Extract Bootloader? - Sony Xperia P, U, Sola, Go

I believe this might be possible. If someone is willing to give this a try, a developer for example? Try to extract your own bootloader from you phone, re-pack it for CWM as a flashable file and upload. I don't know anything when it comes to the proceedure of how this is done, but fishing about this forum area "http://forum.xda-developers.com/forumdisplay.php?f=855" might lead to a few clues. However this is a different device from a different manufacturer, they have managed to extract the BL. Not sure how. But it proves it must be possible, no? Im desperate for a bootloader unlock. Can't believe my operator is not allowing this.

---

Won't work. Just won't. Adding to the list.

---

K900 said:
Won't work. Just won't. Adding to the list.
Click to expand...
Click to collapse
Okay, no worries. What about this, wouldn't it work if we managed to load a custom kernel AFTER the original kernel is already loaded? A bit like 2nd-init in CWM? Just suggesting as many things as I can so you can either shoot them down in flames and add them to the list, or if something pops up that we COULD possibly try, you can help forward it for development. If it fails it fails...

---

Booting the custom kernel still requires an unlocked bootloader right? Then you are going to have to boot an enirely new android system on top of your basic one to boot custom kernels.
Correct me if i'm wrong
Sent with my Sony Xperia S using a little bit of KA magic.

---

JoelChrist_ said:
Booting the custom kernel still requires an unlocked bootloader right? Then you are going to have to boot an enirely new android system on top of your basic one to boot custom kernels.
Correct me if i'm wrong
Sent with my Sony Xperia S using a little bit of KA magic.
Click to expand...
Click to collapse
Well the thought behind my suggestion is that since the kernel is loaded officially, it means the key is already bypassed due to the official kernel going through which then means if we can load a new kernel as the Rom loads or just before it loads yet still after the original kernel has loaded then the key must still be bypassed and this new custom kernel can be loaded? People should keep giving suggestions!
Sent from my LT26i using xda premium

---

It might just work, but you would need 2 boot partitions right?
We could make a script that boots the second kernel before the first kernel boots the system.
Sent with my Sony Xperia S using a little bit of KA magic.

---

It's hardly possible to boot the kernel as late as the earliest possible injection (install-recovery) on locked BL.

---

No way to make a delay on that time given?

---

keewanchoapsss said:
No way to make a delay on that time given?
Click to expand...
Click to collapse
We can delay it, but to be able to hot boot a kernel, we need to push it back (so we can jump in earlier) not forward.

---

K900 said:
We can delay it, but to be able to hot boot a kernel, we need to push it back (so we can jump in earlier) not forward.
Click to expand...
Click to collapse
You can do it on post boot iirc, just overwrite /system/bin/chargemon with a custom script, mv chargemon to charger, and at the end of the script run charger.
only problem with this is you need a way of hijacking in the kernel (I have no idea how to do this).

---

KeiranFTW said:
You can do it on post boot iirc, just overwrite /system/bin/chargemon with a custom script, mv chargemon to charger, and at the end of the script run charger.
only problem with this is you need a way of hijacking in the kernel (I have no idea how to do this).
Click to expand...
Click to collapse
Yeah, the exact problem is we need to hot swap the kernel. It's possible (by using something similar to Uptrack, i.e. dynamically replacing code in memory), but needs to happen early enough so that nothings breaks if it goes wrong.

---

Can't we just do something similar to dualboot, but with the option to choose between boot system and boot the second kernel?
Sent with my Sony Xperia S using a little bit of KA magic.

---

JoelChrist_ said:
Can't we just do something similar to dualboot, but with the option to choose between boot system and boot the second kernel?
Sent with my Sony Xperia S using a little bit of KA magic.
Click to expand...
Click to collapse
Dualboot needs to be handled by the bootloader or the kernel itself, but we can't modify either on locked bootloader.

