yashsingh1/xdaforums huggingface dataset:
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] seyrarms:
Hmmm someone ppl the last time try open unlock bootloader from backup boot.img from root device but this person get hardbrick and someday this person back again and said the device already unlock bootloader. Idk this possible or not since this person not said the detail how be can possible about that. For XBL partion someone wanna try this. But my problem is sim lock. AU provider give locked for network subset. I need know how be possible open this without s1unlocktool if do.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
Hmm it means no chance
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] yosia_ryan:
Done , temproot xz2c sucsses fully ,

someone has managed to make it for my xz2c
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
Good to know that
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] robberer:
Does anyone has a working firmware for Germany ? For example 1313-6204 Customized DE 52.1.A.0.618-R3C . The French firmware in the initial post disables Wifi Calling on my device.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
Hey buddy from last 3 days I am facing an issue

After getting temproot apps are not working even not opening

I tried flashing fresh firmware and getting temproot still same problem

Do you know how can I fix it?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] seyrarms:
Did u mean app bank?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
No

I meant all normal apps

Including system apps even settings and also everything becomes unresponsive like I cant unistall apps even cant shutdown or restart the mobile I had to force restart by buttons

But luckily I have figured it out

For some unknown reasons a module is causing the problem as i had recently updated it

Will try removing that with adb but if it failed

I will need to reflash firmware
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] vhandeerzhul22:
Can u edit the imei number in the qcn file and flash it back to the phone...? Are the imei number Can change with this metode...?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] yosia_ryan:
no it has no change even in sony xz1 buckup qcn corrupt
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] hasel17:
can you share your way how to temproot your xz2 compact docomo? I need it too.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] yosia_ryan:
Sure, you have to be on tail firmware 188 or android 10 first
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] yosia_ryan:
SONY XZ2&XZ3 INDONESIA | 🇲🇨 🇵🇸

Selamat datang di grup jangan lupa sebelum bertanya silakan baca dulu aturan di topik FAQ.	SONY XZ2 / XZ2c / XZ2p / XZ3 Japan dan Global Varian.

t.me

You should join our group, it's very interesting you will get temproot xz2c there
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] hasel17:
oh, ok. I'll downgrade the firmware first. i'm on .266 right now
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Aozora69:
Just info i managed to use magisk delta in temproot

Link: https://t.me/fKobO94fU7NjMzJl/566
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Unique Cyrus:
Hello I've just tried to flash one of them but it turned out a corrupt message on booting. How can I successfully flash that ROM? Many thanks.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] dev3230:
Hello,

I want XZ2 Compact DOCOMO rom which has temproot access.. Someone told me to download 188 build firmware.. but its not available on internet...
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] AlexHunt099:
Hello, I need temp root ROM for XZ2 SO-03K docomo device as i can't find the correct temproot firmware for this nttdocomo device. Can you help me with it? Thank you in advance.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] xperia_lily:
Where is tama-mroot posted for the new magisk?

I don't understand where you are posting
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] uzairale:
I'm quite busy these days and I no longer have that device that's why I didn't posted anything but you can easily do that at your own just search on YouTube there are few videos explaining the method it's quite easy .try that if you still need help after that you can let me know.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] xperia_lily:
thank you

new version available

but zygisk was not support

I didn't get the results I wanted
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] project_2501:
@cuynu , does the github repo for the edl firehose.bin allow for bootloader unlock and bypass the config flag for unlock allowed = (yes || no)?

@j4nn , is it possible to just replace abl with a copy from an identical device that has already been unlocked to bypass bootloader unlocking (essentially unlock the device by forcing an unlocked bootloader onto the device)? Where is config reading the bootloader unlock value from, the TA; Isn't there a bit within nvdata somewhere to alter instead?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] mirhl:
That seems what they have been proposing here

https://xdaforums.com/t/xz1c-xz1-xz...o-backup-drm-keys-implemented.3795510/page-60

And while I can tell you many people bricked their phones by just manually changing the ROOTING_ALLOWED bit, I could almost swear somebody had once managed to hack that by playing with the emmc, the RCK_H/RCH_H hashes and/or using the IMEI of another phone (even though they broke network connectivity then.. or was this just about simlock?).

Anyway, regardless of the dilemma about whether the hashes are computed or merely fetched from a big lookup table, the solution until now has just been to be pitiful enough with your OEM/carrier, or use paid services like qUnlockTool.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] asdf2345:
Can you find offsets for SO-05K? I have no idea how to find offsets, and I can't find anything about it online.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
@project_2501 edl mode is useless with xz2* devices - it requires sony signed firehose loader which is not publicly available. Even if you could get it, there is no use of it as it requires sony sake authentication for allmost all edl commands, no way around that.

There is no option to replace ABL in any way with a locked device as it is signed by sony.

You need to differentiate between sony way of bootloader "unlock" which just changes a flag (most likely stored in RPMB) to allow boot of unsigned kernels (and so to allow custom android roms), but the bootloader itself (ABL) is still the one signed by sony and cannot be replaced even after the "unlock".

There exists development samples of sony devices that have secure boot not enabled and there you may be able to replace the bootloader or even use commonly available firehose loaders for qualcom devices. But what would be the point as the device is not locked in the first place.

You can never turn a retail phone which has always secure boot enabled into one with secure boot disabled.

Official bootloader unlock method simply allows to boot unsigned kernels.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] project_2501:
@j4nn ,

There is a way to trick the loader to run as a development device (could not one simply dd the dev loader?). I've discovered from swapping boards (setting one from yes to no) that there must be a method to write/inject somewhere in volatile memory the flag to allow the unlock of the loader. I understand the signed binaries and what is going on, but I'm reluctant to believe there is not an undisclosed method for setting a variable without the sake key and remote decryption of the TA to write to it. Something onboard elusively has permission to write to the TA (sim-lock?) or can override/overload what is stored, @munjeni has assumed such as well. Considering how much time it will take to discover the exploit, it might be more cost effective of one's time to just pay the questionable qunlocktoolers.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] asdf2345:
However it would be cool to like run global firmware on Docomo devices
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] project_2501:
If the device is Docomo branded and is network unlocked, switching to global firmware is simple; NFC function is lost (can somone clarify why exactly?) and the modem may need further modifications to work properly depending on the network in use.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] asdf2345:
I had picked up one and tried to get global firmware on it, but was unable to. I was able to get Android 10 and VoLTE (but no data) working, but I ended up returning it.

For NFC, seeing that the NFC logo is different on the Docomo XZ2C, I'm guessing the hardware was replaced with something else, or isn't there in the first place.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] project_2501:
Maybe I should provide the firmware bundles to change Tama network locked devices to the global build to reduce the requests flooding the thread for the exploit to be crafted for their variant?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] project_2501:
@j4nn ,

I wonder if CVE-2020-13799 might be possible to adapt for use on the Tama devices? Placing an already unlocked ABL partition (which rewrites to dev once unlocked) onto a device with the flag set to no (ABL was com, and successfully changed it to dev) displayed for a split second yes in the configuration for bootloader unlock, and then switched back to no.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] asdf2345:
I would like to know how to flash global firmware on one, but I did figure out how to get temproot.

Android 8/9 for this device isn't vulnerable to this exploit or the XZ1C exploits. This exploit requires Android 10.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] project_2501:
I will post a thread and guide for the market/region change for the Tama platform sometime soon - which will in turn bring a whole new wave of devices being sold with locked loaders and global firmware :eek:. Discussion on this thread should mainly be for root exploits that allow customizing the stock software and maybe leveraging of the loader if @j4nn chooses to discuss such openly.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
@project_2501 it is not possible to change bootloader in any way - it is signed with retail key.

Even if we had development sample's bootloader (we /or at least I/ do not have it), it would not be accepted in a retail phone, because it would not validate with retail signing key that is the phone fused with - flashing such bootloader would make that phone a hard brick with no way to rescue it.

Even though CVE-2020-13799 looks interesting, I do not see any way how to use those vulnerabilities in xperia devices case.

> I'm reluctant to believe there is not an undisclosed method for setting a variable without the sake key

You can modify the TA units without sake key.

But the units which are validated with sony signatures would then be regarded as invalid by the firmware with either getting a brick or some functions (like gsm communication) not working.

The signature needed most likely uses different keys than sake authentication sony uses in the phone for certain restricted functions. We do not have either...
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] asdf2345:
I wonder if these keys could be brute forced with modern hardware.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
@asdf2345 no chance for brute force in my opinion. SAKE auth is RSA2048 afaik. Not sure about other signature algos used by xperia devices, but would expect that too or similar.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] project_2501:
@asdf2345 ,

The thread with the bundle necessary has been posted for region changing a Japan market variant Tama device.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Glauber2020:
Meu OS-05K docomo está no Android 9 e não consigo atualizar para o Android 10, não aparece para eu baixar esta atualização do sistema. Se eu usar o Xperia Companion, receberei uma cópia?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] zhoushiyi213:
May I ask if anyone can give a tutorial to calculate the offsets for a given ROM, so we can adapt to our ROM ourselves?

I own a Huawei P30 Pro on Pie and desperately want to gain root shell so I can read the bootloader code (I'd never buy any huawei phone, but it was a nice gift:(). I have the kernel binary, but I don't think they have released the kernel source for the specific ROM version I have. Source for other ROM version seems to exist. Is it possible to adapt it in my situation?

