Tmobile US Sony Z1s Root Bounty ($670.00) CLOSED Root Achieved!!!

Search This thread
By:
Advanced…
epsix

epsix

Senior Member
Aug 29, 2010
2,112
334
Didn't know getting root on Sony Z1s was a pain in the butt. :confused:

Bounty not good enough to get devs attentions?:(

Sent from my C6916 using Tapatalk 2
 
P

POMF2K

Senior Member
Jan 2, 2009
167
26
Traverse City, MI
Forty from me... it's been so long since i saw ads on Android. I can't take much more.

When we do get root... How do we stop ota updatrs that break root? I can't stand the persistent update notification.

Also is it to my benefit to just buy international version of next Sony phone so i don't have to deal with this ever again?
 
  • Like
Reactions: epsix and Vision77
krabappel2548

krabappel2548

Inactive Recognized Developer
Nov 15, 2011
6,444
16,111
Lommel
For those wondering, my Z1 is dead, bootloader is ****ed up so they should sent me a replacement. And I'm sick so didn't do anything else then lay and rest.

Sent from my MT15i using xda app-developers app
 
  • Like
Reactions: brokeasshachi
daveakowalski

daveakowalski

Member
Feb 13, 2014
16
21
Detroit
Feel better...

krabappel2548 said:
For those wondering, my Z1 is dead, bootloader is ****ed up so they should sent me a replacement. And I'm sick so didn't do anything else then lay and rest.

Sent from my MT15i using xda app-developers app
Click to expand...
Click to collapse

Sorry to hear about your phone and that you're under the weather. I know there's not a lot of us here, but we all very much appreciate your efforts!

Hope you feel better soon, take care.

Just curious, did your phone break working on this, or was it something unrelated?
 
epsix

epsix

Senior Member
Aug 29, 2010
2,112
334
Update

_-..zKillA..-_ 20
epsix 20
shook187 20
TravieMcFly 20
Josh McGrath 20
Silenthillnight 20.
sgyee 20
brokeasshachi 20
fatannasty 20 just received your transfer:)
daveakowalski 40
xndabox 10
POMF2K 40
joedeveloper 20

Total = $290.00 USD :D

PS, Dev Z1s is 32gig internal storage, we just need root. :thumbup::cool:

krabappel2548, trying to help us get root.
Any others devs want to join the party? :thumbup:

Sent from my C6916 using Tapatalk 2
 
Last edited:
  • Like
Reactions: fatannasty, pstuart and Josh McGrath
joedeveloper

joedeveloper

Senior Member
Jul 24, 2009
497
103
Las Vegas
epsix said:
Update

zKillA 20
epsix 20
shook187 20
TravieMcFly 20
Josh McGrath 20
Silenthillnight 20.
sgyee 20
brokeasshachi 20
fatannasty 20 just received your transfer:)
daveakowalski 40
xndabox 10
POMF2K 40

Total = $270.00 USD :D

PS, Dev Z1s is 32gig internal storage, we just need root. :thumbup::cool:


Sent from my C6916 using Tapatalk 2
Click to expand...
Click to collapse

I'm down for $20 myself. Should be getting my Z1s tonight. Where's the OP to update this thread?
 
  • Like
Reactions: epsix
krabappel2548

krabappel2548

Inactive Recognized Developer
Nov 15, 2011
6,444
16,111
Lommel
daveakowalski said:
Sorry to hear about your phone and that you're under the weather. I know there's not a lot of us here, but we all very much appreciate your efforts!

Hope you feel better soon, take care.

Just curious, did your phone break working on this, or was it something unrelated?
Click to expand...
Click to collapse

My phone didn't broke while working on this, but I also found out Z1s won't be able to flash Z1 bootloader.

I'll make a new ftf for my tester to see if it will finally boot 534fw. If it doesn't then I need to think about a new method. I'll go to the doctor today so hopefully some meds will make me better soon :) I'm feeling a little better so I'll probably create and upload the ftf today.

Sent from my MT15i using xda app-developers app
 
  • Like
Reactions: fatannasty, brokeasshachi and Josh McGrath
brokeasshachi

brokeasshachi

Member
Jan 6, 2011
24
7
NorCal, USA/Kanagawa, JP
krabappel2548 said:
My phone didn't broke while working on this, but I also found out Z1s won't be able to flash Z1 bootloader.

I'll make a new ftf for my tester to see if it will finally boot 534fw. If it doesn't then I need to think about a new method. I'll go to the doctor today so hopefully some meds will make me better soon :) I'm feeling a little better so I'll probably create and upload the ftf today.

