[ROOT][Kernel][TWRP] repack of the stock kernel with dm-verity and SONY RIC off

Search This thread

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
Changelog:
  • V5.23 Fix for Android 6 (Freeze on boot logo)
    Installation of kcal kernel module for supported kernels. Get the app from https://xdaforums.com/android/software-hacking/dev-kcal-advanced-color-control-t3032080
  • V5.22 Bug in the vendor overlay creation. Existing directories (like /vendor/bin) have not been replicated correctly
  • V5.21 Fix issue when running on Linux (some CR/LF)
    Patch libsepol in bootimg for backwards compatibility with Android 6
  • V5.20 Support for superuser as an alternative to SuperSU (https://github.com/phhusson/Superuser)
    Fix for the missing internal storage link in TWRP
  • V5.11 Support for Android 7.0
    Fix in the overlay layout which could prevent some libraries from loading and cause battery drain
  • V5.1 Support for Android 7.0
    Updated bootimg to deal with Android 7.0 policies
    New tool inside bootimg for adding new contexts to binary file contexts
    New system overlay layout due to a more restrictive linker in Android 7
  • V5.0 New system overlay method using the /vendor directory. As this directory is also in the library search path even libraries can be easily replaced without modifying the system partition
    System-less SuperSU integration improved (Version 2.76 or higher recommended)
    System-less xposed integration (using the standard distribution)
    Support for 32.A.0.253
  • V4.51 Fix for awk script for Linux kernel version detection when running on Linux
  • V4.5 Fixed adb and mtp file access in TWRP for 32.2.A.0.224
  • V4.42 Added support for Z2 (Sirius) and TWRP fstab fix for leo and aries (thanks to waleedsq81)
  • V4.41 Fixed issue with Y/N choice on non-english Windows. Added support for Z3 (leo)
  • V4.4 Support for Z3+/Z4, Tablet Z2, Tablet Z3 and Tablet Z4 added (Z4 still has an issue with TWRP, but DRM fix works)
    SuperSU integration reworked in order to need less SELinux exceptions and to be more secure
    All tasks can now be individually selected. Therefore there is no separate DRM only script required
  • V4.31 Renabled Z5P (satsuki) and Z5C (suzuran) for TWRP and drmfix
  • V4.3 Support for older Lollipop added
    Script execution for Linux fixed
  • V4.24 Fix for for a bug in SuperSU integration in V4.23
  • V4.23 Fix for repacking 3rd party kernel (Some permissions were on custom directories were lost)
  • V4.22 Bugfix for readta (flash_dk reported unit not)
  • V4.21 Fix for the Linux binary of bootimg
  • V4.2 Updated TWRP to 3.0.2
  • V4.1
    Fix for WideWine (if you have your device key) Thanks a lot to goofnorf101 for testing
    unpackinitfs and makeinitfs in my bootimg tool now maintain date/time of files correctly
    Automatic SuperSU installation
  • V4.0
    Fix for older kernels (Lollipop)
    Binary for Linux (The older version had the ARM version packaged)
    Device is not stored in the kernel image anymore
    TWRP updated to version 3.0.1

FAQ - Please read
  • Is is possible to have root with locked bootloader?
    Short answer: no
    Long answer: The locked bootloader only boots unmodified kernel packages signed by Sony. The stock kernel only mounts unmodified /system partitions (dm-veritiy) -> No modification without unlocking
    So any change to the kernel (like this script) or system partition requires unlocked bootloader
  • What is dm-verity?
    A hash checksum on all blocks of a filesystem in order to verify the integrity
  • What is Sony RIC?
    A protection to avoid mounting the root filesystem or system read/write
  • What happens if I unlock my bootloader
    The device key (TA unit 0x1046b) will be wiped, which deactives everything DRM related. In addition a full wipe of your phone will be perfomed.
    So extract your TA partition before with this great tool http://xdaforums.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597 from zxz0O0
    If you already unlocked the bootloader before, then at least the credentials will be restored, which will reactivate stuff like x-reality and camera de-noise
  • Why do I need to flash my device key?
    Without your device only some functions can be reactivated, like x-reality. Other functions like widevine do not work with out your device key.
  • How do I enter TWRP recovery?
    Restart your phone and press the volume key up as soon as the LED switches to yellow
  • I want to use a custom kernel with the DRM fix
    Just say "N" to all other options. Nevertheless be prepared for problems if the custom kernel does not match your Android version.
  • What should I do if there is an update to this script?
    First check if you really need to run this update by checking the changelog. E.g. if it says binary for Linux fixed and you are using Windows then probably you don't care. If you did not change your Android version then all you have to do is to update the kernel package with fastboot flash boot. If you do not use the automatic SuperSU integration then you have to reinstall SuperSU in TWRP.

This tool repacks an existing kernel package (usually the stock kernel) in order to make it rootable and adds TWRP recovery as well. Version 4 has been succesfully tested with LP and MM.

In particular it adresses the following issues:
  • DM-Verity: Android is now using dm-verity to verfy the integrity of the system partition. Until you switch it off your phone won't boot after modifying /system
  • SONY RIC: RIC is blocking the write access to the system partition
  • DRM Keys: After unlocking the bootloader your device key is wiped, which deactivates some functionaliy. E.g. x-reality, denoise in camera aso.

Recompiling the kernel is not required as only the init ramdisk needs to be modified. You can run these scripts either in Windows or Linux.

Thanks to the excellent work of zxz0O0 you can now backup the TA partition before unlocking the bootloader with this tool http://xdaforums.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597
If you managed to backup your TA partition before you unlocked the bootloader then this version will fully reactivate your keys as well. (many thanks to addicted1900 for helping me with the testing)

As there has been some confusion I would like to point out one more time that you cannot run any kernel package which is not signed by Sony without unlocking the bootloader. So this works only with unlocked bootloader.
As it seems that it is not clear to everyone I also want to mention that <...> is a placeholder. E.g. <extracted kernel> means that you should replace it with then name of your extracted kernel, which could be kernel.elf

There was a report that having SuperSU in the system partition installed may lead to a bootloop. Therfore you shoud first install the bootimage created by this script and then install SuperSU afterwards, as it will then use the system-less strategy.

In order to use these scripts you need the kernel boot image of your current version. There two different ways to obtain it:

Method1:
If you have a .ftf image then open it with zip application (7Zip, WinZip, Windows Compressed Folder) and extract kernel.sin. Afterwards use Flashtool -> Tools -> SIN Editor to extract the kernel. You should end up with the boot image with extension .elf.

Method2:
Run your favourite recovery and connect via
Code:
adb -d shell
Now run
Code:
find /dev -name boot
dd if=<output of the find command before> of=/sdcard/kernel.img

Once you have the kernel image you are ready to use the script.
The newest version support superuser as an alternative to SuperSU. This is available open source and can be verified. In order to integrated you need the current superuser.zip from http://superuser.phh.me/superuser.zip and to be install the app afterwards from Google Play (look for superuser phh) or build it yourself from github.
To integrate the kernel part just place superuser.zip in the rootkernel directory.

You can also still use SuperSU, although it is causing a huge battery draining on my Z5 with Android 7.0 If you place SuperSU in the same directory (SuperSU*.zip, case sensitive) then it will be also installed automatically . It did all the tests with 2.76, but newer versions should work as well. Please be aware that you can not update SuperSU within the application. For a newer SuperSU version you need to rerun the script.
If you want to integrate xposed as well just place the distribution for you device and Android version in the same directory. (e.g. xposed-v86-sdk23-arm64.zip). Only support with Android 6.0 (sdk 23) and higher.
xPosed for Android 7.0+ is still not available.

Code:
rootkernel <extracted kernel> boot.img
You are prompted for several choices:
  • Sony RIC is enabled. Disable?
    I prefer not to disable it in order to keep my phone more secure. Unfortunately there are a lot of bad guys in this world and SELinux and RIC still can save us if someone discovers a new kernel exploit.
    Sony RIC basically prevents mounting the /system partition for write. You can still modify it in recovery of of course, but if you require write access to /system without entering recovery then you need to disable it.
  • Install TWRP recovery? Here you should say yes unless you are trying to patch a non-stock kernel, which comes already with a recovery
  • Install busybox? For security reasons I prefer not to install. In recovery you have it anyway. This choice is only available if you chose install TWRP
  • Found SuperSU-v....zip. Install? Integrates SuperSU. For this option to show up you have to place the SuperSU package into the same directory with the name SuperSU*.zip (case sensitive)
  • Found superuser.zip. Install? Integrates superuser. For this option to show up you have to place superuser.zip into the same directory (case sensitive)
  • # Make su permissive (Permits any action as su)? This only appears if you install superuser. Permissive means you can anything as root, without it is restricted mainly to file operations (sufficient for e.g. Titanium Backup)
  • Found xposed-v....zip. Install? Integrates xposed system-less. For this option to show up you have to place the xposed for your device and Android version into the same directory. (e.g. xposed-v86-sdk23-arm64.zip)
  • Install DRM fix? Installs the DRM fix. First it tries to use the device key which you flashed with flash_dk. If it does not exist it uses an alternative method which cannot fix everything (e.g. Widevine will not work, but X-reality, Camera denoise etc. will work)

Now put your phone into fastboot mode (Volume Up + connect USB) and then run:
To test it without actually flashing it:
Code:
fastboot boot boot.img
For flashing it:
Code:
fastboot flash boot boot.img

If you managed to backup for TA partition before then you can reactivate your original device key as follows:
Code:
flash_dk <ta backup image>  DK.ftf
Flashing this file with flashtool will write your device key to an alternative unit, from where the drmfix library will pick it up.
This is a one-time task. It will survive a complete reset of the phone or Android system upgrade. The device key has a length of just 16 bytes, so it is correct that the resulting DK.ftf has a size of only aprox. 500 bytes.

If you like my work you can buy me a coffee ;)

Some background information:
There are two main tools involved (for both Android and Windows)
- busybox
Probably everyone knows it

- bootimg
A multicall binary with several tools for unpacking and packing the boot image as well as adapting the SELinux policy. Part of the code is written by me from scratch, some other parts are cherry picked from other projects. I will also provide the source for it. As Windows doesn't have softlinks I modified the tools for unpacking and packing the init ramdisk to write text files with __lnk__ at the end instead.
 

Attachments

  • rootkernel_v4.31_Windows_Linux.zip
    15.3 MB · Views: 12,433
  • rootkernel_v4.51_Windows_Linux.zip
    8.6 MB · Views: 13,109
  • rootkernel_v5.11_Windows_Linux.zip
    13.9 MB · Views: 6,177
  • rootkernel_v5.23_Windows_Linux.zip
    14.3 MB · Views: 48,933
Last edited:

Funkmasterchilla

Senior Member
May 13, 2014
452
128
Lorient
Do you want the kernel.sin of stock . 200?

I am downloading the whole firmware again from xperifirm. Thank you mate !

Edit: Working great! I'll stick to stock kernel now since Androplus' consumes more battery while asleep !
Edit2: I successfully flashed recoveries in command window from my PC but can't access TWRP at boot though, no LED flashing.
Edit3: Ok that's cuz there's no recovery boot script obviously, my bad. That's above my pay grade, if somebody is kind enough to create a stock. 200 with recoveries it'd be much appreciated :) PM me if so
Edit!: I flashed monx new stock based kernel

Thank you Tobias !
 
Last edited:

zavpasha

Senior Member
Dec 20, 2010
112
28
Moscow
Hi everyone,

as most of you know, even after unlocking the bootloader there are a few more requirements before you can modify the system partition, i.e. install SuperSU, xposed etc.

- Android is now using dm-verity to verfy the integrity of the system partition. Until you switch it off your phone won't boot after modifying /system
- SONY RIC is blocking the write access to the system partition

The good news is, that it is not required to recompile the kernel. It is sufficent to modify the init scripts inside the init ram disk. So you can just stick to the stock kernel.

I created a package which precisely does this job for you. Just run it from TRWP after installing a new Android version :)
With this you don't have to wait anymore until someone creates the right kernel package for your phone

PS: It leaves a copy of the new boot image in the internal sdcard if you want to save it somewhere. (boot.img) It can be flashed with fastboot if required.
Hmm... I don't understand what this zip file do with phone.... Can you explain more primitive for me?!
Is that for recover stock kernel with stock drm keys?! I understand correct?!
 

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
Hmm... I don't understand what this zip file do with phone.... Can you explain more primitive for me?!
Is that for recover stock kernel with stock drm keys?! I understand correct?!

Before you can start to install thing like SuperSU and xposed you have to change the kernel, otherwise your phone won't boot anymore. In the past you had to wait for someone to come up with a compatible kernel for your phone, now this package just converts your existing kernel.
Regarding the DRM please install the package from the DRM restore thread.
 

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
I am downloading the whole firmware again from xperifirm. Thank you mate !

Edit: Working great! I'll stick to stock kernel now since Androplus' consumes more battery while asleep !
Edit2: I successfully flashed recoveries in command window from my PC but can't access TWRP at boot though, no LED flashing.
Edit3: Ok that's cuz there's no recovery boot script obviously, my bad. That's above my pay grade, if somebody is kind enough to create a stock. 200 with recoveries it'd be much appreciated :) PM me if so
Edit!: I flashed monx new stock based kernel

Thank you Tobias !

Thanks for the feedback. Future versions of this package will add TRWP as well. I am currently working on it. ;)
 
Last edited:

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
Well, the script which checks if recovery should be started is bin/init inside the zip. If you don't like the vibrate then just remove the line and run the package again

Gesendet von meinem E6683 mit Tapatalk
 

Barthlon

Senior Member
Oct 30, 2008
638
225
huh, so it is possible to have 2 recoveries at the same time? (and why would anyone want 2 recoveries? :p)
 

FakeSmile

Senior Member
Jul 1, 2013
665
51
I flash the v2 and i got bootloop. 4 time red LED and the phone reboot and all over again. What's the problem?
 

stiffmeister75

Senior Member
Nov 4, 2010
88
25
hi tobias,
i didn't try the v2, because i thought, that the twrp recovery wouldn't be compatible.
but when you say it's ok, than i'll try it :)

br
stiffmeister
 

sheraro

Senior Member
Jan 15, 2012
689
235
Casablanca
hi tobias,
i didn't try the v2, because i thought, that the twrp recovery wouldn't be compatible.
but when you say it's ok, than i'll try it :)

br
stiffmeister

I flashed zombie kernel without making backup of stock kernel, can you share it with me so I can try this method (I doubt it will work on zombie)

ps : I have .200 fw
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 284
    Changelog:
    • V5.23 Fix for Android 6 (Freeze on boot logo)
      Installation of kcal kernel module for supported kernels. Get the app from https://xdaforums.com/android/software-hacking/dev-kcal-advanced-color-control-t3032080
    • V5.22 Bug in the vendor overlay creation. Existing directories (like /vendor/bin) have not been replicated correctly
    • V5.21 Fix issue when running on Linux (some CR/LF)
      Patch libsepol in bootimg for backwards compatibility with Android 6
    • V5.20 Support for superuser as an alternative to SuperSU (https://github.com/phhusson/Superuser)
      Fix for the missing internal storage link in TWRP
    • V5.11 Support for Android 7.0
      Fix in the overlay layout which could prevent some libraries from loading and cause battery drain
    • V5.1 Support for Android 7.0
      Updated bootimg to deal with Android 7.0 policies
      New tool inside bootimg for adding new contexts to binary file contexts
      New system overlay layout due to a more restrictive linker in Android 7
    • V5.0 New system overlay method using the /vendor directory. As this directory is also in the library search path even libraries can be easily replaced without modifying the system partition
      System-less SuperSU integration improved (Version 2.76 or higher recommended)
      System-less xposed integration (using the standard distribution)
      Support for 32.A.0.253
    • V4.51 Fix for awk script for Linux kernel version detection when running on Linux
    • V4.5 Fixed adb and mtp file access in TWRP for 32.2.A.0.224
    • V4.42 Added support for Z2 (Sirius) and TWRP fstab fix for leo and aries (thanks to waleedsq81)
    • V4.41 Fixed issue with Y/N choice on non-english Windows. Added support for Z3 (leo)
    • V4.4 Support for Z3+/Z4, Tablet Z2, Tablet Z3 and Tablet Z4 added (Z4 still has an issue with TWRP, but DRM fix works)
      SuperSU integration reworked in order to need less SELinux exceptions and to be more secure
      All tasks can now be individually selected. Therefore there is no separate DRM only script required
    • V4.31 Renabled Z5P (satsuki) and Z5C (suzuran) for TWRP and drmfix
    • V4.3 Support for older Lollipop added
      Script execution for Linux fixed
    • V4.24 Fix for for a bug in SuperSU integration in V4.23
    • V4.23 Fix for repacking 3rd party kernel (Some permissions were on custom directories were lost)
    • V4.22 Bugfix for readta (flash_dk reported unit not)
    • V4.21 Fix for the Linux binary of bootimg
    • V4.2 Updated TWRP to 3.0.2
    • V4.1
      Fix for WideWine (if you have your device key) Thanks a lot to goofnorf101 for testing
      unpackinitfs and makeinitfs in my bootimg tool now maintain date/time of files correctly
      Automatic SuperSU installation
    • V4.0
      Fix for older kernels (Lollipop)
      Binary for Linux (The older version had the ARM version packaged)
      Device is not stored in the kernel image anymore
      TWRP updated to version 3.0.1

    FAQ - Please read
    • Is is possible to have root with locked bootloader?
      Short answer: no
      Long answer: The locked bootloader only boots unmodified kernel packages signed by Sony. The stock kernel only mounts unmodified /system partitions (dm-veritiy) -> No modification without unlocking
      So any change to the kernel (like this script) or system partition requires unlocked bootloader
    • What is dm-verity?
      A hash checksum on all blocks of a filesystem in order to verify the integrity
    • What is Sony RIC?
      A protection to avoid mounting the root filesystem or system read/write
    • What happens if I unlock my bootloader
      The device key (TA unit 0x1046b) will be wiped, which deactives everything DRM related. In addition a full wipe of your phone will be perfomed.
      So extract your TA partition before with this great tool http://xdaforums.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597 from zxz0O0
      If you already unlocked the bootloader before, then at least the credentials will be restored, which will reactivate stuff like x-reality and camera de-noise
    • Why do I need to flash my device key?
      Without your device only some functions can be reactivated, like x-reality. Other functions like widevine do not work with out your device key.
    • How do I enter TWRP recovery?
      Restart your phone and press the volume key up as soon as the LED switches to yellow
    • I want to use a custom kernel with the DRM fix
      Just say "N" to all other options. Nevertheless be prepared for problems if the custom kernel does not match your Android version.
    • What should I do if there is an update to this script?
      First check if you really need to run this update by checking the changelog. E.g. if it says binary for Linux fixed and you are using Windows then probably you don't care. If you did not change your Android version then all you have to do is to update the kernel package with fastboot flash boot. If you do not use the automatic SuperSU integration then you have to reinstall SuperSU in TWRP.

    This tool repacks an existing kernel package (usually the stock kernel) in order to make it rootable and adds TWRP recovery as well. Version 4 has been succesfully tested with LP and MM.

    In particular it adresses the following issues:
    • DM-Verity: Android is now using dm-verity to verfy the integrity of the system partition. Until you switch it off your phone won't boot after modifying /system
    • SONY RIC: RIC is blocking the write access to the system partition
    • DRM Keys: After unlocking the bootloader your device key is wiped, which deactivates some functionaliy. E.g. x-reality, denoise in camera aso.

    Recompiling the kernel is not required as only the init ramdisk needs to be modified. You can run these scripts either in Windows or Linux.

    Thanks to the excellent work of zxz0O0 you can now backup the TA partition before unlocking the bootloader with this tool http://xdaforums.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597
    If you managed to backup your TA partition before you unlocked the bootloader then this version will fully reactivate your keys as well. (many thanks to addicted1900 for helping me with the testing)

    As there has been some confusion I would like to point out one more time that you cannot run any kernel package which is not signed by Sony without unlocking the bootloader. So this works only with unlocked bootloader.
    As it seems that it is not clear to everyone I also want to mention that <...> is a placeholder. E.g. <extracted kernel> means that you should replace it with then name of your extracted kernel, which could be kernel.elf

    There was a report that having SuperSU in the system partition installed may lead to a bootloop. Therfore you shoud first install the bootimage created by this script and then install SuperSU afterwards, as it will then use the system-less strategy.

    In order to use these scripts you need the kernel boot image of your current version. There two different ways to obtain it:

    Method1:
    If you have a .ftf image then open it with zip application (7Zip, WinZip, Windows Compressed Folder) and extract kernel.sin. Afterwards use Flashtool -> Tools -> SIN Editor to extract the kernel. You should end up with the boot image with extension .elf.

    Method2:
    Run your favourite recovery and connect via
    Code:
    adb -d shell
    Now run
    Code:
    find /dev -name boot
    dd if=<output of the find command before> of=/sdcard/kernel.img

    Once you have the kernel image you are ready to use the script.
    The newest version support superuser as an alternative to SuperSU. This is available open source and can be verified. In order to integrated you need the current superuser.zip from http://superuser.phh.me/superuser.zip and to be install the app afterwards from Google Play (look for superuser phh) or build it yourself from github.
    To integrate the kernel part just place superuser.zip in the rootkernel directory.

    You can also still use SuperSU, although it is causing a huge battery draining on my Z5 with Android 7.0 If you place SuperSU in the same directory (SuperSU*.zip, case sensitive) then it will be also installed automatically . It did all the tests with 2.76, but newer versions should work as well. Please be aware that you can not update SuperSU within the application. For a newer SuperSU version you need to rerun the script.
    If you want to integrate xposed as well just place the distribution for you device and Android version in the same directory. (e.g. xposed-v86-sdk23-arm64.zip). Only support with Android 6.0 (sdk 23) and higher.
    xPosed for Android 7.0+ is still not available.

    Code:
    rootkernel <extracted kernel> boot.img
    You are prompted for several choices:
    • Sony RIC is enabled. Disable?
      I prefer not to disable it in order to keep my phone more secure. Unfortunately there are a lot of bad guys in this world and SELinux and RIC still can save us if someone discovers a new kernel exploit.
      Sony RIC basically prevents mounting the /system partition for write. You can still modify it in recovery of of course, but if you require write access to /system without entering recovery then you need to disable it.
    • Install TWRP recovery? Here you should say yes unless you are trying to patch a non-stock kernel, which comes already with a recovery
    • Install busybox? For security reasons I prefer not to install. In recovery you have it anyway. This choice is only available if you chose install TWRP
    • Found SuperSU-v....zip. Install? Integrates SuperSU. For this option to show up you have to place the SuperSU package into the same directory with the name SuperSU*.zip (case sensitive)
    • Found superuser.zip. Install? Integrates superuser. For this option to show up you have to place superuser.zip into the same directory (case sensitive)
    • # Make su permissive (Permits any action as su)? This only appears if you install superuser. Permissive means you can anything as root, without it is restricted mainly to file operations (sufficient for e.g. Titanium Backup)
    • Found xposed-v....zip. Install? Integrates xposed system-less. For this option to show up you have to place the xposed for your device and Android version into the same directory. (e.g. xposed-v86-sdk23-arm64.zip)
    • Install DRM fix? Installs the DRM fix. First it tries to use the device key which you flashed with flash_dk. If it does not exist it uses an alternative method which cannot fix everything (e.g. Widevine will not work, but X-reality, Camera denoise etc. will work)

    Now put your phone into fastboot mode (Volume Up + connect USB) and then run:
    To test it without actually flashing it:
    Code:
    fastboot boot boot.img
    For flashing it:
    Code:
    fastboot flash boot boot.img

    If you managed to backup for TA partition before then you can reactivate your original device key as follows:
    Code:
    flash_dk <ta backup image>  DK.ftf
    Flashing this file with flashtool will write your device key to an alternative unit, from where the drmfix library will pick it up.
    This is a one-time task. It will survive a complete reset of the phone or Android system upgrade. The device key has a length of just 16 bytes, so it is correct that the resulting DK.ftf has a size of only aprox. 500 bytes.

    If you like my work you can buy me a coffee ;)

    Some background information:
    There are two main tools involved (for both Android and Windows)
    - busybox
    Probably everyone knows it

    - bootimg
    A multicall binary with several tools for unpacking and packing the boot image as well as adapting the SELinux policy. Part of the code is written by me from scratch, some other parts are cherry picked from other projects. I will also provide the source for it. As Windows doesn't have softlinks I modified the tools for unpacking and packing the init ramdisk to write text files with __lnk__ at the end instead.
    63
    Rootkernel V5.23 (UNOFFICIAL 2.5) - OREO - Xperia X, X Comp., X Perf., XZ and XZs

    Xperia X Performance, XZ and XZs ONLY (Xperia X and Xperia X Compact must skip this):
    Android Oreo ramdisk patching needs some additional files, and they must be copied from Oreo /system into the rootkernel's filesystem_files folder, prior to run the script, and they are:
    Code:
    /system/vendor/etc/[B][COLOR="Blue"]fstab.qcom[/COLOR][/B]
    /system/vendor/etc/init/hw/[B][COLOR="blue"]init.qcom.rc[/COLOR][/B]
    /system/vendor/etc/init/hw/[B][COLOR="blue"]init.target.rc[/COLOR][/B]
    (you can pull these files through adb, or even converting system.sin to system.ext4 and take them out from there - just copy them, and DO NOT touch its contents)

    Rootkernel's procedure for Oreo kernel ONLY:
    1. Download and extract attached Rootkernel V5.23 (UNOFFICIAL 2.5)
    2. Download attached flashable zip (DRM-fix_System_Mode.zip) and push it somewhere in your device (internal memory or sdcard)
    3. Run rootkernel script with Oreo stock kernel.elf (eg.: rootkernel kernel.elf boot.img)
    4. Say yes (Y) to everything - If you want munjeni's TA PoC option, ensure your TA.img (case sensitive) is located at rootkernel's root folder, and say no (N) to DRM fix
    5. You're done!

    Rootkernel's output should look like this:
    Code:
    Rootkernel V5.23 (UNOFFICIAL 2.5)
    
    - Unpacking kernel
      Found elf boot image
      Kernel version: 3.18.66-perf-g27a9189
      Found appended DTB
    - Detected vendor: somc (Sony), device: dora (Xperia X Performance), variant: row
    - Unpacking initramfs
    - Detected platform: 64-bit
    - Detected Android version: 8.0.0
    - Android Oreo requires additional files! Continue? (Say yes to copy) [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
      init.rc (patched)
      fstab.qcom (copied)
      init.qcom.rc (copied and patched)
      init.target.rc (copied and patched)
    - dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] [B][COLOR="Blue"]Y[/COLOR][/B]
      Patching fstab in dtb to disable dm-verity
    - Sony RIC is enabled. Disable? [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
      Disabling Sony RIC
    - force-encrypt is enabled. Disable? (Say yes if you decrypt /data) [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
      Disabling force-encrypt
    - Install DRM fix? [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
      1. DRM fix preload line added successfully!
      2. DRM libraries still need to be flashed manually on TWRP recovery before 1st boot!!
         System mode, flash: DRM-fix_System_Mode.zip
    - All done! Continue? [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
    - Creating new initramfs
    - Creating boot image
    - Cleaning up
    Done

    Flash patched kernel:
    1. Flash Oreo ftf (wiping everything, excluding nothing - except *.ta files - if any)
    2. Unplug device and DO NOT turn it on
    3. Fastboot newly created boot.img
    4. Fastboot TWRP for your device
    5. Unplug device and DO NOT turn it on again
    6. Enter TWRP recovery and flash: DRM-fix_System_Mode.zip << YOU CAN SKIP THIS STEP IF YOU CHOOSE munjeni's TA PoC OPTION!!
    7. You're done!

    Root:
    - After step 6 above, flash latest Magisk zip (SuperSU seems not to work properly yet)

    Known issues:
    - Magisk zip installation may fail, and device may also fall in a bootloop
    - If you're facing this ^, do whole procedure again, but DO NOT flash Magisk zip, instead, turn device on, install latest Magisk Manager, patch boot.img and flash it (fastboot it)!


    As always, TRY IT AT YOUR OWN RISK!

    Credits:
    @tobias.waldvogel ofc
    @sToRm// for additional ramdisk files hint (man, you're insane!)

    Enjoy it!
    41
    Niugat related only... I don't know maybe you didn't noticed but seinject tool from OP is not working for nougat selinux, if you remove -q parameter yiu will see that ;)

    I was very busy the last months, so there were not that many updates.
    Now that Android 7 is out I made a new version to supports it as well.
    xPosed is currently not included in but you can still flash it from TWRP if you need it.

    The script itself is hosted on github now: https://github.com/tobiaswaldvogel/android_rootkernel
    If you interested in the source of bootimg have a look at https://github.com/tobiaswaldvogel/and_boot_tools
    ;)

    Cheers,
    Tobias
    36
    DRM Fix Workaround and Sony RIC disabler for Nougat - System Mode!

    Not yet due to file contexts now being in bin format. The tool will hang. @serajr posted a workaround a few posts ago.

    Tool still can not fully handle Nougat's kernel, even after my changes. That's why I didn't share it yet!
    With that kernel we're able to disable dm-verity ONLY, which leads us to create a fully working DRM fix workaround (system mode):

    1. Download attached flashable zip (DRM fix libs are inside it)
    2. Run rootkernel tool with Nougat's stock kernel.elf, and choose Y for dm-verity ONLY! << MANDATORY to avoid bootloop
    Code:
    - dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] [B][COLOR="Blue"]Y[/COLOR][/B]
    3. When tool asks you for - Install busybox?, do nothing yet, and...
    4. Enter \ramdisk folder and edit init.target.rc@0750 file (with notepad++)
    5. Add the blue lines exactly as shown below (between "on early-init" and "on fs" sections):
    Code:
    [B]on early-init[/B]
        mkdir /firmware 0771 system system
        mkdir /bt_firmware 0771 system system
        symlink /data/tombstones /tombstones
        mkdir /dsp 0771 media media
    	
    [B][COLOR="Blue"]on post-fs
        export LD_PRELOAD libdrmfix.so[/COLOR][/B]
    
    [B]on fs[/B]
        wait /dev/block/bootdevice
    5.1 - If "on post-fs" section already exists, add :libdrmfix.so at the final of the line underneath it:
    Code:
    [B]on post-fs[/B]
        export LD_PRELOAD libNimsWrap.so[B][COLOR="Red"]:libdrmfix.so[/COLOR][/B]
    6. Save the file and exit \ramdisk folder
    7. Back to the rootkernel's screen and choose N for busybox (boot.img will be created)
    8. Open downloaded file with 7Zip and drag'n'drop your newly created boot.img file into its content screen (root)
    8.1. rootkernel_Nougat_boot_and_drmfix_flashable.zip contents will be:
    Code:
    META_INF
    system
    [B]boot.img[/B]
    9. Close 7Zip
    10. Enter TWRP recovery (fota kernel recovery) and flash the zip
    11. Done!

    Sony RIC, TWRP recovery (internal), DRM fix (internal) and busybox WILL NOT WORK AND THEY MUST BE SKIPPED by choosing N.


    TRY IT OUT AT YOUR OWN RISK


    Disabling Sony RIC (do this before performing step 7 above):
    1. Enter \ramdisk folder and edit init.sony-platform.rc@0750 file (with notepad++)
    2. Insert the blue line and add the red # mark, exactly as shown below (look for "on boot" section):
    Code:
    [B]on boot[/B]
        # Setting to use rndis_qc driver
        exec u:r:usb_device_mode:s0 -- /system/bin/sh /init.usbmode.platform.sh "set_rndis_qc"
    
        # SONY: for Bluesleep
        chown bluetooth net_bt /proc/bluetooth/sleep/lpm
        chown bluetooth net_bt /proc/bluetooth/sleep/btwrite
        chmod 0660 /proc/bluetooth/sleep/lpm
        chmod 0660 /proc/bluetooth/sleep/btwrite
    
        # SONY: Enable Sony RIC
        mount securityfs securityfs /sys/kernel/security nosuid nodev noexec
        [B][COLOR="Blue"]write /sys/kernel/security/sony_ric/enable 0[/COLOR][/B]
        [B][COLOR="Red"]#[/COLOR][/B] chmod 0640 /sys/kernel/security/sony_ric/enable
    
        # SONY: Enable wakeup irq module
        write /sys/devices/platform/wakeup_debug.0/enable 1
    3. Save the file and exit \ramdisk folder
    4. Done > Proceed now to step 7 above


    For development purposes only! You don't need to do that!! - If you wanna dare and play with file_contexts.bin as a plain text file, do this before performing step 7 above:

    1. Download attached bin2txt.zip and unpack it
    2. Copy original file_contexts.bin@0644 binary from rootkernel's /ramdisk folder to the bin2txt's /ramdisk folder
    3. Run bin2txt (windows) or ./bin2txt.sh (linux)
    4. Move converted file_contexts.bin@0644 (now as a plain text file) from bin2txt's /ramdisk folder back to the rootkernel's /ramdisk folder (replacing original file)
    6. Done > Proceed now to step 7 above

    In the tests I did with my XP everything was ok! Device did boot up as it should!!
    If device get stuck at sony logo, something went wrong. Create a new boot.img without this!!
    31
    Rootkernel V5.23 (UNOFFICIAL 2.4) - OREO - Xperia X, X Comp., X Perf., XZ and XZs

    What's new:
    - Xperia X and Xperia X Compact compatibility (Oreo)
    (X and XC users, please, do read first line of the post, in red)

    Output:

    Code:
    Rootkernel V5.23 (UNOFFICIAL 2.4)
    
    - Unpacking kernel
      Found elf boot image
      Kernel version: 3.10.84-perf-g78dc059
      Found appended DTB
    - Detected vendor: somc (Sony), device: [B][COLOR="Blue"]kugo (Xperia X Compact)[/COLOR][/B], variant: row
    - Unpacking initramfs
    - Detected platform: 64-bit
    - Detected Android version: 8.0.0
    [B][COLOR="blue"]- Found fstab.qcom (no additional files required)![/COLOR][/B]
    - dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] Y
      Patching fstab in dtb to disable dm-verity
    - Sony RIC is enabled. Disable? [Y/n] Y
      Disabling Sony RIC
    - force-encrypt is enabled. Disable? (Say yes if you decrypt /data) [Y/n] Y
      Disabling force-encrypt
    - Install DRM fix? [Y/n] Y
      1. DRM fix preload line added successfully!
      2. DRM libraries still need to be flashed manually on TWRP recovery before 1st boot!!
         System mode, flash: DRM-fix_System_Mode.zip
    - All done! Continue? [Y/n] Y
    - Creating new initramfs
    - Creating boot image
    - Cleaning up
    Done

    >> Enjoy it! <<

    (please, do read instructions before proceeding and patching your STOCK kernel, also, do always use the elf format as the input file)