【E1】 XPeria E1 (D2005) semi-official dev thread -flashing, hacking, rooting and all

1,433 posts
Thanks Meter: 583
 
By mai77, Senior Member on 15th April 2014, 06:08 PM
Post Reply Email Thread
E1 model long story short:

E1 facts:
- can be rooted (somewhat) easily -- see http://forum.xda-developers.com/show...postcount=1307 for Kitkat 4.4.2 rooting with kernel-swapping via flashtool
- can be flashed, but not as versatile as GALAXYs with ODIN
- open source AOSP open source build 20.0.A.1.8 : http://developer.sonymobile.com/downloads/xperia-open-source-archives/open-source-archive-for-build-20-0-a-1-8/ (not "advertised" with other o.s. models... funny)
- FREEXPERIA support with few if any reports
- no full NANDROID support yet (fstab script not adapted)

conclusion: OK for developers. decrypt FTF poss. etc.


do a TA backup prior to unlocking bootloader else you kill your keys!


UPDATE: http://towelroot.com TOWELROOT will root "E1" as well as "E1 dual" UPDATE 2: but not the latest Oct.2014 version anymore. dang!



TIPS & TRICKS:

- if existent, kill youtube update apk. the update introduce nasty ad before each tube video




flash image: http://www.xperiadownload.cz/index.p...ategory/49-e1# for Androxydes flash-tool --> http://androxyde.github.com/




The E1 has no hw back-button like other xperias. Instead flashmode and fastbootmode are entered into via POWER together with either of the VOLUME +/- keys - contrary to the ft's instructions (see pic above).


current Flashtool ver. 0-9-18-2 does have towelroot built-in it works if developer options are active (unknown sources , usb debug).

flashmode flashing works with ft and xperiaFIRM firmware files.


/ProgramData/Sony Mobile/Update Engine/db/13740270/blob_fs
this is where PC-companion stores (win 8.1) the "4 SEUS files" for decoding with ft, e.g. FILE_280864415 containing the .sin files with the flash images.




#############################
open source build 20.0.A.1.8 : http://developer.sonymobile.com/down...ld-20-0-a-1-8/


that tool unlocks and relocks (advisable: do not change flasher installations in between) the bootloader (bl). so SONY's PC-companion does not complain and upgrades your E1 after you downgraded it with the Androxyde flasher.

these instructions http://xperiafirmware.com/8-firmware...-e1-dual-d2105
give you an idea about using Androxyde's ft.

The idea about SONYs "Emma" flash tool is to flash E1 with unlocked bl, which is sth. PC-companion and SUS will not do. (just relock with Androxyde ft, if u still can).
Emma does not support the E1 model, so it is useless for E1 users. No e-mail registration required, if you follow Sony instruction and put the .ini file from .zip next to the .exe file.



quick test to see whether your Windows drivers (version 1.5 or later) do work:

E1 win drivers come with Androxydes flash tool, plus you need ADK usb drivers and the SONY android_winusb.inf to manually place in adk subdirectory.

boot into fastbootmode - while USB plugged - and you must see a steady blue light on the phone's top (not green or red). if it goes off or is dark, probably your win driver has a yellow triangle to it because it malfunctions. to remedy: reinstall drivers after booting windows via (7) advanced bootup option (i.e. no enforcement of driver signatures). verify that the yellow triangle in windows device manager is gone.


1. power off E1
2. press and hold VOLUME UP button
3. plug in USB cable to Windows PC and E1 (both ends)
4. blue light must come on very soon
5. which indicates FAST BOOT MODE being active



stuff E1 users need:

  • rooted hot-bootable kernel
  • working TA-partn backup so users can unlock bootloaders late in the game
  • once you unlocked: it is no going back! (no relock method proven yet!)
  • to flash in flash-mode (rather than fast boot mode) u need to unlock the bl


