[DISCUSSION] Something interesting about unlocking bootloader and OTA update

[imtyg]

Previously I tried to write TA backup file of my F8132 (HK Variant) into its partition, then I found that the warning message showed before SONY boot logo disappeared.
But I need to flash a stock firmware to prevent boot failure since signature will be verified before booting. Actually the phone is relocked with DRM features come back, just like a locked new phone. The camera focus is OK. and X-Reality works fine, etc. You can get OTA firmware updates again.

After that, I tried to unlock bootloader again by flashtool. Since we know that the data will be completely erased during the boot after unlocking. I tried to erase boot and FOTAKernel partition by fastboot. Of course the phone can't boot without a kernel, and the data will not be erased automatically. I used fastboot to boot a TWRP recovery image directly.

Finally the phone booted into recovery mode, but the data partition was encrypted and I should input a password, or erase it. So I had to format the partition. Then I checked the cache partition and found out that the OTA firmware will be download to /storage/emulated/0/recovery/update-package. Maybe it's simply a zip file, but I'm too late to check it. (Maybe I can get it the next time after an OTA download finished Now I found that it is not a zip file). But the most interesting thing I found was that I received the Nougat OTA update of 39.2.A.0.327, after I formatting the data partition! At this moment I'm in unlocked Marshmallow 35.1.A.0.297 and AndroPlus Kernel v12 with DRM fix. However, there is something different from normal unlocked phone with DRM fix. The SECURITY test which shows the DRM keys said:

WIDEVINE [Key OK] [Active]
CKB [Key OK] [Active]
HUK: ****************
PRODID_AID : 0004
OTP_LOCK_CONFIG : 1555
OTP_LOCK_STATUS : LOCKED
AUTH_ENABLE : 07
DEVICE_ID : ********

[B]FIDO_KEYS : Not provisioned[/B]

Factory Reset Reason: virgin,notimestamp

I have checked with my friends, and found out that:

If it has not been unlocked yet, the FIDO_KEYS will show Provisioned;
If it has been unlocked, and without DRM fix, the HUK will be generic error!, and FIDO_KEYS will be Not provisioned, SUNTORY error;
if it has been unlocked, but with DRM fix, the FIDO_KEYS will show Not provisioned, provision failed.

The camera and X-Reality works fine, and I finally get the Nougat OTA package for 297, but I can't unpack it now.
It's interesting because if you unlock the phone, then reboot to let it erase the data partition by itself, finally flash a DRM fixed kernel, you will not receive an OTA firmware update (but you can update the system apps). So I guess I skipped some changes to TA partition during the manual erase of those partitions. I plan to study it when I'm free in holidays.:fingers-crossed:

 

[KWOKSFUNG]

This is probably just becoz of the drm fix in androplus work so well that it fake the system that the phone is in LB status. U can try do that OTA in UB but it will fail

 

[imtyg]

This is probably just becoz of the drm fix in androplus work so well that it fake the system that the phone is in LB status. U can try do that OTA in UB but it will fail

I use the fix all the time, but I have never received OTA before. And I think I can just flash stock kernel and recovery to let it update successfully if I don't modify the system partition, maybe.

 

[serajr]

How about this?
You can build your own kernel with drmfix and DK.ftf (if you've backed up TA partition prior to unlock the bootloader).