Database Users

{all-in-1 guide} root - recovery - custom rom - kernel- xposed

Well, in this guide I will try to concentrate all the process from a Stock Z3 (D6603) to a fully rooted, unlocked bootloader, custom rom and recovery, modded kernel and xposed firmware.
AS ALWAYS I WONT BE RESPONSIBLE FOR ANY DAMAGE, WAR, OR DEAD UNICORNS. PROCEED ON YOUR OWN RESPONSABILITY
Pre-process drivers:
Get fastboot drivers from here: https://mega.co.nz/#!upQkWCpA!BCvvsQR6Ee1gfmzAAGCeIMmFek2AaM0r_9HGWVNw8tM
Get adb+drivers from here: https://mega.co.nz/#!upQkWCpA!BCvvsQR6Ee1gfmzAAGCeIMmFek2AaM0r_9HGWVNw8tM
Z3 Official Drivers from here: https://mega.co.nz/#!v8JkkZAQ!w9ERWMs0L1UmWf_N3oCT4JgFdfU9NUFT7Wjv7D_bBh0
First of all you need to gain root privileges:
Download stock firmware (FTP format) https://mega.co.nz/#!D5ZXmJKZ!XWD6dae-NwKECGctrFsetFlODcf6EQMMYf22fCPHo2g​Download FlashTool (To flash FTF format) https://mega.co.nz/#!D5ZXmJKZ!XWD6dae-NwKECGctrFsetFlODcf6EQMMYf22fCPHo2g​Download GiefRoot and unpack it https://mega.co.nz/#!yxQFQbzK!KeA0u1i6KwKetj1aAaSLUZ_qiih1N0uox0GGes700J8​Flash the stock firmware using flashtool, click on the bolt, select the FTF file downloaded previously and follow instructions​Note: The screen says press back+plug USB. It is not back button but VOL+ Button​
Now skip configuration process, you will loose it all so it is not necessary but nothing happens if you want to waste your time.​Once skipped go to Settings > About Phone and tap 7 times on Build number to enable developer options.​Under developer options enable Usb Debugging and Mock Locations​Now, in settings enable unknown sources and disable verify apps ​Put your phone in Airplane Mode​Connect your phone to the computer and open the install.bat inside the folder of GiefRoot​Note: Probably a pop-up will show in your phone asking to allow USB debug, check the "Always allow..." and press OK​Now follow instructions on the CMD screen​Note: It will probably fail the first time, just start again from install.bat point​
Now let's install a recovery (it wont be the final recovery because this is changed by installing roms, we will stick on FOTA one. A few steps below.
Download ES File Explorer: https://mega.co.nz/#!j0xxESqT!k1VHSKi86lBgdh8NPbxmb3Q9FKFWDup7gAt-_uWkWCU​Download ZU Recovery: https://mega.co.nz/#!Ll4UVLTS!A8w4NeleaxjXBLQdUbZLtzGZRpPefX71rp27aCNV_mk​Enable root and mount system r/w.​Extract the ZU Recovery and open install.bat​Choose option 1 and follow instructions.​Note: You will have a new App named NDR Utils, use it to reboot the phone.​
Let's backup DRM keys:
Download TA-Backup: https://mega.co.nz/#!v0wgDCRR!xJBrmo1FfdvQQcFzK6ZO4dEfUi1YLaNGEl8XMaKu18s​Extract TA Backup​Run Backup.bat​Keep the file generated well saved.​
Now, we will unlock bootloader:
I won't explain this point, I will recommed you follow this guide from the Official Sony's web: http://developer.sonymobile.com/unlockbootloader/unlock-yourboot-loader/ it is very clear and includes all checks needed.
Now let's install a custom ROM to proceed to FOTA recovery:
Download PacMan custom ROM from here: http://forum.xda-developers.com/z3/development/rom-pac-rom-lp-mr1-beta-1-t3099454​Flash it as usual​Let it boot and proceed to next step​
Now let's install the FOTA recovery:
Download FOTA recovery image: https://mega.co.nz/#!38xxBZZJ!2jwbChc-XFlilltodA7R0VQzQTnbf8EPbUokR38C4Yg​Once the ROM has booted put your phone in fastboot mode:​
Code:
adb reboot fastboot
Or turn it down, hold vol+ and plug the USB.​Then flash the FOTA recovery:​
Code:
fastboot flash recovery <downloaded.img>
Then reboot your phone:​
Code:
fastboot reboot
Now we can proceed to install PacMan ROM again (in case you lost it while flashing FOTA):
Download PacMan custom ROM from here: http://forum.xda-developers.com/z3/development/rom-pac-rom-lp-mr1-beta-1-t3099454
You can use this kernel along this ROM too:
http://forum.xda-developers.com/z3/orig-development/kernel-m5-kernel-t3045319
Get the permissive version in order to allow xposed to run.
xposed: I am testing it right now, I will explain it as soon as I see it is stable.

In your guide you use 'TFT' instead if the correct term of 'FTF'
They are FlashTool Files, hence the FTF

gregbradley said:
In your guide you use 'TFT' instead if the correct term of 'FTF'
They are FlashTool Files, hence the FTF
Click to expand...
Click to collapse
Thank you for the correction. Appreciate it.

im on D6653 and i tried using the root method.... after rebooting, my phone has alot of errors and the home screen is not working. there is nothing on the screen apart from the wallpaper and the 3 soft buttons at the bottom. i can't go to setting. what should i do?

togcbu said:
im on D6653 and i tried using the root method.... after rebooting, my phone has alot of errors and the home screen is not working. there is nothing on the screen apart from the wallpaper and the 3 soft buttons at the bottom. i can't go to setting. what should i do?
Click to expand...
Click to collapse
Flash the stock again and be carefull not not to flash D6603 firmware to D6653.

