Xperia Tablet S Bricked and revived. Service tools obtained.

Search This thread

deltaztek

Member
Nov 7, 2007
6
10
Hello all. After bricking my Xperia tablet S by the next method: rooted it, then install a soft called as I remember PLay help, or something like that, a soft that helped you make your device look like any other in Google play sao you can install all apps even if they aren't made for your device. everything was ok but when i restarted my tablet it wouldnt pass the sony logo and than black screen.
So I tryed all methods provided within this forum, but nothing worked.
So I decided to sent it to service. they realized it was a soft problem and charged me about 40 $ to repair.
every thing is great now, BUT I have found in the box when I have picked up my tablet from service a 2 gb sd card :D
i thought that was the sd card used to resoft my tablet, so I inserted the sd card in my tablet and rebooted while holding the vol plus button and it started to say something like: cold-boot linux kernel from sd card. i didnt want to break it again because i didnt have enough power and I restarted my tablet. it works ok.

I want to see what it is on that sd card and share this tool with you, but for this I need help from you to create an image or something like that of this sd card. I have an macbook pro with os x maverick.
Any Ideeas?
 

CoolApps

Senior Member
May 12, 2011
3,386
611
Can you upload the files in a zip file?

Sent from my Nexus 4 using Tapatalk
 

Z3PHYR

Senior Member
Sep 9, 2012
142
94
my macbook sees the sd card, but it tells me that is not in a recognisable format and wants to format it. :(

If you can, try puting ubuntu on a cd and live boot it on the computer then put in the sdcard and see if it recognizes it

Sent from my C6603 using xda app-developers app
 

smgdev

Senior Member
Jan 13, 2013
321
48
Ankara
Oh damn, dd it to a file. If you can't do this, I can connect to your computer with teamviewer.

Sony Tablet S cihazımdan Tapatalk kullanılarak gönderildi
 

deltaztek

Member
Nov 7, 2007
6
10
I have created a raw copy with Hdd raw copy tool
the image is here. please download until 22 jan 2014
www wetransfer com/downloads/0bf376dc203efb9020b16ad377e5e47820140115102753/0734314e80d6048007785b2d3448fd3020140115102753/8c53e2

replace the spaces in the we transfer link with dots because i have received this error: The following errors occurred with your submission:
To prevent spam on the XDA forums, ALL new users prevented from posting outside links in their messages. After approximately 10 posts, you will be able to post outside links. Thank you for understanding!
 
  • Like
Reactions: Theogonist

smgdev

Senior Member
Jan 13, 2013
321
48
Ankara
I have created a raw copy with Hdd raw copy tool
the image is here. please download until 22 jan 2014
www wetransfer com/downloads/0bf376dc203efb9020b16ad377e5e47820140115102753/0734314e80d6048007785b2d3448fd3020140115102753/8c53e2

replace the spaces in the we transfer link with dots because i have received this error: The following errors occurred with your submission:
To prevent spam on the XDA forums, ALL new users prevented from posting outside links in their messages. After approximately 10 posts, you will be able to post outside links. Thank you for understanding!

I wrote the image to my sd card and it is containing 3 partitions. But it is not working for tablet s. Can you explain how can you able to boot the tablet from that card?

Sony Tablet S cihazımdan Tapatalk kullanılarak gönderildi
 

deltaztek

Member
Nov 7, 2007
6
10
I wrote the image to my sd card and it is containing 3 partitions. But it is not working for tablet s. Can you explain how can you able to boot the tablet from that card?

Sony Tablet S cihazımdan Tapatalk kullanılarak gönderildi

I have Sony Xperia Tablet S, which is the next generation of Sony Tablet S.
I have inserted the sd card and tried to boot but nothing happens. I can no longer acces the menu with Power+Vol UP or with Power +Vol UP+Vol Down, which I could before the service did the firmware upgrade. that is why is important this sd card, to see what it contains and how it works.

I apparently can't do nothing with it besides being stuck on screen with this text: Cold-boot Linux.kernel from sd-card.
 

vatis24

Senior Member
May 31, 2010
479
51
40
Nicosia
Wow !
deltaztek thanks for sharing this with us , i think this maybe will be the solution to many bricked devices.

Cheers

Vatis
 

jappaj

Senior Member
May 1, 2011
242
79
Damn, this is cool stuff! Just what we needed, service to forgot recovery SD card inside debricked device! Let's see if we can learn how to use this, too bad I am having so little time nowadays.

Btw. what do you mean "I can no longer acces the menu with Power+Vol UP or with Power +Vol UP+Vol Down, which I could before the service did the firmware upgrade. that is why is important this sd card, to see what it contains and how it works." ?

Do you mean that you cannot anymore access recovery, with or without recovery SD-card?

- What happens without SD-card, does your tablet boot normally
- Without SD-card, what happens if you try to go to recovery when booting by Power+Vol?
- With SD-card what happens when you boot normally?
- With SD-card what happens when you try to get to recovery?

I will download image, but my tab is not with me this weekend, damn...

Do NOT let your OSX format the card :) This is great great stuff.

---------- Post added at 02:24 PM ---------- Previous post was at 02:10 PM ----------

Oh and is the SD card itself ordinary generic SD card or is it some kind of Sony's special card or something?
 
  • Like
Reactions: Theogonist

vatis24

Senior Member
May 31, 2010
479
51
40
Nicosia
Damn, this is cool stuff! Just what we needed, service to forgot recovery SD card inside debricked device! Let's see if we can learn how to use this, too bad I am having so little time nowadays.

Btw. what do you mean "I can no longer acces the menu with Power+Vol UP or with Power +Vol UP+Vol Down, which I could before the service did the firmware upgrade. that is why is important this sd card, to see what it contains and how it works." ?

Do you mean that you cannot anymore access recovery, with or without recovery SD-card?

- What happens without SD-card, does your tablet boot normally
- Without SD-card, what happens if you try to go to recovery when booting by Power+Vol?
- With SD-card what happens when you boot normally?
- With SD-card what happens when you try to get to recovery?

I will download image, but my tab is not with me this weekend, damn...

Do NOT let your OSX format the card :) This is great great stuff.

---------- Post added at 02:24 PM ---------- Previous post was at 02:10 PM ----------

Oh and is the SD card itself ordinary generic SD card or is it some kind of Sony's special card or something?

Ok here is the strange thing...

When i connect the tab on my pc inside recovery i can not connect with ADB , BUT when i am on cold-boot and connect the tab on pc then showing that discovered a sony device then i dont have drivers but i install ADB test drive 2013 , then i can connect with ADB, any ideas? i try to shell but i am getting error :
C:\adb>adb shell
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
- exec '/system/bin/sh' failed: Permission denied (13) -

anything else i can try?

Cheers
 

jappaj

Senior Member
May 1, 2011
242
79
Please explain how device works when this SD card is inside :) What happens when you boot normally this SD card inside, what happens if you boot Power-Vol ? When this cold boot appears, what did you do?

Next week I can get my tab back and can try this by myself...
 

vatis24

Senior Member
May 31, 2010
479
51
40
Nicosia
Please explain how device works when this SD card is inside :) What happens when you boot normally this SD card inside, what happens if you boot Power-Vol ? When this cold boot appears, what did you do?

Next week I can get my tab back and can try this by myself...

Ok here is the deal :

After you burn the .img on the sd card the windows stops see the sd card due to the format , so i have to boot linux to see whats is inside sd card, but some people reported 3 partitions .... on uper posts.

Anyway when you boot the tablet with the SD card inside either you try to go to recovery automatically booting from sd card and writing on tablet : Cold-booting linux. kernel from sd card , but nothing happens , now if you remove the sd card and try to boot to recovery wokring as before. If you boot to recovery and after put the sd card can read the sd card from recovery but there is nothing to flash.

Any ideas?

