• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!
  • Fill out your device list and let everyone know which phones you have!    Edit Your Device Inventory

How-to: root, keep and backup DRM keys, etc. [KitKat/Lollipops/Marshmallow/etc.]

Search This thread

astrosp4c3

Senior Member
May 28, 2012
464
148
Moon
Not even angry with you..
Your experience is welcome and you're probably right. ;)
The problem is that we need some more tests.
I will report.

All I can say is that I really hope that somebody proves me wrong! :)

I'm very interested in this, because I take care of this list/tutorial: http://forum.xda-developers.com/z3-compact/general/list-stock-firmwares-d5803-d5833-t2906706

If on z3c the downgrading process always wipes the data partition, I will correct my guide.
I've been taking care of a similar thread for Xperia T for ONE year and nobody said he had a problem with this method. So, I'm sure it's good for older xperia.

Now, it's possible that our beloved z3c has a different behaviour with Flashtool.
Ok.
The problem is that if you say to someone to make a copy of his/her stuff and make a test and then report the feedback, you have a chance of 10% to get an answer (if you're lucky).
Nobody wants to test, never. We are always the same few people that lock, unlock, relock the bootloader, flash, downgrade, upgrade, wipe, make backup and REPORT.
And anyways, only one experience is never reliable.
So bad, it really makes me angry. :(

Nevertheless, I will test by myself and report.
@dillalade I'm not angry with you, I'm sure you need not to lose your data...

Strange yet Inconclusive.

We need others to chime in on there experience if they managed to preserve there data partition post downgrade.

Though I suspect not given Charlie's experience.


I didn't wipe doing downgrade and upgrade and i haven't got any big problem. I just had a little problem downgrading to .98 , had force closes of android.process.media and android.process.acore , i solved it cancelling the data of applications: Contacts, Contacts storage (not sure how it's translated) and for the process.media just deleted data of Media Storage. Other than these the phone is like always
Upgrade didn't present also problems unchecking the wipes.

You can do all this without lose your data , don't worry.
 
Last edited:
D

darkarvan

Guest
Are you sure about this?
With the Z1C was necessary relock the bootloader.

In all cases, the photos in the night seem very bad.

you could possible check if all work fine with the drm keys in the service menu. *#*#SERVICE#*#*, Service Tests, Security.
I dont know if there is displayed all, but at me it is @ Stock "Key OK Active" in very line.
 

damaz78

Member
Feb 4, 2011
31
10
Wrocław
I didn't wipe doing downgrade and upgrade and i haven't got any big problem. I just had a little problem downgrading to .98 , had force closes of android.process.media and android.process.acore , i solved it cancelling the data of applications: Contacts, Contacts storage (not sure how it's translated) and for the process.media just deleted data of Media Storage. Other than these the phone is like always
Upgrade didn't present also problems unchecking the wipes.

You can do all this without lose your data , don't worry.

I can absolutelly confirm that. I didn't even wipe any apps data while on. 98 for a while and troubled by the same FC's - together with going back to. 77 it's all gone. No trouble at all now and enjoing root. Go on for it guys.
 
  • Like
Reactions: dillalade and istux

bilboa1

Inactive Recognized Developer
Aug 16, 2010
1,289
683
Just as a quick note, while its possible to down/re-upgrade without losing any data, i'd rather have the topic wipe data by default, and warn that it wipes the phone. Advanced users can figure out by themselves how to do it as they follow the steps without losing data.
Non advanced users have high chances of deleting the data even when following different steps, and even if successful, to have other problems due to corrupted settings after downgrading if they used the phone for a bit. (then you get these "oh what the hell my battery life is bad" and logcat is spamming errors. or "this single app always FC since i followed this!" while most app wouldn't).

