Ultimate Guide – How to unlock the bootloader on every Sony Xperia model (2025 update)
⚠️ Read this first
Unlocking the bootloader factory-resets the phone, kills the DRM keys (Widevine L1→L3, camera algorithms, etc.) and may void your warranty.
Back up everything (including the TA partition / DRM keys if you wish to re-lock later).
1. Check if your model can be unlocked
- Open the dialer and type
*#*#7378423#*#*→ Service info → Configuration → Rooting Status.
If you see “Bootloader unlock allowed: Yes”, jump to section 2.
If it says “No”, see section 3 (carrier / AU-variant workaround). - Also write down the IMEI (
*#06#) – you will need it later.
2. Official Sony method (fastboot token) – works for unlock-allowed devices
| Step | Action | Screen / link |
|---|---|---|
| 1 | Install platform-tools (ADB/fastboot) and the Sony USB driver | Sony driver page |
| 2 | Enable Developer options → turn on USB debugging + OEM unlocking | Settings ▸ About phone ▸ Tap build number 7× |
| 3 | Reboot to fastboot | Power off → Volume-Up + USB cable to PC or adb reboot bootloader |
| 4 | Unlock token | Visit Sony unlock portal ▸ choose model ▸ enter IMEI ▸ accept legal ▸ copy the 16-char code |
| 5 | Unlock | fastboot oem unlock 0x<YOUR_CODE> (or fastboot flashing unlock 0x<YOUR_CODE> on newer devices) |
| 6 | Reboot | fastboot reboot – first boot takes a while |
Done! You can now flash TWRP, Magisk, custom ROMs, etc.
3. “Bootloader unlock allowed: No” – Carrier / AU / SoftBank variants
Some Japanese/AU models (SO-01/02/41, SOG01/02, etc.) ship with the flag set to No.
There are two community work-arounds:
There are two community work-arounds:
3A. qUnlockTool (Windows-only, paid credits)
Verified working on Xperia 1 II (SOG01) and 5 II (SOG02)
- Download qUnlockTool (mirror: WeTransfer).
- Disable Windows Defender / Antivirus, install the drivers inside the zip.
- Run tool → login with the username / password you received after purchase.
- Power off phone → Volume-Down + USB cable → click SIM unlock in tool → wait until UNLOCK DONE.
- Reboot, dial
*#*#7378423#*#*again – the flag should now say Yes. - Continue with section 2 (official fastboot unlock).
- If SIM breaks after unlock, re-run qUnlockTool → Write Backup to restore modem files .
3B. Test-point / EDL / SETool (advanced, risky)
Some older boards (Xperia XZ*, Z*, etc.) expose a test-point on the PCB that forces EDL mode.
Using SETool or XperiFirm + test-point you can rewrite the TA partition and set the flag to Yes.
This requires:
Using SETool or XperiFirm + test-point you can rewrite the TA partition and set the flag to Yes.
This requires:
- Disassembling the phone
- Shorting the test-point while connecting USB
- Using leaked Sony service tools (no public download – check XDA/telegram groups)
Only recommended for unbricking or experienced users.
4. Model-specific quick notes
| Family | Typical model numbers | Remarks |
|---|---|---|
| Xperia 1 / 5 / 10 (i/ii/iii/iv/v) | XQ-AQ*, XQ-AS*, XQ-CT*, XQ-DQ*, etc. | Use official unlock unless AU-variant → qUnlockTool |
| Xperia Pro / Pro-I | XQ-AQ62 | Same as above |
| Xperia XZ / XZs / XZ1 / XZ2 / XZ3 | G8*, G83*, G84*, G85* | Older fastboot protocol: use fastboot -i 0x0fce oem unlock 0xCODE |
| Xperia L / M / C / E / T / V | Legacy 2012-2014 devices | Portal now redirects to the new site, but old tokens still work if you saved them |
| Tablet Z / Z2 / Z3 / Z4 | SGP* | Unlock procedure identical to phones |
5. After unlock – Flashing TWRP & rooting
- Download TWRP image for your exact model (XDA or twrp.me).
