[Sony Xperia XZ1  Guides, News, & Discussion] braveheartleo:
Carrier phones are odd-ball siblings of their global counterparts. As such, they do not enjoy nor receive the same level of support as that of the latter in the modding scene (custom ROMs, recoveries, etc.), even though both carry the same brand model name, e.g. Xperia XZ1 G8341 "Global" vs. Xperia XZ1 SO-01K "NTT DoCoMo". This is because of the subtle underlying hardware differences between the global and carrier variants, even if they have the same specsheet.

One can try flashing ROMs for a global variant onto one of these phones, but it can be a hit or miss, with some hardware components not working like NFC and even losing other functions like the fullseg receiver. And even if it seems to run fine, there may be other issues like poor battery performance because of a non-functioning hardware preventing deep sleep.

Given the above, if you're like me who has one of these carrier phones and doesn't mind running stock where everything works, then this guide is for you. This will allow you to customize several aspects of the system as indicated per section.

This guide has been made possible with the great work of @j4nn on his temproot exploit via CVE-2019-2215 here, extended to support carrier phones from NTT DoCoMo, au KDDI, and Softbank. Once you achieve temporary privilege escalation by running bindershell, you can execute the following commands from inside a terminal emulator (if you followed the howto from the link) or the adb shell. There is no need to setup Magisk. All changes are permanent, except for those in /data that will be erased upon factory reset.

Keep in mind the following:

1. Customizations in this guide were done on an Xperia XZ1 SO-01K from NTT DoCoMo. I think that the file system from the other carriers shouldn't differ that much, but let me know if there are any discrepancies and I'll see if I can help.

2. Make backup of the files if you wish to revert them later on.

3. Avoid making changes in files and/or directories other than those as detailed in this guide, specifically in /oem and /data.

4. The starting directory for files to be copied is assumed to be at /sdcard, i.e. the root directory of the internal storage.

5. Always remount as read-write before committing the changes in /oem:

# mount -o rw,remount /oem

6. Restart the phone for changes to take effect.

View attachment 5376247

View attachment 5376257

Let's get started.

• Boot animation

Shave off a few seconds of boot-up time by removing the boot animation, or you can replace this to whatever you want (you'll have to make sure that the boot animation is in compatible format with the phone). To remove:

# cd /oem/media
# rm bootanimation.zip
# touch bootanimation.zip
# chmod 644 bootanimation.zip

It is not enough that you delete the file, because then the system will load /system/media/bootanimation.zip. You need to create a zero-byte file with the proper permissions.

• Boot logo

I found an empty splash partition that is 32.64 MiB in size. I'm still trying to figure out if flashing a compatible boot splash image to this partition will make the bootloader load this image instead of the one built into it, just like in the case of the boot animation above. I still have to determine the compatible format for this splash image.

If you have further information regarding the format please share it here. I'm also trying to change the blinding light of that boot logo to something more tolerable.

• Emoji font

View attachment 5376251

Fast fact: Did you know that emoji comes from the Japanese words 'e' meaning picture and 'moji' meaning character?

To replace (assuming you have a font file named MyFont.ttf):

# cd /oem/fonts
# rm ColorUniEmoji.ttf DcmColorIEmoji.ttf
# cp /sdcard/MyFont.ttf ColorUniEmoji.ttf
# chmod 644 ColorUniEmoji.ttf

The two ttf files are referenced in /system/etc/fonts.xml, but it is the ColorUniEmoji.ttf file that needs to be replaced to make changes to the system emoji. Removing this file will only defer the system to load all glyphs from /system/fonts/NotoColorEmoji.ttf, so rename your font file accordingly.

• Display font

To have your own font apart from the choices in Settings > Display > Change font for display (assuming you have a font file named MyFont.ttf):

# cp /sdcard/MyFont.ttf /data/system/fonts/UserFont.ttf

• Installing apps into /system

You can achieve the same effect of installing apps into /system (without triggering the 'Your device is corrupt' boot message) as follows (assuming you have an app named MyApp.apk):

# cd /oem/app
# mkdir MyApp
# chmod 755 MyApp
# cp /sdcard/MyApp.apk MyApp/
# chmod 644 MyApp/MyApp.apk

Replace /oem/app with /oem/priv-app as needed.

