[HOWTO] Customizing the stock Android 8.0 Oreo on the Japanese Xperia XZ1 with temproot - Sony Xperia XZ1 Guides, News, & Discussion

Carrier phones are odd-ball siblings of their global counterparts. As such, they do not enjoy nor receive the same level of support as that of the latter in the modding scene (custom ROMs, recoveries, etc.), even though both carry the same brand model name, e.g. Xperia XZ1 G8341 "Global" vs. Xperia XZ1 SO-01K "NTT DoCoMo". This is because of the subtle underlying hardware differences between the global and carrier variants, even if they have the same specsheet.
One can try flashing ROMs for a global variant onto one of these phones, but it can be a hit or miss, with some hardware components not working like NFC and even losing other functions like the fullseg receiver. And even if it seems to run fine, there may be other issues like poor battery performance because of a non-functioning hardware preventing deep sleep.
Given the above, if you're like me who has one of these carrier phones and doesn't mind running stock where everything works, then this guide is for you. This will allow you to customize several aspects of the system as indicated per section.
This guide has been made possible with the great work of @j4nn on his temproot exploit via CVE-2019-2215 here, extended to support carrier phones from NTT DoCoMo, au KDDI, and Softbank. Once you achieve temporary privilege escalation by running bindershell, you can execute the following commands from inside a terminal emulator (if you followed the howto from the link) or the adb shell. There is no need to setup Magisk. All changes are permanent, except for those in /data that will be erased upon factory reset.
Keep in mind the following:
1. Customizations in this guide were done on an Xperia XZ1 SO-01K from NTT DoCoMo. I think that the file system from the other carriers shouldn't differ that much, but let me know if there are any discrepancies and I'll see if I can help.
2. Make backup of the files if you wish to revert them later on.
3. Avoid making changes in files and/or directories other than those as detailed in this guide, specifically in /oem and /data.
4. The starting directory for files to be copied is assumed to be at /sdcard, i.e. the root directory of the internal storage.
5. Always remount as read-write before committing the changes in /oem:
Code:
# mount -o rw,remount /oem
6. Restart the phone for changes to take effect.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Let's get started.
• Boot animation
Shave off a few seconds of boot-up time by removing the boot animation, or you can replace this to whatever you want (you'll have to make sure that the boot animation is in compatible format with the phone). To remove:
Code:
# cd /oem/media
# rm bootanimation.zip
# touch bootanimation.zip
# chmod 644 bootanimation.zip
It is not enough that you delete the file, because then the system will load /system/media/bootanimation.zip. You need to create a zero-byte file with the proper permissions.
• Boot logo
I found an empty splash partition that is 32.64 MiB in size. I'm still trying to figure out if flashing a compatible boot splash image to this partition will make the bootloader load this image instead of the one built into it, just like in the case of the boot animation above. I still have to determine the compatible format for this splash image.
If you have further information regarding the format please share it here. I'm also trying to change the blinding light of that boot logo to something more tolerable.
• Emoji font
Fast fact: Did you know that emoji comes from the Japanese words 'e' meaning picture and 'moji' meaning character?
To replace (assuming you have a font file named MyFont.ttf):
Code:
# cd /oem/fonts
# rm ColorUniEmoji.ttf DcmColorIEmoji.ttf
# cp /sdcard/MyFont.ttf ColorUniEmoji.ttf
# chmod 644 ColorUniEmoji.ttf
The two ttf files are referenced in /system/etc/fonts.xml, but it is the ColorUniEmoji.ttf file that needs to be replaced to make changes to the system emoji. Removing this file will only defer the system to load all glyphs from /system/fonts/NotoColorEmoji.ttf, so rename your font file accordingly.
• Display font
To have your own font apart from the choices in Settings > Display > Change font for display (assuming you have a font file named MyFont.ttf):
Code:
# cp /sdcard/MyFont.ttf /data/system/fonts/UserFont.ttf
• Installing apps into /system
You can achieve the same effect of installing apps into /system (without triggering the 'Your device is corrupt' boot message) as follows (assuming you have an app named MyApp.apk):
Code:
# cd /oem/app
# mkdir MyApp
# chmod 755 MyApp
# cp /sdcard/MyApp.apk MyApp/
# chmod 644 MyApp/MyApp.apk
Replace /oem/app with /oem/priv-app as needed.
• Debloat
Effortlessly debloat your phone from carrier-specific apps and services by making modifications in /oem/android-config/early_config.xml. The package names contained in the xml file will disappear from the system upon restart. A factory reset will not even bring those packages back. You can remove the package names should you decide to have the need for them. Restart the phone and they will appear again.
Here's mine configured with the bare-minimum packages to avoid bootloops and other issues. You can change it to suit your needs, just follow the file structure. I purposefully didn't indent the lines I added to easily see them.
You can also rename or delete the folder /oem/deletable-app if you don't want to have those apps contained therein to be installed by the system upon a factory reset.
Note for SO-01K:
Do not include the com.nttdocomo.android.phonemotion package if you use the stock phone dialer com.sonymobile.android.dialer. The dialer will crash whenever you receive an incoming call, preventing you from answering it.
• GPS
UPDATE: The GPS doesn't work no matter what parameters are changed in the gps.conf file. It doesn't detect any satellites, so it doesn't lock-in on your coordinates, at least this is the case with mine. This may be another limitation of using a carrier-locked phone outside of it's country of origin. I'm afraid that the only remedy for this would be to flash a global ROM variant, especially if binaries are involved. I know this to be the case because I have an SOV37 on Japan ROM and no GPS work there also, but after flashing it to a Global ROM then I got GPS to work properly.
I'm still trying to find out how to fix this without unlocking the bootloader, but I'm not holding my breath.
Tweak the GPS parameters of the phone in /oem/android-config/gps.conf.
• Preset networks
Remove /oem/android-config/preset_networks.conf if you don't want to have carrier saved networks present whenever you reset your network settings or factory reset.
• APNs
I have always wondered why carrier phones don't automatically populate the APN for any SIM other than a Japanese SIM, even after having the phone SIM unlocked. As it turns out, the system of these phones doesn't really include the APN parameters of other networks outside Japan.
/system/etc/apns-conf.xml, which is where all APN parameters for all networks of the World can be found, is a symlink to /data/customization/apns-conf.xml, which itself is another symlink to /system/etc/customization/settings/defaults/apns-conf.xml, which is an xml file containing zero APN parameters.
As you can see, we can change this by replacing the symlink in /data/customization/apns-conf.xml with the full xml file from Google's source repository found here. This will download a file named apns-conf-full.txt. This is base64 encoded. To decode:
Code:
$ base64 -d /sdcard/Download/apns-conf-full.txt > /sdcard/apns-conf.xml
Unfortunately, upon every restart the system reverts /data/customization/apns-conf.xml to the original symlink. To prevent this, we need to make the file immutable with chattr, but this command is not available in the system.
If you followed the howto from the temproot link, and ran bindershell from a terminal emulator, you will come across the post of @Tifs detailing on how to successfully start Magisk from the same. You just need to download the arm64/busybox binary from one of the posted links.
When you have this and the xml files ready, then:
Code:
# cd /data/local/tmp
# cp /sdcard/Download/busybox .
# chmod +x busybox
# cd /data/customization
# rm apns-conf.xml
# cp /sdcard/apns-conf.xml .
# chmod 644 apns-conf.xml
# /data/local/tmp/busybox chattr +i apns-conf.xml
After restarting the phone, try Settings > Network & Internet > Mobile network > Access point names > Reset to default and see the available APNs for your SIM.
• VoWiFi / Wi-Fi calling
These carrier phones came provisioned with VoLTE and Video Calling but not Wi-Fi calling, at least in the case of mine. I'm not sure how useful Video Calling would be outside Japan, and it seems that Wi-Fi Calling is not used there. @pbarrette provided a great overview of the configs that enable VoLTE and Wi-Fi Calling here. But we are interested in enabling Wi-Fi Calling so here are the relevant changes to make:
1. Decompile /oem/overlay/com.android.carrierconfig-res-305.apk on your phone or PC.
2. Once decompiled, modify res/xml/vendor.xml with the following values as follows:
Code:
<boolean name="carrier_wfc_ims_available_bool" value="true" />
<boolean name="carrier_default_wfc_ims_enabled_bool" value="true" />
3. Rebuild the decompiled apk and overwrite the original file with the modified one.
4. Append the following line to /oem/system-properties/config.prop:
Code:
persist.data.iwlan.enable=true
5. It may be necessary to change/reinsert SIM after phone restart for the changes to take place.
• Build.prop
It is not possible to add or modify values in /system/build.prop without triggering the 'Your device is corrupt' boot message. However, you can add or modify certain values in /oem/system-properties/config.prop, which gets read into the system property database.
If you are using Gboard and you want custom themes for it, then you can append these lines for example:
Code:
ro.com.google.ime.themes_dir=/oem/etc/gboard_theme
ro.com.google.ime.theme_file=swiftinstaller.zip
Edit the values as needed.
Here are the other interesting values to modify:
Code:
# show the NFC icon
ro.nfc.icon.enable=true
# disable the forced camera shutter sound
ro.camera.sound.forced=0
It may also be necessary to decompile /oem/overlay/android-res-305.apk, then modify res/values/bools.xml as follows:
Code:
<bool name="config_camera_sound_forced">false</bool>
to turn off the forced camera shutter sound. I did both modifications, but try the config.prop value first. It may be enough.
* VoLTE / 4G calling
There should be a matching APN entry to use VoLTE with your network operator. Unfortunately, this is missing as well, and if you try to add it manually in Settings > Network & Internet > Mobile network > Access point names, it doesn't get saved. This is the case with mine.
UPDATE: I just acquired an Xperia XZ2 SOV37 "au KDDI" running Android 10. When I tried adding an APN of type 'ims' there, I got an 'Operator does not allow adding APNs of type dun, ims.' So it is a carrier-imposed restriction on the phone, only that in my XZ1 it fails silently.
You can add the APN entry in two locations:
1. /data/customization/apns-conf.xml, but you can only do this before making the file immutable; or
2. /oem/overlay/android-res-305.apk, by decompiling it and then modifying res/xml/apns.xml, rebuild and then overwrite with this one. I went this route.
In both cases, this is the APN entry you need to add:
Code:
<apn carrier="IMS" apn="ims" mcc="{mcc}" mnc="{mnc}" type="ims" protocol="IPV4V6" roaming_protocol="IP" />
Replace the values in curly braces with the MCC and MNC of your network operator.
* CellBroadcastReceiver
Each carrier phone comes with their own way of receiving emergency alerts depending on the network operator. All of them however don't include the CellBroadcastReceiver app like the other models do.
If you want to receive such alerts, then download this apk here. Rename it as CellBroadcastReceiver.apk then do the following:
Code:
# cd /oem/priv-app
# mkdir CellBroadcastReceiver
# chmod 755 CellBroadcastReceiver
# cd CellBroadcastReceiver
# cp /sdcard/CellBroadcastReceiver.apk .
# chmod 644 CellBroadcastReceiver.apk
* Sound enhancement
Sound enhancements like the DSEE HX, ClearAudio+, etc. apply only on stock media players like the Music and Video player (but not on any other else it seems) in the case of Android 8.0 Oreo. On Android 9.0 Pie, these enhancements apply system-wide for all media playing apps. An upgrade is recommended if this customization is needed.
While customizations such as these may not come close to the level you get with custom ROMs (and the updated software and security that come with it), these will at least give you something to control and tweak AND STILL get a device with a locked bootloader (and all the goodies that come with it like passing SafetyNet and Key Attestations, Widevine L1, intact DRM keys, etc.). You get the best of both worlds, at the cost of running a not-so-updated system.
I will add more sections to this as soon as I made some more modifications. I hope you find this guide useful as much as I enjoyed creating it. If you do, please hit the LIKE button. It will be very much appreciated.

---

Changelog
* 2021-08-02: initial posting, revised with images
* 2021-08-03: added section on VoLTE
* 2021-08-04: updated VoLTE, added section on CellBroadcastReceiver
* 2021-08-11: updated GPS
* 2021-08-14: added section on Sound enhancement

---

braveheartleo said:
* VoLTE / 4G calling
There should be a matching APN entry to use VoLTE with your network operator. Unfortunately, this is missing as well, and if you try to add it manually in Settings > Network & Internet > Mobile network > Access point names, it doesn't get saved. This is the case with mine.
UPDATE: I just acquired an Xperia XZ2 SOV37 "au KDDI" running Android 10. When I tried adding an APN of type 'ims' there, I got an 'Operator does not allow adding APNs of type dun, ims.' So it is a carrier-imposed restriction on the phone, only that in my XZ1 it fails silently.
You can add the APN entry in two locations:
1. /data/customization/apns-conf.xml, but you can only do this before making the file immutable; or
2. /oem/overlay/android-res-305.apk, by decompiling it and then modifying res/xml/apns.xml, rebuild and then overwrite with this one. I went this route.
In both cases, this is the APN entry you need to add:
Code:
<apn carrier="IMS" apn="ims" mcc="{mcc}" mnc="{mnc}" type="ims" protocol="IPV4V6" roaming_protocol="IP" />
Replace the values in curly braces with the MCC and MNC of your network operator.
Click to expand...
Click to collapse
braveheartleo
Thanks a lot for such a helpful post.
I have a SO-02K XZ2 Compact docomo, running android 9.0, unlocked bootloader, rooted.
I could not find file "apns-conf.xml" on "/system/etc/".
After rebuilding "android-res-305.apk" ... each time i tried to manually add APN (through Newtrok & internet > Mobile network > Advanced > Access Point Names) i end up with no APNs.​
what could be wrong?

---

shamllakh said:
After rebuilding "android-res-305.apk" ... each time i tried to manually add APN (through Newtrok & internet > Mobile network > Advanced > Access Point Names) i end up with no APNs.
Click to expand...
Click to collapse
Hi, sorry for the very late reply, I must have missed the notification for this one.
If you read my post carefully, then you would have already gotten the answer to your question.
I'm not sure what you did after rebuilding the file, but if you followed my post correctly then you wouldn't have the need to manually add an APN entry for VoLTE, which doesn't get saved.

---

@braveheartleo regarding 4g/volte I tried to modify the apns-conf.xml. I managed to have ims registered but for some reason, after a while it reverts back to not registered even though i made it immutable. I would like to try the other way by decompiling android resapk but I don't know how to. Do you mind sharing a basic guide and the pre requisites. I tried recompiling in windows using apktool and I don't know if I'm doing it right, I didn't see any res folder after inside. I tried the apk tool on the go but I'm not lucky to have it installed, I think the development of the app has stopped years ago. I have sov36 so I am also thinking maybe it's deferent on how you do it compare to softbank?

---

braveheartleo said:
2. /oem/overlay/android-res-305.apk, by decompiling it and then modifying res/xml/apns.xml, rebuild and then overwrite with this one. I went this route.
Click to expand...
Click to collapse
@braveheartleo I managed to decompile android-res-305.apk but there is no res folder or apns.xml on it for sov36 au. I tried to look onto the same apk for s0-01k and it is present. I guess docomo build their firmware a bit different than kddi au. I tried modifying apns-conf.xml and i get ims registered but i still can't make calls. And after a while it reverts back to not registered even after making it immutable.

---

braveheartleo said:
• Debloat
Click to expand...
Click to collapse
I also want to add that they can easily debloat by flashing global rom and still have temp root. It worked on my xz1 au/sov36.

---

nitrams said:
I also want to add that they can easily debloat by flashing global rom and still have temp root. It worked on my xz1 au/sov36.
Click to expand...
Click to collapse
I just want to point that flashing global rom will loose the volte. But I have found a solution for that or maybe others already knew about it. By modifying oem/system-properties/config.prop and adding these lines and not justnthe volte but it will also activate wifi calling and video calling.
persist.data.iwlan.enable=true
persist.dbg.ims_volte_enable=1
persist.dbg.volte_avail_ovr=1
persist.dbg.vt_avail_ovr=1
persist.dbg.wfc_avail_ovr=1
persist.radio.rat_on=combine
persist.radio.data_ltd_sys_ind=1
persist.radio.data_con_rprt=1
persist.radio.calls.on.ims=1
persist.dbg.ims_volte_enable=1
persist.dbg.volte_avail_ovr=1
persist.dbg.vt_avail_ovr=1
persist.dbg.wfc_avail_ovr=1
persist.data.iwlan=1
persist.data.iwlan.ipsec.ap=1
persist.radio.volte.dan_support=true
persist.radio.rat_on=combine
persist.radio.data_ltd_sys_ind=1
persist.radio.data_con_rprt=1
persist.radio.calls.on.ims=1
persist.radio.VT_ENABLE=1
persist.sys.cust.lte_config=true
persist.rcs.supported=1
But still, im unlucky to have my carrier's volte work for me.
GitHub - edgd1er/voenabler: voenabler
voenabler. Contribute to edgd1er/voenabler development by creating an account on GitHub.
github.com