[Summary] Rooting the Z5

[Knux14]

Hi there,

I think we should make a simple thread to sum up everything we know about root, since the main talking thread is long, here are the main informations:

Xperia Z5:
- No locked bootloader root yet
- AndroPlusKernel: http://xdaforums.com/xperia-z5/development/kernel-andropluskernel-v1-t3246100
- TWRP here http://xdaforums.com/xperia-z5/development/twrp-2-8-7-0-z5-rootable-kernel-t3240032
- CWM booting but not usable: http://xdaforums.com/xperia-z5/development/recovery-clockworkmod-recovery-sony-t3249782
- Unlocked BL dirty rooting available and working as intended: http://xdaforums.com/xperia-z5/development/dirty-root-solution-unlocked-bl-t3233274
- Dumped original firmware: http://xdaforums.com/xperia-z5/general/ftf-files-sony-xperia-z5z5-dual-t3214397
- Xposed works but you need to let it bootloop a few times

Xperia Z5 Compact:
- No locked bootloader root yet
- Zombie Kernel testing release here: http://xdaforums.com/z5-compact/orig-development/kernel-zombie-t3224735
- Unlock bootloader root available (http://xdaforums.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524)
- Prerooted firmware available for unlocked BL: http://xdaforums.com/z5-compact/development/pre-rooted-32-0-5-32-firmware-one-click-t3231520
- Xposed doesn't work with prerooted firmware

Currently we need to:
- Compile Zombie Kernel for Z5
- Improve TWRP support
- Create prerooted-firmware
- Most obviously and most hardly, find exploit for Locked BL root

Ok I'm not an Xperia pro, just got my first one few days ago, but still a android and linux geek, so if there is mistakes in my post, or update I haven't seen, notify me

 

[Uclydde]

- Maybe dump the original firmware ?

If I'm not mistaken, I think it already has: http://xdaforums.com/xperia-z5/general/ftf-files-sony-xperia-z5z5-dual-t3214397

 

[abrahamjones]

Need root for Z5, thx for efforts.

 

[Knux14]

If I'm not mistaken, I think it already has: http://xdaforums.com/xperia-z5/general/ftf-files-sony-xperia-z5z5-dual-t3214397

Updated

 

[nilezon]

Test kernel for Z5:
https://mega.nz/#!15oSGLiA!N-lOlfn8RS9_gN_GcVJrFzXg21nzL1xDdt1xKujl9is
This is stock Z5 kernel modified to disable Sony RIC, dm verity, etc.

It should work together with the Z5C rooting solution:
http://xdaforums.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524

Please report back.

 

[Azdian]

Test kernel for Z5:
https://mega.nz/#!15oSGLiA!N-lOlfn8RS9_gN_GcVJrFzXg21nzL1xDdt1xKujl9is
This is stock Z5 kernel modified to disable Sony RIC, dm verity, etc.

It should work together with the Z5C rooting solution:
http://xdaforums.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524

Please report back.

You are the man, you saved me
my phone works now with root access

 

[Knux14]

Test kernel for Z5:
https://mega.nz/#!15oSGLiA!N-lOlfn8RS9_gN_GcVJrFzXg21nzL1xDdt1xKujl9is
This is stock Z5 kernel modified to disable Sony RIC, dm verity, etc.

It should work together with the Z5C rooting solution:
http://xdaforums.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524

Please report back.

Huge thanks, But I can't get it working...
I open BL, I fastboot flashed the kernel, then I fastboot booted on the recovery (Which doesn't show a black screen as expected but a real non-fully-working twrp for me) and I tried to install Supersu but I write an error then...

EDIT: Kinda glitchy to do, but works.

If anyone has Xposed working, please make a tutorial

 

[ChrissehB]

Okay so this is my first Xperia device and my second android device (used to have a Nexus 5 so rooting was simple). Can anyone ELI5 the root situation?

I understand that the TA partition contains DRM keys to make X-Reality etc work and that unlocking the bootloader will wipe this TA partition and the features will stop working. My main confusion comes from - if other lollipop devices have rooting methods for locked bootloaders, why don't these methods work on the Z5? Sorry if this is extremely obvious and I'm an idiot.

