Recovering Xperia XZ2 (and maybe other TAMA) from hard-brick state

Applies for H8216, H8266, H8276, H8296 (International) And Japanese (SOV37, 702SO), not for SO-03K yet.

Written by : @cuynu (feel free to correct me)

Tool credit : j4nn, trustedinstaller (XDA)

Requirements

• A PC running Linux, (Windows may still work but more complex)
• Bkerler EDL tool installed, Python installed with pip
• Katana & SDM845 Payload & Firehose
• Unbrick package

Notice

• This guide only works if your current phone has working and untouched TA (Trim-Aera), xflkeystore, xflkeystorebak partition, or a backup one
• If TA, xflkeystore, xflkeystorebak is messed up, or your whole phone is messed up with all partition erased (like malicious modules, windows driver ufs,...) and you don't have any backup, there is NO WAY to recover it, as those partition is critical and UNIQUE to each motherboard.

Start

• You need to enter EDL mode first, if the device has corrupted xfl or xbl and the light does not show up then you can just connect USB charger then it will automatically enter EDL
• In case if the device is blinking/stuck at red light of death when connect charger, or keep blinking or just blink once with green light when you hold power button, you need to short testpoint to enter EDL mode.

After entered, it should show the device

cuynu@x99e $ lsusb | grep 0fce:ade5
Bus xxx Device xxx: ID 0fce:ade5 Sony Ericsson Mobile Communications AB QUSB_BULK_CID:0402_SN:F7D8400F

Install EDLClient tool by bkerler

# Debian/Ubuntu/Mint/etc
sudo apt install adb fastboot python3-dev python3-pip liblzma-dev git
sudo apt purge modemmanager
# Fedora/CentOS/etc
sudo dnf install adb fastboot python3-devel python3-pip xz-devel git
# Arch/Manjaro/etc
sudo pacman -S android-tools python python-pip git xz
sudo pacman -R modemmanager
# Gentoo (run as root!)
emerge -aq dev-util/android-tools dev-vcs/git dev-python/pip

# For systemd distros
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
# For OpenRC distros (run as root!)
rc-update del modemmanager default boot sysinit
rc-service modemmanager stop

git clone https://github.com/bkerler/edl.git # do NOT use --recurse-submodules
cd edl
git submodule update --init --recursive

# Manual install
chmod +x ./install-linux-edl-drivers.sh
bash ./install-linux-edl-drivers.sh
pip3 install . --break-system-packages

Clone and prepare BootROM exploit tool

git clone https://git.disroot.org/cuynu/fhcoyote_sdm845.git
git clone https://git.disroot.org/cuynu/katana-fork.git
cd katana-fork
pip install -r requirements.txt --break-system-packages
cp ../fhcoyote_sdm845.git/*.elf .

Run the exploit

python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf

Output should be

2026-07-04 16:12:23 

88                                                                   
88                       ,d                                          
88                       88                                          
88   ,d8   ,adPPYYba,  MM88MMM  ,adPPYYba,  8b,dPPYba,   ,adPPYYba,  
88 ,a8"    ""     `Y8    88     ""     `Y8  88P'   `"8a  ""     `Y8  
8888[      ,adPPPPP88    88     ,adPPPPP88  88       88  ,adPPPPP88  
88`"Yba,   88,    ,88    88,    88,    ,88  88       88  88,    ,88  
88   `Y8a  `"8bbdP"Y8    "Y888  `"8bbdP"Y8  88       88  `"8bbdP"Y8  
                                                                     
                                    
    
Qualcomm BootROM Exploit - CVE-2021-30327
Version 1.0 (c) 2025 Daniel224455 <danalexgro@gmail.com> - github.com/Daniel224455/katana
Selected SoC: sdm845
Searching for Qualcomm device in Sahara state
Found device!
Connected to device
Sahara version 2
Device is in PBL Sahara
Starting exploit
Coyote payload detected
Sending payload segment, offset=0x0 size=0x40
Sending payload segment, offset=0x40 size=0x428
Sending payload segment, offset=0x1000 size=0x1000
Transferred payload, now trying to get our shellcode to execute!
Transferring nulls to satisfy PBL
Executing shellcode
Your BootROM is now pwned!
You can now run testsigned firehoses
Releasing USB after reinit by payload
Device released.
Reconnecting
Searching for Qualcomm device in Sahara state
Found device!
Connected to device
Checking if sahara was reinitialized correctly
Transfer complete, telling PBL it's done
Loader uploaded successfully
Device released.

