FORUMS
Remove All Ads from XDA

[DANGEROUS TOOL][DO NOT USE!][READ FIRST!!!] Trim Area Tool

49 posts
Thanks Meter: 90
 
By p0kemon, Account currently disabled on 9th December 2016, 03:11 PM
Post Reply Email Thread
Trim Area Tool

Hello! First of all sorry for my bad english words I will try to explain what this tool mean. I am working on trim area dump .ta to .img converter. Whole idea is to dump drm key which is stored in ta unit 1046b and dump the rest of units and further convert (reconstruct) that .ta dump to fully functional .img dump. Whole idea is based on thing which I found in my trim area dump unit 1046b which is somehow doubled on my unmodified locked TA and by the way not deleted after unlocking. I thinked to root phone by unlocking device, get backup unit 1046b, reconstruct trim area, flash reconstructed trim area to make phone locked as before unlocking. Inded it can be done (unconfirmed curently) but... Later things is confirmed on other phones that not all phones have that doubled unit so that mean not all phones have the same trim area. In general my idea was to decode that mistic trim area. I have done things, its decoded partialy but not all since some devices don't have the same headers of the units, for example some device headers starts with C1E9F83Bffffffff but some with C1E9F83Bffffff32 and some with C1E9F83B32323234... I have done some tests to an device (z3) which have broken screen. That phone had that diferent unit headers which is not like on my phone c1e9f83bffffffff, I have reconstructed trim area, flashed back, and this is a report -> http://forum.xda-developers.com/show...&postcount=117 and this one -> http://forum.xda-developers.com/show...&postcount=119 and this one -> http://forum.xda-developers.com/show...&postcount=153

Whole story starts at page http://forum.xda-developers.com/xper...t3503918/page5 please read all posts if you are interesting for trim area things and things which I thinked to do! By that way you will understand better about our tool and idea about a tool!

Trim area format is explained in this post -> http://forum.xda-developers.com/show...8&postcount=64 . Problem by now is we don't know how safe is reconstructing some trim area, for example that mistic diferencies in bytes (ffffffff) on some phones and (32323234) on some phones and also some diferent on some phones is a problem by now. What that bytes mean and or why it differs on some devices, I don't know. My tool reconstruct that and makes all ffffffff. The same things can be seen in unused blocks, for example on some devices its filled with 0xff and on some devices with 0x10 and on some devices with 0x32. Why I don't know. My tool makes it all 0xff.

I can reconstruct all units from .ta and can produce .img, but I can not confirm if it will work since testers for that thing is need! Tool is in early stage and not all features is implemented with reason: need to be confirmed one by one. Curently I have done only basic reconstruction which didn't change units data.
Only change headers and unused blocks and make them all with 0xff. At the end tool regenerates hashes of the partitions, thats all by now. I don't know how safe it is at all!

I have done trimarea_tool (command line tool), and that tool nothing change in trim area dump other than unit headers (I have not implemented the rest of my tools since undocumented trim area is still undocumented and very risky is touching trim area, so I not included the rest, it will be public somedays when things gone fully tested), partition hashes and unused blocks, it cleans that 32323234 bytes and writes ffffffff instead and regenerates hashes, thats all by now. Unit data is the same. I have included ton of checks, for example if you try to modify your original ta dump, tool will not generate reconstructed trim area, if size is different, if trim area is not 0x200000 bytes long... and many more. Since we are at initial stage about trim area in general we can't know how safe is playing with trim area, @itsux is only one who flashed reconstructed trim area and reported no hard brick. I must notify you now with red words DO NOT FLASH IF YOU NO WANT TO RISK!!! THIS IS VERY DANGEROUS AND MAY HARD BRICK YOUR PHONE - MEANS KILL FOREVER!!! DO NOT USE ON A WORKING PHONE, THAT IS A RISK!!! Use only if you have broken phone for example working phone with not working or broken screen and you no need that phone, don't flash on daily phone! Itsux is only one who tested on his Z3 phone which is with broken screen, I have modified his trim area the same way, he flashed back that trim area and reported here that his phone is not hard bricked. Again I don't know how safe things is so I am not responsible if tool kills your phone, use at your own risk!! But if you realy want to risk and probably kill your own phone please report what happened at least, it would help further development on this tool!

How to run tool:
First of all this tool is not a standard application so you can't open it like a regular application by double click! Tool is a command line tool so it must be run trught your windows command prompt or trought an batch file! Tool reguires only one parameter, parameter is you TA.img file, e.g:
Code:
trimarea_tool TA.img
Attached Files
File Type: rar trimarea_tool.rar - [Click for QR Code] (962.5 KB, 580 views)
The Following 16 Users Say Thank You to p0kemon For This Useful Post: [ View ] Gift p0kemon Ad-Free
 
 
9th December 2016, 03:31 PM |#2  
Myself5's Avatar
Recognized Developer
Thanks Meter: 9,076
 
Donate to Me
More
Great progress.
I'll think about letting you mess with my Z5s TA Also I'll PM you the Z3 and Z3C TA images as promised in the PM later.

