Related
Hello fellow Xperia Gamers,
After using this phone for a while now the following questions remain:
1) Will unlocking the bootloader make it easier to repair by myself in future if this phone ever software bricks?
2) Overclocking requires a kernel like Doom's, the question is: Can you underclock the Xperia Play using rooted stock and setCPU?
3) Lets say I wanted to unlock the bootloader, I could do so without having to flash a custom rom at once right?
4) The modem I use is a r800i - Iam Dutch (the Netherlands) - Provider is: T-mobile.
Can anyone point me to the steps and files needed to flash the official 2.3.4?
(I like to have things ready before they go wrong hehe.)
Any advice is welcome.
Kind regards, Stefan,
First, you can follow these guides to do everything, read "flash a ftf file" for instruction to return to stock.
1. Maybe, but no difference than if you have locked bootloader, since recovering from a softbrick usually mean using Flashtool to flash factory firmware.
2. You don't need custom kernel to underclock. Just root and use SetCPU. Though I don't know why you should underclock, this phone have efficient battery life and can be slow at times with demanding apps. Even though I overclock my Play to 1.2ghz it still get good battery life.
3. You don't have to go flashing custom rom or do anything to your phone after that.
4. Here is the HongKong R800i 2.3.4 factory firmware, it has been modified to be rootable (using either SuperOneClick or Flashtool. The rom is in Chinese by default, but when you put it your sim it will automatically change language.)
Base on your inquiries, it doesn't seem like you need to unlock your bootloader since you have no intention of overclocking nor install custom roms.
What I suggest you do is if you already have root, download the CWM installer version 5, specifically. And the NXT Lite rom. And the GB Google apps.
Install CWM, then boot into CWM by: while turning on your device, keep pressing the Volume Down button at the Sony logo. You can flash the NXT Lite rom as it does not require an unlocked bootloader. It's based on stock, but is more optimized and look nicer.
If you do unlock the bootloader, I recommend installing this Doom kernel, it really help improve the phone performance. You will need fastboot to unlock the bootloader and flash kernels, check my signature.
Great answers, thanks a lot mate!
I would like to give Doom's kernel a try now, however when using the recovery above Iam unable to boot into recovery.
(Think I need it to flash the wifi modules as his posts state.)
- Will not boot into recovery if vol down is pressed and held down on SE bootscreen \ logo splash.
- Will not boot into recovery when I choose to do so from the X-parts tools.
Any idea's?
PS: Will flashing a custom kernel reset the phone?
(As in, will I need to reinstall all apps?)
Yet another question if I may: What is the correct way of disconnecting a device after its been used in fastboot mode?
- Simply unplug the USB?
- Or safely remove hardware from Windows?
Kind regards, Stefan.
You need to use CWM installer version5, not the latest version. And dont press and hold, but keep pressing the button. You might need to enabled USB debugging when you install it but not sure if its needed.
For the kernel some kernel require to extra WiFi module.
Sent from my R800i
Thanks again for this info, booted into recovery now.
Ill read trough Doom his post a time or 5 and then flash his kernel.
Kind regards, Stefan.
Hello guys,
Whilst searching on google for some kernel flashing methods I saw an app named flashify...
Since I can't use flashtool on my pc for flashing stuff, luckily got my bootloader unlocked via fastboot and half root turned into full root...
Well, cutting the crap...
Test this app... Flashify on both locked and unlocked bootloaders....
Get it from here -
http://forum.xda-developers.com/showthread.php?t=2349847
Bugs--
Locked bootloaders--
None yet
Unlocked Bootloaders --
Recovery image can't be flashed...
Warning -- Half/Full root is needed in order to use this app..
Test and report back.. I will contact the developer to add support for our device too... So people without pc can have custom kernels with recoveries..
Thanks.
kaustubh.rockstar said:
Hello guys,
Whilst searching on google for some kernel flashing methods I saw an app named flashify...
Since I can't use flashtool on my pc for flashing stuff, luckily got my bootloader unlocked via fastboot and half root turned into full root...
Well, cutting the crap...
Test this app... Flashify on both locked and unlocked bootloaders....
Get it from here -
http://forum.xda-developers.com/showthread.php?t=2349847
Bugs--
Locked bootloaders--
None yet
Unlocked Bootloaders --
Recovery image can't be flashed...
Warning -- Half/Full root is needed in order to use this app..
Test and report back.. I will contact the developer to add support for our device too... So people without pc can have custom kernels with recoveries..
Thanks.
Click to expand...
Click to collapse
"Your device didn't pass the compatibility test, therefore it isn't fully supported yet. Flashing boot/recovery will not work. I'll work to try to support as many devices as possible."
kaustubh.rockstar said:
Hello guys,
Whilst searching on google for some kernel flashing methods I saw an app named flashify...
Since I can't use flashtool on my pc for flashing stuff, luckily got my bootloader unlocked via fastboot and half root turned into full root...
Well, cutting the crap...
Test this app... Flashify on both locked and unlocked bootloaders....
Get it from here -
http://forum.xda-developers.com/showthread.php?t=2349847
Bugs--
Locked bootloaders--
None yet
Unlocked Bootloaders --
Recovery image can't be flashed...
Warning -- Half/Full root is needed in order to use this app..
Test and report back.. I will contact the developer to add support for our device too... So people without pc can have custom kernels with recoveries..
Thanks.
Click to expand...
Click to collapse
Hey people I thinks this app is good but the negative you need custom recovery to flash zip files "then what's the point", I suggest you use this app Flash Gordon you don't need a custom recovery to flash zip file meaning those with locked bl can use this app to flash mode etc.
