NEW: Install official Global ROM on Chinese TB132FU running ZUI 14 or Fake globalDISCLAMER: Flashing on TB132FU is pretty much safe and a hard brick has not occured yet, but do it at your own risk. If anything goes wrong you can return to ZUI 14 using one of the restoration methods listed on the FAQ thread. ALL YOUR FILES WILL BE DELETED. Make a backup of your personal files before proceeding.
Did my work help you? Be free to buy me a coffee. PayPal me at @alsbvg
Current version: TB132FU_S000094_221117_ROW
To see what works and what doesn't check below.
To flash this version you will need:
1 - A computer running Windows
2 - Flashtool (attached to the thread)
3 - ADB drivers or UsbDk drives & MTK drivers
4 - ZUI 14 installed on your TB132FU. If you have fake global you can flash as well, but having ZUI is recommended.
5 - Firmware file
6 - Attention to the really detailed tutorial below.
How to flash
Preparation:
1 - Download and install the drivers provided above. If you already have them installed skip this step.
2 - On your computer create a folder on your Desktop. Name it LENOVO.
3 - Download the firmware file (download link provided above) and un-zip it inside the LENOVO folder on your desktop. So inside your LENOVO folder now you should have a folder called TB132FU_S000094 Global.
4 - Download the attached flash tool and un-zip it inside the LENOVO folder on your desktop. Now you have a folder called TB132FU_S000094 Global and a folder called MTK_Flashtool.
5 - Power off your TB132FU and disconnect it from your computer in case you have it connected.
Flashing:
1 - Go to the LENOVO folder, and open the folder MTK-Flashtool. Inside this folder find flash_tool and double-click to open it.
2 - Once it opens click the TAB download. Do not click the green arrow.
3 - For the Download agent click Choose. Navigate to your Desktop > Lenovo > MT_Flashtool and select the file MTK_AllInOne_DA_onyx_signed
4- For Scatter-loading file click Choose. Navigate to your Desktop > Lenovo > TB132FU_S000094 Global and select MT6893_Android_scatter.txt. You will see two files with the same name. Click the one with the paper with lines icon. Wait for it to load.
5 - For Authentication File click Choose. Navigate to your Desktop > Lenovo > MT_Flashtool and select the file auth_sv5
6 - You will see white and green lines below. Scroll down and find the line that starts with lk_a and UNMARK it. All the other options should be marked, only lk_a should be unmarked.
Ex:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
7 - Click the green arrow DOWNLOAD and plug in your tablet. Wait until it completes flashing the firmware.
And done. Once it is finished you can unplug your tablet and turn it on. You now should be running the latest global rom on your TB132FU;
What works:
Google Sync
HDR with true black
Productivity mode (PC mode)
And almost everything else. I'm still testing it.
What doesn't work:
OTA - once a new update is available it will be needed to be flashed manually losing all data. OTA did not work on a previous version.
Ultra-fast charging. It has Rapid charge but not the super fast charging available on ZUI
Some users reported L1 when flashing this global.
For users who lost L1 status, no solution to get it back from L3 yet. :/
"Scroll to the left" on the home screen to access the media center will not turn off even if you try manually setting it as off.
Time-zone issue: Factory reset it after the first boot to get it fixed.
You tell me what else is not working.
Thanks for the detailed explanation.
Some cuestions that you may have an answer for:
1. Has the bootloader to be unlock? What happens if I have the bootloader lock? (I lock mine with zui 14 in order to get L1)
2. Is there a way to change region code like in others lenovo models? Will it have any impact on OTAs?
3. Can you rollback to zui 14?
Thanks in advance. I think that will be able to have a full working rom with OTAs and L1 eventually. This is a huge step forward
als_bvg said:
What doesn't work:
Ultra fast charging. It has Rapidy charge but not the super fast charging available on ZUI
Click to expand...
Click to collapse
Out of curiosity, does the Chinese model have an Ultra fast charging?
My Global P11 Pro gen 2 does Rapid charge and my cable display caps out at 10w which I wouldn't say is rapid...
Same cable and charger gives me much faster speeds on my Galaxy S22U.
Pawnty said:
Out of curiosity, does the Chinese model have an Ultra fast charging?
My Global P11 Pro gen 2 does Rapid charge and my cable display caps out at 10w which I wouldn't say is rapid...
Same cable and charger gives me much faster speeds on my Galaxy S22U.
Click to expand...
Click to collapse
It does. The Chinese running ZUI has Ultra-fast charging with the original cable and charger.
tylerdanarg said:
Thanks for the detailed explanation.
Some cuestions that you may have an answer for:
1. Has the bootloader to be unlock? What happens if I have the bootloader lock? (I lock mine with zui 14 in order to get L1)
2. Is there a way to change region code like in others lenovo models? Will it have any impact on OTAs?
3. Can you rollback to zui 14?
Thanks in advance. I think that will be able to have a full working rom with OTAs and L1 eventually. This is a huge step forward
Click to expand...
Click to collapse
1 - You don't need the bootloader to be unlocked to flash this global version. I had Zui 14 with a locked bootloader and OEM locked, and the flashing worked. The OEM toggle will not be available once you use this version. It says you need to connect to the internet or contact your carrier.
2 - No way to change the region code so far. OTA will not work as described. It was tested on an older version. It will download and try to install but will fail. This is the latest rom so no OTA updates so far, we will have to wait to see if it will be the same.
3 - Yes, you can roll back to Zui 14. I did that quite a few times during my tests. Bricked the device more than 20 times and was always able to roll back to ZUI.
Thank you so much!
Generating User Accounts is working too? Wanted to use the tablet for the family, but ZUI doesn't offer accounts and Google Family doesn't work.
Hi. Thank you very much for the excellent work! Testing, so far so good. Do I have an L1 or am I misunderstanding something? Screenshot attached.
Thanks for the great work you do.
We have successfully implemented the global implementation.