Thus, you can keep data, at your own risk, and if you do that, you already know how to =)
 

CAL7

Senior Member
Jun 1, 2010
565
74
if you type "mount" it should show if /system is mounted as rw (read write) after the above commands are typed
if thats the case then the problem is elsewhere ;)
Does the following tell you anything about my rw problem?
Code:
 [email protected]:/ $ su
[email protected]:/ #* mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,size=886952k,nr_inodes=178260,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,size=886952k,nr_inodes=178260,mode=750,gid=1000 0 0
securityfs /sys/kernel/security securityfs rw,nosuid,nodev,noexec,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,size=886952k,nr_inodes=178260,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,size=886952k,nr_inodes=178260,mode=755,gid=1000 0 0
tmpfs /tmp tmpfs rw,seclabel,nosuid,relatime,size=886952k,nr_inodes=178260,mode=755 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,discard,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,relatime,discard,noauto_da_alloc,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,relatime,discard,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/apps_log /mnt/idd ext4 rw,seclabel,nosuid,nodev,noexec,noatime,discard,data=ordered 0 0
tmpfs /storage/remote tmpfs rw,seclabel,relatime,size=1024k,nr_inodes=256,mode=750,gid=1028 0 0
/dev/block/platform/msm_sdcc.1/by-name/LTALabel /lta-label ext4 ro,seclabel,nosuid,nodev,noexec,noatime,nobarrier,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other,allow_utime_grp 0 0
/dev/fuse /storage/uicc0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other,allow_utime_grp 0 0
tmpfs /storage/emulated tmpfs rw,seclabel,nosuid,nodev,relatime,mode=050,gid=1028 0 0
/dev/block/vold/179:65 /mnt/media_rw/sdcard1 texfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,gid=1023,umask=0007,allow_utime=0020,nls=utf8,min_prealloc_size=64k,max_prealloc_size=60874M,readahead=4M,fail_safe,discard,errors=continue 0 0
/dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other,allow_utime_grp 0 0
/dev/fuse /storage/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other,allow_utime_grp 0 0
/dev/fuse /storage/emulated/0/Android/obb fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other,allow_utime_grp 0 0
/dev/fuse /storage/emulated/legacy fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other,allow_utime_grp 0 0
/dev/fuse /storage/emulated/legacy/Android/obb fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other,allow_utime_grp 0 0
 

lysp

Member
Jul 11, 2011
32
15
Well, you haven't heard back from me because I spent the last couple of days mourning since it didn't work ;)
I didn't get any FC when flashing the new FW like somebody else reported but I couldn't save my apps/data. I backup all I could but after downgrading I basically had an empty phone.

I managed to root without deleting data. Took a few goes, but worked.

I followed another post:
http://forum.xda-developers.com/z3/general/root-d6603-77-downgrade-data-wipe-t3016521

The only issue i had i think (from memory) was forgetting to enable flight mode, and mock locations.
 

Proday

Senior Member
Sep 19, 2010
271
36
When I'm trying to flash the frimware it says me:
02/001/2015 11:01:20 - ERROR - Drivers need to be installed for connected device.
02/001/2015 11:01:20 - ERROR - You can find them in the drivers folder of Flashtool.

I had the same problems on my win 8 x64, there were no chances to make drivers to woark. I switched to my brother computer with win 7 and everything woarked fine from first.
 

dunrite

New member
Sep 14, 2014
2
0
Brisbane
Hi all
I used this guide to root and install recovery on my D5803. It all went smoothly. After everything was done and rebooted into system I checked the apps to see if the SU icon was there which it was along with the NDRUtils icon.
I then tried to boot in recovery, with no luck at all. I went to Nuts page and followed his steps,
and different combinations of the power and volume buttons. The phone just boots as normal. There's no LED flash.
I used the NDRUtils app and selected reboot to recovery. It just does a normal reboot. Like recovery not there at all.
I repeated the guide a second time with the same results.
Has anyone had this problem or am I just flat missing something.
I would be grate full for any help.

