Recovering Xperia XZ2/XZ2C/XZ3 (and maybe other TAMA) from hard-brick state

Applies for all XZ2/XZ2C/XZ3 variant (DoCoMo please use specific DoCoMo files)

Written by : @cuynu (feel free to correct me)

Tool credit : j4nn, trustedfirmware (XDA)

Original repositories :

Katana : https://github.com/Daniel224455/katana

SDM845 Payloads : https://github.com/Daniel224455/sdm845-payloads

EDLClient : https://github.com/bkerler/edl

Requirements

• A PC running Linux, (Windows may still work but more complex and is not supported)
• Bkerler EDL tool installed, Python installed with pip
• Katana & SDM845 Payload & Firehose
• Unbrick (or rescue-only) package (get below)

---

• Meaning : [Unbrick package = Full unbrick package with ROM] | [Rescue-only package = Unbrick package without ROM]

---

• Unbrick package for XZ2 Dual SIM (H8266/H8296/H8276) : Download
• Unbrick package for XZ2 Single SIM (H8216/702SO/SOV37) : Download

---

• Rescue-only package for Xperia XZ2 (Single/Dual) : Download
• Rescue-only package for Xperia XZ2 (DoCoMo) : Download

---

• Rescue-only package for Xperia XZ3 (Single/Dual) : Download
• Rescue-only package for Xperia XZ3 (DoCoMo) : Download

---

• Rescue-only package for Xperia XZ2 Compact (Single/Dual) : Download
• Rescue-only package for Xperia XZ2 Compact (DoCoMo) : Download

Notice

• This guide only works if your current phone has working and untouched TA (Trim-Aera), xflkeystore, xflkeystorebak partition, or a backup one
• If TA, xflkeystore, xflkeystorebak is messed up, or your whole phone is messed up with all partition erased (like malicious modules, windows driver ufs,...) and you don't have any backup, there is NO WAY to recover it, as those partition is critical and UNIQUE to each motherboard.

Start

• You need to enter EDL mode first, if the device has corrupted xfl or xbl and the light does not show up then you can just connect USB charger then it will automatically enter EDL
• In case if the device is blinking/stuck at red light of death when connect charger, or keep blinking or just blink once with green light when you hold power button, you need to short testpoint to enter EDL mode.

Find testpoint here

How-to use testpoint: remove battery, short the testpoint circuit, keep short it and connect USB, then release, and check output on PC with lsusb, after recognized, connect the battery again but DO NOT unplug cable, then continue with next steps.

Xperia XZ2 EDL Testpoint

Xperia XZ2 Compact Testpont

Xperia XZ3 Testpoint

After entered, it should show the device

cuynu@x99e $ lsusb | grep 0fce:ade5
Bus xxx Device xxx: ID 0fce:ade5 Sony Ericsson Mobile Communications AB QUSB_BULK_CID:0402_SN:F7D8400F

---

Install EDLClient tool by bkerler / Dependencies

# Debian/Ubuntu/Mint/etc
sudo apt install adb fastboot python3-dev python3-pip liblzma-dev git
sudo apt purge modemmanager

# Fedora/CentOS/etc
sudo dnf install adb fastboot python3-devel python3-pip xz-devel git

# Arch/Manjaro/etc
sudo pacman -S android-tools python python-pip git xz
sudo pacman -R modemmanager

# Gentoo (run as root!)
emerge -aq dev-util/android-tools dev-vcs/git dev-python/pip

# For systemd distros

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
# For OpenRC distros (run as root!)
rc-update del modemmanager default boot sysinit
rc-service modemmanager stop

# Install EDLClient tool

git clone https://github.com/bkerler/edl.git # do NOT use --recurse-submodules
cd edl
git submodule update --init --recursive
pip install . --break-system-packages

If you have problem with installing EDLClient tool (pylzma failed to build/install), do this

• Clone this fork

git clone https://github.com/electimon/pylzma.git

Install manually

cd pylzma
python setup.py build
sudo python setup.py install

Then try cd .. && pip install . --break-system-packages to install again.

---

Clone and prepare BootROM exploit tool (this is my fork with changes to work with specific Sony TAMA VID/PID, as it is 0fce:ade5, and providing pre-built binaries)

git clone https://git.disroot.org/cuynu/fhcoyote_sdm845.git
git clone https://git.disroot.org/cuynu/katana-fork.git
cd katana-fork
pip install -r requirements.txt --break-system-packages
cp ../fhcoyote_sdm845.git/*.elf .

