xperia-firmware-toolkit is a free, open-source Windows toolkit for pulling Sony Xperia stock firmware — straight from Xperia Companion or from Sony's own ESS distribution API — and rooting the Xperia 1 IV (XQ-CT72 / PDX223) with KernelSU Next. It documents how Xperia Companion works internally, where it drops firmware, and how to fetch the exact same files directly, then takes you through unlock → patch → root and (bonus) adb-based data migration between phones.
⚠️ For your own devices and security research. Unlocking a Sony bootloader
wipes the device and revokes DRM keys. No Sony firmware is redistributed here —
only the method and tooling. Every device token/ID/serial in the examples is redacted.
What it does
- Capture firmware from Xperia Companion — find where Companion stores firmware
on Windows and grab the partition
.sin bundle as it downloads.
- Download firmware without Companion — call Sony's public ESS distribution
API directly (no MITM, no pinning bypass) and pull chunks over HTTP Range.
- Reverse-engineering notes — Companion's Java/OSGi internals, the JRE-truststore
MITM trick, metadata files, and the Sony
.sin format.
- Root the Xperia 1 IV — extract stock
boot.img, patch with KernelSU Next,
fastboot flash boot, then Zygisk + PlayIntegrityFix + TrickyStore.
- Migrate Android data over adb — contacts → vCard, SMS → restorable XML, media
push, APK extraction and Play-Store-vs-sideload classification.
Repository layout
| Path | What |
|---|
docs/xperia-companion-reverse-engineering.md | How Companion works + the MITM/JRE-truststore method |
docs/xperia-companion-firmware-capture.md | Where firmware lands on Windows + capture |
docs/sony-ess-api-direct-download.md | The ESS API chain (Companion-less download) |
docs/rooting-guide.md | Full bootloader-unlock → KernelSU Next → Zygisk/PIF/TrickyStore walkthrough |
firmware-capture/watch_firmware_win.ps1 | Watches Companion and copies firmware parts as they land |
mitm/log_urls.py, mitm/capture.ps1 | mitmproxy addon + transparent capture launcher |
data-transfer/*.ps1 | adb migration tools (contacts, SMS, media, APKs) |
tools/ | Bundled third-party root/ad-block/SSL-unpinning tools (see tools/CREDITS.md) |
examples/*.xml | Redacted ESS API responses |
Quick start
# Capture firmware while Xperia Companion "Software repair" downloads it
powershell -ExecutionPolicy Bypass -File firmware-capture\watch_firmware_win.ps1
# Extract contacts from a source phone over adb
powershell -ExecutionPolicy Bypass -File data-transfer\contacts_to_vcf.ps1
Set $Serial and paths at the top of each script first. You need Android
platform-tools (adb/fastboot) on PATH.
FAQ
Do I need XperiFirm to download Sony Xperia firmware?
No. This project shows two routes that don't use XperiFirm: capturing the files
Xperia Companion downloads, and calling Sony's ESS distribution API directly.
Where does Xperia Companion store firmware on Windows?
Under %LOCALAPPDATA%\Sony\Xperia Companion\<InstallTime>\localstorage\<REGION>\
as FILE_<contentId> (a ZIP of all partition .sin files). Details in the docs.
Does rooting the Xperia 1 IV need an unlocked bootloader?
Yes — Sony bootloader unlock (which wipes the device and revokes DRM keys) is
required before flashing a patched boot image.
How do I get a raw boot.img from a Sony .sin file?
Strip the SIN header up to the ANDROID! magic (offset 3584 on the analysed
build); the remainder is a valid boot image. See the RE notes.
Did you have to defeat SSL pinning on Xperia Companion?
No. Companion uses standard TLS with its own JRE truststore; a trusted MITM CA
imported into jre\lib\security\cacerts is enough — and even that is optional
because the firmware tokens are already in services.json.
Alternatives / compared with
- XperiFirm — enumerates and downloads all currently-available Xperia firmware
from Sony's servers. This toolkit instead documents the Companion/ESS mechanics
and focuses on capture + a specific root workflow; use XperiFirm for broad
version enumeration.
- Newflasher — flashes Sony
.sin/FTF firmware over the flashmode protocol.
Complementary: use it to flash what you capture here.
License
MIT — see LICENSE. Not affiliated with Sony. "Sony" and "Xperia" are
trademarks of their respective owners; firmware is their property.