Thanks...dunrite
 

jean001luc

Senior Member
Aug 2, 2010
285
8
you could try at first the xposed module Root Cloak , and only if that doesnt work proceed with unroot

Thank you.
Xposed however does not succesfulyl hide root for the application in question (work related apps plus Barclays mobile banking).
Is it possible to do a complete unroot?
My end goal is to remove bloatware - after that I don't need root
 

Nesousx

Senior Member
Sep 29, 2009
53
2
Hi all,

I have followed the first post to root my device and it worked. However, I am strugling with the non writable /system paritition.

Symptoms :

my /system is read only:
Code:
mount | grep system                                                                                                                  
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,discard,data=ordered 0 0
I can manually remount as rw, but it won''t take hold after the reboot.

Weird things, is I had no issue so far with several "root" apps : Titanium Backup, Xposed Framework, Adaway. They all works flawlessly. However, if I want to create or delete a file inside /system (even though the file exporer is granted root access) I have an error and can't do it. As mentionned earlier, my /system boots as ro, and I can remount it manually as rw.

What I tried :

  1. I have flashed RICDefeat.zip from recovery and,
  2. I even tried this : http://forum.xda-developers.com/showpost.php?p=58421809&postcount=1108 but it didn't help either.

Any help would be greatly appreciated.
 
Last edited:
  • Like
Reactions: CAL7

istux

Senior Member
Jun 26, 2012
1,448
1,474
Milano
I didn't wipe doing downgrade and upgrade and i haven't got any big problem. I just had a little problem downgrading to .98 , had force closes of android.process.media and android.process.acore , i solved it cancelling the data of applications: Contacts, Contacts storage (not sure how it's translated) and for the process.media just deleted data of Media Storage. Other than these the phone is like always
Upgrade didn't present also problems unchecking the wipes.

You can do all this without lose your data , don't worry.

I can absolutelly confirm that. I didn't even wipe any apps data while on. 98 for a while and troubled by the same FC's - together with going back to. 77 it's all gone. No trouble at all now and enjoing root. Go on for it guys.

Just as a quick note, while its possible to down/re-upgrade without losing any data, i'd rather have the topic wipe data by default, and warn that it wipes the phone. Advanced users can figure out by themselves how to do it as they follow the steps without losing data.
Non advanced users have high chances of deleting the data even when following different steps, and even if successful, to have other problems due to corrupted settings after downgrading if they used the phone for a bit. (then you get these "oh what the hell my battery life is bad" and logcat is spamming errors. or "this single app always FC since i followed this!" while most app wouldn't).

Thus, you can keep data, at your own risk, and if you do that, you already know how to =)

I managed to root without deleting data. Took a few goes, but worked.

I followed another post:
http://forum.xda-developers.com/z3/general/root-d6603-77-downgrade-data-wipe-t3016521

The only issue i had i think (from memory) was forgetting to enable flight mode, and mock locations.

Thank you guys... there's no need of my test anymore :good: and no need to correct my tutorial in "stock firmware" thread as well :victory:

Well, so if you uncheck "data" before downgrading and then before upgrading, the data partition is safe and the only issues you get are the errors I quoted above, which get fixed when you revert back to .77 at the end of the process


@bilboa1 If you change idea in the future, you can insert a note inside the OP that points to this post, in order to help who needs to keep data.
People keep asking the same questions over and over again ;)
 
  • Like
Reactions: Lazer72

Sptz

Senior Member
Jun 25, 2012
65
4
I tried to copy a file to /system and it didn't work, so, I'm assuming I encountered the RO mounting issue. So, I tried flashing the fix in the OP and nothing has changed. Still can't copy anything to /system, so effectively, Titanium is only able to freeze apps but not uninstall them.

Anyone faced the same issue and knows a fix?

Many thanks

---------- Post added at 04:58 PM ---------- Previous post was at 04:33 PM ----------

Hi all,

I have followed the first post to root my device and it worked. However, I am strugling with the non writable /system paritition.

Symptoms :

my /system is read only:
Code:
mount | grep system                                                                                                                  
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,discard,data=ordered 0 0
I can manually remount as rw, but it won''t take hold after the reboot.

Weird things, is I had no issue so far with several "root" apps : Titanium Backup, Xposed Framework, Adaway. They all works flawlessly. However, if I want to create or delete a file inside /system (even though the file exporer is granted root access) I have an error and can't do it. As mentionned earlier, my /system boots as ro, and I can remount it manually as rw.

What I tried :

  1. I have flashed RICDefeat.zip from recovery and,
  2. I even tried this : http://forum.xda-developers.com/showpost.php?p=58421809&postcount=1108 but it didn't help either.

Any help would be greatly appreciated.

I have the exact same issue, flashing the RCIDefeat.zip did no good as well.

Have you tried uninstalling the app "Albums" for example with Titanium? Try that after backing it up and see if it holds after a reboot. That's the issue I'm having, I'm only able to freeze those xperia system apps. :(
 

CAL7

Senior Member
Jun 1, 2010
565
74
I tried to copy a file to /system and it didn't work, so, I'm assuming I encountered the RO mounting issue. So, I tried flashing the fix in the OP and nothing has changed. Still can't copy anything to /system
Same here. I've done everything I've been able to research that is supposed to address the rw issue: 2.8.1 dual recovery, RICdefeat, the adb commands. I'm VERY open to suggestions.

Anyone faced the same issue and knows a fix?
Yes; No.

I have the exact same issue, flashing the RCIDefeat.zip did no good as well.
Ditto.

Have you tried uninstalling the app "Albums" for example with Titanium? Try that after backing it up and see if it holds after a reboot. That's the issue I'm having, I'm only able to freeze those xperia system apps. :(
I haven't tested that, but will. I initially had problems using TB at all because I had the removable sdcard as my backup location and TB couldn't write to it. I changed that to internal sdcard, and at least now, it's working.

Edit: was able to delete "Album" app through a reboot. Then restored from TB.
 
Last edited:

Sptz

Senior Member
Jun 25, 2012
65
4
So you actually can delete it. Did it disappear from the drawer etc and stayed crossed in TB? This is annoying so much argh : l
 

phanmo

Senior Member
Oct 2, 2010
98
11
Nantes, France
If you can mount system as rw through terminal, why not just run the script at boot? There are a bunch of terminal apps that can automatically run scripts.

Sent from my D5803 using XDA Free mobile app
 

Sptz

Senior Member
Jun 25, 2012
65
4
If you can mount system as rw through terminal, why not just run the script at boot? There are a bunch of terminal apps that can automatically run scripts.

Sent from my D5803 using XDA Free mobile app

I just tried to mount it using this command: mount -o remount,rw /system

It comes back saying "operation not permitted". Any ideas?
 

alxtorrentazos

Senior Member
Jun 11, 2013
66
11
Montevideo
CAL7, "SDFix: KitKat Writable MicroSD" is your friend (Google Play Store )if you need to write the TB files into an external microSD card. Before you run it, just do the "SU, MOUNT -O REMOUNT,RW /SYSTEM" trick on "Terminal Emulator for Android" :)

Phanmo, could you please provide a few steps guide about how to create a script that launches automatically when you turn the phone ON or when you restart it? I'm a completely noob.
TIA
Alx
 

bilboa1

Inactive Recognized Developer
Aug 16, 2010
1,289
683
Thank you guys... there's no need of my test anymore :good: and no need to correct my tutorial in "stock firmware" thread as well :victory:

Well, so if you uncheck "data" before downgrading and then before upgrading, the data partition is safe and the only issues you get are the errors I quoted above, which get fixed when you revert back to .77 at the end of the process


@bilboa1 If you change idea in the future, you can insert a note inside the OP that points to this post, in order to help who needs to keep data.
People keep asking the same questions over and over again ;)
Added as faq item, best of both worlds!
 
  • Like
Reactions: istux

Top Liked Posts

  • There are no posts matching your filters.
  • 277
    By almost popular demand, making this a thread ;)

    This is a how-to root, install recovery, backup drm keys, etc. from scratch in a single thread since finding all threads can be daunting. That's basically all the things you generally want to do when you root the phone (WITHOUT UNLOCKING THE BOOTLOADER).

