• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[GUIDE][ROOT] How to Root 101 / 230 Firmware with Locked Bootloader

Search This thread

Cookie Ninja

Senior Member
Jan 21, 2010
2,043
699
ROOT JB (101) AND KITKAT (230) FIRMWARE WITH LOCKED BOOTLOADER

This thread is now officially obsolete. There is a new, simple and efficient ROOT method created by @geohot, based on the asec exploit. This method is valid for all versions of android with kernel dates older(earlier) than 04 June. The method probably works on any phone / tablet device EXCEPT the HTC M8, Moto G & E, and devices with Intel chipsets. Go to this thread for details:

http://forum.xda-developers.com/showthread.php?t=2783863

The guide below is obsolete and remains only for info. Please do not follow?.

DISCLAIMER: The steps WILL INVOLVE OBTAINING BOOTLOADER UNLOCK CODE FROM SONY, However, after unlocking, you will be guided to re-lock bootloader so that the end result will be a phone with Marlin Keys, Bravia Engine2 and Bootloader INTACT (LOCKED).

Starting Assumptions:

1. You have a Sony Xperia Z (C66XX) L-39H (Duh! Obvious!)
2. You have some knowledge of Root, SUPERUSER and enabling developer options, enabling USB Debugging mode, switching off and connecting your phone to USB & Computer with vol Up / Down Pressed to enable Fastboot mode or Flash Mode. If not, then go slowly and patiently, read every screen that flashes in front of you on your PC/Laptop and choose dilligently.
3. The bootloader status of your phone is BOOTLOADER UNLOCK ALLOWED--YES. This is the general case if you are on a no-contract plan with your service provider, or you have brought the phone at a full premium price (No discounted price by your wireless service provider). US / Canadian users, please obtain your unlock codes before you proceed further, all your phone's bootloaders ARE LOCKED. If you have bought the phone second-hand or from a dubious source check the bootloader lock status by opening the dialler and entering *#*#7378423#*#* (star-hash-star-hash S E R V I C E hash-star-hash-star). You will see four options 1. Service Info, 2. Service Tests, 3. Calibrations and 4. Customisation Settings. To check the bootloader status tap on Service Info>(next page)>tap on configuration>(next page) the last item is your bootloader status. It must read bootloader unlock allowed-YES If it reads "bootloader unlock allowed-NO" then you need unlock codes from your wireless service provider. If it reads "bootloader-UNLOCKED", then you have lost your Marlin keys and bootloader (This also means you cannot flash Sony updates, but you have a wide open field to flash any ROM and kernel of your choice!).
4. Loads of Patience....
5. Some coffee / favourite non-alcoholic brew at hand for sustenance (alcoholic beverages can be for later, till you're done with the process / you are past the legal age. Until then go easy....)
6. It is assumed that you have a Windows PC / Laptop (Win32/64) with all necessary drivers loaded. If not just download and install PC Companion, it will install the necessary Sony drivers.

Step-1
Locked bootloader with 4.2.2 (67 or lower firmware) ROOT status idoesn't matter.
Locked Bootloader with 4.3 (.569 / Commercial & Journalist's firmware) rooted / unrooted.

If on 4.2 firmware, then ROOT your device using BINARY's Method or cubeundcube's method (DOOMLORD's method works below 67 firmware, but I may be wrong) Links:
Binary's Thread: http://forum.xda-developers.com/showthread.php?t=1886460
cubeundcube nethod: http://forum.xda-developers.com/showthread.php?t=2559009
DOOMLORD's thread: http://forum.xda-developers.com/showthread.php?t=2327472

If on 4.3 firmware and not rooted, then downgrade to 4.2.2 (67 firmware) by flashing a ftf file of your region. Links for flashtool thread is given below. Use thread search to find ftf file for your region and download it.

If you are already rooted on 4.3, 569 firmware AND have a locked bootloader, then start from this point.

Make a backup of your Trim Area (TA) by using the tool created by DevShaft at this thread: http://forum.xda-developers.com/showthread.php?t=2292598 This Step is VERY IMPORTANT!!!!!

Step-2
You now have a rooted phone on 4.2.2 (67 firmware) or 4.3 (569 firmware), AND you have made a backup of yourphone's TA.