[GUIDE] Sony Xperia Z5 - UNLOCK / ROOT / TWEAKS - OS 5.1.1 / 6.0

[GUIDE] Sony Xperia Z5
DISCONTINUED - SEE NEWS !
Last update: 20.06.2016​
This guide will help you to root your phone, install new firmwares, unlock your bootloader and much more. Its splitted into 3 sections: StockRom, CustomROM and Tweaks so you should find things easily. I think if you understood this guide you can easily flash different firmwares, kernels and so on. And now - have fun
NEWS
I have to much work to do at the moment to continue this guide. But, the main work is done, now its all about updating the links. If there is something remarkable new, I will add it to my guide.
20.06.2016
- updated links
- minor changes
23.04.2016
- updated download links
- added custom rom (CyanogenMod13)
- some small changes
09.04.2016
- I'm very busy at the moment (exams and hard work). So I cant help you guys that much and cant try new kernels and that kind of stuff Plese ask @gm007 or @zacharias.maladroit if you have problems. I will come back as fast as I can
- updated download links
28.03.2016
- updated download links
12.03.2016
- Android 6.0 compatibility check
- updated download links
- graphical revision
14.02.2016
- updated guide to make it more understandable
QUESTION & ANSWER
Which devices are supported by this guide?
- Sony Xperia Z5
- Model number: E6653 / E6603 (for other models use different kernel)
- OS version: Stock Xperia Android 5.1.1 / 6.0
Whats important to know before I start?
- I´m NOT responsible for any damage.
- Keep in mind that unlocking the bootloader can void your warrenty.
- Save your data, all settings and files will be deleted during this process.
- READ THE ENTIRE GUIDE FIRST!
[GUIDE] GENERAL
FASTBOOT
1) POWER OFF phone
2) Hold VOLUME UP
3) Connect to PC via USB
4) LED turns blue
FLASHMODE
1) POWER OFF phone.
2) Hold VOLUME DOWN
3) Connect to PC via USB
4) LED turns green
RECOVERY
a) You can enter TWRP while booting. If the LED turns yellow, hold VOLUME DOWN till it gets orange.
b) Use this command in Minimalistic ADB and FASTBOOT to reboot to recovery:
Code:
adb reboot recovery
BOOTLOOP / EMERGENCY POWER OFF
1) Hold POWER OFF and VOLUME UP
2) Device vibrates 3 times
DEVELOPER MODE AND UNNOWN SOURCES]
1) settings -> about phone -> touch build number several times
2) settings -> developer options -> enable USB debugging
3) settings -> security -> enable Unknown sources
PC PERMISSIONS
1) Run Minimalistic ADB and FASTBOOT and FLASHTOOL with admin permissions.
2) Use USB 2.0 ports, sometimes 3.0 ports doesnt work.
[GUIDE] StockROM
# BUGS / ISSUES
E6653_32.1.A.1.163
- camera apps (AR Effect,...) do force close
- filesystem (external SD card) does not refresh automatically, so you cant transfer files you copied to sd card via MTP to PC. Solved via restart. --> also on STOCK ROM
# DIRECT DOWNLOAD LINKS
E6653
Kernel
Z5_AndroPlusKernel_Permissive_v30 (for firmware .163 and .185)
Z5_AndroPlusKernel_Permissive_v31 (for firmware .224)
Recovery
twrp-3.0.2-0-E6653-20160417.img
SuperSu
SuperSU (beta but stable)
# DOWNLOAD LINKS
Windows programs
Sony PC Companion
Minimal ADB and Fastboot
Flashtool + patch file
µTorrent (for downloading Flashtool)
Android
AndoPlusKernel
TWRP
# GUIDE
BOOTLOADER STATUS
The bootloader loads the kernel. If unlock isnt allowed, the bootloader will prevent loading a custom kernel.
1) type *#*#7378423#*#* into dialer / phone app
2) service info --> configuration --> rooting status
3) if bootloader unlock allowed says YES, you can continue. If bootloader unlock isnt allowed you CAN NOT root your phone.
INSTALLING PROGRAMS
Flashtool
1) install µTorrent
2) download torrent file from Flashtool website
3) run downloaded torrent file via µTorrent
4) download Flashtool via µTorrent
! You can close and or delete µTorrent now, you will not need it anymore
5) install Flastool
6) open install directory from flashtool and replace x10flasher.jar with new patch
OTHER
1) install all other programs
INSTALL / CHECK DRIVERS
Windows 7 and lower
1) open Flashtool install directory
2) open driver folder
3) run Flashtool-drivers.exe
4) install Flashmode and Fastboot drivers
Windows 8 and higher
1) restart computer with digital driver signature disabled (you have to do this every time you restart your pc)
http://www.howtogeek.com/167723/how...8.1-so-that-you-can-install-unsigned-drivers/
2) open Flashtool install directory
2) open driver folder
3) run Flashtool-drivers.exe
4) install Flashmode and Fastboot drivers
! There are no Z5 drivers yet, that’s why you need Sonys PC Companion!
! Flashtool drivers were updated, try the new Z5 drivers before installing Sony PC Companion.
Sony PC Companion
1) run Sony PC Companion
2) connect your Xperia Smartphone
3) wait till it has been detected
4) close Sony PC Companion, you dont need it anymore
ADB driver check
1) enable Developer options and Unknown sources
2) run Minimal ADB and Fastboot
3) type
Code:
adb devices
4) allow dialog on your phone
5) check if your device is shown in command window
fastboot driver check
1) run Minimal ADB and Fastboot
2 put device in FASTBOOT mode
3) type
Code:
fastboot devices
in Minimal ADB and Fastboot
4) check if your device is shown in command window
! When connecting phone in flashmode or fastboot additional drivers will be installed automatically.
! Installing drivers twice can solve problems.
UNLOCK BOOTLOADER
1) open Flashtool
2) click on BLU (Bootloader Unlock)
3) follow the instructions shown by Flashtool
4) you will be forwarded to a Sony website
5) follow the instructions there
6) at the end you will receive a key
7) save this key carefully!
8) enable Enable OEM unlock in developer options
9) copy KEY into Flashtool prompt and click unlock
! You can try to use Flashtool for unlocking first, or continue with step 10.
10) open Minimal ADB and Fastboot
11) your phone has to be in Fastboot mode
12) check if your phone is shown by
Code:
fastboot devices
13) enter the following code:
Code:
fastboot –i 0x0fce oem unlock 0xKEY_FROM_SONY
14) reboot (that can take a long time, so dont worry)
DOWNLOAD XPERIA FIRMWARE - OPTIONAL
If you want to update, upgrade or reset your ROM.
1) open Flashtool
2) click on XperiFirm
3) downloading…..
4) in XperiFirm select your device then choose your preferred firmware (e.g. Z5 --> E6653 ---> Customized DE --> 32.0.A.6.200 R12B)
5) in the right column double click the latest firmware and start download
6) Unpack automatically has to be checked
7) after downloading close download window and XperiFirm
8) now Flashtool should start doing things
! You can identify your phone model by: Settings -->About phone--> Diagnostics
FLASH NEW FIRMWARE - OPTIONAL
If you want to update, upgrade or reset your ROM.
1) in Flashtool click on Flash device and choose your firmware
2) under "Wipe", check all (APPS_LOG, DIAG, SSD, USERDATA)
3) click flash and follow the instructions
4) after successful installation reboot phone (that can take a long time, so dont worry)
! You can flash a new ROM without unlocking your bootloader.
FLASH KERNEL
The kernel has direct control of the hardware.
1) download latest Kernel from download section (AndroPlusKernel is only for E6653 models)
2) extract ZIP
3) put boot.img from zip into your root directory from Minimal ADB and Fastboot
4) put phone into fastboot mode
5) run Minimal ADB and Fastboot and check with
Code:
fastboot devices
6) type in:
Code:
fastboot flash boot boot.img
7) restart phone and look if its working
! If you end up in a bootloop with the LED flashing 3-4 times try to flash Kernel and Recovery again. If this doesnt help, reflash firmware, kernel and recovery.
FLASH RECOVERY
The recovery is something like the boot menu you may know from windows. Its mainly used to install programs and apps.
1) download latest TWRP from download section
2) put twrp.img into your root directory from Minimal ADB and Fastboot
4) put phone into fastboot mode
5) run Minimal ADB and Fastboot and check with
Code:
fastboot devices
6) type in:
Code:
fastboot flash recovery twrp.img
! You can rename twrp image to twrp.img or something shorter if you want.
7) after the first boot - do a reboot into recovery. Otherwise the partitions won't be mounted correctly & flashing will run into trouble. It takes several seconds (or a few minutes) to reboot into recovery - but then you're good to go.
ROOT
Some apps need more permissions than normal. You can compare root with administrator rights on windows.
1) download UPDATE-SuperSU-v2.67.zip
2) copy UPDATE-SuperSU-v2.67.zip to your internal memory
3) enter TWRP
4) click Install
5) navigate through folder structure
6) tap UPDATE-SuperSU-v2.67.zip
7) "Swipe to confirm flash"
8) reboot
RESTORE DRM KEYS
Unlocking the bootloader disables a partition on your phone where software keys are saved. Without this keys xReality, BIONZ, audio processing arent available. This program will restore this features.
! Take a look if xReality is already working before installing DRM keys.
1) download DRM RESTORE (drmrestore.zip) from download section
2) copy drmrestore.zip to your external sd card
3) enter TWRP
4) click Install
5) navigate through folder structure
6) tap drmrestore.zip
7) "Swipe to confirm flash"
8) reboot
! Unfortunately, there is no way to save the original TA partition at the moment.
[GUIDE] CustomROM
# CyanogenMod 13_Alpha for E6653 and E6603
CyanogenMod is a free, community built, aftermarket firmware distribution of Android 6.0 (Marshmallow), which is designed to increase
performance and reliability over stock Android for your device.
### XDA Z5_CyanogenMod 13 Link ###
# AromaROM with Installer for Z5 E6853 / E6883 / E6653
AROMA is a custom ROM with nice tweaks, but it has some serious bugs. I used it for 2 month and there are several issues: random reboot, screen turn off during calling and does not turn on again, problems with notification bar, ... .
### XDA ROMAur Link ###
1) install stock lollipop rom
3) for E68xx models install recovery and kernel for your device
4) For E66xx models install twrp-2.8.7.0-E6653-20151130_material.img and kernel for your device
5) copy ROMAur to your external sd card
6) enter recovery
7) make a full wipe (Wipe --> Factory reset)
8) install ROMAur
9) Reboot
[TWEAKS]
XPOSED
ONLY FOR 5.1.1: When you want to install Xposed you have to deodex your system or install an already deodexes ROM. Without this procedure the camera and other apps wont work. Use this guide to solve this: http://forum.xda-developers.com/crossdevice-dev/sony/z4-z5-z5c-fix-camera-fc-installing-t3246962
XDA Thread: http://forum.xda-developers.com/showthread.php?t=3034811
1) download xposed-v85-sdk23-arm64.zip and XposedInstaller_3.0_alpha4.apk [Android 6.0 versions]
2) copy xposed-v79-sdk23-arm64.zip and XposedInstaller_3.0_alpha4.apk to your internal memory
3) enter TWRP
4) click Install
5) navigate through folder structure
6) tap xposed-v79-sdk23-arm64.zip
7) "Swipe to confirm flash"
8) reboot
9) install XposedInstaller_3.0_alpha4.apk
10) reboot
useful Xposed Moduless
APM+
Xperia / AOSP NavBar Buttons
OGYoutube + OGYoutube Xposed Login Fix
Flat Style Colored Bars
DISABLE SmallApps
SmallApps is that little bar in the overview screen.
1) power on phone
2) unlock your phone (open homescreen)
3) open Minimal ADB and Fastboot
4) type:
Code:
adb shell
pm hide com.sony.smallapp.launcher
pm hide com.sony.smallapp.app.widget
exit
5) after this, type:
Code:
adb reboot
! If you know what youre doing, you can simply delete all the SmallApp stuff via ROOT Uninstaller.