TA (trim area) backup for relocking bl & save DRM keys: http://forum.xda-developers.com/show....php?t=2292598
not yet tested for E1 - also you need root for it (no proven method for that yet).
best practise is to TA BACKUP your new E1 prior to unlocking - but as of now, the E1 is not yet supported by TA bak.
the TA-backup partition is helpful for possible relocking bootloader too.
there seems to be no way yet to keep the DRM certs on phone during full reflash, meaning all your payware is gone.
we need an aroma debloater to get rid of Megs of bloatware like chinese KBD (25MB) and such


rooting tool test results:
  • rooting with Androxyde tool = FAILURE
  • bin4ry v33 = FAILURE even with current adb.exe etc. (many error messages)
  • Framaroot = FAILURE
    • adb shell am start -n com.alephzain.framaroot/.FramaAdbActivity --es exploit Gandalf --ei action 0 = ERROR 5
so just use TOWELROOT, it works.



your directory
  • C:\ProgramData\Sony Mobile\Update Engine\db\13744270\blob_fs
(or likewise) has FILE_2809963345 asf. for A'xydes flash-tool SEUS-decrypt and to rebundle into bittorrent files and possibly even reflash this backup later.


  • safe mode: press+hold power while tap off (tap+hold 2 sec!)
    • --> reboot safe mode appears
  • flash mode : vol- plugin USB ..... no light
    • Androxyde's flashing is poss. only with unlocked bootoader (?)
  • fastbootmode : vol+ plugin USB .... blue steady light
    • unlike MTK phones, leave battery inside of E1 phone for reboot into flashmode

urban legend
: 3 vibes master reset via POWERup is not possible.


for SERVICE MENU dial this command: *#*#7378423#*#* i.e. * SERVICE #


UNLOCKING the E1 bootloader (not simlock or netlock): enter command
  • fastboot.exe -i 0x0fce oem unlock 0xKEY
, where KEY is the unlock boot loader key you got via mail by SONY after you gave them you IMEI and name asf.. (if you did...)
once unlocked, the SONY software will cease to update or reflash/repair the phone. use a proper flash-image and Androxyde flashtool instead.
(same with Galaxy: KIES will stop upgrading Galaxys after you used ODIN for manual flashing.)







#############################################
AOSP open source available for E1 via SONY see below ( seems, just 5 models (L, Z, S, ...) are advertised on SONY dev page, which is kind of misleading. Leads you to believe that there is no E1 source code.

open source build 20.0.A.1.8 : http://developer.sonymobile.com/down...ld-20-0-a-1-8/





no USB-to-go it seems
no flashlight
  • OS Android OS, v4.3 (Jelly Bean), planned upgrade to v4.4.2 (KitKat) anytime soon
  • Chipset Qualcomm MSM8210 Snapdragon 200
  • CPU Dual-core 1.2 GHz Cortex-A7
  • GPU Adreno 302 but no bravia engine advertised
  • Sensors Accelerometer, proximity, compass
  • Radio FM radio with RDS (spirit FM not working)
  • GPS Yes, with A-GPS support and GLONASS <-- but Glonass not in all markets
please tag all posts specific to E1 with a tag "E 1" or "E 1 dual" or "xperia E1"

################################################

When updating firmware (from jelly bean 4.2 -> 4.4), will it effect/update TA partition?
No. The TA partition is firmware-version-independent. (contains keys (DRM) etc.)

check the status of the DRM keys by entering *#*#SERVICE#*#* in the dialler, then looking in
Service tests - Security

All the keys should say [Key OK] if they're active. on my E1 I get "No data" (I have unlocked my bl). what is the display on a pristine E1 with locked bl?
The Following 12 Users Say Thank You to mai77 For This Useful Post: [ View ] Gift mai77 Ad-Free
18th April 2014, 02:49 PM |#2  
mai77's Avatar
OP Senior Member
Thanks Meter: 583
 
More
Angry
  • insert SIM card to get rid of language selection screen after each boot up (when pristine after upgrade etc.)
  • PC companion will only reflash ("repair") youre E1 if you have an internet connection. very undesirable.
19th April 2014, 10:35 AM |#3  
mai77's Avatar
OP Senior Member
Thanks Meter: 583
 
More
Question please compare with a new E1 ! thank you!
check the status of the DRM keys by entering *#*#SERVICE#*#* in the dialler, then looking in
Service tests - Security

in KITKAT, running "reset customization" performs full delete with all apps and data killed, except SuperSU in /system ... but /user is deleted .
confirmation dialog says : "ERASE EVERYTHING" || OK ||| no ||
does not say "except superSU" lol


