Database Info

[Q] TA Restore got a bit scary. Future Advice?

Hi Guys,
So I managed to get my Z3 - D6603 to a state that I wanted: Lollipop, root and working Xposed. Only thing left to do was restore TA (Relock bootloader) so that I had all DRM functionality back - Perfect Device would result. I used Devshaft's tool to restore the backup I had taken before unlock of BL.
The fun started after the tool finished the restore and reboot the device, or rather, tried to reboot the device. The device was practically dead with only red LED visible with USB connected or a short vibrate when power button pressed. Nothing else (Very scary). Eventually managed to get the device to flash with flashtool in flashmode, no wipe. Device booted fine and on inspection I see the bootloader is infact relocked.
My question now is, what caused the 'Brick'? I would like to obtain root again by unlocking bootloader again, flashing Androplus and SuperSU, restore TA and relock. This time without getting the fright of my life thinking I had bricked my new and very expensive device. Any tips? Don't really want to data wipe again to go the PFCreator route.
Ch33rz,

Custom kernel and locked BL
Hey !
Relock bootloader (result of TA restore) with a custom kernel (Androplus,...) will soft brick the device. You can't boot a device with a locked bootloader and a custom kernel.
Don't panic, you can't hardbrick your device (but if you unplug your device during TA restore, you will brick it) !

DJPops said:
Hey !
Relock bootloader (result of TA restore) with a custom kernel (Androplus,...) will soft brick the device. You can't boot a device with a locked bootloader and a custom kernel.
Don't panic, you can't hardbrick your device (but if you unplug your device during TA restore, you will brick it) !
Click to expand...
Click to collapse
Thanks for the reply, man.
Okay, that makes sense. However, when I did the restore I had this "Stock" kernel flashed and not Androplus. Is this still not an acceptable kernel? What criteria does the kernel need to fulfil to allow a successful restore without a soft brick?

Kyle07 said:
Thanks for the reply, man.
Okay, that makes sense. However, when I did the restore I had this "Stock" kernel flashed and not Androplus. Is this still not an acceptable kernel? What criteria does the kernel need to fulfil to allow a successful restore without a soft brick?
Click to expand...
Click to collapse
No, that kernel has been modified so it is not stock
When on a locked bootloader you need the completely stock kernel, if it has been decompiled and recomiled (even with no changes) your phone will not boot on it.
Flash a FTF file or force a repair using PCComapnion to fix it

gregbradley said:
No, that kernel has been modified so it is not stock
When on a locked bootloader you need the completely stock kernel, if it has been decompiled and recomiled (even with no changes) your phone will not boot on it.
Flash a FTF file or force a repair using PCComapnion to fix it
Click to expand...
Click to collapse
Thank you. That clarifies it nicely.
Some sort of integrity check at play here?

Kyle07 said:
Thank you. That clarifies it nicely.
Some sort of integrity check at play here?
Click to expand...
Click to collapse
The fact is we do not know Sony keys, without them a locked bootloader will only boot a stock kernel

gregbradley said:
The fact is we do not know Sony keys, without them a locked bootloader will only boot a stock kernel
Click to expand...
Click to collapse
In hindsight that was a silly question. Appreciate your patience.
Still getting accustomed to modifying a Sony. Initially quite different to other Androids I've modded - mostly Samsungs.

Root without losing DRM Keys?

Hello,
Is it possible to Root my Sony Xperia Z3 D6603 which is currently running Android 5.0.2 without losing the DRM keys?
I don't want to have to roll back to 4.4.4, or lose any of my files.
I have a pretty slow internet so i'm not a big fan of downloading stuff, I'm just psyched to check out Xposed if it exists.