Thanks for quite a nice guide.
I have done rooting on various devices but this seems to be most complicated ever. [emoji14]
Sent from my E6683 using Tapatalk

It has been before this guide. Basically what I did was unlocking the bootloader, booting recovery, flashing kernel, flashing root, wipe, restore DRM fake, done.
Firmware wasn't necessary for me and I've made bad experiences with alternate firmwares / radios and so on in the past.

Hi. Do I have to backup my TA partition ?

there no way to backup your TA partition hopefully for now.

How to increase volume of both speakers
I have rooted z5 but don't know how to edit mixer path.xml

Siudzix said:
Hi. Do I have to backup my TA partition ?
Click to expand...
Click to collapse
Actually there is no need for it, imho. The fake DRM keys are doing a really good job. X-reality back, after picture processing back. It's also currently not possible to backup them afaik.

DeathStroke said:
Thanks for quite a nice guide.
I have done rooting on various devices but this seems to be most complicated ever. [emoji14]
Sent from my E6683 using Tapatalk
Click to expand...
Click to collapse
Mate I see you have Z5 E6683 which is dual sim. Were you able to get your phone rooted using this guide?
Many thanks.

I have XPERIA Z5 Dual Sim (E6633) - will this guide work ?

Siudzix said:
I have XPERIA Z5 Dual Sim (E6633) - will this guide work ?
Click to expand...
Click to collapse
Yes and no. You need a different kernel and mybe recovery. Everything else is the same. I will include a link in my guide if I find a working kernel.

Rooting Z5
Hi all,
Shall i root the phone without unlocking the Bootloader.I dont want to Unlock the bootloader.So please advise me is this root method is work on Locked Bootloader.
Thanks in advance

ramprasaathks said:
Hi all,
Shall i root the phone without unlocking the Bootloader.I dont want to Unlock the bootloader.So please advise me is this root method is work on Locked Bootloader.
Thanks in advance
Click to expand...
Click to collapse
For now, you have to unlock your bootloader to gain root access. There is no other method at the moment. So in conclusion: locked bootloader = no root.

how i root z5 dual 6683

parteek.dandyan said:
how i root z5 dual 6683
Click to expand...
Click to collapse
Follow the guide and do it. Its written there.
Sent from my E6683 using Tapatalk

DeathStroke said:
Follow the guide and do it. Its written there.
Sent from my E6683 using Tapatalk
Click to expand...
Click to collapse
Dont blame him. I added this guide for E6683 today. I cant try it myself because I have no E6683, but I hope it will work

alphatact1cs said:
Dont blame him. I added this guide for E6683 today. I cant try it myself because I have no E6683, but I hope it will work
Click to expand...
Click to collapse
I was not blaming, I didn't know that you updated today. Would be great in future if you do any update, add the date and following update.
Thank you.
One thing I noticed while reading your guide was TWRP is not for E6683. Will there be any problem? I haven't yet tried your guide because I was in doubt.
Sent from my E6683 using Tapatalk

DeathStroke said:
One thing I noticed while reading your guide was TWRP is not for E6683. Will there be any problem? I haven't yet tried your guide because I was in doubt.
Click to expand...
Click to collapse
The new Kernel from monx includes TWRP, so you dont need to flash Recovery...normally. I know that my guide works, but only for E6653. I included a link for E6683, but I also wrote that I cant try it because I havent a Z5 E6683. Anyway, TWRP for E6653 should work for E6683 devices. The main difference is the Kernel.

Guys, what about E6633 ? Is it really bad ?

Siudzix said:
Guys, what about E6633 ? Is it really bad ?
Click to expand...
Click to collapse
You can try it at your own risk. Someone said that it will work, but I would be careful.
pesonic said:
Should this be working on E6633 too?
Click to expand...
Click to collapse
arismelachrinos said:
+1
Click to expand...
Click to collapse

@alphatact1cs are you open to suggestions??
we are currently trying to unify devices index here at xda..
would you like to follow what our fellow brother @kuzibri and @sd_shadow has implemented?
http://forum.xda-developers.com/general/about-xda/public-index-program-project-t3147245

[Guide] Safe bootloader unlock, restore DRM, custom recovery, root, bootloader relock

** DISCLAIMER: I AM NOT A DEV AND THIS IS MY HOBBY. I ASSUME NO RESPONSIBILITY IF THIS BREAKS YOUR DEVICE **​
The following is tested on model E6553. This may work for the dual sim model too but I have not verified it. Do not flash the ftf and kernel files intended for one model onto another.​
I am not taking credit for any of the tools and kernels here. They are all developed by others. I am only telling you how to use them.
Credits: @zxz0O0, @tobias.waldvogel
0- Prerequisites
You need to have a functioning installation of adb and fastboot tools. You need to have proper Sony drivers installed on your PC to detect your phone when it is connected to the PC. You should be able to flash an ftf file using flashtool. If any of these sound unfamiliar to you, stop reading, go learn about them, and then come back.
1- How to unlock your bootloader without losing the DRM keys
Sony has designed this phone such that if you unlock your bootloader you lose your TA partition PERMANENTLY which includes some of the Xperia features and licenses that have to do with image processing etc. forever. You will also no longer receive OTAs. So in theory, without a copy of this TA partition (which is unique to each device and cannot be copied over from another) unlocking the bootloader results in an irreversible loss of some of your phone's features. Relocking the bootloader will not bring them back.
A hack exists that allows you to backup the TA partition before you unlock the bootloader. This backup will make the process completely reversible so if you ever need to send the tablet to Sony for repair or just want to return it to its original state you have a way. Follow these instructions carefully:
1.0- Before you begin keep in mind that this procedure, especially the unlocking step, completely erases your tablet. Disable myXperia and remove your google account before proceeding. The following will likely not work well with encryption.
1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the Customized NL ftf that you can get from here.
1.2- Enter service Mode by dialing *#*#7378423#*#* -> Service info -> configuration, and make sure the device is unlockable.
Also check -> Service Tests -> Security and you will see a bunch of "active" and "OK" attributes. You can take screenshots for your reference.
1.3- Turn on usb debugging mode on your phone.
1.4- Download iovyroot zip v0.4 or higher from here.
1.5- Unzip this zip file into a folder of your choice and open a command terminal there.
1.6- Connect the phone which is now in USB debugging mode to your PC and answer yes when the phone asks to authorize the PC to access it in USB debugging mode. You can check that the PC indeed sees the phone by running this command
Code:
adb devices
1.7- Run the following command:
Code:
tabackup
1.8- VERY IMPORTANT: Make sure the command completes with no errors. If all goes well you will have a file with a name like TA-05052016.img (the name may be different for you) with a size of 2MB in your folder.
1.9- Save this file in a very safe place. Save it on your hard disk, AND email it to yourself, AND put it on your google drive. If you lose this file you can never reverse the bootloader unlocking process.
1.10- Reboot the device.
1.11- Now you can unlock the bootloader. Follow the instructions at Sony's official website at http://developer.sonymobile.com/unlockbootloader Also save your unlock code that you obtain in this step somewhere. You may need it some day.
1.12- Reboot the device and it will briefly enter recovery and then start the phone initial setup.
1.13- (Optional) you can easily verify that your bootloader is unlocked by entering the fastboot mode, obtaining any boot image, and running the following command to boot your tablet with that image:
Code:
fastboot boot boot.img
1.14- (Optional) you can see that the DRM keys are erased from your tablet by repeating step 1.2 but this time you will see a bunch of errors under Service Tests -> Security.
1.15- As a side effect of unlocking the bootloader you lose the ability to receive OTA updates. Clean flash a Marshmallow ftf to continue. For this tutorial I used Marshmallow 6.0 E6553_Customized HK_1294-9654_32.1.A.1.185_R7C (the latest firmware at the time of this writing.)
2- How to emulate DRM keys and/or root and/or add recovery after unlocking the bootloader.
A hack exists that can emulate the DRM keys:
2.1- Extract the boot image from the 32.1.A.1.185 marshmallow ftf that you installed in step 1.15. Here are the steps to take:Open the ftf file with 7-zip or any zip program that you have at your disposal
Look for a file called kernel.sin and extract it.
Start flashtool and from Tools menu choose Sin Editor.
Select the kernel.sin that you extracted in the previous step and hit Extract data.
Flashtool will create a file called kernel.elf which you will use in the next step.​2.2- Download rootkernel_v4.42_Windows_Linux.zip (or a higher version) from http://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 and unzip it in a folder of your choice.
2.3- Copy the kernel.elf that you got in step 2.1 to this folder. If you want root, follow this guide through to section 5 place SuperSU 2.71 (or higher) in this folder as well. Make sure the name of the SuperSU zip starts with letters "SuperSU". The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133 (The rootkernel tool has a bug in its built-in SuperSU integration. See: http://forum.xda-developers.com/showpost.php?p=67485478&postcount=838)
2.4- Open a command terminal in this folder and run the rootkernel script. Your command should look similar to this:
Code:
rootkernel.cmd kernel.elf boot-patched.img
When prompted, answer as follows:- Sony RIC is enabled. Disable? [Y/n] Y (if you want root plus write access)
- Install TWRP recovery? [Y/n] Y (if you want to have recovery)
- Install busybox? [Y/n] Y (if you want busybox. It is very useful)
- Found SuperSU-v2.71-20160331103524.zip. Install? [Y/n] Y (if you want root)
- Install DRM fix? [Y/n] Y (if you want DRM emulation)​This will create a new kernel image called boot-patched.img which you will now flash on your phone.
2.5- Boot the phone in the fastboot mode and flash your patched image using the following fastboot command:
Code:
fastboot flash boot boot-patched.img
2.6- (Optional) You can reboot the phone and see that the DRM keys are indeed retrieved by repeating step 1.2. You can also open settings -> display, and look under Image Enhancement. If the DRM emulation is successful you will see this.
3- How to flash a custom or stock kernel
3.0- If you have already flashed the patched kernel in part 2 you will skip this part.
3.1- Whether you want to use a custom kernel or stock, and whether you have done the DRM patch described above or not, to flash a boot image (i.e. kernel) on your phone you need to restart the tablet in fastboot mode.
3.2- To flash the kernel use this command:
Code:
fastboot flash boot [I]name_of_your_kernel[/I]
You will replace name_of_your_kernel with whatever your kernel is called (e.g. boot.img, kernel.elf, etc.)
4- How to add and use recovery
4.1- Recovery is added to your kernel in step 2.4.
4.2- To enter recovery reboot the phone and touch the volume up key when the LED turns yellow during the boot splash screen.
5- How to root
5.1- Place SuperSU 2.71 zip (or higher) on the phone's sdcard. The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133
5.2- Reboot to recovery and flash the zip file.
6- How to relock bootloader and return it to original factory state
6.0- To relock the bootloader along with restoring the DRM keys the phone must have unmodified stock firmware.
6.1- Repeat step 1.1
6.2- Repeat steps 1.3, 1.4, and 1.5
6.3- Copy the TA backup image that you had obtained in section 1 in the iovyroot folder and use the tarestore command to flash the TA partition back onto the phone. The command will look similar to this:
Code:
tarestore TA-05052016.img
Make sure the command completes with no error. If it fails the first time try again. Reboot the phone. Your bootloader is now locked and your DRM keys restored.
6.4- (Optional) You can verify that you are back to the original locked state by repeating step 1.2.