All the keys should say [Key OK] if they're active.

on my E1 I get "No data" (I have unlocked my bl).

what is the display on a pristine E1 with locked bl?
19th April 2014, 10:47 AM |#4  
lozohcum's Avatar
Senior Member
Flag Internety
Thanks Meter: 1,747
 
More
I think Xperia E1 should be placed somewhere else because we have already 4 devices here and incredible amount of spam.
The Following 2 Users Say Thank You to lozohcum For This Useful Post: [ View ] Gift lozohcum Ad-Free
19th April 2014, 10:53 AM |#5  
mai77's Avatar
OP Senior Member
Thanks Meter: 583
 
More
Lightbulb

5 steps to decrypt it all:

1_ downs4

2_ sin
3_ extr_decode
4_ trim\ area\ etc
5_ extr_e4fs


step 1 : downld with xperiafirm 4 files (called raw SEUS-files ?) for E1 , such as:

FILE_280864415
FILE_281405390
FILE_281405393
FILE_281426896

sin: step 2 : use flashtool to decode, extract, dump, decrypt the sin files, you get:

amss_fs_1_S1-MODEMSW-LIVE-B578-PID1-0005-MMC.sin
amss_fs_2_S1-MODEMSW-LIVE-B578-PID1-0005-MMC.sin
amss_fsg_S1-MODEMSW-LIVE-B578-PID1-0005-MMC.sin
cache_S1-SW-LIVE-B578-PID1-0005-MMC.sin
elabel-D2005-row_201403122110.1_20.1.A.0.47_S1-ELABEL-LIVE-B578-PID1-0004-MMC.sin
fotakernel_S1-SW-LIVE-B578-PID1-0005-MMC.sin
kernel_S1-SW-LIVE-B578-PID1-0005-MMC.sin
loader.sin
partition-image_S1-SW-LIVE-B578-PID1-0005-MBR.sin
system_S1-SW-LIVE-B578-PID1-0005-MMC.sin
userdata_S1-SW-LIVE-B578-PID1-0005-MMC.sin


extr_decode: step 3 : use flashtool to further extract from "system" sin part the mountable ext4-file, such as :

system_S1-SW-LIVE-B578-PID1-0005-MMC.ext4
system_S1-SW-LIVE-B578-PID1-0005-MMC.header


trim area etc: don't mess with the trim area parts unless you look for a bricked phone


cust-reset.ta
simlock.ta
update1.xml
update.xml


extr_e4fs: step 4 : I think the raw file is useless

system_S1-SW-LIVE-B578-PID1-0005-MMC.ext4 ######### mount -o loop ... to see files
system_S1-SW-LIVE-B578-PID1-0005-MMC.raw

all stuff from the "4 source files" :

Falcon_S1BootConfig_MiscTA_130820_1730.ta

boot_delivery.xml

dbi_PLATFORM-MSM8210-LIVE-HWID008110E1-SWID12-OEM1-AID4-DEBUG00_S1-BOOT-LIVE-B578-0004-MMC.sin

dbi_S1-BOOT-TEST-B316-0001-MMC.sin

emmc_appsboot_PLATFORM-MSM8210-LIVE-HWID008110E1-SWID09-OEM1-AID4-DEBUG00_S1-BOOT-LIVE-B578-0004-MMC.sin

emmc_appsboot_S1-BOOT-TEST-B316-0001-MMC.sin


rpm_PLATFORM-MSM8210-LIVE-HWID008110E1-SWID0A-OEM1-AID4-DEBUG00_S1-RPMFW-LIVE-B578-PID1-0005-MMC.sin

rpm_S1-RPMFW-TEST-B316-0001-MMC.sin

sbl1_PLATFORM-MSM8210-LIVE-HWID008110E1-SWID00-OEM1-AID4-DEBUG00_S1-BOOT-LIVE-B578-0004-MMC.sin

sbl1_S1-BOOT-TEST-B316-0001-MMC.sin

tz_PLATFORM-MSM8210-LIVE-HWID008110E1-SWID07-OEM1-AID4-DEBUG00_S1-BOOT-LIVE-B578-0004-MMC.sin

tz_S1-BOOT-TEST-B316-0001-MMC.sin

###############################



get everything out of the kernel part, such as ramdisk:



step 1 -elf-extrct

kernel_S1-SW-LIVE-B578-PID1-0005-MMC.elf
kernel_S1-SW-LIVE-B578-PID1-0005-MMC.header

from file :

kernel_S1-SW-LIVE-B578-PID1-0005-MMC.sin


step 2 = elf-extract :



kernel_S1-SW-LIVE-B578-PID1-0005-MMC.elf.3
kernel_S1-SW-LIVE-B578-PID1-0005-MMC.elf.Image


kernel_S1-SW-LIVE-B578-PID1-0005-MMC.elf.ramdisk
##### from "gz" file

kernel_S1-SW-LIVE-B578-PID1-0005-MMC.elf.ramdisk.gz



step 3 = unzip ramdisk : /kernel_S1-SW-LIVE-B578-PID1-0005-MMC.elf.ramdisk:


kernel_S1-SW-LIVE-B578-PID1-0005-MMC.elf ################ use ELF DECODE feature in flashtool
kernel_S1-SW-LIVE-B578-PID1-0005-MMC.elf.ramdisk ######## filesystem for kernel with init.rc asf.


content of ramdisk filesystem:
step 4 = unzip ramdisk further


######## gives you the files to modify in custom ROM


charger
crashtag
data
default.prop
dev
file_contexts
fstab.qcom
init
init.class_main.sh
init.environ.rc
init.mdm.sh
init.qcom.class_core.sh
init.qcom.early_boot.sh
init.qcom.factory.sh
init.qcom.rc
init.qcom.ril.sh
init.qcom.sh
init.qcom.ssr.sh
init.qcom.syspart_fixup.sh
init.qcom.usb.rc
init.qcom.usb.sh
init.rc
init.s1.rc
init.sony.usb.rc
init.target.rc
init.trace.rc
init.usbmode.sh
init.usb.rc
proc
property_contexts
res
sbin
seapp_contexts
sepolicy
sys
system
ueventd.qcom.rc
ueventd.rc





#######################


now that you modded E1 firmware, put it all back together for flashing !

use "bundle" feature in ft to produce FTF ( = .zip ) file for actual flashing.


The Following 2 Users Say Thank You to mai77 For This Useful Post: [ View ] Gift mai77 Ad-Free
19th April 2014, 02:31 PM |#6  
RSXtm's Avatar
Senior Member
Flag Verona
Thanks Meter: 60
 
More
Quote:
Originally Posted by mai77

would be nice to have a new subforum

but so far the admins didnt move

Did you try to root with Cydia Impactor? It works for (almost) all devices
19th April 2014, 05:21 PM |#7  
mai77's Avatar
OP Senior Member
Thanks Meter: 583
 
More
cydia impactor does not root the E1.

the other functions mostly work tho, but androxyde already provides those.
The Following User Says Thank You to mai77 For This Useful Post: [ View ] Gift mai77 Ad-Free
19th April 2014, 06:39 PM |#8  
Member
Thanks Meter: 27
 
More
Quote:
Originally Posted by MrNoob5427

Did you try to root with Cydia Impactor? It works for (almost) all devices

Quote:
Originally Posted by mai77

cydia impactor does not root the E1.

the other functions mostly work tho, but androxyde already provides those.

Cydia Impactor can't root E1, signature bugs unavailable
19th April 2014, 07:35 PM |#9  
Member
Thanks Meter: 18
 
More
I got root for D2005 Xperia E1 !! not your method. @DooMLoRD is trying for this. I've tested with unlocked bootloader
19th April 2014, 10:40 PM |#10  
mai77's Avatar
OP Senior Member
Thanks Meter: 583
 
More
Ok so how did you do it?
19th April 2014, 11:08 PM |#11  
Member
Flag Vienna
Thanks Meter: 22
 
More
Have you tried framaroot already, it's easy and fast. Worked for a friend of mine.

Sent from my GT-I9505 using XDA Premium 4 mobile app
Post Reply Subscribe to Thread

Tags
e 1, e 1 dual, xperia, xperia e, xperia e1

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes