I recovered by flashing 1.2 cmt only using the method posted in the thread.

then, I used nss pro and change the product code to 160300, this forces the hw code back to normal, then used the old nss to fix the product code.