Debricking ideas for Xperia Tablet S - Sony Tablet S

Added xtskit.zip to this post which contains various scripts which can be used to debug various situations! Please use always latest version from this post and AT YOUR OWN RISK!
Decided to start new thread if anybody would still get any adeas for debricking my Xperia Tablet S before I call it unpossible... So, what has happened:
- Tried to upgrade my FI XTS from rooted 6b to rooted JB. Flashing apparently went fine but after reboot I got just Sony logo. Was able to boot to recovery and tried to recover by flashing firmware version 6, but got this error:
Installing update...
Write images to system0...
Write files to vendor0...
Random offset: 0x384
read_mod_link: failed to readlink "/system1/vendor": No such file or directory
E:Error in /tmp/desklunvr/desklunvr.zip
(Status 7)
Installation aborted.
Don't know what went wrong when flashing, but my analysis of current state:
* /blflags is set to 1 (because recovery starts to flash system0).
* /system0 contains valid image of that firmware what I use to recover (since it was flashed properly)
* /datapp/vendor0 contains correct data from the same firmware (since files were written properly)
* /system1 is totally corrupted
* /datapp/vendor1 state is unknown
* /staging state is unknown but propably contains valid data from SOME firmware because recovery works, right?
Because of that /system1 corrupted state, recovering won't work as Sonys updater-script will try to read it before flashing /staging.
No, why my XTS does not boot? For me, it seems that /staging contains valid image (because I can get to recovery), doesn't it then contain also valid kernel for system0, right? Does my XTS not boot because:
* /blflags is set to 1. System tries to boot from /system1 and FAILS since it's corrupted. However bootloader does not recognize this and wont flip blfalgs.
OT
* /staging is corrupted
In both cases, I could boot if I could just flip /blflags flag! In first case system would boot using /system0 and everything ok if /staging would have the right kernel for /system0 and since I can flash /system0 no problem. Also if flag would be flipped I could flash /system1 afterwards.
Now, any ideas? How to flip /blflags? I've been trying to poweroff in the middle of booting process but no luck. It just seems bootloader won't flip it no matter what.
Thanks!
- J

---

ignore post, cant delete

---

Could somebody confirm, that does hidden.img contain recovery and kernel? Further, could somebody with JB go to recovery and paste the version? I am trying to trace what version my /staging (hidden.img) is, JB or 6b.
My recovery says:
System utility(Rev.39, BL: 0x00000006, EC: 0.21, master)
I think it said the same when I was on 6b so unless JB has the same recovery, my /staging is probably from 6b.
Thanks!
Edit: And please, if anybody have european r6b firmware signed-txs03_300-ota-121116002.zip please share with me! I think my current hidden.img is from that firmware, just perhaps if I flash it, I could recover if the reason I cannot boot is that r6b bootloader won't allow loding r6 or JB system... Heh, I just tried, I can download r6b firmware for EVERY OTHER region but for my own region. Probably download link I got was wrong, but what would be the right link?

---

One kind soul replied and it seems JB's recovery is Rev.44. So my recovery/bootloader/kernel is from r6b and that's why my JB did not boot. I flashed hidden.img but for some reason it did not work (or I mistyped since I was a bit sleepy when upgrading).
I could try flashing r6b system0 and it could work, but Sony has removed it from their site. Please, anybody, do you have signed-txs03_300-ota-121116002.zip ??? I have r6, but it does not boot.

---

Just out of curiosity, when I poweron my tablet, kernel probably boots OK since my computer can see SGPT12 device after a while. However, adb does not work as expected so that wont help at all.