• Debloat

Effortlessly debloat your phone from carrier-specific apps and services by making modifications in /oem/android-config/early_config.xml. The package names contained in the xml file will disappear from the system upon restart. A factory reset will not even bring those packages back. You can remove the package names should you decide to have the need for them. Restart the phone and they will appear again.

Here's mine configured with the bare-minimum packages to avoid bootloops and other issues. You can change it to suit your needs, just follow the file structure. I purposefully didn't indent the lines I added to easily see them.

You can also rename or delete the folder /oem/deletable-app if you don't want to have those apps contained therein to be installed by the system upon a factory reset.

Note for SO-01K:

Do not include the com.nttdocomo.android.phonemotion package if you use the stock phone dialer com.sonymobile.android.dialer. The dialer will crash whenever you receive an incoming call, preventing you from answering it.

• GPS

UPDATE: The GPS doesn't work no matter what parameters are changed in the gps.conf file. It doesn't detect any satellites, so it doesn't lock-in on your coordinates, at least this is the case with mine. This may be another limitation of using a carrier-locked phone outside of it's country of origin. I'm afraid that the only remedy for this would be to flash a global ROM variant, especially if binaries are involved. I know this to be the case because I have an SOV37 on Japan ROM and no GPS work there also, but after flashing it to a Global ROM then I got GPS to work properly.

I'm still trying to find out how to fix this without unlocking the bootloader, but I'm not holding my breath.

Tweak the GPS parameters of the phone in /oem/android-config/gps.conf.

• Preset networks

Remove /oem/android-config/preset_networks.conf if you don't want to have carrier saved networks present whenever you reset your network settings or factory reset.

• APNs

I have always wondered why carrier phones don't automatically populate the APN for any SIM other than a Japanese SIM, even after having the phone SIM unlocked. As it turns out, the system of these phones doesn't really include the APN parameters of other networks outside Japan.

/system/etc/apns-conf.xml, which is where all APN parameters for all networks of the World can be found, is a symlink to /data/customization/apns-conf.xml, which itself is another symlink to /system/etc/customization/settings/defaults/apns-conf.xml, which is an xml file containing zero APN parameters.

As you can see, we can change this by replacing the symlink in /data/customization/apns-conf.xml with the full xml file from Google's source repository found here. This will download a file named apns-conf-full.txt. This is base64 encoded. To decode:

$ base64 -d /sdcard/Download/apns-conf-full.txt > /sdcard/apns-conf.xml

Unfortunately, upon every restart the system reverts /data/customization/apns-conf.xml to the original symlink. To prevent this, we need to make the file immutable with chattr, but this command is not available in the system.

If you followed the howto from the temproot link, and ran bindershell from a terminal emulator, you will come across the post of @Tifs detailing on how to successfully start Magisk from the same. You just need to download the arm64/busybox binary from one of the posted links.

When you have this and the xml files ready, then:

# cd /data/local/tmp
# cp /sdcard/Download/busybox .
# chmod +x busybox
# cd /data/customization
# rm apns-conf.xml
# cp /sdcard/apns-conf.xml .
# chmod 644 apns-conf.xml
# /data/local/tmp/busybox chattr +i apns-conf.xml

After restarting the phone, try Settings > Network & Internet > Mobile network > Access point names > Reset to default and see the available APNs for your SIM.

