Thursday, September 1, 2016

[Kernel] Stock Marshmallow Kernel with Root + DRM Fix

Before starting, your phone must have an unlockable bootloader. If your Xperia M5 have a permanently locked bootloader, unfortunately you can't use this kernel.

As you may already know, Sony enabled verified boot on Xperia M5 starting with the Marshmallow firmwares (30.2.A.0.100 / 30.2.B.0.100) just like on their recent flagships (Z3+/Z5/X Performance) and thus, dd Flasher Minimal won't work anymore because it writes into system partition, and so, dm-verity verification would fail and the phone would refuse to boot.

How it works?
The main issue is dm-verity, which prevents any kind of modification on system partition, so we must disable it. Unfortunately, you need to modify the kernel to disable dm-verity, and to flash a modified kernel, you'll need to unlock the bootloader, wiping your device unique DRM keys in the process. Fortunately, @tobias.waldvogel developed a tool which includes a DRM fix, aimed mostly at the Xperia flagships, but it also works very well with Xperia M5, and thanks to iovyroot/iovySU and the previous exploitable firmwares, we can take a TA Backup without much trouble!

So, in other words, this kernel is exactly the same as the stock from 30.2.A.0.100/30.2.B.0.100 firmware despite the following changes:
• Verified boot (dm-verity) disabled
• SuperSU v2.76 in system-less mode (and a small modification to make it survive factory reset)
• DRM fix library (more about that later)

Requirements
• Your device must have an unlockable bootloader. (you can check that in the Service Menu, on your phone, open the dialer and enter *#*#7378423#*#*, then go to Service Info => Configuration => Rooting Status)
• You must be running one of the supported firmwares (30.2.A.0.100/30.2.B.0.100) before flashing this kernel.
• ADB drivers and fastboot should be installed on the computer.
• (Optional, but highly recommended) A TA backup of your device, taken before unlocking its bootloader, to restore DRM related functions.

Instructions
I've splitted the instructions into three smaller sections. If you already have unlocked the device bootloader, jump straight to the 2nd section.
Backing up the TA partition and unlocking the bootloader
Before unlocking the bootloader, I highly recommend making a backup of the TA partition of your device as it'll allow relocking your bootloader and restoring your device unique DRM keys in the future and it'll also allow restoring full DRM related functionality on your phone through the DRM fix library included in this kernel.

To make a TA backup, your phone should be already rooted (you can do that on Xperia M5 by downgrading to one of supported firmwares and then using iovySU, click here for more details), after that, use Backup TA to make the backup. Also, keep in mind that the TA partition is unique to every device and you should not EVER restore or use a TA backup of another phone, even if it's from exactly the SAME model and variant!. Doing that will hard brick your device, most of times without any way to repair.

Now you can safely unlock your bootloader, start by going to Sony Developer World and follow the instructions to request your bootloader unlock key. Note: Xperia M5 won't be in the list of unlockable phones but you can pick any other device on the list (I picked up Xperia Z5, for example), it'll also work without issues.

After you got your bootloader unlock key, simply turn off your phone, hold the Volume Up key and plug the USB cable. Keep holding Vol Up until notification LED becomes blue. Now, run the following commands to unlock your bootloader (this will wipe all data on internal storage, make sure to backup important data first):
Code:

fastboot oem unlock 0x<your device key>
fastboot reboot

(since internal storage will be wiped, the first boot after unlocking the bootloader will take a while to complete)

Flashing your device key
Note: you need a TA Backup to perform this step, if you didn't make a TA Backup before unlocking the bootloader, skip directly to the next section

On Xperia devices, when you unlock the bootloader, the unique device key get deleted forever and so some proprietary Sony features (X-Reality/Mobile BRAVIA Engine, proprietary camera denoise algorithms, etc) and DRM-related features cease to work. The DRM fix library included in this kernel fully reactivates all DRM-related functionality by loading your device key from an alternate TA Unit (which we'll flash now). If you didn't take a TA backup, you don't have your unique device key and thus the DRM fix library will work in "emulation" mode (on this mode some Sony features like the camera algorithms and Mobile BRAVIA Engine works but Miracast and anything using Widevine won't work).

First we need to extract your unique device key from the TA backup, you can do that with Root Kernel. Extract it somewhere and put your TA backup on the same folder (if you did your backup through iovyroot, it's a file named TA-xxxxxx.img, if you did your backup through Backup TA it's a file named TA.img which will be inside the .ZIP file) then run the following command through Command Prompt (or Terminal if you're on Linux/Mac):
Code:

flash_dk <ta backup image>  DK.ftf
If everything went well, you'll now have a FTF file of around 500 bytes named DK.ftf on the same folder. Using Androxyde's FlashTool, flash this file in your phone through flash mode. An alternative method is opening DK.ftf with WinRAR or 7-Zip to extract the file DK.ta and then using FlashTool Pro Mode (File => Switch Pro then Advanced => Trim Area => S1 => Flash TA File). You only need to do this step once, no need to reflash the key even after flashing other FTF files or doing a Factory Reset.

After that, you're ready to flash the kernel, follow the next step.

Flashing the modified kernel
Now, in the attachments, you'll find two kernels (one for the single SIM and another for the dual SIM variants), download and unzip the kernel that matches your variant, then turn off your device, hold Volume Up and plug the USB cable. Keep holding Vol Up until the notification LED turns blue, then run the following command to flash the kernel:

If you have an E5603, E5606 or E5653:
Code:

fastboot flash boot boot_m5_ss_30.2.A.0.100_nodmv_su_drmfix.img
fastboot reboot

If you have an E5633, E5643 or E5663:
Code:

fastboot flash boot boot_m5_ds_30.2.B.0.100_nodmv_su_drmfix.img
fastboot reboot

And that's it. Upon rebooting you should see SuperSU in the app drawer. And thanks to the DRM fix library by @tobias.waldvogel, if you have flashed your device key you can also do the Security Test on the Service Menu (open the dialer and enter *#*#7378423#*#* to open) to see it still passes, even with the bootloader unlocked!


Frequently Asked Questions
< placeholder >

Credits
The most important piece of this kernel (the DRM Fix library) was made by @tobias.waldvogel. He's also the developer of Root Kernel, which can patch kernels with this library on the fly. Unfortunately, Mediatek kernels have some oddities (like a 512-bytes header at the beginning of the zImage and RAM Disk) that prevents most tools from working without modifications, so I had to edit and patch those kernels manually. The system-less integration of SuperSU on this kernel was done using the official SuperSU installer from @Chainfire despite a minor tweak I did to make root access survive Factory Resets, so, credits (and thanks) to them.



from xda-developers http://ift.tt/2c8tjg8
via IFTTT

No comments:

Post a Comment