256 lines
9.8 KiB
Markdown
256 lines
9.8 KiB
Markdown
# Recovering Xperia XZ2 (and maybe other TAMA) from hard-brick state
|
|
|
|
Applies for H8216, H8266, H8276, H8296 (International)
|
|
And Japanese (SOV37, 702SO), not for SO-03K yet.
|
|
|
|
Written by : @cuynu (feel free to correct me)
|
|
|
|
Tool credit : j4nn, trustedinstaller (XDA)
|
|
|
|
## Requirements
|
|
|
|
- A PC running Linux, (Windows may still work but more complex and is not supported)
|
|
- Bkerler EDL tool installed, Python installed with `pip`
|
|
- Katana & SDM845 Payload & Firehose
|
|
- Unbrick (or rescue-only) package (get below)
|
|
- Meaning : [Unbrick package = Full unbrick package with ROM] | [Rescue-only package = Unbrick package without ROM]
|
|
- Unbrick package for XZ2 Dual SIM (H8266/H8296/H8276) : [Download](https://cuynutt.ddns.net/files/XZ2_Unbrick/XZ2_H8266_52.1.A.3.137_Unbrick_EDL.zip)
|
|
- Unbrick package for XZ2 Single SIM (H8216/702SO/SOV37) : [Download](https://cuynutt.ddns.net/files/XZ2_Unbrick/XZ2_H8216_52.1.A.3.49_Unbrick_EDL.zip)
|
|
- Rescue-only package for XZ2 (Single/Dual) : [Download](https://cuynutt.ddns.net/files/XZ2_Unbrick/XZ2_Unbrick_EDL_RescueOnly.zip)
|
|
|
|
## Notice
|
|
|
|
- This guide only works if your current phone has working and untouched `TA` (Trim-Aera), `xflkeystore`, `xflkeystorebak` partition, or a backup one
|
|
- If `TA`, `xflkeystore`, `xflkeystorebak` is messed up, or your whole phone is messed up with all partition erased (like malicious modules, windows driver ufs,...) and you don't have any backup, there is NO WAY to recover it, as those partition is critical and UNIQUE to each motherboard.
|
|
|
|
## Start
|
|
|
|
- You need to enter EDL mode first, if the device has corrupted `xfl` or `xbl` and the light does not show up then you can just connect USB charger then it will automatically enter EDL
|
|
- In case if the device is blinking/stuck at red light of death when connect charger, or keep blinking or just blink once with green light when you hold power button, you need to short testpoint to enter EDL mode.
|
|
|
|
Find testpoint here
|
|
|
|
How-to use testpoint: remove battery, short the testpoint circuit, keep short it and connect USB, then release, and check output on PC with `lsusb`, after recognized, connect the battery again but DO NOT unplug cable, then continue with next steps.
|
|
|
|
Xperia XZ2 EDL Testpoint
|
|
<details>
|
|
|
|
<img alt="xz2 tp" src="https://gitlab.com/cuynu/archive/-/raw/main/xz2_testpoint.png" width="500" height="700" />
|
|
|
|
</details>
|
|
|
|
Xperia XZ2 Compact Testpont
|
|
|
|
<details>
|
|
|
|
<img alt="xz2c tp" src="https://gitlab.com/cuynu/archive/-/raw/main/xz2c_testpoint.png" width="500" height="700" />
|
|
|
|
</details>
|
|
|
|
Xperia XZ3 Testpoint
|
|
|
|
<details>
|
|
|
|
<img alt="xz3 tp" src="https://gitlab.com/cuynu/archive/-/raw/main/xz3_testpoint.png" width="500" height="800" />
|
|
|
|
</details>
|
|
|
|
After entered, it should show the device
|
|
|
|
```
|
|
cuynu@x99e $ lsusb | grep 0fce:ade5
|
|
Bus xxx Device xxx: ID 0fce:ade5 Sony Ericsson Mobile Communications AB QUSB_BULK_CID:0402_SN:F7D8400F
|
|
```
|
|
|
|
----------------------------------------------
|
|
|
|
Install EDLClient tool by bkerler
|
|
|
|
```
|
|
# Debian/Ubuntu/Mint/etc
|
|
sudo apt install adb fastboot python3-dev python3-pip liblzma-dev git
|
|
sudo apt purge modemmanager
|
|
# Fedora/CentOS/etc
|
|
sudo dnf install adb fastboot python3-devel python3-pip xz-devel git
|
|
# Arch/Manjaro/etc
|
|
sudo pacman -S android-tools python python-pip git xz
|
|
sudo pacman -R modemmanager
|
|
# Gentoo (run as root!)
|
|
emerge -aq dev-util/android-tools dev-vcs/git dev-python/pip
|
|
|
|
# For systemd distros
|
|
sudo systemctl stop ModemManager
|
|
sudo systemctl disable ModemManager
|
|
# For OpenRC distros (run as root!)
|
|
rc-update del modemmanager default boot sysinit
|
|
rc-service modemmanager stop
|
|
|
|
git clone https://github.com/bkerler/edl.git # do NOT use --recurse-submodules
|
|
cd edl
|
|
git submodule update --init --recursive
|
|
|
|
# Manual install
|
|
chmod +x ./install-linux-edl-drivers.sh
|
|
bash ./install-linux-edl-drivers.sh
|
|
pip3 install . --break-system-packages
|
|
```
|
|
|
|
If you have problem with installing EDLClient tool (pylzma failed to build/install), do this
|
|
- Clone this fork
|
|
```
|
|
git clone https://github.com/electimon/pylzma.git
|
|
```
|
|
Install manually\
|
|
```
|
|
cd pylzma
|
|
python setup.py build
|
|
sudo python setup.py install
|
|
```
|
|
Then try `cd .. && pip 3 install . --break-system-packages` to install again.
|
|
|
|
-------------------------------------------
|
|
|
|
Clone and prepare BootROM exploit tool
|
|
```
|
|
git clone https://git.disroot.org/cuynu/fhcoyote_sdm845.git
|
|
git clone https://git.disroot.org/cuynu/katana-fork.git
|
|
cd katana-fork
|
|
pip install -r requirements.txt --break-system-packages
|
|
cp ../fhcoyote_sdm845.git/*.elf .
|
|
```
|
|
------------------------------------------
|
|
|
|
Run the exploit
|
|
```
|
|
python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf
|
|
```
|
|
|
|
Output should be like this (katana banner removed)
|
|
```
|
|
2026-07-04 16:12:23
|
|
Qualcomm BootROM Exploit - CVE-2021-30327
|
|
Version 1.0 (c) 2025 Daniel224455 <danalexgro@gmail.com> - github.com/Daniel224455/katana
|
|
Selected SoC: sdm845
|
|
Searching for Qualcomm device in Sahara state
|
|
Found device!
|
|
Connected to device
|
|
Sahara version 2
|
|
Device is in PBL Sahara
|
|
Starting exploit
|
|
Coyote payload detected
|
|
Sending payload segment, offset=0x0 size=0x40
|
|
Sending payload segment, offset=0x40 size=0x428
|
|
Sending payload segment, offset=0x1000 size=0x1000
|
|
Transferred payload, now trying to get our shellcode to execute!
|
|
Transferring nulls to satisfy PBL
|
|
Executing shellcode
|
|
Your BootROM is now pwned!
|
|
You can now run testsigned firehoses
|
|
Releasing USB after reinit by payload
|
|
Device released.
|
|
Reconnecting
|
|
Searching for Qualcomm device in Sahara state
|
|
Found device!
|
|
Connected to device
|
|
Checking if sahara was reinitialized correctly
|
|
Transfer complete, telling PBL it's done
|
|
Loader uploaded successfully
|
|
Device released.
|
|
```
|
|
|
|
If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint, or replug then connect (if xbl,xfl is corrupted) then try again.
|
|
|
|
## Backup necessary UNIQUE partitions
|
|
> [!WARNING]
|
|
> You MUST backup the following partition : `TA` & `xflkeystore` & `xflkeystorebak` before proceed with EDL flashing and safe it to safe place
|
|
>
|
|
> As the unbrick (or rescue-only) package OVERRIDE the current one on the device with randomized `TA` & `xblkeystore` & `xblkeystorebak` !!!
|
|
>
|
|
> If you skip this, YOUR MOTHERBOARD will PERMANENTLY BRICK, with NO WAY TO RESUCE EVEN WITH WORKING EDL !
|
|
|
|
```
|
|
edl r TA ~/TA_backup.bin --memory=ufs --lun=0
|
|
edl r xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0
|
|
edl r xflkeystorebak ~/xflkeystorebak_backup.bin --memory ufs --lun=0
|
|
```
|
|
The backup will save to your user home home folder : `~/`
|
|
|
|
Keep `TA_backup.bin` & `xflkeystore_backup.bin` & `xflkeystorebak_backup.bin` !!!
|
|
DO NOT DELETE IT, otherwise the motherboard will be UNRECOVERABLE.
|
|
|
|
## Erase old partition table
|
|
|
|
MAKE SURE TO HAVE BACKUP IN ABOVE STEP FIRST !!! YOU'VE WARNED !!!!
|
|
|
|
```
|
|
dd if=/dev/zero of=gpt_empty.bin bs=500000 count=1
|
|
edl w gpt gpt_empty.bin --memory ufs --lun 0
|
|
edl w gpt gpt_empty.bin --memory ufs --lun 1
|
|
edl w gpt gpt_empty.bin --memory ufs --lun 2
|
|
```
|
|
|
|
## Flash EDL firmware
|
|
- Download unbrick firmware from requirements step.
|
|
- As of now, current unbrick (or rescue only) package only work with XZ2 with H8216 and H8266, there is NO support for DoCoMo yet so DO NOT FLASH THIS EDL FIRMWARE FOR DoCoMo variant.
|
|
- Contact me on Telegram [@cuynuz](https://t.me/cuynuz) if you want to help me to made one
|
|
```
|
|
unzip XZ2*Unbrick*.zip
|
|
cd edlfw
|
|
edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml .
|
|
```
|
|
Example output
|
|
```
|
|
cuynu@x99e $ edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml .
|
|
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
|
|
main - Trying with no loader given ...
|
|
main - Waiting for the device
|
|
main - Device detected :)
|
|
DeviceClass
|
|
DeviceClass - [LIB]: USB Overflow
|
|
main - Mode detected: firehose
|
|
Progress: |██████████| 100.0% Write (Sector 0x6 of 0x6, ) 21.27 MB/s
|
|
Progress: |██████████| 100.0% Write (Sector 0x5 of 0x5, ) 20.61 MB/s
|
|
Progress: |██████████| 100.0% Write (Sector 0x200 of 0x200, ) 24.04 MB/s
|
|
Progress: |██████████| 100.0% Write (Sector 0x1000 of 0x1000, ) 24.66 MB/s
|
|
Progress: |██████████| 100.0% Write (Sector 0xBC of 0xBC, ) 20.86 MB/s
|
|
Progress: |██████████| 100.0% Write (Sector 0x1400 of 0x1400, ) 24.60 MB/s
|
|
...
|
|
```
|
|
|
|
## Set bootable partition
|
|
|
|
By default after flash, the bootable device is in `LUN0` so we have to change it to `LUN1`, which contain `xbl_a` and `xbl_config_a`, as PBL will load XBL and other bootloader components.
|
|
|
|
```
|
|
edl setbootablestoragedrive 1
|
|
```
|
|
|
|
## Restore Sony original partition table
|
|
|
|
The `gpt_main*.bin` is only a placeholder to retrieve partition, it will not boot without restoring official Sony partition table, we have to flash original partition table to make the device boot.
|
|
|
|
```
|
|
edl w gpt partition-image-LUN0_X-FLASH-ALL-B6B5.img --memory=ufs --lun=0
|
|
edl w gpt partition-image-LUN1_X-FLASH-ALL-B6B5.img --memory=ufs --lun=1
|
|
edl w gpt partition-image-LUN2_X-FLASH-ALL-B6B5.img --memory=ufs --lun=2
|
|
```
|
|
|
|
## Restore original unique partition backup
|
|
|
|
> [!WARNING]
|
|
> This is UNIQUE file, you MUST restore it after EDL flash, otherwise the device will not turn on due to incorrect `TA` & `xflkeystore` & `xflkeystorebak`.
|
|
>
|
|
|
|
```
|
|
edl w TA ~/TA_backup.bin --memory=ufs --lun=0
|
|
edl w xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0
|
|
edl w xflkeystorebak ~/xflkeystorebak_backup.bin --memory=ufs --lun=0
|
|
```
|
|
|
|
## Reboot the device
|
|
```
|
|
edl reset
|
|
```
|
|
|
|
It will reboot the device, and will boot to Sony logo, then load Android, but if it not, or "device is corrupt" screen appears, enter Flash mode, and then reflash firmware for your XZ2.
|
|
- If you use `rescue-only` package, it will loop Sony logo until it show `Your device is corrupt` screen, at this point use `newflasher`, find firmware for your model, then reflash. Remember to remove `boot` folder from firmware folder before flash with `newflasher`.
|