Database Info

[TOOL] Unlock bootloader in ASUS ZenPad 3S 10 Z500M (P027)

Tool to Unlock Bootloader in ASUS ZenPad 3S 10 Z500M (P027)​
This software essentially unlocks the bootloader in your tablet. I've developed a way to switch a Mediatek bootloader into an unlocked state using root privileges. Luckily, the Z500M does give us temporary root access to run this tool. The result is an "Orange State" boot mode, which disables boot partition verification. As a bonus, this procedure does not erase your data like a typical unlock routine does. It also does not require a PC except to start the temporary rooted image. Note that your tablet will still lack fastboot flashing functionality. But flashing by other means is still possible.
WARNING: Running this tool should be pretty safe. But I don't encourage anyone to try this. Before trying this out, consider the risks and drawbacks involved. By unlocking, you are essentially giving up the security of your device. It's also possible that a future firmware update will relock the bootloader or become incompatible with this tool.
This software is only for ASUS model Z500M/P027. Do not try it on any other device. It will not work. Support for other Mediatek devices may be added in the future. (That's why this is posted in the general forum rather than the ZenPad 10 one.)
And by the way, I don't own this tablet.
DISCLAIMER
This software is for educational purposes only. Anything you do that is described in this post is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software.
REQUIREMENTS
A ZenPad Z500M tablet upgraded to Android N
A rooted/patched boot image such as one made by Magisk Manager (method 1)
Temporary root with Magisk or other superuser manager installed (method 1)
TWRP image (method 2)
Knowledge of adb/fastboot and of basic Linux command shell
INSTRUCTIONS
Method 1
Read all of these instructions and make sure you understand them before starting
If you don't have an offline patched boot image, use Magisk Manager to make one from the stock boot.img of your current firmware. Transfer it to your PC.
Reboot your tablet into fastboot mode--either hold vol. down + power to power up, and select Fastboot. Or run 'adb reboot bootloader' while in Android.
Connect your tablet to a PC and run fastboot boot patched_boot.img to start the rooted image in tethered mode
Download the tool zip file to your tablet.
Extract the zip to your /data/local/tmp folder.
Open a root shell with adb shell, then run 'su'
Change your shell current directory to that folder (cd /data/local/tmp)
Run this command to unlock or lock the bootloader
Code:
sh unlockbl.sh
Follow the instructions on the screen and type the requested confirmation into the prompt.
Check for completion or any error messages. Report them here.
If no errors, you are unlocked and may modify your boot partition (e.g. install root).
Method 2
Read all of these instructions and make sure you understand them before starting
If you don't have TWRP for your tablet, download the latest image to your PC from this thread.
Download the tool zip file to your tablet.
Extract the zip to your /data/local/tmp folder. (For this method, most other folders should work as well due to permissive selinux mode)
Reboot your tablet into fastboot mode--either hold vol. down + power to start up and select Fastboot, or run 'adb reboot bootloader' from Android
Connect your tablet to a PC and run fastboot boot twrp-*.img to start TWRP in tethered mode
At the TWRP welcome screen, do not select to modify the system partition and touch Keep System Read-only instead. Doing otherwise will render your tablet unbootable.
Mount system in TWRP in read-only mode. Mounting in read/write mode will render your tablet unbootable.
Open a shell with adb shell on your PC or open TWRP's built-in terminal
Change your shell current directory to the folder that you extracted the tool zip into (cd /data/local/tmp)
Run this command to unlock or lock the bootloader
Code:
sh unlockbl.sh
Follow the instructions on the screen and type the requested confirmation into the prompt.
Check for completion or any error messages. Report them here.
If no errors, you are unlocked and may modify your boot partition (e.g. install root).
DOWNLOAD
Current Version
Unlock Tool v0.6a
Changelog
v0.6a
Actually improve compatibility with TWRP
v0.6
Handle units with blank bootloader configs
Improve compatibility with TWRP
Improve text wrapping for TWRP's terminal
v0.5
Major overhaul to remove the need for kernel module
v0.2
Made compatible with other FW versions
v0.1
First release
CREDITS
@amartolos for being a kick-ass tester
If anyone wants to develop a full Android app around this script, be my guest.
Also, that Thanks button will not click itself...

reversed :silly:

I got this after typing "Yes, I want to unlock"
Extracting binaries
Inserting kernel module
Testing kernel module
Oops! Something went wrong. Aborting
Your system has not been modified
Exit code 126
Click to expand...
Click to collapse
When running script with terminal on tablet I got exit code 1 on the same stage.

Joh14vers6 said:
I got this after typing "Yes, I want to unlock"
When running script with terminal on tablet I got exit code 1 on the same stage.
Click to expand...
Click to collapse
Were you running a basic boot image or did you boot the patched boot image?

amartolos said:
Were you running a basic boot image or did you boot the patched boot image?
Click to expand...
Click to collapse
I booted from the patched boot image. Latest FW. Script will not run without (temp)root.

I haven't been able to get magisk to make a patched boot.img
Any help appreciated.

Can we use the patched boot image you posted from the other thread? "Z500M_signed_patched_boot.tar"? https://forum.xda-developers.com/showpost.php?p=74303280&postcount=72

2. Install Magisk Manager and create an offline patched boot image from the stock boot.img if you don't have one.
Apologies. I have Magisk installed on my Nexus 6 but I would not consider myself an expert. With that device I installed the Magisk zip file in TWRP recovery and then installed Magisk Manager. After installation of Magisk Manager on the Z500M and launching the app it asks if I want to install the Magisk 15.2 zip. Should that be done?
At this time I haven't done this and I don't see any method for creating the patched boot image. Can someone direct me via a link or explanation on how to do this?

There's another thread that contains this info: Click Here

ExtremeRyno said:
Can we use the patched boot image you posted from the other thread? "Z500M_signed_patched_boot.tar"? https://forum.xda-developers.com/showpost.php?p=74303280&postcount=72
Click to expand...
Click to collapse
Yes
Sent from my P01MA using Tapatalk

Joh14vers6 said:
I got this after typing "Yes, I want to unlock"
Extracting binaries
Inserting kernel module
Testing kernel module
Oops! Something went wrong. Aborting
Your system has not been modified
Exit code 126
Click to expand...
Click to collapse
When running script with terminal on tablet I got exit code 1 on the same stage.
Click to expand...
Click to collapse
Hmm, that sounds like a permissions problem. Before running the script, can you turn off Selinux enforcement somehow? Try running 'setenforce 0' or maybe there's a setting in Magisk that controls this. Bear with me, I'm trying to get to the bottom of this...
Has anyone besides amartolos gotten this to work yet?

I ran the tool successfully and it said to reboot and Root. While rebooting it says:
Orange State
Your device has been unlocked and can't be trusted
Your device will reboot in 5 seconds
Then I can't get a root to take.
Edit: I found the problem. After you run the script, run magisk to root before you reboot, while you are still in temp root status.
Sent from my P01MA using Tapatalk

loner. said:
I ran the tool successfully and it said to reboot and Root. While rebooting it says:
Orange State
Your device has been unlocked and can't be trusted
Your device will reboot in 5 seconds
Then I can't get a root to take.
Click to expand...
Click to collapse
Yep, you got it! In order to have persistent root, you actually have to install it to your boot partition while booted up with temporary root.

loner. said:
Edit: I found the problem. After you run the script, run magisk to root before you reboot, while you are still in temp root status.
Click to expand...
Click to collapse
Word

diplomatic said:
I got this after typing "Yes, I want to unlock"
Hmm, that sounds like a permissions problem. Before running the script, can you turn off Selinux enforcement somehow? Try running 'setenforce 0' or maybe there's a setting in Magisk that controls this. Bear with me, I'm trying to get to the bottom of this...
Has anyone besides amartolos gotten this to work yet?
Click to expand...
Click to collapse
I tried SELinuxModeChanger to set Selinux to permisive and tried setenforce 0 and both give same exit code 1 from the terminal.

Joh14vers6 said:
I tried SELinuxModeChanger to set Selinux to permisive and tried setenforce 0 and both give same exit code 1 from the terminal.
Click to expand...
Click to collapse
What firmware version do you have installed? And are you running this from the /data/local/tmp directory?

diplomatic said:
What firmware version do you have installed?
Click to expand...
Click to collapse
FW WW_14.0210.1709.30 from 04 jan 2018 and yes, I ran from that folder.

Joh14vers6 said:
FW WW_14.0210.1709.30 from 04 jan 2018 and yes, I ran from that folder.
Click to expand...
Click to collapse
Last two numbers should be .27
I checked and yes there is a update, but I don't think I can install it. Since I and already rooted. The size of the update seems to be a security update.
---------- Post added at 05:16 PM ---------- Previous post was at 05:11 PM ----------
Has anyone who successfully rooted this device able to do the update after?

I'm glad to see that Asus is releasing security updates even if it does break the unlock. My biggest fear buying this tablet was that it would not be updated. I opted for the update and will hope for an updated patch from @diplomatic.
As an aside. I would encourage anyone in this thread to give hit the "Thanks" button for diplomatic!
EDIT: I just checked and see my last update brought me to WW_14.0210.1711.30_20171206. That's different than the 1/4/2018 update showing on the website which is WW_14.0210.1709.30 and what @Joh14vers6 shows.

Joh14vers6 said:
FW WW_14.0210.1709.30 from 04 jan 2018 and yes, I ran from that folder.
Click to expand...
Click to collapse
OK everyone, this is important... I found an incompatibility between the new FW's kernel and the tool. You have to use the patched boot image from FW 1709.27 for temporary root... In the meantime, I have to fix it to be able to run under the new FW. But it won't be compatible with the old. And I hope it still unlocks...

TWRP + Root for Vankyo Z1 (Android Go Edition)?

Has anybody heard of the Vankyo Z1 MatrixPad? It's a cheap generic tablet with Android Go Edition 8.1. I think the bootloader is unlocked (fastboot oem unlock gave "Okay" as a result but oem device-info and other commands aren't recognized). I don't mind bricking it if it comes to it, but is there a generic TWRP or can I just get Magisk on this thing?

SilverZero said:
Has anybody heard of the Vankyo Z1 MatrixPad? It's a cheap generic tablet with Android Go Edition 8.1. I think the bootloader is unlocked (fastboot oem unlock gave "Okay" as a result but oem device-info and other commands aren't recognized). I don't mind bricking it if it comes to it, but is there a generic TWRP or can I just get Magisk on this thing?
Click to expand...
Click to collapse
I'm currently trying to root it however nothings working including all the ADB and flashboot commands, OEM unlocking ect

Because your Android is version 8.1 to get the superuser access to be able to control various aspects of Android OS means you need to perform a certain modification that will root your tablet's Android.
Here is what you have to do to root your device's Android: Replace Android's Toybox binary - what is a restricted version by default - by unrestricted Toybox v0.8.5. This can get achieved by means of ADB.
Toybox v0.8.5 is available here:
Index of /toybox/bin

jwoegerbauer said:
Because your Android is version 8.1 to get the superuser access to be able to control various aspects of Android OS means you need to perform a certain modification that will root your tablet's Android.
Here is what you have to do to root your device's Android: Replace Android's Toybox binary - what is a restricted version by default - by unrestricted Toybox v0.8.5. This can get achieved by means of ADB.
Toybox v0.8.5 is available here:
Index of /toybox/bin
Click to expand...
Click to collapse
its upgraded to android 10 go

how did you update it

Moto g play nethunter

I'm trying to root my Moto g play and I was able to unlock the bootloader but I can't get past that any help would be awesome I'm trying to flash nethunter as well

AFAIK the phone is running Android 10, hence it comes by default with TOYBOX ( no root ) installed. All you have to do is to flash TOYBOX v0.8.5 what comes with SU ( read: root ).

How do I flash toybox?
jwoegerbauer said:
AFAIK the phone is running Android 10, hence it comes by default with TOYBOX ( no root ) installed. All you have to do is to flash TOYBOX v0.8.5 what comes with SU ( read: root )
Click to expand...
Click to collapse

If you have a Custom Recovery installed, then you
1. create a flashable TOYBOX-UPDATE.ZIP what contains all the necessary files incl. updater-script
2. flash this ZIP via the Custom Recovery
otherwise, if you can successfully establish an ADB connection, you
1. create a Windows CMD file that contains all the necessary commands
2. connect computer with phone
2. run the Windows CMD file

How to root android device with factory disabled fastboot

Howdy! I got a gionee a1 lite device recently and I cannot manually reboot the phone to bootloader through recovery mode or fastboot via adb pc tools. Someone here enlightened me that the device's fastboot is disabled which is a bummer.
I'm aware now that some manufacturers disable their devices' bootloaders for reasons unknown. Has anyone been able to root a device with a disabled fastboot? Please help me out.

Trunks614 said:
Howdy! I got a gionee a1 lite device recently and I cannot manually reboot the phone to bootloader through recovery mode or fastboot via adb pc tools. Someone here enlightened me that the device's fastboot is disabled which is a bummer.
I'm aware now that some manufacturers disable their devices' bootloaders for reasons unknown. Has anyone been able to root a device with a disabled fastboot? Please help me out.
Click to expand...
Click to collapse
Methods that involve flashing the device won't do you any good. You'll have to try methods that involve using an app to root the device for you, which have not been useful to root android since android Lollipop/Marshmallow was released.

Droidriven said:
Methods that involve flashing the device won't do you any good. You'll have to try methods that involve using an app to root the device for you, which have not been useful to root android since android Lollipop/Marshmallow was released.
Click to expand...
Click to collapse
Is there possibly any app or other method that doesn't involve unlocking bootloader to root android nougat? Kingroot and kingoroot have been ineffective so far.

It's a misconception to think that device's bootloader must get unlocked before device's Android can get rooted.
Rooting Android simply means a suitable SU binary - by whatever method - gets installed. IMO the easiest method to do this is by means of ADB.

jwoegerbauer said:
It's a misconception to think that device's bootloader must get unlocked before device's Android can get rooted.
Rooting Android simply means a suitable SU binary - by whatever method - gets installed. IMO the easiest method to do this is by means of ADB.
Click to expand...
Click to collapse
I have a ported twrp ready to flash but I'm hesitant because I heard flashing a recovery while bootloader is locked could bork the device. Flashing twrp seems to be the only step now to root the phone, should I give it a try or avoid the risk?

My POV: TWRP isn't needed at all to root a device's Android.

jwoegerbauer said:
My POV: TWRP isn't needed at all to root a device's Android.
Click to expand...
Click to collapse
I needed the twrp to flash magisk. Is there some other method to root an android 7 device that doesn't involve twrp or unlocking bootloader?

I already told you a method: no more to say by me ...

jwoegerbauer said:
I told a method: no more to say by me ...
Click to expand...
Click to collapse
Please put me through or post the link to the method.

1. Download latest version of SuperSU.zip onto PC
2. Install ADB on PC ( systemwide accessible !!! ) if not already done yet
3. On phone enable USB debugging, if not already done yet, and reboot phone
4. Connect phone with PC via USB cable that came with phone
5. Run a Windows command script ( .BAT-file ) that contains these lines
Code:
@echo off
adb devices
adb reboot recovery
timeout /t 10 /nobreak >nul
echo In Recovery menu shown on device select "Update from ADB" and apply
echo Press any key when done ...
pause >nul
adb sideload <PATH-TO-SUPERSU.ZIP-FILE-ON-PC-HERE>
adb reboot

jwoegerbauer said:
My POV: TWRP isn't needed at all to root a device's Android.
Click to expand...
Click to collapse
My POV: it isn't exactly as simple as connect to adb and issue a few commands, that is just a fact. I'm speaking from experience, just isn't that simple in all cases. If you can get the device to accept temp root via adb, then, yes, it "can" be that simple, the problem is, temp root via adb isn't an option on ALL android devices.

jwoegerbauer said:
1. Download latest version of SuperSU.zip onto PC
2. Install ADB on PC ( systemwide accessible !!! ) if not already done yet
3. On phone enable USB debugging, if not already done yet, and reboot phone
4. Connect phone with PC via USB cable that came with phone
5. Run a Windows command script ( .BAT-file ) that contains these lines
Code:
@echo off
adb devices
adb reboot recovery
timeout /t 10 /nobreak >nul
echo In Recovery menu shown on device select "Update from ADB" and apply
echo Press any key when done ...
pause >nul
adb sideload <PATH-TO-SUPERSU.ZIP-FILE-ON-PC-HERE>
adb reboot
Click to expand...
Click to collapse
Thank you. I tried this, unfortunately I got a "device not found" error even though "adb devices" did.

Droidriven said:
My POV: it isn't exactly as simple as connect to adb and issue a few commands, that is just a fact. I'm speaking from experience, just isn't that simple in all cases. If you can get the device to accept temp root via adb, then, yes, it "can" be that simple, the problem is, temp root via adb isn't an option on ALL android devices.
Click to expand...
Click to collapse
I'm really confused ...
With no line in this thread it was mentioned / suggested / recommended to install a temporary root.
I kindly ask you to stop hopping into a thread and post off-topic content. TIA

@Trunks614
When ADB triggers "no devices found" then it's mostly caused by wrong ADB-driver used.

jwoegerbauer said:
@Trunks614
When ADB triggers "no devices found" then it's mostly caused by wrong ADB-driver used.
Click to expand...
Click to collapse
Will "apply update from SD card" work the same way?

jwoegerbauer said:
1. Download latest version of SuperSU.zip onto PC
2. Install ADB on PC ( systemwide accessible !!! ) if not already done yet
3. On phone enable USB debugging, if not already done yet, and reboot phone
4. Connect phone with PC via USB cable that came with phone
5. Run a Windows command script ( .BAT-file ) that contains these lines
Code:
@echo off
adb devices
adb reboot recovery
timeout /t 10 /nobreak >nul
echo In Recovery menu shown on device select "Update from ADB" and apply
echo Press any key when done ...
pause >nul
adb sideload <PATH-TO-SUPERSU.ZIP-FILE-ON-PC-HERE>
adb reboot
Click to expand...
Click to collapse
SuperSU is a deprecated project, that is why and how Magisk came to prominence. Anyone still using SuperSU is taking a real chance of compromising the security of their device at the system level. If SuperSU is used to gain root, it is highly recommended to convert to Magisk root after gaining root via SuperSU.

i have the same problem, zte A5 2019 fastboot disabled, by the way you can try mtk easy-su

Unlocking Bootloader Facetel Q3pro

Hi
I have a Facetel q3pro android 10 tablet. I recently replaced the screen which inverted the x axis on the screen. I can't find any way to change the axis back so I want to root and try and fix myself. The problem is once I get into fastboot to unlock the bootloader the commands fail. Both oem unlock and flashing unlock. Am I missing something or is there another command or is the bootloader just not unlockable? If so is there a way to get around this bootloader issue?

To root a device's Android it's NOT required that device's bootloader gets unlocked before.

xXx yYy said:
To root a device's Android it's NOT required that device's bootloader gets unlocked before.
Click to expand...
Click to collapse
O really, is there a guide to do that? Or would i need a stock rom cuz im not able to find on of those?
Thanks for the reply

All what's needed is to extend the scope of existing Android OS functions by su - read: switch user - command, what by default is left off for security reasons.
This can get achieved by means of ADB.

xXx yYy said:
All what's needed is to extend the scope of existing Android OS functions by su - read: switch user - command, what by default is left off for security reasons.
This can get achieved by means of ADB.
Click to expand...
Click to collapse
So I've been trying to research what you're saying but not having much luck I've found a few commands such as going to shell then typing su, but says inaccessible or not found. I can pull user lists, and see commands for users but nothing about switching to su. I think I found the issue to solve my axis issue but it requires access to config.txt which is denied without root I believe. Sorry I'm not the most advanced these shell/adb commands

People who carefully read posts are certainly in advantage.