[Q&A][Root]Rooting with Locked Bootloader - NO OTA Method

[Miche1asso]

After much tampering I managed to identify a procedure to root our phone(s) leaving the Stock ROM intact (addition of rooting apart, sure). This will remove the requirement to do an OTA update, which in the future could remove the rooting if any update will be available (Lollipop maybe?).

The process is very straightforward and has been tested in both OS X and Windows. Here it follows:

THIS SHOULD WORK FOR ALL XPERIA PHONES WITH KITKAT INSTALLED WHICH HAD A PREVIOUS ROM VULNERABLE TO TOWELROOT.
If your phone started with KitKat 4.4.4 or later and you want to keep the locked bootloader you may be doomed.​

GENERAL GUIDELINES:

• Be sure to have the full FTF for the stock ROM you are currently running
• Flash only the kernel of a ROM for your phone vulnerable to the Towelroot exploit unchecking the wipe checkboxes
• Reboot the phone:
  The phone will bootloop, but it doesn't matter. The Linux kernel and adb are alive and thus the "Towelroot" vulnerability is exploitable by rootkitXperia
• Run rootkitXperia. After the rooting it should get stuck when trying to reboot the phone(*). Interrupt it with CTRL-C
• Flash back the kernel for the ROM in your phone
• Reboot the phone
• Manually run the command to have the RIC permanently disabled:
  

  adb shell "su -c /data/local/tmp/install_tool.sh"

(*) In some phones (Xperia Z?) rootkitXperia may not get stuck. If the phone reboots the rooting should be complete. Just flash back your original kernel and it should be done (untested).

The following section will explain in great detail every single step needed. It also includes all the links to the SW and procedures needed:

COMPREHENSIVE TUTORIAL:

PREPARATION:

• Have your phone updated to the last ROM
• Download Flashtool: link
• Download rootkitXperia: link
• Have adb installed: Suggested links: OSX/Linux - Windows
• - Windows only: Install the phone drivers (probably using Sony PC Companion. I dunno, I don't use that Windows junk )
• Enable the USB debugging: HowTo
• In Settings/Security enable "Unknown sources"
• Make it sure Flashtool/adb can connect to the phone: just try "adb shell" from the terminal.
• Download a Jelly Bean stock ROM for YOUR phone: link for D2303
  Otherwise for D2303 (but it is confirmed working with the M2 Aqua D2403 as well) you can use the attached FTF (kernel only)
• From Flashtool download the FTF of your latest ROM (Menu "Devices/Check Updates" at least in OS X). Be sure to use the same ID
• You may want to make a full backup using the Sony system app "Backup and restore" (or equivalent in other languages)

ROOTING:

• Launch Flashtool in your Mac/PC
• Power off the phone
• While holding the Volume Down key connect the phone to the Mac/PC via USB
• The phone top led should blink red and then green
• Flashtool should report that the phone is connected in flash mode
• Select the JB FTF of your choice (full RoM/kernel only).
  In OSX Flashtool is glitched. You may need to select an FTF and then move upward with the arrow keys
• Exclude all but the kernel. Uncheck the wipe checkboxes
• Proceed with the kernel flashing . The blu icon with a thunder
• After the flashing has terminated disconnect the phone from the USB
• Start the phone:
  This is the tricky part. Android now will bootloop. But we don't care, because the underlying Linux is well alive!! adb works and so it does the Linux kernel/OS.
  And that is all we need, because rootkitXperia exploits the Towelroot vulnerability but without the need of launching the graphical interface. Just hurry a bit because it may or may not last forever.
• Connect the phone via USB
• From the terminal cd into the rootkitXperia directory
• Launch the script: install.sh in OSX/Linux - install.bat in Windows
• When the script gets stuck at the phone reboot terminate it (CTRL-C)

At this point, with the phone still in bootloop, you may check if the rooting has been successful. Just type the command:

 adb shell "su -c id"

which should report

uid=0(root) gid=0(root) context=u:r:init:s0

If it doesn't something went wrong (it shouldn't).


DISABLE THE RIC (enable /system read/write):

• Disconnect the phone
• Power it off
• Hold the Volume Down key and connect it to the computer
• In Flashtool flash the kernel of your latest ROM.
  Like before exclude all but the kernel, no wipe needed
  Also there is an issue with 18.3.1.C.1.15 installed via PC Companion/Sony Bridge for Mac. One should flash (thus not excluding it) the "BOOTBUNDLE" as well as shown in this post
• Disconnect the phone from the USB and reboot it
• Connect the phone
• Manually run the command:
  

  adb shell "su -c /data/local/tmp/install_tool.sh"

• Reboot and enjoy your rooted phone!

What to do next:

• Press "Thanks!"
• Backup your TA partition: link for OS X
• Put a copy in your most favorite Cloud service (Dropbox/iCloud/Google Drive/Whatever). It's better be safe than sorry.
• Update SuperSU binary and apk
• Install adaway to get a rid of those annoying commercial
• Anything else you rooted your phone for!

Unrooting/Recovery

• You may need to use the OFF button near the SIM card slot if anything went wrong (like if you forgot to uncheck the wipe flags). That shuts down the phone. You would need a needle (or something very small) to push it. (**)
• Flash with Flashtool the kernel and system from the ROM you previously downloaded to keep your data - or -
• Rebuild the ROM with Sony Bridge For Mac/PC Companion

(**) Thanks to Vino Kulafu for the tip.

JB Kernel from the Xperia M2 D2303 FTF attached:
It's confirmed working with the following devices:

• Xperia M2 D2303
• Xperia M2 Aqua D2403

 

[Andrej732]

It's working

After much tampering I managed to identify a procedure to root our phone(s) leaving the Stock ROM intact (addition of rooting apart, sure). This will remove the requirement to do an OTA update, which in the future could remove the rooting if any update will be available (Lollipop maybe?).

Yap, I have just test it and everthing is working fine. I was using Windows. And i could also update su binary without any problem. Thank you for sharing us this method which reduce a lot of wasted time.

 

[Miche1asso]

Yap, I have just test it and everthing is working fine. I was using Windows. And i could also update su binary without any problem. Thank you for sharing us this method which reduce a lot of wasted time.

Thanks for confirming!

BTW did you use the attached kernel?

 

[Andrej732]

Thanks for confirming!

BTW did you use the attached kernel?

Yes, everything is fine.

 

[Vino Kulafu]

Many thanks for this!

Successfully rooted Generic Philippine D2303 4.4.4 KK firmware, with full R/W access using the above instructions.

However, I suggest that the above steps be updated for clarity. Happy rooting guys; this is a much more convenient way to root, albeit complicated.

This should be moved to General section or Android Development section so people can see this thread easily.

:good:

 

[Miche1asso]

However, I suggest that the above steps be updated for clarity. Happy rooting guys; this is a much more convenient way to root, albeit complicated.

Do you mean to make a short version? I mean, as it is now it's a full guide, from A to Z. I was thinking about making a section with the 4-5 steps for the skilled users. Too bad I didn't think about reserving the second post. Is there any way to have it added? Otherwise I'll put it in the bottom with a reference on the top.

EDIT: Added a generic procedure on the top.

This should be moved to General section or Android Development section so people can see this thread easily.

:good:

yeah, I was thinking about making a thread there pointing to this one as well. The process is quite generic, although I think in the Xperia Z rootkitXperia does reboot the phone disabling the RIC.

 

[Vino Kulafu]

No need to make a short version, my friend; it's good enough. Here are some suggestions though:

1. I think the portion about holding the up volume key is wrong since it boots the phone into fastboot mode while we need to go to flash mode.
2. Kindly stress the importance of unchecking the wipe checkboxes in flashmode. If not unchecked, you could end up with a bootlooping phone wherein the root kit will not function since the adb debug setting has been reset, which leads to #3.
3. Make use of the OFF button near the sim card slot when faced with the situation described in #2. Just flash back the original kernel and repeat.

My experience was this:
I didn't wait for reboot; I cancelled the procedure when it hung in the reboot part. Then I shut the phone off using the OFF button near the sim card slot, then flashed back stock KK kernel only. Afterwards, I proceeded to the disabling RIC then reboot again. Presto, all is well.

:laugh:

 

[Miche1asso]

No need to make a short version, my friend; it's good enough. Here are some suggestions though:

1. I think the portion about holding the up volume key is wrong since it boots the phone into fastboot mode while we need to go to flash mode.
2. Kindly stress the importance of unchecking the wipe checkboxes in flashmode. If not unchecked, you could end up with a bootlooping phone wherein the root kit will not function since the adb debug setting has been reset, which leads to #3.
3. Make use of the OFF button near the sim card slot when faced with the situation described in #2. Just flash back the original kernel and repeat.

My experience was this:
I didn't wait for reboot; I cancelled the procedure when it hung in the reboot part. Then I shut the phone off using the OFF button near the sim card slot, then flashed back stock KK kernel only. Afterwards, I proceeded to the disabling RIC then reboot again. Presto, all is well.

:laugh:

Ok, let me see:
1. Crap. I always get confused. It is Volume down, then, I just checked. I'll fix it.
2. Oh, I didn't think it could get so bad. I just unchecked the boxes to avoid to lose my data.. Well, yes, thinking about that it makes sense now.
3. I'll add it. Thanks.

 

[Dzepar]

As i know, with Locked bootloader even if you hold volume up (+ button) it will reject the connection with phone. Otherwise great guide and you should contact someone of moderators to move this in General section.

Thanks


Xperia M2 D2303 on K.K. 4.4.4

 

[i_1]

how the Xperia M2 Aqua (D2403) ?

Is there a solution root for D2403 with locked bootloader ?

sorry bad my language

 

[Miche1asso]

As i know, with Locked bootloader even if you hold volume up (+ button) it will reject the connection with phone. Otherwise great guide and you should contact someone of moderators to move this in General section.

Thanks

Xperia M2 D2303 on K.K. 4.4.4

No, no. One just needs to hold Volume Down. WIth the locked bootloader we can flash all FTF we like as long as they are from Sony.

I also made a new thread in the general section just with the "General Guidelines" also pointing to this one. But thanks.

Actually it made the portal!

Is there a solution root for D2403 with locked bootloader ?

sorry bad my language

If it had a Jelly Bean ROM just download the FTF (don't ask me from where) and follow this guide.

 

[i_1]

sorry .. no I do not understand

after successful with rootkitxperia , so need to flash back stock kernel before?

 

[Vino Kulafu]

Yes, you need flash back stock KK kernel. After doing that, the phone should boot properly. Then you can proceed to disabling the RIC module steps.

 

[i_1]

Why is this?

anyone can help ?

 

[i_1]

sorry

anyone can help ?

sorry I'm not as thorough with his files ...
now xperia M2 Aqua (D2403) has been rooting with locked bootloader on KitKat 4.4.4


Thank you Miche1asso with this awesome work ...:good::good::good:
Thank you also for Kulafu Vino has helped me with explanation...:good::good::good:

 

[Postiga 41]

sorry I'm not as thorough with his files ...
now xperia M2 Aqua (D2403) has been rooting with locked bootloader on KitKat 4.4.4


Thank you Miche1asso with this awesome work ...:good::good::good:
Thank you also for Kulafu Vino has helped me with explanation...:good::good::good:

Help me please i have same phone like you i dont have kernel but have the firmware for 2403

 

[Miche1asso]

sorry I'm not as thorough with his files ...
now xperia M2 Aqua (D2403) has been rooting with locked bootloader on KitKat 4.4.4

Thank you Miche1asso with this awesome work ...:good::good::good:
Thank you also for Kulafu Vino has helped me with explanation...:good::good::good:

You're welcome!

So, let me understand: did you flash my attached JB kernel for the M2 D2303 in the M2 Aqua D2403? I'd like this to be confirmed so in the case I will add it to the guide.

 

[i_1]

You're welcome!

So, let me understand: did you flash my attached JB kernel for the M2 D2303 in the M2 Aqua D2403? I'd like this to be confirmed so in the case I will add it to the guide.

Yes ... I'm using your D2303 JB kernel

---------- Post added at 01:20 AM ---------- Previous post was at 01:09 AM ----------

Help me please i have same phone like you i dont have kernel but have the firmware for 2403

Just wait for the later addition of tutorials from Miche1asso

 

[Miche1asso]

Help me please i have same phone like you i dont have kernel but have the firmware for 2403

The kernel I attached in the main post works for the D2403 as well. I updated the guide confirming it. Download it and follow the instruction step by step.

 

[umeshxda]

After flashing latest kernel , phone just shows sony then blank screen...but adb can detect the device...
any fix??