In the current release of Flashify and with my XM dual (locked bootloader) I can only backup the Kernel... none of the flashing options work, gives the "Your device didn't pass the compatibility test, therefore it isn't fully supported yet. Flashing boot/recovery will not work. I'll work to try to support as many devices as possible." message =/
YES, I have read as much as I can in the forums (all day today, rather nice way to spend a holiday though).
I have a Xperia Z1 Compact D5503 handset (FR SFR version, from eBay). I have recently updated it to Android 5.0.2 via XperiFirm tool. I flashed the Customized_IN version (D5503_Customized IN_1281-0184_14.5.A.0.242_R3D). It WAS NOT rooted and I don't remember if I had unlocked the bootloader.
[I have a laptop running Windows 8.1 x64, with latest versions of XperiFirm, FlashTool x64, Android Studio (with Google USB driver), PC Companion. My laptop detects my phone as MTP (or MSC when I choose so), but in the Device Manager, it never shows as android adb device (always MTP, or USB stick). I tried Update Driver option but to no avail, it says the Google USB driver or the downloaded Z1 Compact driver (from Sony site) is not supported (either by the phone or the PC). But the phone shows debugging connected, even prompts my authorization (first time only). Flashmode and Fastboot modes are detected well enough.]
Now, it says I am not allowed to unlock bootloader (via "*#*#7378423#*#* > Service Info > Configuration" menu). It shows the following:
------------------------------------------------------
Rooting Status:
Bootloader unlock allowed: No
------------------------------------------------------
I am unable to unlock the bootloader (or root, yeah, that's the ultimate goal) via the following methods:
1. Official Sony Method,
2. ZergRush
3. TowelRoot,
4. Easy Root Tool,
5. Newroot (by Doomlord),
6. Flashtool (that BLU option),
7. Fastboot via cmd.exe,
8. Flashing pre rooted zip files (cannot open stock recovery option, does this have any? I used the stock recovery a lot on my old Samsung).
Flashtool, cmd and Newroot showed variants of this same error: "only position independent executables (PIE) are supported."
Sony gave me a code, but that also yielded another variant of the same.
Now, as far as I have understood, what I need is one or more of the following:
1. a pre-rooted ftf file (someone said that is impossible as for Sony's encryption, is that right?)
2. some way to root without unlocking bootloader (Newroot does that, but did not work)
3. some way to override that crazy arrogance of Sony and unlock the bootloader and be my white knight...
Can anyone provide me with a guide or some example? It is not at all fair of Sony to create these non-allowance nonsense.
P.S. Please do not mind my tone, I am usually very docile but a whole day (literally; 6 AM to 6 AM next day!!!) in front of my PC without any result have mutated me a bit.
BTW, I am fairly proficient in following complex instructions only if they are conclusive (I don't want to spend another day figuring out how to follow them)
i cannot contribute in any way, i just wanted to tell you you´re not the only one with the problem. if i find a solution i will get back to you
Flash .108 firmware, root with "rootkitxperia", install dualrecovery, use prf creator to make a flashable rooted zip of lollipop (if that's what you want) and flash in recovery. Job done
I'm actually relieved to see someone else experiencing the exact same problems, I've already spent several days figuring out how to unlock the bootloader and get my phone rooted, but to no avail. However my device does state that the bootloader can be unlocked, but can't be found through cmd prompt when connected in fastboot mode and get's the same error: 'only PIE (position independent executables) are supported when trying to unlock the bootloader with flash tool.
White knights on problem solving horses would be greatly appreciated indeed!
I got a Z1C recently from eBay but have also done this on a Z Ultra and Z2, because of the cross development Sony stuff this is very similar for all of them.
You only need to unlock the boot loader if you want to flash a custom kernel or ROM. You don't need to unlock it to get root access, however to get root access you'll have to flash an old version of Android. You're flashing an old version from before they patched the exploits you want to use to get root.
So the steps are:
1. Get an old version of the official Sony ROM.
2. Flash the old ROM.
3. Exploit it to obtain root access.
4. Install a custom recovery.
5. Make a custom flashable zip of the firmware you want to use with root included.
6. Enter custom recovery and flash the zip you created in step five.
The files I used to do this are:
From XperiFirm I download "1280-5440 Netherlands T-Mobile NL 14.4.A.0.108 / R9C".
Using Flashtool I made an FTF from it and flashed it.
Then I used "EasyRootTool v12.4" to get root access.
I installed "Z1C-lockeddualrecovery2.8.21-RELEASE.installer.zip" from Nut's site.
Then you go back to XperiFirm and grab the version of Android you want to use. I used the 5.0.2 Customised AU one as I'm in Australia, you probably want the Indian one.
Use PRFCreator to make a flashable zip with a custom recovery and SuperSU, for that you need the "Z1C-lockeddualrecovery2.8.21-RELEASE.flashable.zip" not the installer.
There are posts with this info around, it's almost 5am for me so I'm not going to go looking for the links to the posts, you'll have to do that yourself. If you read for the day you've probably found them already.
First of all, I would advise against unlocking your bootloader unless you have a backup of your TA partition. Otherwise you risk losing your DRM keys and might criple your camera. This is irreversible damage without a backup. Second, on the official Sony unlock page it states specifically that not all devices are allowed to unlock the bootloader. If it doesn't, though luck then I guess but I could be wrong.
Now to backup the TA partition you need to be rooted which is not possible up to now with Lollipop unless your bootloader is unlocked. So this is a bit of a problem. Luckily flashtool (make sure to use the older 0.9.18.6 version at the bottom of the download page) allows you to flash a previous version without unlocked bootloader or being rooted. Choose one from the list at the bottom of this link but make sure to use a .108 one from the "KitKat [Old]" section (I chose Generic UK unbranded => link points to UA version, UK FTF here). Then root it through one of your preffered methods, backup TA partition and install a recovery.