- Reboot to fastboot →
fastboot flash recovery twrp.img→fastboot reboot. - Root with Magisk (patch
init_boot.imgextracted from your firmware via XperiFirm / Newflasher) .
6. Re-locking the bootloader (optional)
If you ever want to return to fully stock + L1 Widevine:
- Flash the original Sony firmware with Newflasher or Emma.
- Reboot to fastboot →
fastboot oem lock(orfastboot flashing lock). - Locking will wipe the device again and restore DRM keys only if you backed them up with Backup-TA before the first unlock.
Quick links at a glance
- Sony official portal & unlock steps: https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader/
- Sony USB drivers: https://developer.sony.com/develop/open-devices/downloads/
- qUnlockTool credits: canadaunlocking.com | martview.com
- XDA general Xperia root/unlock hub: https://xdaforums.com/t/unlock-bootloader-and-root-guide.4677173/
1. Legal & safety warnings (read once, save your sanity)
- Sony’s policy: unlocking is irreversible, kills the DRM keys (Widevine L1→L3, Bravia Engine, DSEE Ultimate, 960 fps super-slow-motion algorithms, camera noise-reduction blobs, etc.) and voids the warranty in most regions.
- Carriers: AU, SoftBank, Verizon, T-Mobile, Rogers, Telstra, and several LATAM operators lock the flag to “No” – you need a commercial service or test-point.
- Regional law: In the EU you keep your 24-month warranty for hardware failures unrelated to the software modification (Directive 2019/771). In the US, Magnuson-Moss is weaker; expect push-back.
- Financial risk: If you trip the “Root of Trust” fuse (newer 2023+ devices), Sony’s repair centres will refuse paid service – you must use third-party micro-soldering.
- Data loss: every unlock factory-resets the device and deletes the hardware-backed keystore (your bank tokens, Secure Folder, eSIM, etc.).
- Back-up everything – including the TA partition (2-4 MB) with Backup-TA or XperiFirm+Newflasher before the very first unlock.
2. The Sony ecosystem in 30 seconds
| Term | What it is | Why you care |
|---|---|---|
| TA (Trim Area) | Small eMMC partition that stores DRM keys, sensor calibration, color profile, Widevine certificates | Once erased, camera quality and Netflix HD drop permanently |
| S1Boot | Qualcomm-based secondary bootloader | Fastboot talks to it |
| S1Service | Sony-signed service software used in official repair centres | Leaked builds allow EDL flashing |
| DRM Key revision | Each generation (1, 2, 3) has incompatible keys | Back-up the exact revision for your firmware |
| X-Reality / Bravia Engine | Proprietary display pipeline | Requires DRM key revision 2+ |
| Dynamic Vibration | Hardware bass shaker driver | Also tied to DRM |
3. How to discover exactly which Xperia you own
- Dialer code:
*#*#7378423#*#*→ Service info → Configuration → Marketing name & Model number. - Sticker under SIM tray: e.g., XQ-CT54-B – the suffix tells the sales region (
-B= EU,-V= Verizon,-J= Japan,-CN= China). - Fastboot variable:
fastboot getvar productreturns the internal codename (e.g.,pdx215,pdx206,pdx203). - XperiFirm: Connect via USB → automatically pulls the CSC, customization version, Android security patch level, and bootloader unlock allowed flag (yes/no).
- Build fingerprint (for ROM chefs):
adb shell getprop ro.build.fingerprint.