Now, upgrade to 4.3 (101 firmware) by connecting your phone to the PC (USB cable) using PC Companion or by using SUS. Use the UPGRADE option and not the CLEAN INSTALL option to retain data. On the first boot after upgrade you will realize that you've lost ROOT and any recovery that you had earlier installed.

Make a FTF file of the upgraded ROM by following the instructions from this thread by deadmask (http://forum.xda-developers.com/xperia-u/general/guide-how-make-ftf-stock-firmware-sus-t2075736) or from Stage-3 of this thread by VipeR (http://forum.xda-developers.com/showthread.php?t=2188129)

Step-3
You now have a phone on the latest firmware (without root) AND you have a backup of TA from 4.2 firmware, AND ALSO have a FTF file for the latest firmware.

Obtain the unlock code for your bootloader from the Sony website. Link: http://unlockbootloader.sonymobile.com/
enter your phone's IMEI number and your email to recieve the unlock code. Legal eagles, obtaining an unlock code DOES NOT MEAN THAT you have actually used it!!! Open your e-mail inbox and check for mail from SONY containing your unlock code.

Custom Kernel Download First download a custom kernel by DOOMLORD (with CWM) recovery for use immediately after unlocking the bootloader from this thread by DOOMLORD: http://forum.xda-developers.com/showthread.php?t=2167381 . Download the custom kernel and place it on your computer's desktop/folder of your choice. Extract the contents of the zip file and we'll come back to it later.

ADB+Fastboot Tools Download a set of ADB and fastboot tools made by anonymous and hosted at the Dev-host site Download link : http://d-h.st/I8l
After the zip file has downloaded extract it to get a folder fastboot+ADB Now take out the boot.img file from the zip file containing DOOMLORD's kernel above, and copy it to the win32subfolder inside the fastboot+ADB folder. Make a note of the location (Drive/folder) where this folder has been saved. (preferred storage on the desktop)

CWM Flashable SuperSU Download Download the latest flashable Super SU by Chainfire from the OP of this thread: http://forum.xda-developers.com/showthread.php?t=1538053 . Download the latest cwm flashable superSU.zip and place it in your phone's external SD Card
Use Androxyde's Flashtool (thread link:http://forum.xda-developers.com/showthread.php?t=920746) to unlock your bootloader It is a painless one-click procedure using the BL button. follow the instructions in the flashtool and let the phone reboot (after unplugging USB) Now recheck if ADB debigging mode and Unknown sources are enabled in phone settings.

Now click START on your PC and enter 'cmd' in the search box. Right click on the command prompt / DOS box (cmd.exe) and choose "run as administrator". Enter the administrator password if prompted by the PC. In the command prompt window type the following commands:
cd\
cd users\(your login username)\desktop\fastboot+adb\win32\
(in case you stored the fastboot+adb file on your desktop) or navigate to the folder where you stored the extracted files....
fastboot flash boot boot.img (did you extract and store the boot.img file from doomlord's kernel to the win32 file of fastboot+adb?)
wait for the results to flash and then type fastboot reboot andWAIT before you hit ENTER

Hold the phone in your hand and do the reboot command. As soon as the blue light goes off and the SONY logo appears wait for the phone LED to turn violet. Press Vol UP button on seeing the violet LED and release-press-release-press two to three times for good measure (Sometimes a constant press also works) till the LED goes off and the phone boots into CWM. In the CWM menu use the Vol up/down to tab move between the options and use the power button to select. There is also a touch-swipe down/up to tab-move and swipe right to select or swipe left to go back, use this method only if you are confident/familiar with the touch-select method. Select flash a Zip from external SD card and navigate to the folder where you stored the update-superSU-1.93.zip and select it. confirm by moving down to select Yes, Flash update-supersu1.93.zip and let CWM finish flasing the SU. go back to the main page and reboot to system from CWM.

After the phone reboots check Super SU is loaded on your phone in /System/app/ and check full root access on your phone....

Step-4
You now have a rooted phone on the Latest 101 firmware, with unlocked bootloader, AND you have a backup of your phone's TA and also have a ftf file of the latest firmware.

Now you have one last step to go back to stock kernel for locking your bootloader. Start Flashtool and select the flash (lightning) button select flash mode. Now select the latest firmware, which you had converted to FTF and on the right side top, (wipe options) untick all wipe options. On the right bottom (exclude), tick mark to exclude everything EXCEPT kernel and fotakernel. See that the centre window (flash content) shows only kernel.sin, fotakernel.sin and loader.sin. (Check Screenshot for reference) Now hit the flash button and put the phone into flash mode.Unplug and Reboot

Step-5
Now you have a rooted phone with the latest firmware on stock kernel (no CWM) AND you have a backup of the TA from your phone.
Now's the time to flash the TA. Do you remember the steps of making backup/restoring TA. check DevShaft's thread again, and remember it is better to do a dry run for restoring TA, before the final restore. DO IT.

Finally, you have rooted the phone with the latest firmware, and relocked your bootloader, and all with a ROM/Kernel and customisation of your region/choice.

Future Steps:
Flash a recovery. [NUT]'s dual recovery for locked bootloader is the best. Thread link : http://forum.xda-developers.com/showthread.php?t=2261606

Acknowledgements:
All DEVs and OPs whose threads, posts, tools and files as mentioned in this post. I have only placed them in one order. You may thank each thread OP &/or Dev for their tools, files and guides.
 
Last edited:

johan8

Senior Member
Nov 16, 2010
389
20
In 67 you can root with Doomlord solution, no need to unlock the bootloader.
Then need to update with cwm method other than rom flash.
 

kclo321

Member
Oct 18, 2008
16
1
In 67 you can root with Doomlord solution, no need to unlock the bootloader.
Then need to update with cwm method other than rom flash.

hi there, would you pls advise the step for Doomlord's solution? I follow this threat http://forum.xda-developers.com/showthread.php?t=2386405 but fail at step 2 flash older rootable version (tried XperiaZ_C660X_KernelOnly_10.3.A.0.423_Generic_NL.f tf - 7.12 MB and C6603_10.4.1.B.0.101_Stripped.ftf). phone boot loop.:rolleyes:
 

Cookie Ninja

Senior Member
Jan 21, 2010
2,043
699
That's why I didn't advise using doomlord's method in op. Read again. Root using bin4ry's method/cubeundcube method and proceed as per op. There's no need for striped and full ftf, just the ftf you create from your upgrade is enough.

Dead Cookies leave no trails...
 

DoubleYouPee

Senior Member
Jul 28, 2011
1,895
232
If you're going to go back to 2.67 anyway its easier to just flash NUTs upgrade to 4.3.
You will also have root and no fiddling with bootloader required.
 

Cookie Ninja

Senior Member
Jan 21, 2010
2,043
699
I posted this thread only after verifying the steps on my device. I was initially on 569 with locked bootloader and rooted. I did the exact steps and found that I had not lost any data, personal or on the internal sd card. Try... But Pls make a backup, just in case (I did it too).

Dead Cookies leave no trails...
 
Last edited:
  • Like
Reactions: nihilista

Fokezy

Senior Member
Jul 18, 2011
252
47
I posted this thread only after verifying the steps on my device. I was initially on 569 with locked bootloader and rooted. I did the exact steps and found that I had not lost any data, personal orion internal sd card. Try... But Pls make a backup, just in case (I did it too).

Dead Cookies leave no trails...

I have a nandroid backup of 4.2.2 so I guess I could just restore that If I happen to lose my stuff. Or maybe I have to downgrade and then restore?

Edit: But Honestly it's really risky. maybe I'll just wait till someone comes up with an exploit for 4.3.
 
Last edited:

dragonnet_86

Senior Member
Feb 7, 2013
68
0
Xiaomi Poco F3
First thanks
If i had download 4.3 101 on my copmputer and flash it manual can i skip step 2
- And when i flash framework and electocity cut can damage my phone ??!!

Sent from my C6603 using XDA Premium 4 mobile app
 

zviki

Senior Member
Dec 30, 2008
1,402
211
Maribor
Huh! With every new phone I bought,rooting is harder.Samsung phones was so easy to root.LG was a little bit harder,but this... :-S

Sent from my C6603 using Tapatalk
 

SONiX-GERMANY

Senior Member
Mar 11, 2013
270
121
Guys, it is not sooo hard as it sounds. If you are familiar with the usage of the flashtool and have a little bit trust in yourself, then THIS is definitive the right thread to get root access and a relocked bootloader on your .101 firmware. Follow exactly the steps and don't - please don't - listen to some smart heads who suggest to flash a prerooted fw. Take the hard way and you'll be definitive successfull. I did so with this tut, and my Z is totally ok. Thanks to Cookie Ninja again.