Then create your own stock FTF with flashtool. Use this method with PC Companion or just download it through flashtool's built-in Xperifirm with this method.
Then create your own pre-rooted flashable zip with PRFCreator with part 2 from this guide. Continue with part 3 from the same guide (maybe skip the 3 big cups of coffee), exhale and get on with your life.
Maybe check out this one and this one (basically the same process) too.
It's the same procedure as written above but with some links I used to gather the information. I just went through this myself so still had all the tabs open. These were most of the useful ones I believe. It really is a PITA to gather all the bits and pieces from miscellaneous posts scattered all over this forum.
Why flash a 108 kk and then root? Just create lollipop rom with prf creator and flash that.
spudata said:
Why flash a 108 kk and then root? Just create lollipop rom with prf creator and flash that.
Click to expand...
Click to collapse
PRFCreator doesn't make FTF's but flashable zips. From the PRFCreator thread:
To flash a pre-rooted firmware, you need a recovery menu
Click to expand...
Click to collapse
To install a recovery you need to be rooted (at least as far as I know) or have an unlocked bootloader. The point is not to unlock the bootloader at all (like when it is not possible) or maybe only after taking a backup of TA partition if not already done so (which again needs root access).
You're absolutely right, my mistake. Think i had a memory lapse
Hey all,
so i have (hopefully) read all those "I'm new to HTC"-threads and an almost infinite amount of additional threads all around the internet and especially here on xda in the htc 10 forum. I think i have figured it out so far, coming from a Galaxy S5 it's quite confusing sometimes as there i would have to get my hands on odin, flash twrp and from there on everything is super easy.
CID/MID
The CID of my device (HTC__034) shows me my device is unbranded and the region is europe. This is like the CSC over at samsung where DBT would be an unbranded german device?
The MID is an identifier for the model, it's model specific and should be the same throughout all regions and carriers (read this on some german android wiki site). It's like SM-G900F over at samsung?
Bootloader
The bootloader is locked by default. To be able to install a custom recovery, root, flash custom roms, etc. pp. i need to unlock the bootloader either over at htcdev (where they will store the information about me unlocking the bootloader) or through sunshine which will also S-OFF my device. Once the bootloader is unlocked, no more OTA updates except installing them "by hand"
S-ON/S-OFF
S-OFF is not needed to flash custom roms, but i may be stuck on some firmware version if it won't get updated anymore. To change firmware version i would need to S-OFF my device.
Also, to flash a radio i would need S-OFF. Is this radio you are all talking about what the modem is over at samsung?
S-ON is default, S-OFF is a sunshine exclusive, XTC2Clip won't work here anymore
Custom recovery
unlock bootloader and if wanted, S-OFF, fastboot install twrp
Root
flash supersu, systemless supersu or magisk and systemless phhsuperuser through twrp
Flashing roms
unlocked bootloader and custom recovery needed, then just flash this baby
Nice work, due diligence is rare these days
You got it all very close, your shouldn't have any trouble.
don't worry about S off
create an account at the HTC Dev website
on Dev site, select unlock bootloader and follow step by step
once bootloader is unlocked, "fastboot flash recovery twrp.img"
reboot into recovery and CREATE FULL BACKUP... save it somewhere safe...
at this point you are safe and don't need to worry about bricking your phone!
you are also now done with the computer, from this point on you can switch roms as much as you like with just your phone.
to install rom, save file to your phone, wipe system, dalvik/cache, then install new file, all from within twrp
Let me know if you need any help
---------- Post added at 01:30 PM ---------- Previous post was at 01:26 PM ----------
Also just to clarify, it is basically the same thing as your s5, but you are replacing Odin with fastboot and adding the one step of unlocking your bootloader first. Don't worry about rooting at first because most custom roms will have it already rooted, so installing the rom will also root... Good luck
S1CAR1US said:
You got it all very close, your shouldn't have any trouble.
don't worry about S off
create an account at the HTC Dev website
on Dev site, select unlock bootloader and follow step by step
once bootloader is unlocked, "fastboot flash recovery twrp.img"
reboot into recovery and CREATE FULL BACKUP... save it somewhere safe...
at this point you are safe and don't need to worry about bricking your phone!
you are also now done with the computer, from this point on you can switch roms as much as you like with just your phone.
to install rom, save file to your phone, wipe system, dalvik/cache, then install new file, all from within twrp
Let me know if you need any help
---------- Post added at 01:30 PM ---------- Previous post was at 01:26 PM ----------
Also just to clarify, it is basically the same thing as your s5, but you are replacing Odin with fastboot and adding the one step of unlocking your bootloader first. Don't worry about rooting at first because most custom roms will have it already rooted, so installing the rom will also root... Good luck
Click to expand...
Click to collapse
First of all, thanks for the answer, just a few more questions^^
S-OFF + unlocked bootloader -> this is what i have on my S5 right now. enabling me to flash and/or **** up everything.
for example take a firmware (bootloader, modem, rom) for s7 and brick my s5 or repartition with a pitfile or whatsoever if i want to
i am able to up-/downgrade firmware from (if it's there) nougat down to marshmallow and back up to nougat
S-ON + unlocked bootloader -> will only give me the possibility to flash new system partition (aka rom), a custom recovery, gain root access and (read about this) flash a kernel. but this won't allow me to update firmware, so as long as i'm on mm, no nougat for me except i relock my bootloader and flash a nougat RUU (check for right MID and CID).
2.1 do i have this right (about the firmware up-/downgrades)?
2.2 the RUUs are basically stock firmware?
