[DRM FIX] Drm fix for unlocked bootloader on 53.1.A.3.34

[munjeni]

Disclaimer:

All this was made for testing and educational purposes, ME is not responsible for what you do on/with your device using it, you must agree that you using all on your own risk, I am not responsible if you brick your device or anything else!

Hello, this is only for unlocked bootloaders! Hope you know when bootloader is unlocked all suntory blobs is inactive, widevine and ckb keys is not active too and also android atest key is not provisioned. What happen when you install this? All is back! More info on screenshoot from attachment.

Prereguires:
- stock rom version 53.1.A.3.34 , didn't tested on other versions!

How to install:
- to get L1 instead of L3 you need to flash boot delivery from android 9 via newflasher, this is mandatory for having L1 mode!
- boot twrp recovery
- flash Magisk-v20.4.zip
- boot you device, install magisk manager app from playstore, enable core only mode in magisk manager
- extract [email protected] from Magisk-v20.4.zip vendor/bin/hw folder and place in the same dir with adb on your pc

From above since magisk managed installer modification I done is not working you need to do it manualy via adb:

adb push [email protected] /data/local/tmp
adb shell
su
mount -o remount,rw /vendor
cp -fr /data/local/tmp/[email protected] /vendor/bin/hw/
chown 0.2000 /vendor/bin/hw/[email protected]
chmod 0755 /vendor/bin/hw/[email protected]
chcon u:object_r:hal_secd_default_exec:s0 /vendor/bin/hw/[email protected]
sync
reboot

you're done.

Enjoy!

 

[munjeni]

I'm unsure if I corectly modified magisk installer so let me know if you succed!

 

[Pandemic]

What about xperia 1 bro ?
Xperia 1 have no twrp

 

[munjeni]

What about xperia 1 bro ?
Xperia 1 have no twrp

This is for xperia 10 only, its two diferent phones, it might not work on xperia 1, somebody need to try.

 

[nitrams]

Nice. Have you tried to re lock boot loader after restoring drm keys? Any success?

 

[munjeni]

Nice. Have you tried to re lock boot loader after restoring drm keys? Any success?

relocking is not posible on xperia 10, and also when bootloader is unlocked device key aka drm key is lost forewer there is no back. The same is on xperia 1 and 5 and 1 II and 5 II . Relocking bootloader on 1,5,1II,5II didn't write new DK key, DK key is lost forewer! What this mod do? It patch bootloader unlock state and convert all widevine and ckb keys back so android think that bootloader is not unlocked and all is activated but in L3 mode. One thing when bootloader is unlocked security level is no more L1 it is L3. If you care about lossing DK key do not unlock bootloader, wait for temp root exploit instead.

 

[nitrams]

With that being said, is the stream quality downgraded to sub hd for l3?

 

[nitrams]

Another progress here
https://forum.xda-developers.com/xp...-xz2c-xz2p-xz3-temp-root-exploit-via-t4099131.

Hope someone can patch this to xperia 10

---------- Post added at 06:18 AM ---------- Previous post was at 05:54 AM ----------

is it possible to revert back to security level L1 by flashing custom roms? i think its not possible with lineageOS just like what sir LuK1337 quoted in lineage os official thread, but what about other roms like GSI or pixel experience?

 

[munjeni]

With that being said, is the stream quality downgraded to sub hd for l3?

Don't know how to check it but I'm believing since all widevine and ckb key is back it is like locked device.

Another progress here
https://forum.xda-developers.com/xp...-xz2c-xz2p-xz3-temp-root-exploit-via-t4099131.

Hope someone can patch this to xperia 10

---------- Post added at 06:18 AM ---------- Previous post was at 05:54 AM ----------

is it possible to revert back to security level L1 by flashing custom roms? i think its not possible with lineageOS just like what sir LuK1337 quoted in lineage os official thread, but what about other roms like GSI or pixel experience?

Its unclear why L3 mode is activate, it have 3 meanings:
1. because of DK (device key aka drm key) is lost
2. because I have modified vendor partition because of needs to replace secd with patched one
3. dm-verity is disabled

I curently have no idea how to replicate everything like stock, somebody need to participate on this to make our mod better, it can be better for sure, I'm just done initial work.

 

[j4nn]

@munjeni, in my opinion none of the 3 reasons you listed would cause L1 to L3.
I can tell only from recent test with xz2:
1) had device key restored
2) all partitions virgin stock not modified at all including kernel (boot) partition
3) dm-verity enabled
4) booted xz2 from usb via 'fastboot boot' using kernel patched to hide bootloader unlock (and therefore in theory not require any secd patching)
Still had L3 instead of L1 with xz2 android 10 fw. Security screen showed bootloader unlock not done, but there were suntory errors.

 

[nitrams]

@j4nn can you help us patch temp root exploit to xperia 10 please. I saw your post for XZ2/XZ2c/XZ2p/XZ3. Hope you can do us a favor here. Thank you

 

[j4nn]

@nitrams, I am not sure if kernel of xperia 10 is even vulnerable - according to @munjeni sony used 4.4 kernel.

 

[nitrams]

@j4nn and @munjeni could this help us with the exploit. I just keep on searching everytime you guys tell me new information. Sorry if i cant contribute as im not a dev nor into coding and its the least i can do. It shows its for pixel 2 and kernel version is 4.4.
https://github.com/kangtastic/cve-2019-2215

Also same exploit t was used on xz series
https://forum.xda-developers.com/cr...-xzp-temp-root-exploit-via-cve-t4046641/page6

 

[munjeni]

Ok j4nn, I will send you some info later by pm. Guys, with this mod L3 is mode only, but now I can tell you I have L1 mode activated! Going to edit OP with instruction how to install all this.

Edit:
updated install instructions!

 

[nitrams]

Wow that's good news. More power to you guys!

 

[serajr]

@munjeni ... you did it again! Awesome!! :highfive: :good:

 

[i.ippei]

Hello, @munjeni.

I'm thinking of porting your work to xperia 1.

please tell me, what tool did you use to analyze the "[email protected]".

IDAPro? objdump?