[How-To] Rooted Stock or CM12 with Locked Bootloader for SGP621 using giefroot

[lowtraxx]

Disclaimer: This procedure involves a higher risk than normal to brick your device. If you are not really familiar with flashtool please do not attempt to do this! I am not resposible for bricked devices, World War III or your exploding cats!

Also you acknowledge this points:
- This tutorial includes flashing the system partition of a firmware that is for a different device (Z3 Phone D6603)
- At some point your screen will not display anything
- This will not work on non-LTE versions of the Tablet (SGP611 and SGP612). Instructions for SGP611 can be found there.
- You also will loose all of you data, so please make a Backup.


If you are still sure you want to do this then here are the Steps:
1. Get the firmware ftf (SGP621_23.0.1.A.0.167_CE.ftf) for the SGP621 (for example from here or here)
2. Get a vulnerable firmware ftf (D6603_23.0.A.2.93_Generic_20GLOBAL.ftf) for the Xperia Z3 D6603 (for example from here or here)
3. Get the patched giefroot version for our device here
4. Open Flashtool and select flash. Then select flashmode and press OK
5. Select the 23.0.A.2.93 firmware and select to NOT wipe anything (see Picture 1). In the Exclude mark everything BUT system then start the flash process. If you do something wrong here you ran a VERY HIGH risk of bricking your device permanently
6. Put your device in flash mode (hold volume down and plug the device in) -> Wait until flash is finished and restart your device
7. Start your device - you'll notice black bars on the left and right of the picture
8. It should boot up and display lots of errors, but still function
9. Go into Settings -> Backup and Reset -> Factory data reset and make a factory reset from there (It seems wiping in flashtool does not work for some people)
10. Do initial configuration and select enable adb debug and allow mock location in developer options
11. Select Security -> Unknown Sources (If you do not do this, giefroot will not work)
12. Open a shell/command prompt and try if adb shell works and brings you to your device <- This step is important because here you authorize the device for adb access that you need later, please select to authorize the connected computer permanently when asked to do so

13. Open Flashtool and select flash. Then select flashmode and press OK
14 Select the 23.0.A.2.93 firmware and select to NOT wipe anything (see Picture 2). In the Exclude mark everything BUT kernel then start the flash process. If you do something wrong here you ran a VERY HIGH risk of bricking your device permanently
15. Put your device in flash mode (hold volume down and plug the device in) -> Wait until flash is finished and restart your device
16. Start your device and notice that the Screen stays pitch black, but you can hear the starting Sound

17. Once the tablet has started, go into the folder where you extracted giefroot and launch the install.bat

18. Wait till it is finished and tells you that you achived root (The device will reboot once while rooting, this is normal)
19. Open Flashtool and select flash. Then select flashmode and press OK
20. Select the SGP621_23.0.1.A.0.167_CE.ftf. Select to NOT wipe anything (see Picture 3). In the Exclude mark everything BUT kernel then start the flash process.
21. Put your device in flash mode (hold volume down and plug the device in) -> Wait until flash is finished and restart your device

22. Congratulation. After rebooting you should have a rooted SGP621 with the system of a D6603.
23. Now backup your TA with the tool from here
24. Unlock the bootloader via the instructions from Sony here. Do this only if you have your TA partition backed up!

To install CyanogenMod 12 nightly:

25. Download a CM12 nightly build from here.
26. Unpack the boot.img from the downloaded zip file
27. Go into fastboot mode (press volume up and plug device into computer until led flashes blue).
28. Issue 'fastboot flash boot /path/to/boot.img'
29. Issue 'fastboot reboot'
30. Once the led gets purple press volume down to get into recovery
31. Select install -> install via adb
32. Issue 'adb sideload /path/to/downloaded-zip.zip'
33. Wipe data and cache
34. Reboot and enjoy CyanogenMod

To install rooted Stock:

25. Open Flashtool and select flash. Then select flashmode and press OK
26. Select the SGP621_23.0.1.A.0.167_CE.ftf. Leave everything as it is and start the flash process.
27. Put your device in flash mode (hold volume down and plug the device in) -> Wait until flash is finished and restart your device
28. Get the advanced stock kernel from here, boot into fastboot mode, execute 'fastboot flash boot /path/to/the/Z3TC-stock-twrp.img'
29. Download RicDefeat from here.
30. Reboot the device and while booting once the led goes purple press the volume down key.
31. In the recovery tap on Advanced and Install with ADB and swipe to activate ADB
32. Issue 'adb sideload /path/to/RICDefeat.zip' (If sideloading does not work, put the zip file on your sd card and install it from there)
33. After that is finished, exit the recovery. It will ask you if you want to root. Answer yes and exit.
34. Open Flashtool again and select flash. Then select flashmode and press OK
35. Select the SGP621_23.0.1.A.0.167_CE.ftf. Select to NOT wipe anything (see Picture 3). In the Exclude mark everything BUT kernel then start the flash process.
36. Put your device in flash mode (hold volume down and plug the device in) -> Wait until flash is finished and restart your device
37. Restore your TA Backup and enjoy root on stock.

Congratulations, you now have a rooted device with either stock or CM12

Update Log

Update 1: I verified that Backup of TA works by reflashing it and checking if DRM is still intact in Service Menu.
Update 2: Changed instructions so wiping is done from the booted firmware directly, because for some users it was not possible to flash userdata from flashtool
Update 3: Added step 11 to enable Unknown Sources as otherwise giefroot will not work
Update 4: Added mirrors for the ftf files
Update 5: Added information to step 12 because it is important to authorize the device
Update 6: Added tutorial link
Update 7: Added tutorial for stock and CM12
Update 8: Update cause new giefroot is able to root our kernel

Thanks to zxz0O0 for giefroot and DevShaft for TA Backup

Good Luck and Have Fun

 

[jaime4272]

Your awesome man and thank you I'll give it a try

---------- Post added at 04:12 PM ---------- Previous post was at 03:52 PM ----------

hi boss I don't know if you could make a video on how to do it some of us are not that smart. so if you could please thanks

 

[guybrush2099]

some screenshots for the "worst" steps too

 

[Sean09]

Your awesome man and thank you I'll give it a try

---------- Post added at 04:12 PM ---------- Previous post was at 03:52 PM ----------

hi boss I don't know if you could make a video on how to do it some of us are not that smart. so if you could please thanks

The instructions are very detailed, if you aren't that smart, as you put it, you should not do this process.

 

[lowtraxx]

I don't know if I will have time to make a video, but I will do some screenshots in a few hours once I am back on my PC

 

[frostmore]

rooting

i suggest taking out variables and automate the entire rooting process. i.e creating a .bat file or program.

why?

i dare say there will be noobs who will screw up the process and brick their tablets.then come crying in xda asking for solutions.

we are dealing with a fw frm another device(even though its in the same family) so there are bound to be risks involved.might as well preempt the possibility of dealing with a grief stricken noob and jus write a rooting progam....

 

[jaime4272]

need help with errors

lowtraxx can you tell me what's going on here. I've tried 4 times and I get this error. could you tell what am I doing wrong. I have been following you instructions but I cant get pass the first stage.

 

[lowtraxx]

lowtraxx can you tell me what's going on here. I've tried 4 times and I get this error. could you tell what am I doing wrong. I have been following you instructions but I cant get pass the first stage.

It seems system flashes okay, but the wipe of userdata fails. Could you please try to instead of wiping everything to wipe nothing and only flash system. After that reboot the tablet and you should get a normal bootup with lots of errors. Then go into Settings -> Backup and Reset and make a factory data reset. Then after that finished the tablet reboots and you should get no more errors. Then follow the rest of the steps.

Update: I also changed the tutorial to reflect that problem.

 

[lowtraxx]

i suggest taking out variables and automate the entire rooting process. i.e creating a .bat file or program.

why?

i dare say there will be noobs who will screw up the process and brick their tablets.then come crying in xda asking for solutions.

we are dealing with a fw frm another device(even though its in the same family) so there are bound to be risks involved.might as well preempt the possibility of dealing with a grief stricken noob and jus write a rooting progam....

I will try to do just that once I have the time. I just wanted to share the way as soon as I could so others that are experienced with flashtool (hence the big red disclaimer ) could try it out while I refine the proccess.

 

[infinitylook]

great i will try this!

Hope will succeed. by the way you have mirrors?

 

[lowtraxx]

Hope will succeed. by the way you have mirrors?

Mirrors:
D6603_23.0.A.2.93_Generic_20GLOBAL.ftf
SGP621_23.0.1.A.0.167_CE.ftf

 

[guybrush2099]

great lowtraxx! thank you very very very much it' s a really good workaround!

 

[jaime4272]

hi I have run into a little problem after rooting and trying to flash the spg621 rom back it looks like it doesn't and still on z3 and wifi and Bluetooth wont work any idea?

---------- Post added at 10:31 AM ---------- Previous post was at 09:55 AM ----------

when running on cmd giefroot when it says press any key to continue do I just let it be or do I press any key

 

[lowtraxx]

Follow the giefroot instructions and press a key. For the Wifi and Bluetooth issues; If you flash a update zip you will need to do a factory reset, because otherwise your device could act funny, as configuration data from the D6603 is still there and needs to be erased.

hth

 

[CubicU07]

Working for me!

I've managed to get my device back onto rooted stock firmware with locked bootloader and the DRM keys intact. Created a guide for this here.

 

[jaime4272]

thank you. ill keep trying even thought i'm a hard time but ill get to it thanks

 

[lowtraxx]

thank you. ill keep trying even thought i'm a hard time but ill get to it thanks

Do not despair. It works, as proven by the people in this thread. You will work it out. For flashing to rooted stock use the tutorial from @CubicU07 in this post.

 

[jaime4272]

well I did manage to root even thought I took me some time. but thanks to you lowtraxx I was able to root and backup TA next I will follow his instructions for unloched BL then restore. thanks

 

[bikeaholics]

Hello, did anybody got it work with the 32gb wifi modell? Thanks a lot

 

[lowtraxx]

Working for me!

I also managed to get back to rooted stock via the following steps after obtaining root:
1. Backup TA partition using Backup TA.
2. Return to stock unrooted by flashing the SGP621 rom using FlashTool without changing any of the options.
3. Unlock the bootloader (There are various ways to do this, including using FlashTool, just Google for it).
4. Flash the Advanced Stock Kernel by krabappel2548 using FlashTool in FastBoot mode.
5. Download the SuperSU.
6. Using PRFCreator on the SGP621 rom and the SuperSU zip, create a flashable stock rom zip.
7. Copy the resulting zip onto your device.
8. Boot into TWRP on your device and flash the zip.
9. Once complete, restore the TA partition using TA Backup

Note: Restoring TA partition without going back to stock kernel will soft brick your device, thus the need for steps 5 to 8 to return to stock kernel, while retaining root at the same time. This however, means that you lose custom recovery. So if you prefer having custom recovery over getting your DRM keys back into the device and restoring functionality like X-Reality, then skip steps 5 to 9 altogether..

Update: Unfortunately, after a bit of testing, I realized that the root I ended up with, following steps I listed, was not properly installed. I wasn't able to mount system in R/W mode in Root Explorer nor install BusyBox and it seemed like the only way I could make changes to files in the system was via ADB. Since I have no experience at all in Android programming, I'm striking out steps 5 - 9 until someone finds a solution to this. Sorry for anyone who tried this.

You need to disable Sony's RIC write protection by inserting the proper kernel module. Look here if the precompiled one works for you. With that you should be able to use the stock kernel (TA intact) WITH r/w to system.