Sent from my D6603 using Tapatalk
The Following 2 Users Say Thank You to Myself5 For This Useful Post: [ View ]
9th December 2016, 03:57 PM |#3  
Senior Member
Hong Kong
Thanks Meter: 137
 
More
Sorry, I don't really understand the purpose of this project, since TA backup is already achieved on new series?
9th December 2016, 04:17 PM |#4  
OP Account currently disabled
in oob of the nand memory
Thanks Meter: 90
 
More
Yes thats a true, dump is achieved, but somedays for example when new xperia lines comes out and there was no root possible (android is more and more secure) we can use further tool to convert unlocked trim area to locked one for example. What we can do with unlocked bootloader that is a very clean I'm in hope
The Following 3 Users Say Thank You to p0kemon For This Useful Post: [ View ] Gift p0kemon Ad-Free
9th December 2016, 05:20 PM |#5  
Senior Member
Hong Kong
Thanks Meter: 137
 
More
Quote:
Originally Posted by p0kemon

Yes thats a true, dump is achieved, but somedays for example when new xperia lines comes out and there was no root possible (android is more and more secure) we can use further tool to convert unlocked trim area to locked one for example. What we can do with unlocked bootloader that is a very clean I'm in hope

So u are trying to fix already UB phone with no ta backup to return to completely fixed drm key? wow now i understand XDD Appreciate your work
9th December 2016, 05:58 PM |#6  
Senior Member
Thanks Meter: 265
 
More
Quote:
Originally Posted by KWOKSFUNG

So u are trying to fix already UB phone with no ta backup to return to completely fixed drm key? wow now i understand XDD Appreciate your work

No...the purpose of this tool would be to reconstruct the trim area from a locked bootloader phone so you don't have to wait for an exploit to be found to root (temp root) on future firmwares to backup your TA when all known exploits are patched..
If you already unlocked there nothing that can be done
The Following User Says Thank You to -DM- For This Useful Post: [ View ] Gift -DM- Ad-Free
9th December 2016, 06:10 PM |#7  
OP Account currently disabled
in oob of the nand memory
Thanks Meter: 90
 
More
Quote:
Originally Posted by -DM-

No...the purpose of this tool would be to reconstruct the trim area from a locked bootloader phone so you don't have to wait for an exploit to be found to root (temp root) on future firmwares to backup your TA when all known exploits are patched..
If you already unlocked there nothing that can be done

Thats right! By the way we still need system user at least in order to dump unit 1046b trought libta.so Hope we get better way when it need.

One more thing, we don't know for sure if drm key is maybe just an generic key for example one which we can enter for example, right? It must be tested first before things gets comfirmed.
The Following 2 Users Say Thank You to p0kemon For This Useful Post: [ View ] Gift p0kemon Ad-Free
9th December 2016, 06:20 PM |#8  
Senior Member
Thanks Meter: 265
 
More
Quote:
Originally Posted by p0kemon

Thats right! By the way we still need system user at least in order to dump unit 1046b trought libta.so Hope we get better way when it need.

One more thing, we don't know for sure if drm key is maybe just an generic key for example one which we can enter for example, right? It must be tested first before things gets comfirmed.

Even better
By the way I got a Z3 with a detached front panel, which is just collecting dust right now as I bought a Z5p after the Z3 broke...
The Z3 is fully functional (the screen colors are just washed out), it is rooted with a locked bootloader (never was unlocked)...I can totally test things on it for you, no problem if it bricks
The Following User Says Thank You to -DM- For This Useful Post: [ View ] Gift -DM- Ad-Free
9th December 2016, 06:25 PM |#9  
OP Account currently disabled
in oob of the nand memory
Thanks Meter: 90
 
More
Quote:
Originally Posted by -DM-

Even better
By the way I got a Z3 with a detached front panel, which is just collecting dust right now as I bought a Z5p after the Z3 broke...
The Z3 is fully functional (the screen colors are just washed out), it is rooted with a locked bootloader (never was unlocked)...I can totally test things on it for you, no problem if it bricks

That would be great realy! I have done some updates to tool right now, forgot to disable "supported device" check, by now all 2mb trim areas is supported. If you going to try please report what happened!
The Following 3 Users Say Thank You to p0kemon For This Useful Post: [ View ] Gift p0kemon Ad-Free
10th December 2016, 03:39 PM |#10  
OP Account currently disabled
in oob of the nand memory
Thanks Meter: 90
 
More
Some updates... now tool generates two reconstructed formats .img and .ta

.img format is the same like your ta.img dump, just reconstructed
.ta format is just an text file which contains the same data like one from your dump from flashtool, one to four .ta files is created and every one contain its data coresponded to trim area partition number, just reconstructed
The Following 2 Users Say Thank You to p0kemon For This Useful Post: [ View ] Gift p0kemon Ad-Free
11th December 2016, 02:16 PM |#11  
OP Account currently disabled
in oob of the nand memory
Thanks Meter: 90
 
More
Today I have received xperia z1 compact with broken screen, on my supprise I started momentaly working on tests to ta, first thing which I done was reconstruction. What I have done? Since unit 8b2 is unit which is created after unlocking, unit with the same size, unit in the same partition 2 like unit 1046b which get deleted after unlocking... what I tested? Partition 020002 (mean partition 2, part 0), unit 1046b was in partition 020002, now it is in partition 020202 (which is seccond part of the partition 2, in most case), unit 1046b is now in partition 020202 as a replacement to unit 0b2, comfirmed sucess! Just replaced unit 8b2 with one 1046b, reconstructed hashes and I can finally say its success, first device successfuly relocked! Device is locked again the same like before unlocking, all drm keys is with status OK! So guys project is sucesfull! Next thing which I going to test right now is that 32323234 bytes and things...
The Following 7 Users Say Thank You to p0kemon For This Useful Post: [ View ] Gift p0kemon Ad-Free
Post Reply Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes