[BOUNTY][FULFILLED] Z3 D6616 - Root

Search This thread

tuzonghua

Member
Jun 2, 2009
37
24
Sony XPERIA Z3 D6616

Instructions for root
* zxz0O0's original instructions
* GhostRaiderMX's detailed instructions
* Video instructions

Intro
First, thanks to Pyres for a great Z3 bounty thread. This thread is specifically for gaining root on the D6616 (T-Mobile US) variant of the Sony Z3. The method proposed by user zxz0O0 works for many variants of this device, but the D6616 is excluded because the exploit has already been patched in the earliest available firmware for the device.

The goal
The bounty's fulfillment requires obtaining root access in order to be able to backup the TA partition, where the DRM keys for the aforementioned technologies are stored. Once we have a backup for our TA partition, we can unlock the bootloader with the official Sony tool and then restore the DRM keys. In the event of hardware failure, we will be able to restore to stock the phone and to have no warranty issue.

Claiming requirements
In order to claim this bounty, you will need to fulfill each and every one of this points:
1. Be the first person to create or find a method to obtain root access in the latest available software release on the aforementioned devices, without neither unlocking the bootloader nor compromising (or affecting) the TA partition in any way that could prevent a correct and successful backup of it;
2. Give proof of point #1 by posting an adequate quantity of screenshots to illustrate it, together with step by step instructions, in a fashion such that everyone can follow them and reproduce the exploit;
3. Wait for at least 10% of pledgers (fastest quorum achieved between per capita and per pecunia criteria*) to give confirmation about the method functionality;
4. Claim your bounty via PM from pledgers.

*i.e. the fastest between 10% of the number of people and 10% of the amount of money pledged as bounty.

Payment will be processed between each member and the bounty collector via PM on an individual basis.

List of Pledges
1. tuzonghua - $50.00
2. ecnahc - $25.00
3. leonhks - $20.00
4. ubuntunerd - $20.00
5. macrosblackd - $25.00
6. kaikea - $25.00
7. HORiZUN - $50.00
8. thienbrand - $10.00
9. lvlonkey - $20.00
10. edwardlanti - $25.00
11. xtentual - $40.00
12. bishop9779 - $30.00
13. metalmilo12 - $20.00
14. imna357 - $10.00
15. ShermCraig - $20.00
16. Bling_Diggity - $10.00
17. TrunkleBob - $50.00
18. mrmizzo - $50.00
19. dia_naji - $20.00
20. dmdelgado - $20.00
21. steelsix - $15.00

Total Pledge: $555.00
Last updated: April 5, 2015, 12:53 UTC -5

Rules of this bounty thread
- Please note before making a post in the thread please refer to the below list to see if your post will be acceptable. If it is not part of this list, your post will be reported and you may risk getting an infraction as per forum moderators.
- Please note you may not make any specific restrictions or requirements that aren't listed in the OP. By making a post with your contribution price you are agreeing to paying out based on all terms listed in OP only and nowhere else.
- Please be advised that if Sony is to release an official method of rooting without unlocking the bootloader or restoring TA partitions lost by officially unlocking the bootloader (extremely unlikely but must be accounted for) prior to any member of XDA's submission, this bounty automatically becomes invalidated.
- Please do not PM a pledge, for it will not be counted.

List of Acceptable Posts:
- New bounty submission or increase of current bounty;
- Questions or assistance in development of a root, recovery, or bootloader unlock method;
- Questions and answers regarding bootloaders on this device;
- Questions and answers regarding the nature of lockdown on this device;
- Questions and answers regarding kernel and bootloader-related exploits;
- Any kind of updates about unfinished or still work-in-progress methods that would at the moment of posting be unfit for fulfilling the bounty;
- Bounty's fulfillment.
 
Last edited:

scoder

Senior Member
Oct 30, 2009
53
47
Denver, CO
This will most likely be the exploit used to gain privileges:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1474

After the Graphic Buffer is exploited, giefroot (made by zxzo0o) should run successfully, rooting the device.
Right now, a few developers are attempting to root the Note 4 with this method, and I think once they achieve it, we can port it to the D6616 and Z3v. Follow the Note 4 devs here: http://xdaforums.com/note-4-att/general/galaxy-note-4-root-progress-t2961974/page22
I planned on looking for a way to exploit the Graphic Buffer and run giefroot with escalated privileges, but it doesn't look like I'll have the time.

You can find a copy of the D6603's /system/lib/libui.so here: https://dl.dropboxusercontent.com/u/24614808/libui.so
I can't imagine the D6616's libui.so being patched since this exploit was just found.
 
Last edited:

leonhks

Member
Feb 23, 2009
26
3
I will pledge $20

Hope someone finds out how to root it for this model
Really hate tmobile icon and blogware.... Stupid WiFi calling mess up my group texts
 

kaikea

New member
Aug 29, 2012
3
0
Finally a thread dedicated to the D6616. Willing to pledge $25. Love this phone! Just need root.
 

thienbrand

Senior Member
Jun 7, 2009
268
71
Just register my new credit card, so i'm in for $10 ( im doing everything i can, so sorry ).
 

leonhks

Member
Feb 23, 2009
26
3
@tdoyle hopefully lollipop will be out soon for this model, but unlike the unlock/international model of the z3, the US version is built sightly differently, knowing tmobile with a lock led bootloader. Tmobile will take there sweet @SS time making the updated. If Cf-auto-root works then the guy that fulfilled these requirements can have my money....
 

Top Liked Posts

  • There are no posts matching your filters.
  • 40
    Hello,

    With the release of CVE-2014-7953 we have a new possibility to get system privilegues. Shortly after release I developed a c binary to exploit it. After trying it on multiple devices, I noticed that the ApplicationInfo struct differs on most devices. In the end I dropped to the Java implementation by hqdvista, as this one is independent. So credits to him for the CVE-2014-7953 exploit.

    Combined together with the qseecom vulnerability we can now successfully get root on D6616.

    Steps (follow the instructions clearly!):
    1. Download the attachment
    2. Install Java Development Kit (if not installed yet)
    3. Run exploit.bat
    4. Let it run until you see the following line
      53lqo1.jpg
    5. Run root.bat inside folder root
    6. Wait for reboot and enjoy root

    Regards
    22
    @zxz0O0 Thank you for your work, finally my D6616 has been successfully rooted. Sony and T-Mobile can go suck it! lol But remember people, the D6616 has a locked bootloader so as far as I know, no custom ROMs can be installed. Other than than that root works. Everything else, well we're on our own.

    For those wondering what I did or want to try:

    ROOT INSTRUCTIONS

    1) I did this on Windows 8.1 (64 bit)
    2) Make sure you have the latest Java Development Kit (8 update 45) and latest Android firmware (4.4.4).
    3) Make sure ADB works on your D6616. (One way to test this out is by installing Debloater on your PC since this requires ADB. You will need to enable Developer Options and check the option "USB Debugging". If successful, Android will throw out an authentication key and Debloater will successfully detect it and start working. At this point you can close Debloater.)
    4) Download zxz0O0's D6616_root file (http://xdaforums.com/showpost.php?p=60494236&postcount=107)
    5) If you have an antivirus software on your phone and on your PC, disable them.
    6) Extract the D6616_root you downloaded earlier.
    7) Run the exploit.bat file. (REMEMBER: This has to be run normally, NOT IN ADMINISTRATIVE MODE. If you get a warning, click on "Run Anyway").
    8) The exploit.bat will stop and it will prompt you to go to Developer Options and go to "Select Debug App". Enable TestApp2. Next enable "Wait for debugger".
    9) Once you do that, press any key to continue and once it says "Successful", you will now open the root.bat file inside the root folder (REMEMBER: This has to be run normally, NOT IN ADMINISTRATIVE MODE. If you get a warning, click on "Run Anyway").
    10) The root.bat will root your device and enable SuperSU. It should close automatically when its done and your D6616 will reboot on its own.
    11) That's it, now you can close exploit.bat by pressing any key.

    AFTER ROOT

    After rooting, you can disable USB debugging and Developer Options. You will see a SuperSU icon on the app drawer and a TestApp2 icon. You can uninstall TestApp2 as it is no longer needed.

    While it is optional, it is important to install Recovery on your D6616 just in case something wrong happens when modifying system files.

    1) I did this on Windows 8.1 (64 bit)
    2) Download XZDUALRECOVERY2.8.14.
    3) Extract the archive and remember to enable USB debugging on the phone. Disable any antivirus on your phone and PC.
    4) Run the install.bat file. (REMEMBER: This has to be run normally, NOT IN ADMINISTRATIVE MODE. If you get a warning, click on "Run Anyway").
    5) You need to input "1" since the root exploit installed SuperSU.
    6) The install.bat will pause and on your D6616, a popup from SuperSU will ask you to grant permissions. You must grant access.
    7) After successful installation, your D6616 will reboot on its own and show the TeamWin recovery menu.
    8) From here you can create a nandroid backup of the phone. If not you can just reboot your phone to Android but its there whenever you need to restore or create a backup.
    12
    Sony XPERIA Z3 D6616

    Instructions for root
    * zxz0O0's original instructions
    * GhostRaiderMX's detailed instructions
    * Video instructions

    Intro
    First, thanks to Pyres for a great Z3 bounty thread. This thread is specifically for gaining root on the D6616 (T-Mobile US) variant of the Sony Z3. The method proposed by user zxz0O0 works for many variants of this device, but the D6616 is excluded because the exploit has already been patched in the earliest available firmware for the device.

    The goal
    The bounty's fulfillment requires obtaining root access in order to be able to backup the TA partition, where the DRM keys for the aforementioned technologies are stored. Once we have a backup for our TA partition, we can unlock the bootloader with the official Sony tool and then restore the DRM keys. In the event of hardware failure, we will be able to restore to stock the phone and to have no warranty issue.

    Claiming requirements
    In order to claim this bounty, you will need to fulfill each and every one of this points:
    1. Be the first person to create or find a method to obtain root access in the latest available software release on the aforementioned devices, without neither unlocking the bootloader nor compromising (or affecting) the TA partition in any way that could prevent a correct and successful backup of it;
    2. Give proof of point #1 by posting an adequate quantity of screenshots to illustrate it, together with step by step instructions, in a fashion such that everyone can follow them and reproduce the exploit;
    3. Wait for at least 10% of pledgers (fastest quorum achieved between per capita and per pecunia criteria*) to give confirmation about the method functionality;
    4. Claim your bounty via PM from pledgers.

    *i.e. the fastest between 10% of the number of people and 10% of the amount of money pledged as bounty.

    Payment will be processed between each member and the bounty collector via PM on an individual basis.

    List of Pledges
    1. tuzonghua - $50.00
    2. ecnahc - $25.00
    3. leonhks - $20.00
    4. ubuntunerd - $20.00
    5. macrosblackd - $25.00
    6. kaikea - $25.00
    7. HORiZUN - $50.00
    8. thienbrand - $10.00
    9. lvlonkey - $20.00
    10. edwardlanti - $25.00
    11. xtentual - $40.00
    12. bishop9779 - $30.00
    13. metalmilo12 - $20.00
    14. imna357 - $10.00
    15. ShermCraig - $20.00
    16. Bling_Diggity - $10.00
    17. TrunkleBob - $50.00
    18. mrmizzo - $50.00
    19. dia_naji - $20.00
    20. dmdelgado - $20.00
    21. steelsix - $15.00

    Total Pledge: $555.00
    Last updated: April 5, 2015, 12:53 UTC -5

    Rules of this bounty thread
    - Please note before making a post in the thread please refer to the below list to see if your post will be acceptable. If it is not part of this list, your post will be reported and you may risk getting an infraction as per forum moderators.
    - Please note you may not make any specific restrictions or requirements that aren't listed in the OP. By making a post with your contribution price you are agreeing to paying out based on all terms listed in OP only and nowhere else.
    - Please be advised that if Sony is to release an official method of rooting without unlocking the bootloader or restoring TA partitions lost by officially unlocking the bootloader (extremely unlikely but must be accounted for) prior to any member of XDA's submission, this bounty automatically becomes invalidated.
    - Please do not PM a pledge, for it will not be counted.

    List of Acceptable Posts:
    - New bounty submission or increase of current bounty;
    - Questions or assistance in development of a root, recovery, or bootloader unlock method;
    - Questions and answers regarding bootloaders on this device;
    - Questions and answers regarding the nature of lockdown on this device;
    - Questions and answers regarding kernel and bootloader-related exploits;
    - Any kind of updates about unfinished or still work-in-progress methods that would at the moment of posting be unfit for fulfilling the bounty;
    - Bounty's fulfillment.
    11
    I created a flashable signed zip it includes SUPERSU 2.4.6, NUTZDUALRECOVERY, and XPOSED INSTALLER 5.0.2. Just wipe dalvik cache and flash this in recovery then wipe dalvik cache again. First boot will take a while. https://mega.co.nz/#!19oHzIrT!HlTGHgnUtPoiSNVksz7IRXHRViww7dc7scMQHfgy__0
    6
    Devs are currently working on gaining privileges on the Note 4 and Kindle Fire from this exploit: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1474

    This is an Android-wide bug, so it affects anything before 5.1. They are finding it hard to trigger the exploit though, but if they do, it will be a similar application to TowelRoot most likely (one application that works on various/most devices). 1474 will escallate privileges, allowing 4322 (giefroot) to root the device.

    1474 is rated a 10 on NVD's website, which means it has high impact across Android devices. Let's hope it gets figured out soon.