S.onyXT.S v1.0 [UNBRICKER] - Xperia Tab S auto unbricker/flasher!

Search This thread

stth

Member
Nov 21, 2007
15
1
That is just some great work. Were the kernel different?
jep, they were different.
It was the Tablet P kernel from signed-nbx02_004-ota-121121004.zip
-> http://xdaforums.com/showthread.php?t=1687429

i just tried to read out the kernel the easy way, but this does not work

root@android:/dev # dd if=mem of=/imgdata/dev-mem-25mb.img bs=512 count=50000
mem: read error: Bad address
0+0 records in
0+0 records out
0 bytes transferred in 0.001 secs (0 bytes/sec)

So is there a way to do this with your kernel with kexec? Do you have a tutorial for this? How did you manage to build into the kexec module/option is it scrabled or will the tablet s also boot a normal kernel?

€:
this brought me to the idea to put an unscrambled kernel on the sd card. but this did not work ) :
 
Last edited:

stth

Member
Nov 21, 2007
15
1
I am waiting for tablet P unbricker release.

i beg you for same tool, but for tablet S !!))

condi's tool should work there, too. I could boot the xperia tablet s with a tablet p kernel into system. It should work vice versa.

try the script to the point where it creates the sd image. then abort. put the sd in the tablet and see if it boots. if it boots from sd (you'll see a message), you should get root by executing
adb shell "/system/xbin/pwn"
and verify with (can't be executed in one adb shell)
adb shell "/system/xbin/busyboxbin/mount -o rw,remount /"

up to this point nothing should be changed on the tablet, so nothing will go wrong (abort the script at the right time!)

does that work on tablet p/s?
 
Last edited:
  • Like
Reactions: dex9mm

1Hax

Senior Member
Jul 22, 2010
72
10
condi's tool should work there, too. I could boot the xperia tablet s with a tablet p kernel into system. It should work vice versa.

try the script to the point where it creates the sd image. then abort. put the sd in the tablet and see if it boots. if it boots from sd (you'll see a message), you should get root by executing
adb shell "/system/xbin/pwn"
and verify with (can't be executed in one adb shell)
adb shell "/system/xbin/busyboxbin/mount -o rw,remount /"

up to this point nothing should be changed on the tablet, so nothing will go wrong (abort the script at the right time!)

does that work on tablet p/s?

device do not boot from sd. Unbricker do not see my STS either. it says "waiting for device". when i connect it in recovery mode, i can see "attached device" in adb shell. but unbricker dont see it anyway. or may be i did it all wrong?

sorry for my F+ english )
 

stth

Member
Nov 21, 2007
15
1
Did you check if the image really is on the sd? there should be 3 partitions in fdisk. the first one should be broken and you must not repair it. the second one should contain a minimal system an the third and biggest one is empty. if you can see the disk in hex, there is a 0x42, 0x42 at address 0x0000 0400.
 

1Hax

Senior Member
Jul 22, 2010
72
10
Did you check if the image really is on the sd? there should be 3 partitions in fdisk. the first one should be broken and you must not repair it. the second one should contain a minimal system an the third and biggest one is empty. if you can see the disk in hex, there is a 0x42, 0x42 at address 0x0000 0400.

yep. cant see the hex, but everything other is like u said
 

stth

Member
Nov 21, 2007
15
1
yep. cant see the hex, but everything other is like u said
hm... thats too bad.

OK let's go mad.

extract that kernel from the image
dd if=unbrick.img of=unbrick_kernel.img bs=512 count=9000 skip=2

clean up the sd between mbr and first partition
dd if=/dev/zero of=/dev/sdX bs=512 count=62 seek=2

copy kernel into first partition
dd if=unbrick_kernel.img of=/dev/sdX1

if this modified image does not work, I suggest to fiddle around with the old offset a bit
for Y in 1, 3, 4, 6, 8 etc.(not 0, thats the mbr)
* clean up again (see above)
* put the kernel at another offset dd if=unbrick_kernel.img of=/dev/sdX bs=512 seek=Y
* test if it boots

after that, you could try to do the same with the hidden.img as kernel image. you would get this from your official OTA image
see here -> http://xdaforums.com/showthread.php?t=1687429
the descrambler for it is in condis UNBRICKER package. after that you can open it with any packing-program.

€: do you use linux? if not, you must change the commands to fit dd.exe google should help with that.

or you just boot an ubuntu image from usb stick, test (do not install) open a terminal, do "sudo su -" and you can execute the commands easily. be careful! do a"ls /dev/sd*" before and after putting in the sd. only execute dd if you are 100% sure which sdX device the sd card is. otherwise you could overwrite something important on your system.
 
Last edited:

dex9mm

Senior Member
Did you check if the image really is on the sd? there should be 3 partitions in fdisk. the first one should be broken and you must not repair it. the second one should contain a minimal system an the third and biggest one is empty. if you can see the disk in hex, there is a 0x42, 0x42 at address 0x0000 0400.

Is the Unbricker script device specific (drivers needed for Sts?) for it to start just a thought from reading tread


Sent from my C1905 using XDA Free mobile app
 

stth

Member
Nov 21, 2007
15
1
Is the Unbricker script device specific (drivers needed for Sts?) for it to start just a thought from reading tread


Sent from my C1905 using XDA Free mobile app

drivers should be in the kernel image. and both are tegra chip sets. i just tried to also boot the sts kernel on the xts. it only boots, if i overwrite the end of the other kernel.

1 (if not aleady done))
dd if=unbrick.img of=/dev/sdX
2)
dd of=/dev/zero of=/dev/sdX bs=512 seek=19000 count=1000
3)
dd if=hidden_sts_ota.img of=/dev/sdX bs=512 seek=2


if you replace the unbricker kernel on the sd by the ota kernel, the tablet should boot as usual. that means, a tablet with broken kernel should boot, a tablet with broken system should not boot (same error as usual), a working tablet should look like it boots as usual (but the kernel should be different). can anyone verify that?
 
Last edited:

1Hax

Senior Member
Jul 22, 2010
72
10
hm... thats too bad.

OK let's go mad.

extract that kernel from the image
dd if=unbrick.img of=unbrick_kernel.img bs=512 count=9000 skip=2

clean up the sd between mbr and first partition
dd if=/dev/zero of=/dev/sdX bs=512 count=62 seek=2

copy kernel into first partition
dd if=unbrick_kernel.img of=/dev/sdX1

if this modified image does not work, I suggest to fiddle around with the old offset a bit
for Y in 1, 3, 4, 6, 8 etc.(not 0, thats the mbr)
* clean up again (see above)
* put the kernel at another offset dd if=unbrick_kernel.img of=/dev/sdX bs=512 seek=Y
* test if it boots

after that, you could try to do the same with the hidden.img as kernel image. you would get this from your official OTA image
see here -> http://xdaforums.com/showthread.php?t=1687429
the descrambler for it is in condis UNBRICKER package. after that you can open it with any packing-program.

€: do you use linux? if not, you must change the commands to fit dd.exe google should help with that.

or you just boot an ubuntu image from usb stick, test (do not install) open a terminal, do "sudo su -" and you can execute the commands easily. be careful! do a"ls /dev/sd*" before and after putting in the sd. only execute dd if you are 100% sure which sdX device the sd card is. otherwise you could overwrite something important on your system.


i had vacation) could you explain me like for a kid... what should i do step by step ? ( im dumb... using windows. all i tryed failed.
 

stth

Member
Nov 21, 2007
15
1
i had vacation) could you explain me like for a kid... what should i do step by step ? ( im dumb... using windows. all i tryed failed.

No problem, you're well relaxed?

The idea is to change the position of the kernel image on the sd-card. I don't know the exact syntax of the dd command 4 win, you should ask it by executing dd.exe --help. guessing from the command from condis script it should be nearly the same.

/dev/zero should be something different in win > http://serverfault.com/questions/321473/dev-zero-equivalent-in-windows
/dev/sdX must be replaced by \\.\X: where X is the drive letter of the SD (double check! ... really!)

Does this help already?
 

1Hax

Senior Member
Jul 22, 2010
72
10
No problem, you're well relaxed?

The idea is to change the position of the kernel image on the sd-card. I don't know the exact syntax of the dd command 4 win, you should ask it by executing dd.exe --help. guessing from the command from condis script it should be nearly the same.

/dev/zero should be something different in win > http://serverfault.com/questions/321473/dev-zero-equivalent-in-windows
/dev/sdX must be replaced by \\.\X: where X is the drive letter of the SD (double check! ... really!)

Does this help already?

not as well as expected) i have linux laptop if its easyer. but not sure for drivers..
should i take sxts's kernel? cuz i cant open\decrypt ota for my sts
 

stth

Member
Nov 21, 2007
15
1
not as well as expected) i have linux laptop if its easyer. but not sure for drivers..
should i take sxts's kernel? cuz i cant open\decrypt ota for my sts

jep, linux would be easier at some point but the unscrambler is only for win. but if dd and dev zero is no problem on your machine, it's ok to use win for that.

The zip has to be processed by desklunvr.exe from the condi-package first.
-> desklunvr.exe ota.zip

€: on linux you may have a adb package to install which should be sufficient. the driver is in the kernel. / for desklunvr.exe you'll need wine
 
Last edited:

stth

Member
Nov 21, 2007
15
1
unbrick, root and debloat xts

hi,

i had problems to execute condis batch script for windows, so i rewrote it for bash/linux and extended it's function a bit. It uses the file mirrors used by condi, so if anybody sees a problem with this, please tell me. references are included.

it can also be used as root script, if you delete some steps.
it can also be used to apply a custom rom, if you modify it.

see attachment. extract and run the shell script. adb, wine and root access (on host) are required. guide is included.

thanks go to @condi and all his sources, @stifilz, @Chainfire, LeslieAnn@androidcentral, @jappaj

cheers, stth
 

Attachments

  • sony.xts.unbricker.zip
    924.3 KB · Views: 558
Last edited:

gemini16

Senior Member
Dec 23, 2009
54
15
hanoi
Seems bootloader for XTS different with STS, STP so Unbrick.IMG from condi's Unbricker can't boot STS, STP from SD card.
 

sanderbouw

Senior Member
Sep 5, 2011
117
34
It took me a while before i got it working on the XTS, it seems the unbricker needs the right SD card to work. The least I can do is share which sd's are working, so you won't face the same problems i did:

Not working:
- TDK 4gb SDHC class 4
- Sandisk 4gb SDHC class 2
- Sandisk 2gb SD class 2
- Transcend 2gb SD class unknown
- Kingston 4gb SDHC class 4
- Integral MicroSD adapter with SD-02g Taiwan 2gb MicroSD class unkown

Working:
- Samsung MicroSD adapter with Samsung 16gb MicroSD class 10
 

pyroz

New member
Apr 6, 2006
4
0
Tab Xperia S asking for google account

Hello,

I need reset my tablet, its asking for google password

its model Tab Xperia S SGPT111DE/S

I have try to flash it with S.onyXT.S [UNBRICKER] v1.0 but nothing happend, never cold booting on screen

any idea ?

br,
pyroz




It took me a while before i got it working on the XTS, it seems the unbricker needs the right SD card to work. The least I can do is share which sd's are working, so you won't face the same problems i did:

Not working:
- TDK 4gb SDHC class 4
- Sandisk 4gb SDHC class 2
- Sandisk 2gb SD class 2
- Transcend 2gb SD class unknown
- Kingston 4gb SDHC class 4
- Integral MicroSD adapter with SD-02g Taiwan 2gb MicroSD class unkown

Working:
- Samsung MicroSD adapter with Samsung 16gb MicroSD class 10
 

diek

New member
Dec 12, 2008
1
0
Hello, when I get the last message, it never ends.

[*] Put SD card to tablet, power it on, and when it will show
[COLD-BOOTING] text - connect it to pc, and press enter...

[*] Waiting for device...

[*] Rooting...
[*] Mounting sd partition for img data...

[*] Pushing data... [may take a while..]

Any idea, no error in the screen, allways the text cold-booting Linux,kernel image from SD card.

---------- Post added at 02:16 AM ---------- Previous post was at 02:05 AM ----------

Hello, when I get the last message, it never ends.

[*] Put SD card to tablet, power it on, and when it will show
[COLD-BOOTING] text - connect it to pc, and press enter...

[*] Waiting for device...

[*] Rooting...
[*] Mounting sd partition for img data...

[*] Pushing data... [may take a while..]

Any idea, no error in the screen, allways the text cold-booting Linux,kernel image from SD card.


Sorry I wait 10 min more and it's all ok, ad my tablet works again,

Thanks
 

steven.smith

Member
Oct 30, 2011
20
3
Xperia SGPT12 bricked... not sure what to do

My SGPT12 won't go into recovery mode (tried Pow+Volup) and "adb reboot recovery". In both cases, it just boots past the Sony logo and does the 'blue streak" logo and just keeps on doing that. I can't get into recovery even though I have the stock rom update.zip on the sdcard. I am out of ideas and nearly out of patience.

I tried using this Unbricker, but I keep on getting an error when it tries to transfer everything to the SDCard. The error is "invalid drive specification" then it says "Error opening output file: 32 the process cannot access the file because it is being used by another process". I've tried restarting the computer and not opening up the sd card folder, but nothing seems to work.

Any ideas?
 

dex9mm

Senior Member
My SGPT12 won't go into recovery mode (tried Pow+Volup) and "adb reboot recovery". In both cases, it just boots past the Sony logo and does the 'blue streak" logo and just keeps on doing that. I can't get into recovery even though I have the stock rom update.zip on the sdcard. I am out of ideas and nearly out of patience.

I tried using this Unbricker, but I keep on getting an error when it tries to transfer everything to the SDCard. The error is "invalid drive specification" then it says "Error opening output file: 32 the process cannot access the file because it is being used by another process". I've tried restarting the computer and not opening up the sd card folder, but nothing seems to work.

Any ideas?


You need to format the sd and start again see if you can umnmount the sd card
also there is a post about the types of sd card that do and dont work with the unbricker
Make sure there are no other windows open when the bricker is running
The unbricker is tempermental at best

If you had it rooted beforehand and adb debugging is still active you can use the a.i.o tool to aapply the rescue back door patch and then the update this is an option if you havent done a reset
Sent from my SGPT12 using XDA Free mobile app
 

huuhungus

Member
Sep 18, 2005
18
0
@condi: May I ask if this tool is work for Sony Tablet S model SGPT111jp/s or not ? I waited for a long time for unbricker tools.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 23
    Hi :)


    I've finished fully automatic unbricker for Sony Xperia Tablet S!

    Code:
    It wouldn't be possible without xda users, xda community, especially: 	
                                deltaztek [SD source], 
                                jappaj [shell access],
                                NerdiX [beta tester],
    and all other users, who helped to get it working!
    Source thread where manual solution has been discovered.



    Ladies & Gentlemen...
    S.onyXT.S [UNBRICKER] !

    [What is this?]

    S.onyXT.S [UNBRICKER] will unbrick your device firmware,
    no need any shell/linux knowledge - step by step, everything automatic.
    It will automatically download needed data.

    Unbrick process includes:
    • downloading "magic SD" prepared image (237mb),
    • downloading proper update data,
    • decrypting, extracting update data,
    • auto making "magic SD" - no need win32imager etc.,
    • uploading update data to device,
    • at last - unbricking device :) - flashing system/hidden partitions.

    [Requirements]:

    - internet connection to download data ;),
    - adb drivers correctly installed,
    - min. 2GB SD card.


    [Changelog]:

    Code:
    [09.02.2014] v1.0:
    - initial version.


    [To-Do]:

    Code:
      - datapp flashing - vendor apps fix,


    [Screenshots:]

    b0nr.png


    [Download]:

    Attached to this thread.


    [Donate]:

    Keep this project alive - don't forget to donate!


    br
    condi

    current_version=1.0
    2
    If I can help someone, this is how I did and worked for me: http://xdaforums.com/showpost.php?p=67376554&postcount=31
    1
    LEGEND ONCE AGAIN.... :D

    If only we had something for out older Tabs :(

    Oh well none the less one more step in the right direction :)
    1
    Hi :)


    I've finished fully automatic unbricker for Sony Xperia Tablet S!

    [To-Do]:

    Code:
      - datapp flashing - vendor apps fix,

    br
    condi

    current_version=1.0

    hello friend
    I saw that you removed the datapp lines in the script
    as I wrote in the other topic, links to vendor directory are for a specific country
    Sony factory script at first startup wants to choose country then obviously resets symlinks for specific directory.
    Now my IR works with Panasonic and other tv... ir database seems well
    I must clarify that after the manual procedure in dd mmcblk0p3(and 4), the tablet is not updating correctly in recovery. He wrote in mmcblk0p3 and mmcblk0p9 (vendor0 only), then check passed correctly.
    Whether updating with jbr1 or jbr2 file is getting the same result, booted the system1 from mmcblk0p4 with jbr1 (not r2), i.e. not been updated, and sonys app not worked.
    I had to dd if=/dev/block/mmcblk0p3(updated thru recovery) of=/dev/block/mmcblk0p4 to be the same, read the post of @jappaj to fix datapp symlinks, then the update went correctly thru recovery from jbr1 to jbr2

    EDIT: maybe /data partition (/dev/block/mmcblk0p11) must be formated (factory reset) to triger sony's script to ask for country and autoset correct symlinks
    1
    i beg you for same tool, but for tablet S !!))