FORUMS
Remove All Ads from XDA

How-to: root, keep and backup DRM keys, etc. [KitKat/Lollipops/Marshmallow/etc.]

1,276 posts
Thanks Meter: 668
 
By bilboa1, Recognized Developer on 26th January 2015, 12:58 PM
Post Reply Email Thread
By almost popular demand, making this a thread

This is a how-to root, install recovery, backup drm keys, etc. from scratch in a single thread since finding all threads can be daunting. That's basically all the things you generally want to do when you root the phone (WITHOUT UNLOCKING THE BOOTLOADER).

TL;DR - overview
If you know what you're doing, you really just need to read this part of the post. If you're unsure, read the step-by-step instead.
If you're running Android 6.0.1 MM with firmware .291 (and probably any other future firmware), want to root without unlocking the bootloader more quickly than the method below refer to this post: http://forum.xda-developers.com/z3-c...75-lb-t3418714 (get all 3 zips, rename the kernel zips to .ftf, flash kernel575.ftf with flashtool - reboot - enable dev mode, run bat script - reboot in recovery and flash supersu.zip - flash kernel291.ftf, reboot, done (for future versions you'll want to only flash the kernel from sony's ftf after rooting)

See the FAQ at the bottom in case you need additional help, about mounting /system read-write, fixing the sdcard issues, etc. These are not directly related to the rooting process, but you most likely want to perform these tasks anyway.

Step by step instructions

Read instructions carefully, there's many steps, making this slightly complex.
  1. Ensure you backed up everything you need (files/apps/pictures/etc) first, these will be lost! - YOUR PHONE WILL BE WIPED.
    -- FW DOWNGRADE AND INSTALL WITH FLASHTOOL --
  2. Downgrade fw to 23.0.A.2.93 (Device D5803) or anything prior to 23.0.1.A.5.77 (december fw)
  3. Global:https://mega.nz/#F!wdEG3aiD!Ej2S4hcMKGPgnmGudvAegg (look for 23.0.A.2.93) (or see http://forum.xda-developers.com/show...postcount=2030 for more links if this one no longer works)
  4. Get and install Flashtool at http://www.flashtool.net/index.php
  5. Move the fw into the C:/Flashtool/firmwares directory
  6. Open Flashtool, click on the lightning symbol ("flash device"), select "Flashmode" and click on "OK"
  7. Just select the name of the fw you downloaded and click on "Flash"
  8. Wait for a window to pop up (it may take a few minutes, be patient)
  9. Now everything is ready: turn off your phone
  10. Push the volume DOWN button, connect the USB cable to your PC while still pushing the volume DOWN button
  11. Once the flashing process has started, release the volume button
  12. ) Do not disconnect the USB cable, wait until flash completes (flashtool will indicate when you can unplug).
    -- ROOTING W/ EXPLOIT --
  13. Enable USB debugging on the phone (Settings => About phone => Click 7 times on Android Build to unlock developer options)
  14. Allow mock locations (Settings => Developer Settings)
  15. Ensure you have adb drivers installed (http://support.sonymobile.com/gb/tools/pc-companion/ don't use it to update
  16. Download rooting tool (http://forum.xda-developers.com/devd...10766&task=get) or latest from http://forum.xda-developers.com/cros...-4322-t3011598)
  17. Unzip the rooting tool
  18. Connect phone to your computer
  19. Put phone in airplane mode
  20. Run install.bat from the rooting tool (allow USB debugging when asked on the phone every time, also allow root prompt) and follow instructions from the tool
  21. You should be rooted now, if you get an error "Device not rooted" trying running the tool once more
    -- Backup DRM keys/TA Partition --
  22. Get backup ta tool from https://github.com/DevShaft/Backup-TA/releases
  23. Unzip it!
  24. Ensure phone is still connected (or reconnect it)
  25. Run Backup-TA.bat
  26. Read the information and follow the instructions given by the tool.
    -- Install latest firwmare with root, DRM keys, recovery --
    Alternative 1: pre-made pre-rooted image (for fast internet, slow pc Alternative 2, for newer fw for example - build your own pre-rooted image (fast pc, slower internet:
  27. Get PRFC from http://forum.xda-developers.com/cros...e-pre-t2859904
  28. Get latest fw from http://forum.xda-developers.com/z3-c...d5833-t2906706
  29. Get latest SuperSU zip http://download.chainfire.eu/supersu
  30. Get DualRecovery zip (the flashable zip, not the installer one) from http://nut.xperia-files.com/ you want Z3C-lockeddualrecoveryX.Y.Z-RELEASE.flashable.zip
  31. Start PRFC and add the 3 zip (FTF file is the fw, SuperSU and Recovery)
  32. Click "create" - this will take a while
  33. Copy resulting "pre-rooted" fw to /sdcard0 on your phone (it means copy flashable.zip from the PRFC directory to the "internal storage" directory of the phone)
  34. Get Dual Recovery installer this time, from http://nut.xperia-files.com/ you want Z3C-lockeddualrecoveryX.Y.Z-RELEASE.installer.zip notice how thats 'installer' this time, not the same file as in 30!
  35. Unzip it
  36. start install.bat and follow instructions (hit 1 (allow adb/root on the phone as needed)
  37. You should be in recovery automatically now. (if not, reboot and when the LED change colors push volume UP repeatedly)
  38. Flash the pre-rooted fw (flashable.zip) from the recovery (touch "install zip", select /storage/sdcard1/flashable.zip then confirm install) on the phone, then power off the phone (DO NOT REBOOT)
  39. To power off, go into the "power options" and hit "power off" (dont do "reboot in flashmode" DO power off)
  40. Unplug USB (yes this is required, DO IT)
  41. Open Flashtool and select the non-pre-rooted fw (this is 23.5.A.1.291 for example), but DESELECT system: in "EXCLUDE" make sure you check the checkbox next to "SYSTEM", flash it.
  42. press volume DOWN and plug USB cable while keeping volume DOWN pressed, when flashing starts, stop pressing the volume button
  43. After flash is done and when flashtool tells you to, remove USB cable and start the phone
  44. Congrats and enjoy, you made it to the end! you now have latest + recovery + root and backups of your DRM keys! (and of course all DRM functions enabled)

FAQ
- Some root apps don't work, because /system can't be remounted rw, what's up with that?
  • Sony has a special in kernel protection that disallow remounting /system read-write, even for root. Flash this in recovery (copy it to the sdcard and reboot in recovery with volume UP pressed, then install it): https://github.com/dosomder/SonyRICD.../RICDefeat.zip

- I unlocked my boot loader, or lost my DRM keys some other way AFTER backing up as per above procedure. How to restore?
  • plug USB back in
  • re-enable usb debugging on the phone (Settings => About phone => Click 7 times on Android Build to unlock developer options)
  • Start backup TA again but this time hit restore

- I messed somewhere, phone doesn't boot or work properly, what to do!
  • unplug USB
  • if phone is on, long press the power button+volume UP until the phone turns off
  • go back to step 1 of the how to, follow the how to! Mainly - the howto makes you setup flashtool again, then boot the phone in flash mode with volume key and plugging in the USB cable.

- I forgot to backup DRM keys (backup ta program) but I never unlocked the bootloader, is it bad?
  • nope you're fine, just back them up now

- I really lost my DRM keys, can I recover them?
- I don't want to wipe my phone!
  • Uncheck "data" before downgrading and then before upgrading in flashtool. You will get some errors when downgrading, which will go away when you revert back to .77 at the end of the process
  • This is at your own risk, data still risk being deleted if something goes wrong
  • Depending on the apps, etc. you have, there is a chance that some app would not work properly at the end of the process without a full wipe. If that's the case, you might need to go in settings>applications and "delete data" for that app.

- Some apps can't write to the sdcard!
- I don't have SuperSu on marshmallow+ ?!
  • It just didnt install properly into /system. That's ok. Just install it from the play store - you do have the su binary installed in /system so this will work

- Does this work on my SO-02G (Xperia Z3C Docomo NTT version) ?
- Does this work with lollipop (Android 5.0)?
- Does this work with Marshmallow (Android 6.0)?
- Will this work with Nougat (Android 7.0)?
- Will this always work?! (yes probably)
  • Yes.
  • If when doing the final reboot its stuck on the loading screen the first time, reboot again a last additional time with power + volume UP.

People who did the hard work/references thanks to them:
@istux (fw list, flashtool how to http://forum.xda-developers.com/z3-c...d5833-t2906706)
@xzx0O0 (root exploit: http://forum.xda-developers.com/cros...-4322-t3011598)
@DevShaft (backup ta http://forum.xda-developers.com/show....php?t=2292598)
@serajr (install .77 fw http://forum.xda-developers.com/show...0&postcount=71)
dosomder (kmod for sony's RIC) https://github.com/dosomder/SonyRICDefeat
The Following 272 Users Say Thank You to bilboa1 For This Useful Post: [ View ]
 
 
26th January 2015, 02:56 PM |#2  
Senior Member
Thanks Meter: 90
 
More
Everything worked. Thanks a ton!
The Following User Says Thank You to tocirah1 For This Useful Post: [ View ] Gift tocirah1 Ad-Free
26th January 2015, 03:19 PM |#3  
Senior Member
Thanks Meter: 184
 
More
Thanks for the detailed explanation with links, very thorough and helpful.

MODS PLEASE STICKY THIS THREAD, might just be the most important thread in the Z3 Compact forum.
26th January 2015, 06:10 PM |#4  
Member
Thanks Meter: 44
 
More
Wink
If you're having trouble with step 34 opening a command prompt in the files folder, try pressing shift and right click on or in the "files" folder, you should see "Open command window here"

Unrelated: what's the purpose of steps 40-43 (reflashing non pre-rooted FW)?
The Following 4 Users Say Thank You to adamk7 For This Useful Post: [ View ] Gift adamk7 Ad-Free
26th January 2015, 07:26 PM |#5  
madlive's Avatar
Senior Member
Thanks Meter: 7
 
More
Thanks for this manual, managed to get it work. Although if I start xposed, I get the error it can't mount the system partition. Titanium Backup works perfect. It seems the system partition is read only still? Any solution very welcome. Once again many thanks to the hard working people behind this exploit
26th January 2015, 08:35 PM |#6  
wayne_sk's Avatar
Member
Thanks Meter: 13
 
More
wowz, it's finally here!!!
26th January 2015, 09:47 PM |#7  
Member
Thanks Meter: 44
 
More
Quote:
Originally Posted by madlive

Thanks for this manual, managed to get it work. Although if I start xposed, I get the error it can't mount the system partition. Titanium Backup works perfect. It seems the system partition is read only still? Any solution very welcome. Once again many thanks to the hard working people behind this exploit

Follow this: http://forum.xda-developers.com/show...&postcount=228
The Following 2 Users Say Thank You to adamk7 For This Useful Post: [ View ] Gift adamk7 Ad-Free
26th January 2015, 09:55 PM |#8  
madlive's Avatar
Senior Member
Thanks Meter: 7
 
More
This is why I love this community, thanks mate, that completely fixed it
26th January 2015, 11:45 PM |#9  
OP Recognized Developer
Thanks Meter: 668
 
Donate to Me
More
Quote:
Originally Posted by adamk7

If you're having trouble with step 34 opening a command prompt in the files folder, try pressing shift and right click on or in the "files" folder, you should see "Open command window here"

Unrelated: what's the purpose of steps 40-43 (reflashing non pre-rooted FW)?

its here in case you need to restore DRM keys. for example if you unlocked your boot loader, or messed up something somewhere.

Quote:
Originally Posted by madlive

Thanks for this manual, managed to get it work. Although if I start xposed, I get the error it can't mount the system partition. Titanium Backup works perfect. It seems the system partition is read only still? Any solution very welcome. Once again many thanks to the hard working people behind this exploit

Fastest i found is to flash https://github.com/dosomder/SonyRICDefeat (the zip in there). its an extra protection on the sony kernel that makes /system non-remountable r/w, this module takes care of it. above post method would also work.
The Following 2 Users Say Thank You to bilboa1 For This Useful Post: [ View ]
27th January 2015, 12:47 AM |#10  
Anthony25's Avatar
Member
Thanks Meter: 7
 
More
Hello,
Thanks a lot for this thread, but you made a typo in the step 37, in the command to remount /system: "mount -o remount,rw /system" instead of "mount -oremount,rw /system".
27th January 2015, 01:18 AM |#11  
Pyres's Avatar
Senior Member
Thanks Meter: 115
 
More
Had I known you were going to post such detailed instructions, I would have waited and saved tons of time! :P
Very helpful indeed, kudos for your work
Post Reply Subscribe to Thread

Tags
drm keys, recovery, root

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes