yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=5649361]Mike7143[/MENTION], to provide root access to apps, root manager like magisk is needed.

It can be started from an exploit (possibly with a bit limited functionality) as shown in this thread. Unfortunately that old magisk does not work with android 10.

I tried to start up latest magisk from the exploit, but it ended with magisk manager detected magisk root alright, but I could not make sending notifications from apps to ask magisk for root permission somehow.

So currently only the shell is available, allowing for example to backup still locked TA partition.

You can do small changes in /system, but if you would not get red triangle on boot, it would possibly revert the change.

You can modify stuff in /system on runtime "system less-ly" exactly like magisk does it though, using bind mounts.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] bruno$0:
Is this method compatible with lasted firmware? (.672)

Is this safe relock the bootloader with my backup? Nothing breaks?

Btw, amazing job! Now i think aosp project Will get more users. Hope xz3 get more popular in custom scene.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] SGH-i200:
Thanks for mentioning the VoLTE modem config on still locked XZ1 devices! Somehow I didn't read that in the XZ1 thread. Good to know! Maybe I won't unlock the bootloader of my backup XZ1, because adding VoLTE for my German telco provider Congstar to the stock firmware is enough for my use case.

Too bad there is no possibility to restore the TA partition on the XZ2c yet. On the XZ1 this opened the door to real freedom! :)
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Mike7143:
So... if I'm reading this right, even just backing up the TA partition on the XZ2C caused something to break, forcing you to unlock? I was thinking maybe I should figure out how to backup my TA partition as well just in case in the future there's a fix, but if it's going to break it by just backing it up, that's an issue as well.

---------- Post added at 11:52 AM ---------- Previous post was at 11:42 AM ----------

So, basically all we have is temp root via adb shell. Doesn't seem that magisk works. I guess I'm not sure what you mean by "small" changes in /system, what is "small"? Coming from a 2013 Moto X developer edition that I could do anything with I'm really missing adaway and youtube adaway on my new XZ2C H8314. Not sure if modifying my hosts file would be considered small or not, and that doesn't take care of youtube adaway of which I'm not even sure how that works. DNS666 seems to be an alternative to adaway but it's not taking care of youtube.

Regarding modifying /system "system-lessly", I'll admit I'm a rookie when it comes to this stuff, I either have a lot to learn/read up on or wait for an easier to use app/workaround.

It seems like in your XZ1C post you and others were working on getting the XZ2C sorted out but since decided to go back and focus on the XZ1C?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=8910837]brunos0[/MENTION], the exploit cannot work with .672 firmware, the kernel in it already contains the vulnerability fix.

There is the list of supported targets / fw versions in the OP...

I am not aware of any method that would allow you to re-lock unlocked xz2* phone.

[MENTION=1995555]SGH-i200[/MENTION], yes, I believe it should be possible to temp root oreo running xz1, from it flash your pie's oem partition, modify it according to your needs and upgrade with newflasher to latest pie skipping flash of oem partition, getting you latest stock pie with modified oem...

Concerning TA restore on XZ2c (or any other tama platform phone): it actually _is_ possible to easily restore TA partition from locked state backup, returning your device key (aka drm keys) back.

But it somehow seems the firmware does not use it anyway for some reason. Unfortunately even kernel hiding bootloader unlock does not help like it did with xz1* phones.

So it might happen that someone discovers a way to make drm features work if you have the keys restored from locked TA backup...

[MENTION=5649361]Mike7143[/MENTION], no, that is a misunderstanding... That linked post, where I describe my initial exploiting of xz2 - that has been completely different exploit. That exploit has been originally designed for xz1c, ported partially for xz2 and in the process of trying/testing/implementing it, something broke... It has nothing to do with just released CVE-2020-0041 based exploit for xz2* phones.

So this new exploit is perfectly safe, only doing changes in RAM of linux kernel to escalate to root user with selinux changed to permissive.

After a reboot all is gone, no root or anything left from the exploit...

So you can safely backup locked TA to preserve the device key (drm keys) for future use.

Concerning changes - simply forget changing /system or /vendor or kernel boot partition.