    TL;DR - overview
    If you know what you're doing, you really just need to read this part of the post. If you're unsure, read the step-by-step instead.
    If you're running Android 6.0.1 MM with firmware .291 (and probably any other future firmware), want to root without unlocking the bootloader more quickly than the method below refer to this post: http://forum.xda-developers.com/z3-compact/general/recovery-root-mm-575-lb-t3418714 (get all 3 zips, rename the kernel zips to .ftf, flash kernel575.ftf with flashtool - reboot - enable dev mode, run bat script - reboot in recovery and flash supersu.zip - flash kernel291.ftf, reboot, done (for future versions you'll want to only flash the kernel from sony's ftf after rooting)


    See the FAQ at the bottom in case you need additional help, about mounting /system read-write, fixing the sdcard issues, etc. These are not directly related to the rooting process, but you most likely want to perform these tasks anyway.

    Step by step instructions

    Read instructions carefully, there's many steps, making this slightly complex.

    1. Ensure you backed up everything you need (files/apps/pictures/etc) first, these will be lost! - YOUR PHONE WILL BE WIPED.
      -- FW DOWNGRADE AND INSTALL WITH FLASHTOOL --
    2. Downgrade fw to 23.0.A.2.93 (Device D5803) or anything prior to 23.0.1.A.5.77 (december fw)
    3. Global:https://mega.nz/#F!wdEG3aiD!Ej2S4hcMKGPgnmGudvAegg (look for 23.0.A.2.93) (or see http://forum.xda-developers.com/showpost.php?p=66275977&postcount=2030 for more links if this one no longer works)
    4. Get and install Flashtool at http://www.flashtool.net/index.php
    5. Move the fw into the C:/Flashtool/firmwares directory
    6. Open Flashtool, click on the lightning symbol ("flash device"), select "Flashmode" and click on "OK"
    7. Just select the name of the fw you downloaded and click on "Flash"
    8. Wait for a window to pop up (it may take a few minutes, be patient)
    9. Now everything is ready: turn off your phone
    10. Push the volume DOWN button, connect the USB cable to your PC while still pushing the volume DOWN button
    11. Once the flashing process has started, release the volume button
    12. ) Do not disconnect the USB cable, wait until flash completes (flashtool will indicate when you can unplug).
      -- ROOTING W/ EXPLOIT --
    13. Enable USB debugging on the phone (Settings => About phone => Click 7 times on Android Build to unlock developer options)
    14. Allow mock locations (Settings => Developer Settings)
    15. Ensure you have adb drivers installed (http://support.sonymobile.com/gb/tools/pc-companion/ don't use it to update
    16. Download rooting tool (http://forum.xda-developers.com/devdb/project/dl/?id=10766&task=get) or latest from http://forum.xda-developers.com/crossdevice-dev/sony/giefroot-rooting-tool-cve-2014-4322-t3011598)
    17. Unzip the rooting tool
    18. Connect phone to your computer
    19. Put phone in airplane mode
    20. Run install.bat from the rooting tool (allow USB debugging when asked on the phone every time, also allow root prompt) and follow instructions from the tool
    21. You should be rooted now, if you get an error "Device not rooted" trying running the tool once more
      -- Backup DRM keys/TA Partition --
    22. Get backup ta tool from https://github.com/DevShaft/Backup-TA/releases
    23. Unzip it!
    24. Ensure phone is still connected (or reconnect it)
    25. Run Backup-TA.bat
    26. Read the information and follow the instructions given by the tool.
      -- Install latest firwmare with root, DRM keys, recovery --
      Alternative 1: pre-made pre-rooted image (for fast internet, slow pc ;)Alternative 2, for newer fw for example - build your own pre-rooted image (fast pc, slower internet;):
    27. Get PRFC from http://forum.xda-developers.com/crossdevice-dev/sony/tool-prfcreator-easily-create-pre-t2859904
    28. Get latest fw from http://forum.xda-developers.com/z3-compact/general/list-stock-firmwares-d5803-d5833-t2906706
    29. Get latest SuperSU zip http://download.chainfire.eu/supersu
    30. Get DualRecovery zip (the flashable zip, not the installer one) from http://nut.xperia-files.com/ you want Z3C-lockeddualrecoveryX.Y.Z-RELEASE.flashable.zip
    31. Start PRFC and add the 3 zip (FTF file is the fw, SuperSU and Recovery)
    32. Click "create" - this will take a while
    33. Copy resulting "pre-rooted" fw to /sdcard0 on your phone (it means copy flashable.zip from the PRFC directory to the "internal storage" directory of the phone)
    34. Get Dual Recovery installer this time, from http://nut.xperia-files.com/ you want Z3C-lockeddualrecoveryX.Y.Z-RELEASE.installer.zip notice how thats 'installer' this time, not the same file as in 30!
    35. Unzip it
    36. start install.bat and follow instructions (hit 1 (allow adb/root on the phone as needed)
    37. You should be in recovery automatically now. (if not, reboot and when the LED change colors push volume UP repeatedly)
    38. Flash the pre-rooted fw (flashable.zip) from the recovery (touch "install zip", select /storage/sdcard1/flashable.zip then confirm install) on the phone, then power off the phone (DO NOT REBOOT)
    39. To power off, go into the "power options" and hit "power off" (dont do "reboot in flashmode" DO power off)
    40. Unplug USB (yes this is required, DO IT)
    41. Open Flashtool and select the non-pre-rooted fw (this is 23.5.A.1.291 for example), but DESELECT system: in "EXCLUDE" make sure you check the checkbox next to "SYSTEM", flash it.
    42. press volume DOWN and plug USB cable while keeping volume DOWN pressed, when flashing starts, stop pressing the volume button
    43. After flash is done and when flashtool tells you to, remove USB cable and start the phone
    44. Congrats and enjoy, you made it to the end! you now have latest + recovery + root and backups of your DRM keys! (and of course all DRM functions enabled)