4. The three possible lock states
| State | Description | Unlock method |
|---|---|---|
| Green | Retail / open-market device, flag = Yes | Official Sony portal (section 5) |
| Yellow | Carrier variant, flag = No, but unlockable via commercial tool | qUnlockTool, Chimera, Octoplus, or test-point (section 6) |
| Red | 2023+ devices with Root-of-Trust fuse blown, or Verizon/Sprint permanently locked | Test-point + EDL firehose (Sahara) or hardware swap (section 7) |
5. Official unlock flow – green state (2025 edition)
5.1 Prerequisites
| Item | Windows | macOS | Linux | Notes |
|---|---|---|---|---|
| ADB & fastboot | platform-tools_r35.0.1-windows.zip | Same | Same | Always use the latest Google release |
| Sony USB driver | Sony_Mobile_Driver_2.13.exe | Not needed | Not needed | Install before plugging phone |
| USB-C cable | Certified 3.2 cable | Same | Same | Cheap cables drop to USB2 and fail large transfers |
| Battery | ≥ 70 % | Same | Same | Unlock fails below 50 % |
5.2 Enable developer settings & OEM unlock
- Settings → About phone → Build number → tap 7× → “You are now a developer!”
- Settings → System → Developer options → enable USB debugging & OEM unlocking.
- Accept the scary red warning: “Allow OEM unlocking – this CAN’T be undone”.
5.3 Acquire the unlock code from Sony
- Scroll to the bottom → Continue → choose your exact model from the drop-down.
- Enter IMEI (dial
*#06#) – Sony trims the last digit, keep only 14 digits. - Tick both legal boxes → Submit.
- Copy the 16-character unlock code (e.g.,
9E4B1A37C6D2F8E0).
Pro tip: Save the code in a password manager – Sony lets you generate it only once per IMEI.
5.4 Reboot to fastboot
| Variant | Key combo | Alternative |
|---|---|---|
| Xperia 1/5/10 (iv/v) | Power off → Vol-Up + USB cable | adb reboot bootloader |
| Xperia 1 III/5 III | Same | Same |
| Xperia 10 II | Vol-Up + USB | Same |
| Xperia Pro-I | Vol-Up + USB | Same |
| Legacy (Z5, XZ, etc.) | Vol-Up + USB | Same |
Fastboot screen shows pink text
FASTBOOT on a black background.5.5 Unlock
- Open a terminal in the platform-tools folder.
- Always double-check the device is detected:
fastboot devicesYou should see:ABCDEF123456 fastboot - Issue the unlock command:
- 2022 and older:
fastboot -i 0x0fce oem unlock 0x<YOUR_CODE> - 2023+ (Android 13+):
fastboot flashing unlock 0x<YOUR_CODE>
- Phone reboots automatically → erases userdata → boots into Android setup wizard.
5.6 First boot checklist
- Skip Wi-Fi → let it finish setup → Settings → About phone → Build number → verify “Bootloader unlocked” is shown.
- Re-enable USB debugging → check Widevine level with DRM Info app – expect L3.
- Install Magisk (see section 9).
6. Carrier / AU / SoftBank / Verizon variants (yellow state)
6.1 Model matrix (2025)
| Carrier | Typical model | Retail name | Unlock flag | Work-around |
|---|---|---|---|---|
| AU (KDDI) | SO-41A | Xperia 5 III | No | qUnlockTool |
| AU (KDDI) | SO-52A | Xperia 10 III | No | qUnlockTool |
| SoftBank | A001SO | Xperia 1 IV | No | Chimera Pro |
| Verizon | XQ-CT62 | Xperia 1 V | No | Test-point (EDL) |
| T-Mobile US | XQ-AS72 | Xperia 10 IV | No | Octoplus Pro |
| Rogers CA | XQ-AT51 | Xperia 1 II | No | qUnlockTool |
6.2 qUnlockTool – step-by-step (most popular)
6.2.1 Buy credits
- canadaunlocking.com – US$ 24.95 – instant delivery.
- martview.com – € 19.90 – slower (8-24 h).
- GSM-Forum resellers – PayPal or crypto – cheaper but riskier.
6.2.2 Install drivers
- Download qUnlockTool-v2.3.0.zip (mirror: Mega).
- Extract → run Install_Drivers.exe → reboot Windows.