Sent from my rooted C6603 using xda app-developers app
 
  • Like
Reactions: Cookie Ninja

benchoz

Member
Oct 6, 2011
35
1
Shah Alam
hi all

ive got xperia z 6603 with 101 firmware..i try to flash 569 stripped file and then when i check back it doest even change anything at about phone..it still on 101..please someone..please provide more detailed instructions..im on LB..
 

kingvortex

Senior Member
Mar 25, 2010
5,042
3,967
Great tutorial. I've been linking people to it fairly regularly. :)

Just some input; you're advising people to get unlock codes from their network provider when it states 'Bootloader unlock allowed : No' in the service menu.

I'm fairly (almost completely) certain that there is no way for people in that situation to get the status changed at all, including by their network provider or Sony. Network/sim unlocking the device does not affect the bootloader unlock status.

Also, Flashtool has a fastboot mode that allows flashing of the boot.img, which may be easier for some that aren't confident working with the command line.

Anyway, they're small issues in what is a thorough tutorial. ;)

Sent from my C6603 using Tapatalk
 
Last edited:
  • Like
Reactions: Cookie Ninja

Top Liked Posts

  • There are no posts matching your filters.
  • 12
    ROOT JB (101) AND KITKAT (230) FIRMWARE WITH LOCKED BOOTLOADER

    This thread is now officially obsolete. There is a new, simple and efficient ROOT method created by @geohot, based on the asec exploit. This method is valid for all versions of android with kernel dates older(earlier) than 04 June. The method probably works on any phone / tablet device EXCEPT the HTC M8, Moto G & E, and devices with Intel chipsets. Go to this thread for details:

    http://forum.xda-developers.com/showthread.php?t=2783863

    The guide below is obsolete and remains only for info. Please do not follow?.

    DISCLAIMER: The steps WILL INVOLVE OBTAINING BOOTLOADER UNLOCK CODE FROM SONY, However, after unlocking, you will be guided to re-lock bootloader so that the end result will be a phone with Marlin Keys, Bravia Engine2 and Bootloader INTACT (LOCKED).

    Starting Assumptions:

    1. You have a Sony Xperia Z (C66XX) L-39H (Duh! Obvious!)
    2. You have some knowledge of Root, SUPERUSER and enabling developer options, enabling USB Debugging mode, switching off and connecting your phone to USB & Computer with vol Up / Down Pressed to enable Fastboot mode or Flash Mode. If not, then go slowly and patiently, read every screen that flashes in front of you on your PC/Laptop and choose dilligently.
    3. The bootloader status of your phone is BOOTLOADER UNLOCK ALLOWED--YES. This is the general case if you are on a no-contract plan with your service provider, or you have brought the phone at a full premium price (No discounted price by your wireless service provider). US / Canadian users, please obtain your unlock codes before you proceed further, all your phone's bootloaders ARE LOCKED. If you have bought the phone second-hand or from a dubious source check the bootloader lock status by opening the dialler and entering *#*#7378423#*#* (star-hash-star-hash S E R V I C E hash-star-hash-star). You will see four options 1. Service Info, 2. Service Tests, 3. Calibrations and 4. Customisation Settings. To check the bootloader status tap on Service Info>(next page)>tap on configuration>(next page) the last item is your bootloader status. It must read bootloader unlock allowed-YES If it reads "bootloader unlock allowed-NO" then you need unlock codes from your wireless service provider. If it reads "bootloader-UNLOCKED", then you have lost your Marlin keys and bootloader (This also means you cannot flash Sony updates, but you have a wide open field to flash any ROM and kernel of your choice!).
    4. Loads of Patience....
    5. Some coffee / favourite non-alcoholic brew at hand for sustenance (alcoholic beverages can be for later, till you're done with the process / you are past the legal age. Until then go easy....)
    6. It is assumed that you have a Windows PC / Laptop (Win32/64) with all necessary drivers loaded. If not just download and install PC Companion, it will install the necessary Sony drivers.

    Step-1
    Locked bootloader with 4.2.2 (67 or lower firmware) ROOT status idoesn't matter.
    Locked Bootloader with 4.3 (.569 / Commercial & Journalist's firmware) rooted / unrooted.