No, you must roll back to a FW ending in .93 which is KK, then root, then install recovery, then update via a pre-rooted flashable zip
I would not hold my breath for a lollipop exploit. The main reason to find one has gone (i.e there already is a way to get root on lollipop with a locked bootloader)

Hussain_Salam said:
Hello,
Is it possible to Root my Sony Xperia Z3 D6603 which is currently running Android 5.0.2 without losing the DRM keys?
I don't want to have to roll back to 4.4.4, or lose any of my files.
I have a pretty slow internet so i'm not a big fan of downloading stuff, I'm just psyched to check out Xposed if it exists.
Click to expand...
Click to collapse
rooting has nothing to do with the DRM keys
you have to downgrade.
you will lose your data.
you have to download a kitkat stock rom.
No way around this if you want root.

android404 said:
rooting has nothing to do with the DRM keys
Click to expand...
Click to collapse
It does if you root by unlocking the bootloader. Doing this wipes the TA partition where the DRM keys are kept
you will lose your data.
Click to expand...
Click to collapse
Not if you do not wipe the data partition of flash the data partition from the FTF. You will get a lot of FC's when downgraded but this is not an issue as you will be upgrading immediately to Lollipop anyway

gregbradley said:
It does if you root by unlocking the bootloader. Doing this wipes the TA partition where the DRM keys are kept
Not if you do not wipe the data partition of flash the data partition from the FTF. You will get a lot of FC's when downgraded but this is not an issue as you will be upgrading immediately to Lollipop anyway
Click to expand...
Click to collapse
Of course... Thanks for correcting me.

gregbradley said:
It does if you root by unlocking the bootloader. Doing this wipes the TA partition where the DRM keys are kept
Not if you do not wipe the data partition of flash the data partition from the FTF. You will get a lot of FC's when downgraded but this is not an issue as you will be upgrading immediately to Lollipop anyway
Click to expand...
Click to collapse
But why revert if he is unlocking?
If he is unlocking he can flash a kernel with recovery and root via TWRP.
Before back up TA.
And after restore the DRM keys.
Easy.

TheTeslaCoil said:
But why revert if he is unlocking?
If he is unlocking he can flash a kernel with recovery and root via TWRP.
Click to expand...
Click to collapse
Please read the OP, he does not want to lose DRM keys, hence he needs to root without unlocking the bootloader first.
Also, if you have a custom kernel installed you cannot have DRM keys running, once you restore them using a TA partition restore you relock the bootloader and cannot boot on a custom kernel.

gregbradley said:
Please read the OP, he does not want to lose DRM keys, hence he needs to root without unlocking the bootloader first.
Also, if you have a custom kernel installed you cannot have DRM keys running, once you restore them using a TA partition restore you relock the bootloader and cannot boot on a custom kernel.
Click to expand...
Click to collapse
The DRM can be restored.
I rest my case.

TheTeslaCoil said:
The DRM can be restored.
I rest my case.
Click to expand...
Click to collapse
sigh,,,
No they cannot unless you have taken a backup before unlocking the bootloader.
There is a thread about restoring some functionality but it does not restore to 100% stock compared to when people have a stock ROM with DRM keys installed, and like I said, READ THE OP, he asked for a way not to lose his DRM keys, not to have the functions associated with them.
If you unlock without backing them up, you cannot restore them, FACT!
I really do not want to get into an online fracas with you, but this is the second time today you are jumping in and not giving exactly 100% correct answers to the questions asked.
android404 said:
Of course... Thanks for correcting me.
Click to expand...
Click to collapse
No worries

gregbradley said:
sigh,,,
No they cannot unless you have taken a backup before unlocking the bootloader.
There is a thread about restoring some functionality but it does not restore to 100% stock compared to when people have a stock ROM with DRM keys installed, and like I said, READ THE OP, he asked for a way not to lose his DRM keys, not to have the functions associated with them.
If you unlock without backing them up, you cannot restore them, FACT!
I really do not want to get into an online fracas with you, but this is the second time today you are jumping in and not giving exactly 100% correct answers to the questions asked.
Click to expand...
Click to collapse
But I already said, if you back up TA.
Check again.
And you appear to be a person that doesn' t like to be contradicted.
So...see you later.

TheTeslaCoil said:
But I already said, if you back up TA.
Check again.
And you appear to be a person that doesn' t like to be contradicted.
So...see you later.
Click to expand...
Click to collapse
Please tell the user how to back up his TA then without rooting first...
You need to back it up before unlocking the bootloader and you need root to back it up....
From now on I think me and you should only talk via PM.
Regards.

Root, backup TA. Save it on your laptop.
Unlock bootloader.
Enjoy a rooted unlocked device with endless possibilities.
If you ever want to have your phone as it was when you bought it, restore TA, unroot etc.
Easy peasy japanesey.

TheTeslaCoil said:
Root, backup TA. Save it on your laptop.
Unlock bootloader.
Enjoy a rooted unlocked device with endless possibilities.
If you ever want to have your phone as it was when you bought it, restore TA, unroot etc.
Easy peasy japanesey.
Click to expand...
Click to collapse
OK, so we are back at the situation the OP asked, how does he root without losing the DRM keys...... Your method said to unlock the boot to flash a custom kernel... That wipes the TA partition and the DRM keys BEFORE you have had a chance to back them up.
PS, as I said lets keep this via PM, I already sent one before you replied here.

gregbradley said:
OK, so we are back at the situation the OP asked, how does he root without losing the DRM keys...... Your method said to unlock the boot to flash a custom kernel... That wipes the TA partition and the DRM keys BEFORE you have had a chance to back them up.
PS, as I said lets keep this via PM, I already sent one before you replied here.
Click to expand...
Click to collapse
Just to follow up with this discussion. I am currently on a locked bootloader but rooted and installed recovery using the method mentioned in the other thread. How can I back up my TA partition? I can't find a tutorial link on TA partition backup.

mf1tym said:
Just to follow up with this discussion. I am currently on a locked bootloader but rooted and installed recovery using the method mentioned in the other thread. How can I back up my TA partition? I can't find a tutorial link on TA partition backup.
Click to expand...
Click to collapse
You have already done the "hard" part. Do some reading on this thread http://forum.xda-developers.com/showthread.php?t=2292598 ,will be short , download zip within OP ,extract and run. After you created backup store it safely I think I have mine on 4 locations (cloud and local) although I doubt I will be unlocking bootloader anytime soon.

gregbradley said:
OK, so we are back at the situation the OP asked, how does he root without losing the DRM keys...... Your method said to unlock the boot to flash a custom kernel... That wipes the TA partition and the DRM keys BEFORE you have had a chance to back them up.
PS, as I said lets keep this via PM, I already sent one before you replied here.
Click to expand...
Click to collapse
I said backup TA.
So...I' m right.

schetz said:
You have already done the "hard" part. Do some reading on this thread http://forum.xda-developers.com/showthread.php?t=2292598 ,will be short , download zip within OP ,extract and run. After you created backup store it safely I think I have mine on 4 locations (cloud and local) although I doubt I will be unlocking bootloader anytime soon.
Click to expand...
Click to collapse
Schetz, thanks mate. I saw this link before. It said it's unmaintained and the devices capatable is only to Z2 so I thought it did not work on the Z3. But I will re-read it again.

TheTeslaCoil said:
I said backup TA.
So...I' m right.
Click to expand...
Click to collapse
You said to root by unlocking the bootloader first, then backup the TA so you are wrong. Editing your post after the fact does not change this, adding the line "Before backup TA" does not make you correct as you have to root to backup the TA.. so when you say "why revert when he can just unlock", that's why.
And finally, restoring the DRM keys after unlocking means you get a locked bootloader, so you cannot boot a custom kernel so you lose root...
The point is now moot, and you need to remember my advice on this, keep it in PM's

[Q] Locking bootloader

How Has anyone of you have any idea how to lock the bootloader on E3?

help3r said:
How Has anyone of you have any idea how to lock the bootloader on E3?
Click to expand...
Click to collapse
If you had made a backup of DRM keys before you unlocked, you can restore them and lock your bootloader.
If you hadn't done it, bad luck, they're lost, DRM keys are device specific and you can't restore them from another device.

