash back.

Also you may possibly flash oem from oreo Korea firmware instead of oem.sin from the listed fw, that may also work, depending if there are significant differences in system or not.
[Sony Cross-Device General] shahidaffan:
I Want to unlock bl and i m on oreo fw, is there any way to relock bootloader completely to it original state (like warning ⚠ splash screen after every reboot). So my question is which partitions should i copy before unlocking bl so that after restoration of ta/partition there won't be any warning splash screen. Thank You.
[Sony Cross-Device General] j4nn:
[MENTION=5911532]shahidaffan[/MENTION], I am not aware of any way to relock the bootloader.
[Sony Cross-Device General] nitrams:
Hi. Please help us to add xperia 10 on the device list that could run the exploit. We only have few devs with this mid range phone and i think having it to be able to have temp root, unlocked bl with ta back up can let us do more. Thank you in advance!
[Sony Cross-Device General] kaakkuri:
Help needed

Hello, i have just bought myself xzp and it is running pie atm. If i use this exploit after downgrade to oreo will it give me ta-backup so i can unlock bootloader or do i need to do something else? And if what? My goal is to have existenz running on my phone like in all my previous xperia models have.
[Sony Cross-Device General] j4nn:
[MENTION=5218338]kaakkuri[/MENTION], yes, you can downgrade and use this temp root to backup TA, similarly as with renoroot.
[Sony Cross-Device General] j4nn:
[MENTION=10802311]nitrams[/MENTION], xperia 10 kernel is not vulnerable to CVE-2019-2215, at least the two kernel source packages (53.1.A.2.2 and 53.0.A.2.139) released by sony contain the fix for it.

These two kernels are not vulnerable to CVE-2020-0041 either.
[Sony Cross-Device General] ezdi:
Got it working with G8441_47.1.A.12.205 using the same offsets as .8.49 and .16.20. I'd guess it'll work with everything in between those two.

I was too lazy to set up a build environment for the experiment so I just used a hex editor to rename the SO-02K in the ELF.