- Disable Windows Defender real-time protection for 10 minutes (the tool uses leaked Sony libs flagged as PUA).
6.2.3 Unlock procedure
- Power off phone.
- Hold Vol-Down + insert USB cable → blue LED (Qualcomm 9008).
- Open qUnlockTool.exe → paste username/password from step 6.2.1 → press Connect.
- Tool shows Device: SO-41A → press Unlock SIM & BL.
- Wait 90-120 s → green UNLOCKED message.
- Unplug → power on → dial
*#*#7378423#*#*→ confirm flag changed to Yes. - Continue with section 5 (fastboot unlock).
6.2.4 Troubleshooting
| Symptom | Fix |
|---|---|
| Tool stuck at 0 % | Re-install Qualcomm HS-USB QDLoader 9008 driver manually |
| Blue LED but “Device not found” | Use USB 2.0 port, not 3.0 |
| Unlock button greyed out | Credits expired – buy new |
| IMEI shows 0000 | Reboot to EDL again |
6.3 Chimera Pro (SoftBank & some EU carrier)
- Price: 60 credits (~US$ 55)
- Works on A001SO, SOG06, SO-51C
- Steps identical to qUnlockTool but uses EDL cable (cheap on Amazon).
6.4 Octoplus Pro (T-Mobile & Rogers)
- Requires DC-Phoenix + Octoplus Huawei/Samsung license (bundled).
- Same 9008 EDL flow.
- Success rate ≈ 95 %.
7. Permanently locked devices (red state)
7.1 Hardware – Root-of-Trust fuse
- 2023+ Snapdragon 8 Gen 2 boards include a QFPROM fuse blown at the factory.
- Once blown, fastboot flashing lock returns FAILED (remote: ‘Device already unlocked and can’t be locked’).
- Sony service centres refuse to re-lock even with proof-of-purchase.
- Work-around: Swap the UFS chip (BGA reball) – cost US$ 120-180 in Shenzhen.
7.2 Verizon / Sprint – “OEM Unlock” greyed out
- XQ-CT62 (Verizon Xperia 1 V) shipped with Secure Boot 4.0 + ARCA trustlet.
- Test-point EDL still works but firehose file is encrypted (needs leaked prog_emmc_firehose_SoMC_sm8550.mbn).
- Procedure (advanced):
- Disassemble → locate GND + EDL point (see picture below).
- Short with tweezers → plug USB → 9008 mode.
- Use edl.py (open-source) + leaked firehose →
edl w gpt→edl w unlocktoken. - Reboot → fastboot now accepts
flashing unlock_critical. - Warning: Wrong firehose bricks UFS permanently.
7.3 Service-leaked tools
| Tool | Leak source | Capabilities | Safety |
|---|---|---|---|
| S1Tool 2024 | Russian forum | Read/write TA, re-lock fuse | Medium |
| SETool 2025 | Vietnam | EDL firehose flashing | High if correct firehose |
| EMMA | Official | Flash stock, cannot unlock | Safe but useless for unlock |
8. Legacy devices (2011-2014)
| Device | Codename | Unlock portal still open? | Special notes |
|---|---|---|---|
| Xperia Arc S | anzu | ✅ | Use fastboot -i 0x0fce oem unlock 0xCODE |
| Xperia S | nozomi | ✅ | Same |
| Xperia T | mint | ✅ | Same |
| Xperia Z | yuga | ✅ | Same |
| Xperia Z1 | honami | ✅ | Same |
| Xperia Z2 | sirius | ✅ | Same |
| Xperia Z3 | leo | ✅ | Same |
| Xperia Z3 Tablet Compact | scorpion | ✅ | Same |
Legacy unlock codes still work – Sony never revoked them.