    FAQ
    - Some root apps don't work, because /system can't be remounted rw, what's up with that?

    - I unlocked my boot loader, or lost my DRM keys some other way AFTER backing up as per above procedure. How to restore?
    • plug USB back in
    • re-enable usb debugging on the phone (Settings => About phone => Click 7 times on Android Build to unlock developer options)
    • Start backup TA again but this time hit restore

    - I messed somewhere, phone doesn't boot or work properly, what to do!
    • unplug USB
    • if phone is on, long press the power button+volume UP until the phone turns off
    • go back to step 1 of the how to, follow the how to! Mainly - the howto makes you setup flashtool again, then boot the phone in flash mode with volume key and plugging in the USB cable.

    - I forgot to backup DRM keys (backup ta program) but I never unlocked the bootloader, is it bad?
    • nope you're fine, just back them up now

    - I really lost my DRM keys, can I recover them?

    - I don't want to wipe my phone!
    • Uncheck "data" before downgrading and then before upgrading in flashtool. You will get some errors when downgrading, which will go away when you revert back to .77 at the end of the process
    • This is at your own risk, data still risk being deleted if something goes wrong
    • Depending on the apps, etc. you have, there is a chance that some app would not work properly at the end of the process without a full wipe. If that's the case, you might need to go in settings>applications and "delete data" for that app.

    - Some apps can't write to the sdcard!

    - I don't have SuperSu on marshmallow+ ?!
    • It just didnt install properly into /system. That's ok. Just install it from the play store - you do have the su binary installed in /system so this will work

    - Does this work on my SO-02G (Xperia Z3C Docomo NTT version) ?

    - Does this work with lollipop (Android 5.0)?
    - Does this work with Marshmallow (Android 6.0)?
    - Will this work with Nougat (Android 7.0)?
    - Will this always work?! (yes probably)
    • Yes.
    • If when doing the final reboot its stuck on the loading screen the first time, reboot again a last additional time with power + volume UP.