I do not have a backup, made DRM keys, but do not want to restore them. I just wanted to lock the bootloader (factory Uploader software) because it resells the phone.

help3r said:
I do not have a backup, made DRM keys, but do not want to restore them. I just wanted to lock the bootloader (factory Uploader software) because it resells the phone.
Click to expand...
Click to collapse
They dont check the bootloader. I have sold many phones which were unlocked and rooted.

Yes, do not check, but if you need to give your phone under warranty then check if the bootloader is unlocked.

I ve backup my TA partition....then wanna restore...
but confused that which step is 1st Relock or restore..

So I have to do that without partition backup TA does not block the bootloader?

I repeat the question. Is it possible to lock the bootloader back without having done a backup TA?

help3r said:
I repeat the question. Is it possible to lock the bootloader back without having done a backup TA?
Click to expand...
Click to collapse
no

Help with Bacup TA > UL > Root > Unroot > ReLock BL/Restore TA

Hi all,
So I read people are now able to backup TA partition (DRM Keys) before Unlocking the Bootloader.
Keep in mind my aim for instance here is to install BBS (Better Battery Stats app) onto the system partition for full battery stats.
Now my question is can the below tasks be achieved in this order.:
1. Downgrade to an exploitable Firmware (MM?)
2. Backup TA partition
3. UL BL (Unlock Bootloader)
4. Root device
5. Install BetterBatteryStats onto System partition.
6. Unroot device
8. L BL (Lock Bootloader)
9. Restore TA partition.
And where in this list would be best to upgrade to Nougat.
I believe I achieved something similar on my z5c, but it's been a while now since I've wanted to root. But given the recent TA exploits I'm thinking it's time to geek again.
I believe if we can define the above process explicitly, many people would be happy.
As much information, direction, insight, instructions on all of the points above would be greatly appreciated by and for my.fellow XZ'ers :fingers-crossed:

I'm also curious on how to unlock, root and restore
I know it was possible to be rooted with locked bootloader on Z3 but have not seen how to on the XZ yet

Sonic Dash said:
I'm also curious on how to unlock, root and restore
I know it was possible to be rooted with locked bootloader on Z3 but have not seen how to on the XZ yet
Click to expand...
Click to collapse
Its not possible to have root on a locked bootloader on the XZ.
dillalade said:
Hi all,
Keep in mind my aim for instance here is to install BBS (Better Battery Stats app) onto the system partition for full battery stats.
And where in this list would be best to upgrade to Nougat.
Click to expand...
Click to collapse
Try this
Downgrade to MM
Backup TA
Upgrade to Nougat
Unlock bootloader and root
Install BBS
Remove root and relock bootloader
I have no guarantee it will work though and the DM-verity would probably lead to a bootloop or a non booting device. Be sure you know how to get out of this before you proceed.

gregbradley said:
Its not possible to have root on a locked bootloader on the XZ.
Click to expand...
Click to collapse
What's the reason for this?
Doesn't the Z3 have similar protection as the XZ?

Sonic Dash said:
What's the reason for this?
Doesn't the Z3 have similar protection as the XZ?
Click to expand...
Click to collapse
No, the XZ has verified boot security (DM-verity). The bootloader will not allow a non signed kernel to boot. Stock kernels will not allow a modified system to boot. Hence you need to unlock the boot for the phone to boot if you change the system partition by just one bit....

gregbradley said:
No, the XZ has verified boot security (DM-verity). The bootloader will not allow a non signed kernel to boot. Stock kernels will not allow a modified system to boot. Hence you need to unlock the boot for the phone to boot if you change the system partition by just one bit....
Click to expand...
Click to collapse
Okay that makes sense, so with it being unlocked is there any way to hide the device unlocked screen at boot?
Im sure I also have seen talks about DRM keys being flashed in and being possible to use with unlocked bootloaderers did anything ever come of that?