I'm not a developer nor a expert in kernel, but know enough to understand C code and build binaries out of them...
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=10822057]zhoushiyi213[/MENTION], I am afraid this can hardly be summed in a tutorial - it requires good knowledge of linux kernel internals, because fixing only the offset defines in the exploit source beginning is not enough to make it work.

Having those defined offsets correct would still crash the kernel most likely, then you would need to understand what's wrong and how it should work to debug and fix other problems in the exploit.

Moreover this vulnerability has only a narrow window of kernels affected if any for a device, so you may better verify in your device kernel's sources, that the bug is there, before trying to port it.

In any case, simply running the poc not adapted to your target kernel may also reveal if the kernel is vulnerable, as the initial stuff in the exploit seems to do something even with wrong offsets on vulnerable kernel.

Please note also, if wanted this exploit to be run against a vulnerable kernel 4.14 (or any other than 4.9), it would need lot more changes than in case of 4.9 kernel, which the original exploit has been designed for with Pixel 3.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] zhoushiyi213:
Thanks a lot for the detaled information! I guess I'll try to learn more about the kernel before I try to do this, or more likely never...

I tried your exploit fo the LG phones - foolishly running each adaption from 1 to 12 - and although there is not a root shell, I ended up with screen not lighting up until a forced reboot, so it seems vulnerable and I guess the adaption is possible in theory in my case. It's a 4.9 kernel though.

But anyway, thanks you very much for the information and adapting the exploit for all the models/ROMs!
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Mike7143:
Just thought I'd post because I tried it and it didn't work for anyone who might try this later... I attempted to gain temp root using terminal emulator on my XZ2C itself, it didn't work. The phone didn't have any issue, the terminal simply stopped working. Just an FYI.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=5649361]Mike7143[/MENTION], please post the log from the terminal.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=10822057]zhoushiyi213[/MENTION], if the exploit could make your kernel crash, it means the kernel is probably vulnerable.

If you have the sources for similar kernel version and you have the kernel binary that is running on the phone, the exploit could be adapted most likely.

Could you please edit your post#23 removing the full quote of my response, which is just above your post?

Actually it would be great to stay on topic of the thread, which is about XZ2* phones, not LG nor Huawei.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] serajr:
[MENTION=4418980]j4nn[/MENTION] It would be possible to port the exploit to something like Xperia 5 (55.1.A.3.49 - january 2020 security patch)?

This is not my case (I don't own the device), just curiosity. Tia!
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=3989065]serajr[/MENTION], I guess it would be possible to get the exploit running with both xperia 5 and xperia 1 with android 10 possibly up to March 2020 security path level. Checking the kernel sources, they are vulnerable since 55.1.A.0.748 till 55.1.A.3.112 which is the last version of sources released up to now. There is no source package for firmwares since 55.1.A.3.149, but I guess that got the bug fixed if it is April security patch.

Please note though, many substantial changes would need to be done in the exploit to make it compatible with kernel 4.14 used with xperia 5/1, because it has been designed for kernel 4.9.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
implemented magisk setup from temproot

finally got magisk from temp root working including permission asking feature - released as tama-mroot.zip - get it here
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Mike7143:
Not entirely sure what this means yet, will have to play/test later this evening; but awesome! Good work [MENTION=4418980]j4nn[/MENTION] ! I'll let you know how it goes!

edit: oh wow you also got TA backup working too, I'll try again and hopefully it'll work! Awesome!
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=5649361]Mike7143[/MENTION], obviously it can sometime happen that the exploit either hangs or reboots the phone due to racy and unpredictable heap memory contents. Thats normal. Your attempt to run it without adb from a terminal emulator will not work, not only because the terminal emulator does not have permission to execute the exploit, but term emulator user is more restricted than adb user and escalation from general app user is not implemented, it needs to be run from adb. You can use adb over wifi but that needs to be enabled from usb connection each time after reboot. It is android security measure.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] pvabel:
I know it's a bit of off-topic, and yeah, I did not read the whole thread, but there is something I want to ask

I have seen that restoring DRM on unlocked phones failed even when using the locked TA, but can we restore DRM when actually relocking using it? I don't really mind DRM being broken while I use the phone unlocked, but not being able to restore it in case I want to sell the phone later sounds like a problem

Does reflashing the locked TA even relock the bootloader on these phones, or do the new models use some kind of fuse trickery for storing unlock state?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
Please note, there is no problem to restore a TA backup from a locked state, device key would be restored in it.

The problem is only with tama platform phones (xz2/xz2c/xz2p/xz3), where there is no known method (yet) how to re-enable drm functionalities even when having the device key (aka drm keys) restored in the TA, like it has been possible with yoshino platform phones (xz1/xz1c/xzp) by use of kernel patch to hide unlocked bootloader state.

Reflashing TA backup from locked state does not re-lock bootloader already with yoshino phones, so it does not re-lock BL with tama phones either.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] tb_:
[MENTION=4418980]j4nn[/MENTION] I have one more question:

I remember you were eyeing the Trustzone exploit. I'm still on android 8. And my plan was to exploit the universal cereal bus and then the trustzone exploit.

From what I see this is a kernel 4.9 exploit so technically it should work with android 8 if the offsets are right.

Do you think it make sense to stay on 8 port this exploit instead and see whats possible with the Trustzone exploit?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=1017159]tb_[/MENTION], this exploit can be used only with tama phones running android 10. Kernel in Android 9 or 8 of tama phones firmwares is not vulnerable.

Similarly this cannot be used with yoshino phones, because the bug has not been merged in any of stock released firmwares (xz1* did not get android 10).
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] tb_:
Gotcha so if I want to play with the trustzone to extract keys I would need to stay in 8 and write a cereal bus exploit correct?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=1017159]tb_[/MENTION], I do not follow you. Do you have xz1* or xz2* phone?
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] tb_:
Xz2c. We’re still kinda figuring out how the drm works right?

I have an xz2c that is still on Android. There is an Android 8 exploit that allows getting root but it’s a bit complicated as it requires a USB mass storage emulation.

The old device should also still be vulnerable to the old Qualcomm trustzone exploit.

So maybe if I get root on it I could try extracting private keys. Maybe that allows us to restore drm
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=1017159]tb_[/MENTION], well if you could get another exploit to work with android 8 on tama, good.

Which trust zone exploit are you referring to?

I am afraid only an exploit getting trust zone arbitrary code execution could eventually help with drm. But it's just my opinion without any facts to support that.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] tb_:
This one I think

https://www.nccgroup.com/us/our-research/private-key-extraction-qualcomm-keystore/
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] mirhl:
We were talking about the RPMB here (and other things), so yes I would guess TZ would help into understanding TA.

And there was also another vulnerability I had reported.

I'm still on the first Pie release then, if it can help.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=1017159]tb_[/MENTION], do you know how to actually use that key extraction trust zone exploit?

In my opinion it is a conceptual work that needs to be adapted for different targets and use cases, possibly involving different crypto functions.

I can for example imagine that it could be adapted to extract private key for the android attest key, allowing to fake still locked state when responding to google's hw backed safety net test using tz crypto, verified on server.

But in case of sony drm stuff?

I am not sure. It may actually be possible that some drm function are running inside tz, but only with locked state - just my theory, nothing to back up that.

What key to extract in such case?

Moreover, we can have the key. One half is stored in TA 66667 unit while still locked (the device key). The other half is stored in some other TA location, signed and not removed after unlock.

The problem seems to be that the restored device key is not used possibly in TZ when BL unlock is detected (again, just my theory).

[MENTION=4900593]mirhl[/MENTION], you have still locked xz2* phone?

Concerning other exploits - not sure what we could gain old androids, while we already have temp root with xz2* running android 10?

In my opinion there is no need for another temp root. Having it with Q is even better, one may use it with magisk running quite recent fw and not even do the unlock itself.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] tb_:
I don’t unfortunately know.

The reason why I was holding off the upgrade was because I thought that the trustzone exploit might have been fixed with a firmware upgrade.
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] scuderio:
Anyone have firmware h8266 52.1.A.0.618 ftf zip or tar gz
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] j4nn:
[MENTION=8357824]scuderio[/MENTION], yes I have following versions - just uploaded the one you asked for:

H8116_Customized IBE_1313-3189_52.1.A.0.618_R3C

H8166_Customized FR_1313-2540_52.1.A.0.618_R4C

H8216_Customized UK_1313-4679_52.1.A.0.618_R5C

H8266_Customized FR_1313-2481_52.1.A.0.618_R4C.zip

H8296_Customized TW_1313-6119_52.1.A.0.618_R4C

H8314_Customized FR_1313-2468_52.1.A.0.618_R4C

H8324_Customized FR_1313-2469_52.1.A.0.618_R2C.zip

H8416_Customized IBE_1316-6423_52.1.A.0.618_R5C

H9436_Customized FR_1316-3076_52.1.A.0.618_R6C

H9493_Customized HK_1316-2331_52.1.A.0.532_R2C
[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] scuderio:
Ok thanks master good job great work ?????

---------- Post added at 04:36 AM ---------- Previous post was at 04:35 AM ----------

Ok thanks master good job great work