[ROOT][Kernel][TWRP] repack of the stock kernel with dm-verity and SONY RIC off

Search This thread
By:
Advanced…
langeveld024

langeveld024

Senior Member
Jun 7, 2012
1,772
824
Razuddin said:
Guys im running stock 32.0.A.6.200 and want to unlock my bootloader shortly. After ive unlocked my bootloader, can i flash v2 of this zip via fastboot? am i reading correctly and thinking that this will leave me with this kernel and TWRP and also be rooted?
Click to expand...
Click to collapse

No, this zip package is meant to flash from recovery. It unpacks and modifies your current stock kernel.
You can fastboot flash recovery.img first and then flash this or just flash andro-kernel followed by the Drm restore zip from tobias's other thread.
BTW for root you should flash supersu from recovery (source: http://download.chainfire.eu/supersu-beta) and for working busybox (you gonna need that too) install busybox installer from playstore and let it install once u got root.
 
  • Like
Reactions: Razuddin
T

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
tobias.waldvogel said:
Sure, I will publish it when I'm back next week.
Click to expand...
Click to collapse
This is the source for unpackelf. I am reorgnizing the source in order to create a multicall binary with all tools for unpacking/creating kernel images and initfs, which compiles for Windows/Android/Linux.
The next version of the rootkernel tool will be available for running in recovery or on Windows .

Once it is finished I will publish the whole source.
 

Attachments

  • unpackelf.zip
    2.4 KB · Views: 153
  • Like
Reactions: langeveld024, ZizuK, uripiruli and 2 others
C

celderic

Senior Member
Dec 1, 2010
1,140
519
tobias.waldvogel said:
V3 supports now 6.0 ;)
Click to expand...
Click to collapse
Doesn't reach the bootanimation, bootloops.

Seems to work, can boot into recovery although the orange led doesn't turn off after entering recovery like previous versions.

Here, hope this helps. boot.img is the original, and bootnew.img is the output file.

https://mega.nz/#!DUcl0JSQ!gguy0AEN5U2PneRVnFR4TPA3Qd0MIn2fvqn6OMYm-Ss

Edit-
I should add that my system partition has been modified, I assume dm verity was disabled correctly? I've not had time to check it yet, just uploaded it quickly for you.

Sent from my E6653 using Tapatalk
 
Last edited:
T

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
blakwhite said:
Thanks but test fails:
FAILED (remote: dtb not found)
Click to expand...
Click to collapse

I think you missed a few steps. You have sent me the kernel.sin. Before you can use my tool you need to extract the boot image from the .sin file. You can do this with flashtool as described:
In flashtool use the menu entry Tools->Sin Editor and then select your kernel.sin. After using the "Extract data" button you should end up with a file kernel.elf. This file can be uses with my tool.
So afterwards run e.g.
Code: 
rootkernel kernel.elf newkernel.img
and then try to run it with fastboot boot newkernel.img

I just did these steps with your kernel.sin and it worked perfectly well.

Cheers,
Tobias
 
  • Like
Reactions: Csihi
T

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
celderic said:
Doesn't reach the bootanimation, bootloops.

Seems to work, can boot into recovery although the orange led doesn't turn off after entering recovery like previous versions.

Here, hope this helps. boot.img is the original, and bootnew.img is the output file.

https://mega.nz/#!DUcl0JSQ!gguy0AEN5U2PneRVnFR4TPA3Qd0MIn2fvqn6OMYm-Ss

Edit-
I should add that my system partition has been modified, I assume dm verity was disabled correctly? I've not had time to check it yet, just uploaded it quickly for you.

Sent from my E6653 using Tapatalk
Click to expand...
Click to collapse
I tried your bootnew.img and it boots perfectly well on my phone. Yes, dm-verity is disabled and I also have some changes on my system partition.
Which kind of changes did you do?

Cheers,
Tobias
 
T

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
Source of bootimg

Here is the source of bootimg for the who are insterested in it. In the V3 package you will find the binary version for Windows and Android.
It includes the following commands:

unpackelf, unpackimg, mkimg, unpackinitfs, mkinitfs, getarch, seinject

Unpackelf and unpackimg are for unpacking boot images and mkimg creates an Android boot package again.
Unpackinitfs and mkinitfs are for the init ramdisk. The difference to other implementations is that links are create as text files with the ending __lnk__ in order to make to compatible with Windows (Windows has not soft links).
Getarch returns whether a Linux executable is 64 or 32 bit
Seinject adds rules to SELinux policies. Many thanks to Joshua Brindle for this https://bitbucket.org/joshua_brindle/sepolicy-inject

Cheers,
Tobias
 

Attachments

  • bootimg.zip
    217.7 KB · Views: 177
  • Like
Reactions: serajr, munjeni, zacharias.maladroit and 2 others
B

blakwhite

Senior Member
Nov 30, 2010
167
52
tobias.waldvogel said:
Sure, here you go: https://mega.nz/#!XNkBhLKJ!X35U46V1GkPkMZm75FHMJw0r1ANrjSVYrgQ3FTGoBNs

It boots perfectly well on my E6683

Cheers,
Tobias
Click to expand...
Click to collapse

Thank you. But interestingly, this one fails, too.

I can't figure out what but there's something wrong with my phone. I experienced the same problem with Androplus kernel too. Before 6.0, I could root perfectly and flash any kernel. But now, none of the kernels boot.

After flashing this one, phone didn't turn on, just a weak vibration when I tried to power on. But I flashed the kernel only from the original ftf through flashtool and it booted.
 
T

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
blakwhite said:
Thank you. But interestingly, this one fails, too.

I can't figure out what but there's something wrong with my phone. I experienced the same problem with Androplus kernel too. Before 6.0, I could root perfectly and flash any kernel. But now, none of the kernels boot.

After flashing this one, phone didn't turn on, just a weak vibration when I tried to power on. But I flashed the kernel only from the original ftf through flashtool and it booted.
Click to expand...
Click to collapse
Just a quick question: You unlocked your bootloader, right? Otherwise anything else than the original file signed by Sony won't work.
 
B

blakwhite

Senior Member
Nov 30, 2010
167
52
tobias.waldvogel said:
I'm sorry, I didn't mean to offend you ;). But it could happen that your phone get relocked with an update.
So you still getting the message then that DTB wasn't found? This is really strange. On which model are you trying to boot it?

Cheers,
Tobias
Click to expand...
Click to collapse

No problem, you didn't offend me :)

It's an E6603. That relocking thing came to my mind but didn't see a possibility. But I will try re-unlocking although I still see it as unlocked in config.

I got the same error when I tested, nonetheless flashed just to have tried.
 
C

celderic

Senior Member
Dec 1, 2010
1,140
519
tobias.waldvogel said:
I tried your bootnew.img and it boots perfectly well on my phone. Yes, dm-verity is disabled and I also have some changes on my system partition.
Which kind of changes did you do?

Cheers,
Tobias
Click to expand...
Click to collapse
You let it boot up fully? I have the E6653.

I can confirm even after a full data wipe including internal storage, this does not boot (the bootnew.img, i've not tried with another as you said this definitely works) I've tried many times, and it can't even display the boot animation, it gets to the start of it and freezes before the text can be displayed, the red led flashes a few times and the display goes black and loops doing this over and over.
I'm using my rom posted here

This is the exact rom i am using, my 6.0 release, i've not created a new thread for it yet.
Androplus kernel v20 is included and boots fine, just updated to v21 and that is okay too
Here is the rom if anybody else could test please?
There are no specific mods to the system partition, only supersu added, the rest are just apks removed so i don't think it is a problem with my rom as this is basically stock just debloated.

I will try stock 6.0 now, (flashing as we speak) but like i say my rom is stock just debloated and rooted, not even busybox added.

Edit-
Still the same,
Here is the base i used for my rom, and the same stock image i just flashed to test with.
E6653_32.1.A.1.163_1298-5496_R6C.ftf (Customized UK)
I'm going to try and build it again to to make sure the bootnew.img was okay, although you said your device booted.

Edit2-
Very strange, i built it again and flashed only the stock system partition with flashtool and it booted.
Will update if i have any more problems.

Edit3-
The bootloop i mentioned only happens when supersu is installed on the system partition, but installed systemless in the kernel it is fine.
 
Last edited:
B

blakwhite

Senior Member
Nov 30, 2010
167
52
tobias.waldvogel said:
So you still getting the message then that DTB wasn't found? This is really strange.
Click to expand...
Click to collapse

Yeah, strange really. I tried re-unlocking but it said already done. I tried downgrading to 5.1.1 and rooted successfully. Then updated again to 6.0 only to get the same errors in the fastboot process.

I downloaded some other firmware (6653 this time), fastbooted on some other pc but still the same. I haven't used a phone without root for the last 4 years, other than a few weeks waiting period, and go mad really :(
 
T

tobias.waldvogel

Senior Member
Nov 2, 2006
430
1,128
blakwhite said:
I haven't used a phone without root for the last 4 years, other than a few weeks waiting period, and go mad really :(
Click to expand...
Click to collapse
I can totally understand that, this also why I spent quite a lot of time the last two in this project.

I had some more thoughts on your problem and I can see only two possible explainations:
- Your fastboot is outdated.
I'm using the one from official Android SDK (size 319,488)
- Your bootloader has not been updated.
The boot image file format has changed since 5.1.1 and is using now appened DTB. The original format provided by Sony is in ELF format and the image in Android boot image format. Sony ELF can't be created as it requires a digital signature from Sony. I assume you used Flashtool to flash the Marshmallow image. What you could double check is that your ftf containts also the bootloader.
 
  • Like
Reactions: blakwhite
You must log in or register to reply here.

Similar threads

zacharias.maladroit
[KERNEL][E6653/E6633/E6683] Zach's Kernel Playground for Z5, WIP (work in progress)
Replies
2K
Views
212K
H3ADROOM
H3ADROOM
B
[TWRP][E6653/E6603] 2.8.7.0 and Stock Rootable Kernel [2015-11-15]
Replies
61
Views
54K
M
mikael1
T
Sony credentials restore after unlocking the bootloader
Replies
273
Views
130K
Wenro
Wenro
K
[Summary] Rooting the Z5
Replies
165
Views
168K
L33Tgod
L33Tgod
monx®
[LP][UB][ROOT][DRM][KERNEL][RECOVERY](TWRP3.0) Z5 ADV STOCK KERNEL (2016/03/04) (v1g)
Replies
138
Views
41K
A
Aiman Hossain

