# xperia-firmware-toolkit: Xperia Companion and firmware-delivery findings

> xperia-firmware-toolkit documents how Xperia Companion stores and downloads Sony Xperia firmware. Its investigation covers the app's Java/OSGi bundles, the ESS API request sequence and the SIN boot-image layout. PowerShell scripts capture firmware downloaded by Companion, and a separate guide covers Xperia 1 IV rooting and data migration.

- Type: Case study
- Targets: App · Firmware · Protocol
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-08
- Original resource: <https://github.com/nsozturk/xperia-firmware-toolkit>
- Primary source: <https://github.com/nsozturk/xperia-firmware-toolkit/blob/f187460923d9ad6281d52036b503033df72c99eb/docs/xperia-companion-reverse-engineering.md>
- Catalog page: <https://awesomerea.org/resources/xperia-firmware-toolkit-case/>
- Record JSON: <https://awesomerea.org/resources/xperia-firmware-toolkit-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/xperia-firmware-toolkit-case/index.md)

## Requirements & limits

- **Prerequisites:** The documented Windows scripts use PowerShell on Windows 10 or 11; firmware capture requires Xperia Companion, while device migration and rooting steps use Android platform-tools.
- **Scope:** The rooting workflow targets Xperia 1 IV XQ-CT72 / PDX223 and requires bootloader unlocking, which wipes the device and revokes DRM keys.
- **License:** MIT license.

## Primary sources

1. <https://github.com/nsozturk/xperia-firmware-toolkit/blob/f187460923d9ad6281d52036b503033df72c99eb/docs/xperia-companion-reverse-engineering.md>
2. <https://github.com/nsozturk/xperia-firmware-toolkit/blob/f187460923d9ad6281d52036b503033df72c99eb/README.md>
3. <https://github.com/nsozturk/xperia-firmware-toolkit/blob/f187460923d9ad6281d52036b503033df72c99eb/RELEASE_NOTES.md>

## More in Apps

- [FABA on Linux: reconstructing the speaker's song format](https://awesomerea.org/resources/faba-tools-case/index.md) · Case study
- [Voicemeeter: mapping the Audio Callback API](https://awesomerea.org/resources/voicemeeter-audio-callback-case/index.md) · Case study
- [Lidl Plus: mapping Lidl Pay API requests](https://awesomerea.org/resources/lidl-plus-pay-api-case/index.md) · Case study
- [open-cardi: reconstructing Cardi lighting control over BLE](https://awesomerea.org/resources/open-cardi-case/index.md) · Case study
- [Pool Comfort / Galaxywind: a local heat-pump client from Android and UDP analysis](https://awesomerea.org/resources/poolcomfort-galaxywind-case/index.md) · Case study
- [Mondeer Bluetooth scale: reconstructing BLE weighing and binding](https://awesomerea.org/resources/mondeer-bluetooth-scale-ha-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.