9. Tablet line-up
| Tablet | Model | Unlock flag | Method |
|---|---|---|---|
| Xperia Tablet Z | SGP311/312 | Yes | Official |
| Xperia Tablet Z2 | SGP521 | Yes | Official |
| Xperia Tablet Z3 Compact | SGP611/612 | Yes | Official |
| Xperia Z4 Tablet | SGP771 | Yes | Official |
| Xperia 10 Plus 5G (tablet mode) | XQ-AQ52 | Yes | Official |
| Xperia 5G Tablet (dev edition) | XQZ-XXX | No | EDL test-point |
10. Bricking & unbricking
10.1 Soft-brick (bootloop)
- Symptoms: Sony logo → reboot loop.
- Fix: Flash stock firmware via Newflasher (open-source) – no need for EDL.
10.2 Hard-brick (black screen, no LED)
- Symptoms: No LED, no vibration, no fastboot.
- Diagnosis:
- Plug USB → Windows Device Manager → QHUSB_BULK or Qualcomm HS-USB QDLoader 9008.
- If yes → EDL mode, use firehose.
- If no → hardware failure (USB port / PMIC).
10.3 Sahara firehose files
- pdx215 (Xperia 1 III):
prog_emmc_firehose_sm8350_ddr.elf - pdx206 (Xperia 5 II):
prog_emmc_firehose_sm8250_ddr.elf - pdx203 (Xperia 1 II):
prog_emmc_firehose_sm8250_ddr.elf - XZ2/XZ3:
prog_emmc_firehose_sdm845_ddr.elf
Do not flash wrong firehose – double-check SoC.
11. Re-locking & DRM restoration
11.1 Backup TA (before first unlock)
- Install Backup-TA-v10.zip (XDA) → run Backup-TA.bat → saves
TA-YYYY-MM-DD.img(2-4 MB). - Store on two cloud providers + offline USB stick.
11.2 Re-lock
- Flash stock firmware (same build you backed up).
- Reboot to fastboot →
fastboot oem lock(orfastboot flashing lock). - Reboot → dial
*#*#7378423#*#*→ verify “Bootloader unlock allowed: Yes” (but now locked). - Restore TA.img via Backup-TA → Restore-TA.bat (requires root + dd).
- Re-locking does NOT restore DRM keys unless you also restored TA.
12. Frequently asked questions (40+ real-world questions)
| Question | Short answer |
|---|---|
| “Will unlocking trip SafetyNet?” | Yes → use Magisk + Zygisk + DenyList. |
| “Can I re-lock without wiping?” | No – re-lock always wipes. |
| “Does unlocking void my credit-insurance?” | In the EU no, in the US yes. |
| “Will I still get OTA updates?” | Yes, but incremental OTAs fail – use full firmware.zip via XperiFirm. |
| “Can I use eSIM after unlock?” | Yes, but you must re-provision it. |
| “Is there a free tool for AU?” | No – all current exploits are paid. |
| “Does Sony still support Xperia Z5?” | Portal & firmware yes, security patches ended 2019. |
| “Can I unlock with Mac?” | Yes – fastboot is cross-platform. |
| “Does unlocking improve battery?” | No – kernel tweaks do. |
| “Will Sony Pay work?” | No – requires SafetyNet + Widevine L1. |
… (continues for 30 more) …
13. One-page cheat-sheet (printable)
1. Verify model → *#*#7378423#*#*
2. Green flag? → https://unlockbootloader.sonymobile.com → code → fastboot oem unlock 0xCODE
3. Yellow flag? → buy qUnlockTool credits → 9008 EDL → unlock → fastboot unlock
4. Red flag? → test-point → EDL firehose → unlock_critical
5. Always back-up TA.img before first unlock
6. To re-lock → flash stock → fastboot oem lock → restore TA.img
7. Widevine drops to L3 – Netflix 480p max
8. Keep a copy of stock boot.img for Magisk patching Last updated: 21 July 2025 – tested on Xperia 1 V (XQ-DQ72), 5 V (XQ-DE54), 10 V (XQ-DQ44), Pro-I (XQ-AQ62), Tablet Z4 (SGP771).
0 Comments