Xperia Tablet S Bricked and revived. Service tools obtained.

[vatis24]

What is your operating system? Problem is, that you will need to use Linux, OSX or any *nix operating system to complete all these steps and you also would need to know how to use command line tools. If somebody would create ready to use image and share it, all this could be skipped, but I am not willing to do it since Sony has been suing people for less (Playstation hackers, anybody?).

Thanks a lot for your reply jappaj, then i guess we will have to wait for a ready image from someone .

Cheers and thanks

 

[mstfyounis]

@jappaj
Maaaaan, you are genius
But is there any hope that it will work with the older generation (Sony Tablet S1) ???

 

[Theogonist]

All download links are as dead as my bricked Tablet.
Is there any chance to get the Service Tools image?

I also have some spare time and Linux know how to offer

 

[iRet]

All download links are as dead as my bricked Tablet.
Is there any chance to get the Service Tools image?

I also have some spare time and Linux know how to offer

I've uploaded for you. Here it is. yadi.sk/d/ESwKmRjQGdSwJ

 

[NerdiX]

You make my day guys
My SGPT1311 is live again!

Big THANKS to deltaztek, jappaj and sony's service center guy who forget recovery card and make this big gift for us.
How i repaired my tab:
1. write img to sdcard;
2. on ubuntu live cd with gparted -> resize part2 to get more space fo system.img and hidden.img
3. follow jappaj instructions:

* Using Linux mount second partition of SD-card to the fs (sorry, can't help if you do not know how to do this... cannot distribute modified image as it would violate Sony's IP):
mount /dev/sdb2 /mnt/part2

* Give executable permissions for mksh (sh is linked to mksh):

chmod 755 /mnt/part2/bin/mksh

* Set imutable bit for mksh:

chattr +i /mnt/part2/bin/mksh

* While doing this, you may just as well download motochopper and put pwn to xbin and give execute permissions:

cp pwn /mnt/part2/xbin/
chmod 755 /mnt/part2/xbin/pwn

* EDIT: See my post below. This is good time to push system.img and hidden.img to the sdcard. Get OTA zip, decrypt, unzip and write:

cp system.img /mnt/part2/
cp hidden.img /mnt/part2/

* Umount, put SD-card to the Xperia Tablet S and boot it. Wait a while.

* Start shell and gain root using pwn (motochopper is not designed for this so ignore al the error messages after success message):
C:\>adb shell
[email protected]:/ $ /system/xbin/pwn
/system/xbin/pwn
[+] This may take a few minutes.
[+] Success!
sh: /system/xbin/busybox: not found
sh: cp: not found

* Add busybox to PATH for convenience:

export PATH=$PATH:/system/xbin/busyboxbin

- Using desklunvr (http://forum.xda-developers.com/show....php?t=2068261) decrypt the OTA you used to brick your devices in the first place. ie:
Code:

desklunvr.exe signed-txs03_xxx-ota-nnn.zip

- Push resulting system.img to /tmp (or better write it to sd-card while you write pwn etc., adb is slow...):
Code:

adb push system.img /tmp

- From adb shell flash system image to first system partition:
Code:

/system/xbin/busyboxbin/dd if=/tmp/system.img of=/dev/block/mmcblk0p3

- From adb shell flash system image to second system partition:
Code:

/system/xbin/busyboxbin/dd if=/tmp/system.img of=/dev/block/mmcblk0p4

To try to flash hidden.img if system.img is not enough, push hidden.img to /tmp just like you did system img and:

/system/xbin/busyboxbin/dd if=/tmp/hidden.img of=/dev/block/mmcblk0p7

Thanks again!
xcus my bad english


EDIT: used signed-txs03_350-ota-121116014.zip for system.img and hiden.img

 

[Theogonist]

I've uploaded for you. Here it is. yadi.sk/d/ESwKmRjQGdSwJ

Awesome, thanks!
I'll look into it as soon as I am home

 

[NerdiX]

Condi made his Flasher only for wifi, not for 3g (jb). While attempting to adjust it to flash 3f firmware, i break my tab.
After repairing with above method, tab can't be updated to jb 4.1.1, straight from recovery (prohibit update bla, bla...) and System Update check from Settings->About report that i'm current.
Again put in card system.img and hidden.img from signed-txs03_350-ota-130705005_desklunvr.zip. Steps with sdcard are familiar.
Now my tab is upgraded to jb 4.1.1 Next step is motochopper.

P.P. i don't know what break condi's tool to root it (drivers, adb - everything is ok) 15 min loop and nothing, but motochopper work properly.

 

[smgdev]

Maybe service did this on purpose, can you ask him/her for s1 servixce tools? Lol

Sony Tablet S cihazımdan Tapatalk kullanılarak gönderildi

 

[jappaj]

You make my day guys
My SGPT1311 is live again!

Sweeeeeeeeeeeeet, it worked?!?!? Wonderful news, extraordinary! Million thanks to @deltaztek for obtaining SD-card in the first place, @djrbliss for motochopper, @<robin> for desklunvr, @condi for gathering knowledge about how to flash images to the device , @stifilz for firmwares and of course SonyCenterGuy why leaked the SD-card (could be on purpose, you know...)! If I forgot to thank somebody, sorry and tell me and I will add credits!

There is some kind of recovery daemon running on Android booted from Sony's SD-card, probably it can be used to flash images also, but we do not know how to do it and if dd really worked then who cares! There are also so much diagnostic tools in the SD-card, that somehow Sony is able to get shell even without that immutable flag trick, but who cares that either now...

One could prepare new image, with Sony's first partition which clearly does trigger the cold boot and minimal /system with only busybox in it and enough room for system.img. Image like that should fit into 50 MB zip. To be used by non-Linux-people abroad here.

So excited it worked, damn!

Ps. Sorry, non-Xperia tablet owners, if the SD-card won't boot non-Xperia tablet, there is little we can do for now.

 

[vatis24]

Sweeeeeeeeeeeeet, it worked?!?!? Wonderful news, extraordinary! Million thanks to @deltaztek for obtaining SD-card in the first place, @djrbliss for motochopper, @<robin> for desklunvr, @condi for gathering knowledge about how to flash images to the device and of course SonyCenterGuy why leaked the SD-card (could be on purpose, you know...)! If I forgot to thank somebody, sorry and tell me and I will add credits!

There is some kind of recovery daemon running on Android booted from Sony's SD-card, probably it can be used to flash images also, but we do not know how to do it and if dd really worked then who cares! There are also so much diagnostic tools in the SD-card, that somehow Sony is able to get shell even without that immutable flag trick, but who cares that either now...

One could prepare new image, with Sony's first partition which clearly does trigger the cold boot and minimal /system with only busybox in it and enough room for system.img. Image like that should fit into 50 MB zip. To be used by non-Linux-people abroad here.

So excited it worked, damn!

Ps. Sorry, non-Xperia tablet owners, if the SD-card won't boot non-Xperia tablet, there is little we can do for now.

Thanks jappaj for thinking all xpeira tablet users!
We will really appricaite it if someone can prepare a new image so we will unbrick our tablets!

Cheers all and thanks this amazing community !

 

[NerdiX]

Anyone with non-Xperia tab must try, I think everything will be ok.

 

[iRet]

Anyone with non-Xperia tab must try, I think everything will be ok.

How to try it? On Tablet S original image written to sd card does nothing. Also tried to enter recovery and update from sd. Is any special activity needed to tell tablet to boot from sd?

 

[Theogonist]

It seems I'm doing something wrong or my Xperia Tab is beyond repair.
I dd'ed the image to a SD Card and can mount the partitions.
unfortunately the tablet refuses to boot from the SD card
I can see the SDcard from recovery but it's empty when I select it.

Any ideas?

 

[jappaj]

It seems I'm doing something wrong or my Xperia Tab is beyond repair.
I dd'ed the image to a SD Card and can mount the partitions.
unfortunately the tablet refuses to boot from the SD card
I can see the SDcard from recovery but it's empty when I select it.

Any ideas?

Try first booting your tablet using Sonys' image without any modificaitons at all. Just dd the image to SD-card and boot your tab. It still does not cold boot? Perhaps yo ucould try another SD-card, just in case? I find it very strange that you are able to boot to the reovery (bootloader works), but not this SD-card (bootloader does not work?!)...

There no recovery image in this SD-card, forget about trying to flash something from recovery. Card contains bootable android system but no flash ZIP.

 

[Theogonist]

Try first booting your tablet using Sonys' image without any modificaitons at all. Just dd the image to SD-card and boot your tab. It still does not cold boot? Perhaps yo ucould try another SD-card, just in case? I find it very strange that you are able to boot to the reovery (bootloader works), but not this SD-card (bootloader does not work?!)...

That's what's bugging me too. which partition should be flagges as bootable? atm it is set to the first partition.

Disk /dev/sdi: 31.4 GB, 31439454208 bytes
255 Köpfe, 63 Sektoren/Spur, 3822 Zylinder, zusammen 61405184 Sektoren
Einheiten = Sektoren von 1 × 512 = 512 Bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Festplattenidentifikation: 0xaea06dd5

Gerät boot. Anfang Ende Blöcke Id System
/dev/sdi1 * 63 144584 72261 c W95 FAT32 (LBA)
/dev/sdi2 144585 1381589 618502+ 83 Linux
/dev/sdi3 1381590 2008124 313267+ 83 Linux
/dev/sdi4 2008125 2233034 112455 83 Linux

There no recovery image in this SD-card, forget about trying to flash something from recovery. Card contains bootable android system but no flash ZIP.

ok I only expected to see the filesystem of partition 2 at least.

I will try another SD card. But I won't be back before sunday night - family business :\

 

[jappaj]

Been playing with SD-card and trying to find out what it takes to cold-boot. At first I zeroed the SD-card, created manually new partition equalling Sony's partition table and dd'd in first hidden partition. No boot. Tried to change disk identifier to the same than in Sony's image, no boot. The dd'd in first 63 sectors -> boot. MBR is stored on first sector of the disk and first partition starts on sector 63, so there is worth of 62 sectors some empty space. It seems cold boot magic lies on these sectors, that is what makes Xperia Tablet S to recgonize SD-card as diagnostics card and boot kernel from first hidden partition.

Went further ahead, zeroed the disk identifier, deleted last two partitions and changed partition type of the first partition to Non-FS data. Still boots. So yeah, magic is in those sectors. I will try next to figure out minimal set of files needed for dd'ing new system in for that first partition.

 

[Theogonist]

Ok I managed to boot from an SD Card.
My first tries were done with a 32GB Micro SD and an adapter -> not working
I now used a 8GB SD card -> works

I'll try to restore the device when I am back

 

[jappaj]

Nice, 32GB card is SDXC anyways not SDHC right? That may be why it did not work from 32GB card.

Meanwhile, it is enough to have bin and lib on the SD-card's system partition to recover since dd is really only command needed apart from basic shell commands like cd and ls. Oh and of course adbd is needed. Probably most of the stuff frum bin and lib could be removed also, but there is little point...

 

[NerdiX]

How to try it? On Tablet S original image written to sd card does nothing. Also tried to enter recovery and update from sd. Is any special activity needed to tell tablet to boot from sd?

You can't update from card, cos no recovery image stored on it.
jappaj write about that, just try to boot from card, if you stuck with cold boot kernel message, then tab can be repaired with this method.
I'm sure service guys manipulate this card another way, not like us
@Theogonist, there's no fat32 partition on the card, something is wrong. Format the card and write again.

 

[stifilz]

Been playing with SD-card and trying to find out what it takes to cold-boot. At first I zeroed the SD-card, created manually new partition equalling Sony's partition table and dd'd in first hidden partition. No boot. Tried to change disk identifier to the same than in Sony's image, no boot. The dd'd in first 63 sectors -> boot. MBR is stored on first sector of the disk and first partition starts on sector 63, so there is worth of 62 sectors some empty space. It seems cold boot magic lies on these sectors, that is what makes Xperia Tablet S to recgonize SD-card as diagnostics card and boot kernel from first hidden partition.

Went further ahead, zeroed the disk identifier, deleted last two partitions and changed partition type of the first partition to Non-FS data. Still boots. So yeah, magic is in those sectors. I will try next to figure out minimal set of files needed for dd'ing new system in for that first partition.

Following this thread and your awesome work!!! Hoping there is something obvious in the 'cold boot magic' part that we can implement to work with the STS.