    People who did the hard work/references thanks to them:
    @istux (fw list, flashtool how to http://forum.xda-developers.com/z3-compact/general/list-stock-firmwares-d5803-d5833-t2906706)
    @xzx0O0 (root exploit: http://forum.xda-developers.com/crossdevice-dev/sony/giefroot-rooting-tool-cve-2014-4322-t3011598)
    @DevShaft (backup ta http://forum.xda-developers.com/showthread.php?t=2292598)
    @serajr (install .77 fw http://forum.xda-developers.com/showpost.php?p=58395100&postcount=71)
    dosomder (kmod for sony's RIC) https://github.com/dosomder/SonyRICDefeat
    9
    Thanks to the OP and all the devs who made this possible.

    I was a bit confused trying to figure out what we're doing here, so I want to add some explanation for others who might share my concerns. I just hate doing "step-by-step" procedures without a clear understanding of what we're doing. Besides, it's easier to work your way out of problems if instead of just following some recipe you're actually aware of what you're doing.

    1. This apparently relies on a root exploit that was closed in 23.0.1.A.5.77. So the procedure begins with flashing an older build onto the phone, using Flashtool. The OP provides links to 23.0.1.A.2.93.

    2. As a couple of other posters have observed, this is perfectly viable without doing a wipe. Of course, you'd be crazy not to back up your data anyway, but as long as you uncheck "DATA" in the Wipe checkboxes each time you go into Flashtool you can do this without losing all your personalizations. In the intermediate steps though, your phone will bug you with error messages about various processes that are constantly crashing due to the version mismatches. The Contacts app is hit particularly hard by this, and it may be best to just save your contact data off and blow it away before beginning, and then resync/restore it onto the device after everything is done. I didn't go that far myself, but it might have been simpler to clean up.

    3. There are separate steps to download Sony's PC Companion app (necessary for its ADB drivers), the script to root the phone, and a script to backup your TA partition. Then starting around step 26 the process moves on to installing a rooted 23.0.1.A.5.77 build which requires a few more downloads, depending on how you do it.

    The idea is to flash your phone back to 23.0.1.A.2.93. Then you expose the vulnerability by putting the phone in airplane mode and allowing mock locations. You run a script that roots the older ROM and then reboots the phone. At this point you have a rooted 23.0.1.A.2.93 build. Then you can optionally (recommended; it's not hard) backup your TA. The script puts the backup on your hard drive -- nice touch.

    3. Now comes the trickiest part to understand -- I'll explain why in a moment. The authors can root 23.0.1.A.2.93, but they know you want to be on 23.0.1.A.5.77. You can't just flash the stock 23.0.1.A.5.77 FTF or you'd lose root, so in one step they apply a TWRP custom recovery by using a script (very neat trick, considering the bootloader is still locked!), followed by rebooting the phone into recovery where you have to flash an image of the 23.0.1.A.5.77 system partition with SuperSU already applied. This gives you a 23.0.1.A.5.77 system partition, with everything else from 23.0.1.A.2.93. So afterwards you use Flashtool to flash the rest of stock 23.0.1.A.5.77 FTF onto the phone, with the stock system partition excluded by use of a setting in Flashtool.

    There are a few things that make this part tricky. First, the instructions are a little redundant. You can either download the image file in step 26 (this is a prebuilt image with the 23.0.1.A.5.77 system partition and SuperSU and TWRP) and then you can skip directly to step 33 (very simple), or you can skip step 26 and build your own image by doing everything in steps 27 through 32. The way I read it, you want to do step 26 unless either the zip is not available for some reason, or perhaps if your phone is not a D5803 (since the prebuilt image is apparently a D5803 version).

    The second thing that makes this part tricky is that due to a bug in the script you have to manually enter a mount command. I don't know if the command works as typed, but it's definitely got a typo in it. As another poster observed, the correct syntax is:
    mount -o remount,rw /system

    The third thing that makes it tricky is that you have to cd down into a subfolder to run the mount command, and then cd back up into the parent directory to get the install.bat used in the next step.