Sent from my MT15i using xda app-developers app
Click to expand...
Click to collapse


Thanks for your hard work home-skilly. Feel better soon :good:
 
  • Like
Reactions: fatannasty
O

OCedHrt

Senior Member
May 18, 2009
721
63
San Jose
krabappel2548 said:
My phone didn't broke while working on this, but I also found out Z1s won't be able to flash Z1 bootloader.

I'll make a new ftf for my tester to see if it will finally boot 534fw. If it doesn't then I need to think about a new method. I'll go to the doctor today so hopefully some meds will make me better soon :) I'm feeling a little better so I'll probably create and upload the ftf today.

Sent from my MT15i using xda app-developers app
Click to expand...
Click to collapse

If there's a way to package the 534 kernel in Z1s's sin header, it should flash.
 
  • Like
Reactions: drewkj09, Josh McGrath and fatannasty
T

T_O_N_Y_

Member
Jan 8, 2011
48
12
Dallas
krabappel2548 said:
If it wants to boot yes, I've sent the new ftf to my testers to test, they will test after work (night for me) so I'll know more tomorrow

Sent from my MT15i using xda app-developers app
Click to expand...
Click to collapse

This Is The Log I Received Whenever Flashing The FTF

14/023/2014 16:23:26 - INFO - <- This level is successfully initialized
14/023/2014 16:23:26 - INFO - Flashtool Version 0.9.13.0 built on 2013-06-04 22:50:00
14/023/2014 16:23:30 - INFO - Device disconnected
14/023/2014 16:23:38 - INFO - Selected C6916 / 14.1.A.1.534 / root_test
14/023/2014 16:23:39 - INFO - Preparing files for flashing
14/024/2014 16:24:46 - INFO - Please connect your device into flashmode.
14/025/2014 16:25:09 - INFO - Device connected in flash mode
14/025/2014 16:25:10 - INFO - Opening device for R/W
14/025/2014 16:25:10 - INFO - Reading device information
14/025/2014 16:25:10 - INFO - Phone ready for flashmode operations.
14/025/2014 16:25:10 - INFO - Current device : C6916 - CB5A1WFAMD - 1277-0679_R12B - 1272-6084_14.2.C.0.159 - TMOUS-LTE_14.2.C.0.159
14/025/2014 16:25:10 - INFO - Start Flashing
14/025/2014 16:25:10 - INFO - Processing loader.sin
14/025/2014 16:25:10 - INFO - Checking header
14/025/2014 16:25:10 - INFO - Flashing data
14/025/2014 16:25:10 - INFO - Loader : S1_Root_6732 - Version : MSM8974_23 / Boot version : S1_Boot_MSM8974_LA1.04_15 / Bootloader status : NOT_ROOTABLE
14/025/2014 16:25:10 - INFO - Processing partition-image.sin
14/025/2014 16:25:10 - INFO - Checking header
14/025/2014 16:25:10 - INFO - Flashing data
14/025/2014 16:25:10 - INFO - Processing kernel.sin
14/025/2014 16:25:10 - INFO - Checking header
14/025/2014 16:25:10 - INFO - Ending flash session
14/025/2014 16:25:10 - ERROR - ERR_SEVERITY="MINOR";ERR_CODE="0017";ERR_DYNAMIC="0x80080028 ";
14/025/2014 16:25:10 - ERROR - Error flashing. Aborted
14/025/2014 16:25:11 - INFO - Device connected in flash mode
14/025/2014 16:25:11 - INFO - Device disconnected
 
  • Like
Reactions: fatannasty
krabappel2548

krabappel2548

Inactive Recognized Developer
Nov 15, 2011
6,444
16,111
Lommel
T_O_N_Y_ said:
This Is The Log I Received Whenever Flashing The FTF

14/023/2014 16:23:26 - INFO - <- This level is successfully initialized
14/023/2014 16:23:26 - INFO - Flashtool Version 0.9.13.0 built on 2013-06-04 22:50:00
14/023/2014 16:23:30 - INFO - Device disconnected
14/023/2014 16:23:38 - INFO - Selected C6916 / 14.1.A.1.534 / root_test
14/023/2014 16:23:39 - INFO - Preparing files for flashing
14/024/2014 16:24:46 - INFO - Please connect your device into flashmode.
14/025/2014 16:25:09 - INFO - Device connected in flash mode
14/025/2014 16:25:10 - INFO - Opening device for R/W
14/025/2014 16:25:10 - INFO - Reading device information
14/025/2014 16:25:10 - INFO - Phone ready for flashmode operations.
14/025/2014 16:25:10 - INFO - Current device : C6916 - CB5A1WFAMD - 1277-0679_R12B - 1272-6084_14.2.C.0.159 - TMOUS-LTE_14.2.C.0.159
14/025/2014 16:25:10 - INFO - Start Flashing
14/025/2014 16:25:10 - INFO - Processing loader.sin
14/025/2014 16:25:10 - INFO - Checking header
14/025/2014 16:25:10 - INFO - Flashing data
14/025/2014 16:25:10 - INFO - Loader : S1_Root_6732 - Version : MSM8974_23 / Boot version : S1_Boot_MSM8974_LA1.04_15 / Bootloader status : NOT_ROOTABLE
14/025/2014 16:25:10 - INFO - Processing partition-image.sin
14/025/2014 16:25:10 - INFO - Checking header
14/025/2014 16:25:10 - INFO - Flashing data
14/025/2014 16:25:10 - INFO - Processing kernel.sin
14/025/2014 16:25:10 - INFO - Checking header
14/025/2014 16:25:10 - INFO - Ending flash session
14/025/2014 16:25:10 - ERROR - ERR_SEVERITY="MINOR";ERR_CODE="0017";ERR_DYNAMIC="0x80080028 ";
14/025/2014 16:25:10 - ERROR - Error flashing. Aborted
14/025/2014 16:25:11 - INFO - Device connected in flash mode
14/025/2014 16:25:11 - INFO - Device disconnected
Click to expand...
Click to collapse

Same as other tester, going to bed now will fix it tomorrow

Sent from my MT15i using xda app-developers app
 
  • Like
Reactions: _-..zKiLLA..-_ and T_O_N_Y_
You must log in or register to reply here.

Similar threads

krabappel2548
Root, Backup TA, Unlock bootloader and more! The ultimate Xperia Z1 guide
Replies
1K
Views
552K
Y
Yasrowbel
hyelton
[FTF] C6902 & C6903 & C6906 & C6943 FTF Mega Collection
Replies
2K
Views
813K
L
lokesh ganesh
I
New Sony Xperia D6503
Replies
1K
Views
291K
Levered
Levered
Waledac
Root Xperia Z1 Lollipop 5.1.1 Build 14.6.A.1.216 / 14.6.A.0.368 [ LB / UBL ]
Replies
122
Views
172K
A
Anzee
Waledac
Root 14.4.A.0.157 [ LB / UBL ]
Replies
197
Views
148K
gjagadish3
gjagadish3

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 36
    jcase
    jcase
    std396 said:
    I hope I don't offend anyone, but thats pretty dumb. It will be like my pharmacy lab saying "We have the cure for your disease, but we won't release it till August. In the mean time die." How dumb. Oh well! Money was not an issue to me, I would have helped pay for the early release. Good luck everyone!

    Sent from my C6916 using XDA Premium 4 mobile app
    Click to expand...
    Click to collapse

    What is dumb is comparing access to a root exploit, to life saving medical care.

    Since money is no issue to you, put it where your mouth is.

    Just because of your utterly ridiculous analogy, $250 VERIFIABLE donation to a Mary Bridge Children's hospital, 100% verification must be provided along with return shipping label. Device will be mailed to my office, I will root and remove write protection, reship in the original shipping material within 3 days. Use a reusable box, that is appropriate for this purpose.

    https://waystohelp.multicare.org/donate-to-mary-bridge

    Make it $1500 (yourself alone) and I will will match the donation out of my pocket.

    *Edit I am out of state until next week, so this can not go down until then*
    View
    35
    jcase
    jcase
    Geez no one can get root working? Full details are posted everywhere. Fine, here.


    Dear Sony, :/ sorry for violating my self imposed embargo, someone else outed the vulnerability and build exploits (See z2 root) based on google patches before August. It was happening with or without beaups and I. Either google needs a longer embargo, or us carriers need to be faster to allow updates.



    If bounty still exists, please send to jcase@cunninglogic.com, I will split with @beaups and then dispense my half to the charity of my choice. If it doesn't, I hope everyone got their money back.

    donations can also be sent to jcase@cunninglogic.com, please note what they are for so i can split them with beaups

    Code: 
    adb push pwn /data/local/tmp/pwn

adb shell chmod 755 /data/local/tmp/pwn

adb shell /data/local/tmp/pwn

    then wait until adb works agian, and then reboot


    Someone else will have to setup a proper way to disable write to system, however running /system/xbin/kill_ric.sh will disable ric and allow you to write to system until reboot. Until a better approach is setup, i suggest using some on boot app to run it as root.

    You will need supersu app from the market. Dont ask me for support if you didn't follow directions, dont ask me for support unless it throws errors.

    epsix said:
    Thank you ZKillA for transferring this thread to me.

    I will bare the paypal deduction fees, as of right now the moneys that i recieved from the list is $520.00. And $150.00 are unaccounted

    shook187 ask to be remove from the list.

    Please when you send the money make sure you transfer as "GIFT"

    Update!!!

    _-..zKillA..-_ 20
    epsix 20 payment recieved
    TravieMcFly 20 payment received
    Josh McGrath 30 payment received
    Silenthillnight 20 payment received
    sgyee 20. payment received
    brokeasshachi 20
    fatannasty 20 payment received
    daveakowalski 40 payment received
    xndabox 10
    POMF2K 40
    joedeveloper 20
    murdermonkey9000 20
    mugetsu666 10 payment received
    randaddy 20 payment received
    maddeath 10 payment received
    holabola 5 payment received
    Jdom58 20
    StephenT 150.00 payment received
    TrunkleBob 25 payment received via Google Wallet
    Don_Perrignon 40 payment received
    camdogrs 10 payment received
    h20x 20 payment received
    FranzDages 15 payment received
    Generalgr147 25 payment received
    marksee 20 payment received

    Total = $670.00 USD :D

    PS, Dev Z1s is 32gig internal storage, we just need root. :thumbup::cool:

    krabappel2548, trying to help us get root.
    Any others devs want to join the party? :thumbup:


    If you guys trust me, then just send the money through PayPal and mentioned your xda username. Then I'll counted up and once we have root I send one time transfer to the Dev, it's up to you
    Click to expand...
    Click to collapse
    View
    14
    ApriliaM3
    ApriliaM3
    Thread cleaned guys and apologies for the delay...
    Let's hope I don't need to be returning any time soon, to cleanup more of the same.
    View
    12
    jcase
    jcase
    Ok, for those looking to exploit this device.

    Disabling the ric process is not enough, you still won't be able to mount system.

    A friend did some kernel source checking, /sys/kernel/security/sony_ric/enable is no longer an option without changing the cmdline option oemandroidboot.security to 0, which with the locked bootloader we can't do.

    It is going to take a secondary exploit, or patching the kernel memory to be able to remount /system.

    Root itself was trivial, I got root on @joedeveloper 's phone (using an exploit I wrote to root my Xperia Z and Tablet Z) and was able to dump some data last night. Writing su to /system however is going to be the sticking point.

    If anyone wants specific data from a rooted device, such as the boot.img please let me know and I will post it.
    View
    11
    daveakowalski
    daveakowalski
    Seems there hasn't been much progress on the topic at hand, and this thread keeps deteriorating to "omg Sony/T-mobile/locked boot loaders suck" and how the grass must be greener with other phones and other carriers.

    I respect the sentiment, but I don't think it has any place in this thread.

    - No one made anybody buy the Z1s... If you didn't know the bootloader was locked and there was no public root method available, you didn't spend 15 minutes on this forum and I hope this experience has been an existential one.

    - Please stop telling people guilty of the previous point to buy an international Z1. There are plenty of reasons to want a phone from tmo: warranty, JUMP program, installment payments, wifi calling (huge feature to have when dependence on higher spectrum frequently leaves you wanting inside a building or in a basement). If people bought the Z1s without consideration for any of these I would be surprised, but again, that's someone not doing their homework and repeatedly discussing it doesn't get us any closer to root.

    - Per jcase root is not only possible, but also works in practice. I'm sure we all for our selfish reasons hate him a little bit for holding the keys to the castle, but it is his hard work and his prerogative which must be respected; it should instead be seen in a positive light because WE KNOW THE POSSIBILITY EXISTS.

    - There has to be a million other places to talk about the S5 and carrier security measures... Why are we discussing any other phones besides the Z1s and related devices which could be used as a resource in obtaining root on the Z1s.

    Sorry for the rant, I haven't been very active here because I like to keep to myself unless I have something constructive and relevant to say. Jumping on this thread to catch up every couple days has become exhausting because every lapse in optimism is followed by 2 pages of people complaining.

    jcase thanks for sticking around and providing people on topic with feedback for their ideas, it's probably the only constructive dialogue happening here at this point.

    Thanks to everyone else trying to get root or at least throwing ideas out there. I'd love to see this thread stay on topic and have some of the personal frustration/disappointment/whining find another avenue for discourse.

    Sent from my C6916 using Tapatalk
    View

New posts