---
name: xperia-firmware-upgrade
description: Upgrade Sony Xperia 1 VI (XQ-EC72) firmware with newflasher without wiping data, keeping Magisk root. Use when asked to flash, upgrade, or update Xperia firmware downloaded with XperiFirm.
---

# Xperia firmware upgrade (keep data + Magisk root)

Device: Sony Xperia 1 VI, model XQ-EC72, region `Customized SEA`.
Firmware lives in `/home/grmrgecko/Downloads/XperiFirm 5.8.1 (by Igor Eisberg)/` in folders named `XQ-EC72_Customized_SEA_<version>`.
Tools: `~/bin/newflasher` (v57), `~/bin/unsin`, `fastboot`.

## 1. Download firmware

XperiFirm (Windows .exe in the folder above, runs under Wine/mono) downloads the
firmware into a new `XQ-EC72_Customized_SEA_<version>` folder. Never downgrade —
the bootloader enforces anti-rollback (see `securitypatchlevel.dat`).

## 2. Patch init_boot with Magisk

Inside the new firmware folder:

```sh
mkdir init_boot_X-FLASH-ALL-88DF
cd init_boot_X-FLASH-ALL-88DF
unsin ../init_boot_X-FLASH-ALL-88DF.sin   # produces init_boot.img
```

Copy `init_boot.img` to the phone, patch it in the Magisk app
("Install" → "Select and Patch a File"), and copy the resulting
`magisk_patched-<ver>_<rand>.img` back into this same directory.

## 3. Prepare the flash copy

newflasher flashes every `.sin`/`.ta` in its working directory, so work on a
copy with the dangerous bits removed. From the XperiFirm folder:

```sh
cp -r --reflink=auto "XQ-EC72_Customized_SEA_<version>" "XQ-EC72_Customized_SEA_<version> copy"
cd "XQ-EC72_Customized_SEA_<version> copy"
rm persist_X-FLASH-ALL-88DF.sin
cp -r "../XQ-EC72_Customized_SEA_<previous-version> copy/tadump" .
```

- **Remove `persist_X-FLASH-ALL-88DF.sin`** — persist holds per-device
  calibration/DRM data; flashing it overwrites yours. This is the only file
  removed.
- **`userdata_X-FLASH-ALL-88DF.sin` stays.** Data is preserved by answering
  the "keep userdata?" prompt, not by deleting the file.
- **Carry the `tadump/` folder forward** from the previous version's copy. It
  accumulates trim-area dumps (`tadump_N.ta`, numbered upward) — hard-brick
  insurance. newflasher appends a new dump to it each flash.

Verify the prep by diffing against the previous prepared copy: the only
differences from a fresh download should be `persist*.sin` gone, the
`init_boot_X-FLASH-ALL-88DF/` workspace dir, and `tadump/`.

## 4. Flash with newflasher

Power the phone off, then hold **Volume-Down** while plugging in USB —
**green LED** = flashmode (`lsusb` shows a `0fce:` Sony device).

```sh
cd "XQ-EC72_Customized_SEA_<version> copy"
~/bin/newflasher
```

Prompt answers, in order:

| Prompt | Answer |
|---|---|
| "…if you understand the risk" | `y` |
| "dump trim area" (optional) | `y` — saves into `tadump/` |
| "Do you want to keep userdata?" | **`y`** — this is the no-wipe step |
| "Reboot mode at the end of flashing" | `f` — go straight to fastboot for re-rooting |

Non-interactive equivalent: `printf 'y\ny\ny\nf\n' | ~/bin/newflasher`

## 5. Re-flash Magisk root

The flash wrote the stock init_boot, so root must be restored. With the phone
in fastboot (blue LED — it's already there if you answered `f`; otherwise hold
**Volume-Up** while plugging in USB from power-off):

```sh
fastboot flash init_boot init_boot_X-FLASH-ALL-88DF/magisk_patched-*.img
fastboot reboot
```

First boot after an upgrade takes a while. Open Magisk afterward to confirm
root survived.

## 6. Re-enable US 5G (SEA firmware in the US)

Flashing includes `modemst1`/`modemst2` `.sin` files, which reset the modem
EFS — any modem-side band/5G configuration is lost on every upgrade and must
be redone.

- Old quick trick (worked through 69.2.A.4.16): dial `*#*#4636#*#*` → Phone
  Information → toggle "Enable DSDS" off, re-enable, reboot (some users must
  leave DSDS off). May only force the 5G icon rather than real NR.
- Current method: replace three RF-band policy files in the modem EFS
  `/policyman` folder with the versions from XDA thread 4753150 ("Enable 5G &
  Global RF Bands on Xperia", by htcmage) — `band_set_01.xml`,
  `plmn_mcc_supported_01.xml`, `policies.xml` (adds T-Mobile / Verizon / AT&T /
  Dish LTE+NR bands). The guide uses Windows QPST EFS Explorer; the Linux path
  below is what actually worked here and needs no Windows.

  **Working Linux / adb procedure (done 2026-08-27, verified):**
  1. Download the 3 attachments from the thread (Chrome navigates directly to
     each `xdaforums.com/attachments/...` URL — script-triggered downloads are
     blocked; a real navigation downloads fine). Validate each is well-formed
     XML with root `<policy>` / `<policy_list>` and `schema_ver="1"` matching
     the device's existing files.
  2. Open the Qualcomm diag port: `adb shell su -c
     'setprop sys.usb.config diag,serial_cdev,rmnet,adb'`. Phone re-enumerates
     as USB `05c6:9091` (adb survives). Bind the serial driver (needs root on
     the PC): `sudo modprobe option && echo 05c6 9091 | sudo tee
     /sys/bus/usb-serial/drivers/option1/new_id`. Diag port = `/dev/ttyUSB0`
     (the one that answers a DIAG version request; ttyUSB1 is silent).
  3. Talk EFS2 over DIAG. EfsTools (JohnBel) is the usual tool but its
     libnserial hits EIO on the option-driver port; the reliable path was a
     small pyserial EFS2 client (HDLC + FCS-16, subsys 0x4B/EFS 19). Scripts
     kept at `~/.../scratchpad/efs2.py` (+ `diag_probe.py`). It does:
     hello → list `/policyman` → **back up** the 3 files → write new ones
     (unlink then open `O_WRONLY|O_CREAT` perm 0777, 1 KB write chunks) →
     read back and byte-compare to verify.
  4. `adb reboot`. Reboot clears diag mode back to normal adb.
  5. Verify: `dumpsys telephony.registry | grep isNrAvailable` → `true`
     (stock SEA firmware shows false); `settings get global
     preferred_network_mode` should be an NR mode (26 = NR_LTE_GSM_WCDMA).

  Backups of the device's original `/policyman` files:
  `~/.../scratchpad/policyman_backup/`. Invalid XML can stop the modem from
  booting — restore by writing the backups back, or reflash the modem `.sin`
  files with newflasher.
- Hardware limit: band n71 does not work on the 1 VI; T-Mobile users see
  LTE 2/12/66 and NR n41; n66 confirmed on Verizon.

## 7. Cleanup

Keep both the original and the " copy" folder for at least one more upgrade —
the copy is the reference for preparing the next version, and `tadump/` is
carried forward from it. Older versions than the previous one can be deleted.