[Sony Cross-Device General] nlra:
So I recently bought a refurbished "G8441" from an Aliexpress vendor. I knew there was some inherent risk, but I've bought and used other Xperias from these Chinese refurbishers in the past, so I knew roughly what I was getting into.

Still, the particular device I received is interesting. Even though the same seller had both SO-02K and G8441 at vastly different price points (G8441 is > USD$100 more than the SO-02K), and I selected the G8441 (PM-1061-BV), the hardware is clearly SO-02K (PM-1060-BV) and is running SO-02K bootloader and modem firmware, but has somehow also been flashed with Customized UK G8441 (1310-6856) Android Pie firmware (47.2.A.11.228).

View attachment 5403123View attachment 5403125

I have no idea how they managed to do this. It's also clear that it was deliberate, since they manufactured a sticker for the SIM drawer that they put on top of the existing one. So essentially they charged me "full-price" for a G8441 but somehow "converted" a SO-02K into a G8441...but only halfway, since of course the modem itself is still the SO-02K modem, so it doesn't cover the same LTE bands as the G8441 one.

I have access to a Band 42 LTE eNB lab, so to further prove the point, I took this phone there, put in one of our test SIMs, and this "G8441" connected right up to it. A real G8441 cannot do this, since the G8441 doesn't support LTE B42.

I have a genuine SO-02K that I picked up used on eBay a couple of months back, and I have not been able to flash G8441 firmware to it, since Sony seems to have signed G8441 and SO-02K firmwares with different sets of encryption keys. Attempting the flash with newflasher just results in "Failed to verify cms". On this fake G8441, I tried to flash the same system.sin to it that it already has (1310-6856 version 47.2.A.11.228), but of course the flash errored out in exactly the same way. So even though the vendor somehow managed to get a G8441 system.sin and kernel.sin on this device, with the tools I have access to at least, it is impossible (without unlocking the bootloader) to re-flash with anything other than a genuine SO-02K ROM.

So, how the heck is this possible? Even the firmware history log from TA plainly shows that it got flashed with Customized UK firmware while the bootloader remained untouched. Since it shows up in the firmware update log, they couldn't have just written G8441 firmware directly to the flash chip themselves...they would have needed to accomplish this through Sony S1/flashmode!

Not at all sure I'll be successful, but I'm going to try to return it and see if I can get them to send me an actual G8441 device. But in the meantime, if there are any experiments anybody here wants me to run, let me know...

=========== FIRMWARES HISTORY LOG =============
NEW_VERSION: erased_user_data:true, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA1.1_O_79, cdf_version:1311-8845_R11B, fs_version:GENERIC_47.1.B.6.36, sw_version:1307-7513_47.1.B.6.36
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA1.1_O_79, cdf_version:1311-8845_R11B, fs_version:GENERIC_47.1.B.9.2, sw_version:1307-7513_47.1.B.9.2
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA1.1_O_82, cdf_version:1311-8845_R14B, fs_version:GENERIC_47.1.F.1.80, sw_version:1307-7513_47.1.F.1.80
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA1.1_O_82, cdf_version:1311-8845_R14B, fs_version:GENERIC_47.1.F.1.105, sw_version:1307-7513_47.1.F.1.105
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA2.0_P_106, cdf_version:1311-8845_R9C, fs_version:GENERIC_47.2.B.0.322, sw_version:1307-7513_47.2.B.0.322
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA2.0_P_110, cdf_version:1311-8845_R11C, fs_version:GENERIC_47.2.B.3.0, sw_version:1307-7513_47.2.B.3.0
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA2.0_P_110, cdf_version:1311-8845_R11C, fs_version:GENERIC_47.2.B.3.31, sw_version:1307-7513_47.2.B.3.31
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA2.0_P_110, cdf_version:1311-8845_R11C, fs_version:GENERIC_47.2.B.4.2, sw_version:1307-7513_47.2.B.4.2
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA2.0_P_114, cdf_version:1311-8845_R11C, fs_version:GENERIC_47.2.B.5.11, sw_version:1307-7513_47.2.B.5.11
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA2.0_P_114, cdf_version:1311-8845_R11C, fs_version:GENERIC_47.2.B.5.38, sw_version:1307-7513_47.2.B.5.38
NEW_VERSION: erased_user_data:false, variant:user, s1boot_version:1306-5035_X_Boot_MSM8998_LA2.0_P_114, cdf_version:1310-6856_R2C, fs_version:GENERIC_47.2.A.11.228, sw_version:1307-7513_47.2.B.5.38
=================================================