[ROOT][Z-Z3] How to root 5.0 Lollipop with rootkitXperia

Search This thread

AndroPlus

Senior Member
rootkitXperia is back again!

A Japanese developer, @cubeundcube made it possible to root some Android 5.0 Lollipop firmware directly (not 5.1 and 64bit devices, sadly...).
With new rootkitXperia, you don't need to roll back to KitKat when you lose root on locked bootloader!

Download
Download (only for M4 Aqua Dual E2363 *)
Download (for M4 Aqua E2303 **)

Supported device/version
Z2/Z3 variant
23.2.A.1.62
23.1.A.1.28
17.1.1.B.3.240 or .245 *Japanese model
23.0.B.1.38 *Japanese model
23.0.B.1.59 *Japanese model
23.0.C.0.350 *Japanese model
23.0.H.0.334 *Japanese model

Z1 variant
14.5.A.0.270
14.3.B.0.310 *Japanese model

Z variant
10.6.A.0.454

M4 Aqua Dual E2363 *
26.1.B.1.85

M4 Aqua E2303 **
26.1.A.1.128

* You can see some 5.1 firmwares in "support.txt", but "封鎖" means "blocked/patched", so they are not supported.

How to use rootkitXperia
1. Install adb driver for your device
2. Go to Settings > Developer options and tick USB debugging
3. Go to Settings > Security and tick Unknown sources
4. Connect your phone to your computer
5. Extract rootkitXperia_20150926.zip and run install.bat
6. When you see "— all finished —" in console, rooting is done.

NOTE: rootkitXperia won't install recovery or kill ric,
so you have to install XZDualRecovery.

Donate link for cubeundcube is here.
If you want to thank him, his first post for dev threads is here;)
 
Last edited:

E66666666

Senior Member
May 23, 2013
235
69
Here's the thing pulled through Google Translate:
■ domestic version
Z1 system: 14.3.B.0.310 previous
Z2 system: 17.1.1.B.3.240 (245) previous
Z3 system: 23.0.B.1.38 previous

■ Z2 & Z3 system (Overseas Version)
23.4.A.0.546 blockade
23.2.A.1.62 OK
23.1.A.1.28 OK

■ Z1 system (Overseas Version)
14.6.A.0.368 blockade
14.5.A.0.283 blockade
14.5.A.0.270 OK

■ Z system (Overseas Version)
10.7.A.0.222 blockade
10.6.A.0.454 OK

Domestic version means the Japanese versions. Probably.
 
  • Like
Reactions: pollob666

beenoliu

Senior Member
Dec 5, 2010
157
66
Hong Kong
I got error when rooting C5 Ultra Dual
--- Xperia rootkit 2015/09/26 ---

waiting for device...
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
783 KB/s (13640 bytes in 0.017s)
4906 KB/s (75364 bytes in 0.015s)
4878 KB/s (29972 bytes in 0.006s)
7227 KB/s (170232 bytes in 0.023s)
7678 KB/s (5904943 bytes in 0.751s)
7755 KB/s (1048328 bytes in 0.132s)
28 KB/s (58 bytes in 0.002s)
26 KB/s (55 bytes in 0.002s)
307 KB/s (629 bytes in 0.002s)
5051 KB/s (25863 bytes in 0.005s)
4424 KB/s (13592 bytes in 0.003s)
58 KB/s (60 bytes in 0.001s)
2572 KB/s (5268 bytes in 0.002s)

getroot start.
ro.build.product=arima6752_lwt_s_l
ro.build.id=29.0.B.0.161
ro.build.version.release=5.0
max_fds=4096
Creating target socket...OK.
3072 sockets created.

waiting for device...
error: protocol fault (no status)
adb server is out of date. killing...
ADB server didn't ACK
* failed to start daemon *
error:
error:

removing temporary files...
adb server is out of date. killing...
* daemon started successfully *
rm: /data/local/tmp/getroot: No such file or directory
rm: /data/local/tmp/supolicy: No such file or directory
rm: /data/local/tmp/libsupol.so: No such file or directory
rm: /data/local/tmp/busybox: No such file or directory
rm: /data/local/tmp/00stop_ric: No such file or directory
rm: /data/local/tmp/99SuperSUDaemon: No such file or directory
rm: /data/local/tmp/install-recovery.sh: No such file or directory
rm: /data/local/tmp/ric_disabler_mod.ko: No such file or directory
rm: /data/local/tmp/copymodulecrc: No such file or directory
rm: /data/local/tmp/saferic: No such file or directory
rm: /data/local/tmp/install_tool.sh: No such file or directory

--- all finished ---
請按任意鍵繼續 . . .
 

