(How I got) XZ premium Fingerprint Volte & WiFi calling WITHOUT bootloader unlock

[Robin Banks]

*This would not be possible without j4nn & his amazing temp root https://forum.xda-developers.com/xperia-xz1-compact/development/devonly-exploits-temp-root-to-backup-t3795510 please thank & donate 2 him!*


This is not really a "how 2 guide" because I am not good at explaining things like this. But I will try & explain how I did it. Because I have seen a lot of other people also searching for working Volte without unlocking their bootloader.

First I used j4nn's temp root guide & flashed old firmware & ran his magic program. Then I backed up my DRM keys (incase I want to unlock my bootloader someday). Then I stopped. And instead of unlocking my bootloader & while still in temp root.. I thought, maybe I can write to the OEM folder? So I typed
'mount -o rw,remount /oem' and that worked!

So.. I used another command window without closing the first one and pushed a new OEM folder to /data/local/temp
(I got the new OEM folder from US XZ1c firmware. you can also get that folder by searching for TMo-VoLTE-fix-v3.zip & unziping it)

Then, I went back to the original temp root command window & used the 'cp' command to copy that new OEM file from data/local/temp over to my /OEM folder. I re-set the owner & file permissions rebooted.
After testing it, I was able 2 flash the latest (non US for working fp) Oreo by flashing like normal with Newflasher except I deleted the OEM.sin file, so it wouldn't write over my new one! Finally I disabled auto update.
Now my XZp is still bootloader locked, running 47.1.A.16.20 with Fingerprint, Volte & wifi calling all working on tmobile in the US.

I can actually receive calls at home now!! Before this, most of my calls went 2 vm, after a long pause.

I did also try it with pie & it didn't work for me. But, ymmv. I am sure it's possible tho. I was not impressed with pie anyways & I really hate that new volume popup window that covered my home & back keys in landscape mode.

One other note is because I have the dual sim XZp I changed my modem name in the modem.conf file from "tmobile_us_ims" to "dsds_tmobile_us_ims". I am not sure this is actually necessary tho because I have since looked in other ds Volte firmwares like Taiwan. And they don't use "dsds" in their modem.conf file

 

[tronganhha29]

*This would not be possible without j4nn & his amazing temp root https://forum.xda-developers.com/xperia-xz1-compact/development/devonly-exploits-temp-root-to-backup-t3795510 please thank & donate 2 him!*


This is not really a "how 2 guide" because I am not good at explaining things like this. But I will try & explain how I did it. Because I have seen a lot of other people also searching for working Volte without unlocking their bootloader.

First I used j4nn's temp root guide & flashed old firmware & ran his magic program. Then I backed up my DRM keys (incase I want to unlock my bootloader someday). Then I stopped. And instead of unlocking my bootloader & while still in temp root.. I thought, maybe I can write to the OEM folder? So I typed
'mount -o rw,remount /oem' and that worked!

So.. I used another command window without closing the first one and pushed a new OEM folder to /data/local/temp
(I got the new OEM folder from US XZ1c firmware. you can also get that folder by searching for TMo-VoLTE-fix-v3.zip & unziping it)

Then, I went back to the original temp root command window & used the 'cp' command to copy that new OEM file from data/local/temp over to my /OEM folder. I re-set the owner & file permissions rebooted.
After testing it, I was able 2 flash the latest (non US for working fp) Oreo by flashing like normal with Newflasher except I deleted the OEM.sin file, so it wouldn't write over my new one! Finally I disabled auto update.
Now my XZp is still bootloader locked, running 47.1.A.16.20 with Fingerprint, Volte & wifi calling all working on tmobile in the US.

I can actually receive calls at home now!! Before this, most of my calls went 2 vm, after a long pause.

I did also try it with pie & it didn't work for me. But, ymmv. I am sure it's possible tho. I was not impressed with pie anyways & I really hate that new volume popup window that covered my home & back keys in landscape mode.

One other note is because I have the dual sim XZp I changed my modem name in the modem.conf file from "tmobile_us_ims" to "dsds_tmobile_us_ims". I am not sure this is actually necessary tho because I have since looked in other ds Volte firmwares like Taiwan. And they don't use "dsds" in their modem.conf file

Do we lose drm key? Can I access the / system or use root explorer?

 

[Robin Banks]

Do we lose drm key? Can I access the / system or use root explorer?

You won't lose any drm keys if you don't unlock the bootloader. I posted screen shots above that show all security keys intact, with locked bootloader. And if you look at the top, the wifi calling icon is there! The "rooting" part I used was only temporary & I only tried 2 modify files in the /OEM folder because that's all I needed for Volte & WiFi calling on tmobile. I had 2 downgrade firmware & run a temp root exploit from j4nn.

His exploit is explained here https://forum.xda-developers.com/xperia-xz1-compact/development/devonly-exploits-temp-root-to-backup-t3795510 BUT, instead of unlocking the bootloader I just copied US Xz1c /OEM files into my /OEM folder then set file permissions. That would be awesome if someone could make a script 2 automate this process for everyone!
Remember after your done, your gonna want 2 update to a newer more secure firmware. I didn't have luck with Pie, but it's got some minor bugs anyways (I am running Oreo 47.1.A.16.20 now & I love it). The trick is you MUST DELETE the OEM.sin folder from the new firmware folder before you flash it. Otherwise it will write over your progress.

 

[tronganhha29]

You won't lose any drm keys if you don't unlock the bootloader. I posted screen shots above that show all security keys intact, with locked bootloader. And if you look at the top, the wifi calling icon is there! The "rooting" part I used was only temporary & I only tried 2 modify files in the /OEM folder because that's all I needed for Volte & WiFi calling on tmobile. I had 2 downgrade firmware & run a temp root exploit from j4nn.

His exploit is explained here https://forum.xda-developers.com/xperia-xz1-compact/development/devonly-exploits-temp-root-to-backup-t3795510 BUT, instead of unlocking the bootloader I just copied US Xz1c /OEM files into my /OEM folder then set file permissions. That would be awesome if someone could make a script 2 automate this process for everyone!
Remember after your done, your gonna want 2 update to a newer more secure firmware. I didn't have luck with Pie, but it's got some minor bugs anyways (I am running Oreo 47.1.A.16.20 now & I love it). The trick is you MUST DELETE the OEM.sin folder from the new firmware folder before you flash it. Otherwise it will write over your progress.

Can you help me on activating VoLTE? I read in the above tutorial just talking about backup and restore TA partition. Sorry for my English not good. Thank you!

 

[Robin Banks]

Can you help me on activating VoLTE? I read in the above tutorial just talking about backup and restore TA partition. Sorry for my English not good. Thank you!

Are you in the US, & want Volte on Tmobile?

 

[tronganhha29]

Are you in the US, & want Volte on Tmobile?

No, I'm in Vietnam, i'm using G8141 with custom CH firmware

 

[Robin Banks]

No, I'm in Vietnam, i'm using G8141 with custom CH firmware

I am sorry, I am not familiar with any phone providers in Vietnam. I don't think there is an easy fix because I haven't seen Vietnamese Volte modem files in any XZp firmware. I could be wrong tho, so maybe someone will correct me & also help you out.

The only reason this works for tmobile is because Sony included built in support files for some providers, like tmobile in the US. But, it's only their XZ1c phone that will actually load the correct modem file & trigger Volte & WiFi calling features out of the box. Only a couple files need to be changed on the XZp.
Problem was, it always required a bootloader unlock to change those files.

This is not a problem anymore... Because it can now be done with temproot thanks to j4nn!

 

[tronganhha29]

I am sorry, I am not familiar with any phone providers in Vietnam. I don't think there is an easy fix because I haven't seen Vietnamese Volte modem files in any XZp firmware. I could be wrong tho, so maybe someone will correct me & also help you out.

The only reason this works for tmobile is because Sony included built in support files for some providers, like tmobile in the US. But, it's only their XZ1c phone that will actually load the correct modem file & trigger Volte & WiFi calling features out of the box. Only a couple files need to be changed on the XZp.
Problem was, it always required a bootloader unlock to change those files.

This is not a problem anymore... Because it can now be done with temproot thanks to j4nn!

I worry about losing drm key. I was on the xzc and I had a camera error.
Thank you !

 

[Robin Banks]

I worry about losing drm key. I was on the xzc and I had a camera error.
Thank you !

The only way you can lose your DRM keys... Is unlocking your bootloader. I did not want to do that. But, I wanted Volte & WiFi calling. This thread is about how I got those features WITHOUT unlocking my bootloader. And yes, of course I still have my DRM keys.

You said, that you had a camera error on an XZ1c? Assuming, you unlocked the bootloader. Did you get Volte working in Vietnam after you unlocked it? If not, then none of this will help you with your XZp. because they are very similar & they use the same provider modem files.

From what I understand, the Pie update fixes the green picture camera error. Have you tried updating your XZ1c to Pie? That should atleast make your camera work again.

 

[vyis]

Good idea, i'm using others country rom because my country update speed suck ... (Due to the carrier) , so i lose feature like WIFI calling and VoLTE. Gonna try this.

 

[Robin Banks]

Good idea, i'm using others country rom because my country update speed suck ... (Due to the carrier) , so i lose feature like WIFI calling and VoLTE. Gonna try this.

This is what people in the US with the XZ1c have been doing because they want to enable their Fingerprint sensor AND have the US Volte settings.

So if your provider already supports Volte.. Flash that firmware first so your volte works. Then before you flash the country you want to use. Just delete the new OEM.sin file out of the folder. That will make a perfect mix of the two.
It will only keep your volte provider settings from old firmware. You don't even need temp root.
But I doubt Volte setting would survive an OTA update. It also will work with two different build versions. I don't know if this is possible with oreo/pie mix tho.

 

[VBBoston]

*This would not be possible without j4nn & his amazing temp root https://forum.xda-developers.com/xperia-xz1-compact/development/devonly-exploits-temp-root-to-backup-t3795510 please thank & donate 2 him!*


This is not really a "how 2 guide" because I am not good at explaining things like this. But I will try & explain how I did it. Because I have seen a lot of other people also searching for working Volte without unlocking their bootloader.

First I used j4nn's temp root guide & flashed old firmware & ran his magic program. Then I backed up my DRM keys (incase I want to unlock my bootloader someday). Then I stopped. And instead of unlocking my bootloader & while still in temp root.. I thought, maybe I can write to the OEM folder? So I typed
'mount -o rw,remount /oem' and that worked!

So.. I used another command window without closing the first one and pushed a new OEM folder to /data/local/temp
(I got the new OEM folder from US XZ1c firmware. you can also get that folder by searching for TMo-VoLTE-fix-v3.zip & unziping it)

Then, I went back to the original temp root command window & used the 'cp' command to copy that new OEM file from data/local/temp over to my /OEM folder. I re-set the owner & file permissions rebooted.
After testing it, I was able 2 flash the latest (non US for working fp) Oreo by flashing like normal with Newflasher except I deleted the OEM.sin file, so it wouldn't write over my new one! Finally I disabled auto update.
Now my XZp is still bootloader locked, running 47.1.A.16.20 with Fingerprint, Volte & wifi calling all working on tmobile in the US.

I can actually receive calls at home now!! Before this, most of my calls went 2 vm, after a long pause.

I did also try it with pie & it didn't work for me. But, ymmv. I am sure it's possible tho. I was not impressed with pie anyways & I really hate that new volume popup window that covered my home & back keys in landscape mode.

One other note is because I have the dual sim XZp I changed my modem name in the modem.conf file from "tmobile_us_ims" to "dsds_tmobile_us_ims". I am not sure this is actually necessary tho because I have since looked in other ds Volte firmwares like Taiwan. And they don't use "dsds" in their modem.conf file

You are awesome! Can you please write specific commands you used to
1) push a new OEM folder to /data/local/temp
2) 'cp' command to copy that new OEM file from data/local/temp over to my /OEM folder.
3) I re-set the owner & file permissions rebooted.

Thanks!

 

[Robin Banks]

You are awesome! Can you please write specific commands you used to
1) push a new OEM folder to /data/local/temp
2) 'cp' command to copy that new OEM file from data/local/temp over to my /OEM folder.
3) I re-set the owner & file permissions rebooted.

Thanks!

I will try. But, like I said. I am not that great at step by step instructions. It would be awesome if someone made a better guide or a script 2 run after temp root.

So, AFTER you already have temp root. Open another command window (keep your temp root window open!) assuming you have the new OEM folder in your command line root dir.
Adb push OEM /data/local/tmp
Then using the temp root window from earlier exploit.
mount -o rw,remount /oem
chown root.root /data/local/tmp/OEM
cd /data/local/tmp/OEM
cp - R * /oem
chmod 755 /oem/modem-config
chmod 755 /oem/modem-config/408
chmod 644 /oem/modem-config/408/modem.conf
chmod 755 /oem/overlay-408
chmod 644 /oem/overlay-408/android-res-310-408.apk
chmod 644 /oem/overlay-408/com.android.carrierconfig-res-310-408.apk
chmod 644 /oem/overlay-408/com.android.phone-res-310-408.apk
chmod 644 /oem/overlay-408/com.android.settings-res-310-408.apk
chmod 644 /oem/overlay-408/com.android.systemui-res-310-408.apk
chmod 755 /oem/system-properties/408
chmod 644 /oem/system-properties/408/config.prop

Done. Reboot. You might half to take out your Sim card & reinsert it. Or factory reset. To get volte setting to take. You will know because it will say something like restarting to update carrier configuration.
Then of course you can update, but be shure to delete the OEM.sin file before flashing newer firmware! I tried this with pie once & it did not work for me. But ymmv. Right now I like oreo better anyways
I have included the zip file I found here on XDA & used it. It's meant for bootloader unlocked so just Unzip it & only use the OEM file.

Please let me know how it goes or if I forgot something!

 

[VBBoston]

I will try. But, like I said. I am not that great at step by step instructions. It would be awesome if someone made a better guide or a script 2 run after temp root.