S-OFF + locked bootloader
what is up with this configuration? have read it gives me the same options as S-ON and bootloader unlocked?
S-OFF would also allow me to relock bootlader without relocked flag, so it looks as if i never unlocked the bootloader?
AOSP-roms
what configuration do i need to flash aosp roms as soon as there are mor than alpha/beta builds? is S-ON + unlocked bootloader sufficient?
peteter said:
First of all, thanks for the answer, just a few more questions^^
S-OFF + unlocked bootloader -> this is what i have on my S5 right now. enabling me to flash and/or **** up everything.
for example take a firmware (bootloader, modem, rom) for s7 and brick my s5 or repartition with a pitfile or whatsoever if i want to
i am able to up-/downgrade firmware from (if it's there) nougat down to marshmallow and back up to nougat
S-ON + unlocked bootloader -> will only give me the possibility to flash new system partition (aka rom), a custom recovery, gain root access and (read about this) flash a kernel. but this won't allow me to update firmware, so as long as i'm on mm, no nougat for me except i relock my bootloader and flash a nougat RUU (check for right MID and CID).
2.1 do i have this right (about the firmware up-/downgrades)?
2.2 the RUUs are basically stock firmware?
S-OFF + locked bootloader
what is up with this configuration? have read it gives me the same options as S-ON and bootloader unlocked?
S-OFF would also allow me to relock bootlader without relocked flag, so it looks as if i never unlocked the bootloader?
AOSP-roms
what configuration do i need to flash aosp roms as soon as there are mor than alpha/beta builds? is S-ON + unlocked bootloader sufficient?
Click to expand...
Click to collapse
Best way is "S-OFF - LOCKED".
You have the same advantages as with "S-OFF - UNLOCKED", but with "S-OFF - LOCKED" you can go easily back to stock ("S-ON - LOCKED").
You can flash everything AND you can up-/ or downgrade your firmware. So AOSP roms are no problem for you
Never RELOCK your phone.
So the best way is: Unlock your phone with HTC Dev > Flash TWRP > Flash SuperSu > Install sunshine and choose inside the app "S-OFF - LOCKED".
If you want to go back to stock, just flash a RUU.zip and do the s-on command. Thats it.
But, if you still have a firmware version that's compatible with temp root, you don't need to unlock through HTC first. If you're going to spend the Sunshine money anyway, and if your FW version is compatible, go with Sunshine since the beginning.
Also, when you first run TWRP and it asks you if you want to make system writable, say NO. That way, you are able to backup everything untouched and get back to stock in case you want to take OTAs. There are guides that show you how to do it if you decide to stay stock + root/xposed.
Thank you all, so the way would be
download and install sunshine -> done
let sunshine run its tests (temproot etc) -> done and working
(from here on to be done)
pay 25$ and choose S-OFF + LOCKED -> done
fastboot flash recovery twrp.img -> done
i could also do this fastboot boot recovery twrp.img command and then also backup stock recovery? -> no longer available
boot up twrp, no to writable system -> done
nandroid backup (system image, boot) -> done
do what i want, flash custom-rom, aosp-rom, keep stock-rom, flash magisk and systemless phhsuperuser, flash supersu systemless or standard supersu, xposed and whatever makes me hit install in recovery -> done done done
also, never ever RELOCK in case i would S-OFF and UNLOCK
in case i missed something, please enlighten me else i'm of to gain freedom
dastinger said:
But, if you still have a firmware version that's compatible with temp root, you don't need to unlock through HTC first. If you're going to spend the Sunshine money anyway, and if your FW version is compatible, go with Sunshine since the beginning.
Click to expand...
Click to collapse
Okay, I forgot the sunshine temproot. I got my phone from repair last week with latest firmware and it wasn't working. I had to use HTC Dev to unlock first.
peteter said:
Thank you all, so the way would be
download and install sunshine -> done
let sunshine run its tests (temproot etc) -> done and working
(from here on to be done)
pay 25$ and choose S-OFF + LOCKED
fastboot flash recovery twrp.img
i could also do this fastboot boot recovery twrp.img command and then also backup stock recovery?
boot up twrp, no to writable system
nandroid backup
do what i want, flash custom-rom, aosp-rom, keep stock-rom, flash magisk and systemless phhsuperuser, flash supersu systemless or standard supersu, xposed and whatever makes me hit install in recovery
also, never ever RELOCK in case i would S-OFF and UNLOCK
in case i missed something, please enlighten me else i'm of to gain freedom
Click to expand...
Click to collapse
After your nandroid backup you have to reboot TWRP and allow writable system, or you can't flash anything a ROM
Not anything. You can still flash Magisk, Systemless Root, Systemless Xposed or a custom kernel. Basically, you can flash anything that doesn't mess with system. A ROM, for example, will need writable system ofc.
Once again, thanks a lot guys, installed twrp which is now asking me for a password. am i right that i have to enter my decrypt password?
EDIT: Just hit cancel worked
peteter said:
Once again, thanks a lot guys, installed twrp which is now asking me for a password. am i right that i have to enter my decrypt password?
EDIT: Just hit cancel worked
Click to expand...
Click to collapse
http://forum.xda-developers.com/htc-10/how-to/psa-htc-10-s-off-s-lock-unlock-t3371264
I got OTA updates with S-OFF I understand it's the recovery that will block OTA. What I did was S-OFF and HTC DEV unlocked bootloader I have not changed either one since. What I was doing to get latest firmware(for US UNLOCKED or developer edition) was flash a stock pmewl RUU not modify it and take OTAs to get the latest firmware. If you have the m10h in the USA, your LTE is crippled. You may want to convert to TMOUS or US unlocked. LTE will turn on at that point, however you won't get the full AWS spectrum. I use WCDMA(3.5G or HSDPA+) exclusively, unless I'm somewhere it won't work, like southern Denver, even then it's crippled. I quickly came to the conclusion that I need a PME with full AWS spectrum. I did have the device converted to US unlocked and on nougat within hours, nougat at the time was not available for my device out of the box. Another thing I sometimes go into recovery and find if didn't mount data partition. Simply re-flashing encryption compatible TWRP fixes this. Either a backup or image flash from TWRP. Or re-flash TWRP using TWRP app or dd from a terminal.
