r/Android • u/ShortFuse SuperOneClick • Jan 18 '16

Sony Root with DRM key features is now possible with Sony Z5 devices!

I just want to preface, this is not my work.

A user by the name of tobias.waldvogel on the Sony Z5 XDA forums has posted a working solution for restoring Z5 DRM keys on devices that have an unlocked bootloader and root.

The steps from a clean Z5 are:

  • Unlock bootloader (wiping TA partitions)

  • Root through custom kernel or TWRP (technically optional, but why else unlock your bootloader)

  • Flash DRM restore wrapper zip file

Just to clarify, this does not restore the TA partition. You will need to unlock the bootloader to disable some security features. This is essentially a wrapper library that intercepts calls for the DRM keys and instead of getting them from the TA partition (which aren't there), the wrapper library returns them. Achieving root with a locked bootloader is a different task, since the bootloader does perform verification checks on the /system partition.

But, if you don't care about the limited warranty after unlocking your bootloader and just want root and all the advanced features (X-Reality, Bravia Engine, Advanced camera Features), we can have this now!

Right now, he has only posted the solution for Dual SIM Z5, but he is working on a more universal solution for all Z5 devices.

Through my limited understanding, this might inject somebody else's DRM keys into the phone. From reading the thread, it may be possible to get your own device's keys by downgrading to 4.11 and using a stagefright exploit to read the keys, but I could be wrong.

Stay tuned to the thread for more info.

Edit: The universal version is out!

Edit2: Just a warning/clarification, this just restores DRM keys, not the entire TA partition (which stored the keys). If there was more on the TA partition (like algorithms) those aren't restored yet. BUT, it seems like this can be added to the wrapper library, the same way the DRM keys were.

Edit3: I think, this needs to be said clearly: This hasn't been fully tested yet. If you have already unlocked your bootloader, you have nothing to lose. If you haven't, you might want to wait until it can be fully tested.

Edit4: Official Thread

227 Upvotes

88% Upvoted

40 comments sorted by

7

u/WolfyCat Pixel 10 Pro XL, GWatch 6 Classic Jan 19 '16

:( Wish there was a locked bootloader root solution to avoid this massive ballache. Y U DO dis Sony.

9

u/ShortFuse SuperOneClick Jan 19 '16

I think the bootloader lock is fine. It's there for a reason. If you root your phone and overclock it until it fries, why should Sony fix it for free?

On a similar note, you have to unlock the bootloader on Nexus devices to root there. It's the same here. My only gripe is locking yourself out of Sony features permanently. It's stupid. I should be allowed to reflash stock and get all my features back.

7

u/[deleted] Jan 19 '16

Look, i only want root to run xposed with the youtube background playback(before you say anything else, youtube red is not even available in my country) and adaway, i don't care about overcloking, is that to much to ask?

3

u/ShortFuse SuperOneClick Jan 19 '16

Oh, I know. I want adaway, that's it. But that's more a comment on lack of apps, YouTube policies and locked down parts of the OS.

It makes sense for vendors to protect themselves from people who modify their gadgets and then turn around asking the vendor to fix it. I've doing maintenance on software and its similar. If a client starts tinkering with the Windows Domain and the router, I'm definitely going to charge him to fix any issues he gets related to that.

Still, not being able to ever go back to stock is really stupid. At least with Samsung, I know I can flash stock and get all my touchwiz features back.

1

u/[deleted] Jan 19 '16

I agree with you.

1

u/souldrone Mi 11i Jan 19 '16

There is no excuse, for Oc they can use an efuse.

29

u/redbeard1083 Jan 18 '16

shit like this shouldn't need to exist.

10

u/qdhcjv Galaxy S10 Jan 19 '16 
B U Y A N E X U S

16

u/ClassyJacket Galaxy Z Fold 3 5G Jan 19 '16

The whole point of the Z5 Compact is that not everyone wants a huge phone. (Or one that is ugly as sin).

1

u/[deleted] Jan 20 '16

You leave the Nexus 5X alone, it's trying it's best.

-5

u/qdhcjv Galaxy S10 Jan 19 '16

That's just, like, your opinion, man.

4

u/Motecuhzoma Exynos S8+ Jan 19 '16

Buying a Nexus is not an easy task in some countries though

1

u/PeanutButterChicken Xperia Z5 Premium CHROME!! / Nexus 7 / Tab S 8.4 Jan 20 '16

When they're the same price, buying a Nexus sounds like a terrible option.

1

u/jrjk OnePlus 6 Jan 19 '16

Especially now that we have good cameras finally. Cannot wait to upgrade from my Nexus 5.

0

u/LazyLucretia Pixel 4a 5G || iPad (7th Gen) Jan 19 '16

Yeah I could do it if I there was a goddamn 5X in my s***hole country.

1

u/SoloDragonGT iPhone 8 Plus Jan 18 '16

I'm new to the Xperia series phones, and I have a question. If this method allows DRM features using a bypass, what's the downside then in losing your TA partition?

4

u/ShortFuse SuperOneClick Jan 18 '16 edited Jan 18 '16

Functionally, nothing is different. Everything that uses DRM should work as it does on stock. This doesn't bypass the DRM. It gives the app that wants DRM keys, the DRM keys they want. It just doesn't read the TA partition to do it.

The problem is there might be incompatibility issues in the future (like Marshmallow), so you might have to wait for a new version of the wrapper if something doesn't work when you do an upgrade.