It is however possible to use bind mounts to make "changes" on runtime, but that requires some knowledge obviously.

Maybe I can fix setup of magisk from the temproot exploit, but no promises, spent already huge amount of time on that and getting out of ideas unfortunately.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Mike7143:
Thanks [MENTION=4418980]j4nn[/MENTION] for the reply. So you're saying that simply backing up the TA partition now while on this version and have temp root access shouldn't cause the phone to break? If so, I suppose it's worthwhile to get it backed up in case there's ever a future solution to restore it and have the system recognize it. Is the below quote from your OP regarding temp root on XZ1C how I'd backup my TA partition on my XZ2C?

If so, seems pretty straight forward to backup the TA partition with my DRM keys!

Regarding systemless changes with bind mounts, I'll have to look into that. I found one post here that seems like it's just making a link to another location that perhaps might work, but perhaps even just swapping out a file for a link might not be safe. I'm probably better off just waiting for someone to make more user-friendly tools and then make donations vs. trying to learn on my own and risk breaking my device!

If I can find a cheap/broken screen H8314 I might be able to buy it if it'd help with development of getting the XZ2C to be unlocked/rooted and retaining all the Sony features. I plan on using this phone for a while just like I just traded my 2013 Moto X for the XZ2C in 2020!
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=5649361]Mike7143[/MENTION], yes, that's the way to back up TA even in case of XZ2* phones.

Here is an example to use bind mount to change hosts temporarily on runtime from a root shell:

akari:/ # cd /data/local/tmp
akari:/data/local/tmp # cp /system/etc/hosts .
akari:/data/local/tmp # mount -o bind hosts /system/etc/hosts
akari:/data/local/tmp # echo "127.0.0.1 some.url.com" >> /system/etc/hosts
akari:/data/local/tmp # cat /system/etc/hosts
127.0.0.1 localhost
::1 ip6-localhost
127.0.0.1 some.url.com
akari:/data/local/tmp #

as it is only a mount, the change is done in /data/local/tmp/hosts in fact, that can be seen like this:

akari:/data/local/tmp # umount /system/etc/hosts
akari:/data/local/tmp # cat /system/etc/hosts
127.0.0.1 localhost
::1 ip6-localhost
akari:/data/local/tmp # cat /data/local/tmp/hosts
127.0.0.1 localhost
::1 ip6-localhost
127.0.0.1 some.url.com
akari:/data/local/tmp #
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
As it seems .618 fw versions get missing from xperifirm, please let me know if you need some - I still have following:

H8116_Customized IBE_1313-3189_52.1.A.0.618_R3C

H8166_Customized FR_1313-2540_52.1.A.0.618_R4C

H8216_Customized UK_1313-4679_52.1.A.0.618_R5C

H8266_Customized FR_1313-2481_52.1.A.0.618_R4C

H8296_Customized TW_1313-6119_52.1.A.0.618_R4C

H8314_Customized FR_1313-2468_52.1.A.0.618_R4C

H8324_Customized FR_1313-2469_52.1.A.0.618_R2C

H8416_Customized IBE_1316-6423_52.1.A.0.618_R5C

H9436_Customized FR_1316-3076_52.1.A.0.618_R6C

H9493_Customized HK_1316-2331_52.1.A.0.532_R2C

so I may upload it on request.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] SGH-i200:
I would be happy, if you mirror "H8324_*_52.1.A.0.618_R2C" for me! :) I forgot to check Xperifirm right after I read about your new temp root success. Shame on me.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Mike7143:
I tried to backup TA partition on XZ2C H8314 on 52.1.A.0.618 using temp root but when I run the line

dd if=/dev/block/bootdevice/by-name/TA of=TA-locked.img

I get

dd: TA-locked.img: Required key not available

Any ideas? :confused:
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=1995555]SGH-i200[/MENTION], you can download it here:

https://androidfilehost.com/?w=files&flid=312525

H8324_Customized FR_1313-2469_52.1.A.0.618_R2C.zip

[MENTION=5649361]Mike7143[/MENTION], you are right, it seems there is some limitation with the root permissions. I will check it. Probably would need some extension in the exploit.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Mike7143:
Thanks for verifying that it wasn't something I'm not doing correctly! Just out of curiosity, I'm assuming that your XZ2C was on Android 10 and you had to unlock the BL to get it working again? Would you be able to provide a list of things that are now broken due to the unlock and loss of DRM keys so that folks like myself might be able to weigh whether or not we want to unlock? I'd really like to know exactly what I'm giving up, at least today on Android 10 for an unlocked BL so I can weigh the pros and cons. I'm not sure if you're familiar enough with the XZ2C and know what all features it had before and what's gone missing/broken after.

I can read lots about what's been broken and not on past versions of Android, but I'm not finding a lot of info yet on what's changed in Android 10, if anything. I have read that BL unlock on Android 10 doesn't break the camera anymore but it's unclear to me if reports are that the camera is no longer completely broken (green screen) but any Sony processing perks are gone, or if the camera and all the Sony stuff related to the camera and image processing are no longer affected.

Thanks!
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=5649361]Mike7143[/MENTION], my xz2 unlock has been done on 52.0.A.8.131, that is a pie firmware. That time (2019-10-03) android Q had not been available for xz2 yet.

So I cannot help you with those questions, sorry.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] difkey:
Hi, j4nn.

Already asked before - can you make an update for SO-05K (XZ2 Compact Docomo) support?

I understand that the exploit only works with an identical kernel image.

I understand that this exploit is for tama platform.

I have Xperia XZ2compact Japanese version SO-05K too.

I tried to test the exploit.

Naturally, after trying to execute the exploit, it became clear that it was not supported for this firmware.

I found downloadable android 10 firmware - SO-05K_NTT DoCoMo JP_52.0.B.9.316-R11B

Can it be exploited?

Can you explain what changes need to be made in exploit for it to work for firmware SO-05K_NTT DoCoMo?

Kernel image is available at Goole drive: here
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] didine7607:
Hi everyone, i have xz3 dual sim H9436, so i downloaded the fw posted here as it's recommanded to use temperoot, i just wanted to install pixel launcher so i can use gestures feature ...the installation of the fw went flowlessly no problem at all, but when i temperooted and installed the folders of pixel launcher on oem folder then reboot, my phone freezes everytime when xperia is about to display, it restarts then reboot when xperia shows up over and over, ( FYI in the past i unlocked my bootloader in hope to root it and install custom roms, but after i unlocked it, i wasn't able to root it because there's simply no way to do so with xz3) so now i'm posting here hoping to find some help please :(
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] mak6021:
Not something complicated to get Root Magisk, just patch boot and boot via fastboot if you want give instructions, but I need your boot and vbmeta of firmware
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] didine7607:
Thank you, i Just want the Phone to boot after that and get access to gestures. Where can i find my boot and vbmeta of firmeware ? Because i installed the one posted here, download link for H9436 dual sim

Edit:

i'm not sure if these are the files you asked for, i found them on main folder after extracting the 3 zips, and the boot from boot zip

https://drive.google.com/file/d/1wlZrwxgiPoaWjlrNel0sQNXLpnJqUSl4/view?usp=sharing

https://drive.google.com/file/d/1npIAB9E4mTdGvL7uY3qv54R1FlF63AM6/view?usp=sharing
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] didine7607:
sorry for double post :/
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] mak6021:
The second link is wrong!! Okay if you have this version, follow the instructions below.

Connect the phone in fastboot mode (Turn off the phone, hold down the volume key \ + \ and without releasing it, connect the smartphone to the computer, wait for the blue LED to light up, then you can release the key). Open the files one by one (after opening and executing the command, they close themselves) 1vbmeta.cmd -> 2boot.cmd -> 3dtbo.cmd -> 4reboot.cmd ... Good luck
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] didine7607:
Thank you very much 🙏. Will try it tomorrow, just one question : is this supposed to get rid of bootloop ? Or to root ? And if it's the first answer, can i still boot and find the pixel launcher ?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] didine7607:
i'm trying to do exactly what you told me, but nothing happen when i click on each command, am i doing something wrong ?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] didine7607:
nvm, it was drivers issues, i managed to install all the 4 scripts, the phone rebooted, this time it went a little bit further, at first it was restarting at "exper..." now i can see xperia fully on screen for couple of seconds, then bootloop...please, help me to fix it
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] goriath:
I hope to see a reply to my post since the topic seems become a minor trend and the autor more likely has other things to do in life, BTW...

I have an Xperia XZ2 compact (H8314), stock, unbranded, CustomIT region, with Vodafone sim card (I live in Italy) - latest Android 10 sony ROM installed 52.1.A.3.49

All I wanted (...for xmas) was VoLTE, since my carrier provide the service, although the phone isn't listed in their "Very Important Phone" list (actually no SONY device is listed). It's vital for me get VoLTE since my carrier has removed 3G and 2G coverage is getting worse - so no 4G in my case means no inbound/outbound calls at all...

If I don't manage to solve the problem, more likely I'm going to change the carrier rather the phone, but that's not the point...

The question:

With the info in the OP would be possibile...(?):

-Downgrade to a target fw (since mine isn't supported)

-Temp root the phone

-Install a custom recovery (TWRP) w/o UBL

-Then upgrade to major release again

-Mod the phone in order to support VoLTE (by editing build.prop like I have heard...) ???

Or there is something I miss?

I spent the last 3 days seeking and reading for a strategy but everything seems to be about unlocking the BL at some point and I don't want to (you know the reason....I read in this thread that even if you could temp root the phone to backup locked/unlocked TA partitions, with DRM keys intact in order to restore them later, the phone is not going to accept keys anymore...)

Many thanks
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] mirhl:
Build.prop isn't gonna get you anywhere.

It's not a problem with your phone, but the carrier (which is certainly a joke when it can certify super cheap alcatels and 6yo lumias, but not xperias)

https://xdaforums.com/t/unlock-all-...device-use-your-phone-globally-no-bs.2871269/

https://xdaforums.com/t/guide-enable-volte-for-your-non-operator-handset.3816565/

https://xdaforums.com/t/volte-on-tmo-and-fingerprint-sensor.3666387/page-6#post-74159245

https://xdaforums.com/t/volte-and-w...cs-and-probably-other-t-mobile-mvnos.3880189/

https://xdaforums.com/t/xz1-compact...int-wi-fi-calling-step-by-step-guide.4502093/

https://xdaforums.com/t/porting-t-mobile-volte.3670023/#post-73829118

https://xdaforums.com/t/volte-succe...lacement-sony-mobile-withdrawal-area.4144701/

https://xdaforums.com/t/guide-enable-volte-for-unsupported-carriers.3892659/

QualcommMBNs/extracted/mbn/Nokia/8/mcfg_sw/generic/eu/vodafone/volte/italy/mcfg_sw.mbn.json at master · JohnBel/QualcommMBNs

Contribute to JohnBel/QualcommMBNs development by creating an account on GitHub.

github.com

To be sure there's nothing you can't do if you unlock the booloader (even though, I don't really know how much work it could still entail). But there's some small chance you could still manage to pull it off with just temp root and QPST, maybe.

This isn't really the right thread though.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] accadiaantonio:
Salve, potrei avere anche io la rom per xz3?grazie
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Samir solanki:
No bootloader unlock required to get volte
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
@goriath you can downgrade fw in order to temp root, then modify settings in oem partition in order to enable volte (oem partition is not verity checked) and then upgrade to the latest stock fw, without need to unlock nor twrp.

You just need to prepare the changes in oem in a way they would work with the target firmware.

There are threads about enabling such stuff in oem partition of sony phones, just search for it.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] cuynu:
Haizz, need switch from qualcomm modem to edl 9008 to test universal bootloader unlock.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] goriath:
Upgrading to the latest FW is not going to overwrite changes to OEM partition?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] depkagura:
please bro update magisk24.1 for temproot
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Chris4869:
Does this work in SO-01L(DOCOMO)? I have try but cant work in 52.1.B.0.239
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] xperia_lily:
Could you upload H8296-52.1.A.0.618 - xperia XZ2 dual and H8296_Customized TW_1313-6119_52.1.A.0.618_R4C.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] JD_9:
Many thanks @j4nn
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] raavanaa_lk:
Can you help me to unlock my bootloader,
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] DikanR:
i am very happy with this root method. but is it possible to have tama-mroot updated to the new version? because when i tried to update the root myself with the magisk app, it always broke my phone. the new magisk root version has zygisk and i really need it. and i would very thankful if the tama-mroot could be updated.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] diba pranasta:
Hi rdhany, can you show me how to replace the firmware list? Iam using xz3 softbank.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] mak6021:
Hello, can I use magisk modules?

