[ROOT][Kernel][TWRP] repack of the stock kernel with dm-verity and SONY RIC off

[floporin]

i really need help. were do i get my boot.img from. i got the elf but im a little lost and when i do try and set it out the tool says
detected android version 8.0.0 and just sits there for 3 hours before i close it down. would running it on linux work better?

hi,
i got the same hang, just getting:

Rootkernel V5.23

- Unpacking kernel
Found android boot image
Kernel version: 3.10.84-g0befc21
- Detected vendor: somc (Sony), device: suzuran (Xperia Z5 compact), variant: row
- Unpacking initramfs
- Detected platform: 64-bit

but i unstuck it by ctr+c in the windows command prompt. I think the first part of the tool, "Sony RIC is enabled. Disable?", gets stuck and is unable to pass to next steps.
After that the next steps of the script went fine.

 

[fauntelroy]

i accidentally delete my ta backup, now i only have dk.ftf.
can i extract that to get my ta backup img again?

 

[Berni-0815]

i accidentally delete my ta backup, now i only have dk.ftf.
can i extract that to get my ta backup img again?

I don't think so! My ta backup image file has about 2mb, my dk.ftf only about 570b...

 

[fauntelroy]

I don't think so! My ta backup image file has about 2mb, my dk.ftf only about 570b...

now i have working device with dk.ftf applied,can i run backup ta again?or is it just useless?

 

[Berni-0815]

now i have working device with dk.ftf applied,can i run backup ta again?or is it just useless?

In my eyes useless. Where should any information comes from only 570b? I think this dk.ftf flashes just some byte that fakes an original ta partition (will say: Those informations the original ta partition had contained to let all things work as expected).

Surely you can extract the ta partition from your device again. But if it will contain the original information? Can't believe it...

 

[levone1]

Xperia X Performance, XZ and XZs ONLY (Xperia X and Xperia X Compact must skip this):
Android Oreo ramdisk patching needs some additional files, and they must be copied from Oreo /system into the rootkernel's filesystem_files folder, prior to run the script, and they are:

/system/vendor/etc/[B][COLOR="Blue"]fstab.qcom[/COLOR][/B]
/system/vendor/etc/init/hw/[B][COLOR="blue"]init.qcom.rc[/COLOR][/B]
/system/vendor/etc/init/hw/[B][COLOR="blue"]init.target.rc[/COLOR][/B]

(you can pull these files through adb, or even converting system.sin to system.ext4 and take them out from there - just copy them, and DO NOT touch its contents)

As always, TRY IT AT YOUR OWN RISK!

Credits:
@tobias.waldvogel ofc
@sToRm// for additional ramdisk files hint (man, you're insane!)

Enjoy it!

Hi Serajr - quick question... Is Rootkernel currently working for XZ1C or XZ2C, (pie)? I don't see any root threads in those forums... Thanks

 

[serajr]

Hi Serajr - quick question... Is Rootkernel currently working for XZ1C or XZ2C, (pie)? I don't see any root threads in those forums... Thanks

Hi bro. No, it's not (in fact, it is not necessary on these devices).
XZ2/C need only twrp and magisk to get root (see post #3). But drmfix doesn't work on android pie yet (camera still works with some few hacks).
XZ1/C have an TA backup root exploit tool, so you don't need to worry about drm stuff, and also, like XZ2/C, only trwp and magisk are needed to get root!

 

[Saint Arnoulf]

Hi, I managed to backup my TA, when I want to create DK.ftf, i run flash_dk.cmd TA.img Dk.ftf and got error Could not find device key in TA.img (Unit 0x1046B). Please help, thanks in advance

I have the same problem and I can't describe it any better. I have a neat TA.img from a Nandroid back-up made by TWRP. I also get the message that flash_dk can't find a device key of the Digital Rights Management in it. Very confusing...

rootkernel already used the same TA.img for Munjeni's TA PoC solution. Hence a lot isn't clear to me about flash_dk:
· Why is this extra ftf necessary when rootkernel already used TA.img for the boot.img?
· Why can't flash_dk find a device key in a neat TA.img?
· To which partition should one flash DK.ftf if flash_dk would succesfully find a device key?

Another thing that isn't clear to me is why nobody responded to the clear question of butilities since he posted it on the 11th of April 2016? We're already three years later now and we still don't know what to do when this surprising problem occurs. The problem is surprising because we do a Nandroid back-up to save device keys and DRM.

Happy to read an answer,

kind regards,

Hr. F.J. Roebersen.

---------- Post added at 11:14 PM ---------- Previous post was at 10:42 PM ----------

I have the same problem and I can't describe it any better. I have a neat TA.img from a Nandroid back-up made by TWRP. I also get the message that flash_dk can't find a device key of the Digital Rights Management in it. Very confusing...

rootkernel already used the same TA.img for Munjeni's TA PoC solution. Hence a lot isn't clear to me about flash_dk:
· Why is this extra ftf necessary when rootkernel already used TA.img for the boot.img?
· Why can't flash_dk find a device key in a neat TA.img?
· To which partition should one flash DK.ftf if flash_dk would succesfully find a device key?

Another thing that isn't clear to me is why nobody responded to the clear question of butilities since he posted it on the 11th of April 2016? We're already three years later now and we still don't know what to do when this surprising problem occurs. The problem is surprising because we do a Nandroid back-up to save device keys and DRM.

Happy to read an answer,

kind regards,

Hr. F.J. Roebersen.