From my experience, whenever TWRP asks for a password that means data did not mount! The latest TWRP from twrp.me the official one is working fine for me.
The only problems I had were in trying to return to a fully stock condition.
Which is useful to do in case you maybe sell the phone after upgrading or something. And it very much depends on where you got your phone on how successful that attempt will be. For instance, my contract allows me to upgrade every two years, but the CID they use (H3G__001), despite the phone basically being unlocked, is not supported anywhere in the form of RUU. I had to S-OFF in order to be able to change the CID to HTC__001 which is the WWE CID but you can also change a significant amount of other stuff.
The other thing that being S-OFF makes easy is updating or rolling back firmware versions and different revisions of android require different firmwares (for instance between Marshmallow and Nougat)
Although, some of it has the potential to brick your phone, which being S-ON prevents. So it depends just how far you want to go and if you'd rather have that saftey net. But beyond that, you do not need S-OFF to install and run custom roms, or recoveries, etc.
Good points. It is risky to S-OFF, last time I flashed a write value to the safety state of an HTC modem was the Evo 4g, locked to Virgin Mobile when I got it. I had to cut a small section of a wire from an ethernet cable after flashing the unlock binary. Using that cable to ground contact points(at the risk of bricking) I read how to bypass some safety and get into diag mode writing some hex value to something else using fastboot.
I got into Android(and Linux) by hacking the HTC Touch Pro 2 and a laptop to flash it with. That was a Microsoft Phone. Using Haret, and installing Android Donut system/kernel images on the sdcard, you could boot into the Android Linux kernel and everything was loaded. It was slow, no cellular connection, it booted as a proof of concept.
Unpractical for daily use, I just kept Windows with the earliest version of the Sense interface, compulsively flashing every new Energy ROM. Then came the HTC HD2, the last Microsoft Phone(before Windows Mobile), my first practical Android phone. Started off booting Froyo using the same sdcard install and Haret psuedo bootloader method. Dark Forces group eventually formatted the EEPROM of the HD2 using a Linux friendly file system and moved Android from the sdcard to the internal memory. Adopting Linux kernel and vendor sources from the HTC Desire, the XDA community hacked together a fringe device.
I had a few HD2s running Android on a foreign device. Even bricked a couple of them flashing European radios. Only to restore them by buying the same not bricked devices with busted screens on eBay.
You can do things with an HTC, not possible otherwise using other Armel hardware . I mean try writing low level binary states to the modem of an Nexus device, not only to re define the locality of where the device was manufactured to function, but even downgrade firmware versions and the respective security patches.
Won't happen, not without Jtag and a few years of bricking devices while you earn an unrequited masters in computer science, as I imagine the phreakers/developers behind Sunshine must have.
My point, if I have one, is the raw potential before the OP and the device we're taking about.
To even look up a device on XDA demands a degree of user autonomy not encouraged by many manufactures. Like those that resort exclusively to advertising and pandering to made for TV "group think" expectations and attitudes of what a device is capable of. Only what is most profitable to most manufactures will work easily on the device without risk of destruction.
End users intolerant of bloatware and advertising, or limiting personal driving, shopping, usage and locality data to services they chose or at least use and know about. Those are examples of what's outside the stock ROM box.
The communications service industry as a whole will lose profits if they don't buy the majority of these inherently open devices and tailor them to fit, for the most part, their ends. I mean yeah, KNOX is secure, and that's a great cover story to isolate open development. Groups of independent developers, builders, and users can take technology in a direction different and less predictable than what is otherwise a profitable direction.
I like to imagine this fora as a nail in the coffin of computer hardware and software development that unnecessarily limits experimentation and inflates security risks to homogenize those capable individuals under the same or similar payroll. Focusing them on profit over communal benefit, as if we can't have both.
rooted kernel hiding bootloader unlock
with working sony stock fw fota updates
for Sony Xperia XZ Premium
Firmware Over the Air system updates have been disabled/not working with sony xperia phones with unlocked bootloader.
Also many sony drm functions are disabled if fw detects unlocked bootloader even if device master key was recovered.
I've implemented a kernel patch for xperia XZ1 Compact / XZ1 / XZ Premium phones that properly masks bootloader unlock status so it appears as still locked for sony stock firmwares.
This allows FOTA updates to be installed if running completely unmodified stock firmware. This is possible if this kernel is just booted from usb via fastboot instead of flashing it.
The kernel is pre-rooted, so you can have root as usual with magisk when running this kernel (you can use magisk system less patching to make changes to system/vendor partitions without actually modifying them).
For oreo fw the boot process is patched to hide magisk from sony ric daemon that stops the boot in case it thinks the bootloader is still locked. This special patch allows to pass safetynet including cts while having properly working magisk.
This kernel may be used (flashed) just to properly enable sony drm features, like video image enhancements, if device master key was recovered via locked state TA restore.
The bellow described way to install FOTA system update works with both - phone with TA restored and phone with drm keys lost. Both variants have been tested with xz1c.
How to use this kernel while planning to do FOTA system update eventually
Update: please see here for the latest usage instructions for kernels in flashable zip archive.
