Xperia Tablet S Bricked and revived. Service tools obtained.

[vatis24]

could you make a short video how this service mode looks?

http://www.youtube.com/watch?v=gN8pANcBz1Y

Edit : Maybe to load needs to see 50% battery ?

I am on red on battery

 

[condi]

http://www.youtube.com/watch?v=gN8pANcBz1Y

Edit : Maybe to load needs to see 50% battery ?

I am on red on battery

Do I remember good - you have adb (without shell) while running cold booting?
if yes - run tab, connect to pc and try:

adb pull /tmp/recovery.log
adb pull /tmp/
adb pull /cache/
adb pull /system
adb pull /

and tell me what you get

-----------------------------------------
oh and maybe its in fastboot mode ???????
try to replace sony driver in device manager, to fastboot bootloader one.
and then try "fastboot devices"

 

[deltaztek]

Damn, this is cool stuff! Just what we needed, service to forgot recovery SD card inside debricked device! Let's see if we can learn how to use this, too bad I am having so little time nowadays.

Btw. what do you mean "I can no longer acces the menu with Power+Vol UP or with Power +Vol UP+Vol Down, which I could before the service did the firmware upgrade. that is why is important this sd card, to see what it contains and how it works." ?

Do you mean that you cannot anymore access recovery, with or without recovery SD-card?

- What happens without SD-card, does your tablet boot normally
- Without SD-card, what happens if you try to go to recovery when booting by Power+Vol?
- With SD-card what happens when you boot normally?
- With SD-card what happens when you try to get to recovery?

I will download image, but my tab is not with me this weekend, damn...

Do NOT let your OSX format the card This is great great stuff.

---------- Post added at 02:24 PM ---------- Previous post was at 02:10 PM ----------

Oh and is the SD card itself ordinary generic SD card or is it some kind of Sony's special card or something?

I cant acces the recovery menu with or without the sd card inserted.
If I boot the tablet with sd inside it gives me the text: cold-boot Linux.kernel from sd card. And it remains like that.

 

[jappaj]

There is 4 partitions. First is unknown type, rest of them are ext2. Second partition seems to contain system image, third one contains "something" looks almos like somebody's playground and third one is virtually empty.

That first unknown partition could contain linux kernel and something which is booted but we currently do not know what happens then. And there is some offset before first partition, some sector which are not used by any partitions. Could these sectors contain Sony's magic which makes device to boot kernel from first partition? If so, does device care what kind of kernel, could we craft our own SD-card with eessentially custom ROM?-)

A bit tired right now, but just my 5 cents...

 

[condi]

I cant acces the recovery menu with or without the sd card inserted.
If I boot the tablet with sd inside it gives me the text: cold-boot Linux.kernel from sd card. And it remains like that.

deltaztek - could you do adb pulls like i've written above?

 

[deltaztek]

I will try this weekend, as I am very busy this days.
Ps: the sd card appears to be a regular Elite PRO 2gb Memory Card

Sent from my SGPT12 using xda app-developers app

 

[vatis24]

Please give me fastboot drivers x64 i will try to install ( i dot have fastboot in the options there, the only bootloader its from one HTC dream)

C:\adb>adb pull /tmp/recovery.log
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
remote object '/tmp/recovery.log' does not exist
--------------------------------------------------------------------------------------------
C:\adb>adb pull /tmp/
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
pull: building file list...
pull: /tmp/nfx_daemon.txt -> ./nfx_daemon.txt
pull: /tmp/random -> ./random
2 files pulled. 0 files skipped.
289 KB/s (10701 bytes in 0.036s)
-----------------------------------------------------------------------------------------------
C:\adb>adb pull /cache/
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
pull: building file list...
0 files pulled. 0 files skipped.
------------------------------------------------------------------------------------------------
on adb pull /system, worked and pulled all the system on my adb folder i dont know if you want to see something specific
1381 files pulled. 0 files skipped.
1701 KB/s (476616300 bytes in 273.554s)
----------------------------------------------------------------------------------------------------
also adb pull / worked exept the system pulled
pull: /tmp/nfx_daemon.txt -> ./tmp/nfx_daemon.txt
pull: /tmp/random -> ./tmp/random
pull: /acct/uid/5002/tasks -> ./acct/uid/5002/tasks
pull: /acct/uid/5002/cgroup.procs -> ./acct/uid/5002/cgroup.procs
pull: /acct/uid/5002/notify_on_release -> ./acct/uid/5002/notify_on_release
pull: /acct/uid/5002/cgroup.event_control -> ./acct/uid/5002/cgroup.event_contro
l
failed to copy '/acct/uid/5002/cgroup.event_control' to './acct/uid/5002/cgroup.
event_control': Permission denied
pull: /acct/uid/5002/cgroup.clone_children -> ./acct/uid/5002/cgroup.clone_child
ren
pull: /acct/uid/5002/cpuacct.usage -> ./acct/uid/5002/cpuacct.usage
pull: /acct/uid/5002/cpuacct.usage_percpu -> ./acct/uid/5002/cpuacct.usage_percp
u
pull: /acct/uid/5002/cpuacct.stat -> ./acct/uid/5002/cpuacct.stat
pull: /acct/uid/5002/cpuacct.cpufreq -> ./acct/uid/5002/cpuacct.cpufreq
pull: /acct/uid/5002/cpuacct.power -> ./acct/uid/5002/cpuacct.power
pull: /acct/uid/1023/tasks -> ./acct/uid/1023/tasks
pull: /acct/uid/1023/cgroup.procs -> ./acct/uid/1023/cgroup.procs
pull: /acct/uid/1023/notify_on_release -> ./acct/uid/1023/notify_on_release
pull: /acct/uid/1023/cgroup.event_control -> ./acct/uid/1023/cgroup.event_contro
l
failed to copy '/acct/uid/1023/cgroup.event_control' to './acct/uid/1023/cgroup.
event_control': Permission denied
pull: /acct/uid/1023/cgroup.clone_children -> ./acct/uid/1023/cgroup.clone_child
ren
pull: /acct/uid/1023/cpuacct.usage -> ./acct/uid/1023/cpuacct.usage
pull: /acct/uid/1023/cpuacct.usage_percpu -> ./acct/uid/1023/cpuacct.usage_percp
u
pull: /acct/uid/1023/cpuacct.stat -> ./acct/uid/1023/cpuacct.stat
pull: /acct/uid/1023/cpuacct.cpufreq -> ./acct/uid/1023/cpuacct.cpufreq
pull: /acct/uid/1023/cpuacct.power -> ./acct/uid/1023/cpuacct.power
pull: /acct/uid/2000/tasks -> ./acct/uid/2000/tasks
pull: /acct/uid/2000/cgroup.procs -> ./acct/uid/2000/cgroup.procs
pull: /acct/uid/2000/notify_on_release -> ./acct/uid/2000/notify_on_release
pull: /acct/uid/2000/cgroup.event_control -> ./acct/uid/2000/cgroup.event_contro
l
failed to copy '/acct/uid/2000/cgroup.event_control' to './acct/uid/2000/cgroup.
event_control': Permission denied
pull: /acct/uid/2000/cgroup.clone_children -> ./acct/uid/2000/cgroup.clone_child
ren
pull: /acct/uid/2000/cpuacct.usage -> ./acct/uid/2000/cpuacct.usage
pull: /acct/uid/2000/cpuacct.usage_percpu -> ./acct/uid/2000/cpuacct.usage_percp
u
pull: /acct/uid/2000/cpuacct.stat -> ./acct/uid/2000/cpuacct.stat
pull: /acct/uid/2000/cpuacct.cpufreq -> ./acct/uid/2000/cpuacct.cpufreq
pull: /acct/uid/2000/cpuacct.power -> ./acct/uid/2000/cpuacct.power
pull: /acct/uid/1000/tasks -> ./acct/uid/1000/tasks
pull: /acct/uid/1000/cgroup.procs -> ./acct/uid/1000/cgroup.procs
pull: /acct/uid/1000/notify_on_release -> ./acct/uid/1000/notify_on_release
pull: /acct/uid/1000/cgroup.event_control -> ./acct/uid/1000/cgroup.event_contro
l
failed to copy '/acct/uid/1000/cgroup.event_control' to './acct/uid/1000/cgroup.
event_control': Permission denied
pull: /acct/uid/1000/cgroup.clone_children -> ./acct/uid/1000/cgroup.clone_child
ren
pull: /acct/uid/1000/cpuacct.usage -> ./acct/uid/1000/cpuacct.usage
pull: /acct/uid/1000/cpuacct.usage_percpu -> ./acct/uid/1000/cpuacct.usage_percp
u
pull: /acct/uid/1000/cpuacct.stat -> ./acct/uid/1000/cpuacct.stat
pull: /acct/uid/1000/cpuacct.cpufreq -> ./acct/uid/1000/cpuacct.cpufreq
pull: /acct/uid/1000/cpuacct.power -> ./acct/uid/1000/cpuacct.power
pull: /acct/uid/0/tasks -> ./acct/uid/0/tasks
pull: /acct/uid/0/cgroup.procs -> ./acct/uid/0/cgroup.procs
pull: /acct/uid/0/notify_on_release -> ./acct/uid/0/notify_on_release
pull: /acct/uid/0/cgroup.event_control -> ./acct/uid/0/cgroup.event_control
failed to copy '/acct/uid/0/cgroup.event_control' to './acct/uid/0/cgroup.event_
control': Permission denied
pull: /acct/uid/0/cgroup.clone_children -> ./acct/uid/0/cgroup.clone_children
pull: /acct/uid/0/cpuacct.usage -> ./acct/uid/0/cpuacct.usage
pull: /acct/uid/0/cpuacct.usage_percpu -> ./acct/uid/0/cpuacct.usage_percpu
pull: /acct/uid/0/cpuacct.stat -> ./acct/uid/0/cpuacct.stat
pull: /acct/uid/0/cpuacct.cpufreq -> ./acct/uid/0/cpuacct.cpufreq
pull: /acct/uid/0/cpuacct.power -> ./acct/uid/0/cpuacct.power
pull: /acct/uid/tasks -> ./acct/uid/tasks
pull: /acct/uid/cgroup.procs -> ./acct/uid/cgroup.procs
pull: /acct/uid/notify_on_release -> ./acct/uid/notify_on_release
pull: /acct/uid/cgroup.event_control -> ./acct/uid/cgroup.event_control
failed to copy '/acct/uid/cgroup.event_control' to './acct/uid/cgroup.event_cont
rol': Permission denied
pull: /acct/uid/cgroup.clone_children -> ./acct/uid/cgroup.clone_children
pull: /acct/uid/cpuacct.usage -> ./acct/uid/cpuacct.usage
pull: /acct/uid/cpuacct.usage_percpu -> ./acct/uid/cpuacct.usage_percpu
pull: /acct/uid/cpuacct.stat -> ./acct/uid/cpuacct.stat
pull: /acct/uid/cpuacct.cpufreq -> ./acct/uid/cpuacct.cpufreq
pull: /acct/uid/cpuacct.power -> ./acct/uid/cpuacct.power
pull: /acct/tasks -> ./acct/tasks
pull: /acct/cgroup.procs -> ./acct/cgroup.procs
pull: /acct/notify_on_release -> ./acct/notify_on_release
pull: /acct/cgroup.event_control -> ./acct/cgroup.event_control
failed to copy '/acct/cgroup.event_control' to './acct/cgroup.event_control': Pe
rmission denied
pull: /acct/cgroup.clone_children -> ./acct/cgroup.clone_children
pull: /acct/release_agent -> ./acct/release_agent
pull: /acct/cpuacct.usage -> ./acct/cpuacct.usage
pull: /acct/cpuacct.usage_percpu -> ./acct/cpuacct.usage_percpu
pull: /acct/cpuacct.stat -> ./acct/cpuacct.stat
pull: /acct/cpuacct.cpufreq -> ./acct/cpuacct.cpufreq
pull: /acct/cpuacct.power -> ./acct/cpuacct.power

Do I remember good - you have adb (without shell) while running cold booting?
if yes - run tab, connect to pc and try:

adb pull /tmp/recovery.log
adb pull /tmp/
adb pull /cache/
adb pull /system
adb pull /

and tell me what you get

-----------------------------------------
oh and maybe its in fastboot mode ???????
try to replace sony driver in device manager, to fastboot bootloader one.
and then try "fastboot devices"

 

[condi]

That first unknown partition could contain linux kernel and something which is booted but we currently do not know what happens then.

if anyone would like to investigate it:
http://www.4shared.com/zip/MGA9HsWNce/unknown-partition.html
the 'unknown partition' ~71mb -> zip ~4,5mb

 

[vatis24]

Is there any command from adb that we can mount usb to get the keyboard working from the usb port?

An idea..


Cheers
Vatis

 

[DooMLoRD]

very interesting.

I dont have this device but one of the users sent me a p.m. i found it to be very interesting...

for those interested I have mirrored the file on my server:
http://doomlord.xperia-files.com/?d...yeV9pbWFnZS1BbmRyb2lkNDAzaW5zdGFsbHNkY2FyZA==

also creating another mirror on Dev-Host

 

[vatis24]

Thanks Doomlord , glad to see you here !

Any ideas what that could be ? Can you check the partitions due to your high experience and knowledge and give us a tip ?

Cheers and thanks again.

Vatis

very interesting.

I dont have this device but one of the users sent me a p.m. i found it to be very interesting...

for those interested I have mirrored the file on my server:
http://doomlord.xperia-files.com/?d...yeV9pbWFnZS1BbmRyb2lkNDAzaW5zdGFsbHNkY2FyZA==

also creating another mirror on Dev-Host

 

[jappaj]

I love learning and want to encourage people to learn, so if anybody does want to dissect this image but has no idea how to get started, here is some hints. Using Linux (you could youse USB or DVD bootable live distibution), you can start like this:

* Analyze img file using parted:

[email protected]:~/xperia$ /sbin/parted Android403installsdcard.img
WARNING: You are not superuser. Watch out for permissions.
GNU Parted 2.3
Using /home/maintenance/xperia/Android403installsdcard.img
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) unit s
(parted) print
Model: (file)
Disk /home/maintenance/xperia/Android403installsdcard.img: 3932160s
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number Start End Size Type File system Flags
1 63s 144584s 144522s primary boot, lba
2 144585s 1381589s 1237005s primary ext2
3 1381590s 2008124s 626535s primary ext2
4 2008125s 2233034s 224910s primary ext2

So we just changes units to sectors and printed out partition table. We could have used units b and printed out partition sizes etc. in bytes but sectors are easier to operate later on. Turned out that there is four partition, first of which have no type given but is marked as bootable. Rest are standard Linux ext2 partitoins.

Then we could dump these partitions to files using commands like these (notice that I will dump also boot sector aka. MBR just in case it countains something out of ordinary and interesting):

dd if=Android403installsdcard.img of=mbr.img bs=512 skip=0 count=63
dd if=Android403installsdcard.img of=part2.img bs=512 skip=144585 count=1237005
dd if=Android403installsdcard.img of=part3.img bs=512 skip=1381590 count=626535
dd if=Android403installsdcard.img of=part4.img bs=512 skip=2008125 count=224910

Voila, all the partitions are now in separate files for easier investigation. MBR, is like is should be, 32 kB (well, 512b + remaining of the first sector), first unknown partition is 71 MB, second ext2 is 605 MB, third ext2 is 306 MB and fourth and last ext2 is 110 MB long.

Now one could try to create another SD card, let's say by first dd'ing only MBR to the SD card and see what happens, does it already put device to some kind of special mode? If not, then try dd'ing MBR and first unknown partition. Is it enough? Then first, second and third one.

But back to the images. Some preliminary analysis:

[email protected]:~/xperia$ file mbr.img
mbr.img: x86 boot sector; partition 1: ID=0xc, active, starthead 1, startsector 63, 144522 sectors; partition 2: ID=0x83, starthead 0, startsector 144585, 1237005 sectors; partition 3: ID=0x83, starthead 0, startsector 1381590, 626535 sectors; partition 4: ID=0x83, starthead 0, startsector 2008125, 224910 sectors
[email protected]:~/xperia$ file part1.img
part1.img: data
[email protected]:~/xperia$ file part2.img
part2.img: Linux rev 1.0 ext2 filesystem data (mounted or unclean), UUID=6ec6b117-19cb-49ce-b315-5280a7b79b70 (large files)
[email protected]:~/xperia$ file part3.img
part3.img: Linux rev 1.0 ext2 filesystem data (mounted or unclean), UUID=12dc0b0f-7834-4aee-b252-74681a8f6612 (errors)
[email protected]:~/xperia$ file part4.img
part4.img: Linux rev 1.0 ext2 filesystem data, UUID=1f6edc59-485c-49ea-b7a9-6fa6c15647a1

First real partition is not recognized by file. I did hope that it would have been unencrypted ARM kernel there. But no :-/

Rest of the partitions can be mounted like this for further investigation:

[email protected]:~/xperia$ mkdir part2
[email protected]:~/xperia$ su -c "mount -o loop part2.img part2/"

Etc. This should be nothing new for seasoned veterans here, but just thought that if Linux-rookies would like to learn something new (also this acts as personal log when I am trying to figure out what is in the card)

 

[jappaj]

Some quick testing... MBR only written to SD card won't do anything. MBR + first unknown partition will put device into "Cold-booting Linux. Kernal image from SD card." -mode. On this mode device shows in Windows with VID 18D1 and PID D002 and Windows 7 will automatically download titled "ACER ADB" with device type "SAMSUNG Android Phone"... Go figure. adb works anyways, no sh but pull works.

I wonder if other partitions are just leftover stuff and have nothing to do with recovery...

 

[jappaj]

Yeah, after cold boot following partitions are mounted from the SD-card:

23 1 179:18 / /system rw,nosuid,nodev,relatime - ext2 /dev/block/mmcblk1p2 rw,errors=continue
24 1 179:19 / /data rw,nosuid,nodev,relatime - ext2 /dev/block/mmcblk1p3 rw,errors=continue
17 1 179:20 / /datapp ro,nosuid,relatime - ext4 /dev/block/mmcblk1p4 ro,user_xattr,acl,barrier=1,data=writeback

So all the partitions from the SD-card are used. First partition is kernel. Now, why in the earth won't it allow me to start adb shell, even though I manually added permissions to SD-card...

 

[vatis24]

Yeah, after cold boot following partitions are mounted from the SD-card:

23 1 179:18 / /system rw,nosuid,nodev,relatime - ext2 /dev/block/mmcblk1p2 rw,errors=continue
24 1 179:19 / /data rw,nosuid,nodev,relatime - ext2 /dev/block/mmcblk1p3 rw,errors=continue
17 1 179:20 / /datapp ro,nosuid,relatime - ext4 /dev/block/mmcblk1p4 ro,user_xattr,acl,barrier=1,data=writeback

So all the partitions from the SD-card are used. First partition is kernel. Now, why in the earth won't it allow me to start adb shell, even though I manually added permissions to SD-card...

Very interesting , so if you manage to take permissions maybe this will make you our savor!

Cheers and thanks for your effords

 

[jappaj]

Very interesting , so if you manage to take permissions maybe this will make you our savor!

Cheers and thanks for your effords

There must be some kind of special version of adbd which disallows access to key system files like sh or certain others even though secure is set to 0 and everything. Init is one of those files but at least following processes are spawned:

1: /init
111: /sbin/ueventd
124: /system/bin/servicemanager
125: /system/bin/vold
127: /system/bin/svold
128: /system/bin/nfx_log_service
129: /sbin/nfx_daemon
130: /system/bin/sdcard /data/media 1023 1023
131: /system/bin/hci_eventd -d /devices/platform/tegra-ehci.0
132: /system/bin/sh
141: /system/bin/svold
142: /system/bin/svold
143: /system/bin/svold
144: /system/bin/vold
145: /system/bin/vold
...

Since some of the processes are spawned from /system which we have write access, I wonder if we could write replacement which pushes more friendly adbd in place... I will look into this some other day, have to get sleep now...

 

[jappaj]

Gentleman. Sony has been paranoid enough to even protect their diagnostig tools. Too bad they have left so many security holes in it:

C:\>adb shell
$ getprop ro.build.fingerprint
getprop ro.build.fingerprint
Sony/txs03_351/txs03:4.0.3/IML74K/eng.t-yanagawa.20120618.223335:eng/test-keys

We have shell. Now we just need root (no, su does not work out of the box, /system is mounted nosuid)...

---------- Post added at 10:23 PM ---------- Previous post was at 10:10 PM ----------

Well damn, of course our old friend motochopper does the trick:

C:\>adb push pwn /tmp
793 KB/s (1283460 bytes in 1.579s)

C:\>adb shell
chmod 755 /tmp/pwn
$ /tmp/pwn
/tmp/pwn
[+] This may take a few minutes.
[+] Success!

So we have now shell and root with bricked devices. Don't throw your bricked devices to the trash bin yet

 

[jappaj]

Full instructions for Linux-competent people:

The deal is that Sony's recovery image will start nfx_daemon which does this on boot:

set_permission() /system/bin/sh --> 384

It removes execute permissions from the sh binary and thus no shell access for us! Lucky us they have been hasty enough not to consider some basic Linux file system features... let's say immutable bit. When immutable flag is set for file, not even root can modify it until immutable flag is unset. Sure enough nfx_daemon won't check this, so we can get shell using this.

What you need to do:

* Write SD-card image to the real SD-card

* Using Linux mount second partition of SD-card to the fs (sorry, can't help if you do not know how to do this... cannot distribute modified image as it would violate Sony's IP):
mount /dev/sdb2 /mnt/part2

* Give executable permissions for mksh (sh is linked to mksh):
chmod 755 /mnt/part2/bin/mksh

* Set imutable bit for mksh:
chattr +i /mnt/part2/bin/mksh

* While doing this, you may just as well download motochopper and put pwn to xbin and give execute permissions:
cp pwn /mnt/part2/xbin/
chmod 755 /mnt/part2/xbin/pwn

* EDIT: See my post below. This is good time to push system.img and hidden.img to the sdcard. Get OTA zip, decrypt, unzip and write:
cp system.img /mnt/part2/
cp hidden.img /mnt/part2/

* Umount, put SD-card to the Xperia Tablet S and boot it. Wait a while.

* Start shell and gain root using pwn (motochopper is not designed for this so ignore al the error messages after success message):
C:\>adb shell
[email protected]:/ $ /system/xbin/pwn
/system/xbin/pwn
[+] This may take a few minutes.
[+] Success!
sh: /system/xbin/busybox: not found
sh: cp: not found

* Add busybox to PATH for convenience:
export PATH=$PATH:/system/xbin/busyboxbin

* Enjoy. We could no try to dd image from OTA zip to the bricked devices. I have no heart to do this since my device is not bricker. If anybody knows how to use dd and has bricked device, please, could you try it?

Ps. While we still cannot boot custom kernel (somebody should start working with that first partition, can we use custom kernel?), we could now craft custom rom which just uses original kernel, but it boots from the SD-card! How cool is that?

---------- Post added 23rd January 2014 at 12:15 AM ---------- Previous post was 22nd January 2014 at 11:28 PM ----------

Could anybody with bricked Xperia Tablet S try to recover? Mine is not bricked so I do not have heart to. If you are willing to, do this at your own risk and adapt instructions if I got something wrong:

- Follow instructions from my earlier post to get shell and root.
- Using desklunvr (http://forum.xda-developers.com/showthread.php?t=2068261) decrypt the OTA you used to brick your devices in the first place. ie:

desklunvr.exe signed-txs03_xxx-ota-nnn.zip

- Unzip decrypted zip

- Push resulting system.img to /tmp (or better write it to sd-card while you write pwn etc., adb is slow...):

adb push system.img /tmp

- From adb shell flash system image to first system partition:

/system/xbin/busyboxbin/dd if=/tmp/system.img of=/dev/block/mmcblk0p3

- From adb shell flash system image to second system partition:

/system/xbin/busyboxbin/dd if=/tmp/system.img of=/dev/block/mmcblk0p4

- Reboot. What happens?

Ps. Using these instructions Vendor apps are not restored and we didn't even try to flash hidden.img, need to try that also... Also, if device won't boot, one could try to flash original ICS OTA, if available... Now I have to get sleep.

---------- Post added at 12:21 AM ---------- Previous post was at 12:15 AM ----------

To try to flash hidden.img if system.img is not enough, push hidden.img to /tmp just like you did system img and:

/system/xbin/busyboxbin/dd if=/tmp/hidden.img of=/dev/block/mmcblk0p7

AT YOUR OWN RISK! Now sleep...

 

[vatis24]

Dear jappaj,

impressed of your foundations and your work .

I can try all of your instructions but unfortunately i don't understand the part :

* Write SD-card image to the real SD-card

* Using Linux mount second partition of SD-card to the fs (sorry, can't help if you do not know how to do this... cannot distribute modified image as it would violate Sony's IP):
mount /dev/sdb2 /mnt/part2

Also please note that my tablet was already rooted before i bricked it , if that can help.
Cheers

Vatis

 

[jappaj]

* Write SD-card image to the real SD-card
* Using Linux mount second partition of SD-card to the fs (sorry, can't help if you do not know how to do this... cannot distribute modified image as it would violate Sony's IP):
mount /dev/sdb2 /mnt/part2

What is your operating system? Problem is, that you will need to use Linux, OSX or any *nix operating system to complete all these steps and you also would need to know how to use command line tools. If somebody would create ready to use image and share it, all this could be skipped, but I am not willing to do it since Sony has been suing people for less (Playstation hackers, anybody?).