cuynu/tama_unbrick
Watch
1
Fork
You've already forked tama_unbrick
 0
Code Issues Pull requests Projects Releases Wiki Activity
tama_unbrick/README.md
Cuynu 040dbb1624
 docs: adapt new katana & change fhcoyote* url & minor changes 
Signed-off-by: Cuynu <cuynu@proton.me>
2026-07-23 23:09:42 +07:00

12 KiB
Raw Permalink Blame History

Recovering Xperia XZ2/XZ2C/XZ3 (and maybe other TAMA) from hard-brick state

Applies for all XZ2/XZ2C/XZ3 variant (DoCoMo please use specific DoCoMo files)

Written by : @cuynu (feel free to correct me)

Tool credit : trustedfirmware (XDA)

Original repositories :

Katana : https://github.com/Daniel224455/katana

SDM845 Payloads : https://github.com/Daniel224455/sdm845-payloads

EDLClient : https://github.com/bkerler/edl

Requirements

  • A PC running Linux, (Windows may still work but more complex and is not supported)
  • Bkerler EDL tool installed, Python installed with pip
  • Katana & SDM845 Payload & Firehose
  • Unbrick (or rescue-only) package (get below)
  • Meaning : [Unbrick package = Full unbrick package with ROM] | [Rescue-only package = Unbrick package without ROM]
  • Unbrick package for XZ2 Dual SIM (H8266/H8296/H8276) : Download
  • Unbrick package for XZ2 Single SIM (H8216/702SO/SOV37) : Download
  • Rescue-only package for Xperia XZ2 (Single/Dual) : Download
  • Rescue-only package for Xperia XZ2 (DoCoMo) : Download
  • Rescue-only package for Xperia XZ3 (Single/Dual) : Download
  • Rescue-only package for Xperia XZ3 (DoCoMo) : Download
  • Rescue-only package for Xperia XZ2 Compact (Single/Dual) : Download
  • Rescue-only package for Xperia XZ2 Compact (DoCoMo) : Download

Notice

  • This guide only works if your current phone has working and untouched TA (Trim-Aera), xflkeystore, xflkeystorebak partition, or a backup one
  • If TA, xflkeystore, xflkeystorebak is messed up, or your whole phone is messed up with all partition erased (like malicious modules, windows driver ufs,...) and you don't have any backup, there is NO WAY to recover it, as those partition is critical and UNIQUE to each motherboard.

Start

  • You need to enter EDL mode first, with Testpoint or EDL cable. if the device is entering EDL due to corrupted bootloader (eg: XBL is corrupted), then it will not work, you can't use that EDL mode.
  • In case if the device is blinking/stuck at red light of death when connect charger, or keep blinking or just blink once with green light when you hold power button, you need to short testpoint to enter EDL mode.

Find testpoint here

How-to use testpoint: remove battery, short the testpoint circuit, keep short it and connect USB, then release, and check output on PC with lsusb, after recognized, connect the battery again but DO NOT unplug cable, then continue with next steps.

Xperia XZ2 EDL Testpoint

xz2 tp

Xperia XZ2 Compact Testpont

xz2c tp

Xperia XZ3 Testpoint

xz3 tp

After entered, it should show the device

cuynu@x99e $ lsusb | grep 0fce:ade5
Bus xxx Device xxx: ID 0fce:ade5 Sony Ericsson Mobile Communications AB QUSB_BULK_CID:0402_SN:F7D8400F

Install EDLClient tool by bkerler / Dependencies

# Debian/Ubuntu/Mint/etc
sudo apt install adb fastboot python3-dev python3-pip liblzma-dev git
sudo apt purge modemmanager

# Fedora/CentOS/etc
sudo dnf install adb fastboot python3-devel python3-pip xz-devel git

# Arch/Manjaro/etc
sudo pacman -S android-tools python python-pip git xz
sudo pacman -R modemmanager

# Gentoo (run as root!)
emerge -aq dev-util/android-tools dev-vcs/git dev-python/pip

# For systemd distros

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
# For OpenRC distros (run as root!)
rc-update del modemmanager default boot sysinit
rc-service modemmanager stop

# Install EDLClient tool

git clone https://github.com/bkerler/edl.git # do NOT use --recurse-submodules
cd edl
git submodule update --init --recursive
pip install . --break-system-packages

If you have problem with installing EDLClient tool (pylzma failed to build/install), do this

  • Clone this fork
git clone https://github.com/electimon/pylzma.git

Install manually

cd pylzma
python setup.py build
sudo python setup.py install

Then try cd .. && pip install . --break-system-packages to install again.

Clone and prepare BootROM exploit tool (fhcoyote_sdm845 is used to providing pre-built binaries)

git clone https://codefloe.com/cuynu/fhcoyote_sdm845.git
git clone https://github.com/Daniel224455/katana.git
cd katana
pip install -r requirements.txt --break-system-packages
cp ../fhcoyote_sdm845.git/*.elf .

Run the exploit

python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf -vid 0x0FCE -pid 0xADE5

Output should be like this (katana banner removed)

2026-07-23 22:26:31 Selected SoC: sdm845
2026-07-23 22:26:31 Waiting for Qualcomm device in Sahara state
2026-07-23 22:26:31 Found device!
2026-07-23 22:26:31 Connected to device
2026-07-23 22:26:31 Sahara version 2
2026-07-23 22:26:31 Device is in PBL Sahara
2026-07-23 22:26:31 Starting exploit
2026-07-23 22:26:31 Coyote payload detected
2026-07-23 22:26:31 Sending payload segment, offset=0x0 size=0x40
2026-07-23 22:26:31 Sending payload segment, offset=0x40 size=0x428
2026-07-23 22:26:31 Sending payload segment, offset=0x1000 size=0x1000
2026-07-23 22:26:31 Payload transferred
2026-07-23 22:26:31 The BootROM is still requesting data, uploading nulls
2026-07-23 22:26:31 BootROM received all requested data
2026-07-23 22:26:31 Corrupting memory beyond available stack space
2026-07-23 22:26:31 Executing Payload
2026-07-23 22:26:31 Got code execution in EL3, which means your BootROM is now pwned!
2026-07-23 22:26:32 You can now run testsigned firehoses
2026-07-23 22:26:32 Releasing USB after reinitialization by payload
2026-07-23 22:26:32 Device released.
2026-07-23 22:26:32 Reconnecting
2026-07-23 22:26:32 Waiting for Qualcomm device in Sahara state
2026-07-23 22:26:32 Found device!
2026-07-23 22:26:32 Connected to device
2026-07-23 22:26:32 Checking if Sahara was reinitialized correctly
2026-07-23 22:26:32 Sahara was reinited correctly
2026-07-23 22:26:32 Transfer complete, telling PBL it's done
2026-07-23 22:26:32 Loader uploaded successfully
2026-07-23 22:26:32 Device released.
2026-07-23 22:26:32 Exploit finished!

If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint (or use EDL cable) then try again.

Backup necessary UNIQUE partitions

Warning

You MUST backup the following partition : TA & xflkeystore & xflkeystorebak before proceed with EDL flashing and safe it to safe place

As the unbrick (or rescue-only) package OVERRIDE the current one on the device with randomized TA & xblkeystore & xblkeystorebak !!!

If you skip this, YOUR MOTHERBOARD will PERMANENTLY BRICK, with NO WAY TO RESUCE EVEN WITH WORKING EDL !

edl r TA ~/TA_backup.bin --memory=ufs --lun=0
edl r xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0
edl r xflkeystorebak ~/xflkeystorebak_backup.bin --memory ufs --lun=0

The backup will save to your user home home folder : ~/

Keep TA_backup.bin & xflkeystore_backup.bin & xflkeystorebak_backup.bin !!! DO NOT DELETE IT, otherwise the motherboard will be UNRECOVERABLE.

Erase old partition table

MAKE SURE TO HAVE BACKUP IN ABOVE STEP FIRST !!! YOU'VE WARNED !!!!

dd if=/dev/zero of=gpt_empty.bin bs=500000 count=1
edl w gpt gpt_empty.bin --memory=ufs --lun=0
edl w gpt gpt_empty.bin --memory=ufs --lun=1
edl w gpt gpt_empty.bin --memory=ufs --lun=2

Flash EDL package

  • Download unbrick/rescue-only package from requirements step.
  • If you are using XZ3, replace with unzip XZ3*Unbrick*.zip
  • If you are using XZ2 Compact, replace with unzip XZ2C*Unbrick*.zip
unzip XZ2*Unbrick*.zip
cd edlfw
edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml .

Example output

cuynu@x99e $ edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml .
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
DeviceClass
DeviceClass - [LIB]: USB Overflow
main - Mode detected: firehose
Progress: |██████████| 100.0% Write (Sector 0x6 of 0x6, ) 21.27 MB/s
Progress: |██████████| 100.0% Write (Sector 0x5 of 0x5, ) 20.61 MB/s
Progress: |██████████| 100.0% Write (Sector 0x200 of 0x200, ) 24.04 MB/s
Progress: |██████████| 100.0% Write (Sector 0x1000 of 0x1000, ) 24.66 MB/s
Progress: |██████████| 100.0% Write (Sector 0xBC of 0xBC, ) 20.86 MB/s 
Progress: |██████████| 100.0% Write (Sector 0x1400 of 0x1400, ) 24.60 MB/s
...

Set bootable partition

By default after flash, the bootable device is in LUN0 so we have to change it to LUN1, which contain xbl_a and xbl_config_a, as PBL will load XBL and other bootloader components.

edl setbootablestoragedrive 1

Restore Sony original partition table

The gpt_main*.bin is only a placeholder to retrieve partition, it will not boot without restoring official Sony partition table, we have to flash original partition table to make the device boot.

edl w gpt partition-image-LUN0_X-FLASH-ALL-B6B5.img --memory=ufs --lun=0
edl w gpt partition-image-LUN1_X-FLASH-ALL-B6B5.img --memory=ufs --lun=1
edl w gpt partition-image-LUN2_X-FLASH-ALL-B6B5.img --memory=ufs --lun=2

Restore original unique partition backup

Warning

This is UNIQUE file, you MUST restore it after EDL flash, otherwise the device will not turn on due to incorrect TA & xflkeystore & xflkeystorebak.

edl w TA ~/TA_backup.bin --memory=ufs --lun=0
edl w xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0
edl w xflkeystorebak ~/xflkeystorebak_backup.bin --memory=ufs --lun=0

Reboot the device

edl reset

It will reboot the device, and will boot to Sony logo, then load Android, but if it not, or "device is corrupt" screen appears, enter Flash mode, and then reflash firmware for your XZ2/XZ2C/XZ3.

  • If you use rescue-only package, it will loop Sony logo until it show Your device is corrupt screen, at this point use newflasher, find firmware for your model, then reflash. Remember to remove boot folder from firmware folder before flash with newflasher.