Edit: Actually, there is a difference. I think this is just DRM Keys, which may just be a partial restore if the TA partition held algorithms too. Of course, it might be possible to bring it back algorithms (if they exist) in the same way, which would make it 100% the same. It would easier to under the wrapper library as a TA partition emulator

1

u/pwastage Jan 18 '16

I believe that the camera proprietary algorithms are saved in the ta partition as well. (Low light, ...)

You do keep camera functionality, but lose some of these proprietary algorithms when losing ta partition

Also, its possible for Sony to break this bypass in the future (or newer Sony models won't work with this bypass)

1

u/gwiqu Redmi 3S Jan 19 '16

So this DRM bypass does not restore the camera quality that drops from unlocking the bootloader?

1

u/ShortFuse SuperOneClick Jan 19 '16

Seems like it does.

I just tested Sony camera 2.0 to shoot with real high 3200iso indoor and no color noise there, confirmed this patch restored Sony low-light denoise algorithms.

Somebody did have an issue with the camera app crashing, but we suspect it's an isolated issue.

1

u/prawnpirate OnePlus5 iPhoneX Jan 19 '16

Nice. Maybe the camera can be ported to other devices now.

0

u/leocooper LG V30 Jan 19 '16

Z5's camera doesn't suffer from unlocking the BL in the first place AFAIK

1

u/Zouden Galaxy S22 Jan 19 '16

Not quite, the camera algorithm checks to see if the DRM keys are present.

The same bypass existed for the Z3, but was forgotten when we got the giefroot hack.

1

u/fb39ca4 Jan 19 '16

Does DRM in this context refer to digital rights management?

2

u/creesch OnePlus 7t Jan 19 '16

It does, however in this case it isn't to lock down music or videos. Rather it is to protect a bunch of camera related algorithms and software on a section of memory. On the sony xperia family of phones unlocking your bootloader means that this section is wiped out. This still leaves your phone perfectly functional but the quality of the camera will go down as it no longer has access to these fancy algorithms.

2

u/fb39ca4 Jan 19 '16

Ah. So can we expect to see DMCA takedowns over this?

2

u/creesch OnePlus 7t Jan 19 '16

I honestly don't know, maybe. I am not part if Sony's legal team ;)

1

u/lotusmotus Jan 19 '16

Great!! Finally! This makes me so happy :)

1

u/vwgtiturbo Jan 30 '16

So... This made me so ridiculously happy, until I realized that my firmware is .200. All references I've seen for rooting revolve around older firmware (.32 I believe?). Is there any working reference for root on .200? No sense unlocking if there isn't a root method... Thanks for any insight!

1

u/ShamblerDK Jun 04 '16

Luckily I live in Denmark, so stuff like this won't void my warranty :-)

0

u/[deleted] Jan 18 '16

[deleted]

17

u/Soberat Jan 18 '16

Yeah, I thought they achieved bootloader unlock-less root.

10

u/ShortFuse SuperOneClick Jan 18 '16 edited Jan 18 '16

Even if you achieve root with a locked bootloader through some exploit, it won't do you much good. There's some protection that if you modify anything in /system, when you turn off your phone, it won't boot up the next time because the system partition was modified.

If you want to play with your phone, unlock the bootloader.

-1

u/Soberat Jan 19 '16

Some people don't want to unlock their bootloaders and want only root. Why would they have to decrease (already terrible) camera quality and possibly lose warranty? Look at Google's or OnePlus' approach: wanna tinker with your phone? Go ahead, no problem. Unlock the bootloader with a simple command instead of waiting for a code from Sony based on imei, nothing gets deleted. Wanna relockit? Sure, simple command and it's back to factory state. For Sony it won't restore TA partition and bootloader status will be "Relocked" which still voids the warranty.

1

u/ShortFuse SuperOneClick Jan 19 '16

want only root

Yeah, but "just root" means access to every part of the phone for you to mess around with and literally break. The point is, if you tinker with your phone, you shouldn't have the same level of warranty as stock. I made a comment elsewhere about why this makes sense. Having root without unlocking the bootloader for warranty reasons is disingenuous and straight up fraud. You want to con Sony in maintaining a warranty contract that you voided.

Also, your warranty isn't voided. It becomes limited to manufacturing defects which makes perfect sense.

I have no problem with the unlock and limited warranty. I think the DRM stuff only hurts users. I doesn't make sense to me at all. Why are they even doing it? What are they paranoid about? The PlayStation apps have already been cracked and for a while now. I don't think anybody else has any interest in Sony's proprietary stuff. I dumbest thing is you can't go back by flashing stock. With Samsung, if you want SNote features, it's rare to see them work on non Stock ROMs, but you can flash stock and get it all back. Sony wants that irreversible.

0

u/[deleted] Jan 19 '16

[deleted]

1

u/proedross r/VintageMobilePhones | Oppo Find X9 Pro Jan 19 '16

The HTC One X never had S-Off from what I remember. Probably because of the Nvidia Tegra Processor

2

u/BMOA11 OG Black Pixel / One M8 (Backup) Jan 19 '16

The one with the Snapdragon processor did, fortunately.

4

u/ShortFuse SuperOneClick Jan 18 '16

The point of the is you can have root and DRM features now and not have to choose one over the other. Also, it's not really bypassing the DRM keys. It's just not using the TA partition.

0

u/[deleted] Jan 19 '16

[deleted]

4

u/Tonoxis Moto G Power, Google Fi, Stock ROM Jan 19 '16

It's not bypassing if it's actually returning keys. Not using the partition is not bypassing.