Sonic Dash said:
Okay that makes sense, so with it being unlocked is there any way to hide the device unlocked screen at boot?
Im sure I also have seen talks about DRM keys being flashed in and being possible to use with unlocked bootloaderers did anything ever come of that?
Click to expand...
Click to collapse
I do not know any way of hiding the screen. Also, the DRM fix that is used with an unlocked bootlader is not a full restore of the keys. DRM functionality is restores and to my knowledge it is not 100% the same as restoring the TA partition fully.

gregbradley said:
I do not know any way of hiding the screen. Also, the DRM fix that is used with an unlocked bootlader is not a full restore of the keys. DRM functionality is restores and to my knowledge it is not 100% the same as restoring the TA partition fully.
Click to expand...
Click to collapse
After some research it seems like this warning is stored in the logo.
I found a post from a few months back with a guide on how to remove it for the Moto G4
Maybe its the same for our XZ?

Sonic Dash said:
After some research it seems like this warning is stored in the logo.
I found a post from a few months back with a guide on how to remove it for the Moto G4
Maybe its the same for our XZ?
Click to expand...
Click to collapse
Yes, this can be changed in the kernel from what I remember.

gregbradley said:
Its not possible to have root on a locked bootloader on the XZ.
Try thisDowngrade to MM
Upgrade to Nougat
Install BBS
Remove root and relock bootloader
I have no guarantee it will work though and the DM-verity would probably lead to a bootloop or a non booting device. Be sure you know how to get out of this before you proceed.
Click to expand...
Click to collapse
Not sure I follow your procedure, seems redundant, I assume you've missed out a few steps there by accident.
But thanks anyway.
However, if the DM verity you mention does what it should then I guess by editing the system partition as I proposed and then relocking would cause a bootloop.
I hope there is a way and perhaps others can share more insight.

dillalade said:
Not sure I follow your procedure, seems redundant, I assume you've missed out a few steps there by accident.
But thanks anyway.
However, if the DM verity you mention does what it should then I guess by editing the system partition as I proposed and then relocking would cause a bootloop.
I hope there is a way and perhaps others can share more insight.
Click to expand...
Click to collapse
Your quote has missed some of the steps I mentioned...
•Downgrade to MM
•Backup TA
•Upgrade to Nougat
•Unlock bootloader and root
•Install BBS
•Remove root and relock bootloader
But yes, I presume a bootloop will result from it

dillalade said:
Hi all,
So I read people are now able to backup TA partition (DRM Keys) before Unlocking the Bootloader.
Keep in mind my aim for instance here is to install BBS (Better Battery Stats app) onto the system partition for full battery stats.
Now my question is can the below tasks be achieved in this order.:
1. Downgrade to an exploitable Firmware (MM?)
2. Backup TA partition
3. UL BL (Unlock Bootloader)
4. Root device
5. Install BetterBatteryStats onto System partition.
6. Unroot device
8. L BL (Lock Bootloader)
9. Restore TA partition.
And where in this list would be best to upgrade to Nougat.
I believe I achieved something similar on my z5c, but it's been a while now since I've wanted to root. But given the recent TA exploits I'm thinking it's time to geek again.
I believe if we can define the above process explicitly, many people would be happy.
As much information, direction, insight, instructions on all of the points above would be greatly appreciated by and for my.fellow XZ'ers :fingers-crossed:
Click to expand...
Click to collapse
It won't work! As @gregbradley said, dm-verity does not allow unsigned partitions (eg modified /system) to be loaded, and the procedure you wanna try will result in a bootloop for sure!
Now that we have a specific tool to perform backup of TA partition, "safe" root came true. So why not to do that?
You can always restore your original TA.img and flash full stock firmware, which will give you a locked device like the never-unlocked one!
Anyway... try it at your own risk!

gregbradley said:
Yes, this can be changed in the kernel from what I remember.
Click to expand...
Click to collapse
So who would be best to contact in regards to making this? @AndroPlus perhaps?

How to convert ta.img to file ta.zip flash twrp

s-6182 said:
How to convert ta.img to file ta.zip flash twrp
Click to expand...
Click to collapse
Just realised, you won't need to convert anything!
In TWRP, select - Install Image (under Install button on the home menu) and locate the TA.img from there.
Apparently, you might not need to flash stock firmware afterwards, but I would do that if I were you just to make sure everything works cleanly!

gregbradley said:
No, the XZ has verified boot security (DM-verity). The bootloader will not allow a non signed kernel to boot. Stock kernels will not allow a modified system to boot. Hence you need to unlock the boot for the phone to boot if you change the system partition by just one bit....
Click to expand...
Click to collapse
Why did Sony do that?
I just dont want to see ads in games and apps.
For these, root was enough. At least my old Z3 phone.
I do not want to open the unlock bootloader, because the device may have serious performance degradation especially on the camera, right?!
Is it possible in the near future to make root without unlock bootloader ?
P.S.: If I knew that, I would not buy XZ.

please stop the discussion on SONY's security measures here
FerhaDo said:
I do not want to open the unlock bootloader, because the device may have serious performance degradation especially on the camera, right?!
Is it possible in the near future to make root without unlock bootloader ?
Click to expand...
Click to collapse
This has been beaten to death in the post Z3 devices fora.
You can read A LOT about in e.g. the Z5 section.
Authorative Guide:
http://forum.xda-developers.com/crossdevice-dev/sony/noob-guide-to-sony-ericsson-xperia-t3209012

Questions about Unlocking Bootloader

Hello, could someone help me with some questions please? It is more concerned with unlocking the bootloader and security so I am sorry if this isn't the right place, but any help is greatly appreciated as I come from iOS & Jailbreaking.
1) other than my data, what should I backup before/after unlocking the bootloader? maybe recovery and persistent partitions? and how would I do that, by booting TWRP from FastBoot before flashing it?
2) I am planning on flashing Evo X and I assume with the SafetyNet Fix zip provided I'd be able to pass SafetyNet, but what about Widevine? Will it still be L1 after unlocking & flashing Evo X? If not, is L1 permanently lost after unlocking the bootloader?
3) anything else I should know / do before I proceed?
Thanks in Advance!

1) we cannot restore Miui data to AOSP
2) After flashing many aosp roms, I never lost FOD and L1.(ask the question on the Evo X rom thread)

NOSS8 said:
1) we cannot restore Miui data to AOSP
2) After flashing many aosp roms, I never lost FOD and L1.(ask the question on the Evo X rom thread)
Click to expand...
Click to collapse
Hey, thanks for the response, for #1, I don't mean my personal data, but rather system partitions like the recovery and persistent partitions, I heard that the persistent partition stores the Widevine certificates, how can I backup those? And how can I restore them if needed?
Thanks!

Not possible
If you want to go back to Miui just flash the original rom with miflash in fastboot mode.
I have already done this several times without problem.

NOSS8 said:
Not possible
If you want to go back to Miui just flash the original rom with miflash in fastboot mode.
I have already done this several times without problem.
Click to expand...
Click to collapse
Honestly I don't understand, I don't want to go back to MIUI, basically I looked up online on Widevine, and it said the Widevine certificates are stored in some persist.img or partition or something like that, how do I backup that?
Or do you mean I do not need to backup anything? I can just straight up flash custom ROM without any worries of losing Widevine L1?

Or do you mean I do not need to backup anything? I can just straight up flash custom ROM without any worries of losing Widevine L1? Yes
Evo x=google dialer so no call recorder

NOSS8 said:
Or do you mean I do not need to backup anything? I can just straight up flash custom ROM without any worries of losing Widevine L1? Yes
Evo x=google dialer so no call recorder
Click to expand...
Click to collapse
Okay thanks! Hopefully everything goes well when I can finally unlock

TGX20 said:
Okay thanks! Hopefully everything goes well when I can finally unlock
Click to expand...
Click to collapse
Currently twrp is not 100% functional, use magisk only for SafetyNet.
to avoid erasure or other problems on partitions.
https://forum.xda-developers.com/t/failed-to-mount-invalid-argument.4199945/
https://forum.xda-developers.com/t/cannot-mount-system_root-and-product-read-only.4120501/