Edit : Can you see mate whats on sd card after burning the .img ? Whats so big for 1.8 gb ?
 

jappaj

Senior Member
May 1, 2011
242
79
Hmh. Sound like me that said SD do not contain zip file to flash from the recovery, instead tablet recognizes it as some kind of special Sony's maintenance card an boots directly Linux kernel from the card. If I am correct, this way you can recover device even if recovery itself has been corrupted.

But if there is nothing happening after "Cold-booting linux. kernel from sd card", it could be that some extra gear is required. In example serial cable through which you can run shell commands or perhaps ordinary USB cable but some kind of special software would be needed to upload new images to the device. This is just a quess though.

Need to check out that img and what's inside after I have some time. Let's hope it is not encrypted and all files inside can be read...
 

smgdev

Senior Member
Jan 13, 2013
321
48
Ankara
Hmh. Sound like me that said SD do not contain zip file to flash from the recovery, instead tablet recognizes it as some kind of special Sony's maintenance card an boots directly Linux kernel from the card. If I am correct, this way you can recover device even if recovery itself has been corrupted.

But if there is nothing happening after "Cold-booting linux. kernel from sd card", it could be that some extra gear is required. In example serial cable through which you can run shell commands or perhaps ordinary USB cable but some kind of special software would be needed to upload new images to the device. This is just a quess though.

Need to check out that img and what's inside after I have some time. Let's hope it is not encrypted and all files inside can be read...

Filer are not encrypted and image contains 3 partitions, one of them contains a full system rot filesystem, and second one contains something similiar to first and third is empty.

Sony Tablet S cihazımdan Tapatalk kullanılarak gönderildi
 

condi

Senior Member
Feb 13, 2007
744
989
Ostrów Wielkopolski
condiecu.pl
Hello all. After bricking my Xperia tablet S by the next method: rooted it, then install a soft called as I remember PLay help, or something like that, a soft that helped you make your device look like any other in Google play sao you can install all apps even if they aren't made for your device. everything was ok but when i restarted my tablet it wouldnt pass the sony logo and than black screen.
So I tryed all methods provided within this forum, but nothing worked.
So I decided to sent it to service. they realized it was a soft problem and charged me about 40 $ to repair.
every thing is great now, BUT I have found in the box when I have picked up my tablet from service a 2 gb sd card :D
i thought that was the sd card used to resoft my tablet, so I inserted the sd card in my tablet and rebooted while holding the vol plus button and it started to say something like: cold-boot linux kernel from sd card. i didnt want to break it again because i didnt have enough power and I restarted my tablet. it works ok.

I want to see what it is on that sd card and share this tool with you, but for this I need help from you to create an image or something like that of this sd card. I have an macbook pro with os x maverick.
Any Ideeas?

Very very interesting :) Thank you very much deltaztek for sharing!
It might bring some capabilities, downloading, will take a look :)
Shame I've got only Tab S, maybe it could be modded to work on 1st Tab S also?
Unfortunately I suspect, that it will work only on Xperia Tab, because of other boot maybe etc.

br
condi

------------------------------
ok, everybody who wants to take a look into partitions in windows,
there is an easy way.

1) download win32diskimager, write img to some SD card.
2) download linux reader, run it
3) voila - all the files accessible :)


-------------------------------
guys? some maybe stupid idea, but I havent seen that diagnostic card running on device.
if its native linux runned, with adb shell not accessible, but with svold.fstab content:
## SVold 1.0

#######################
## Regular device mount
##
## Format: edev_mount <label> <mount_point> <dtype> <part> <sysfs_path1...>
## label - Label for the volume
## mount_point - Where the volume will be mounted
## dtype - Device type
## part - Partition # (1 based), or 'auto' for first usable partition.
## <sysfs_path> - List of sysfs paths to source devices
######################

dev_monitor sdcard2 /mnt/sdcard2 sd auto /devices/platform/sdhci-tegra.2/mmc_host/mmc1
edev_mount usbdisk1 /mnt/usbdisk1 usb auto /devices/platform/tegra-ehci
edev_mount usbdisk2 /mnt/usbdisk2 usb auto /devices/platform/tegra-ehci
edev_mount usbdisk3 /mnt/usbdisk3 usb auto /devices/platform/tegra-ehci
edev_mount usbdisk4 /mnt/usbdisk4 usb auto /devices/platform/tegra-ehci
edev_mount usbdisk5 /mnt/usbdisk5 usb auto /devices/platform/tegra-ehci
edev_mount usbdisk6 /mnt/usbdisk6 usb auto /devices/platform/tegra-ehci
edev_mount usbdisk7 /mnt/usbdisk7 usb auto /devices/platform/tegra-ehci
edev_mount usbdisk8 /mnt/usbdisk8 usb auto /devices/platform/tegra-ehci

where all the usb devices should be mounted,
so you could connect usb keyboard via otg host cable,
and with it have access and control on linux command prompt?
anybody here could try?

------------------------
build.prop content:
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=IML74K
ro.build.display.id=txs03_351-eng 4.0.3 IML74K eng.t-yanagawa.20120618.223335 test-keys
ro.build.version.incremental=txs03servicediag.eng.t-yanagawa.20120618.223335
ro.build.version.sdk=15
ro.build.version.codename=REL
ro.build.version.release=4.0.3
ro.build.date=2012ĺą´ 6ćśˆ 18ć—Ą ćśˆć›ść—Ą 22:36:32 JST
ro.build.date.utc=1340026592
ro.build.type=eng
ro.build.user=t-yanagawa
ro.build.host=t-yanagawa-laptop
ro.build.tags=test-keys
ro.product.model=Sony Tablet S_2
ro.product.brand=Sony
ro.product.name=txs03_351
ro.product.device=txs03
ro.product.board=txs03
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=Sony
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=tegra
# ro.build.product is obsolete; use ro.product.device
ro.build.product=txs03
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=txs03_351-eng 4.0.3 IML74K eng.t-yanagawa.20120618.223335 test-keys
ro.build.fingerprint=Sony/txs03_351/txs03:4.0.3/IML74K/eng.t-yanagawa.20120618.223335:eng/test-keys
ro.build.characteristics=tablet
# end build properties
ro.opengles.version = 131072
wifi.interface=wlan0
wifi.wpa_supp_ready=0
persist.tegra.nvmmlite = 1
##NFC
#debug.nfc.fw_download=false
#debug.nfc.se=false
windowsmgr.max_events_per_sec=135
ro.tether.denied=true
ro.sony.sound.enabled=true

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.product-res-path=vendor/framework/SemcGenericUxpRes.apk
ro.sony.update.server=info.update.sony.net
ro.sony.update.category_id=ST001
ro.sony.update.service_id=txs03_351
ro.sony.sku.base=txs03_351
ro.sony.build.id=TID0010000
ro.sony.build.incremental=120618223
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
drm.service.enabled=true
dalvik.vm.heapstartsize=5m
dalvik.vm.heapgrowthlimit=48m
dalvik.vm.heapsize=256m
keyguard.no_require_sim=1
ro.sony.wan.dispMenuNwTyp=true
rild.libpath=/system/lib/libhuawei-ril.so
ro.kernel.gps.data=/dev/ttyUSB3
ro.kernel.gps.ctl=/dev/ttyUSB4
ro.sony.wan.sar.enable=yes
ro.sony.wifisleep=0
ro.com.google.gmsversion=4.0_r1
ro.com.google.clientidbase=android-sony
ro.kernel.android.checkjni=1
ro.setupwizard.mode=OPTIONAL
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
tf.enable=y
ro.sony.wan.ipv6.enable=false
persist.sys.sony.cabc.disable=0
persist.sys.sony.hdmi.disable=0
ro.sony.irremote.protocol_type=2
ro.sony.ols.eula=1

incremental value looks nice :)
ro.build.version.incremental=txs03servicediag.eng.t-yanagawa.20120618.223335
 
Last edited:
  • Like
Reactions: Theogonist

vatis24

Senior Member
May 31, 2010
479
51
40
Nicosia
Very very interesting :) Thank you very much deltaztek for sharing!
It might bring some capabilities, downloading, will take a look :)
Shame I've got only Tab S, maybe it could be modded to work on 1st Tab S also?
Unfortunately I suspect, that it will work only on Xperia Tab, because of other boot maybe etc.

br
condi

------------------------------
ok, everybody who wants to take a look into partitions in windows,
there is an easy way.

1) download win32diskimager, write img to some SD card.
2) download linux reader, run it
3) voila - all the files accessible :)


-------------------------------
guys? some maybe stupid idea, but I havent seen that diagnostic card running on device.
if its native linux runned, with adb shell not accessible, but with svold.fstab content:


where all the usb devices should be mounted,
so you could connect usb keyboard via otg host cable,
and with it have access and control on linux command prompt?
anybody here could try?

Amazing idea, i have the cable and i can try it tommorow, i will let you know

Cheers
Vatis
 
  • Like
Reactions: condi

condi

Senior Member
Feb 13, 2007
744
989
Ostrów Wielkopolski
condiecu.pl
Amazing idea, i have the cable and i can try it tommorow, i will let you know

Cheers
Vatis

Waiting for results :)

-------------------------
interesting .sh files inside /xbin/..

chkbootloader.sh:
Code:
#!/system/xbin/busyboxbin/sh


if [ "$1" == "" ]; then
	echo COMMAND NOT FOUND
	echo Result:NG
	exit 1
else
	hd -c 4200 /dev/block/mmcblk0p8 | /system/xbin/busyboxbin/grep "5f 42 4c" >/dev/null
	if [ $? -ne 0 ]; then
		echo Cannot get Bootloader version
		echo Result:NG
		exit 1
	fi
	BL_1=`hd -c 4200 /dev/block/mmcblk0p8 | /system/xbin/busyboxbin/grep "5f 42 4c" | /system/xbin/busyboxbin/cut -d " " -f6`
	BL_2=`hd -c 4200 /dev/block/mmcblk0p8 | /system/xbin/busyboxbin/grep "5f 42 4c" | /system/xbin/busyboxbin/cut -d " " -f7`
	BL_3=`hd -c 4200 /dev/block/mmcblk0p8 | /system/xbin/busyboxbin/grep "5f 42 4c" | /system/xbin/busyboxbin/cut -d " " -f8`
	BL_4=`hd -c 4200 /dev/block/mmcblk0p8 | /system/xbin/busyboxbin/grep "5f 42 4c" | /system/xbin/busyboxbin/cut -d " " -f9`
	BOOTLOADER=$BL_1$BL_2$BL_3$BL_4
	echo Value, 0x$BOOTLOADER

	if [ $BOOTLOADER -eq $1 ]; then
		echo Result:eek:K
		exit 0
	else
		echo Result:NG
		exit 1
	fi
fi

exit 0

diaginit.sh:
Code:
#!/system/xbin/busyboxbin/ash

/system/xbin/busyboxbin/awk '/^[a-z]/{sub(/=/," "); print "setprop "$1" \""$2"\""}' /system/build.prop > /tmp/setprop.sh
/system/bin/sh /tmp/setprop.sh
rm /tmp/setprop.sh

mount -r -w -t ext2 /dev/block/mmcblk0p1 /configs
mount -r -w -t ext4 /dev/block/mmcblk0p5 /cache
mount -r -t ext4 /dev/block/mmcblk0p10 /log
/system/xbin/busyboxbin/awk '/^[a-z]/{sub(/=/," "); print "setprop "$1" \""$2"\""}' /configs/local.prop | /system/xbin/busyboxbin/grep "bdaddr" > /tmp/setlocalprop.sh
/system/bin/sh /tmp/setlocalprop.sh
rm /tmp/setlocalprop.sh
setprop vold.decrypt trigger_restart_framework
export PS1="# "

That diag.init probably is being started on boot with service mode,
or should be initiated manually via running with shell.


Oh and there is SU binary already there :)

-----------------------
im thinking is it worth to replace system partition with nbx03 1st gen Tab S,
maybe we could use it on our devices also ;)

-------------------------
there are some parametrs set in /property/ <<<<<<<<<< we could try to add "persist.service.adb.enable"
in order to get adb working :)
 
Last edited:

vatis24

Senior Member
May 31, 2010
479
51
40
Nicosia
My wife going to sleep now:) i will test now the keyboard via usb on tablet i will revert very soon!!!

---------- Post added at 11:21 PM ---------- Previous post was at 11:11 PM ----------

My wife going to sleep now:) i will test now the keyboard via usb on tablet i will revert very soon!!!

Keyboard not working , i mean getting power but nothing happens, maybe a usb drive to usb port? with update zip ? just saying , any ideas?

Vatis
 

condi

Senior Member
Feb 13, 2007
744
989
Ostrów Wielkopolski
condiecu.pl
My wife going to sleep now:) i will test now the keyboard via usb on tablet i will revert very soon!!!

---------- Post added at 11:21 PM ---------- Previous post was at 11:11 PM ----------



Keyboard not working , i mean getting power but nothing happens, maybe a usb drive to usb port? with update zip ? just saying , any ideas?

Vatis

could you make a short video how this service mode looks?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 9
    Hello all. After bricking my Xperia tablet S by the next method: rooted it, then install a soft called as I remember PLay help, or something like that, a soft that helped you make your device look like any other in Google play sao you can install all apps even if they aren't made for your device. everything was ok but when i restarted my tablet it wouldnt pass the sony logo and than black screen.
    So I tryed all methods provided within this forum, but nothing worked.
    So I decided to sent it to service. they realized it was a soft problem and charged me about 40 $ to repair.
    every thing is great now, BUT I have found in the box when I have picked up my tablet from service a 2 gb sd card :D
    i thought that was the sd card used to resoft my tablet, so I inserted the sd card in my tablet and rebooted while holding the vol plus button and it started to say something like: cold-boot linux kernel from sd card. i didnt want to break it again because i didnt have enough power and I restarted my tablet. it works ok.

    I want to see what it is on that sd card and share this tool with you, but for this I need help from you to create an image or something like that of this sd card. I have an macbook pro with os x maverick.
    Any Ideeas?
    8
    Btw. using instructions from this thread vendor partition is not restored properly. You could do it manually via shell or via .bat... @condi, you have been quite productive with .bat files, perhaps you could prepare us .bat file which expectes device to be booted from recovery SD-card and then a) flashes system.img to both system partitions b) flashes hiddeh.img c) set's up vendor.

    I could do bat like that but I have so little time...

    Got some ideas, how to make it fully automatic :) even making sdcard from the beginning. i will try to make such tool.

    ======
    work in progress... got 80% of .bat ready. still making smallest sd image as I can. tool will prepare chosen firmware, split it to img files, prepare magic card, and do every flashing thing automatically.

    ======
    90%... need some testers with Xperia Tab and teamviewer :)

    ==================
    98% done, any volunteer? :)
    5
    ok guys, now please tell me - pwn binary is mandatory?
    its just to get su? (su already in xbin dir), or it makes shell accessible/make some other changes?


    auto unbrick tool - what works:

    1) download update.zip, decrypt, get img's,
    2) download prepared sd img (~180mb),
    3) write sd img to sd,

    got last thing to test (cant make it on my own = no xperia tab in my hands)
    4) auto unbrick process via shell

    need some device remotely via teamviewer!
    4
    Full instructions for Linux-competent people:

    The deal is that Sony's recovery image will start nfx_daemon which does this on boot:

    set_permission() /system/bin/sh --> 384

    It removes execute permissions from the sh binary and thus no shell access for us! Lucky us they have been hasty enough not to consider some basic Linux file system features... let's say immutable bit. When immutable flag is set for file, not even root can modify it until immutable flag is unset. Sure enough nfx_daemon won't check this, so we can get shell using this.

    What you need to do:

    * Write SD-card image to the real SD-card

    * Using Linux mount second partition of SD-card to the fs (sorry, can't help if you do not know how to do this... cannot distribute modified image as it would violate Sony's IP):
    mount /dev/sdb2 /mnt/part2

    * Give executable permissions for mksh (sh is linked to mksh):
    chmod 755 /mnt/part2/bin/mksh

    * Set imutable bit for mksh:
    chattr +i /mnt/part2/bin/mksh

    * While doing this, you may just as well download motochopper and put pwn to xbin and give execute permissions:
    cp pwn /mnt/part2/xbin/
    chmod 755 /mnt/part2/xbin/pwn

    * EDIT: See my post below. This is good time to push system.img and hidden.img to the sdcard. Get OTA zip, decrypt, unzip and write:
    cp system.img /mnt/part2/
    cp hidden.img /mnt/part2/

    * Umount, put SD-card to the Xperia Tablet S and boot it. Wait a while.

    * Start shell and gain root using pwn (motochopper is not designed for this so ignore al the error messages after success message):
    C:\>adb shell
    shell@android:/ $ /system/xbin/pwn
    /system/xbin/pwn
    [+] This may take a few minutes.
    [+] Success!
    sh: /system/xbin/busybox: not found
    sh: cp: not found

    * Add busybox to PATH for convenience:
    export PATH=$PATH:/system/xbin/busyboxbin

    * Enjoy. We could no try to dd image from OTA zip to the bricked devices. I have no heart to do this since my device is not bricker. If anybody knows how to use dd and has bricked device, please, could you try it?

    Ps. While we still cannot boot custom kernel (somebody should start working with that first partition, can we use custom kernel?), we could now craft custom rom which just uses original kernel, but it boots from the SD-card! How cool is that?

    ---------- Post added 23rd January 2014 at 12:15 AM ---------- Previous post was 22nd January 2014 at 11:28 PM ----------

    Could anybody with bricked Xperia Tablet S try to recover? Mine is not bricked so I do not have heart to. If you are willing to, do this at your own risk and adapt instructions if I got something wrong:

    - Follow instructions from my earlier post to get shell and root.
    - Using desklunvr (http://xdaforums.com/showthread.php?t=2068261) decrypt the OTA you used to brick your devices in the first place. ie:
    Code:
    desklunvr.exe signed-txs03_xxx-ota-nnn.zip

    - Unzip decrypted zip

    - Push resulting system.img to /tmp (or better write it to sd-card while you write pwn etc., adb is slow...):
    Code:
    adb push system.img /tmp

    - From adb shell flash system image to first system partition:
    Code:
    /system/xbin/busyboxbin/dd if=/tmp/system.img of=/dev/block/mmcblk0p3

    - From adb shell flash system image to second system partition:
    Code:
    /system/xbin/busyboxbin/dd if=/tmp/system.img of=/dev/block/mmcblk0p4

    - Reboot. What happens?

    Ps. Using these instructions Vendor apps are not restored and we didn't even try to flash hidden.img, need to try that also... Also, if device won't boot, one could try to flash original ICS OTA, if available... Now I have to get sleep.

    ---------- Post added at 12:21 AM ---------- Previous post was at 12:15 AM ----------

    To try to flash hidden.img if system.img is not enough, push hidden.img to /tmp just like you did system img and:

    /system/xbin/busyboxbin/dd if=/tmp/hidden.img of=/dev/block/mmcblk0p7

    AT YOUR OWN RISK! Now sleep...
    3
    very interesting.

    I dont have this device but one of the users sent me a p.m. i found it to be very interesting...

    for those interested I have mirrored the file on my server:
    http://doomlord.xperia-files.com/?d...yeV9pbWFnZS1BbmRyb2lkNDAzaW5zdGFsbHNkY2FyZA==

    also creating another mirror on Dev-Host