[Sony Tablet S] stth:
IT WORKED

THANKS [MENTION=422959]condi[/MENTION]

PS: why not trying to use the SD-image to flash KitKat?

i mean, you can pull all mmc images and flash all mmc images via dd, why not writing a custom rom this way? the only problem is the kernel.

mounts of /dev/block/*

mmcblk0p1 -> /configs

-r--r--r-- 1 root root 64 Jan 1 2000 06590E37F8A647D989345317AAFF6A6C

-r--r--r-- 1 root root 242 Jan 1 2000 31850B1B-0DAB-42ce-A498-A73479B7B3EB

-r--r--r-- 1 root root 878 Jan 1 2000 calibration_rear.bin

-r--r--r-- 1 root root 63104 Jan 1 2000 CFBSMXHMUAF48EXTDTCSOH4BXXDDRBFG

-r--r--r-- 1 root root 132 Jan 1 2000 local.prop​

mmcblk0p2 -> /params

-rw------- 1 root root 2 Jan 30 14:43 activate_done

lrwxrwxrwx 1 root root 57 Jan 30 14:43 countries.lst -> /datapp/vendor/vendor0/regioncodelist/SKU002000172608.lst

drwx------ 2 root root 4096 Jan 1 1970 lost+found

-rw-r--r-- 1 root root 33 Jan 30 14:43 region_checksum.txt

-rw-r--r-- 1 root root 9706 Jan 30 14:43 region.zip

-rw-rw-rw- 1 root root 2 Jan 30 14:43 selected_country​

mmcblk0p3 -> /system

mmcblk0p4 -> /system (copy)

mmcblk0p5 -> /cache

(ls /cache/recovery)

-rw-r--r-- 1 root root 45 Jan 1 2000 last_install

-rw-r----- 1 root root 22626 Jan 1 2000 last_log

-rw------- 1 stth stth 18769 Jan 1 2000 log​

mmcblk0p6 -> not mounted (2MB, file system?, image not mountable as loop device)

mmcblk0p7 -> not mounted (64MB, file system?, image not mountable as loop device)

mmcblk0p8 -> not mounted (2MB, file system?, image not mountable as loop device)

mmcblk0p9 -> /datapp (vendor)

mmcblk0p10 -> /log

-rw-r--r-- 1 root root 18652 Jan 1 2000 recovery_abort.log​

mmcblk0p11 -> /data

judging the size of the unknown partitions, mmcblk0p7 could contain the kernel. probably we just have to find the file system on this partition. i guess, sony just skips a part or descrambles the partition while it shows the sony logo (which is always displayed, no matter if you boot into recovery, or the system) also, the hidden.img is flashed there... so... how to get it out?

what are the files in /configs? maybe keys or executables to decrypt the kernel?

does anybody have a log of a successful update in the logs (see mount list above)? is there any information about an updated kernel?

to get the mmc-images, just create the unbricker sd card (it does not break anything if you stop the script after the sd is written)

execute adb shell "/system/xbin/pwn"

then adb pull /dev/block/mmcblk*

on linux, you can mount them with

mount -o loop <image> <mountpoint>

some require root to view files

if anything is broken, we should be able to reflash all mmcblk-images which of couse should be backed up in advance

€:

today i scanned the sd image and the hidden.img seems, that the tablet would boot any kernel that is at position 0x00000400 on a sd card.

you may copy any image from OTA update.zip to that position and it should load it.

$ dd if=unbrick.img of=/dev/sdXXX

$ dd if=hidden.img of=/dev/sdXXX bs=512 seek=2

i tried the kernel from a tablet s on the xts and settings/about/kernel told me it worked!!

sadly, the data in hidden.img looks similiar to kernels of other SE devices, but is somehow scrambled