If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint, or replug then connect (if xbl,xfl is corrupted) then try again.

Backup necessary UNIQUE partitions

• Required: TA & xflkeystore & xflkeystorebak

edl r TA ~/TA_backup.bin --memory=ufs --lun=0
edl r xflkeystore xflkeystore_backup.bin --memory=ufs --lun=0
edl r xflkeystorebak xflkeystorebak_backup.bin --memory ufs --lun=0

Keep TA_backup.bin & xflkeystore_backup.bin & xflkeystorebak_backup.bin !!! DO NOT DELETE IT, otherwise the motherboard will be UNRECOVERABLE.

Erase old partition table

edl w gpt gpt_empty.bin --memory ufs --lun 0
edl w gpt gpt_empty.bin --memory ufs --lun 1
edl w gpt gpt_empty.bin --memory ufs --lun 2

Flash EDL firmware

• This is H8266 with 52.1.A.3.137 firmware with Q207 retail bootloader. It works with H8266, H8216, H8276, SOV37, 702SO, except SO-03K.

edl qfil rawprogram0.xml patch0.xml . && edl qfil rawprogram1.xml patch1.xml . && edl qfil rawprogram2.xml patch2.xml .

In flash progress, there will be errors like

firehose_client - [LIB]: ./ssd.bin doesn't exist!
firehose_client - [LIB]: ./devinfo.bin doesn't exist!
firehose_client - [LIB]: ./ddr.bin doesn't exist!
firehose_client - [LIB]: ./sec.bin doesn't exist!
firehose_client - [LIB]: ./apdp.bin doesn't exist!
firehose_client - [LIB]: ./msadp.bin doesn't exist!
firehose_client - [LIB]: ./spunvm.bin doesn't exist!
firehose_client - [LIB]: ./limits.bin doesn't exist!
firehose_client - [LIB]: ./toolsfv.bin doesn't exist!
firehose_client - [LIB]: ./logfs.bin doesn't exist!
firehose_client - [LIB]: ./logdump.bin doesn't exist!
firehose_client - [LIB]: ./cdt.bin doesn't exist!
firehose_client - [LIB]: ./keystore.bin doesn't exist!
firehose_client - [LIB]: ./fsc.bin doesn't exist!
firehose_client - [LIB]: ./rddata.bin doesn't exist!

Just ignore it.

Set bootable partition

By default after flash, the bootable device is in LUN0 so we have to change it to LUN1, which contain xbl_a and xbl_config_a, as PBL will load XBL and other bootloader components.

edl setbootablestoragedrive 1

Restore Sony original partition table

The gpt_main*.bin is only a placeholder to retrieve partition, it will not boot without restoring official Sony partition table, we have to flash original partition table to make the device boot.

edl w gpt partition-image-LUN0_X-FLASH-ALL-B6B5.img --memory=ufs --lun=0
edl w gpt partition-image-LUN1_X-FLASH-ALL-B6B5.img --memory=ufs --lun=1
edl w gpt partition-image-LUN2_X-FLASH-ALL-B6B5.img --memory=ufs --lun=2

Restore original unique partition backup

This is UNIQUE file, you have to restore it after EDL flash, otherwise the device will not turn on, it may conflict

edl w TA ~/TA_backup.bin --memory=ufs --lun=0
edl w xflkeystore ~/xflkeystore_backup.bin --memory=ufs --lun=0
edl w xflkeystorebak ~/xflkeystorebak.bin --memory=ufs --lun=0

Reboot the device

edl reset

It will reboot the device, and will boot to Sony logo, then load Android, but if it not, or "device is corrupt" screen appears, enter Flash mode, and then reflash firmware for your XZ2.