My tablet is formatted with the SP Flash Tool. The serial number was lost at that time. (When I looked in the settings, the serial number was 0123456789ABCDEF.)
The serial number itself was recovered by rewriting the proinfo.bin. I think this formatting probably caused the Widevine-related settings to disappear and become L3.
I ask other L3 users, did you format with SP Flash Tool or python?
Flash mine today from ZUI 14 with bootloader lock, L1 and Google Play Certified to Global ROM and I kept L1, Google Certified Device and everything Is working. Even fast charging.
Thanks a lot! Let's see what happens when an OTA Will be available.
Hanswurstistda said:
Thank you so much!
Generating User Accounts is working too? Wanted to use the tablet for the family, but ZUI doesn't offer accounts and Google Family doesn't work.
Click to expand...
Click to collapse
I bought it for my daughter to use and have Family link for her Google Account and its all kinds of wonky (it shows my daughters account under Accounts then it vanishes. the only way I can add it back in is by signing into the Play store but then after an hour or so it goes. Works fine with my google account. Damn Family Link!)
(its on 14.0.413, and has an update pending for 14.0.640 ST). Not a clue how to check if its a modified ROM or what, but was going to try the above and see how it gets on.
Just to clarify fast charging Is shown on the screen but I don't if it's 10w ir 30w. I Will do some measures today and keep you posted
tylerdanarg said:
Just to clarify fast charging Is shown on the screen but I don't if it's 10w ir 30w. I Will do some measures today and keep you posted
Click to expand...
Click to collapse
Try the AccuBattery app, it may not be accurate, but it shows the charging current. I don't want to charge it yet. I will first discharge it and then install this app and start charging. It's convenient because it shows time to charge up to 100%.
daybreak7456 said:
Thanks for the great work you do.
We have successfully implemented the global implementation.
My tablet is formatted with the SP Flash Tool. The serial number was lost at that time. (When I looked in the settings, the serial number was 0123456789ABCDEF.)
The serial number itself was recovered by rewriting the proinfo.bin. I think this formatting probably caused the Widevine-related settings to disappear and become L3.
I ask other L3 users, did you format with SP Flash Tool or python?
Click to expand...
Click to collapse
Thanks for your input. I formated it before using the option "format + download" and serial number is now 012345678ABCDEF. I can try doing what you did with the file proinfo.bin. Any specific tutorial you used?
GeesRiK said:
I bought it for my daughter to use and have Family link for her Google Account and its all kinds of wonky (it shows my daughters account under Accounts then it vanishes. the only way I can add it back in is by signing into the Play store but then after an hour or so it goes. Works fine with my google account. Damn Family Link!)
(its on 14.0.413, and has an update pending for 14.0.640 ST). Not a clue how to check if its a modified ROM or what, but was going to try the above and see how it gets on.
Click to expand...
Click to collapse
Go to your settings menu. If you see the word ZUI anywhere, it's the Chinese model and you can flash the global if you want.
als_bvg said:
Go to your settings menu. If you see the word ZUI anywhere, it's the Chinese model and you can flash the global if you want.
Click to expand...
Click to collapse
Thanks! Yep, I have ZUI! I think its the family link attached to my daughters Google account that makes it annoying, but can't see any down sides in going to the Global to be honest. Can't get any worse... can it?!
GeesRiK said:
Thanks! Yep, I have ZUI! I think its the family link attached to my daughters Google account that makes it annoying, but can't see any down sides in going to the Global to be honest. Can't get any worse... can it?!
Click to expand...
Click to collapse
It shouldn't get any worse lol, but if your daughter is a kid you might benefit of a global rom, it has Kids space and the possibility of creating multiple users.
Awesome! Big thanks.
als_bvg said:
Thanks for your input. I formated it before using the option "format + download" and serial number is now 012345678ABCDEF. I can try doing what you did with the file proinfo.bin. Any specific tutorial you used?
Click to expand...
Click to collapse
What I did.
Install Python and mtkclient on a windows 10 computer.
python mtk rl --skip userdata "Destination path"
Backup everything but the user data with the above command
Open the backed up proinfo.bin with HxD and rewrite the serial number at the beginning.
python mtk wl "Destination path"
Flash the rewritten proinfo.bin with the above command.
GitHub - bkerler/mtkclient: MTK reverse engineering and flash tool
MTK reverse engineering and flash tool. Contribute to bkerler/mtkclient development by creating an account on GitHub.
github.com
Please check the commands and other information on the website.
I used to be able to do this, but I just tried it with a globalised tablet and it didn't work: the BROM mode (press power and volume plus simultaneously to connect the cable) is difficult to connect and even if it does, an error message appears and the process stops. When I get more time, I will switch back to zui14 and give it a try.
daybreak7456 said:
What I did.
Install Python and mtkclient on a windows 10 computer.
python mtk rl --skip userdata "Destination path"
Backup everything but the user data with the above command
Open the backed up proinfo.bin with HxD and rewrite the serial number at the beginning.
python mtk wl "Destination path"
Flash the rewritten proinfo.bin with the above command.
GitHub - bkerler/mtkclient: MTK reverse engineering and flash tool
MTK reverse engineering and flash tool. Contribute to bkerler/mtkclient development by creating an account on GitHub.
github.com
Please check the commands and other information on the website.
I used to be able to do this, but I just tried it with a globalised tablet and it didn't work: the BROM mode (press power and volume plus simultaneously to connect the cable) is difficult to connect and even if it does, an error message appears and the process stops. When I get more time, I will switch back to zui14 and give it a try.
Click to expand...
Click to collapse
Nice one! I can test it tomorrow. It's actually easier to pull the proinfo.bin file using MTK META Utility by using option Dump NV region. I was able to get and edit the file. Not sure how to flash it again on ZUI with a unlocked bootloader. But that's a start. I managed to get another Serial number by flashing another user's backup, but I still have L3, so might not be connected. I'll keep trying.
als_bvg said:
Nice one! I can test it tomorrow. It's actually easier to pull the proinfo.bin file using MTK META Utility by using option Dump NV region. I was able to get and edit the file. Not sure how to flash it again on ZUI with a unlocked bootloader. But that's a start. I managed to get another Serial number by flashing another user's backup, but I still have L3, so might not be connected. I'll keep trying.
Click to expand...
Click to collapse
I actually managed to get it back by flashing the edited proinfo.bin file using this command on ZUI with unlocked bootloader and OEM unlocked: fastboot flash proinfo proinfo.bin
Now let's see if it impacts or not L3. Testing...
Related
TWRP 331 Porting Thread for New UMIDIGI Power 4G
New thread for the new model UMIDIGI Power 4G Helio P35 Octa core Mtk 6765
Umidigi Power 4G MT6765 Octa Core 4G 4GB 64GB Android 9 Smartphone 6,3 inches
Everybody are Welcome!:good:
MANY THANKS TO OUR MODERATORS TO OPEN AGAIN THIS THREAD !
More attention to the Xda-developers Rules:
http://forum.xda-developers.com/announcement.php?f=256
Many thanks to "SUPER ADMIN" MR. MIKE
New twrp 331-test 1 for this device is builded!
Now need period of tests...
http://www.mediafire.com/file/cnqw8d2qkjqtp6k/Twrp_331_test1_Umi_Power.rar/file
reserved 1
Reserved 2
TWRP Not Working for Me
Finally received the phone today. Spent a few hours trying to get your TWRP port installed with no luck unfortunately. After flashing it via SP Flash Tool, I ran into an "Orange State" unlock warning (which I assume is normal). However it's followed by a bootloop. I can only get the phone to boot using the stock recovery.img. Any modifications to the recovery causes a loop.
On the other hand though, I was able to get root through Magisk (I'm using the latest 19.3 version), and patching the stock boot.img through the app, then flashing the patched boot.img to the phone with SP Flash Tool. I have Viper4Android working, which was my main reason for wanting root, so I'm satisfied for the most part. Can't wait to try this phone out as my daily driver!
SeekerofLight.iz said:
Finally received the phone today. Spent a few hours trying to get your TWRP port installed with no luck unfortunately. After flashing it via SP Flash Tool, I ran into an "Orange State" unlock warning (which I assume is normal). However it's followed by a bootloop. I can only get the phone to boot using the stock recovery.img. Any modifications to the recovery causes a loop.
On the other hand though, I was able to get root through Magisk (I'm using the latest 19.3 version), and patching the stock boot.img through the app, then flashing the patched boot.img to the phone with SP Flash Tool. I have Viper4Android working, which was my main reason for wanting root, so I'm satisfied for the most part. Can't wait to try this phone out as my daily driver!
Click to expand...
Click to collapse
I confirm the first part of this, same issue here... i'd like to flash a twrp for gsi purposes, but for now no luck
SeekerofLight.iz said:
On the other hand though, I was able to get root through Magisk (I'm using the latest 19.3 version), and patching the stock boot.img through the app, then flashing the patched boot.img to the phone with SP Flash Tool. I have Viper4Android working, which was my main reason for wanting root, so I'm satisfied for the most part. Can't wait to try this phone out as my daily driver!
Click to expand...
Click to collapse
Can you write how you got the root of the law? Instructions for inexperienced users.
Thank you in advance.
Root UMIDIGI Power with Magisk
mr A V said:
Can you write how you got the root of the law? Instructions for inexperienced users.
Thank you in advance.
Click to expand...
Click to collapse
Sure thing! Here's a Magisk root guide for anyone just getting started that I wrote up just now. (All mentioned files are provided in the zip.)
Step 0 - Download the Attached Zip File Below
Google Drive Mirror
Mediafire Mirror
MEGA Mirror
Step 1 - Drivers
Install the MediaTek drivers by running "DriverInstaller.exe". These are the drivers that worked for me. But if you have issues with them in Step 5, Google "Mediatek MT65xx USB VCOM Drivers" (or some variation of that) and try some others you can find.
-----------------------------------
Step 2 - Install ADB Interface
Install the Android SDK (ADB Interface). To do this drop the platform-tools folder (from the Step 2 folder) into your C:\ directory. Press the windows start button and search for "Environment Variables" and click on "Edit environment variables" from the results. Under SYSTEM VARIABLES on the bottom (not User variables above it) click on the "Path" variable, and click edit. In the new window that appears, hit "Browse..." and click on the "platform-tools" folder that you placed in your C:\ directory.
All this does is allows you to easily input adb commands into command prompt with no issues. This will be used to verify that the device is appearing properly and issue commands in case of emergency.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
-----------------------------------
Step 3 - Install Magisk
Copy the Magisk.apk to your phone and install it.
(This is where you can then copy the boot.img to your device and patch it via the Magisk app to create the "magisk_patched_boot.img" file, however I have included the already patched file in Step 6 for the UMIDIGI Power so you don't need to.)
Also, this is the Magisk v19.3 Beta, but you can install another version.
-----------------------------------
Step 4 - OEM Unlocking/USB Debugging Mode
On your phone, go to Settings >> System >> Developer Options. (If you haven't activated Developer Options yet, do that by going to About Phone >> Build number, and tap it a bunch of times, but I'm sure you already know this lol)
In Developer Options, turn on "OEM Unlocking" to unlock the bootloader, and USB Debugging.
-----------------------------------
Step 5 - Verify That Your Phone is Detected with ADB
Connect your phone to your PC. Make sure you click "Allow USB debugging" on your phone. Then open up Command Prompt. (Protip: Type "color a" and press Enter if you want to feel like a REAL HACKERMAN.) Now, type in "adb devices" and verify that your phone is detected by your computer. If it's detected, then that's perfect you can move on to Step 6. If not, then uh... you may have to try and find some other MediaTek drivers mentioned in Step 1.
-----------------------------------
Step 6 - Set up SP Flash Tool
Open up SP Flash Tool on your computer by running "flash_tool.exe" in the SP Flash Tool Folder. (If at any time it shows a "Processing" window for some reason, just close and reopen the program if it doesn't go away on its own.)
On the first line choose "MTK_AllInOne_DA.bin". And the third line "Authentication File" can be left blank.
On the second line where it shows "Scatter-loading File", hit "choose" and find the "MT6765_Android_scatter.txt" file in the Step 6 folder. It'll load up and show a bunch of green/white rows in the space below.
Now this looked intimidating to me at first, but it's actually quite simple. As far as I understand (and I could be wrong but), the scatter file just tells the program where to place certain files, like a map for the program to follow. The scatter file I provided is for the UMIDIGI Power. The only thing we'll worry about for now is the boot.img file (but in the future, this is where you could also install a TWRP recovery once we get one that is confirmed to work.)
So in the white/green list, scroll down to where it says "boot" in the "Name" column, and click on the blank area in the "Location" column. It will bring up a window where you can browse to the "magisk_patched_boot.img" that I provided.
-----------------------------------
Step 7 - The Big Huzzah (Rooting)
Power off your phone and make sure it's UNPLUGGED. On SP Flash Tool, click "Download". This prepares the program to begin flashing your phone as soon as it is connected. Grab your phone with one hand, and with your other hand plug in the USB cable (if you only have one hand, use your mouth I guess). Your screen should not turn on at all throughout this process, but if it's successful, you should see that the program begins to flash your device after a second or two. Now just wait until it reaches 100% and says "Download Ok" with a green checkmark. And you're pretty much done!
You can then boot up your phone and check the Magisk app, as well as download a root checker from the Play Store to confirm that your phone has root access! Have fun!
Thank you, far-away friend from me, that you are such a sympathetic person! Thank you for writing everything so quickly and in detail. As soon as I receive my phone, I will definitely try to do everything as you wrote.
Tell me, do you plan to install any firmware on this device? For example, Miui. Or are you satisfied with the stock?
mr A V said:
Thank you, far-away friend from me, that you are such a sympathetic person! Thank you for writing everything so quickly and in detail. As soon as I receive my phone, I will definitely try to do everything as you wrote.
Tell me, do you plan to install any firmware on this device? For example, Miui. Or are you satisfied with the stock?
Click to expand...
Click to collapse
No problem! Unfortunately I don't see many custom ROMs coming to this phone, considering it's not a very popular device. I'd guess our best bet is to hope that the UMIDIGI F1 gets some support, and that anything on there can hopefully be ported over to this phone, but even that device isn't very popular either. For me though, that's not a huge issue because I'm actually quite satisfied with the stock firmware it has on board. It's basically stock Android Pie, and I've been able to add all the extra goodies I want into the phone through Magisk Manager and EdXposed with very minor issues. Most notably Viper4Android to fix the slightly tinny speakers and pump up the overall headphone experience too, and Gravity Box for some extra minor software customization.
Overall, I'd say the biggest downside to this device is the limited camera capabilities, and its somewhat limited performance for heavier tasks like 3D games / game streaming. But other than that, this feels like a very premium device. :good:
I thought about the fact that it is you who can transfer other firmware to this device. As a developer, let's say.
On the F1 already installing the firmware AOSP, LOS and other projects. But need to flash these firmware through TVRP recovery. For our device, there is no such recovery yet.
I have little understanding of the intricacies of the android. Sorry if my questions seem silly.
If we take the firmware for F1, for example AOSP, will it have to be somehow changed for our UD Power? Or can just take the archive, as it is, and flash it?
The processor of our smartphone is not very strong, so it is not for games. It is also not clear what RAM is installed. It looks like the manufacturer has installed a cheap part. Put single-channel LDDR 3. So he made a low price. At the expense of device performance.
mr A V said:
I thought about the fact that it is you who can transfer other firmware to this device. As a developer, let's say.
On the F1 already installing the firmware AOSP, LOS and other projects. But need to flash these firmware through TVRP recovery. For our device, there is no such recovery yet.
I have little understanding of the intricacies of the android. Sorry if my questions seem silly.
If we take the firmware for F1, for example AOSP, will it have to be somehow changed for our UD Power? Or can just take the archive, as it is, and flash it?
The processor of our smartphone is not very strong, so it is not for games. It is also not clear what RAM is installed. It looks like the manufacturer has installed a cheap part. Put single-channel LDDR 3. So he made a low price. At the expense of device performance.
Click to expand...
Click to collapse
I definitely consider myself to be a major noob with the more advanced Android development stuff. I only know enough to find my way around the internet and flash compatible software, haha. I've never looked into creating ports myself, but it's certainly something I think might be worth learning, especially with the limited device support on these phones.
And yeah, in terms of performance I don't expect much out of a phone at this price point, but for all the essentials - music, 1080p YouTube, web browsing, and mid to light gaming, it's surprisingly great considering the price. I haven't had any issues with the memory as of yet, so I wouldn't be too concerned, although you're definitely right in that they probably source some pretty cheap parts for these kind of phones.
SeekerofLight.iz said:
Sure thing! Here's a Magisk root guide for anyone just getting started that I wrote up just now. (All mentioned files are provided in the zip.)
"stubbed guide"
Click to expand...
Click to collapse
It works like a charm, thank you! by the way, were you able to boot that twrp or still nothing? and if you made it, were you able to flash a gsi over that too? i'm unable even to boot that twrp
---------- Post added at 09:30 AM ---------- Previous post was at 09:29 AM ----------
ghost45 said:
TWRP 331 Porting Thread for New UMIDIGI Power 4G
New thread for the new model UMIDIGI Power 4G Helio P35 Octa core Mtk 6765
Umidigi Power 4G MT6765 Octa Core 4G 4GB 64GB Android 9 Smartphone 6,3 inches
Everybody are Welcome!:good:
MANY THANKS TO OUR MODERATORS TO OPEN AGAIN THIS THREAD !
More attention to the Xda-developers Rules:
http://forum.xda-developers.com/announcement.php?f=256
Many thanks to "SUPER ADMIN" MR. MIKE
Click to expand...
Click to collapse
Can i ask you a guide on how were you able to boot it? i'm only getting a bootloop after flashing that from SPFlash
I will build one other version of recovery soon...
mg95tux said:
It works like a charm, thank you! by the way, were you able to boot that twrp or still nothing? and if you made it, were you able to flash a gsi over that too? i'm unable even to boot that twrp
Click to expand...
Click to collapse
Glad to hear it worked for you!
Still nothing. Unfortunately I haven't had any luck with booting into TWRP since I last tried it. Hoping ghost45 will be able to help us out with that when he gets the chance.
Bootloop - Secureboot
Nevermind, bootloader locked.
just type on CMD:
adb reboot bootloader
then
fastboot flashing unlock
Andre_Filho said:
Nevermind, bootloader locked.
just type on CMD:
adb reboot bootloader
then
fastboot flashing unlock
Click to expand...
Click to collapse
remember to allow oem unlock from developer settings in stock rom, otherwise it will fail!
SeekerofLight.iz said:
Finally received the phone today. Spent a few hours trying to get your TWRP port installed with no luck unfortunately. After flashing it via SP Flash Tool, I ran into an "Orange State" unlock warning (which I assume is normal). However it's followed by a bootloop. I can only get the phone to boot using the stock recovery.img. Any modifications to the recovery causes a loop.
On the other hand though, I was able to get root through Magisk (I'm using the latest 19.3 version), and patching the stock boot.img through the app, then flashing the patched boot.img to the phone with SP Flash Tool. I have Viper4Android working, which was my main reason for wanting root, so I'm satisfied for the most part. Can't wait to try this phone out as my daily driver!
Click to expand...
Click to collapse
How do you manage to work Viper.
Cause i'm having some problems, tested all versions and my Driver always stays on "Active: NO Format: Unsuported.... Abnormal"
BusyBox also don't seens to work.
:/
Some help?
Andre_Filho said:
How do you manage to work Viper.
Cause i'm having some problems, tested all versions and my Driver always stays on "Active: NO Format: Unsuported.... Abnormal"
BusyBox also don't seens to work.
:/
Some help?
Click to expand...
Click to collapse
The trick to getting Viper4Android to work is to make sure you have SELinux set to "PERMISSIVE" rather than "ENFORCING" on your phone. Here's a handy little app designed to automatically set it to permissive on boot!
https://forum.xda-developers.com/devdb/project/?id=1561#downloads
And for BusyBox, I was having issues too at first because I think with systemless root, BusyBox can only be installed in /sbin, which gets wiped after each boot. So I searched for "BusyBox" in the Magisk app and found a module called "BusyBox for Android NDK" which has worked perfectly for me.
One thing to note...
Sometimes SELinux doesn't always get changed automatically everytime you boot up. It's pretty consistent, but every once in awhile you may need to manually set it to permissive mode again if things don't seem to be working. But it's literally just pressing a single button, so not a big deal.
The other thing is with Viper itself- At times when I launch the app, the driver status says "abnormal" even after I've toggled SELinux to permissive. If you go into settings and toggle "compatibility mode" or "attach audio effects" on and then off that seems to refresh the driver status. Not sure why, but it works.
Let me know if you have any issues.
TWRP for UMIDIGI POWER
I ask for help in creating TWRP for UMIDIGI POWER firmaware ROM v1.5
Please make for this model TWRP
I am very grateful to you - I unlocked the phone and got the rights Root rights.
It remains only to create a TWRP for UMIDIGI POWER
At this forum, competent specialists and for other models everything is already done.
Maybe there is a website where you can make an order to create a TWRP?
Unfortunately, I do not know English and I do not know how to apply.
I would be very grateful and ready to test your work.
Here is a rooting method for the Plam Phone either the US variant or the Vodafone variant this has not been tested or confirmed working on any other device. This root method may break in the future because it is using a tool that isn't designed for the public i tried getting the firehose packaged with the tool to work in other edl flashing tools but was not able to get it working. So this is all we have for now. There is minimal risk in doing this it just has a lot of steps and it requires a pc running windows.
Note: This will wipe your device so anything stored on it will be lost please backup anything important like photos/contacts/etc
Download and install Sugar QCT from here (Be sure to install the usb drivers as well)
Included in the zip is the username and password that you will need to use to run the program please do not post it here.
Boot the device into recovery by turning the device off and then holding the power button until it restarts 3-4 times and boots to recovery
Select the option to go into emergency download mode
Now plug the device into your computer and open Sugar QCT
From the list select pepito/PVG100 (US) or pepito_vdf (Vodafone)
Now select Upgrade this will download the palms firmware package and flash it to the device
When it finishes do not close sugar
Unplug your device and hold the power button for a few minutes so it will restart out of EDL mode, use a rubber band or something to apply pressure to it so you don't have to hold it
Go to where Sugar QCT is installed (C:\Program Files (x86)\SUGAR QCT_SP_Gotu2\bin\)
In there you should see a folder called PVG100-xxxx (The x's are your serial number)
Copy that to your desktop or anywhere else that you like
In the folder, there should be some random looking mbn files these are actually the firmware files just names are randomized to make using them harder.
There should be a file called B1AMD0D0CV00.mbn if not look for a file that starts with a B it will be the boot.img
You will need to push that to an android device and patch it with magisk manager.
Once that is done replace the B1AMD0D0CV00.mbn in your copy of the firmware with the patched boot.img
Boot it back into emergency download mode as previously stated
Close and reopen sugar
Copy your firmware copy back into C:\Program Files (x86)\SUGAR QCT_SP_Gotu2\bin\ be sure it is the same folder structure
Now select your model again and then press the upgrade button in sugar this will now flash your modified firmware to the device.
Once it finishes hold the power button for a few minutes so it will restart out of EDL mode, use a rubber band or something to apply pressure to it so you don't have to hold it
When it restarts and powers up then go through setting the phone up and install magisk manager and you're rooted.
Thanks to @StormSeeker1 for telling me about holding the power button for a few minutes to get out of EDL previously you had to let the phone die to get out of it which is a pain.
Interesting, shall do it tomorrow.
Curious, this doesn't use the root exploit discussed in other threads? Where is (7) downloading from?
snoopy20 said:
Interesting, shall do it tomorrow.
Curious, this doesn't use the root exploit discussed in other threads? Where is (7) downloading from?
Click to expand...
Click to collapse
It doesn't use any root exploit, it's downloading the firmware directly from TCL servers, the tool used is designed for service centers.
If they are the same hardware, it should be possible to flash Vodaphone over the top?
snoopy20 said:
If they are the same hardware, it should be possible to flash Vodaphone over the top?
Click to expand...
Click to collapse
They are signed with different keys, so it will probably cause the device to boot loop and or not startup. I would not recommend trying it.
Is it possible to dump the radio files from an network unlocked device, and use these files to unlock Verizon network.
Any other ideas to unlock network?
Current findings:
1. Remove the Verizon sim warning.
Simply edit the /vendor/build.prop and modify line "ro.product.vzw=true" to false. However, it has a side effect, causing the contacts in dailer FC while browsering.
2. Enable diag, serial and QMI
One method is dialing "###2324#", another approach is launching "EngineerMode" through apps like quickshortcutmaker, then navigate to Connectivity - DiagProtector.
3. Boot animation path
/Vendor/JRD_custres/media/
4. Most garbage apps path
/Vendor /priv-app/
Every time I try to replace the MBN files after being patched the utility keeps redownloading the originals. Any advice?
xswxm said:
Is it possible to dump the radio files from an network unlocked device, and use these files to unlock Verizon network.
Any other ideas to unlock network?
Current findings:
1. Remove the Verizon sim warning.
Simply edit the /vendor/build.prop and modify line "ro.product.vzw=true" to false. However, it has a side effect, causing the contacts in dailer FC while browsering.
2. Enable diag, serial and QMI
One method is dialing "###2324#", another approach is launching "EngineerMode" through apps like quickshortcutmaker, then navigate to Connectivity - DiagProtector.
3. Boot animation path
/Vendor/JRD_custres/media/
4. Most garbage apps path
/Vendor /priv-app/
Click to expand...
Click to collapse
I put my t-mobile sim into mine and it worked fine no edits needed and mine is officially locked to verizon.
kotaKat said:
Every time I try to replace the MBN files after being patched the utility keeps redownloading the originals. Any advice?
Click to expand...
Click to collapse
Are you postive that the folder structure is the same?
deadman96385 said:
I put my t-mobile sim into mine and it worked fine no edits needed and mine is officially locked to verizon.
Are you postive that the folder structure is the same?
Click to expand...
Click to collapse
I am using another carrier, not USA ones, and it has problems with 4G network.
it works, thanks
Just began mind. So far it's stuck on 2%.
Regarding flashing Vodaphone over Verizon, if the ROM files are signed with different keys then modifying the boot.img will surely break the signage?
snoopy20 said:
Just began mind. So far it's stuck on 2%.
Regarding flashing Vodaphone over Verizon, if the ROM files are signed with different keys then modifying the boot.img will surely break the signage?
Click to expand...
Click to collapse
Are you still stuck at 2%? Of downloading, or of flashing?
deadman96385 said:
I put my t-mobile sim into mine and it worked fine no edits needed and mine is officially locked to verizon.
Are you postive that the folder structure is the same?
Click to expand...
Click to collapse
tapa_t said:
Are you still stuck at 2%? Of downloading, or of flashing?
Click to expand...
Click to collapse
Tried flash pvg100e over pvg100, it will stuck at the beginning and the program won't flash.
xswxm said:
Tried flash pvg100e over pvg100, it will stuck at the beginning and the program won't flash.
Click to expand...
Click to collapse
Doesn't that empirically prove that different versions have different signatures, or at least ROM's are different enough to prevent switching over? Maybe we are just so lucky that boot.img is not checked as rigorously.
Is pvg100e for Vodafone? Where did you get the ROM if your device is pvg100?
Does it finish flashing if you do pvg100 over pvg100?
tapa_t said:
Doesn't that empirically prove that different versions have different signatures, or at least ROM's are different enough to prevent switching over? Maybe we are just so lucky that boot.img is not checked as rigorously.
Is pvg100e for Vodafone? Where did you get the ROM if your device is pvg100?
Does it finish flashing if you do pvg100 over pvg100?
Click to expand...
Click to collapse
The tool deadman provided definitely works if u follow the instruction and choose the right version.
For the signature issue, maybe u can find the answer in another thread about temporary root.
As to the version problems, pvg100 is for Verizon.
To my knowledge, the pvg100e is for many other vendors, such as Vodafone, and the UK version maybe share the same model name. There is another version pvg100eu, for European. U can find more evidence in the temporary root thread.
So far the following:
Windows 10 64 - goes to 2% then after a few seconds a 5002 error.
Windows 7 64 inside Virtualbox - goes to 2% and then doesn't move.
I've tried the drivers and others on the web although the latest is around 2014/15.
xswxm said:
The tool deadman provided definitely works if u follow the instruction and choose the right version.
For the signature issue, maybe u can find the answer in another thread about temporary root.
As to the version problems, pvg100 is for Verizon.
To my knowledge, the pvg100e is for many other vendors, such as Vodafone, and the UK version maybe share the same model name. There is another version pvg100eu, for European. U can find more evidence in the temporary root thread.