    If on 4.2 firmware, then ROOT your device using BINARY's Method or cubeundcube's method (DOOMLORD's method works below 67 firmware, but I may be wrong) Links:
    Binary's Thread: http://forum.xda-developers.com/showthread.php?t=1886460
    cubeundcube nethod: http://forum.xda-developers.com/showthread.php?t=2559009
    DOOMLORD's thread: http://forum.xda-developers.com/showthread.php?t=2327472

    If on 4.3 firmware and not rooted, then downgrade to 4.2.2 (67 firmware) by flashing a ftf file of your region. Links for flashtool thread is given below. Use thread search to find ftf file for your region and download it.

    If you are already rooted on 4.3, 569 firmware AND have a locked bootloader, then start from this point.

    Make a backup of your Trim Area (TA) by using the tool created by DevShaft at this thread: http://forum.xda-developers.com/showthread.php?t=2292598 This Step is VERY IMPORTANT!!!!!

    Step-2
    You now have a rooted phone on 4.2.2 (67 firmware) or 4.3 (569 firmware), AND you have made a backup of yourphone's TA.

    Now, upgrade to 4.3 (101 firmware) by connecting your phone to the PC (USB cable) using PC Companion or by using SUS. Use the UPGRADE option and not the CLEAN INSTALL option to retain data. On the first boot after upgrade you will realize that you've lost ROOT and any recovery that you had earlier installed.

    Make a FTF file of the upgraded ROM by following the instructions from this thread by deadmask (http://forum.xda-developers.com/xperia-u/general/guide-how-make-ftf-stock-firmware-sus-t2075736) or from Stage-3 of this thread by VipeR (http://forum.xda-developers.com/showthread.php?t=2188129)

    Step-3
    You now have a phone on the latest firmware (without root) AND you have a backup of TA from 4.2 firmware, AND ALSO have a FTF file for the latest firmware.

    Obtain the unlock code for your bootloader from the Sony website. Link: http://unlockbootloader.sonymobile.com/
    enter your phone's IMEI number and your email to recieve the unlock code. Legal eagles, obtaining an unlock code DOES NOT MEAN THAT you have actually used it!!! Open your e-mail inbox and check for mail from SONY containing your unlock code.

    Custom Kernel Download First download a custom kernel by DOOMLORD (with CWM) recovery for use immediately after unlocking the bootloader from this thread by DOOMLORD: http://forum.xda-developers.com/showthread.php?t=2167381 . Download the custom kernel and place it on your computer's desktop/folder of your choice. Extract the contents of the zip file and we'll come back to it later.

    ADB+Fastboot Tools Download a set of ADB and fastboot tools made by anonymous and hosted at the Dev-host site Download link : http://d-h.st/I8l
    After the zip file has downloaded extract it to get a folder fastboot+ADB Now take out the boot.img file from the zip file containing DOOMLORD's kernel above, and copy it to the win32subfolder inside the fastboot+ADB folder. Make a note of the location (Drive/folder) where this folder has been saved. (preferred storage on the desktop)

    CWM Flashable SuperSU Download Download the latest flashable Super SU by Chainfire from the OP of this thread: http://forum.xda-developers.com/showthread.php?t=1538053 . Download the latest cwm flashable superSU.zip and place it in your phone's external SD Card
    Use Androxyde's Flashtool (thread link:http://forum.xda-developers.com/showthread.php?t=920746) to unlock your bootloader It is a painless one-click procedure using the BL button. follow the instructions in the flashtool and let the phone reboot (after unplugging USB) Now recheck if ADB debigging mode and Unknown sources are enabled in phone settings.

    Now click START on your PC and enter 'cmd' in the search box. Right click on the command prompt / DOS box (cmd.exe) and choose "run as administrator". Enter the administrator password if prompted by the PC. In the command prompt window type the following commands:
    cd\
    cd users\(your login username)\desktop\fastboot+adb\win32\
    (in case you stored the fastboot+adb file on your desktop) or navigate to the folder where you stored the extracted files....
    fastboot flash boot boot.img (did you extract and store the boot.img file from doomlord's kernel to the win32 file of fastboot+adb?)
    wait for the results to flash and then type fastboot reboot andWAIT before you hit ENTER

    Hold the phone in your hand and do the reboot command. As soon as the blue light goes off and the SONY logo appears wait for the phone LED to turn violet. Press Vol UP button on seeing the violet LED and release-press-release-press two to three times for good measure (Sometimes a constant press also works) till the LED goes off and the phone boots into CWM. In the CWM menu use the Vol up/down to tab move between the options and use the power button to select. There is also a touch-swipe down/up to tab-move and swipe right to select or swipe left to go back, use this method only if you are confident/familiar with the touch-select method. Select flash a Zip from external SD card and navigate to the folder where you stored the update-superSU-1.93.zip and select it. confirm by moving down to select Yes, Flash update-supersu1.93.zip and let CWM finish flasing the SU. go back to the main page and reboot to system from CWM.

    After the phone reboots check Super SU is loaded on your phone in /System/app/ and check full root access on your phone....

    Step-4
    You now have a rooted phone on the Latest 101 firmware, with unlocked bootloader, AND you have a backup of your phone's TA and also have a ftf file of the latest firmware.

    Now you have one last step to go back to stock kernel for locking your bootloader. Start Flashtool and select the flash (lightning) button select flash mode. Now select the latest firmware, which you had converted to FTF and on the right side top, (wipe options) untick all wipe options. On the right bottom (exclude), tick mark to exclude everything EXCEPT kernel and fotakernel. See that the centre window (flash content) shows only kernel.sin, fotakernel.sin and loader.sin. (Check Screenshot for reference) Now hit the flash button and put the phone into flash mode.Unplug and Reboot

    Step-5
    Now you have a rooted phone with the latest firmware on stock kernel (no CWM) AND you have a backup of the TA from your phone.
    Now's the time to flash the TA. Do you remember the steps of making backup/restoring TA. check DevShaft's thread again, and remember it is better to do a dry run for restoring TA, before the final restore. DO IT.

    Finally, you have rooted the phone with the latest firmware, and relocked your bootloader, and all with a ROM/Kernel and customisation of your region/choice.

    Future Steps:
    Flash a recovery. [NUT]'s dual recovery for locked bootloader is the best. Thread link : http://forum.xda-developers.com/showthread.php?t=2261606

    Acknowledgements:
    All DEVs and OPs whose threads, posts, tools and files as mentioned in this post. I have only placed them in one order. You may thank each thread OP &/or Dev for their tools, files and guides.
    2
    Does it include downloading times? First time around I took 40 minutes. Now I reflash in 10 flat!

    Dead Cookies leave no trails...
    1
    Simple and easy to follow I now have a rooted Xperia Z on Android 4.3 :)
    1
    Managed it successful. Thanks for your detailed tutorial. Very nice, now let's look forward to KK! :)

    Sent from my GT-I8160 using xda app-developers app
    1
    First off, big thanks to CookieNinja for posting the tutorial. It made a pretty easy to follow roadmap for everyone to follow.

    It all worked fine, up to the point where I flashed the SuperSU zip file via CWM. When I rebooted the phone it got stuck in a boot-loop. I booted back into CMW and tried erasing all the caches, user data and selecting 'factory reset'. No good - still stuck in a boot loop.

    I managed to get out of it by using Flashtool to flash the .101 firmware I had downloaded from another thread here on XDA. But that removed the root access.

    So right now I have a .101 firmware with no root and no TA.

    I'm about to go through the whole procedure again, just to make sure I didn't make a mistake somewhere.

    Does anyone have any pointers as to what might have gone wrong? And how to avoid it if I get stuck this way again?

    Many thanks,
    V

    EDIT: One thing I did different was to use the 'Sony Bridge for Mac' to update the phone to .101 (Rather than using SUS or PC-Companion in step 2.) and as I said above - I used a .101 FTF that I downloaded from this XDA post: http://forum.xda-developers.com/xperia-z/general/10-4-b-0-569-au-firmwares-australian-t2349279 in step 4 to remove DoomLord's boot image.


    EDIT 2: I found where the Sony Bridge for Mac hides the update files, so I used Flashtool to create an FTF from it.

    EDIT 3: I still got the bootloop after the install CWM / flash SuperSU stage. So I'm flashing a complete install with my .101 FTF. Oh, and no TA partition anymore as I don't have root.