[Sony Xperia 10 III] wirespot:
How to root and pass SafetyNet on Sony Xperia 10 III (XQ-BT52)​

Tested on firmware 62.0.A.3.163.

Disclaimer:

This guide assumes you're familiar with the concepts of rooting, Magisk, SafetyNet, fastboot, adb and so on. I will explain why things are done but if I explained everything it would become too long.

This guide is limited to getting root and apps working on the stock Sony ROM. It doesn't cover installing other ROMs.

You can mess up your phone if you don't know what you're doing. This is not a beginner's guide.

Before you do anything else, do these preparations:

Make sure your device is updated to the latest firmware. Getting updates after you unlock the bootloader will be more complicated.

Use XperiFirm to grab a copy of your current firmware (after you've updated it). It can run on Linux too, either via Mono or in a virtual machine. It's basically just a downloader, it doesn't need any fancy hardware access.

Screenshot everything under Settings > System.

Open the dialer and enter *#*#7378423#*#*. Screenshot everything in the service submenus.

Unlock developer options (tap Settings > About > Build number 7 times) then find it under Settings > System > Advanced. Activate USB debugging. Activate OEM unlocking.

Install the Android SDK Platform Tools. On Linux they're most likely in a package provided by your distro.

Copy the screenshots to your PC because the phone will be reset at some point.

Boot into fastboot by turning the phone off, then connect it to PC via USB, and press POWER and VOLUME UP together. The phone led will turn blue. On PC run fastboot devices and make sure it lists your phone and has the serial number you got from the service menu.

Unlocking the bootloader:

This is the point of no return as far as warranty is concerned!

This will factory reset the phone! Make sure you got everything you needed off it.

Obtain the unlock code (you will need the IMEI of the 1st SIM slot).

Boot into fastboot, check again that fastboot devices lists the phone.

Issue the unlock command using the code you got earlier: fastboot oem unlock 0x<unlock code here>

Reboot the phone (you can say fastboot reboot). It will say "can't check for corruption" and "erasing" a couple of times but will eventually boot up to the factory setup.

Enabling Magisk & root:

Download the latest Magisk apk to the phone and install it. Right now that means v24+.

Open boot_X-FLASH-ALL-8A63.sin from the original firmware with any archive manager (it's a tar.xz), 7zip will work fine.

Extract boot.000, rename it to boot.img and put it on the phone.

Open the Magisk app, next to "Magisk" tap "install", choose "Select and patch a file", pick the "boot.img" file.

Download the patched img to PC (will be next to boot.img called something like magisk_patched-24100_MKPRJ.img).

Boot into fastboot, check again that fastboot devices lists the phone.

Flash the patched boot image: fastboot flash boot magisk_patched-24100_MKPRJ.img

Must say OKAY. Can then reboot the phone (you can say fastboot reboot).

Open the Magisk app again, it should say "installed" now next to "Magisk". Also the Superuser and Modules buttons should now be enabled.

Go into Magisk settings and activate "Hide the Magisk app". This is NOT MagiskHide, it does not hide Magisk from other apps, it hides the Magisk Manager app from other apps. More on this later.

Go into Magisk settings and activate Zygisk. This is a built-in replacement for Riru going forward.

Reboot!

Install a root checker app and verify that you get a prompt from Magisk to give root and that the checker says it got root.

Important changes about Magisk:

Riru is now obsolete. It has been replaced by a feature built-into Magisk called Zygisk (which is essentially Riru running in Zygote). It is strongly recommended to go into Magisk settings and activate Zygisk (even if you don't use Riru modules). Do not install Riru anymore. All modules that needed Riru should have Zygisk versions by now unless they're abandoned.

Magisk no longer maintains a module repository, To find and install modules install Fox's Magisk Module Manager. It's a dedicated module management app that supports the old Magisk repo as well as new ones. Inside Magisk you can still enable/disable/remove/install manually and can also update if the module has an update URL, so you can do without Fox if you get your modules directly from their XDA or GitHub pages.

MagiskHide has been replaced by a new feature called Deny list (it's in Magisk settings). It's much more powerful because the apps & processes added to the deny list will be completely excluded from anything based on Magisk so it's impossible for them to detect leaks anymore. On the downside, excluded apps can't be affected by any Magisk or LSPosed modules (LSPosed will grey out such apps and say "it's on the deny list".) This feature should be used sparingly (see below) because Magisk still does a good job of evading detection.

Passing SafetyNet:

Install YASNAC to check your SafetyNet status. At this point you're probably not passing either Basic or CTS check.

Go into Magisk settings. Enable "Enforce deny list". Enter "Configure deny list", find Google Services, check it, expand it, and select only the process ending in .gms and the one ending in .gms.unstable.

Reboot. Check YASNAC. At this point you should be passing Basic check but probably not CTS.

Install Universal SafetyNet Fix (aka USNF) by kdrag0n in Magisk. (Some GIS ROMs already include what this module does, so if you install a GIS ROM you may not need it.) This module hijacks the CTS verification and drops an error which causes the Google service to fall back to Basic verification, which we already fixed in the previous step.

Reboot. Check YASNAC. At this point you should be passing both Basic and CTS. That's it!

You may need to clear storage & cache for Google Play & Services. Go to Settings > Apps & notifications > See all apps, select "All apps", find them in the list, clear storage/cache and reboot. After that try searching for a restricted app such as Netflix on the Play store, if it shows up in results you're all good.

Remember to also add to deny list other apps that try to detect if you're using root, like banking apps.

Other SafetyNet related fixes:

People using non-stock GIS ROMs will probably need module MagiskHide Props Config by Didgeridoohan. This will install a props command line util that you can use (as root) to force Basic attestation, apply extra Magisk hiding techniques, spoof device fingerprint, change the way fingerprinting is checked, or even impersonate another device altogether. Install, reboot, enter adb shell, type su to go root (will need to grant root to shell on the phone when prompted), then run props and follow the options.

People running extra-stubborn banking apps (or other apps that try to detect root extra-hard) that don't work even when added to the Magisk deny list can try module Shamiko by LSPosed. This module adds extra hiding techniques for the apps on the deny list. Please note that Shamiko will disable the Magisk "enforce deny list" option but that's ok, that's an extra feature, the deny list is in effect even without it.