[GUIDE] Z Ultra and Z1 HARD BRICK RECOVERY

I do not have a backup. Can I do this? please help me ...

i dont have ta backup .my lt25i...can you help me. my xperia is hard briked

:crying:

A.Rahman.A said:

Hi again

after so many try to unbrick my lt25i

finaly i got it

the prolem was becuase of wrong TA data (i flashed another TA on my phone )
therefore i got this error : [ 0x0508:_sin_header_verification, err: 000A ]
but How?
this is the story:
i just have TA backup in " .ta (text)" format (using FlashTool S1 Dump in Advance menu -> Trim Area)

but how use it in S1Tool??
after some study in this thread (on posts #201 to #211 of this thread)
and download the script that user @the_laser made for another user @NiM72NiK

i Extracted (zip) that script an found 7D3.gdfs , 7DA.gdfs and 851.gdfs ,,,, then opened them with notepad
and compared with 2.ta from S1 dump of my Device.
i find 7d3 ,7da,851 lines in 2.ta too

Code:

from script file of Sony SP:
tawrite:00020[B][U]7d3[/U][/B][COLOR="Red"]0353494E000004000000002 . . . . .[/COLOR]
tawrite:00020[B][U]7da[/U][/B][COLOR="red"]F648C1307F7E05891D3FE03 . . . . . .[/COLOR]
tawrite:00020[B][U]851[/U][/B][COLOR="red"]02000907DA270F0015024E0 . . . . .[/COLOR]

from  2.ta file of Sony V:

02
000007D2 0001 01
00000[B][U]7D3[/U][/B] [COLOR="Lime"]05CE[/COLOR] [COLOR="Red"]02 00 00 00 03 FC 04 00 00 00 00 00 00 00 29 . . . . .[/COLOR]
00000[B][U]7DA[/U][/B] [COLOR="Lime"]0287[/COLOR] [COLOR="Red"]9E 2B 0C FB 72 37 68 54 76 E7 15 D4 BA 9C 8E . . . . . .[/COLOR]
.
.
.
00000[B][U]851[/U][/B] [COLOR="Lime"]03CA[/COLOR] [COLOR="Red"]02 00 09 07 DA 27 0F 00 15 02 4E 00 03 BC 00 . . . . .[/COLOR]
.  . .
. 
.

but the number (count) of data after 7d3 and 7da in gdfs script was different from 2.ta file (i think because they are different phone type)
, 851 data was not same in data but same in number

now what u think ? a little risk? again?

ok i made another script with my own TA data
first use c# and wrote simple app to remove spaces of data(red area) in each field(under lined)
then open each script and replace new data, i mean this:

Code:

7d3.gdfs:
tawrite:00020[U][B]7d3[/B][/U][COLOR="DarkOrange"]0200000003FC040000000000 . . . . . [/COLOR]

7da.gdfs:
tawrite:00020[U][B]7da[/B][/U][COLOR="darkorange"]9E2B0CFB7237685476E715D . . . . . [/COLOR]

851.gdfs:
tawrite:00020[U][B]851[/B][/U][COLOR="darkorange"]02000907DA270F0015024E0 . . . . .[/COLOR]

now it's time to repack it.
i putted all file to zip archive and changed zip to sin_file_set
OK connect test point and flow the instruction in first post ,, but now use the file that recently created

after that i could write Boot on my phone
All Done .

Thanks to all member of xda Specially @the_laser for his Sofware and script and helps

here is S1Tool Log:

Code:

SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...
 
DETACH USB CABLE FROM PHONE
REMOVE BATTERY FROM PHONE
ATTACH TESTPOINT
PRESS "READY", THEN ATTACH USB CABLE TO PHONE
 
will use DLOAD protocol ... 
0808010600900000
0D0F50424C5F446C6F6164564552322E30
162001000100
17004001000100E1506B00
PRODUCT DETECTED: "SONY MSM8960-3       OEM1 Fused"
1801000F43240892D02F0DC96313C81351B40FD5029ED98FF9EC7074DDAE8B05CDC8E1
PROCESSING ...
REMOVE TESTPOINT NOW, THEN PRESS "READY"
 
Emergency loader uploaded ...
 
RUNNING S1_PRELOADER VER "R5F001"
LOADER AID: 0001
llbug: blk write fail.fatal
can't send S1 command data [00000006/00000007]
error while uploading DATA block [000001/000001]
LOADER NOT STARTED
Elapsed:99 secs.
 
SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...
 
TO CONNECT NEXT PHONES
X10 Xperia,E10 Mini,E15 Xperia X8,U20 Mini Pro
LT15 Xperia ARC,MT15 Xperia NEO,R800 Xperia PLAY
PRESS AND HOLD "BACK" BUTTON...
 
ST18 Xperia RAY,ST15 Xperia Mini,SK17 Xperia Mini Pro
and Sony Xperia phone
PRESS AND HOLD "Volume Down" BUTTON...
 
PLEASE ATTACH TURNED OFF PHONE NOW
Waiting for phone ...
PROCEDURE STOPPED BY USER
supported phone was not detected
Elapsed:260 secs.
 
SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...
 
DETACH USB CABLE FROM PHONE
REMOVE BATTERY FROM PHONE
ATTACH TESTPOINT
PRESS "READY", THEN ATTACH USB CABLE TO PHONE
 
will use DLOAD protocol ... 
0808010600900000
0D0F50424C5F446C6F6164564552322E30
162001000100
17004001000100E1506B00
PRODUCT DETECTED: "SONY MSM8960-3       OEM1 Fused"
1801000F43240892D02F0DC96313C81351B40FD5029ED98FF9EC7074DDAE8B05CDC8E1
PROCESSING ...
REMOVE TESTPOINT NOW, THEN PRESS "READY"
 
Emergency loader uploaded ...
 
RUNNING S1_PRELOADER VER "R5F001"
LOADER AID: 0001
DEVICE ID: F9E5CF03
FLASH ID: "0015/00000000"
LOADER VERSION: "R5F001"
 
WRITING PACKAGES ...
Processing package
C:\Users\AbdoRahman_Amani\Desktop\R11AB029.S1_MSM8960_R3_S1Boot_1264_2289_Live_HWID6B50E1.SOFTWARE.SIN_FILE_SET
 
Processing ACPU files
PROCESSING: R11AB029.S1_MSM8960_R3_S1Boot_1264_2289_Live_HWID6B50E1.SOFTWARE.SIN
ERROR [ 0x0508:_sin_header_verification, err: 000A ]
HDR block not accepted
Break.
ERROR [ S1_TA_Close,limited, err: 0010 ]
FINISHED
Elapsed:29 secs.
 
SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...
 
DETACH USB CABLE FROM PHONE
REMOVE BATTERY FROM PHONE
ATTACH TESTPOINT
PRESS "READY", THEN ATTACH USB CABLE TO PHONE
 
will use DLOAD protocol ... 
0808010600900000
0D0F50424C5F446C6F6164564552322E30
162001000100
17004001000100E1506B00
PRODUCT DETECTED: "SONY MSM8960-3       OEM1 Fused"
1801000F43240892D02F0DC96313C81351B40FD5029ED98FF9EC7074DDAE8B05CDC8E1
PROCESSING ...
REMOVE TESTPOINT NOW, THEN PRESS "READY"
 
Emergency loader uploaded ...
 
RUNNING S1_PRELOADER VER "R5F001"
LOADER AID: 0001
DEVICE ID: F9E5CF03
FLASH ID: "0015/00000000"
LOADER VERSION: "R5F001"
 
WRITING PACKAGES ...
Processing package
C:\Users\AbdoRahman_Amani\Desktop\TA-backup-20140301.101415.sin_file_set
 
package not contains ACPU files.
Processing update files
PROCESSING: 7d3.gdfs
Writing TA var 0002/07D3/05CE
PROCESSING: 7da.gdfs
Writing TA var 0002/07DA/0287
PROCESSING: 851.gdfs
Writing TA var 0002/0851/03CA
FINISHED
Elapsed:155 secs.
/*
*      ^^^^^^^
*      |||||||
*  writeing TA fields
*----------------------
*  writeing boot
*  ||||||||
*  ˅˅˅˅˅˅˅˅
*/
SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...
 
DETACH USB CABLE FROM PHONE
REMOVE BATTERY FROM PHONE
ATTACH TESTPOINT
PRESS "READY", THEN ATTACH USB CABLE TO PHONE
 
will use DLOAD protocol ... 
0808010600900000
0D0F50424C5F446C6F6164564552322E30
162001000100
17004001000100E1506B00
PRODUCT DETECTED: "SONY MSM8960-3       OEM1 Fused"
1801000F43240892D02F0DC96313C81351B40FD5029ED98FF9EC7074DDAE8B05CDC8E1
PROCESSING ...
REMOVE TESTPOINT NOW, THEN PRESS "READY"
 
Emergency loader uploaded ...
 
RUNNING S1_PRELOADER VER "R5F001"
LOADER AID: 0001
DEVICE ID: F9E5CF03
FLASH ID: "0015/00000000"
LOADER VERSION: "R5F001"
 
WRITING PACKAGES ...
Processing package
C:\Users\AbdoRahman_Amani\Desktop\R11AB029.S1_MSM8960_R3_S1Boot_1264_2289_Live_HWID6B50E1.SOFTWARE.SIN_FILE_SET
 
Processing ACPU files
PROCESSING: R11AB029.S1_MSM8960_R3_S1Boot_1264_2289_Live_HWID6B50E1.SOFTWARE.SIN
no update files in package
FINISHED
Elapsed:55 secs.

hit thanks if it was useful

Click to expand...

Click to collapse

any news for xperia z2

Doom Slayer said:

THIS TUTORIAL IS ONLY FOR HARD BRICKED DEVICES.
HARD BRICK MEANS NO FLASHMODE AND NO FASTBOOT.
IN ORDER TO PROCEED DISASSEMBLY OF YOUR DEVICE IS REQUIRED.
IF YOU HAVE WARRANTY,STOP READING THIS, GO THE SONY SERVICE AND PLAY STUPID.
AS AFTER OPENING YOUR DEVICE, YOUR WARRANTY IS 100% VOID.
I AM NOT RESPONSIBLE FOR ANY DAMAGE.
YOU'VE BEEN WARNED.

Let's get started.
1. Download tools.7z from attachments and pack for your device.
2. Install ggsetup-3.0.0.7.exe
3. Open the back cover of your device.
4. Find the test point (See attachments).
5. Disconnect a battery, connect a usb cable. LED RED will start to blink.
6. Using the paper clip connect your test point with the GND. I used the metal shield in the middle of the motherboard.
7. Open the device manager, you should see SEMC Flash Device. If no, you did something wrong.
8. Disconnect your phone from computer.
9, Repeat the step 5.
10.Run the s1tool and select S1 MSM8974 EMERGENCY for the phone type.
11. Press the flash button, and choice the APP file for your device.
12. Press testpoint ready and repeat the step 6.
13. Remove the testpoint and press READY, when program will ask you to do so.
14. If flash was successful, you may disconnect your phone from usb, connect your battery and try to boot.You may have to charge your battery.
15. Now you can flash your device normally using software.

P.S.
I was not be able to flash on windows 8 64bit, but I flashed without problems on XP.

I would like to thank:

the_laser for making the software.


myevilface from support.setool.net for finding testpoint for c69xx.

and my poor Z Ultra which I sacrificed trying to find the test point
Actually I finished him when I wanted to fix audio jack.
Was to happy that my device is fixed and damaged the screen connector

UPDATE:
Tool for converting TA.img to TA_unbrick.SYN_FILE_SET



------------------------------------------------------------------------------------------------------------
If I helped you to save money, you can buy me a beer or two, which is cheaper than a new motherboard.

Click to expand...

Click to collapse

Hi! ive followed ur steps but im stuck at step 14.

Tried using s1tool on z ultra:
After flashing, it doesn`t turn on, neither fastboot or flashmode.
I already changed the battery.
What can i do?

Welcome S1 Tool [19.05.2015].
That is small and crippled subset of SETOOL2 service tool.

SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...

DETACH USB CABLE FROM PHONE
REMOVE BATTERY FROM PHONE
ATTACH TESTPOINT
PRESS "READY", THEN ATTACH USB CABLE TO PHONE

PROCEDURE STOPPED BY USER
Elapsed:24 secs.

SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...

DETACH USB CABLE FROM PHONE
REMOVE BATTERY FROM PHONE
ATTACH TESTPOINT
PRESS "READY", THEN ATTACH USB CABLE TO PHONE

will use Sahara protocol ...
REMOVE TESTPOINT NOW, THEN PRESS "READY"

PROCESSING ...
SERIAL NUMBER : 5B08AB03
HARDWARE ID : 04000100E1007B00
PRODUCT DETECTED: "MSM8974 OEM1 fused"
HASH :49109A8016C239CD8F76540FE4D5138C87B2297E49C6B30EC31852330BDDB177
Emergency loader uploaded ...

RUNNING S1_PRELOADER VER "LOADER_RELEASE_MSM8974_23_4_AID_4"
LOADER AID: 0004
DEVICE ID: 03AB085B
FLASH ID: "0011/01000010"
LOADER VERSION: "LOADER_RELEASE_MSM8974_23_4_AID_4"

WRITING PACKAGES ...
Processing package
C:\Users\Pedro Ivo\Downloads\C6802\14_2_A_0_290.APP_SW_Togari_GENERIC_1271_5715_S1_SW_LIVE_6732_PID1_0005_MMC.SIN_FILE_SET

WILL UPDATE BOOT TO : 1270-3115 S1_BOOT_MSM8974_LA1.04_15
PARSING: "DEVELOPMENT"
value OTP_LOCK_STATUS_1 : UNLOCKED, not match LOCKED
PARSING: "TEST_OEM0_007B00E1"
value OTP_LOCK_STATUS_1 : LOCKED, match LOCKED
value OTP_DATA_1 : 00000100, not match 01000400
value IDCODE_1 : 007B00E1, match 007B00E1
PARSING: "PRECOMMERCIAL_007B00E1"
value OTP_LOCK_STATUS_1 : LOCKED, match LOCKED
value OTP_DATA_1 : 01000400, match 01000400
value IDCODE_1 : 007B00E1, match 007B00E1
PROCESSING : dbi_S1_Boot_MSM8974_LA1_04_15_AID_4_S1-SDI2-6732-PID1-0004-SDI_S1-BOOT-6732-0004-MMC.sin
PROCESSING : emmc_appsboot_S1_Boot_MSM8974_LA1_04_15_AID_4_PLATFORM-MSM8974-LIVE-HWID007B00E1-SWID09-OEM1-AID4-DEBUG00_S1-BOOT-6732-0004-MMC.sin
PROCESSING : s1sbl_S1_Boot_MSM8974_LA1_04_15_AID_4_PLATFORM-MSM8974-LIVE-HWID007B00E1-SWID65-OEM1-AID4-DEBUG00_S1-BOOT-6732-0004-MMC.sin
PROCESSING : sbl1_S1_Boot_MSM8974_LA1_04_15_AID_4_PLATFORM-MSM8974-LIVE-HWID007B00E1-SWID00-OEM1-AID4-DEBUG00_S1-BOOT-6732-0004-MMC.sin
PROCESSING : tz_S1_Boot_MSM8974_LA1_04_15_AID_4_PLATFORM-MSM8974-LIVE-HWID007B00E1-SWID07-OEM1-AID4-DEBUG00_S1-BOOT-6732-0004-MMC.sin
PROCESSING : Togari_S1BootConfig_MiscTA_130115_1430.ta
Writing TA var 0002/084F/0049
Writing TA var 0002/08FD/0001
BOOT UPDATED
Processing ACPU files
PROCESSING: cache_S1-SW-LIVE-6732-PID1-0005-MMC.sin
PROCESSING: apps_log_S1-SW-LIVE-6732-PID1-0005-MMC.sin
PROCESSING: kernel_S1-SW-LIVE-6732-PID1-0005-MMC.sin
PROCESSING: fotakernel_S1-SW-LIVE-6732-PID1-0005-MMC.sin
SKIP: partition-image_S1-SW-LIVE-6732-PID1-0005-MBR.sin
PROCESSING: rpm_S1-RPMFW-LIVE-6732-PID1-0005-MMC.sin
no update files in package
FINISHED
Elapsed:19 secs.

---------- Post added at 08:18 PM ---------- Previous post was at 08:18 PM ----------

Tried using s1tool on z ultra:
After flashing, it doesn`t turn on, neither fastboot or flashmode.
I already changed the battery.
What can i do?

Welcome S1 Tool [19.05.2015].
That is small and crippled subset of SETOOL2 service tool.

SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...

DETACH USB CABLE FROM PHONE
REMOVE BATTERY FROM PHONE
ATTACH TESTPOINT
PRESS "READY", THEN ATTACH USB CABLE TO PHONE

PROCEDURE STOPPED BY USER
Elapsed:24 secs.

SELECT FIRMWARE PACKAGES
YOU CAN SELECT SEVERAL PACKAGES WITH CTRL BUTTON
CHECKING PACKAGES ...

DETACH USB CABLE FROM PHONE
REMOVE BATTERY FROM PHONE
ATTACH TESTPOINT
PRESS "READY", THEN ATTACH USB CABLE TO PHONE

will use Sahara protocol ...
REMOVE TESTPOINT NOW, THEN PRESS "READY"

PROCESSING ...
SERIAL NUMBER : 5B08AB03
HARDWARE ID : 04000100E1007B00
PRODUCT DETECTED: "MSM8974 OEM1 fused"
HASH :49109A8016C239CD8F76540FE4D5138C87B2297E49C6B30EC31852330BDDB177
Emergency loader uploaded ...

RUNNING S1_PRELOADER VER "LOADER_RELEASE_MSM8974_23_4_AID_4"
LOADER AID: 0004
DEVICE ID: 03AB085B
FLASH ID: "0011/01000010"
LOADER VERSION: "LOADER_RELEASE_MSM8974_23_4_AID_4"

WRITING PACKAGES ...
Processing package
C:\Users\Pedro Ivo\Downloads\C6802\14_2_A_0_290.APP_SW_Togari_GENERIC_1271_5715_S1_SW_LIVE_6732_PID1_0005_MMC.SIN_FILE_SET

WILL UPDATE BOOT TO : 1270-3115 S1_BOOT_MSM8974_LA1.04_15
PARSING: "DEVELOPMENT"
value OTP_LOCK_STATUS_1 : UNLOCKED, not match LOCKED
PARSING: "TEST_OEM0_007B00E1"
value OTP_LOCK_STATUS_1 : LOCKED, match LOCKED
value OTP_DATA_1 : 00000100, not match 01000400
value IDCODE_1 : 007B00E1, match 007B00E1
PARSING: "PRECOMMERCIAL_007B00E1"
value OTP_LOCK_STATUS_1 : LOCKED, match LOCKED
value OTP_DATA_1 : 01000400, match 01000400
value IDCODE_1 : 007B00E1, match 007B00E1
PROCESSING : dbi_S1_Boot_MSM8974_LA1_04_15_AID_4_S1-SDI2-6732-PID1-0004-SDI_S1-BOOT-6732-0004-MMC.sin
PROCESSING : emmc_appsboot_S1_Boot_MSM8974_LA1_04_15_AID_4_PLATFORM-MSM8974-LIVE-HWID007B00E1-SWID09-OEM1-AID4-DEBUG00_S1-BOOT-6732-0004-MMC.sin
PROCESSING : s1sbl_S1_Boot_MSM8974_LA1_04_15_AID_4_PLATFORM-MSM8974-LIVE-HWID007B00E1-SWID65-OEM1-AID4-DEBUG00_S1-BOOT-6732-0004-MMC.sin
PROCESSING : sbl1_S1_Boot_MSM8974_LA1_04_15_AID_4_PLATFORM-MSM8974-LIVE-HWID007B00E1-SWID00-OEM1-AID4-DEBUG00_S1-BOOT-6732-0004-MMC.sin
PROCESSING : tz_S1_Boot_MSM8974_LA1_04_15_AID_4_PLATFORM-MSM8974-LIVE-HWID007B00E1-SWID07-OEM1-AID4-DEBUG00_S1-BOOT-6732-0004-MMC.sin
PROCESSING : Togari_S1BootConfig_MiscTA_130115_1430.ta
Writing TA var 0002/084F/0049
Writing TA var 0002/08FD/0001
BOOT UPDATED
Processing ACPU files
PROCESSING: cache_S1-SW-LIVE-6732-PID1-0005-MMC.sin
PROCESSING: apps_log_S1-SW-LIVE-6732-PID1-0005-MMC.sin
PROCESSING: kernel_S1-SW-LIVE-6732-PID1-0005-MMC.sin
PROCESSING: fotakernel_S1-SW-LIVE-6732-PID1-0005-MMC.sin
SKIP: partition-image_S1-SW-LIVE-6732-PID1-0005-MBR.sin
PROCESSING: rpm_S1-RPMFW-LIVE-6732-PID1-0005-MMC.sin
no update files in package
FINISHED
Elapsed:19 secs.

Thanks for the clear instructions, can confirm also works on the Z1 Compact which shares the same SOC :good:

Test point location is different though: https://xdaforums.com/showthread.php?t=2682255

Please has anyone tried to repair XA1 G3121 with this tool...?
My XA1 got interrupted during flashing, now red light only when connected to charger, not detected on flash tool...
need help pls....
thanks...

Any packs for other Xperia devices? Thanks!

Hello,
I need some help with my Xperia Z1 C6903 device. It is hard bricked.
I've tried to flash it with s1tool in emergency mode (APPSW, FSP and ELABEL) but without any success, getting an error message:

2021-10-03 01:00:35 ERROR [ 0x80080021_, err: 0017 ]
2021-10-03 01:00:35 HDR block not accepted
2021-10-03 01:00:35 Break.
2021-10-03 01:00:35 FINISHED

It seems that a corrupted trim area is the problem. I have a backup of the original TA for my device. Could anybody help me to convert it into SIN_FILE_SET file or show me a tutorial how to do this?

ShibaYoshinori said:

Hello,
I need some help with my Xperia Z1 C6903 device. It is hard bricked.
I've tried to flash it with s1tool in emergency mode (APPSW, FSP and ELABEL) but without any success, getting an error message:

2021-10-03 01:00:35 ERROR [ 0x80080021_, err: 0017 ]
2021-10-03 01:00:35 HDR block not accepted
2021-10-03 01:00:35 Break.
2021-10-03 01:00:35 FINISHED

It seems that a corrupted trim area is the problem. I have a backup of the original TA for my device. Could anybody help me to convert it into SIN_FILE_SET file or show me a tutorial how to do this?

Click to expand...

Click to collapse

I was able to create a flashable trim area file with ta_gen. I flashed it in S1Tool, in emergency mode. Then I flashed APPSW, FSP and ELABEL, one by one, everything in emergency mode. My phone came back to life.

Is there a update for xz2?

Doom Slayer said:

THIS TUTORIAL IS ONLY FOR HARD BRICKED DEVICES.
HARD BRICK MEANS NO FLASHMODE AND NO FASTBOOT.
IN ORDER TO PROCEED DISASSEMBLY OF YOUR DEVICE IS REQUIRED.
IF YOU HAVE WARRANTY,STOP READING THIS, GO THE SONY SERVICE AND PLAY STUPID.
AS AFTER OPENING YOUR DEVICE, YOUR WARRANTY IS 100% VOID.
I AM NOT RESPONSIBLE FOR ANY DAMAGE.
YOU'VE BEEN WARNED.

Let's get started.
1. Download tools.7z from attachments and pack for your device.
2. Install ggsetup-3.0.0.7.exe
3. Open the back cover of your device.
4. Find the test point (See attachments).
5. Disconnect a battery, connect a usb cable. LED RED will start to blink.
6. Using the paper clip connect your test point with the GND. I used the metal shield in the middle of the motherboard.
7. Open the device manager, you should see SEMC Flash Device. If no, you did something wrong.
8. Disconnect your phone from computer.
9, Repeat the step 5.
10.Run the s1tool and select S1 MSM8974 EMERGENCY for the phone type.
11. Press the flash button, and choice the APP file for your device.
12. Press testpoint ready and repeat the step 6.
13. Remove the testpoint and press READY, when program will ask you to do so.
14. If flash was successful, you may disconnect your phone from usb, connect your battery and try to boot.You may have to charge your battery.
15. Now you can flash your device normally using software.

P.S.
I was not be able to flash on windows 8 64bit, but I flashed without problems on XP.

I would like to thank:

the_laser for making the software.


myevilface from support.setool.net for finding testpoint for c69xx.

and my poor Z Ultra which I sacrificed trying to find the test point
Actually I finished him when I wanted to fix audio jack.
Was to happy that my device is fixed and damaged the screen connector

UPDATE:
Tool for converting TA.img to TA_unbrick.SYN_FILE_SET



------------------------------------------------------------------------------------------------------------
If I helped you to save money, you can buy me a beer or two, which is cheaper than a new motherboard.

Click to expand...

Click to collapse

hi... there's no msm8974 in the s1 tools. please reply asap. i brick my z ultra

w8man said:

hi... there's no msm8974 in the s1 tools. please reply asap. i brick my z ultra

Click to expand...

Click to collapse

tool isn't updated long time, no newer cpu support, i have another sony xperia xz2 with sdm845 but there is no tool support it

cuynu said:

tool isn't updated long time, no newer cpu support, i have another sony xperia xz2 with sdm845 but there is no tool support it

Click to expand...

Click to collapse

i used to do this before this is my second time. but in stuck at choosing msm8974 in the s1 tools