Whoa Great
---------- Post added at 01:32 AM ---------- Previous post was at 12:50 AM ----------
najoor said:
** DISCLAIMER: I AM NOT A DEV AND THIS IS MY HOBBY. I ASSUME NO RESPONSIBILITY IF THIS BREAKS YOUR DEVICE **​The following is tested on model E6553. This may work for the dual sim model too but I have not verified it. Do not flash the ftf and kernel files intended for one model onto another.​I am not taking credit for any of the tools and kernels here. They are all developed by others. I am only telling you how to use them.
Credits: @zxz0O0, @tobias.waldvogel
0- Prerequisites
You need to have a functioning installation of adb and fastboot tools. You need to have proper Sony drivers installed on your PC to detect your phone when it is connected to the PC. You should be able to flash an ftf file using flashtool. If any of these sound unfamiliar to you, stop reading, go learn about them, and then come back.
1- How to unlock your bootloader without losing the DRM keys
Sony has designed this phone such that if you unlock your bootloader you lose your TA partition PERMANENTLY which includes some of the Xperia features and licenses that have to do with image processing etc. forever. You will also no longer receive OTAs. So in theory, without a copy of this TA partition (which is unique to each device and cannot be copied over from another) unlocking the bootloader results in an irreversible loss of some of your phone's features. Relocking the bootloader will not bring them back.
A hack exists that allows you to backup the TA partition before you unlock the bootloader. This backup will make the process completely reversible so if you ever need to send the tablet to Sony for repair or just want to return it to its original state you have a way. Follow these instructions carefully:
1.0- Before you begin keep in mind that this procedure, especially the unlocking step, completely erases your tablet. Disable myXperia and remove your google account before proceeding. The following will likely not work well with encryption.
1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
1.2- Enter service Mode by dialing *#*#7378423#*#* -> Service info -> configuration, and make sure the device is unlockable.
Also check -> Service Tests -> Security and you will see a bunch of "active" and "OK" attributes. You can take screenshots for your reference.
1.3- Turn on usb debugging mode on your phone.
1.4- Download iovyroot zip v0.4 or higher from here.
1.5- Unzip this zip file into a folder of your choice and open a command terminal there.
1.6- Connect the phone which is now in USB debugging mode to your PC and answer yes when the phone asks to authorize the PC to access it in USB debugging mode. You can check that the PC indeed sees the phone by running this command
Code:
adb devices
1.7- Run the following command:
Code:
tabackup
1.8- VERY IMPORTANT: Make sure the command completes with no errors. If all goes well you will have a file with a name like TA-05052016.img (the name may be different for you) with a size of 2MB in your folder.
1.9- Save this file in a very safe place. Save it on your hard disk, AND email it to yourself, AND put it on your google drive. If you lose this file you can never reverse the bootloader unlocking process.
1.10- Reboot the device.
1.11- Now you can unlock the bootloader. Follow the instructions at Sony's official website at http://developer.sonymobile.com/unlockbootloader Also save your unlock code that you obtain in this step somewhere. You may need it some day.
1.12- Reboot the device and it will briefly enter recovery and then start the phone initial setup.
1.13- (Optional) you can easily verify that your bootloader is unlocked by entering the fastboot mode, obtaining any boot image, and running the following command to boot your tablet with that image:
Code:
fastboot boot boot.img
1.14- (Optional) you can see that the DRM keys are erased from your tablet by repeating step 1.2 but this time you will see a bunch of errors under Service Tests -> Security.
1.15- As a side effect of unlocking the bootloader you lose the ability to receive OTA updates. Clean flash a Marshmallow ftf to continue. For this tutorial I used Marshmallow 6.0 E6553_Customized HK_1294-9654_32.1.A.1.185_R7C (the latest firmware at the time of this writing.)
2- How to emulate DRM keys and/or root and/or add recovery after unlocking the bootloader.
A hack exists that can emulate the DRM keys:
2.1- Extract the boot image from the 32.1.A.1.185 marshmallow ftf that you installed in step 1.15. Here are the steps to take:
Open the ftf file with 7-zip or any zip program that you have at your disposal
Look for a file called kernel.sin and extract it.
Start flashtool and from Tools menu choose Sin Editor.
Select the kernel.sin that you extracted in the previous step and hit Extract data.
Flashtool will create a file called kernel.elf which you will use in the next step.​2.2- Download rootkernel_v4.42_Windows_Linux.zip (or a higher version) from http://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 and unzip it in a folder of your choice.
2.3- Copy the kernel.elf that you got in step 2.1 to this folder. If you want root, place SuperSU 2.71 (or higher) in this folder as well. Make sure the name of the SuperSU zip starts with letters "SuperSU". The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133
2.4- Open a command terminal in this folder and run the rootkernel script. Your command should look similar to this:
Code:
rootkernel.cmd kernel.elf boot-patched.img
When prompted, answer as follows:
- Sony RIC is enabled. Disable? [Y/n] Y (if you want root plus write access)
- Install TWRP recovery? [Y/n] Y (if you want to have recovery)
- Install busybox? [Y/n] Y (if you want busybox. It is very useful)
- Found SuperSU-v2.71-20160331103524.zip. Install? [Y/n] Y (if you want root)
- Install DRM fix? [Y/n] Y (if you want DRM emulation)​This will create a new kernel image called boot-patched.img which you will now flash on your phone.
2.5- Boot the phone in the fastboot mode and flash your patched image using the following fastboot command:
Code:
fastboot flash boot boot-patched.img
2.6- (Optional) You can reboot the phone and see that the DRM keys are indeed retrieved by repeating step 1.2. You can also open settings -> display, and look under Image Enhancement. If the DRM emulation is successful you will see this.
3- How to flash a custom or stock kernel
3.0- If you have already flashed the patched kernel in part 2 you will skip this part.
3.1- Whether you want to use a custom kernel or stock, and whether you have done the DRM patch described above or not, to flash a boot image (i.e. kernel) on your phone you need to restart the tablet in fastboot mode.
3.2- To flash the kernel use this command:
Code:
fastboot flash boot [I]name_of_your_kernel[/I]
You will replace name_of_your_kernel with whatever your kernel is called (e.g. boot.img, kernel.elf, etc.)
4- How to add and use recovery
4.1- Recovery is added to your kernel in step 2.4.
4.2- To enter recovery reboot the phone and touch the volume up key when the LED turns yellow during the boot splash screen.
5- How to relock bootloader and return it to original factory state
5.0- To relock the bootloader along with restoring the DRM keys the phone must have unmodified stock firmware.
5.1- Repeat step 1.1
5.2- Repeat steps 1.3, 1.4, and 1.5
5.3- Copy the TA backup image that you had obtained in section 1 in the iovyroot folder and use the tarestore command to flash the TA partition back onto the phone. The command will look similar to this:
Code:
tarestore TA-05052016.img
Make sure the command completes with no error. If it fails the first time try again. Reboot the phone. Your bootloader is now locked and your DRM keys restored.
5.4- (Optional) You can verify that you are back to the original locked state by repeating step 1.2.
Click to expand...
Click to collapse
Very usefull step by step guide.. But is there is any method to root phone without unlocking Bl? Quite curious to know from you.