 

[Knux14]

Most android devices have either already unlocked BL or you have to. For example, Nexus 5 needed to unlock the BL, as well as the OnePlus One, but those devices don't contain DRM so you don't loose anything when unlocking

 

[harfot]

Test kernel for Z5:
https://mega.nz/#!15oSGLiA!N-lOlfn8RS9_gN_GcVJrFzXg21nzL1xDdt1xKujl9is
This is stock Z5 kernel modified to disable Sony RIC, dm verity, etc.

It should work together with the Z5C rooting solution:
http://xdaforums.com/z5-compact/development/dirty-root-solution-unlocked-bl-t3230524

Please report back.

Worked in second attempt. First time reboot into recovery. New fastboot boot booted into black screen.

In following sequence it was necessary to add destination file name,

D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/
failed to copy 'SuperSU-v2.51.zip' to '/data/media/0/': Is a directory

D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/SuperSU-v2.51.zip
9055 KB/s (3989636 bytes in 0.430s)

 

[Knux14]

Worked in second attempt. First time reboot into recovery. New fastboot boot booted into black screen.

In following sequence it was necessary to add destination file name,

D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/
failed to copy 'SuperSU-v2.51.zip' to '/data/media/0/': Is a directory

D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/SuperSU-v2.51.zip
9055 KB/s (3989636 bytes in 0.430s)

I did not had to :/

 

[alanm1986]

You guys work fast!

Unsure whether to root myself yet,
Kind of wouldn't mind being able to connect a ps3 pad instead of
Ps4 using the sixaxis app

 

[Falenone]

I'm still confused here. I don't see clear instructions for root process, probably because this is my first Xperia device. Neither do I know if using this modded stock kernel and doing this adb thing few posts back will break the DRM thingy and camera features or not.

 

[Knux14]

I'm still confused here. I don't see clear instructions for root process, probably because this is my first Xperia device. Neither do I know if using this modded stock kernel and doing this adb thing few posts back will break the DRM thingy and camera features or not.

There is nothing clear enough for beginner yet. Sooner or later there will be a TWRP fully working and it will be easy.
Try the dirty method, but don't do things that you are not sure that will work. Ask us if needed

 

[Falenone]

I don't want to lose features because of unlocked bootloader. I guess I'm going to survive without root til there's TWRP and pretty much flash n go root

 

[Knux14]

You will maybe never be able to root without loosing feature. Xperia devices work like this for ages..
The only way you could would be that we find a flaw in Android, which could either arrive soon, or never...

 

[koziakauzu]

You will maybe never be able to root without loosing feature. Xperia devices work like this for ages..
The only way you could would be that we find a flaw in Android, which could either arrive soon, or never...

Ages means..? I know that the Z1 is not so fresh anymore but we were able to root 4.2/4.4.4/5.1 without losing anything with locked BL. (I know nothing except following tutorials)

Sent from my E6653

 

[Knux14]

Yes because there were security holes in android. For now we havent found anything yet in this version

 

[abrahamjones]

Worked in second attempt. First time reboot into recovery. New fastboot boot booted into black screen.

In following sequence it was necessary to add destination file name,

D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/
failed to copy 'SuperSU-v2.51.zip' to '/data/media/0/': Is a directory

D:\DOWNLOADS\Sony\Xperia\Z5\Fastboot>adb push SuperSU-v2.51.zip /data/media/0/SuperSU-v2.51.zip
9055 KB/s (3989636 bytes in 0.430s)

I did boot into TWRP (it was like tablet mode) mounted all partitions to be sure, flashed SuperSU from external sd. It is working. Thank you all

 

[ondrejvaroscak]

Okay so this is my first Xperia device and my second android device (used to have a Nexus 5 so rooting was simple). Can anyone ELI5 the root situation?

I understand that the TA partition contains DRM keys to make X-Reality etc work and that unlocking the bootloader will wipe this TA partition and the features will stop working. My main confusion comes from - if other lollipop devices have rooting methods for locked bootloaders, why don't these methods work on the Z5? Sorry if this is extremely obvious and I'm an idiot.

Google "Verified Boot Android" .. there is almost 100% probability that locked bootloader root will never be achieved, because of this security feature. Verified Boot was introduced in KitKat, but almost nobody used it in so strict mode implementation... Until now, no single firmware using Verified Boot was ever rooted without either custom kernel (must unlock bootloader) or leaked engineering bootloader (try ask Sony engineers for it).