And what buns can you make in your xz2?

No harm to the system on the locked bootloader, thanks.

How to run via terminal to run root? more details? through the pc received No problem.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] cuynu:
Yess. No harm to system
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] seyrarms:
Hello u can find this rom if u using Xperia Companion. They have option for repair and u get a rom after they downloaded for repairing ur device.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] seyrarms:
Hello buddy can this tutor using to sony xperia xz3 japan? Im already with the same android 10 and kernel 4.9
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] xz3user:
Hi everyone, I need some help here with my XZ3 SOV39 variant. I've downgraded from the latest SOV39 ROM to the global ROM mentioned in the top post using newflasher tool. I've successfully installed the Oneplus launcher into the oem folder and enabled the gesture navigation using the temp root method. However, my phone has lost the VoLTE function in the meantime after flashing the global FW.

So my questions are,

1. What are the steps to upgrade the firmware to the latest version without modifying the oem folder and losing the launcher?

2. Is the availability of VoLTE strictly tied to the OEM version or the firmware version?

3. Is there anyway to fix the VoLTE using the temp root method, for example Magisk modules? If not, would VoLTE work again if I flash the latest global firmware with the original Japan OEM partition?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] xz3user:
Does anyone know how to flash Japanese AU OEM part into the temp root target firmware? I was getting bootloops when I tried to do that.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
just uploaded the fw version you have requested:

H8116_Customized IBE_1313-3189_52.1.A.0.618_R3C

H8166_Customized FR_1313-2540_52.1.A.0.618_R4C.zip

H8216_Customized UK_1313-4679_52.1.A.0.618_R5C

H8266_Customized FR_1313-2481_52.1.A.0.618_R4C.zip

H8296_Customized TW_1313-6119_52.1.A.0.618_R4C

H8314_Customized FR_1313-2468_52.1.A.0.618_R4C.zip

H8324_Customized FR_1313-2469_52.1.A.0.618_R2C.zip

H8416_Customized IBE_1316-6423_52.1.A.0.618_R5C

H9436_Customized FR_1316-3076_52.1.A.0.618_R6C

H9493_Customized HK_1316-2331_52.1.A.0.532_R2C

and added to the first post too
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] yosia_ryan:
Hello, I know from someone that version 52.1.B.0.188

sony xz2compact docomo (SO-05K)

can be temprooted.

I already got

boot /kernel,abl,aop,bloototh a10 version 52.1.B.0.188 (SO-05K).

can someone develop and build an exploit for xz2c ( SO-05K) please help me :)
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
Hey

Its finally possible to update magisk on temprooted xz3 and other devices.

I will publish a post
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
Why not you just crossflash to target version of xz2c and get temproot .

It's simply as easy as pie
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
No that's not possible

It wil surely break system

You have to sacrifice and lose VoLTE if you want temproot
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
It is onlly possible for global version

You have to crossflash to targeted global version fw if you want temproot

And you will lose VoLTE
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
You can try with this app if you have xbl partition backed up from bootloader unlocked device

It have partition manager and it is working

I dont know if it will work or not
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] seyrarms:
Nope I'm already using temproot for XZ3 AU SOV39 without using rom Global 😂 it's ok, maybe at soon I'm make tutorial use for docomo, softbank and au temproot in xda. Btw for volte it's not lose for my country can be used since IMS not registered so I need time for fix this
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
Glad to know that

Btw is there any possibility to unlock bootloader without s1unlock tool

And how can we boot into edl mode.

it was possible for lg v50 i think by flashing xbl partition backed up from unlocked device

Having non unlockable bootloader device is headache.

Im gonna never buy sony mobiles again😑😑