Sony's international phones have unlockable bootloaders, and the company even encourages users to tinker around with neat extras like AOSP builds. Alas, in markets like the US the carriers are still the keepers of the keys for a lot of customers, and T-Mobile has once again insisted on locking that sucker down for anyone who buys its version of the Sony Xperia Z3. Now users with this lamentable affliction can at least get root access on their phones, thanks to a bounty-winning method from an XDA user.

The method is intricate and time-consuming, requiring the user to operate one Windows tool to create a pre-rooted version of the phone's firmware, flash a model-specific recovery image, and finally apply the root exploit itself made by "zxz0O0," a Swiss developer and modder who has created similar tools in the past. Unfortunately the latest firmware is incompatible with the process, but there's yet another tool available to flash the phone back to version 23.0.1.A.5.77. The method also works on the Z3 Compact, though I'm not sure there are any Compact phones released with locked bootloaders. A bounty for the root method has reached $3017 USD, though by the nature of XDA bounties, zxz0O0 may not be able to claim all of it.

One last thing to keep in mind: the Xperia Z3 is currently running Sony's build of KitKat, but is slated to receive Lollipop at some point. The prudent Xperia Z3 owner might just wait until the update and hope that someone finds a way to root it first, since updating after a root modification may be difficult or impossible on phones with locked booloaders. Note: Apparently this does not apply to Verizon's Xperia Z3v, which has significant hardware differences from both the international and T-Mobile versions.

Source: XDA-Developers via XperiaBlog

Update: A member of the team that posted this exploit wrote us for some more detailed information. This circuitous method to obtaining root is actually intended for all Xperia Z3 models, not just the ones on restrictive carriers, so that users can go about unlocking the bootloader the standard way. The reason is that doing so loses DRM keys that would prevent users from flashing back to stock using Sony's provided tools. For more on the lamentable situation surrounding Sony and bootloader unlocking, check this story. Community members have already found a way to back up DRM keys, making the official bootloader unlock method unnecessary for power users. The team member also said that they were confident that with the new tools mentioned in this article, it should be "trivial" to regain root and other modifications after flashing a Lollipop software update. He also said that more devices in the Xperia family may benefit from the same tools, though they require testing on variants that the team doesn't currently have access to.

Thanks,  Eli!