Database Users

[Request] Root for Z3C (D5803) -> Solved

HI @all,
now that we have a FW for the device - is root possible?
All known root methods are not working.
BR
UserX10
Edit:
Solved -> Thanks you DooMLoRD
http://forum.xda-developers.com/z3-...58xx-cwm-based-recovery-6-0-4-7-root-t2890231

Delete.

Jeez.
People haven't even got their hands on the phone yet...
Be patient

Anyone wanna try Framaroot?
http://framaroot.net/index.html

framaroot does not work ...

Ok because I saw it posted on this blog and thought it would work. Strange!

plisk3n said:
Ok because I saw it posted on this blog and thought it would work. Strange!
Click to expand...
Click to collapse
Well, it says "tested on device" and is from 9/4, before the device was even unavailable. I'd be careful that apk isn't something more.

CollinsJ said:
Well, it says "tested on device" and is from 9/4, before the device was even unavailable. I'd be careful that apk isn't something more.
Click to expand...
Click to collapse
Yeah that's also the reason why I decided not to download it, I'll just wait till someone @ XDA finds a way to root the device. It's not like we'll die because our device isn't rooted for x weeks/months.

Weeks/months?! I would die! It's been a day and the amount of things I can't do is driving me nuts!

If you have an unlocked boot loader see what I say at http://forum.xda-developers.com/showthread.php?p=55709585. If you don't I think you'll be waiting for a while - someone needs to find an exploit and write the app/code needed to exploit it. This has become increasingly hard as Android has become more secure - before Towelroot AFAIK the Z1/Z2 was not rootable for a long time. You'd probably be waiting a similar length of time for the next big root exploit.

tilal6991 said:
If you have an unlocked boot loader see what I say at http://forum.xda-developers.com/showthread.php?p=55709585. If you don't I think you'll be waiting for a while - someone needs to find an exploit and write the app/code needed to exploit it. This has become increasingly hard as Android has become more secure - before Towelroot AFAIK the Z1/Z2 was not rootable for a long time. You'd probably be waiting a similar length of time for the next big root exploit.
Click to expand...
Click to collapse
Would it not be helpful to contact Sony themselves? They're increasingly developer friendly, these days. Maybe they'd be willing to offer pointers to root app developers?

mudnightoil said:
Would it not be helpful to contact Sony themselves? They're increasingly developer friendly, these days. Maybe they'd be willing to offer pointers to root app developers?
Click to expand...
Click to collapse
Well I know people at Sony and long story short: if you want root unlock the boot loader. Its as simple as that. You have to understand that while a root exploit looks nice to tinkerers its also a serious security issue which must be fixed - that is why many root solutions also patch the exploit they use after using it.

Does unlocking the bootloader require wiping the phone? I know this is required on the nexus phones. If it requires wipe then its the very first thing I'm doing once I get the phone out of the box.
Sent from my Nexus 5 using Tapatalk

tilal6991 said:
Well I know people at Sony and long story short: if you want root unlock the boot loader. Its as simple as that. You have to understand that while a root exploit looks nice to tinkerers its also a serious security issue which must be fixed - that is why many root solutions also patch the exploit they use after using it.
Click to expand...
Click to collapse
I'm aware of this ... but on the one hand being one of the few if only manufacturers to provide official unlocking for the bootloaders (with the obvious intention of spurring development etc), but on the other actively closing non-simple (i.e. ones requiring a dedicated program) root 'exploits' would seem a little at odds. Is it really that black and white? You'd think it might be in their interests to provide an official complex / secure rooting method.

sublimnl said:
Does unlocking the bootloader require wiping the phone? I know this is required on the nexus phones. If it requires wipe then its the very first thing I'm doing once I get the phone out of the box.
Sent from my Nexus 5 using Tapatalk
Click to expand...
Click to collapse
Yes. It will wipe everything AFAIK - double check with the website.
mudnightoil said:
I'm aware of this ... but on the one hand being one of the few if only manufacturers to provide official unlocking for the bootloaders (with the obvious intention of spurring development etc), but on the other actively closing non-simple (i.e. ones requiring a dedicated program) root 'exploits' would seem a little at odds. Is it really that black and white? You'd think it might be in their interests to provide an official complex / secure rooting method.
Click to expand...
Click to collapse
Your statements contradict themselves. Rooting without unlocking the bootloader needs a security flaw. How can any method which leaves a security hole be secure?
Bootloader unlocking gets around this by letting you control the boot partition of the device so you can disable the "security barrier" that android provides. This is a choice you are explicitly making which is why it is the only "secure" way to root.

Does towelroot work?

MrOeyta said:
Does towelroot work?
Click to expand...
Click to collapse
Unfortunately Towelroot does not work.

I've read some people saying that unlocking the bootloader causes you to lose your DRM keys which apparently would affect software/ camera issues?
Can anyone verify this?

tacocats said:
I've read some people saying that unlocking the bootloader causes you to lose your DRM keys which apparently would affect software/ camera issues?
Can anyone verify this?
Click to expand...
Click to collapse
This is very true. On the z1c I neglected to back up the TA partition. And apparently lost native mirror cast and some camera features when I rolled the device back to stock.
Back up your TA partition before unlocking BL.

dillalade said:
This is very true. On the z1c I neglected to back up the TA partition. And apparently lost native mirror cast and some camera features when I rolled the device back to stock.
Back up your TA partition before unlocking BL.
Click to expand...
Click to collapse
Any idea how this could be done?

[WARNING] Sony confirm - Unlocking bootloader affect camera functionality

Bringing some bad news for those who already unlocked their bootloader.
But sony confirms bad image quality on z3 and z3 compact on unlocked bootloader due to DRM keys (some noise reduction algorithms and other may be lost.
More info on this site
http://www.xperiablog.net/2014/10/0...oader/?utm_source=dlvr.it&utm_medium=facebook
Official info here
http://developer.sonymobile.com/unlockbootloader/unlock-yourboot-loader/
and thread in z3 compact subforum here
http://forum.xda-developers.com/z3-compact/general/loss-drm-keys-t2890936

Just a heads up, this has always been the case with previous Xperias.

I know. I just want to let the people know.
In my opinion, there is no such a ROM worth to broke camera functionality.

If people just want to root their Z3, do they still need to unlock the bootloader?
My Z1 is rooted and the bootloader is still locked.

ssj_jaypee said:
If people just want to root their Z3, do they still need to unlock the bootloader?
My Z1 is rooted and the bootloader is still locked.
Click to expand...
Click to collapse
Only if an exploit is found.

ssj_jaypee said:
If people just want to root their Z3, do they still need to unlock the bootloader?
My Z1 is rooted and the bootloader is still locked.
Click to expand...
Click to collapse
For now, only root methos is with unlocked bootloader. We will need to wait for a while to have proper root with locked bootloader.

Well, The Z3 is not listed as one of the supported devices for unlocking, so no fault of Sony here....

gregbradley said:
Well, The Z3 is not listed as one of the supported devices for unlocking, so no fault of Sony here....
Click to expand...
Click to collapse
But some users confirm they unlocked their Z3 even there is no Z3 on list, as i remember.
http://forum.xda-developers.com/z3/general/bootloader-unlock-t2888735
here

electrash said:
But some users confirm they unlocked their Z3 even there is no Z3 on list, as i remember.
http://forum.xda-developers.com/z3/general/bootloader-unlock-t2888735
here
Click to expand...
Click to collapse
Yes they have unlocked it, but if its not on the supported list and people then unlock anyway then what can you expect? Its not Sony's fault

gregbradley said:
Yes they have unlocked it, but if its not on the supported list and people then unlock anyway then what can you expect? Its not Sony's fault
Click to expand...
Click to collapse
Yes, sure. I didnt understand your point from first reply. Now i understand and i agree with you.

gregbradley said:
Well, The Z3 is not listed as one of the supported devices for unlocking, so no fault of Sony here....
Click to expand...
Click to collapse
anyway Z3 is already supported as i check it yesterday
Sent from my D6653 using XDA Free mobile app

gregbradley said:
Yes they have unlocked it, but if its not on the supported list and people then unlock anyway then what can you expect? Its not Sony's fault
Click to expand...
Click to collapse
So what ? Z3 compact is in the list, but unlocking BL on Z3c broke functionality anyway. See the photos on xperiablog. So it doesn`t make any sense at all...
I`m so upset

BIONZ processing algorithm is replaced with a generic algorithm that reduces the quality. The issue was the same on the Z1 on pre-4.3 firmware.
Sony will fix this later, I hope.

chunlianghere said:
anyway Z3 is already supported as i check it yesterday
Sent from my D6653 using XDA Free mobile app
Click to expand...
Click to collapse
I stand corrected, the Z3 is now in the supported list. It must be a recent addition

gregbradley said:
I stand corrected, the Z3 is now in the supported list. It must be a recent addition
Click to expand...
Click to collapse
but previously when z3 is not in the list, i try z3 compact, which still works. the code given is the same for both.

I don't own a Z3/Z3c but if it uses the TA partition to store the DRM keys, then Backup TA should be used before unlocking the BL.
http://forum.xda-developers.com/showthread.php?t=2292598
However, the Backup TA team did not yet included Z3/Z3c in the list of supported devices (see the above thread).
You may want to ask there if the tool works for Z3/Z3c as well.
If it works, you will be able to restore the DRM keys after.
But, I'd rather wait for a root exploit that doesn't need you to unlock the BL...

That tool requires root so the Z3/Z3c isn't going to be supported until we get a root exploit. Everything depends on that right now.

arturiu said:
I don't own a Z3/Z3c but if it uses the TA partition to store the DRM keys, then Backup TA should be used before unlocking the BL.
http://forum.xda-developers.com/showthread.php?t=2292598
However, the Backup TA team did not yet included Z3/Z3c in the list of supported devices (see the above thread).
You may want to ask there if the tool works for Z3/Z3c as well.
If it works, you will be able to restore the DRM keys after.
But, I'd rather wait for a root exploit that doesn't need you to unlock the BL...
Click to expand...
Click to collapse
It's sure Backup TA would work properly, but the problem is that Backup TA needs root too.
That's why we need an exploit first.

Hello everyone, I was looking at this device as a new toy. However, unlocking the bootloader for me is a must with any device I buy. I have yet to own a Sony. Can anyone tell me how big of a difference is the camera once you unlock the bootloader? Is it a small difference or a major issue? Thanks in advance!

Travisdroidx2 said:
Hello everyone, I was looking at this device as a new toy. However, unlocking the bootloader for me is a must with any device I buy. I have yet to own a Sony. Can anyone tell me how big of a difference is the camera once you unlock the bootloader? Is it a small difference or a major issue? Thanks in advance!
Click to expand...
Click to collapse
On xperia z3 is MAJOR. I would advise to wait for proper root method, and support from TA backup app to backup your DRM first, and then to test your self.
This way, if you dont like it, you can restore your DRM with TA backup.

WANTED: Z3 or Z3C TA dump with DRM keys

I'm trying to extract the DRM keys from the Z5C, but to do so I need a better understanding of the TA partition structure.
By looking at the Z3 TA, or better yet, compare a locked and unlocked Z3 TA, I could possibly figure out which part of the Z5 TA to dump/spoof.
Please PM me if you have a TA dump with DRM keys.

Z3C TA
I've just send you a PM with a link to my ta-dumps from my old Z3C (with working DRM keys).
Greetings
kafisc
nilezon said:
I'm trying to extract the DRM keys from the Z5C, but to do so I need a better understanding of the TA partition structure.
By looking at the Z3 TA, or better yet, compare a locked and unlocked Z3 TA, I could possibly figure out which part of the Z5 TA to dump/spoof.
Please PM me if you have a TA dump with DRM keys.
Click to expand...
Click to collapse

kafisc said:
I've just send you a PM with a link to my ta-dumps from my old Z3C (with working DRM keys).
Greetings
kafisc
Click to expand...
Click to collapse
Thank you!
Now let's see what I can do ...

I believed root was needed to get TA partition ?
BTW there MUST be a way to root this phone with locked bootloader...

Drakorcarnis0 said:
I believed root was needed to get TA partition ?
BTW there MUST be a way to root this phone with locked bootloader...
Click to expand...
Click to collapse
System privileges (uid=1000) is likely enough to get the desired DRM keys.
And system privileges can (possibly) be achieved using a Stagefright exploit.
That is at least my current hypothesis.

I dont miss my DRM keys, my camera isnt that bad and all other functions are working. When the first custom roms come, noone will ask for the DRM keys.

[discussion][root] with [locked bl], vulnerabilities Snapdragon on <March2016 Android

[discussion][root] with [locked bl], vulnerabilities Snapdragon on <March2016 Android
There's an interesting article that got me thinking:
http://buysoft.greatsoftline.com/vu...m-snapdragon-chip-allow-for-easy-root-access/
CVE-2016-0819 vulnerability
Click to expand...
Click to collapse
We discovered this particular vulnerability, which is described as a logic bug when an object within the kernel is freed. A node is deleted twice before it is freed. This causes an information leakage and a Use After Free issue in Android. (UAF issues are well-known for being at the heart of exploits, particularly in Internet Explorer.)
CVE-2016-0805 vulnerability
This particular vulnerability lies in the function get_krait_evtinfo. (Krait refers to the processor core used by several Snapdragon processors). The function returns an index for an array; however, the validation of the inputs of this function are not sufficient. As a result, when the array krait_functions is accessed by the functions krait_clearpmu and krait_evt_setup, an out-of-bounds access results. This can be useful as part of a multiple exploit attack.
Gaining root access
Using these two exploits, one can gain root access on a Snapdragon-powered Android device. This can be done via a malicious app on the device. To prevent further attacks that may target either the patched vulnerabilities or similar ones that have yet to be discovered, security experts are not disclosing the full details of this attack.
Trend Micro researchers will disclose the full details of exactly how to leverage the bugs at the upcoming Hack In The Box security conference in the Netherlands to be held in late May 2016.
Click to expand...
Click to collapse
Once updates got applied,
flashing back via XperiFirm, exploit that vulnerability and gain root
What do you think ?
langeveld024 said:
It was already found.
.11 fw is vulnerable at several points, however, rooting is not possible due to dm-verity and Sony ric which prevents modify system.
If u search this thread you'll find more about it.
Click to expand...
Click to collapse
bummer
Pandemic said:
We are genius in Z3 forum !!!!
http://forum.xda-developers.com/showthread.php?p=65856403
“Sent From MWE V9.5.0 On My Z3”
Click to expand...
Click to collapse
There's progress on the Z3 front

Poor Sony's fan waiting root for locked BL so long, many 6.0 phone have got root already,

Gaining root with locked BL is actually great security risk, not something one should be proud of.

Saw this?
http://forum.xda-developers.com/showthread.php?p=65861217
Post 1677 by Pandemic
It looks promising, the Z3 just got Root on LB
Thx. Wolfbreak the developer since the X10i
Sent from my E6653 @ XDA Portal

Duvel999 said:
Saw this?
http://forum.xda-developers.com/showthread.php?p=65861217
Post 1677 by Pandemic
It looks promising, the Z3 just got Root on LB
Thx. Wolfbreak the developer since the X10i
Sent from my E6653 @ XDA Portal
Click to expand...
Click to collapse
Is it possible to port this root method on M with LB for z3 ????? They have the same problem with DRM keys like us.... But they win.
http://forum.xda-developers.com/z3/...oid-6-0-mm-t3337357/post65856403#post65856403
thanx.

I don't think there will be a way to root z5 with LB unfortunatelly.

The method there needs a custom recovery installed which is possible on Z3 due to an exploit used on an early firmware. Since there's no such achievement yet on the Z5 you will already fail with the first task and any other following.
Since they've made their success public before the final firmware is out Sony has enough time to fix everything else.

some people say the z5 and z3 use the same hardware and could technically use the z3 rom to root the z5.
however, the heading of this post should change. i thought we finally have root on the z5 family only to find out that it's just a post talking about root on the z3.....

zacharias.maladroit said:
There's an interesting article that got me thinking:
http://buysoft.greatsoftline.com/vu...m-snapdragon-chip-allow-for-easy-root-access/
Click to expand...
Click to collapse
I didn't know those information were to be disclosed in May, instead of being kept secret. Good news from our point of view...
I think that, if the vulnerabilities could be exploited also on the Z5 line (every exploit needs to be verified practically), then we could gain temporary shell root/system priviledge to backup the TA partition. If i remember well, we cannot achieve permanent root on locked bootloader, as the /system protection SONYric is embedded in the stock kernel image.
We would need some mobile flashing tool like this: http://forum.xda-developers.com/showthread.php?t=2334554

I think i misunderstood. The problem is the Verified Boot ("dm-verity") check introduced in Z3+/Z4 and Z5 line.
We cannot get permanent root because this would involve modified kernel (to write on /system partition), which would not boot using a Locked bootloader because of Verified boot process that uses an OEM key.
The whole process is described here: https://source.android.com/security/verifiedboot/verified-boot.html
Google intention is (or was) to allow the boot process, after a red warning, if the verification of the kernel image didn't succeed on a locked bootloader... But Sony devices bootloop without showing any warning and so the user is not allowed to continue (source: https://androplus.org/Entry/843/ thanks to the developer).
So, on locked bootloaders, it's impossible to have permanent root apps, xposed ,.... unless someone finds a hole in the bootloader (someone found a hole in Motorola's bootloader) or the OEM key gets copied and is used to sign modified firmwares...just exciting dreams.
Anyone, correct me if i'm wrong.

ninestarkoko said:
I think i misunderstood. The problem is the Verified Boot ("dm-verity") check introduced in Z3+/Z4 and Z5 line.
We cannot get permanent root because this would involve modified kernel (to write on /system partition), which would not boot using a Locked bootloader because of Verified boot process that uses an OEM key.
The whole process is described here: https://source.android.com/security/verifiedboot/verified-boot.html
Google intention is (or was) to allow the boot process, after a red warning, if the verification of the kernel image didn't succeed on a locked bootloader... But Sony devices bootloop without showing any warning and so the user is not allowed to continue (source: https://androplus.org/Entry/843/ thanks to the developer).
So, on locked bootloaders, it's impossible to have permanent root apps, xposed ,.... unless someone finds a hole in the bootloader (someone found a hole in Motorola's bootloader) or the OEM key gets copied and is used to sign modified firmwares...just exciting dreams.
Anyone, correct me if i'm wrong.
Click to expand...
Click to collapse
Personally, not having permanent root on a locked bootloader is fine with me. I just need temp root to back up TA partition.
I am pretty sure the rest of the Z5 owners who are not yet unlock are waiting to backup TA partition before doing anything else.
there already is a way to restore credentials to use the bravia engine and the sony goodies. but ultimately, people would like to keep their TA keys (something which they paid for) instead of losing them once they unlock bootloader.