---

Run the exploit

python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf

Output should be like this (katana banner removed)

2026-07-04 16:12:23
Qualcomm BootROM Exploit - CVE-2021-30327
Version 1.0 (c) 2025 Daniel224455 <danalexgro@gmail.com> - github.com/Daniel224455/katana
Selected SoC: sdm845
Searching for Qualcomm device in Sahara state
Found device!
Connected to device
Sahara version 2
Device is in PBL Sahara
Starting exploit
Coyote payload detected
Sending payload segment, offset=0x0 size=0x40
Sending payload segment, offset=0x40 size=0x428
Sending payload segment, offset=0x1000 size=0x1000
Transferred payload, now trying to get our shellcode to execute!
Transferring nulls to satisfy PBL
Executing shellcode
Your BootROM is now pwned!
You can now run testsigned firehoses
Releasing USB after reinit by payload
Device released.
Reconnecting
Searching for Qualcomm device in Sahara state
Found device!
Connected to device
Checking if sahara was reinitialized correctly
Transfer complete, telling PBL it's done
Loader uploaded successfully
Device released.

If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint, or replug then connect (if xbl,xfl is corrupted) then try again.

Backup necessary UNIQUE partitions

Warning

You MUST backup the following partition : TA & xflkeystore & xflkeystorebak before proceed with EDL flashing and safe it to safe place

As the unbrick (or rescue-only) package OVERRIDE the current one on the device with randomized TA & xblkeystore & xblkeystorebak !!!

If you skip this, YOUR MOTHERBOARD will PERMANENTLY BRICK, with NO WAY TO RESUCE EVEN WITH WORKING EDL !

edl r TA ~/TA_backup.bin --memory=ufs --lun=0
edl r xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0
edl r xflkeystorebak ~/xflkeystorebak_backup.bin --memory ufs --lun=0

The backup will save to your user home home folder : ~/

Keep TA_backup.bin & xflkeystore_backup.bin & xflkeystorebak_backup.bin !!! DO NOT DELETE IT, otherwise the motherboard will be UNRECOVERABLE.

Erase old partition table

MAKE SURE TO HAVE BACKUP IN ABOVE STEP FIRST !!! YOU'VE WARNED !!!!

dd if=/dev/zero of=gpt_empty.bin bs=500000 count=1
edl w gpt gpt_empty.bin --memory=ufs --lun=0
edl w gpt gpt_empty.bin --memory=ufs --lun=1
edl w gpt gpt_empty.bin --memory=ufs --lun=2

Flash EDL package

• Download unbrick/rescue-only package from requirements step.
• If you are using XZ3, replace with unzip XZ3*Unbrick*.zip
• If you are using XZ2 Compact, replace with unzip XZ2C*Unbrick*.zip

unzip XZ2*Unbrick*.zip
cd edlfw
edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml .

Example output

cuynu@x99e $ edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml .
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
DeviceClass
DeviceClass - [LIB]: USB Overflow
main - Mode detected: firehose
Progress: |██████████| 100.0% Write (Sector 0x6 of 0x6, ) 21.27 MB/s
Progress: |██████████| 100.0% Write (Sector 0x5 of 0x5, ) 20.61 MB/s
Progress: |██████████| 100.0% Write (Sector 0x200 of 0x200, ) 24.04 MB/s
Progress: |██████████| 100.0% Write (Sector 0x1000 of 0x1000, ) 24.66 MB/s
Progress: |██████████| 100.0% Write (Sector 0xBC of 0xBC, ) 20.86 MB/s 
Progress: |██████████| 100.0% Write (Sector 0x1400 of 0x1400, ) 24.60 MB/s
...

Set bootable partition

By default after flash, the bootable device is in LUN0 so we have to change it to LUN1, which contain xbl_a and xbl_config_a, as PBL will load XBL and other bootloader components.

edl setbootablestoragedrive 1

Restore Sony original partition table

The gpt_main*.bin is only a placeholder to retrieve partition, it will not boot without restoring official Sony partition table, we have to flash original partition table to make the device boot.

edl w gpt partition-image-LUN0_X-FLASH-ALL-B6B5.img --memory=ufs --lun=0
edl w gpt partition-image-LUN1_X-FLASH-ALL-B6B5.img --memory=ufs --lun=1
edl w gpt partition-image-LUN2_X-FLASH-ALL-B6B5.img --memory=ufs --lun=2

Restore original unique partition backup

Warning

This is UNIQUE file, you MUST restore it after EDL flash, otherwise the device will not turn on due to incorrect TA & xflkeystore & xflkeystorebak.

edl w TA ~/TA_backup.bin --memory=ufs --lun=0
edl w xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0
edl w xflkeystorebak ~/xflkeystorebak_backup.bin --memory=ufs --lun=0

Reboot the device

edl reset

It will reboot the device, and will boot to Sony logo, then load Android, but if it not, or "device is corrupt" screen appears, enter Flash mode, and then reflash firmware for your XZ2/XZ2C/XZ3.

• If you use rescue-only package, it will loop Sony logo until it show Your device is corrupt screen, at this point use newflasher, find firmware for your model, then reflash. Remember to remove boot folder from firmware folder before flash with newflasher.