So, AFTER you already have temp root. Open another command window (keep your temp root window open!) assuming you have the new OEM folder in your command line root dir.
Adb push OEM /data/local/tmp
Then using the temp root window from earlier exploit.
mount -o rw,remount /oem
chown root.root /data/local/tmp/OEM
cd /data/local/tmp/OEM
cp - R * /oem
chmod 755 /oem/modem-config
chmod 755 /oem/modem-config/408
chmod 644 /oem/modem-config/408/modem.conf
chmod 755 /oem/overlay-408
chmod 644 /oem/overlay-408/android-res-310-408.apk
chmod 644 /oem/overlay-408/com.android.carrierconfig-res-310-408.apk
chmod 644 /oem/overlay-408/com.android.phone-res-310-408.apk
chmod 644 /oem/overlay-408/com.android.settings-res-310-408.apk
chmod 644 /oem/overlay-408/com.android.systemui-res-310-408.apk
chmod 755 /oem/system-properties/408
chmod 644 /oem/system-properties/408/config.prop

Done. Reboot. You might half to take out your Sim card & reinsert it. Or factory reset. To get volte setting to take. You will know because it will say something like restarting to update carrier configuration.
Then of course you can update, but be shure to delete the OEM.sin file before flashing newer firmware! I tried this with pie once & it did not work for me. But ymmv. Right now I like oreo better anyways
I have included the zip file I found here on XDA & used it. It's meant for bootloader unlocked so just Unzip it & only use the OEM file.

Please let me know how it goes or if I forgot something!

Thank you!!! just needed to edit command cp - R * /oem to cp -R * /oem

 

[SGH-i200]

[...] because I have the dual sim XZp I changed my modem name in the modem.conf file from "tmobile_us_ims" to "dsds_tmobile_us_ims".

Since my G8342 does not load the correct 'Current Modem Configuration' (see screenshot from G8341) I can force this by editing the 'modem.conf', right?

 

[Robin Banks]

Since my G8342 does not load the correct 'Current Modem Configuration' (see screenshot from G8341) I can force this by editing the 'modem.conf', right?

I am just gonna guess that your running a single Sim firmware & you want 2 load a dual sim modem? I am pretty shure that won't work. You can use a single Sim firmware & modem file on a dual sim phone. But the other sim slot won't function. But it looks like you already know that. I am using a dual sim firmware (and phone g8142). But there is no official Volte tmobile firmware for the XZp. Even tho the correct tmobile modem is baked into all the XZp firmwares. It needs the OEM.sin to provision volte & WiFi. It sets "IMS" true or something like that. So I used an oem.sin config file from a single Sim Xz1c. But the rest of my firmware is still XZp dual sim. I originally changed the part where it loads the correct modem & added "dsds" to the beginning because that's what the tmobile modem in my firmware is named. That worked. But it turns out, I didnt even half 2 do that. It still loads my "dsds_tmobile_us_ims" modem. Even tho I just have "tmobile_us_ims" in my modem.conf file. If you were gonna try and load a diffent modem it would be under /oem/modem-config/310/modem.conf because 310 is the customization that your running (in your thumbnail). So, yes you can force it 2 load whatever modem you want.. But only try the modems that are included with your current firmware. I wouldnt copy an actual dual sim modem into your single sim firmware. It *might* work. More then likely would brick it. Lemme know if you have any other questions & I will help ya if I can

 

[SGH-i200]

I am using a dual sim firmware (and phone g8142). But there is no official Volte tmobile firmware for the XZp. Even tho the correct tmobile modem is baked into all the XZp firmwares. It needs the OEM.sin to provision volte & WiFi. It sets "IMS" true or something like that. So I used an oem.sin config file from a single Sim Xz1c. But the rest of my firmware is still XZp dual sim.

This is the way I did it, too!

[...]still loads my "dsds_tmobile_us_ims" modem. Even tho I just have "tmobile_us_ims" in my modem.conf file.

Flashing the OEM.sin is not enough in my case (G8342) because the modem file is missing!?

But only try the modems that are included with your current firmware.

Is it possible to "look" into a SIN file without flashing it, to see which modem files are included, without flashing the firmware?

 

[Robin Banks]

This is the way I did it, too!

Flashing the OEM.sin is not enough in my case (G8342) because the modem file is missing!?
Is it possible to "look" into a SIN file without flashing it, to see which modem files are included, without flashing the firmware?

The actual modem files are in modem.sin and you could unpack them and take a look. But, if your using a single sim xz1 OEM.sin that supports your carriers volte settings.. I think you should be able 2 just flash the whole firmware. I have flashed a single Sim firmware on my XZp and back to dual sim. You will loose your second sim functionality. But you can always flash a dual sim firmware back & it will be good has new. Do you really use 2 sim cards? Check out the 7th post in this thread (user rafi.mv6) about Xz1 single Sim flashing. https://forum.xda-developers.com/xz-premium/how-to/xzp-volte-firmware-t3631276