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 284
    T
    tobias.waldvogel
    Changelog:
    • V5.23 Fix for Android 6 (Freeze on boot logo)
      Installation of kcal kernel module for supported kernels. Get the app from https://xdaforums.com/android/software-hacking/dev-kcal-advanced-color-control-t3032080
    • V5.22 Bug in the vendor overlay creation. Existing directories (like /vendor/bin) have not been replicated correctly
    • V5.21 Fix issue when running on Linux (some CR/LF)
      Patch libsepol in bootimg for backwards compatibility with Android 6
    • V5.20 Support for superuser as an alternative to SuperSU (https://github.com/phhusson/Superuser)
      Fix for the missing internal storage link in TWRP
    • V5.11 Support for Android 7.0
      Fix in the overlay layout which could prevent some libraries from loading and cause battery drain
    • V5.1 Support for Android 7.0
      Updated bootimg to deal with Android 7.0 policies
      New tool inside bootimg for adding new contexts to binary file contexts
      New system overlay layout due to a more restrictive linker in Android 7
    • V5.0 New system overlay method using the /vendor directory. As this directory is also in the library search path even libraries can be easily replaced without modifying the system partition
      System-less SuperSU integration improved (Version 2.76 or higher recommended)
      System-less xposed integration (using the standard distribution)
      Support for 32.A.0.253
    • V4.51 Fix for awk script for Linux kernel version detection when running on Linux
    • V4.5 Fixed adb and mtp file access in TWRP for 32.2.A.0.224
    • V4.42 Added support for Z2 (Sirius) and TWRP fstab fix for leo and aries (thanks to waleedsq81)
    • V4.41 Fixed issue with Y/N choice on non-english Windows. Added support for Z3 (leo)
    • V4.4 Support for Z3+/Z4, Tablet Z2, Tablet Z3 and Tablet Z4 added (Z4 still has an issue with TWRP, but DRM fix works)
      SuperSU integration reworked in order to need less SELinux exceptions and to be more secure
      All tasks can now be individually selected. Therefore there is no separate DRM only script required
    • V4.31 Renabled Z5P (satsuki) and Z5C (suzuran) for TWRP and drmfix
    • V4.3 Support for older Lollipop added
      Script execution for Linux fixed
    • V4.24 Fix for for a bug in SuperSU integration in V4.23
    • V4.23 Fix for repacking 3rd party kernel (Some permissions were on custom directories were lost)
    • V4.22 Bugfix for readta (flash_dk reported unit not)
    • V4.21 Fix for the Linux binary of bootimg
    • V4.2 Updated TWRP to 3.0.2
    • V4.1
      Fix for WideWine (if you have your device key) Thanks a lot to goofnorf101 for testing
      unpackinitfs and makeinitfs in my bootimg tool now maintain date/time of files correctly
      Automatic SuperSU installation
    • V4.0
      Fix for older kernels (Lollipop)
      Binary for Linux (The older version had the ARM version packaged)
      Device is not stored in the kernel image anymore
      TWRP updated to version 3.0.1

    FAQ - Please read
    • Is is possible to have root with locked bootloader?
      Short answer: no
      Long answer: The locked bootloader only boots unmodified kernel packages signed by Sony. The stock kernel only mounts unmodified /system partitions (dm-veritiy) -> No modification without unlocking
      So any change to the kernel (like this script) or system partition requires unlocked bootloader
    • What is dm-verity?
      A hash checksum on all blocks of a filesystem in order to verify the integrity
    • What is Sony RIC?
      A protection to avoid mounting the root filesystem or system read/write
    • What happens if I unlock my bootloader
      The device key (TA unit 0x1046b) will be wiped, which deactives everything DRM related. In addition a full wipe of your phone will be perfomed.
      So extract your TA partition before with this great tool http://xdaforums.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597 from zxz0O0
      If you already unlocked the bootloader before, then at least the credentials will be restored, which will reactivate stuff like x-reality and camera de-noise
    • Why do I need to flash my device key?
      Without your device only some functions can be reactivated, like x-reality. Other functions like widevine do not work with out your device key.
    • How do I enter TWRP recovery?
      Restart your phone and press the volume key up as soon as the LED switches to yellow
    • I want to use a custom kernel with the DRM fix
      Just say "N" to all other options. Nevertheless be prepared for problems if the custom kernel does not match your Android version.
    • What should I do if there is an update to this script?
      First check if you really need to run this update by checking the changelog. E.g. if it says binary for Linux fixed and you are using Windows then probably you don't care. If you did not change your Android version then all you have to do is to update the kernel package with fastboot flash boot. If you do not use the automatic SuperSU integration then you have to reinstall SuperSU in TWRP.

    This tool repacks an existing kernel package (usually the stock kernel) in order to make it rootable and adds TWRP recovery as well. Version 4 has been succesfully tested with LP and MM.

    In particular it adresses the following issues:
    • DM-Verity: Android is now using dm-verity to verfy the integrity of the system partition. Until you switch it off your phone won't boot after modifying /system
    • SONY RIC: RIC is blocking the write access to the system partition
    • DRM Keys: After unlocking the bootloader your device key is wiped, which deactivates some functionaliy. E.g. x-reality, denoise in camera aso.

    Recompiling the kernel is not required as only the init ramdisk needs to be modified. You can run these scripts either in Windows or Linux.