In flash_dk.sh I read the following:

ui_print "- Extracting device key"
DK=$("$BOOTIMG" readta -i $TA_IMAGE -u 0x1046b -h)
if [ $? -ne 0 ]; then
ui_print "Could not find device key in $TA_IMAGE (Unit 0x1046B)"
exit 1
fi

Hence I conclude that there is no more unit 0x1046b in the back-up of the TA.img of my Sony F8331 Xperia XZ (Kagura). It seems to me that the back-up has a very regular size of 2 MB. The back-up of the TA.img of my Sony D6603 Xperia Z3 (Leo) also had a size of 2 MB.

Because I would like to restore the device key when I root my smartphone I would like to know how to solve this issue.

Kind regards,

Hr. F.J. Roebersen.

 

[shoey63]

@Saint Arnoulf
If the key is missing, that means you are using a backup made AFTER unlocking the bootloader which wipes the key in the unlocking process.
Clearly this is the case with a nandroid backup. Any Sony phone after Z3 can't have TWRP installed without unlocking the bootloader first.
Munjeni's tool works whether the key is present or not, although drm functions obviously won't work if made with a TA.img where keys are wiped.

 

[Saint Arnoulf]

Hi, I managed to backup my TA, when I want to create DK.ftf, i run flash_dk.cmd TA.img Dk.ftf and got error Could not find device key in TA.img (Unit 0x1046B). Please help, thanks in advance

In flash_dk.sh I read this:

ui_print "- Extracting device key"
DK=$("$BOOTIMG" readta -i $TA_IMAGE -u 0x1046b -h)
if [ $? -ne 0 ]; then
ui_print "Could not find device key in $TA_IMAGE (Unit 0x1046B)"
exit 1
fi

Now it seems to me that there is no unit 0x1046b in a TA.img when the TA.img is made by TWRP instead of iovyroot. Hence I need another solution to extract my device key from a neat TA.img with a size of 2 MB. I lack the expertise to make such an utility and do not know why this problem exists with models like Sony Xperia Z5 and Sony Xperia XZ.

It also isn't clear to me why rootkernel also has to read TA.img to produce a boot image. Why flash the information from TA.img two times, once in boot.img and once in DK.ftf?

And when will some drmfix pick up that DK.ftf is installed? Must I force some kind of drmfix?

Please help me out because currently I'm quite stuck without a device key in a DK.ftf when I try to repack my stock kernel with dm-verity and SONY RIC off. It seems to me that I need this device key when I want to use my smartphone optimally after gaining root privileges.

Thanks in advance,

kind regards,

Hr. F.J. Roebersen.

 

[Klaus N.]

@Saint Arnoulf

As @shoey63 already said, it's not possible to install TWRP on a locked device later than the Z3. Means, you've unlocked it before running the exploit (iovy), and therefore the drm-keys of your device are lost forever.
So the only solution for you is to use the modified rootkernel tool @serajr. Just follow the steps there exactly, but when asked in the prodedure, say "yes (Y)" to drm fix.

 

[djembuuut]

can i apply it on x compact japan version? i on nougat wit unlockbootloader, but i forgot to back up ta partition before.

 

[yannis_gr]

Dear serajr , tobias.waldvogel, thank for your work and rootkernel!

I wonder, is it possible to add Cpu Voltage Control to your kernel?

Thank you!

 

[zputnyq]

Hi guys,
Sorry if this question has been asked before.
I have read that it's possible to root xperia m4 stock kernel with this tool.
My question is, can I skip patching supersu to kernel step, since I wanna flash magisk ?

Edit: does this tool work on win xp ?

 

[IceDreams]

how to fix this problem

Rootkernel V5.23 (UNOFFICIAL 2.5)

- Unpacking kernel
Found elf boot image
Kernel version: 3.10.84-perf-g51b663cc723-04742-g5bcfaca9e61
Found appended DTB
rootkernel.sh: line 1: suzu: not found
- Detected vendor: somc (Sony), device: suzu, variant: row
- Unpacking initramfs
- Detected platform: 64-bit
- Detected Android version: 8.0.0
- Found fstab.qcom (no additional files required)!
- dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] Y
Patching fstab in dtb to disable dm-verity
- Sony RIC is enabled. Disable? [Y/n] Y
Disabling Sony RIC
- force-encrypt is enabled. Disable? (Say yes if you decrypt /data) [Y/n] Y
Disabling force-encrypt
- Install DRM fix? [Y/n] Y
1. DRM fix preload line added successfully!
2. DRM libraries still need to be flashed manually on TWRP recovery before 1st boot!!
System mode, flash: DRM-fix_System_Mode.zip
- All done! Continue? [Y/n] Y
- Creating new initramfs
- Creating boot image
- Cleaning up
Done

 

[YasuHamed]

how to fix this problem

for z3+ use the older version of script
scrip 5.25 was intented for OREO on X Xz Xzs Xzc Xp xc etc

 

[IceDreams]

for z3+ use the older version of script
scrip 5.25 was intented for OREO on X Xz Xzs Xzc Xp xc etc

that's just the name of the folder sir, the kernel that I use is Suzu Oreo 8.0 34.4.A.2.118

 

[ToastedToast]

I am trying to use this on a Xperia 10, and the program hangs after detecting the platform as 64-bit

 

[trunghxf]

is it normal for me when everytime i create a kernel using the same choices, MD5 of the output kernel keep changing?

 

[Klaus N.]

is it normal for me when everytime i create a kernel using the same choices, MD5 of the output kernel keep changing?

How about using the search function? If you you had, you would have found the answer to your question inside this thread