    And the fourth thing that makes this part tricky is that after installing the custom zip you have to shut off the phone without rebooting. As the OP admits, this is not intuitive. I went to the home screen of TWRP, and in the Reboot section there's an option for powering off the device. Obviously you don't want to randomly tap on everything you see that says "Reboot" since what you're looking for is to shut off the phone without rebooting it. If you do reboot the phone here you'll be bringing up a 23.0.1.A.5.77 system partition with everything else from 23.0.1.A.2.93. Not sure how much damage that does to the overall effort, but it's not gonna work real well. At best, all the error messages would make it harder to turn the phone back off to get back to the Flashtool step.

    4. After you shut off the phone you just go back into Flashtool and set it up to flash the stock 23.0.1.A.5.77 FTF. It's critical that you use the Exclude option to skip the system partition, or it will reinstall an unrooted stock image. Also, if you've been trying to keep your data, then remember to uncheck Data in the Wipe checkboxes again. This step goes very quickly, since the big system partition is excluded.

    Again, this is not a critique in any way; the devs behind this are all gods as far as I'm concerned. I just want to make it easier for others to do this, and I hope this reply helps. I know I wish I'd had it explained to me like this before I began it.

    Okay, one minor critique. The OP says to hold the up volume to get into recovery. On my device, anyway, you have to use the down volume. Timing seems a little tricky too.
    4
    Not even angry with you..
    Your experience is welcome and you're probably right. ;)
    The problem is that we need some more tests.
    I will report.

    All I can say is that I really hope that somebody proves me wrong! :)

    I'm very interested in this, because I take care of this list/tutorial: http://forum.xda-developers.com/z3-compact/general/list-stock-firmwares-d5803-d5833-t2906706

    If on z3c the downgrading process always wipes the data partition, I will correct my guide.
    I've been taking care of a similar thread for Xperia T for ONE year and nobody said he had a problem with this method. So, I'm sure it's good for older xperia.

    Now, it's possible that our beloved z3c has a different behaviour with Flashtool.
    Ok.
    The problem is that if you say to someone to make a copy of his/her stuff and make a test and then report the feedback, you have a chance of 10% to get an answer (if you're lucky).
    Nobody wants to test, never. We are always the same few people that lock, unlock, relock the bootloader, flash, downgrade, upgrade, wipe, make backup and REPORT.
    And anyways, only one experience is never reliable.
    So bad, it really makes me angry. :(

    Nevertheless, I will test by myself and report.
    @dillalade I'm not angry with you, I'm sure you need not to lose your data...

    Strange yet Inconclusive.

    We need others to chime in on there experience if they managed to preserve there data partition post downgrade.

    Though I suspect not given Charlie's experience.


    I didn't wipe doing downgrade and upgrade and i haven't got any big problem. I just had a little problem downgrading to .98 , had force closes of android.process.media and android.process.acore , i solved it cancelling the data of applications: Contacts, Contacts storage (not sure how it's translated) and for the process.media just deleted data of Media Storage. Other than these the phone is like always
    Upgrade didn't present also problems unchecking the wipes.

    You can do all this without lose your data , don't worry.
    4
    If you're having trouble with step 34 opening a command prompt in the files folder, try pressing shift and right click on or in the "files" folder, you should see "Open command window here"

    Unrelated: what's the purpose of steps 40-43 (reflashing non pre-rooted FW)?
    4
    How do i know if my Phone has a locked or unlocked bootloader?
    When i call the service nr (*#*#7378423#*#*) and check rooting status it says "unlock bootloader allowed: Yes"..

    Im New to the z3c community,
    comming from GSII

    Sent from my D5803 using XDA Free mobile app
    Bootloader unlock allowed: Yes = the bootloader is locked, but you can unlock it if you will.
    Bootloader unlock: Yes = the bootloader is unlocked.
    Bootloader unlock allowed: No = the bootloader is locked and you can't unlock it.