frostmore said:
Personally, not having permanent root on a locked bootloader is fine with me. I just need temp root to back up TA partition.
Click to expand...
Click to collapse
Me too

ninestarkoko said:
I think i misunderstood. The problem is the Verified Boot ("dm-verity") check introduced in Z3+/Z4 and Z5 line.
We cannot get permanent root because this would involve modified kernel (to write on /system partition), which would not boot using a Locked bootloader because of Verified boot process that uses an OEM key.
The whole process is described here: https://source.android.com/security/verifiedboot/verified-boot.html
Google intention is (or was) to allow the boot process, after a red warning, if the verification of the kernel image didn't succeed on a locked bootloader... But Sony devices bootloop without showing any warning and so the user is not allowed to continue (source: https://androplus.org/Entry/843/ thanks to the developer).
So, on locked bootloaders, it's impossible to have permanent root apps, xposed ,.... unless someone finds a hole in the bootloader (someone found a hole in Motorola's bootloader) or the OEM key gets copied and is used to sign modified firmwares...just exciting dreams.
Anyone, correct me if i'm wrong.
Click to expand...
Click to collapse
I remember few month ago... Chainfire was working with a new form of root, it doesn't modifies system partition. This solution doesn't help us???? We don't want lose our sony's features. :silly:

uripiruli said:
I remember few month ago... Chainfire was working with a new form of root, it doesn't modifies system partition. This solution doesn't help us???? We don't want lose our sony's features. :silly:
Click to expand...
Click to collapse
That's the systemless root, where root is achieve without changing the system file.
but this kind of root requires modified boot image, which cannot be done without unlocked bootloader....
root is becoming harder to achieve as the years pass. with samdung introducing their crap knox and sony with dm-verify etc etc.. android is fast becoming another apple where everything is being locked up and end users are forced to adhere to the way their phones are "supposed" to be used.

F U C K U P Sony. Why we couldn't own our phone features we paid for. Give our freedom to use our own phone

devilmaycry2020 said:
F U C K U P Sony. Why we couldn't own our phone features we paid for. Give our freedom to use our own phone
Click to expand...
Click to collapse
here's an article on the subject http://www.xda-developers.com/a-look-at-marshmallow-root-verity-complications/
explaining your and my feelings (i really understand you).
If you want, you can comment there but please stay in topic here.

ninestarkoko said:
here's an article on the subject http://www.xda-developers.com/a-look-at-marshmallow-root-verity-complications/
explaining your and my feelings (i really understand you).
If you want, you can comment there but please stay in topic here.
Click to expand...
Click to collapse
ok,thanks for told me about that. i'll be more attention about my words next times

Maybe developer Wolfbreak from the Z3 forum can help us?
Sent from my E6653 @ XDA Portal

Samsung Galaxy s7 and the edge exynos version just got root, wtf Sony --'.

I think the main thing about Samsung phones is they have a recovery partition where as sony do not.
Sent from my Xperia™ Z5 using Tapatalk

Unlock bootloader, it's safe?

Hey, did Unlock bootloader damage your phone?
In z3c would lose the quality of the camera and Bravia mode.
Is now possible to do a Roth without fear?

FIFAR4 said:
Hey, did Unlock bootloader damage your phone?
In z3c would lose the quality of the camera and Bravia mode.
Is now possible to do a Roth without fear?
Click to expand...
Click to collapse
Give this a read as it answers your questions. https://forum.xda-developers.com/crossdevice-dev/sony/root-root-stock-firmware-modern-sony-t3558904

FIFAR4 said:
Hey, did Unlock bootloader damage your phone?
In z3c would lose the quality of the camera and Bravia mode.
Is now possible to do a Roth without fear?
Click to expand...
Click to collapse
you will face the same issue(s), contrary to the guide posted above I would encourage you to backup the TA partition, you can not use the tool in the described in the guide called iovyroot for X compact you will need to use the dirty cow exploit
EDIT: Btw. Flashtool can also do the dirty cow exploit and retrieve the backup.

and although the also guide goes on about nobody knows what widedevine is anyway bla bla.
I can tell you its used for; drm video like amazon prime, Netflix, hbo, etc. so if you plan on using most drm protected video services on your phone, its a thing to also take into consideration (if used any of them on a pc you probably already battled a bit with widevine heh). I am pretty sure the genesis kernel 'fixes' or emulate this without the real drm key from a backup, (I did not check before restoring my own) which would make it the only one on XC atm.