---

Wait what... I just found out, that when I am in recovery console, my computer sees SGPT121 device but does not have driver for it. When device worked, I had drivers. I used "Sony Tablet ADB Driver Automated Installer" to install drivers and when I explored android_winusb.inf I found out that this automated installer installed drivers only for composite adbdev interface, not for single adb interface. So I manually added correct pids etc. and was then able to install drivers and now I can actually see my device booted to recovery:
List of devices attached
0123456789ABCDEF recovery
Shell wont work however as expected so probably still impossible to unbrick, but at least I was able to pull recovery.log:
Starting recovery on Sun Apr 21 10:29:00 2013
can't open /dev/tty0: No such file or directory
framebuffer: fd 3 (1280 x 800)
recovery filesystem table
=========================
0 /tmp ramdisk (null) (null) 0
1 /hwconfigs ext2 /dev/block/mmcblk0p1 (null) 0
2 /configs ext4 /dev/block/mmcblk0p2 (null) 0
3 /system0 ext4 /dev/block/mmcblk0p3 (null) 0
4 /system1 ext4 /dev/block/mmcblk0p4 (null) 0
5 /cache ext4 /dev/block/mmcblk0p5 (null) 0
6 /misc emmc /dev/block/mmcblk0p6 (null) 0
7 /staging ext4 /dev/block/mmcblk0p7 (null) 0
8 /blflags ext4 /dev/block/mmcblk0p8 (null) 0
9 /datapp ext4 /dev/block/mmcblk0p9 (null) 0
10 /log ext4 /dev/block/mmcblk0p10 (null) 0
11 /data ext4 /dev/block/mmcblk0p11 (null) -32768
12 /sdcard vfat /dev/block/mmcblk1p1 /dev/block/mmcblk1 0
13 /boot emmc boot (null) 0
14 /recovery emmc recovery (null) 0
15 /system ext4 system (null) 0
16 /vendor0 ext4 vendor0.img (null) 0
17 /vendor1 ext4 vendor1.img (null) 0
Command: "/sbin/recovery"
ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
persist.sys.usb.config=mtp
ro.build.id=TID0142
ro.build.display.id=TID0142
ro.build.version.incremental=121116001
ro.build.version.sdk=15
ro.build.version.codename=REL
ro.build.version.release=4.0.3
ro.build.date=Fri Nov 16 01:16:55 JST 2012
ro.build.date.utc=1352996215
ro.build.type=user
ro.build.user=integ-build
ro.build.host=build8
ro.build.tags=test-keys
ro.product.model=SGPT12
ro.product.brand=Sony
ro.product.name=SYS_052
ro.product.device=txs03
ro.product.board=txs03
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=Sony
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=tegra
ro.build.product=txs03
ro.build.description=SYS_052-user 4.0.3 TID0142 121116001 test-keys
ro.build.fingerprint=Sony/SYS_052/txs03:4.0.3/TID0142/121116001:user/test-keys
ro.build.characteristics=tablet
ro.opengles.version=131072
wifi.interface=wlan0
wifi.wpa_supp_ready=0
persist.tegra.nvmmlite=1
windowsmgr.max_events_per_sec=135
ro.tether.denied=true
ro.sony.sound.enabled=true
ro.sony.display.release=release6b
ro.product-res-path=vendor/framework/SemcGenericUxpRes.apk
ro.sony.autovolume.threshold=10
ro.sony.update.server=info.update.sony.net
ro.sony.update.category_id=ST001
ro.config.alarm_alert=Alarm.ogg
ro.config.notification_sound=Notification.ogg
ro.config.ringtone=Ringtone_XPERIA.ogg
drm.service.enabled=true
dalvik.vm.heapstartsize=5m
dalvik.vm.heapgrowthlimit=48m
dalvik.vm.heapsize=256m
ro.sony.wifisleep=0
ro.semc.enhance.supported=true
ro.semc.clearaudio.supported=true
ro.somc.dmnorm.supported=true
ro.setupwizard.mode=DISABLED
ro.com.google.gmsversion=4.0_r6
ro.com.google.clientidbase=android-sony
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
net.change=net.bt.name
dalvik.vm.stack-trace-file=/data/anr/traces.txt
tf.enable=y
ro.sony.wan.ipv6.enable=false
persist.sys.sony.cabc.disable=0
persist.sys.sony.hdmi.disable=0
ro.sony.dlna_dms.enabled=false
ro.somc.social_product_model=PRODUCT_MODEL_TABLET
ro.sony.irremote.protocol_type=2
ro.sony.ols.eula=1
ro.pss.ps1content_disable=1
ro.factorytest=0
ro.bootmode=unknown
ro.baseband=unknown
ro.carrier=unknown
ro.bootloader=0x00000006
ro.hardware=txs03
ro.revision=0
init.svc.recovery=running
init.svc.nfx_daemon=running
init.svc.radbd=running