    Thanks to the excellent work of zxz0O0 you can now backup the TA partition before unlocking the bootloader with this tool http://xdaforums.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597
    If you managed to backup your TA partition before you unlocked the bootloader then this version will fully reactivate your keys as well. (many thanks to addicted1900 for helping me with the testing)

    As there has been some confusion I would like to point out one more time that you cannot run any kernel package which is not signed by Sony without unlocking the bootloader. So this works only with unlocked bootloader.
    As it seems that it is not clear to everyone I also want to mention that <...> is a placeholder. E.g. <extracted kernel> means that you should replace it with then name of your extracted kernel, which could be kernel.elf

    There was a report that having SuperSU in the system partition installed may lead to a bootloop. Therfore you shoud first install the bootimage created by this script and then install SuperSU afterwards, as it will then use the system-less strategy.

    In order to use these scripts you need the kernel boot image of your current version. There two different ways to obtain it:

    Method1:
    If you have a .ftf image then open it with zip application (7Zip, WinZip, Windows Compressed Folder) and extract kernel.sin. Afterwards use Flashtool -> Tools -> SIN Editor to extract the kernel. You should end up with the boot image with extension .elf.

    Method2:
    Run your favourite recovery and connect via
    Code: 
    adb -d shell
    Now run
    Code: 
    find /dev -name boot
dd if=<output of the find command before> of=/sdcard/kernel.img

    Once you have the kernel image you are ready to use the script.
    The newest version support superuser as an alternative to SuperSU. This is available open source and can be verified. In order to integrated you need the current superuser.zip from http://superuser.phh.me/superuser.zip and to be install the app afterwards from Google Play (look for superuser phh) or build it yourself from github.
    To integrate the kernel part just place superuser.zip in the rootkernel directory.

    You can also still use SuperSU, although it is causing a huge battery draining on my Z5 with Android 7.0 If you place SuperSU in the same directory (SuperSU*.zip, case sensitive) then it will be also installed automatically . It did all the tests with 2.76, but newer versions should work as well. Please be aware that you can not update SuperSU within the application. For a newer SuperSU version you need to rerun the script.
    If you want to integrate xposed as well just place the distribution for you device and Android version in the same directory. (e.g. xposed-v86-sdk23-arm64.zip). Only support with Android 6.0 (sdk 23) and higher.
    xPosed for Android 7.0+ is still not available.

    Code: 
    rootkernel <extracted kernel> boot.img
    You are prompted for several choices:
    • Sony RIC is enabled. Disable?
      I prefer not to disable it in order to keep my phone more secure. Unfortunately there are a lot of bad guys in this world and SELinux and RIC still can save us if someone discovers a new kernel exploit.
      Sony RIC basically prevents mounting the /system partition for write. You can still modify it in recovery of of course, but if you require write access to /system without entering recovery then you need to disable it.
    • Install TWRP recovery? Here you should say yes unless you are trying to patch a non-stock kernel, which comes already with a recovery
    • Install busybox? For security reasons I prefer not to install. In recovery you have it anyway. This choice is only available if you chose install TWRP
    • Found SuperSU-v....zip. Install? Integrates SuperSU. For this option to show up you have to place the SuperSU package into the same directory with the name SuperSU*.zip (case sensitive)
    • Found superuser.zip. Install? Integrates superuser. For this option to show up you have to place superuser.zip into the same directory (case sensitive)
    • # Make su permissive (Permits any action as su)? This only appears if you install superuser. Permissive means you can anything as root, without it is restricted mainly to file operations (sufficient for e.g. Titanium Backup)
    • Found xposed-v....zip. Install? Integrates xposed system-less. For this option to show up you have to place the xposed for your device and Android version into the same directory. (e.g. xposed-v86-sdk23-arm64.zip)
    • Install DRM fix? Installs the DRM fix. First it tries to use the device key which you flashed with flash_dk. If it does not exist it uses an alternative method which cannot fix everything (e.g. Widevine will not work, but X-reality, Camera denoise etc. will work)

    Now put your phone into fastboot mode (Volume Up + connect USB) and then run:
    To test it without actually flashing it:
    Code: 
    fastboot boot boot.img
    For flashing it:
    Code: 
    fastboot flash boot boot.img

    If you managed to backup for TA partition before then you can reactivate your original device key as follows:
    Code: 
    flash_dk <ta backup image>  DK.ftf
    Flashing this file with flashtool will write your device key to an alternative unit, from where the drmfix library will pick it up.
    This is a one-time task. It will survive a complete reset of the phone or Android system upgrade. The device key has a length of just 16 bytes, so it is correct that the resulting DK.ftf has a size of only aprox. 500 bytes.

