Dirty ROOT solution - for unlocked BL

[nilezon]

I have ported the Z5 Compact root method to Z5.

Please note that both recovery.img and kernel img are different from the Z5 Compact thread. Do not use recovery or kernel for Z5 Compact on your regular Z5 phone.

Disclaimer
I am well aware that this is not the nicest method of rooting, but I got the phone a few hours ago and haven't got the time to put together a better way.

Credits
@Tommy-Geenexus for Zombie kernel
@AndroPlus for Z5 recovery and guidance :good:
@Chainfire for SuperSU

Guide

First, you need to unlock you bootloader (I know, I know, now stop weeping :crying::crying::crying

A rooted device does not boot using default kernel, so you need to install an insecure kernel.
I have repacked stock Z5 (32.0.A.4.11) kernel to disable Sony RIC, dm verity, make it insecure, etc.
Flash using:

fastboot flash boot z5_stock_fixed.img

Reboot your phone using:

fastboot reboot

And verify that it works as expected.

Now, reboot your phone to bootloader again (see info how to at the end of post).
Then issue:

fastboot boot recovery.img

This recovery is partly broken, but it works well enough to install root.
Thanks to @AndroPlus for TWRP.

The phone will boot to a black screen, but you can connect to it using ADB.
You need to manually mount the system and userdata partition by issuing:

adb shell mount /dev/block/platform/soc.0/by-name/system /system
adb shell mount /dev/block/platform/soc.0/by-name/userdata /data

If you get this error:
mount: mounting /dev/block/platform/soc.0/by-name/system on /system failed: No such file or directory
You probably just need to wait a while and try again. You usually have to wait ~120 sec for the mount to work. Be patient.

If you got /system and /data to mount, you can now push SuperSU to the phone and install it:

adb push UPDATE-SuperSU-v2.46.zip /data/media/0/
adb shell twrp install /data/media/0/UPDATE-SuperSU-v2.46.zip
adb shell rm /data/media/0/UPDATE-SuperSU-v2.46.zip

If it all works, just reboot and enjoy root:

adb reboot

Files
z5_stock_fixed.img
recovery.img (for Z5)

Extra info
Boot to bootloader by adb command:

adb reboot bootloader

or by turning off the phone, and then hold down VOL UP while plugging in the USB cable.

 

[Azdian]

works like a charm, finally I can use my Z5 =)
thank you mate.

 

[komugi]

Awesome, do we need to backup TA partition anymore to keep X-Reality etc?

 

[Azdian]

Awesome, do we need to backup TA partition anymore to keep X-Reality etc?

You need to unlock the bootloader, so I don't think you can backup the TA partition.

 

[Jesmugge]

Does this change anything in the kernel? Will battery life be the same?

 

[rohorubo]

If you unlock yourbootloadeR TA partition it lost forever! You can't get it back and things like x-reality won't work anymore.

Gesendet von meinem E6653 mit Tapatalk

 

[koziakauzu]

We know that, but it must have a way (yet to find?) to backup and restore the TA partition just like previous devices (it was possible on Z and Z1, don't know about the others)

Sent from my E6653

 

[gwiqu]

are there unlocked bootloader Z5s? how do we check if our bootloader is locked?

 

[Duvel999]

GOOGLE

Go to calls,enter *#*#7378423#*#* and go to service info-configuration.

Sent from my E6653 @ XDA Portal

 

[mindstormsguy]

I ran through these instructions, and I now have root privileges, but I can't write to /system. Is there something I missed to enable this, or does this just not work?

Sent from my E6653 using Tapatalk

 

[nilezon]

I ran through these instructions, and I now have root privileges, but I can't write to /system. Is there something I missed to enable this, or does this just not work?

Sent from my E6653 using Tapatalk

You need to mount /system as read/write (default: read-only).
You can use an app or shell command to do this.
For example:
http://xdaforums.com/wiki/Guide:Using_the_Terminal#Mount

 

[harfot]

You need to mount /system as read/write (default: read-only).
You can use an app or shell command to do this.
For example:
http://xdaforums.com/wiki/Guide:Using_the_Terminal#Mount

I see I have this problem too.
Using terminal cmd

# mount -o rw,remount /system

replies

mount: Operation not permitted

Also not possible with Root Explorer

In this way it's also not possible to install Busybox.
I reinstalled kernel but didn't change anything.

 

[mindstormsguy]

Operation not permitted for me too. And I also tried reinstalling the kernel before posting.

Sent from my E6653 using Tapatalk

 

[nilezon]

Operation not permitted for me too. And I also tried reinstalling the kernel before posting.

Sent from my E6653 using Tapatalk

Hmm. Same for me. Maybe Sony RIC or SELinux is not fully disabled after all.

 

[harfot]

I see I have this problem too.
Using terminal cmd

# mount -o rw,remount /system

replies

mount: Operation not permitted

Also not possible with Root Explorer

In this way it's also not possible to install Busybox.
I reinstalled kernel but didn't change anything.

Hmm. Same for me. Maybe Sony RIC or SELinux is not fully disabled after all.

@DooMLoRD:
Hello my friend,
Long time no see - hope you are doing well.
Am I wrong if I remember this "half" root once in a DooMKernel? Cannot find it but I'm sure you know the reason.
Thanks

 

[AndroPlus]

It looks like Zombie kernel doesn't have changes like this:
https://github.com/AndroPlus-org/an...mmit/f0544c997bb22da293005ffcaaeeeb4a55394c8d
I think he can improve this current method...

 

[nilezon]

It looks like Zombie kernel doesn't have changes like this:
https://github.com/AndroPlus-org/an...mmit/f0544c997bb22da293005ffcaaeeeb4a55394c8d
I think he can improve this current method...

I don't think it is needed.

Setting:
CONFIG_SECURITY_SONY_RIC=n
in kernel config seem to solve the remount rw problem.
It's much cleaner to remove Sony RIC module this way, than just patching it, IMHO.

It's sad this can't be done by just repacking stock ramdisk.

 

[Azdian]

@nilezon do we need a new compiled kernel for every new firmware?

 

[nilezon]

@nilezon do we need a new compiled kernel for every new firmware?

You can run an older kernel, but the latest is often then best.

 

[bazhip]

I don't think it is needed.

Setting:
CONFIG_SECURITY_SONY_RIC=n
in kernel config seem to solve the remount rw problem.
It's much cleaner to remove Sony RIC module this way, than just patching it, IMHO.

It's sad this can't be done by just repacking stock ramdisk.

Is the fixed version in the main post now, then?