---

jappaj said:
Wait what... I just found out, that when I am in recovery console, my computer sees SGPT121 device but does not have driver for it. When device worked, I had drivers. I used "Sony Tablet ADB Driver Automated Installer" to install drivers and when I explored android_winusb.inf I found out that this automated installer installed drivers only for composite adbdev interface, not for single adb interface. So I manually added correct pids etc. and was then able to install drivers and now I can actually see my device booted to recovery:
Click to expand...
Click to collapse
I have exactly the same problem.
What do you modify on the android_winusb.inf to install drivers?
Thanks

---

hui666 said:
I have exactly the same problem.
What do you modify on the android_winusb.inf to install drivers?
Thanks
Click to expand...
Click to collapse
You mean you bricked your XTS like me while trying to flash JB? The we should warn people, it's something related to region, config or something like that.
About your question; edit android_winusb.inf and find rows like this:
;SONY Sony Tablet S
%CompositeAdbInterface% = USB_Install, USB\VID_054C&PID_05B4&MI_01
Then add row like this just after that:
%SingleAdbInterface% = USB_Install, USB\VID_054C&PID_05B4
So it becomes:
;SONY Sony Tablet S
%CompositeAdbInterface% = USB_Install, USB\VID_054C&PID_05B4&MI_01
%SingleAdbInterface% = USB_Install, USB\VID_054C&PID_05B4
There two places where you will find rows likje this, onw for x85 and one for amd64.
After this, boot to recovery and wait that you can see your XTS in device manager. It should shay that there are no drivers etc. Click update driver and browse manuaklly files and find directory which contains that modified file. Install and it should work.
But Sony has locked us out of the shell and effectively nothing can be done to fix anything (thanks sony, lock bootloader, f**k recovery scripts, f**k automatic swtiching between system images, lock recovery adb... what next, you need to be in jail to use next Xperia device?) unless somebody finds exploit. But then we could root also...

---

Wait, has anybody ever actually tried that would Xperia Tablet S accept upate.zip which is signed with test key just like you sign packages for Tablet S, but ALSO encrypted?
Because error message I get when trying to use such zip is something like cannot desklunvr package... So it is trying to decrypt package and as it is already decrypted, it fails. What happens if we encrypt it? It should be possible since we know how to decrypt!

---

jappaj said:
Wait, has anybody ever actually tried that would Xperia Tablet S accept upate.zip which is signed with test key just like you sign packages for Tablet S, but ALSO encrypted?
Because error message I get when trying to use such zip is something like cannot desklunvr package... So it is trying to decrypt package and as it is already decrypted, it fails. What happens if we encrypt it? It should be possible since we know how to decrypt!
Click to expand...
Click to collapse
Had jb boot up but no root access so flashed the jb update official and it works fine lost root it takes ages for it to boot and also took a couple of goes with the flasher no big deal only reason for root is custom ROM and until boot loader is unlocked not much need for root
S
Sent from my Wildfire using xda app-developers app

---

dex9mm said:
Had jb boot up but no root access so flashed the jb update official and it works fine lost root it takes ages for it to boot and also took a couple of goes with the flasher no big deal only reason for root is custom ROM and until boot loader is unlocked not much need for root
S
Sent from my Wildfire using xda app-developers app
Click to expand...
Click to collapse
Oh dear I've just joined the Bricked club tooo......
I tried updated from rooted 6b to Rooted Jelly Bean with condi flasher and I'm now stuck on the Sony screen.
Anyyyy possible fix?

---

Hi everyone, we are on the same boat. I've tried to flash using S.T.S.Flasher 3.0v the prerooted 4.1.1 rom on my root 4.0.3 R6B tab. My Xperia is US version. It seems that everything worked fine, but at the end I got black screen. On another post I read that a hard reset was needed. Nothing happened. After reboot i got freez on sony's logo. I've done with recovery a factory reset, wiping data etc, but without success.
Now I've downloaded a stock r5 version and flash it but i've seen after first boot that the fw that my dev. is running now is 4.1.1, without root and recovey. Strange but true. Why? i don't really know.
I think that i've done a big mistake flashing it but i think that it was the right thing to do for not using my tab as a coaster for the future.

---

sfex3best said:
Oh dear I've just joined the Bricked club tooo......
I tried updated from rooted 6b to Rooted Jelly Bean with condi flasher and I'm now stuck on the Sony screen.
Anyyyy possible fix?
Click to expand...
Click to collapse
Can you get to recovery? Try to flash firmware version 6 (not a not b) for your region from there. You are not bricked until you cannot flash from recovery like me...

---

sfex3best said:
Oh dear I've just joined the Bricked club tooo......
I tried updated from rooted 6b to Rooted Jelly Bean with condi flasher and I'm now stuck on the Sony screen.
Anyyyy possible fix?
Click to expand...
Click to collapse
flashing the stock jb from sony sight and losing root might be best if cant wait to hear back from condi......
not the best solution but from reading others at least shouldnt risk bricking.

---

Tried installing release 6 from recovery but no luck with that. Tried a few different versions too release 6b and jelly bean but the same error on all of them
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Need help
Sent from my R800i using xda premium

---

sfex3best said:
Tried installing release 6 from recovery but no luck with that. Tried a few different versions too release 6b and jelly bean but the same error on all of them
View attachment 1903761
Need help
Sent from my R800i using xda premium
Click to expand...
Click to collapse
I've flashed one of this stock rom . http://forum.xda-developers.com/showpost.php?p=26882762&postcount=3
because when i tried to flash it using recovery i got this error similar to yours:
"Desklunvr update package...
E:Can't desklunvr /sdcard/customs_prerooted_"........".zip
Installation aborted"
I think you'll lose root and recovery, but now should be the only way that i found to skip that error and brings back your tab to life.

---

I've tried those already I think.
Which one is stock rom out of those tho?
Sent from my R800i using xda premium

---

I have a US device, so i've downloaded and flashed the ICS r6b for US tablet. Should be both stock rom. If you see the links, are all of sony's web site.

---

Guys, if you get that "read_mod_link: failed to readlink "/system1/vendor": No such file or directory" error you currently are bricked. There's no way to recover until:
a) Sony releases an update which does not suck and is actually able to recover something (I doubt it since they haven't done it before)
b) Somebody from Sony leaks private key used to sign updates so we can sign our own update.zip (highly unlikely...)
c) Somebody finds a way to crack recovery from recovery itself (possible but I doubt it since it has not happened before)
d) Somebody finds out how to flip /blflags (possible, but I haven't been able to figure out how)
So we are screwed, there's no way to recover for now.
Ps. If anybody from Sony is reading this, please give us update.zip or something else which will flip blflags which would allow us to reover using standard firmware. Otherway you risk receiving bricked tablets to your sevice centers even though they are not really bricked, we just do not have proper update.zip. Highly unlikely though that anybody from Sony is reading this, at least anybody who can make the decision...

---

jappaj said:
Guys, if you get that "read_mod_link: failed to readlink "/system1/vendor": No such file or directory" error you currently are bricked. There's no way to recover until:
a) Sony releases an update which does not suck and is actually able to recover something (I doubt it since they haven't done it before)
b) Somebody from Sony leaks private key used to sign updates so we can sign our own update.zip (highly unlikely...)
c) Somebody finds a way to crack recovery from recovery itself (possible but I doubt it since it has not happened before)
d) Somebody finds out how to flip /blflags (possible, but I haven't been able to figure out how)
So we are screwed, there's no way to recover for now.
Ps. If anybody from Sony is reading this, please give us update.zip or something else which will flip blflags which would allow us to reover using standard firmware. Otherway you risk receiving bricked tablets to your sevice centers even though they are not really bricked, we just do not have proper update.zip. Highly unlikely though that anybody from Sony is reading this, at least anybody who can make the decision...
Click to expand...
Click to collapse
Man im roight there with you ok evey one who has used the flasher STOP FLASHING
If your stuck on sony screen during flashing But can flash back to ics do and saty there
If it is not booting then I dont have an answer just a warning
I was the first to post about the flsaher giving trouble but nobody checks these fourms till there is a prioblem and thats why people strat at step three and then ask where did I go wrong ive been posting since the twentith so its not like the warning signs wernt there
However if your realy want the update download it via ics then root with condis tool and flasdh
and you boot in to jb there is no root acknowledgement by 3rd party apps there is root due to the kernal condi provides but it is rooted
If
And why is the chager cable so short
Pm me if you need help
Sent from my SGPT12 using xda app-developers app
dont ask for condi by the way hes just got married