    If you like my work you can buy me a coffee ;)

    Some background information:
    There are two main tools involved (for both Android and Windows)
    - busybox
    Probably everyone knows it

    - bootimg
    A multicall binary with several tools for unpacking and packing the boot image as well as adapting the SELinux policy. Part of the code is written by me from scratch, some other parts are cherry picked from other projects. I will also provide the source for it. As Windows doesn't have softlinks I modified the tools for unpacking and packing the init ramdisk to write text files with __lnk__ at the end instead.
    View
    63
    serajr
    serajr
    Rootkernel V5.23 (UNOFFICIAL 2.5) - OREO - Xperia X, X Comp., X Perf., XZ and XZs

    Xperia X Performance, XZ and XZs ONLY (Xperia X and Xperia X Compact must skip this):
    Android Oreo ramdisk patching needs some additional files, and they must be copied from Oreo /system into the rootkernel's filesystem_files folder, prior to run the script, and they are:
    Code: 
    /system/vendor/etc/[B][COLOR="Blue"]fstab.qcom[/COLOR][/B]
/system/vendor/etc/init/hw/[B][COLOR="blue"]init.qcom.rc[/COLOR][/B]
/system/vendor/etc/init/hw/[B][COLOR="blue"]init.target.rc[/COLOR][/B]
    (you can pull these files through adb, or even converting system.sin to system.ext4 and take them out from there - just copy them, and DO NOT touch its contents)

    Rootkernel's procedure for Oreo kernel ONLY:
    1. Download and extract attached Rootkernel V5.23 (UNOFFICIAL 2.5)
    2. Download attached flashable zip (DRM-fix_System_Mode.zip) and push it somewhere in your device (internal memory or sdcard)
    3. Run rootkernel script with Oreo stock kernel.elf (eg.: rootkernel kernel.elf boot.img)
    4. Say yes (Y) to everything - If you want munjeni's TA PoC option, ensure your TA.img (case sensitive) is located at rootkernel's root folder, and say no (N) to DRM fix
    5. You're done!

    Rootkernel's output should look like this:
    Code: 
    Rootkernel V5.23 (UNOFFICIAL 2.5)

- Unpacking kernel
  Found elf boot image
  Kernel version: 3.18.66-perf-g27a9189
  Found appended DTB
- Detected vendor: somc (Sony), device: dora (Xperia X Performance), variant: row
- Unpacking initramfs
- Detected platform: 64-bit
- Detected Android version: 8.0.0
- Android Oreo requires additional files! Continue? (Say yes to copy) [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
  init.rc (patched)
  fstab.qcom (copied)
  init.qcom.rc (copied and patched)
  init.target.rc (copied and patched)
- dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] [B][COLOR="Blue"]Y[/COLOR][/B]
  Patching fstab in dtb to disable dm-verity
- Sony RIC is enabled. Disable? [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
  Disabling Sony RIC
- force-encrypt is enabled. Disable? (Say yes if you decrypt /data) [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
  Disabling force-encrypt
- Install DRM fix? [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
  1. DRM fix preload line added successfully!
  2. DRM libraries still need to be flashed manually on TWRP recovery before 1st boot!!
     System mode, flash: DRM-fix_System_Mode.zip
- All done! Continue? [Y/n] [B][COLOR="blue"]Y[/COLOR][/B]
- Creating new initramfs
- Creating boot image
- Cleaning up
Done

    Flash patched kernel:
    1. Flash Oreo ftf (wiping everything, excluding nothing - except *.ta files - if any)
    2. Unplug device and DO NOT turn it on
    3. Fastboot newly created boot.img
    4. Fastboot TWRP for your device
    5. Unplug device and DO NOT turn it on again
    6. Enter TWRP recovery and flash: DRM-fix_System_Mode.zip << YOU CAN SKIP THIS STEP IF YOU CHOOSE munjeni's TA PoC OPTION!!
    7. You're done!

    Root:
    - After step 6 above, flash latest Magisk zip (SuperSU seems not to work properly yet)

    Known issues:
    - Magisk zip installation may fail, and device may also fall in a bootloop
    - If you're facing this ^, do whole procedure again, but DO NOT flash Magisk zip, instead, turn device on, install latest Magisk Manager, patch boot.img and flash it (fastboot it)!


    As always, TRY IT AT YOUR OWN RISK!

    Credits:
    @tobias.waldvogel ofc
    @sToRm// for additional ramdisk files hint (man, you're insane!)

    Enjoy it!
    View
    41
    T
    tobias.waldvogel
    munjeni said:
    Niugat related only... I don't know maybe you didn't noticed but seinject tool from OP is not working for nougat selinux, if you remove -q parameter yiu will see that ;)
    Click to expand...
    Click to collapse

    I was very busy the last months, so there were not that many updates.
    Now that Android 7 is out I made a new version to supports it as well.
    xPosed is currently not included in but you can still flash it from TWRP if you need it.

    The script itself is hosted on github now: https://github.com/tobiaswaldvogel/android_rootkernel
    If you interested in the source of bootimg have a look at https://github.com/tobiaswaldvogel/and_boot_tools
    ;)

    Cheers,
    Tobias
    View
    36
    serajr
    serajr
    DRM Fix Workaround and Sony RIC disabler for Nougat - System Mode!

    shoey63 said:
    Not yet due to file contexts now being in bin format. The tool will hang. @serajr posted a workaround a few posts ago.
    Click to expand...
    Click to collapse

    Tool still can not fully handle Nougat's kernel, even after my changes. That's why I didn't share it yet!
    With that kernel we're able to disable dm-verity ONLY, which leads us to create a fully working DRM fix workaround (system mode):

    1. Download attached flashable zip (DRM fix libs are inside it)
    2. Run rootkernel tool with Nougat's stock kernel.elf, and choose Y for dm-verity ONLY! << MANDATORY to avoid bootloop
    Code: 
    - dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] [B][COLOR="Blue"]Y[/COLOR][/B]
    3. When tool asks you for - Install busybox?, do nothing yet, and...
    4. Enter \ramdisk folder and edit init.target.rc@0750 file (with notepad++)
    5. Add the blue lines exactly as shown below (between "on early-init" and "on fs" sections):
    Code: 
    [B]on early-init[/B]
    mkdir /firmware 0771 system system
    mkdir /bt_firmware 0771 system system
    symlink /data/tombstones /tombstones
    mkdir /dsp 0771 media media
	
[B][COLOR="Blue"]on post-fs
    export LD_PRELOAD libdrmfix.so[/COLOR][/B]

[B]on fs[/B]
    wait /dev/block/bootdevice
    5.1 - If "on post-fs" section already exists, add :libdrmfix.so at the final of the line underneath it:
    Code: 
    [B]on post-fs[/B]
    export LD_PRELOAD libNimsWrap.so[B][COLOR="Red"]:libdrmfix.so[/COLOR][/B]
    6. Save the file and exit \ramdisk folder
    7. Back to the rootkernel's screen and choose N for busybox (boot.img will be created)
    8. Open downloaded file with 7Zip and drag'n'drop your newly created boot.img file into its content screen (root)
    8.1. rootkernel_Nougat_boot_and_drmfix_flashable.zip contents will be:
    Code: 
    META_INF
system
[B]boot.img[/B]
    9. Close 7Zip
    10. Enter TWRP recovery (fota kernel recovery) and flash the zip
    11. Done!

    Sony RIC, TWRP recovery (internal), DRM fix (internal) and busybox WILL NOT WORK AND THEY MUST BE SKIPPED by choosing N.


    TRY IT OUT AT YOUR OWN RISK


    Disabling Sony RIC (do this before performing step 7 above):
    1. Enter \ramdisk folder and edit init.sony-platform.rc@0750 file (with notepad++)
    2. Insert the blue line and add the red # mark, exactly as shown below (look for "on boot" section):
    Code: 
    [B]on boot[/B]
    # Setting to use rndis_qc driver
    exec u:r:usb_device_mode:s0 -- /system/bin/sh /init.usbmode.platform.sh "set_rndis_qc"

    # SONY: for Bluesleep
    chown bluetooth net_bt /proc/bluetooth/sleep/lpm
    chown bluetooth net_bt /proc/bluetooth/sleep/btwrite
    chmod 0660 /proc/bluetooth/sleep/lpm
    chmod 0660 /proc/bluetooth/sleep/btwrite

    # SONY: Enable Sony RIC
    mount securityfs securityfs /sys/kernel/security nosuid nodev noexec
    [B][COLOR="Blue"]write /sys/kernel/security/sony_ric/enable 0[/COLOR][/B]
    [B][COLOR="Red"]#[/COLOR][/B] chmod 0640 /sys/kernel/security/sony_ric/enable

    # SONY: Enable wakeup irq module
    write /sys/devices/platform/wakeup_debug.0/enable 1
    3. Save the file and exit \ramdisk folder
    4. Done > Proceed now to step 7 above


    For development purposes only! You don't need to do that!! - If you wanna dare and play with file_contexts.bin as a plain text file, do this before performing step 7 above:

    1. Download attached bin2txt.zip and unpack it
    2. Copy original file_contexts.bin@0644 binary from rootkernel's /ramdisk folder to the bin2txt's /ramdisk folder
    3. Run bin2txt (windows) or ./bin2txt.sh (linux)
    4. Move converted file_contexts.bin@0644 (now as a plain text file) from bin2txt's /ramdisk folder back to the rootkernel's /ramdisk folder (replacing original file)
    6. Done > Proceed now to step 7 above

    In the tests I did with my XP everything was ok! Device did boot up as it should!!
    If device get stuck at sony logo, something went wrong. Create a new boot.img without this!!
    View
    31
    serajr
    serajr
    Rootkernel V5.23 (UNOFFICIAL 2.4) - OREO - Xperia X, X Comp., X Perf., XZ and XZs

    What's new:
    - Xperia X and Xperia X Compact compatibility (Oreo)
    (X and XC users, please, do read first line of the post, in red)

    Output:

    Code: 
    Rootkernel V5.23 (UNOFFICIAL 2.4)

- Unpacking kernel
  Found elf boot image
  Kernel version: 3.10.84-perf-g78dc059
  Found appended DTB
- Detected vendor: somc (Sony), device: [B][COLOR="Blue"]kugo (Xperia X Compact)[/COLOR][/B], variant: row
- Unpacking initramfs
- Detected platform: 64-bit
- Detected Android version: 8.0.0
[B][COLOR="blue"]- Found fstab.qcom (no additional files required)![/COLOR][/B]
- dm-verity is enabled. Disable? (Say yes if you modify /system) [Y/n] Y
  Patching fstab in dtb to disable dm-verity
- Sony RIC is enabled. Disable? [Y/n] Y
  Disabling Sony RIC
- force-encrypt is enabled. Disable? (Say yes if you decrypt /data) [Y/n] Y
  Disabling force-encrypt
- Install DRM fix? [Y/n] Y
  1. DRM fix preload line added successfully!
  2. DRM libraries still need to be flashed manually on TWRP recovery before 1st boot!!
     System mode, flash: DRM-fix_System_Mode.zip
- All done! Continue? [Y/n] Y
- Creating new initramfs
- Creating boot image
- Cleaning up
Done

    >> Enjoy it! <<

    (please, do read instructions before proceeding and patching your STOCK kernel, also, do always use the elf format as the input file)
    View

New posts