Xperia Tablet S Bricked and revived. Service tools obtained.

Search This thread


Jun 10, 2015
after root
Now my sony xperia tablet s open in this screen
ples. help my


  • 11733510_1606280429635554_434945995_n.jpg
    25 KB · Views: 271


New member
Sep 27, 2015
Dear all, I just did my registration to this forum to express my THANKS to @NerdiX, for this simple and clear explanation on how to fix my Sony Xperia S tablet (without any Linux stuff :) ) and also with the great efforts of @deltaztek for SD-card , @djrbliss for motochopper, @<robin> for desklunvr, @condi and all the others. Of course I didn't have any problems since my firmware was exactly the same.
Good job guys, I really appreciate what you have done!

Here's my simple how to with prepared image.

These step already done, no need to do this on linux box:

Write image on sdcard min 2Gb.
Put the card in tab and boot it.
When you see " Cold-boot Linux..." connect usb cable to pc and start a shell, presume windows command prompt, adb drivers installed too...
adb shell
[email protected]:/ $
will see:
[+] This may take a few minutes.
[+] Success!
sh: /system/xbin/busybox: not found
sh: cp: not found

export PATH=$PATH:/system/xbin/busyboxbin
then type:
STOP here if your OTA is diferent, i mean - no 3g - wifi only, and country code is not listed below! Read OTA WARNING bellow!!!
If your device is 3g and OTA is like mine, then proceed with next step. OTA for specific device see on stifilz post here:
on: [email protected]:/ # type the following lines one by one followed by enter key
/system/xbin/busyboxbin/dd if=/system/jb411r2/system.img of=/dev/block/mmcblk0p3 [COLOR="Red"][U]press ENTER, and wait, to see when it's done[/U][/COLOR]
/system/xbin/busyboxbin/dd if=/system/jb411r2/system.img of=/dev/block/mmcblk0p4 [COLOR="Red"][U]press ENTER, and wait... when done, proceed[/U][/COLOR]
/system/xbin/busyboxbin/dd if=/system/jb411r2/hidden.img of=/dev/block/mmcblk0p7 [COLOR="Red"][U]press ENTER, and wait[/U][/COLOR]
You can copy lines from here and paste it on command prompt window... When dd is done you can type reboot, or simply close command window, remove the card and start the tab. After SONY logo will see a triangle with an exclamation mark, tab will reboot and another one triangle with an exclamation mark, after that will boot to the os...


OTA WARNING and how to desklinvr your specific device firmware!
Sorry for the delay, thanks again to jappaj, please follow these simple steps to desklunvr your firm, and don't do cross flash 3g<->wifi<->3g versions.

Here's the link to image jb411r2sdcard.img with motochopper, system.img and hidden.img from - image for 3g model - county codes: AT BE BG CH CZ DK FI GR HU IE KZ NL NO PL PT RO RU SE SI SK TR UA, for other images, you need to desklunvr your preferable and put system and hidden via adb put...

Good luck!


New member
Dec 8, 2010
Service Tool Image Link

Hey guys,

does anybody have the Service Tools available right now?
All links seem to be offline :(

Thanks in advance.


New member
Jan 4, 2016
Hello Guys

I have download jb411r2sdcard.img and put it on (Platinum 8 GB Class 10 SDHC).
when I have done it in the tablet now only see the Sony logo and not ''Cold-boot Linux..''
what am I doing wrong?

I can not get into recovery mode from the tablet with or without a card sd.


Mar 31, 2012
Hi all.
Recently, I've bricked my Sony Xperia Tablet S (SGPT1211) and I look forward for hiring someone to help me recover it.

The story:
1. Using the "S.onyTablet.S v6.5 [ALLinONE]" utility I've successfully rooted the tablet. It worked well, but always booted in safe mode.
2. From a wrong understanding, I decided that "S.onyTablet.S v3.0 [FLASHER]" should update my tablet to a better, pre-rooted firmware..
3. By mistake, I reflashed the device with "S.onyTablet.S v3.0 [FLASHER]" INCLUDING the "hidden.img" partition.

As a result, I think that I've flashed the firmware that was intended for a wrong device, here is why:
1. The tablet starts up with a different pattern (orange lines instead of blue lines)
2. It gets to the "choose your language" first-run page, but the touch screen does not react right, it shows a white circle where I press and the setup doesn't go further than the 2nd "connect to WiFi" page.
3. The tablet is now recognized as "Sony Tablet S" device, not as "Sony XPERIA Tablet S", ADB shell shows no devices and Mac OS "Android File Transfer" app shows both cards as empty.

I can still access the boot menu with [volume +] and [power] keys and use "software update from SD card" and "wipe user data" options.
I've tried the "S.onyXT.S v1.0 [UNBRICKER]" utility. It downloaded the images and created an SD card, but this card is totally unreadable (file system not readable) on both Mac, PC and Android.
I've tried to copy the firmware manually to the FAT-formated SD card. It starts uploading via startup menu / bootloader and then aborts at about 20% of the verification process.
3. I've found a "" file made for this tablet, but it also aborts after 20% of verification.

I look forward for hiring someone to help me unbrik the tablet.

Thanks in advance!!


Senior Member
May 15, 2005
Well waking up an old threat,
A friend @vatis24 provided my with some .img files
1 . Android403installsdcard.img
2. unknown-partition.img

I usedWin32Disk to write the Android.img file to the SD card
Once i did that i get the Cold-boot linux kernel message.

Problem is that the adb shell command gives me the error -exec' /system/bin/sh' failed: Permission denied (13) -

I am not sure what i am missing here.
The unknown-partition.img where do i use that does anyone know?

Thank you for anyone that replies :)


New member
Oct 12, 2016
Image Files

I hope someone sees this...

I am kind of in need for the image files to unbrick my
xperia Tablet S.
Does anybody have a image laying around on their HDD?
I would really appreciate the help.
Many thanks!


New member
Nov 27, 2016
Request for Help

Worked like a charm after I used the right SD card.

Thanks to all who put so much effort into the analysis of this wonderful SD Card.

Only thing left to to is restoring all the apps that were installed befor the silly thing decided to play dumb :)

It was a Transcend Micro SDHC - at least that's what it says on the label.
I was using a Kingston MicroSD adapter.
The SD Card I used now is a 8GB PNY SDHC card.

Could you share service tool with me as I have the same problem with my tab s. I really in need it.
Thanks in advance.

ninosss 66

New member
Jul 17, 2017
xperia tablet SGPT1211

Hi guys
I have a xperia tablet SGPT1211 that won't turn on.
Any one has files to boot from the SD

Top Liked Posts

  • There are no posts matching your filters.
  • 9
    Hello all. After bricking my Xperia tablet S by the next method: rooted it, then install a soft called as I remember PLay help, or something like that, a soft that helped you make your device look like any other in Google play sao you can install all apps even if they aren't made for your device. everything was ok but when i restarted my tablet it wouldnt pass the sony logo and than black screen.
    So I tryed all methods provided within this forum, but nothing worked.
    So I decided to sent it to service. they realized it was a soft problem and charged me about 40 $ to repair.
    every thing is great now, BUT I have found in the box when I have picked up my tablet from service a 2 gb sd card :D
    i thought that was the sd card used to resoft my tablet, so I inserted the sd card in my tablet and rebooted while holding the vol plus button and it started to say something like: cold-boot linux kernel from sd card. i didnt want to break it again because i didnt have enough power and I restarted my tablet. it works ok.

    I want to see what it is on that sd card and share this tool with you, but for this I need help from you to create an image or something like that of this sd card. I have an macbook pro with os x maverick.
    Any Ideeas?
    Btw. using instructions from this thread vendor partition is not restored properly. You could do it manually via shell or via .bat... @condi, you have been quite productive with .bat files, perhaps you could prepare us .bat file which expectes device to be booted from recovery SD-card and then a) flashes system.img to both system partitions b) flashes hiddeh.img c) set's up vendor.

    I could do bat like that but I have so little time...

    Got some ideas, how to make it fully automatic :) even making sdcard from the beginning. i will try to make such tool.

    work in progress... got 80% of .bat ready. still making smallest sd image as I can. tool will prepare chosen firmware, split it to img files, prepare magic card, and do every flashing thing automatically.

    90%... need some testers with Xperia Tab and teamviewer :)

    98% done, any volunteer? :)
    ok guys, now please tell me - pwn binary is mandatory?
    its just to get su? (su already in xbin dir), or it makes shell accessible/make some other changes?

    auto unbrick tool - what works:

    1) download, decrypt, get img's,
    2) download prepared sd img (~180mb),
    3) write sd img to sd,

    got last thing to test (cant make it on my own = no xperia tab in my hands)
    4) auto unbrick process via shell

    need some device remotely via teamviewer!
    Full instructions for Linux-competent people:

    The deal is that Sony's recovery image will start nfx_daemon which does this on boot:

    set_permission() /system/bin/sh --> 384

    It removes execute permissions from the sh binary and thus no shell access for us! Lucky us they have been hasty enough not to consider some basic Linux file system features... let's say immutable bit. When immutable flag is set for file, not even root can modify it until immutable flag is unset. Sure enough nfx_daemon won't check this, so we can get shell using this.

    What you need to do:

    * Write SD-card image to the real SD-card

    * Using Linux mount second partition of SD-card to the fs (sorry, can't help if you do not know how to do this... cannot distribute modified image as it would violate Sony's IP):
    mount /dev/sdb2 /mnt/part2

    * Give executable permissions for mksh (sh is linked to mksh):
    chmod 755 /mnt/part2/bin/mksh

    * Set imutable bit for mksh:
    chattr +i /mnt/part2/bin/mksh

    * While doing this, you may just as well download motochopper and put pwn to xbin and give execute permissions:
    cp pwn /mnt/part2/xbin/
    chmod 755 /mnt/part2/xbin/pwn

    * EDIT: See my post below. This is good time to push system.img and hidden.img to the sdcard. Get OTA zip, decrypt, unzip and write:
    cp system.img /mnt/part2/
    cp hidden.img /mnt/part2/

    * Umount, put SD-card to the Xperia Tablet S and boot it. Wait a while.

    * Start shell and gain root using pwn (motochopper is not designed for this so ignore al the error messages after success message):
    C:\>adb shell
    [email protected]:/ $ /system/xbin/pwn
    [+] This may take a few minutes.
    [+] Success!
    sh: /system/xbin/busybox: not found
    sh: cp: not found

    * Add busybox to PATH for convenience:
    export PATH=$PATH:/system/xbin/busyboxbin

    * Enjoy. We could no try to dd image from OTA zip to the bricked devices. I have no heart to do this since my device is not bricker. If anybody knows how to use dd and has bricked device, please, could you try it?

    Ps. While we still cannot boot custom kernel (somebody should start working with that first partition, can we use custom kernel?), we could now craft custom rom which just uses original kernel, but it boots from the SD-card! How cool is that?

    ---------- Post added 23rd January 2014 at 12:15 AM ---------- Previous post was 22nd January 2014 at 11:28 PM ----------

    Could anybody with bricked Xperia Tablet S try to recover? Mine is not bricked so I do not have heart to. If you are willing to, do this at your own risk and adapt instructions if I got something wrong:

    - Follow instructions from my earlier post to get shell and root.
    - Using desklunvr ( decrypt the OTA you used to brick your devices in the first place. ie:

    - Unzip decrypted zip

    - Push resulting system.img to /tmp (or better write it to sd-card while you write pwn etc., adb is slow...):
    adb push system.img /tmp

    - From adb shell flash system image to first system partition:
    /system/xbin/busyboxbin/dd if=/tmp/system.img of=/dev/block/mmcblk0p3

    - From adb shell flash system image to second system partition:
    /system/xbin/busyboxbin/dd if=/tmp/system.img of=/dev/block/mmcblk0p4

    - Reboot. What happens?

    Ps. Using these instructions Vendor apps are not restored and we didn't even try to flash hidden.img, need to try that also... Also, if device won't boot, one could try to flash original ICS OTA, if available... Now I have to get sleep.

    ---------- Post added at 12:21 AM ---------- Previous post was at 12:15 AM ----------

    To try to flash hidden.img if system.img is not enough, push hidden.img to /tmp just like you did system img and:

    /system/xbin/busyboxbin/dd if=/tmp/hidden.img of=/dev/block/mmcblk0p7

    AT YOUR OWN RISK! Now sleep...
    very interesting.

    I dont have this device but one of the users sent me a p.m. i found it to be very interesting...

    for those interested I have mirrored the file on my server:

    also creating another mirror on Dev-Host