Please see screenshots bellow for this kernel in action (with xz1c) doing fota system update from oreo to pie and from pie to next pie version. There is also a video documenting this here. Few longer waiting parts have been cut out to fit the video under 15 minutes of youtube limit for not verified accounts.
if your bootloader is still locked
Use renoroot exploit to backup your TA, unlock your bootloader and restore TA-locked to recover device master key as described in
[XZ1c/XZ1/XZp] temp root exploit to backup drm keys implemented thread.
select one of the prepared kernels and download it
make sure you are running unmodified stock firmware
You need the version corresponding to the selected kernel - reflash the firmware to make sure it is unmodified.
Please note: any mount of /system or /vendor partitions in write mode would result with modifications even if nothing is copied there.
Be aware that some zip packages flashed from twrp may mount the partitions for write access even when that is not needed.
reboot the phone to fastboot mode
Use either "adb reboot bootloader" or
enter fastboot by holding powered off phone's volume up key while connecting it to PC via usb cable and use 'fastboot reboot bootloader' command.
boot the downloaded kernel via fastboot
For example (xz1c):
Code:
fastboot boot boot-G8441-47.1.A.16.20-hideunlock-rooted.img
enjoy your rooted phone which thinks it is still locked
Sony apps will be offered to install/update. System FOTA update may come.
Magisk will provide your root when magisk manager app is installed (offered on the first boot).
if you need to use a custom recovery, like TWRP
Do not flash it. If you do, FOTA update verification will fail.
Instead use 'fastboot boot' the same way as with the kernel above, but instead of the kernel, boot the twrp image without flashing it.
to install a FOTA system update
just start the update as usual
let it run until it finishes the installation
try to catch the restart then and hold volume up that time to enter fastboot
you need to use following command to make next boot working
Code:
fastboot reboot bootloader
use 'fastboot boot' to boot kernel for fw to which fota updating to,
for example (xz1c):
Code:
fastboot boot boot-G8441-47.2.A.4.45-hideunlock-rooted.img
if you miss the restart (or do not have the right kernel version),
it does not matter, the installation will finish even when bootloader unlock is detected with the last reboot to updated system,
so just 'fastboot boot' the corresponding 'hideunlock-rooted' kernel then
Alternative use of this kernel
If you do not like booting from usb via fastboot to startup your phone, you can flash the kernel and boot normally.
But if you like to install FOTA system update then, you would need to flash the stock kernel first in order to make the fw untouched again (assuming no other changes to the fw, like system or vendor partitions, have been done) and boot the patched kernel via 'fastboot boot' as described above.
You can backup stock kernel (and recovery) to avoid need to download full stock fw when you need to restore stock kernel & recovery when you decide to install fota system update - see here and following post for more details please.
If you do not care about FOTA, just do not install it.
And use this kernel just to enable all sony drm features that are available on a locked phone (assuming locked state TA has been restored).
In case you like to make some modifications to system or vendor partitions (as you do not care about fota), you would need to disable verity in the kernel - please see post#3 for noverity variants of oreo kernels and linked post describing howto switch verity off via magisk in all pie kernels.
Downloads
See the post#2 please.
Source code
patched kernel sources to hide bootloader unlock (my-bluhide/* branches)
https://github.com/j4nn/sonyxperiadev-kernel-copyleft
patched magisk sources to hide magisk from sony ric daemon on early boot phase (v19.1-manager-v7.1.2-ric branch)
https://github.com/j4nn/Magisk/tree/v19.1-manager-v7.1.2-ric
The patches are provided under GPL (that means you may include them in your builds, but you need to provide buildable source of released binaries /true for any kernel change btw/).
Credits
Thanks to @tonsofquestions for lot of initial testing of this concept when I did not have a phone with unlocked bootloader and for discovering the need to reboot to fastboot by a command to make the 'fastboot boot' command properly boot the supplied kernel image.
Thanks to @topjohnwu for his excelent magisk tool.
If you find my work useful, consider donating here please:
https://j4nn.github.io/donate/
Thank you.
XDA:DevDB Information
kernel_bluhide_maple, Kernel for the Sony Xperia XZ Premium
Contributors
j4nn
Source Code: https://github.com/j4nn/sonyxperiadev-kernel-copyleft
Kernel Special Features: proper hiding of bootloader unlock, sony ric with magisk hack
Version Information
Status: Stable
Stable Release Date: 2019-02-10
Created 2019-02-10
Last Updated 2019-08-07
Downloads
- hideunlock kernel pre-rooted boot images:
Xperia XZ Premium (G8141)
boot-G8141-47.1.A.16.20-hideunlock-magisk-19.1.img
boot-G8141-47.2.A.4.41-hideunlock-rooted.img
boot-G8141-47.2.A.6.30-hideunlock-rooted.img
boot-G8141-47.2.A.8.24-hideunlock-rooted.img
boot-G8141-47.2.A.10.28-hideunlock-rooted.img
boot-G8141-47.2.A.10.45-hideunlock-rooted.img
boot-G8141-47.2.A.10.62-hideunlock-magisk-19.3.img
Xperia XZ Premium Dual (G8142)
boot-G8142-47.1.A.16.20-hideunlock-magisk-19.1.img
boot-G8142-47.2.A.4.41-hideunlock-rooted.img
boot-G8142-47.2.A.6.30-hideunlock-rooted.img
boot-G8142-47.2.A.8.24-hideunlock-rooted.img
boot-G8142-47.2.A.10.28-hideunlock-rooted.img
boot-G8142-47.2.A.10.45-hideunlock-rooted.img
boot-G8142-47.2.A.10.62-hideunlock-magisk-19.3.img
- hideunlock kernels flashable to multi fw versions (see here for usage howto):
Xperia XZ Premium (G8141)
kernel-G8141-47.1.A.16.20-hideunlock.zip
kernel-G8141-47.2.A.10.62-hideunlock.zip
kernel-G8141-47.2.A.10.80-hideunlock.zip
kernel-G8141-47.2.A.10.107-hideunlock.zip
kernel-G8141-47.2.A.11.228-hideunlock.zip
Xperia XZ Premium Dual (G8142)
kernel-G8142-47.1.A.16.20-hideunlock.zip
kernel-G8142-47.2.A.10.62-hideunlock.zip
kernel-G8142-47.2.A.10.80-hideunlock.zip
kernel-G8142-47.2.A.10.107-hideunlock.zip
kernel-G8142-47.2.A.11.228-hideunlock.zip
Screenshots of XZ1c FOTA system update from oreo 47.1.A.16.20 to pie 47.2.A.4.45
(video available here)
Downloads
This is for alternative use only - please see post#10 of XZ1 thread for more details.