• VoWiFi / Wi-Fi calling

View attachment 5376253

View attachment 5376255

These carrier phones came provisioned with VoLTE and Video Calling but not Wi-Fi calling, at least in the case of mine. I'm not sure how useful Video Calling would be outside Japan, and it seems that Wi-Fi Calling is not used there. @pbarrette provided a great overview of the configs that enable VoLTE and Wi-Fi Calling here. But we are interested in enabling Wi-Fi Calling so here are the relevant changes to make:

1. Decompile /oem/overlay/com.android.carrierconfig-res-305.apk on your phone or PC.

2. Once decompiled, modify res/xml/vendor.xml with the following values as follows:

<boolean name="carrier_wfc_ims_available_bool" value="true" />
<boolean name="carrier_default_wfc_ims_enabled_bool" value="true" />

3. Rebuild the decompiled apk and overwrite the original file with the modified one.

4. Append the following line to /oem/system-properties/config.prop:

persist.data.iwlan.enable=true

5. It may be necessary to change/reinsert SIM after phone restart for the changes to take place.

• Build.prop

It is not possible to add or modify values in /system/build.prop without triggering the 'Your device is corrupt' boot message. However, you can add or modify certain values in /oem/system-properties/config.prop, which gets read into the system property database.

If you are using Gboard and you want custom themes for it, then you can append these lines for example:

ro.com.google.ime.themes_dir=/oem/etc/gboard_theme
ro.com.google.ime.theme_file=swiftinstaller.zip

Edit the values as needed.

Here are the other interesting values to modify:

# show the NFC icon
ro.nfc.icon.enable=true
# disable the forced camera shutter sound
ro.camera.sound.forced=0

It may also be necessary to decompile /oem/overlay/android-res-305.apk, then modify res/values/bools.xml as follows:

<bool name="config_camera_sound_forced">false</bool>

to turn off the forced camera shutter sound. I did both modifications, but try the config.prop value first. It may be enough.

* VoLTE / 4G calling

There should be a matching APN entry to use VoLTE with your network operator. Unfortunately, this is missing as well, and if you try to add it manually in Settings > Network & Internet > Mobile network > Access point names, it doesn't get saved. This is the case with mine.

UPDATE: I just acquired an Xperia XZ2 SOV37 "au KDDI" running Android 10. When I tried adding an APN of type 'ims' there, I got an 'Operator does not allow adding APNs of type dun, ims.' So it is a carrier-imposed restriction on the phone, only that in my XZ1 it fails silently.

You can add the APN entry in two locations:

1. /data/customization/apns-conf.xml, but you can only do this before making the file immutable; or

2. /oem/overlay/android-res-305.apk, by decompiling it and then modifying res/xml/apns.xml, rebuild and then overwrite with this one. I went this route.

In both cases, this is the APN entry you need to add:

<apn carrier="IMS" apn="ims" mcc="{mcc}" mnc="{mnc}" type="ims" protocol="IPV4V6" roaming_protocol="IP" />

Replace the values in curly braces with the MCC and MNC of your network operator.

* CellBroadcastReceiver

View attachment 5377473

View attachment 5377475

Each carrier phone comes with their own way of receiving emergency alerts depending on the network operator. All of them however don't include the CellBroadcastReceiver app like the other models do.

If you want to receive such alerts, then download this apk here. Rename it as CellBroadcastReceiver.apk then do the following:

# cd /oem/priv-app
# mkdir CellBroadcastReceiver
# chmod 755 CellBroadcastReceiver
# cd CellBroadcastReceiver
# cp /sdcard/CellBroadcastReceiver.apk .
# chmod 644 CellBroadcastReceiver.apk

* Sound enhancement

Sound enhancements like the DSEE HX, ClearAudio+, etc. apply only on stock media players like the Music and Video player (but not on any other else it seems) in the case of Android 8.0 Oreo. On Android 9.0 Pie, these enhancements apply system-wide for all media playing apps. An upgrade is recommended if this customization is needed.

While customizations such as these may not come close to the level you get with custom ROMs (and the updated software and security that come with it), these will at least give you something to control and tweak AND STILL get a device with a locked bootloader (and all the goodies that come with it like passing SafetyNet and Key Attestations, Widevine L1, intact DRM keys, etc.). You get the best of both worlds, at the cost of running a not-so-updated system.

I will add more sections to this as soon as I made some more modifications. I hope you find this guide useful as much as I enjoyed creating it. If you do, please hit the LIKE button. It will be very much appreciated. 😊