arokososoo said:
Whoa Great
---------- Post added at 01:32 AM ---------- Previous post was at 12:50 AM ----------
Very usefull step by step guide.. But is there is any method to root phone without unlocking Bl? Quite curious to know from you.
Click to expand...
Click to collapse
Not yet, atleast for my Dual SIM Version.

njaya95 said:
Not yet, atleast for my Dual SIM Version.
Click to expand...
Click to collapse
So you mean there is a way to root single sim version without unlocking BL?

Thanks ú so much! this is well writen, i will try this when i get the time to do a fresh install. Cheers mate

@arokososoo
Please, in the future never quote long OP and any other long posts. This is very annoying for mobile and desktop users to scroll to the next post. Thanks.
Sent from my Sony E6553 using XDA Labs

I wonder if E6533 can use this guide

Got as far as going to the sony website, there's no mention of phones that can be unlocked there and for some reason Ive got bootloader unlock allowed no, even with a sim free phone and my xperia turned off.....bummer

Stoneybridge said:
Got as far as going to the sony website, there's no mention of phones that can be unlocked there and for some reason Ive got bootloader unlock allowed no, even with a sim free phone and my xperia turned off.....bummer
Click to expand...
Click to collapse
I also unlocked my Z3+, although it wasn't supported. I just picked Z4 Tablet since it is the "nearest" one. Worked Got MM rooted now.

How long did that take on your devices? 1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
I am waiting for half an hour now...
Spoiler

Trilliard said:
How long did that take on your devices? 1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
I am waiting for half an hour now...
Spoiler
Click to expand...
Click to collapse
I can't see your picture, but I assume you have that stucking at modem/system ?
If so, downgrade Flashtool to 0.9.19

Well i got a soft brick, but was able to restore it trough Sony Companion. Here is the picture on another hoster http://fs5.directupload.net/images/160529/gr5fpf8t.png dont know on what point it stuck.
Funfact that two germans writting in english
Edit, big thanks version 0.9.19 worked perfect. Cant understand why the newest one doesnt work
Edit 2: System boots up, but when the setup start the process com.android.phone stops instant and if i hit ok the message comes instantly again after about ten times the phone reboot, i cant do anything else... next repair through sony companion and back to stock german 6.0. I´ll stop try it for today.

Trilliard said:
Well i got a soft brick, but was able to restore it trough Sony Companion. Here is the picture on another hoster http://fs5.directupload.net/images/160529/gr5fpf8t.png dont know on what point it stuck.
Funfact that two germans writting in english
Edit, big thanks version 0.9.19 worked perfect. Cant understand why the newest one doesnt work
Edit 2: System boots up, but when the setup start the process com.android.phone stops instant and if i hit ok the message comes instantly again after about ten times the phone reboot, i cant do anything else... next repair through sony companion and back to stock german 6.0. I´ll stop try it for today.
Click to expand...
Click to collapse
Did you forget to wipe?

In a thread i opened in Q&A a user said that even though service info reported bl unlock allowed NO, he managed to unlock it anyways using standard procedure, what do you think?

it seems like Sony RIC is not fully disabled with this patch.

Finally ! Works like a charm in my E6533 (Dual sim) !!! Thanks a lot !!!

Hi thiefxhunter,
How you do this? could you explain us step by step. I like to root my dual sim model.
Thanks.

Hi.. I am stuck in 2.5
My device is unlocked, It is connected in fastboot mode (blue led).
error msg
'Fastboot is not recognised as an internal or external command, operable program or batch file'
Please help me in this.
Solved..
Thanks for this post..

Thanks for this guide, it worked like a charm on my E6553 with 32.2.A.0.224

CorzCorry said:
I also unlocked my Z3+, although it wasn't supported. I just picked Z4 Tablet since it is the "nearest" one. Worked Got MM rooted now.
Click to expand...
Click to collapse
Can you please explain how did you do that? Thanks