boot-G8141-47.1.A.16.20-hideunlock-magisk-19.1-noverity.img
boot-G8142-47.1.A.16.20-hideunlock-magisk-19.1-noverity.img
Screenshots of XZ1c FOTA system update from pie 47.2.A.4.45 to pie 47.2.A.6.30 version
(video available here since 08:10 time)
I am 47.2.A.2.33，can I use 47.2.A.6.30?
So this doesn't work at all with unlocked devices that doesn't have a backup
@j4nn
If the bootloader is unlocked???
And flashing this kernel, nothing happen
nonokirton said:
I am 47.2.A.2.33，can I use 47.2.A.6.30?
Click to expand...
Click to collapse
If you have 47.2.A.4.41 fw, flash that and then you can try FOTA to 47.2.A.6.30.
Let me know, if you need a build of 47.2.A.2.33 kernel, which variant of xzp, if you want to test fota and cannot find the appropriate older fw.
SilverGamer_YT said:
So this doesn't work at all with unlocked devices that doesn't have a backup
Click to expand...
Click to collapse
Actually FOTA works even with devices where "drm keys" have been lost.
I've just tested that (restoring TA-unlocked to get the lost keys state) and I was able to fully install fota from 47.2.A.4.45 to 47.2.A.6.30 using my patched kernel with XZ1c.
So for FOTA it is working. And with pie, camera works without device master key (both with stock and with this unlock hiding kernel).
You would not get video image enhancements obviously, but currently there is no drmfix available with pie that would make it work, is it?
So I guess this is quite good actually (in pie case) even for devices without TA restored.
@karrouma, I am not sure what you mean.
j4nn said:
If you have 47.2.A.4.41 fw, flash that and then you can try FOTA to 47.2.A.6.30.
Let me know, if you need a build of 47.2.A.2.33 kernel, which variant of xzp, if you want to test fota and cannot find the appropriate older fw.
Actually FOTA works even with devices where "drm keys" have been lost.
I've just tested that (restoring TA-unlocked to get the lost keys state) and I was able to fully install fota from 47.2.A.4.45 to 47.2.A.6.30 using my patched kernel with XZ1c.
So for FOTA it is working. And with pie, camera works without device master key (both with stock and with this unlock hiding kernel).
You would not get video image enhancements obviously, but currently there is no drmfix available with pie that would make it work, is it?
So I guess this is quite good actually (in pie case) even for devices without TA restored.
@karrouma, I am not sure what you mean.
Click to expand...
Click to collapse
If you unlocked your bootloader
And you are in pie,
This patch is not working
You want a brand new device to backup the drm from oreo
And it is ok after
karrouma said:
If you unlocked your bootloader
And you are in pie,
This patch is not working
You want a brand new device to backup the drm from oreo
And it is ok after
Click to expand...
Click to collapse
The kernel can be used on UB, just for updates though.
Beetle84 said:
The kernel can be used on UB, just for updates though.
Click to expand...
Click to collapse
Yes i know
But if you don't backup your ta partion
The message when booting still appearing
karrouma said:
If you unlocked your bootloader
And you are in pie,
This patch is not working
You want a brand new device to backup the drm from oreo
And it is ok after
Click to expand...
Click to collapse
As described above, the patched kernel enables fota system update even in case of unlocked phone with drm keys lost and the update can be installed as described.
So it is working even in the case which I originally assumed it would not work.
karrouma said:
Yes i know
But if you don't backup your ta partion
The message when booting still appearing
Click to expand...
Click to collapse
If you mean the "Your device software cannot be checked for corruption. Please lock the bootloader." message displayed right at the beginning of boot - that has nothing to do with (patched or not) kernel or not even with the state of phone's TA (if it was restored after unlock with from locked state backup or if "drm keys" got lost because TA was not backed up before unlock).
That message will be there just from the fact that the bootloader had been unlocked. It is displayed by bootloader even before kernel is loaded.
Restore of TA does not re-lock the bootloader (like it has been the case with some previous xperia generations), so we cannot get rid of that message ever after unlock of a phone.
But with that message Sony suggests to (re)lock the bootloader - maybe someone could claim it to make sony tell us how we should do the re-lock of the bootloader.
Great work I'll implement this into my kernel with credit to you!
@LazerL0rd, thanks for letting me know.
Just wondering, do you plan to support fota system update of stock fw as I did or is your goal just to mask that bootloader had been unlocked?
Anyway, it's good to see that my work is useful.
j4nn said:
As described above, the patched kernel enables fota system update even in case of unlocked phone with drm keys lost and the update can be installed as described.
So it is working even in the case which I originally assumed it would not work.
If you mean the "Your device software cannot be checked for corruption. Please lock the bootloader." message displayed right at the beginning of boot - that has nothing to do with (patched or not) kernel or not even with the state of phone's TA (if it was restored after unlock with from locked state backup or if "drm keys" got lost because TA was not backed up before unlock).
That message will be there just from the fact that the bootloader had been unlocked. It is displayed by bootloader even before kernel is loaded.
Restore of TA does not re-lock the bootloader (like it has been the case with some previous xperia generations), so we cannot get rid of that message ever after unlock of a phone.
But with that message Sony suggests to (re)lock the bootloader - maybe someone could claim it to make sony tell us how we should do the re-lock of the bootloader.
Click to expand...
Click to collapse
So if I use this kernel will I just have the same device as if it were locked but with root and that message? I'm currently having some issues with root at the moment. I'm using existenz ROM and the kernels in the thread and Snapchat keeps detecting that I'm not using legit software even though I don't even have magisk. Another thing is that if I uninstall magisk right now then my safetynet checks all fail without magisk which gives me issues with Google pay and these two problems are what make me wanna relock my bootloader. But after reading this apparently I can't even with the ta backup. So I'm mainly more concerned on a way to be able to use those applications right now and what the best possible way would be to go for it because I'm finding it difficult to find a method with or without magisk where I wouldn't get banned from Snapchat and where I would be able to use Google pay. Thanks for any suggestions it would be highly and greatly appreciated!
@RJASSI21, if you restored locked state TA and run unmodified stock fw with this kernel booted from usb via 'fastboot boot' command, you would get very close to still locked phone, but with fully working root (magisk), obviously with the unlocked warning message on boot.
I believe if you run the setup as just described, you would not have problems with apps detecting root, easily passing safetynet cts check.
The problem is when you install something like the mentioned existenz - that patches stock fw files directly and there may be processes (either in sony fw or downloaded with safetynet stuff from google or even in some apps) that discover these changes and therefore detect rooted system.
If you installed only proper magisk modules that comply with magisk system less rooting (i.e. no modifications in system nor vendor partitions) - such modules may be made hidden with magiskhide to certain apps or google's safety net check. If something simply is flashed into system or vendor partitions, it cannot be made hidden for picky processes.
That means if using only proper magisk systemless modules, you could have root and customizations, still run stock fw with verity enabled kernel booted from usb 'fastboot boot' and even allow fota system update and get it successfully installed (assuming that twrp is not flashed either, instead it is also booted from usb if needed).
j4nn said:
@RJASSI21, if you restored locked state TA and run unmodified stock fw with this kernel booted from usb via 'fastboot boot' command, you would get very close to still locked phone, but with fully working root (magisk), obviously with the unlocked warning message on boot.
I believe if you run the setup as just described, you would not have problems with apps detecting root, easily passing safetynet cts check.
The problem is when you install something like the mentioned existenz - that patches stock fw files directly and there may be processes (either in sony fw or downloaded with safetynet stuff from google or even in some apps) that discover these changes and therefore detect rooted system.
If you installed only proper magisk modules that comply with magisk system less rooting (i.e. no modifications in system nor vendor partitions) - such modules may be made hidden with magiskhide to certain apps or google's safety net check. If something simply is flashed into system or vendor partitions, it cannot be made hidden for picky processes.
That means if using only proper magisk systemless modules, you could have root and customizations, still run stock fw with verity enabled kernel booted from usb 'fastboot boot' and even allow fota system update and get it successfully installed (assuming that twrp is not flashed either, instead it is also booted from usb if needed).
Click to expand...
Click to collapse
Ok thank you for this information. So if I return to stock fw and use this kernel will I no longer get banned from things like snapchat?
https://forum.xda-developers.com/oneplus-6/help/snapchat-locking-magisk-hide-t3895685/page4
ive read in this link that its possible they detect root not magisk or the app. Also would i have to boot the kernel everytime i reboot the device? Also will i have 960fps recording back as an option and 4k in youtube?
@RJASSI21, sorry, I have no experience with snapchat or whatever that is.
As mentioned in my post above, you can get very close to locked stock particularly if locked TA was restored, including fota system update possibility.
But to keep fota system update, you would need to usb boot the kernel instead of flashing it. Or flash it and revert it before starting fota update. Same thing for twrp.
Everything is mentioned in the first and second post.
j4nn said:
@RJASSI21, sorry, I have no experience with snapchat or whatever that is.
As mentioned in my post above, you can get very close to locked stock particularly if locked TA was restored, including fota system update possibility.
But to keep fota system update, you would need to usb boot the kernel instead of flashing it. Or flash it and revert it before starting fota update. Same thing for twrp.
Everything is mentioned in the first and second post.
Click to expand...
Click to collapse
Ok so flashing this kernel would be like having a locked bootloader with root? This includes all the same features as a locked bootloader so 960fps recording and things like that. It would make it seem like it's locked and that if you put an XZP with a locked bootloader next to one with an unlocked bootloader you wouldn't be able to tell the difference?
Is that correct? Like is there anything at all that makes it noticeable at all that it's unlocked? Sorry for all the questions I just don't want to do this and then still have the same results after.
@RJASSI21, I would say so, at least in case of XZp.
With XZ1 / XZ1c you can tell the difference with use of Android Attest Key - but if I am not mistaken, that has never been present with XZp.
See "Android Attest Key lost" xz1c thread, post#98 and following posts up to post#103.
btw, could you please avoid full quoting of just last post you are replying to?
I do not think it is that useful, if the post that has been replied to is just above it, is it?
Sure thing sorry about that but everything should be answered for me now. I was unaware when unlocking the bootloader that having a ta backup wouldn't allow me to relock it so I'm just going to relock it on my z4 tablet instead since I wanted to anyway. Thanks for all the help.