---

Dualboot different kernel it's only possible if there's a custom bootloader ( with a 2nd boot partition for the 2nd kernel , and possibility to switch kernel before booting it [ like dualboot BL of iconia a500/501 ]
Dualboot different roms it's possible by having 2 roms that uses the same kernel , so you can switch rom after kernel boot ( like siyahkernel )
For extract bootloader I think it should be possible by reverse engineering fastboot executible ( if it can put .ta key to unlock bootloader , I think fastboot can also read bootloader partition [ it's quite impossible it can write but it can't read ]) and add the command to read and save bootloader
EDIT : for extract bootloader try to extract it from loader.sin ( 7-zip give me that file is broken , but I think it has strange compression method or some protection to avoid extraction)
EDIT2 : algorithm for compress/decompress loader into loader.sin its LZMA but for some reason 7-zip cannot decompress it
If we'll found a good lzma sompressor/decompressor it will be easier to extract , edit , and repack bootloader for flash by loader.sin with flashtool
EDIT3 (too edit in this post ) : Founded romanger tool that can convert sin to img , but problem remain , tomorrow I will try to use new version of flashtool ( 0.9) to extract loader .sin.... in changelog it's wrote that thay added loder.sin extract from sony fileset ..... maybe it will work

---

Forzaferrarileo said:
Dualboot different kernel it's only possible if there's a custom bootloader ( with a 2nd boot partition for the 2nd kernel , and possibility to switch kernel before booting it [ like dualboot BL of iconia a500/501 ]
Dualboot different roms it's possible by having 2 roms that uses the same kernel , so you can switch rom after kernel boot ( like siyahkernel )
For extract bootloader I think it should be possible by reverse engineering fastboot executible ( if it can put .ta key to unlock bootloader , I think fastboot can also read bootloader partition [ it's quite impossible it can write but it can't read ]) and add the command to read and save bootloader
EDIT : for extract bootloader try to extract it from loader.sin ( 7-zip give me that file is broken , but I think it has strange compression method or some protection to avoid extraction)
EDIT2 : algorithm for compress/decompress loader into loader.sin its LZMA but for some reason 7-zip cannot decompress it
If we'll found a good lzma sompressor/decompressor it will be easier to extract , edit , and repack bootloader for flash by loader.sin with flashtool
EDIT3 (too edit in this post ) : Founded romanger tool that can convert sin to img , but problem remain , tomorrow I will try to use new version of flashtool ( 0.9) to extract loader .sin.... in changelog it's wrote that thay added loder.sin extract from sony fileset ..... maybe it will work
Click to expand...
Click to collapse
You are massively wrong here.
1) hotbooting a kernel is indeed possible, I can give you related links later, but for now just Google KSplice Uptrack.
2) Fastboot has nothing to do with Sony's cryptography, it is a Google tool that is open source as a part of AOSP. If you are talking about flashtool, it is also open source, so there is absolutely no magic involved on the PC. Flashtool reads and writes the loader as raw data, not trying to decipher it. If you still want to mess with loader.sin, it's unlikely to be LZMA compressed because that means an even lower level of software is required to decompress it. A 'good LZMA decompressor' you're looking for is unsurprisingly called lzma, is open source and should come preinstalled in most Linux distributions.
3) To flash anything, even the bootloader, with flashtool or any other method, you'll need to sign it with Sony's key or find a way to bypass the validation in Sony's stock bootloader. This also means that even if you manage to modify the bootloader code, you will not be able to flash it on locked devices unless one of the above happens.

---

But where in the loader file, or any stock file can we find the validation of sony?
Sent with my Sony Xperia S using a little bit of KA magic.

---

JoelChrist_ said:
But where in the loader file, or any stock file can we find the validation of sony?
Sent with my Sony Xperia S using a little bit of KA magic.
Click to expand...
Click to collapse
In the file header. The problem is it's an asymmetric signature. So 1) you need different keys to sign and to verify signatures and 2) the signature itself depends on the file's content, so when the file is changed, it'll no longer be valid.

---

Are bootloader files also verified by Sony?
I don't think so, because the bootloader is the first software to start so it cant be checked by some other software right?
If all this is correct, cant we pull the bootloader file in some way, and replace it with an unlocked or unlockable version?
Correct me if I'm wrong
Sent with my Sony Xperia S using a little bit of KA magic.

---

JoelChrist_ said:
Are bootloader files also verified by Sony?
I don't think so, because the bootloader is the first software to start so it cant be checked by some other software right?
If all this is correct, cant we pull the bootloader file in some way, and replace it with an unlocked or unlockable version?
Correct me if I'm wrong
Sent with my Sony Xperia S using a little bit of KA magic.
Click to expand...
Click to collapse
The new bootloader is verified by the old bootloader.

---

K900 said:
The new bootloader is verified by the old bootloader.
Click to expand...
Click to collapse
In that case, if we remove the bootloader, and flash the other one, there is no bootloader to verify it right?
Sent with my Sony Xperia S using a little bit of KA magic.