[Guide] Stock MIUI (7/8): Official unlock, recovery, root, xposed, DPI & debloat

Please read this thread thoroughly and carefully. Do this at your own risk. The following had worked for two of the same devices. I've made this guide partly for my own notes and because other guides out there seemed incomplete.
Aim of this guide is to have an unlocked bootloader with a custom recovery for flashing root, Xposed and other things while possibly preserving the ability to get official OTA updates. The following is a summary of what this guide entails.
Official Mi FlashUnlock was used to unlock the bootloader. It will take 3-4 days before Xiaomi grants unlock permission on your account. This guide does not touch the emmc for unlocking since that method causes -2% or 50% battery bug. This is the same bug that most CM flashers are running into. In the meantime, prepare your computer and phone for when you do get permission.
Recovery TWRP Alka is a good recovery to use since it's already patched (boot.img) so that it can flash MIUI recovery ROMs (OTA) as well as CM based ROMs. It also has the ability to backup the entire phone (EFS partition). I would strongly suggest backing up all partitions and moving it to your computer or SD card after. You may choose Cofface TWRP if you're never going to try CM based ROMs. Helpful links from other guides will be posted at the end. I have yet to receive an OTA update yet so this part is not tested.
Root, Xposed and DPI instructions are all outlined below. Flash and configure these as you normally would.
Debloating is a big thing that I do to stock ROMs. This essentially prevents the ROM from running the apps, slimming the ROM and hopefully extending daily usage. There are few things that broke though. The only thing I could care about is that I'm not able to change the wallpaper via the Settings (lockscreen + homescreen) anymore. However, the rest that broke were the features that I don't use such as Cleaner (sponsored by Cheetah), dual apps and etc. Debloat accordingly. Be cautious, as I won't be necessarily explaining what each item does. ​
OTA updates does work. However, recovery, root, DPI, Xposed and debloat all needed to be done again.
Prep work
Sign up and login to all the neccessary accounts
Sign up for unlock: http://en.MIUI.com/unlock/, this will take 3-4 days.
Make sure you're also signed into your Mi account on your phone and that you can find your phone at http://i.mi.com/.
Prepare your computer for drivers and software
Enable Windows TESTSIGNING first: https://msdn.microsoft.com/en-us/library/windows/hardware/ff553484(v=vs.85).aspx
The TESTSIGNING boot configuration option is enabled or disabled through the BCDEdit command. To enable test-signing, use the following BCDEdit command:
Bcdedit.exe -set TESTSIGNING ON
To disable test-signing, use the following BCDEdit command:
Bcdedit.exe -set TESTSIGNING OFF​Restart your computer and then install the following:
Mi PC Suite (http://pcsuite.mi.com/)
Mi ROM Flashing Tool and drivers for fastboot & ADB (http://en.MIUI.com/a-234.html)
Mi FlashUnlock tool (http://en.MIUI.com/thread-202290-1-1.html)
Fastboot EDL, just in case (http://forum.xda-developers.com/redmi-note-3/how-to/guide-reboot-to-edl-mode-fastboot-test-t3398718)
Prepare your device
Enable developer mode by going to Settings > About phone > Tap on MIUI Version repeatedly until you get a toast that Developer Mode is enabled
Go back to Settings and then tap on Additional Settings > Developer options
Enable Developer options
Enable OEM unlock
Enable USB debugging
Plugin your phone into your computer, it should now install all the drivers
Turn TESTSIGNING OFF and restart your computer
Signs of computer recoginizing your phone properly (for ADB, Fastboot and etc)
In Device Manager, you should see under Android Phone: Android Composite ADB Interface and Xiaomi Composite MDB Interface
You phone should have also asked you to allow debugging from your computer (check always allow)
Unlocking your phone
Log in from time to time to check your unlock permission from the MiFlash Unlock Tool. You'll just need to follow the instructions to unlock your bootloader.
Boot into fastboot by holding volume-down + power
Run MiFlash Unlock and follow the onscreen instructions
If you're curious to see if it's unlocked, boot back into fastboot and type fastboot oem device-info
Using MiFlash tool to flash another MIUI ROM (China to Global, skip if you already like your MIUI version)
Boot into fastboot by holding volume-down + power, you will get the fastboot bunny
Download your desired fastboot version: http://en.MIUI.com/a-234.html, you can check the changelog and description from here: http://en.MIUI.com/download-301.html
Or you can use MIUI 8 Global Beta: http://forum.xda-developers.com/redmi-note-3/development/MIUI-8-global-beta-redmi-note-3-t3417423
Extract the fastboot ROM (.tgz) twice, the first extract you'll be left with .tar file, the second should leave you with a directory of files
Place that directory in the root of your drive (or somewhere with a short location)
Launch the MiFlash tool, browse to your extracted fastboot ROM and click on refresh. You should now also see your device listed
Click on Flash All and click on refresh once more
Now flash your device, it should take upwards of 170s
Let your device boot, which should take 5m or longer. Set it up as you normally would and redo all the steps outlined in the "Prepare your device" section (don't need the TESTSIGNING part).
Flashing TWRP (Alka) & Root
Download the following files:
TWRP https://dl.twrp.me/kenzo/
Alka http://www.mediafire.com/download/febttn8piu0vfae/recovery+Alka+Update.zip
Universal Boot Img Patcher http://forum.xda-developers.com/redmi-note-3/how-to/modified-twrp-deleting-emmcappsboot-t3371667
SuperSU https://download.chainfire.eu/969/SuperSU/
You should now be working in an administrator command prompt in this directory: C:\Program Files (x86)\Xiaomi\MiPhone\Google\Android. Take this chance to extract fastboot-edl into this same directory. Also place twrp and alkarecoveryupdate img files into this directory. You should have the Universal Boot Img Patcher and SuperSU copied to your phone.
Follow these, don't reboot in between unless stated:
Enter fastboot (volume-down + power)
Type fastboot boot twrp.img
Swipe to allow modifications
Flash universal boot img patcher zip
Flash twrp.img by selecting "Select Image" option.
Select recovery partition & flash it
For some reason twrp has to be flashed this way or else recovery will be reverted to stock MIUI recovery. You can try Alka directly to see if it works for you.
Now reboot to recovery
Flash alkarecoveryupdate.img by selecting "Select Image" option.
Select recovery partition & flash it
Reboot to recovery
Flash SuperSU
Reboot system and let it boot MIUI, it may take longer than usual
You should now test root, configure SuperSU & install Busybox.
Flashing Xposed
Download the latest SolarWarez Xposed: http://forum.xda-developers.com/xposed/unofficial-xposed-MIUI-t3367634
Download Material Xposed Installer: http://forum.xda-developers.com/xposed/material-design-xposed-installer-t3137758
Download Xposed uninstaller, just in case: http://forum.xda-developers.com/showthread.php?t=3034811
A few posts suggests that the latest official Xposed v86 works with MIUI, but doesn't seem to be the case for me.
Install the Xposed Installer of your choice (apk install)
Enter recovery (volume-up + power)
Flash v86-sdk22-arm64 (LP, sdk23 is for MM)
Clear cache and dalvik
Reboot the phone, this should take 5m or longer since we wiped the cache
If you notice bootloops or crashing services, use the uninstaller. Worst case, flash it back to stock using MiFlash.
Xposed modules that I use:
App Settings
MIUI Brightness Fix
Mobile Radio Active Fix
Power Nap
Play Store Fixes
Spotify Skip
TextLinkify
WhatsApp Tuner
xMIUI
xInsta unfortunately does not work well.
Changing DPI
Using FX Explorer (Root access enabled) or any explorer you feel fit.
Go to system/ and edit build.prop
Add this line in between persist.hwc.downscale_threshold=1.15 & #ro.hdmi.enable=true
ro.sf.lcd_density=370​
Reboot your phone
You should be able to use a DPI changer such as texdrodier_dpi to change it to whatever you like after
ROM Debloating, should get around 1.8GB of free memory on boot
Using FX Explorer (Root access enabled) or any explorer you feel fit.
Create the backup location:
Create a folder in system named _backup
Create subfolders named app, data-app, priv, vendor
Debloat app folder as you wish but here's my list:
Go to system/app
Cut the following into system/_backup/app
AGPSTestMode
AmapITS
AnalyticsCore
AntHalService
BasicDreams
BrowserProviderProxy
BugReport
CalendarLocalAccount
CalendarWidget
CloudService
Drive
Email
FileExplorer
FM
Galaxy4
GuardProvider
HTMLViewer
HiddTestApp
HoloSpiralWallpaper
KSICibaEngine
KingSoftCleaner
LatinImeGoogle
LiveWallpapers
LiveWallpapersPicker
LunarInfoProvider
MiDiscover
MiLivetalk
MiuiVideoPlayer
MiWallpaper
MSDC_UI
NoiseField
Notes
OmaDownload
OmaDrmEngineApp
PartnerBookmarksProvider
PhaseBeam
PhotoTable
QtiBackupAgent
QtiFeedback
SampleAuthenticatorService
SapClientApp
SecureSampleAuthService
SoundRecorder
SecProtect
StaProxyService
StepsProvider
Stk
SystemAdSolution
TouchAssistant
TranslationService
Videos
VisualizationWallpapers
WAPPushManager
WfdClient
xdivert
fastdormancy
imstests
jjcontainer
jjhome
jjknowledge
jjstore
Go to system/data-app
Cut the following into system/_backup/data-app
Facebook
klobugreport
Go to system/priv
Cut the following into system/_backup/priv
AndroidForWork
AutoTest
BackupRestoreConfirmation
Browser
Calendar
CleanMaster
FM2
GoogleBackupTransport
GoogleFeedback
Mipub
Music
MusicFX
SpacesManagerService
SpacesTrustAgent
Velvet
xtra_t_app
Go to system/vendor
Cut the following into system/_backup/vendor
CTA
ChinaMobile
ChinaTelecom
ChinaUnicom
CmccPower
MPCS
app
Helpful posts if you have other issues
Flashing to CM: http://forum.xda-developers.com/redmi-note-3/how-to/guide-step-step-guide-flash-cm13-build-t3391839
TWRP Explained: http://forum.xda-developers.com/redmi-note-3/how-to/guide-redmi-note-3-available-twrps-t3406708
Fastboot EDL for softbricked phones: http://forum.xda-developers.com/redmi-note-3/how-to/guide-reboot-to-edl-mode-fastboot-test-t3398718
IMEI Repair: http://en.MIUI.com/thread-245598-1-1.html
MIUI Unlock guide: http://en.MIUI.com/thread-202290-1-1.html

If using alka twrp and officially unlocked the bootloader, universal boot image patcher was not necessary for flashing any official miui rom.
Sent from my Redmi Note 3 using Tapatalk

timberwolf60 said:
If using alka twrp and officially unlocked the bootloader, universal boot image patcher was not necessary for flashing any official miui rom.
Sent from my Redmi Note 3 using Tapatalk
Click to expand...
Click to collapse
i had to do what i did because the recovery wouldn't stay flashed. alka has the boot image built in anyways, so really it's the same thing.

I think DPI should be ro.sf.lcd ? you've written ro.sf.ldc??? Is that correct?

rayulove69 said:
I think DPI should be ro.sf.lcd ? you've written ro.sf.ldc??? Is that correct?
Click to expand...
Click to collapse
fixed. typo

What if i directly boot and flash alka recovery?
What if i directly boot or flash alka recovery? instead of first flashing twrp official and then flashing alka through it

RavdeepAurora said:
What if i directly boot or flash alka recovery? instead of first flashing twrp official and then flashing alka through it
Click to expand...
Click to collapse
try it. like i said in my post, i had to do what i did or else alka wouldn't stay flashed. if it stays flashed for you then great, you've saved 5 steps.

