# Recovering Xperia XZ2/XZ2C/XZ3 (and maybe other TAMA) from hard-brick state Applies for all XZ2/XZ2C/XZ3 variant (DoCoMo please use specific `DoCoMo` files) Written by : @cuynu (feel free to correct me) Tool credit : [trustedfirmware](https://xdaforums.com/m/trustedfirmware.13291828/) (XDA) Original repositories : ``` Katana : https://github.com/Daniel224455/katana SDM845 Payloads : https://github.com/Daniel224455/sdm845-payloads EDLClient : https://github.com/bkerler/edl ``` ## Requirements - A PC running Linux, (Windows may still work but more complex and is not supported) - Bkerler EDL tool installed, Python installed with `pip` - Katana & SDM845 Payload & Firehose - Unbrick (or rescue-only) package (get below) -------------------------------- - Meaning : [Unbrick package = Full unbrick package with ROM] | [Rescue-only package = Unbrick package without ROM] -------------------------------- - Unbrick package for XZ2 Dual SIM (H8266/H8296/H8276) : [Download](https://cuynutt.ddns.net/files/XZ2_Unbrick/XZ2_H8266_52.1.A.3.137_Unbrick_EDL.zip) - Unbrick package for XZ2 Single SIM (H8216/702SO/SOV37) : [Download](https://cuynutt.ddns.net/files/XZ2_Unbrick/XZ2_H8216_52.1.A.3.49_Unbrick_EDL.zip) -------------------------------- - Rescue-only package for Xperia XZ2 (Single/Dual) : [Download](https://git.disroot.org/cuynu/xz2_unbrick/releases/download/rescue-only/XZ2_Unbrick_EDL_RescueOnly.zip) - Rescue-only package for Xperia XZ2 (DoCoMo) : [Download](https://git.disroot.org/cuynu/xz2_unbrick/releases/download/rescue-only/XZ2_DoCoMo_Unbrick_EDL_RescueOnly.zip) -------------------------------- - Rescue-only package for Xperia XZ3 (Single/Dual) : [Download](https://git.disroot.org/cuynu/xz2_unbrick/releases/download/rescue-only/XZ3_Unbrick_EDL_RescueOnly.zip) - Rescue-only package for Xperia XZ3 (DoCoMo) : [Download](https://git.disroot.org/cuynu/tama_unbrick/releases/download/rescue-only/XZ3_DoCoMo_Unbrick_EDL_RescueOnly.zip) ------------------------------- - Rescue-only package for Xperia XZ2 Compact (Single/Dual) : [Download](https://git.disroot.org/cuynu/tama_unbrick/releases/download/rescue-only/XZ2C_Unbrick_EDL_RescueOnly.zip) - Rescue-only package for Xperia XZ2 Compact (DoCoMo) : [Download](https://git.disroot.org/cuynu/tama_unbrick/releases/download/rescue-only/XZ2C_DoCoMo_Unbrick_EDL_RescueOnly.zip) ## Notice - This guide only works if your current phone has working and untouched `TA` (Trim-Aera), `xflkeystore`, `xflkeystorebak` partition, or a backup one - If `TA`, `xflkeystore`, `xflkeystorebak` is messed up, or your whole phone is messed up with all partition erased (like malicious modules, windows driver ufs,...) and you don't have any backup, there is NO WAY to recover it, as those partition is critical and UNIQUE to each motherboard. ## Start - You need to enter EDL mode first, if the device has corrupted `xfl` or `xbl` and the light does not show up then you can just connect USB charger then it will automatically enter EDL - In case if the device is blinking/stuck at red light of death when connect charger, or keep blinking or just blink once with green light when you hold power button, you need to short testpoint to enter EDL mode. Find testpoint here How-to use testpoint: remove battery, short the testpoint circuit, keep short it and connect USB, then release, and check output on PC with `lsusb`, after recognized, connect the battery again but DO NOT unplug cable, then continue with next steps. Xperia XZ2 EDL Testpoint
xz2 tp
Xperia XZ2 Compact Testpont
xz2c tp
Xperia XZ3 Testpoint
xz3 tp
After entered, it should show the device ``` cuynu@x99e $ lsusb | grep 0fce:ade5 Bus xxx Device xxx: ID 0fce:ade5 Sony Ericsson Mobile Communications AB QUSB_BULK_CID:0402_SN:F7D8400F ``` ---------------------------------------------- Install EDLClient tool by bkerler / Dependencies ``` # Debian/Ubuntu/Mint/etc sudo apt install adb fastboot python3-dev python3-pip liblzma-dev git sudo apt purge modemmanager # Fedora/CentOS/etc sudo dnf install adb fastboot python3-devel python3-pip xz-devel git # Arch/Manjaro/etc sudo pacman -S android-tools python python-pip git xz sudo pacman -R modemmanager # Gentoo (run as root!) emerge -aq dev-util/android-tools dev-vcs/git dev-python/pip # For systemd distros sudo systemctl stop ModemManager sudo systemctl disable ModemManager # For OpenRC distros (run as root!) rc-update del modemmanager default boot sysinit rc-service modemmanager stop # Install EDLClient tool git clone https://github.com/bkerler/edl.git # do NOT use --recurse-submodules cd edl git submodule update --init --recursive pip install . --break-system-packages ``` If you have problem with installing EDLClient tool (pylzma failed to build/install), do this - Clone this fork ``` git clone https://github.com/electimon/pylzma.git ``` Install manually ``` cd pylzma python setup.py build sudo python setup.py install ``` Then try `cd .. && pip install . --break-system-packages` to install again. ------------------------------------------- Clone and prepare BootROM exploit tool (this is my fork with changes to work with specific Sony TAMA VID/PID, as it is `0fce:ade5`, and providing pre-built binaries) ``` git clone https://git.disroot.org/cuynu/fhcoyote_sdm845.git git clone https://git.disroot.org/cuynu/katana-fork.git cd katana-fork pip install -r requirements.txt --break-system-packages cp ../fhcoyote_sdm845.git/*.elf . ``` ------------------------------------------ Run the exploit ``` python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf ``` Output should be like this (katana banner removed) ``` 2026-07-04 16:12:23 Qualcomm BootROM Exploit - CVE-2021-30327 Version 1.0 (c) 2025 Daniel224455 - github.com/Daniel224455/katana Selected SoC: sdm845 Searching for Qualcomm device in Sahara state Found device! Connected to device Sahara version 2 Device is in PBL Sahara Starting exploit Coyote payload detected Sending payload segment, offset=0x0 size=0x40 Sending payload segment, offset=0x40 size=0x428 Sending payload segment, offset=0x1000 size=0x1000 Transferred payload, now trying to get our shellcode to execute! Transferring nulls to satisfy PBL Executing shellcode Your BootROM is now pwned! You can now run testsigned firehoses Releasing USB after reinit by payload Device released. Reconnecting Searching for Qualcomm device in Sahara state Found device! Connected to device Checking if sahara was reinitialized correctly Transfer complete, telling PBL it's done Loader uploaded successfully Device released. ``` If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint, or replug then connect (if xbl,xfl is corrupted) then try again. ## Backup necessary UNIQUE partitions > [!WARNING] > You MUST backup the following partition : `TA` & `xflkeystore` & `xflkeystorebak` before proceed with EDL flashing and safe it to safe place > > As the unbrick (or rescue-only) package OVERRIDE the current one on the device with randomized `TA` & `xblkeystore` & `xblkeystorebak` !!! > > If you skip this, YOUR MOTHERBOARD will PERMANENTLY BRICK, with NO WAY TO RESUCE EVEN WITH WORKING EDL ! ``` edl r TA ~/TA_backup.bin --memory=ufs --lun=0 edl r xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0 edl r xflkeystorebak ~/xflkeystorebak_backup.bin --memory ufs --lun=0 ``` The backup will save to your user home home folder : `~/` Keep `TA_backup.bin` & `xflkeystore_backup.bin` & `xflkeystorebak_backup.bin` !!! DO NOT DELETE IT, otherwise the motherboard will be UNRECOVERABLE. ## Erase old partition table MAKE SURE TO HAVE BACKUP IN ABOVE STEP FIRST !!! YOU'VE WARNED !!!! ``` dd if=/dev/zero of=gpt_empty.bin bs=500000 count=1 edl w gpt gpt_empty.bin --memory=ufs --lun=0 edl w gpt gpt_empty.bin --memory=ufs --lun=1 edl w gpt gpt_empty.bin --memory=ufs --lun=2 ``` ## Flash EDL package - Download unbrick/rescue-only package from requirements step. - If you are using XZ3, replace with `unzip XZ3*Unbrick*.zip` - If you are using XZ2 Compact, replace with `unzip XZ2C*Unbrick*.zip` ``` unzip XZ2*Unbrick*.zip cd edlfw edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml . ``` Example output ``` cuynu@x99e $ edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml . Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025. main - Trying with no loader given ... main - Waiting for the device main - Device detected :) DeviceClass DeviceClass - [LIB]: USB Overflow main - Mode detected: firehose Progress: |██████████| 100.0% Write (Sector 0x6 of 0x6, ) 21.27 MB/s Progress: |██████████| 100.0% Write (Sector 0x5 of 0x5, ) 20.61 MB/s Progress: |██████████| 100.0% Write (Sector 0x200 of 0x200, ) 24.04 MB/s Progress: |██████████| 100.0% Write (Sector 0x1000 of 0x1000, ) 24.66 MB/s Progress: |██████████| 100.0% Write (Sector 0xBC of 0xBC, ) 20.86 MB/s Progress: |██████████| 100.0% Write (Sector 0x1400 of 0x1400, ) 24.60 MB/s ... ``` ## Set bootable partition By default after flash, the bootable device is in `LUN0` so we have to change it to `LUN1`, which contain `xbl_a` and `xbl_config_a`, as PBL will load XBL and other bootloader components. ``` edl setbootablestoragedrive 1 ``` ## Restore Sony original partition table The `gpt_main*.bin` is only a placeholder to retrieve partition, it will not boot without restoring official Sony partition table, we have to flash original partition table to make the device boot. ``` edl w gpt partition-image-LUN0_X-FLASH-ALL-B6B5.img --memory=ufs --lun=0 edl w gpt partition-image-LUN1_X-FLASH-ALL-B6B5.img --memory=ufs --lun=1 edl w gpt partition-image-LUN2_X-FLASH-ALL-B6B5.img --memory=ufs --lun=2 ``` ## Restore original unique partition backup > [!WARNING] > This is UNIQUE file, you MUST restore it after EDL flash, otherwise the device will not turn on due to incorrect `TA` & `xflkeystore` & `xflkeystorebak`. > ``` edl w TA ~/TA_backup.bin --memory=ufs --lun=0 edl w xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0 edl w xflkeystorebak ~/xflkeystorebak_backup.bin --memory=ufs --lun=0 ``` ## Reboot the device ``` edl reset ``` It will reboot the device, and will boot to Sony logo, then load Android, but if it not, or "device is corrupt" screen appears, enter Flash mode, and then reflash firmware for your XZ2/XZ2C/XZ3. - If you use `rescue-only` package, it will loop Sony logo until it show `Your device is corrupt` screen, at this point use `newflasher`, find firmware for your model, then reflash. Remember to remove `boot` folder from firmware folder before flash with `newflasher`.