RohitBopnna

Senior Member
Jun 6, 2014
145
57
I have a M4 Auqa Dual (E2363), tried with both 26.1.B.2.102 and 26.1.B.2.129, there is no older firmware of this phone and it does not work.
the phone reboots and says all finished, but there is no SU loaded, and root is not there.

HTML:
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\windows\system32>cd C:\Android\sdk\platform-tools
C:\Android\sdk\platform-tools>install.bat
--- Xperia rootkit 2015/09/26 ---
waiting for device...

307 KB/s (13640 bytes in 0.043s)
4089 KB/s (75364 bytes in 0.017s)
3644 KB/s (29972 bytes in 0.008s)
4147 KB/s (170232 bytes in 0.040s)
4590 KB/s (5904943 bytes in 1.256s)
3390 KB/s (1048328 bytes in 0.301s)
27 KB/s (58 bytes in 0.002s)
17 KB/s (55 bytes in 0.003s)
307 KB/s (629 bytes in 0.001s)
4205 KB/s (25863 bytes in 0.006s)
1203 KB/s (13592 bytes in 0.011s)
29 KB/s (60 bytes in 0.002s)
1725 KB/s (5268 bytes in 0.002s)

getroot start.
ro.build.product=E2363
ro.build.id=26.1.B.2.102
ro.build.version.release=5.0
max_fds=4096
Creating target socket...OK.
3072 sockets created.

waiting for device...

removing temporary files...

--- all finished ---
Press any key to continue . . .

C:\Android\sdk\platform-tools>
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 56
    rootkitXperia is back again!

    A Japanese developer, @cubeundcube made it possible to root some Android 5.0 Lollipop firmware directly (not 5.1 and 64bit devices, sadly...).
    With new rootkitXperia, you don't need to roll back to KitKat when you lose root on locked bootloader!

    Download
    Download (only for M4 Aqua Dual E2363 *)
    Download (for M4 Aqua E2303 **)

    Supported device/version
    Z2/Z3 variant
    23.2.A.1.62
    23.1.A.1.28
    17.1.1.B.3.240 or .245 *Japanese model
    23.0.B.1.38 *Japanese model
    23.0.B.1.59 *Japanese model
    23.0.C.0.350 *Japanese model
    23.0.H.0.334 *Japanese model

    Z1 variant
    14.5.A.0.270
    14.3.B.0.310 *Japanese model

    Z variant
    10.6.A.0.454

    M4 Aqua Dual E2363 *
    26.1.B.1.85

    M4 Aqua E2303 **
    26.1.A.1.128

    * You can see some 5.1 firmwares in "support.txt", but "封鎖" means "blocked/patched", so they are not supported.

    How to use rootkitXperia
    1. Install adb driver for your device
    2. Go to Settings > Developer options and tick USB debugging
    3. Go to Settings > Security and tick Unknown sources
    4. Connect your phone to your computer
    5. Extract rootkitXperia_20150926.zip and run install.bat
    6. When you see "— all finished —" in console, rooting is done.

    NOTE: rootkitXperia won't install recovery or kill ric,
    so you have to install XZDualRecovery.

    Donate link for cubeundcube is here.
    If you want to thank him, his first post for dev threads is here;)
    12
    rootkitXperia_E2303_26.1.A.1.128
    https://www.dropbox.com/s/9pys6qgxtc1hixs/rootkitXperia_E2303_26.1.A.1.128.zip?dl=0

    I almost edited only install.bat because E2303 kernel image is mostly the same as E2363 one. :p
    6
    rootkitXperia_c5ultra_29.0.X.0.161
    https://www.dropbox.com/s/53ki210hlck5m03/rootkitXperia_c5ultra_29.0.X.0.161.zip?dl=0

    I don't have c5 ultra, so there is no guarantee that this kit can work.

    This kit is for 29.0.A.0.161 or 29.0.B.0.161.
    29.0.x.0.161 firmware can be found as 'Service Exchange Unit' by XperiFirm.
    5
    Great!

    And about firmware update keeping rooted, I'm building TWRP for BL locked M4 Aqua.
    5
    With your skills would be nice to make a working root exploit for the Stagefright vulnerability.

    ---
    Sony Xperia A2 SO-04F (Japan version of Z1 Compact)

    The stagefright exploit is dangerous because it is able to abuse various bits in android but it doesn't allow you root access as it and the services that use the stagefright libraries do not run as root.

    This is a prerequisite for a root exploit. That is also the reason why most root exploits found since kitkat are targeting the kernel... The kernel is always running as root, but Google changed android so much that most of the ecosystem is running at system or shell user levels.

    Please, don't get your hope up based on stagefright.