The only thing I could care about is that I'm not able to change the wallpaper via the Settings (lockscreen + homescreen) anymore
Click to expand...
Click to collapse
For what it's worth, I haven't done anything yet aside from bootloader, MIUI 8 and install nova launcher; the wallpaper/lock screen error only happens when I've got nova set as default. When I go back to the stock launcher, I can change both without error. Then I set nova back to default, I can still change wall/lock until I actually restart the phone.
So hopefully that might give you an idea as to what's going on and maybe it'll help.
Do appreciate the guide, something I'll have to do eventually when CM13 works out the kinks.

Thanks the dpi edit works great.

capitak said:
For what it's worth, I haven't done anything yet aside from bootloader, MIUI 8 and install nova launcher; the wallpaper/lock screen error only happens when I've got nova set as default. When I go back to the stock launcher, I can change both without error. Then I set nova back to default, I can still change wall/lock until I actually restart the phone.
So hopefully that might give you an idea as to what's going on and maybe it'll help.
Do appreciate the guide, something I'll have to do eventually when CM13 works out the kinks.
Click to expand...
Click to collapse
Thanks! Good to know it wasn't from the debloating.

I just want to have "write access" to my MicroSD card, so I plan to unlock/root my device.
If I follow the guide just to unlock, is all my personal data/setting/profiles/installed apps still be there after unlock?
Pls advice.

Just waiting on my RN3 to arrive, so this post is perfect timing.
I'll report back once I've followed your steps.

should i install SolarWarez Xposed and Material Xposed Installer or just one of them?

same240 said:
I just want to have "write access" to my MicroSD card, so I plan to unlock/root my device.
If I follow the guide just to unlock, is all my personal data/setting/profiles/installed apps still be there after unlock?
Pls advice.
Click to expand...
Click to collapse
Don't know. Unlocking bootloader usually wipes the device.
doganmanis said:
should i install SolarWarez Xposed and Material Xposed Installer or just one of them?
Click to expand...
Click to collapse
You need both, as usual.

I'm getting this problem in cmd prep work
Bcdedit.exe -set TESTSIGNING ON
AN error has occured setting the element data.
The value is protected by Secure Boot policy and cannot be modified or deleted.

RexMi6 said:
I'm getting this problem in cmd prep work
Bcdedit.exe -set TESTSIGNING ON
AN error has occured setting the element data.
The value is protected by Secure Boot policy and cannot be modified or deleted.
Click to expand...
Click to collapse
You may need to disable driver signing instead. Google that for your windows 8 or 10 machine. My method ensures it's disabled.

I used your guide.
Thank you!
everything is working, on stable-globe rom.
I'm using Titanium backup to uninstall system apps

I'm using the official MIUI Global Stable 7.5.3.0 and have unlocked the bootloader using the official way as well. I just now installed alka recovery directly using fastboot commands and it seems to work fine. It's still there after rebooting a couple of times and I already took a full backup of the phone. Haven't tried restoring it yet, which I will probably do later and post the results, but I guess that will work as well.
Edit: I tried to restore a backup just now, but I got an error when it tried to restore the firmware partition. The error was "extractTarFork() process ended with error : 255" if I'm not mistaken. Still everything seems to be working fine regardless of that error.

Thanks !!! Amazing post!!! Helped me a lot !
I have a Note 3 Pro , couldn't unlock the Phone with Global Version (even with permission) always stoping in 50%, tried to change to Chinese Version, but I couldn't, so I tested with Global Developer Version (Miui 8) and I got the unlock

I'm doing same process you said after unlocking boot loader officially. I'm trying to flash mokee rom and open gapps pico arm 64. After booting rom is crashing saying com.android.phone is stopped and when i check for oem device info it is locked. plz help where am I going wrong

HOW TO: Android 10 Stock with Root via Magisk

Full disclosure- many of these steps are just copy/pasted from the Magisk install instructions and other areas online, just thought I'd post a full set of instructions for our device. There might be easier steps or I might have added additional unnecessary steps, please let me know and I can update. I'm just posting what worked for me. I also don't like installing things from sketchy fileshare sites, so I provide the way to get everything from official sources.
This is to get root via Magisk on a stock Moto Z4 (I have the Retail model, don't know anything about Verizon or other models). You will need to have a knowledge of how to do some advanced tasks, such as using ADB/Fastboot, installing APKs from unknown sources, and installing drivers on your computer. Google is your friend (or DuckDuckGo in my opinion) I am not responsible for bricked phones, thermonuclear war, etc. This is just a helpful guide.
You might as well start on the latest OTA since during the unlock process you'll have no choice but to erase all your data, make sure you're fully updated and backup your data.
HOW TO ROOT FROM STOCK:
First, you must unlock your bootloader. WARNING: THE UNLOCK PROCESS WILL ERASE ALL OF YOUR DATA!
Follow the instructions on the Motorola website to check if your bootloader can be unlocked and retrieve the ID codes
One step Motorola doesn't mention is that you must enable OEM unlocking from the Developer Options. If you don't know how to get to Developer Options, you'll need to google it. It's very easy, and I think it's a good "test" to figure out if you should even be trying to root your phone
Once you have your unlock code, unlock your bootloader according to the instructions here. EVERYTHING ON YOUR PHONE WILL BE DELETED AT THIS POINT!
Next, you must patch the stock boot image.
You will need to retrieve the boot image, please follow the instructions at the bottom of this post on how to download the full OTA archives.
Once you have the stock boot image, copy it to your phone's storage
You need to install Magisk Manager on your phone (it doesn't need to be rooted at this point- it's just needed to patch the boot image) Download the latest Magisk Manager from the official Magisk thread here
Tap "Advanced Settings" in Magisk Manager and check "Recovery Mode"
Press Install → Install → Select and Patch a File, and select your stock boot/recovery image file
Magisk Manager will patch the image, and store it in [Internal Storage]/Download/magisk_patched.img
Copy the patched image from your device to your PC. If you can’t find it via MTP, you can pull the file with ADB:
adb pull /sdcard/Download/magisk_patched.img
Now, flash the modified boot image
Plug your phone in, make sure USB debugging is enabled, open a command line in the same folder that your patched image is in (or, you can put in the full path on step 3 rather than just the filename).
Easiest way to get to fastboot mode is the command (you can also use the volume key trick if you'd rather or if you're having trouble with ADB):
Code:
adb reboot bootloader
Then all you have to do is:
Code:
fastboot flash boot magisk_patched.img
To reboot:
Code:
fastboot reboot
You should be done now! You can check the status of root from Magisk Manager and refer to Magisk documentation for any help with that. You may also want to disable Automatic System Updates from Developer options to prevent issues when updates are released.
HOW TO DOWNLOAD STOCK OTA ZIP & RETRIEVE BOOT IMAGE:
First, you need to download LSMA, Moto/Lenovo's software for managing and recovering phones
Once the software is installed, open it and go to the "Flash" tab, hit "Switch to Upgrade", and connect your phone
When you connect, it will check for an update (Sometimes it will not have the latest update even if you are offered an update on your phone. You'll need to wait until it shows up here)
Download the update
LSMA will download a zip file to C:\ProgramData\LMSA\Download\RomFiles, and once completed it will automatically extract the ZIP. (If you want the full ZIP image for any reason, you must copy it to a different location before the extraction completes, LSMA deletes the zip once the extraction finishes. Just have the window open until the download completes, as soon as the ZIP file appears copy it to another folder, it will not interfere with extraction.)
Retrieve the boot.img from the download folder
HOW TO UPGRADE TO NEW OTA, PRESERVING ROOT & DATA:
Now you can try following the Magisk instructions since our device has an A/B partition layout, but I wasn't able to get it to work, usually the upgrade fails validating the current image so I have an alternate set of steps that did work for me. Backup your data just in case though.
First, you need to download LSMA, Moto/Lenovo's software for managing and recovering phones
Once the software is installed, open it and go to the "Flash" tab, hit "Switch to Upgrade", and connect your phone
When you connect, it will check for an update (Sometimes it will not have the latest update even if you are offered an update on your phone. You'll need to wait until it shows up here)
Download the update, but don't install it yet. The program will download a zip file to C:\ProgramData\LMSA\Download\RomFiles, and once completed it will automatically extract the ZIP.
Retrieve the boot.img from the download folder and copy it to your phone
Patch the boot.img in Magisk Manager per the steps above
Now proceed with installing the update in LSMA (It will say it's going to erase your data, but it does not).
Your phone will reboot to the bootloader and LSMA will flash the update
Once the update is finished and your phone reboots for the final time, close LSMA.
Reboot to the bootloader again:
Code:
adb reboot bootloader
Flash boot:
Code:
fastboot flash boot magisk_patched.img
Reboot:
Code:
fastboot reboot
Upon reboot, you're now updated, and root & data is preserved.

hey there i cant download the recovery.img for get mod
when triying to flash and download it said device incompatible
anyone have the moded recovery already patch that can share if can of course
I have Android 10 already

Need some help I conect my phone tomthe app for downloading the full ota file but gives me an error. The recognize the phone but I can't download the img file can some one share me the .img patched.
Can I use a .img that some in this forum did ?

I read Android has new fastbootd and I had to manually install ROM and root using fastbootd on One Hyper
Z4 doesn't need fastbootd, does it?

mingkee said:
I read Android has new fastbootd and I had to manually install ROM and root using fastbootd on One Hyper
Z4 doesn't need fastbootd, does it?
Click to expand...
Click to collapse
No, the Z4 does not use fastbootd.
Running this command with the device connected in fastboot mode will return yes if it uses fastbootd and no if it doesn't
Code:
fastboot getvar is-userspace
https://source.android.com/devices/bootloader/fastbootd

Do I have to download LSMA or can I use the boot.img from the Android 10 firmware I got from lolinet?

G.I. Jew said:
Do I have to download LSMA or can I use the boot.img from the Android 10 firmware I got from lolinet?
Click to expand...
Click to collapse
The firmware packages from lolinet are identical to the ones downloaded by LMSA

Sigh, not possible on verizon due to the locked bootloader

zander21510 said:
Full disclosure- many of these steps are just copy/pasted from the Magisk install instructions and other areas online, just thought I'd post a full set of instructions for our device. There might be easier steps or I might have added additional unnecessary steps, please let me know and I can update. I'm just posting what worked for me. I also don't like installing things from sketchy fileshare sites, so I provide the way to get everything from official sources.
This is to get root via Magisk on a stock Moto Z4 (I have the Retail model, don't know anything about Verizon or other models). You will need to have a knowledge of how to do some advanced tasks, such as using ADB/Fastboot, installing APKs from unknown sources, and installing drivers on your computer. Google is your friend (or DuckDuckGo in my opinion) I am not responsible for bricked phones, thermonuclear war, etc. This is just a helpful guide.
You might as well start on the latest OTA since during the unlock process you'll have no choice but to erase all your data, make sure you're fully updated and backup your data.
HOW TO ROOT FROM STOCK:
First, you must unlock your bootloader. WARNING: THE UNLOCK PROCESS WILL ERASE ALL OF YOUR DATA!
Follow the instructions on the Motorola website to check if your bootloader can be unlocked and retrieve the ID codes
One step Motorola doesn't mention is that you must enable OEM unlocking from the Developer Options. If you don't know how to get to Developer Options, you'll need to google it. It's very easy, and I think it's a good "test" to figure out if you should even be trying to root your phone
Once you have your unlock code, unlock your bootloader according to the instructions here. EVERYTHING ON YOUR PHONE WILL BE DELETED AT THIS POINT!
Next, you must patch the stock boot image.
You will need to retrieve the boot image, please follow the instructions at the bottom of this post on how to download the full OTA archives.
Once you have the stock boot image, copy it to your phone's storage
You need to install Magisk Manager on your phone (it doesn't need to be rooted at this point- it's just needed to patch the boot image) Download the latest Magisk Manager from the official Magisk thread here
Tap "Advanced Settings" in Magisk Manager and check "Recovery Mode"
Press Install → Install → Select and Patch a File, and select your stock boot/recovery image file
Magisk Manager will patch the image, and store it in [Internal Storage]/Download/magisk_patched.img
Copy the patched image from your device to your PC. If you can’t find it via MTP, you can pull the file with ADB:
adb pull /sdcard/Download/magisk_patched.img
Now, flash the modified boot image
Plug your phone in, make sure USB debugging is enabled, open a command line in the same folder that your patched image is in (or, you can put in the full path on step 3 rather than just the filename).
Easiest way to get to fastboot mode is the command (you can also use the volume key trick if you'd rather or if you're having trouble with ADB):
Code:
adb reboot bootloader
Then all you have to do is:
Code:
fastboot flash boot magisk_patched.img
To reboot:
Code:
fastboot reboot
You should be done now! You can check the status of root from Magisk Manager and refer to Magisk documentation for any help with that. You may also want to disable Automatic System Updates from Developer options to prevent issues when updates are released.
HOW TO DOWNLOAD STOCK OTA ZIP & RETRIEVE BOOT IMAGE:
First, you need to download LSMA, Moto/Lenovo's software for managing and recovering phones
Once the software is installed, open it and go to the "Flash" tab, hit "Switch to Upgrade", and connect your phone
When you connect, it will check for an update (Sometimes it will not have the latest update even if you are offered an update on your phone. You'll need to wait until it shows up here)
Download the update
LSMA will download a zip file to C:\ProgramData\LMSA\Download\RomFiles, and once completed it will automatically extract the ZIP. (If you want the full ZIP image for any reason, you must copy it to a different location before the extraction completes, LSMA deletes the zip once the extraction finishes. Just have the window open until the download completes, as soon as the ZIP file appears copy it to another folder, it will not interfere with extraction.)
Retrieve the boot.img from the download folder
HOW TO UPGRADE TO NEW OTA, PRESERVING ROOT & DATA:
Now you can try following the Magisk instructions since our device has an A/B partition layout, but I wasn't able to get it to work, usually the upgrade fails validating the current image so I have an alternate set of steps that did work for me. Backup your data just in case though.
First, you need to download LSMA, Moto/Lenovo's software for managing and recovering phones
Once the software is installed, open it and go to the "Flash" tab, hit "Switch to Upgrade", and connect your phone
When you connect, it will check for an update (Sometimes it will not have the latest update even if you are offered an update on your phone. You'll need to wait until it shows up here)
Download the update, but don't install it yet. The program will download a zip file to C:\ProgramData\LMSA\Download\RomFiles, and once completed it will automatically extract the ZIP.
Retrieve the boot.img from the download folder and copy it to your phone
Patch the boot.img in Magisk Manager per the steps above
Now proceed with installing the update in LSMA (It will say it's going to erase your data, but it does not).
Your phone will reboot to the bootloader and LSMA will flash the update
Once the update is finished and your phone reboots for the final time, close LSMA.
Reboot to the bootloader again:
Code:
adb reboot bootloader
Flash boot:
Code:
fastboot flash boot magisk_patched.img
Reboot:
Code:
fastboot reboot
Upon reboot, you're now updated, and root & data is preserved.
Click to expand...
Click to collapse
for those who try to install security patch...
I recommend you do the following in case you wish to keep your root and others in the phone.
as usual, back it up in case...
connect to the lenovo software (above) and download the security patch (you can do it thru the rescue step as the program will prompt "no new software" if you try to check "upgrade software".
once the security patch download is complete, keep a copy of the boot.img and load it on the phone to do usual magisk thing.
but be patient...
keep this new magisk edited boot elsewhere and reflash the original boot to your phone so that the error message in making the patch update disappears.
once you reverted to the original boot (it goes without saying the usual fastboot reboot), make the OTA security patch update.
you will find that the root is gone but the phone (everything).
now is the time to flash the magisk edited boot (the new boot from the update patch) to your phone and voilaaaaa!
your root is back + the security patch applied.

beefytr said:
for those who try to install security patch...
I recommend you do the following in case you wish to keep your root and others in the phone.
as usual, back it up in case...
connect to the lenovo software (above) and download the security patch (you can do it thru the rescue step as the program will prompt "no new software" if you try to check "upgrade software".
once the security patch download is complete, keep a copy of the boot.img and load it on the phone to do usual magisk thing.
but be patient...
keep this new magisk edited boot elsewhere and reflash the original boot to your phone so that the error message in making the patch update disappears.
once you reverted to the original boot (it goes without saying the usual fastboot reboot), make the OTA security patch update.
you will find that the root is gone but the phone (everything).
now is the time to flash the magisk edited boot (the new boot from the update patch) to your phone and voilaaaaa!
your root is back + the security patch applied.
Click to expand...
Click to collapse
Hey, I found that using root on the latest security patch makes the WiFi stop working. Like the switch won't even turn on, and it can't scan for new networks. I know that it's not a hardware problem, because I reverted to the March security update and WiFi works. Is anyone else having the no WiFi issue on the latest security patch while using root?

Fazwalrus said:
Hey, I found that using root on the latest security patch makes the WiFi stop working. Like the switch won't even turn on, and it can't scan for new networks. I know that it's not a hardware problem, because I reverted to the March security update and WiFi works. Is anyone else having the no WiFi issue on the latest security patch while using root?
Click to expand...
Click to collapse
Nope!