Click to expand...
Click to collapse
Checked last night, mine, pvg100, is snapdragon 430, and the China mainland version is pvg100c with snapdragon 435.
deadman96385 said:
It doesn't use any root exploit, it's downloading the firmware directly from TCL servers, the tool used is designed for service centers.
Click to expand...
Click to collapse
I'm not looking to root right now, but if I'm understanding this correctly this should mean that I can use SugarQCT to pull the latest version (1AMD) firmware for my Palm that doesn't show any OTA's available and is still on the original 1AGL firmware. Is that correct?
Thanks for making this happen, deadman96385!
tapa_t said:
Doesn't that empirically prove that different versions have different signatures, or at least ROM's are different enough to prevent switching over? Maybe we are just so lucky that boot.img is not checked as rigorously.
Click to expand...
Click to collapse
No need for empirical proof, I did the analysis here.
The difference is: the early part of boot is Qualcomm code using Qualcomm security. These are the "pbl", "sbl/edl" and "aboot/fastboot" programs (and also "modem", "tz" and other bits). These were the parts that I was looking at in the link above.
When "aboot" completes, it hands over to the late part of boot, which is Android code using Google security. These are the "boot.img/Linux kernel" programs, "recovery", "system", "vendor", "data", etc. They use a different security model. That's what this root method targets. You are correct when you say "Maybe we are just so lucky that boot.img is not checked as rigorously".
It does imply that you can mix the PVG100 Qualcomm partitions for "early boot" with the PVG100E Android partitions for "late boot" and vice-versa. But someone with motivation needs to test this... (No, you can't unlock cellular bands this way; the "modem" partition is from Qualcomm and must match your hardware.)
A good diagram is below; Source (and explanation): https://blog.quarkslab.com/analysis-of-qualcomm-secure-boot-chains.html -- I recommend studying this article.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ssuds said:
I'm not looking to root right now, but if I'm understanding this correctly this should mean that I can use SugarQCT to pull the latest version (1AMD) firmware for my Palm that doesn't show any OTA's available and is still on the original 1AGL firmware. Is that correct?
Click to expand...
Click to collapse
This should work. Keep in mind that whilst 1AMD seems to be fine, future versions may (permanently) close the vulnerabilities that allow you to get root, modify system partitions or use the current version of SugarQCT. I don't think this will happen but we should all keep the possibility in mind.
Which Windows version are people using? I've tried W10 and also W7 through a virtualbox but with the above errors.
Hi there,
So After seen many tutorials I wanted to proceed to unlock the bootloader of my Huawei Mediapad T5 , here are the specs
```
Model: AGS2-W09
Build No: AGS2-W09 8.0.0.360(OCEC431)
CPU : Hisilicon Kirin 659
Android Version: 8.0
```
I have downloaded the last build of `potatoNV` along with the SER Drivers ,
I have booted in untrusted driver mode (on Win10) and have installed `usbser.sys` as far as I recall
I proceed opening the Tablet from inside and shorting the "short point" and I get connection with the Computer , I installed the drivers , and tried on `potatoNV` with `Kirin 65x (A)` .
I get to the end of the progress bar , and then I get the problem as there is no confirmation that the process has been performed correctly. The connection dissapears , and If I try to boot on rescue mode and I do `.\fastboot.exe devices` or `fastbook.exe oem device info` it doesnt show no device at all.
Also the `rescue mode` menu says `Phone locked , FRP Unlocked` So I guess I had no luck
Please see the video on the link (note that the 2 takes are not synchronized)
doubt-mediapadt5-bootloaderunlock.mp4
drive.google.com
What I may be possibly doing wrong ? May it be the USB connection (cables or connectors) ? or the drivers I downloaded?
Please any assitance will be appreciated.
Thanks
Maybe I can help you with this. Recently rooted this tab myself. Please give me a reminder tomorrow
Hey there I just saw the message . Please if you can guide me a bit of what I may be doing wrong? Also If there is a way to share the Drivers files that you used that would be great (I'm not sure if it was a matter of drivers or general clumsiness , please If you have a minute to check the video tell me what may be wrong on my "Technique") Thank you!!
freddieventura said:
Hey there I just saw the message . Please if you can guide me a bit of what I may be doing wrong? Also If there is a way to share the Drivers files that you used that would be great (I'm not sure if it was a matter of drivers or general clumsiness , please If you have a minute to check the video tell me what may be wrong on my "Technique") Thank you!!
Click to expand...
Click to collapse
Just saw your responce now (please use reply next time, I will get an notification then ).
The "Kirin 65x (A)" you've used is the correct bootloader. So guess it would have been something going on with the drivers or the procedure.
I recently (about 1 month ago) rooted this tab myself so I think I will have quite recent files for doing so. Maybe I can send them to you if you like. But I should have save the websites where I got them from too. But need to check it up for you then.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Did you have used the settings above?
You did had recieved the "New unlock code" message?
I have to go to work now, but I could help you further later this evening if you need further assistance
Rockel said:
Just saw your responce now (please use reply next time, I will get an notification then ).
The "Kirin 65x (A)" you've used is the correct bootloader. So guess it would have been something going on with the drivers or the procedure.
I recently (about 1 month ago) rooted this tab myself so I think I will have quite recent files for doing so. Maybe I can send them to you if you like. But I should have save the websites where I got them from too. But need to check it up for you then.
View attachment 5391207
Did you have used the settings above?
You did had recieved the "New unlock code" message?
I have to go to work now, but I could help you further later this evening if you need further assistance
Click to expand...
Click to collapse
Hi, thanks for assisting me. Yeah well, the version I used of PotatoNV(the last build) just had the option of Disable FBlock so I did that.
Also I tried wth a previous build that was showing both versions as you are showing and it happened the same thing.
My guess are more focused on 2 probable mistakes by my side either:
- When shorting the short point Im not doing it correctly. (not sure if this, as the device gets detected by PotatoNV and initiates the process)
- (Most likely thisone). Wrong drivers, I have downloaded them through a link found in a youtube video, and the video was not specific about this Tablet. Also there were a bunch of drivers within the same file so I installed one that looked like the correct one (but not 100% sure)
Anyways thanks for taking your time really and appreciate a reply but always whenever you find free time obviously. Take it easy today at work
freddieventura said:
Hi, thanks for assisting me. Yeah well, the version I used of PotatoNV(the last build) just had the option of Disable FBlock so I did that.
Also I tried wth a previous build that was showing both versions as you are showing and it happened the same thing.
My guess are more focused on 2 probable mistakes by my side either:
- When shorting the short point Im not doing it correctly. (not sure if this, as the device gets detected by PotatoNV and initiates the process)
- (Most likely thisone). Wrong drivers, I have downloaded them through a link found in a youtube video, and the video was not specific about this Tablet. Also there were a bunch of drivers within the same file so I installed one that looked like the correct one (but not 100% sure)
Anyways thanks for taking your time really and appreciate a reply but always whenever you find free time obviously. Take it easy today at work
Click to expand...
Click to collapse
Not sure, I should get into it again, but I'm not sure of potato is able to start the procesure or finding the divice if not shorted correctly.
Do you have a screenshot of your potato output/ results?
How are you performing the shorting procedure?
I can see if I can look for you for the right drivers tonight.
Rockel said:
Not sure, I should get into it again, but I'm not sure of potato is able to start the procesure or finding the divice if not shorted correctly.
Do you have a screenshot of your potato output/ results?
How are you performing the shorting procedure?
I can see if I can look for you for the right drivers tonight.
Click to expand...
Click to collapse
I hve uploaded the video which shows all the output and how Im shorting the point. The video though is composed by two takes and are not synced in time but that is how I do it.
doubt-mediapadt5-bootloaderunlock.mp4
drive.google.com
Let me know if you can watch it on there. Thanks
freddieventura said:
I hve uploaded the video which shows all the output and how Im shorting the point. The video though is composed by two takes and are not synced in time but that is how I do it.
doubt-mediapadt5-bootloaderunlock.mp4
drive.google.com
Let me know if you can watch it on there. Thanks
Click to expand...
Click to collapse
Oh yes, forgot about the video in the OP...
Seems you're folowing the wrong procedure with the shorting proces.
And seems your potato version is a bit outdated. But don't think this will be much of an issue.
- Your tablet needs to be turned off.
- cable removed from the tab.
- start potato
- then short the circuit (tab turned off).
- keep it shorted and insert the usb cabel (the other end should be in the computer already)
- the tablet starts (i believe in somekind of flash mode. And i believe you should not be able to see the Huawei logo in this procedure).
- after 2 or 3 seconds after booting, release the shorted circuit.
- i believe it should display you now some info about the tab itself in potato when you press start.
P.s. Don't forget to make a screenshot of the results or write down the newly given unlock code. So you can use it afterwards to lock or unlock your bootloader at a later moment, without opening the tab again.
P.s. 2 I just read in your comment that the recordings are not synchronised. So it's possible you were following the correct steps above. Correct me if I'm wrong please
freddieventura said:
I hve uploaded the video which shows all the output and how Im shorting the point. The video though is composed by two takes and are not synced in time but that is how I do it.
doubt-mediapadt5-bootloaderunlock.mp4
drive.google.com
Let me know if you can watch it on there. Thanks
Click to expand...
Click to collapse
I'm home (finally)...
If the steps mentioned above didn't worked out, I would like to ask you to do axactly as I did. Just unlocked my Mediapad T5 just 1 month ago or so, so everything I've used should be recent enough I guess.
First:
- Un-install your potato version.
- Un-install your Mediapad T5 USB drivers.
So we can begin from scratch
Also:
- turn on OEM-unlock and USB-debugmode in developer settings.
I asume you have a decent and working ADB version installed on your PC?
If not, or when you're not sure, uninstall it too.
I was using the Minimal ADB and Fastboot from here:
[TOOL]Minimal ADB and Fastboot [2-9-18]
Introduction ADB and Fastboot are arguably two of the most indispensable tools used when working with Android devices. If you really want to modify, debug, and tweak along with their countless uses in rooting, and other procedures ADB and...
forum.xda-developers.com
Then:
1) Install the Huawei USB drivers from here:
Support area | files.dc-unlocker.com
(this) or (this) are the "official" sites I got this from.
2) Install the latest version of PotatoNV from here:
GitHub - mashed-potatoes/PotatoNV: Unlock bootloader of Huawei devices on Kirin 960/95х/65x/620
Unlock bootloader of Huawei devices on Kirin 960/95х/65x/620 - GitHub - mashed-potatoes/PotatoNV: Unlock bootloader of Huawei devices on Kirin 960/95х/65x/620
github.com
Open potatoNV and use these settings marked in red:
3) Plug the USB-cable into your PC already, but don't connect the other side to the tablet. And make sure your tablet is turned off.
4) Now short the testingpoint with a shielded part. I just used a thick copper wire and used it between testingpoint and metalshield just next to it. Metal pliers as used in your video should work too ofcourse.
P.S. I see that you also disconnected your screen in the video? It seems that it's verry important not to see a charging icon in the next step, so maybe it's better to connect it again for this step.
5) While still shorting the testingpoint with the shield, connect the USB cable to your tablet and be sure no charging icon pops up (This can be a bit difficult doing on your own. Easiest way is to have someone around te help in this step). After a few secconds when connected (without seeing an charging icon) remove the shorting between testingpoint and shield.
6) Make sure that the Huawei USB COM is selected in PotatoNV (and that the other settings are the same as the screenshot)
7) And pres "Start!"
8) You should get similar results now:
PotatoNV v2.2.1
User manual: https://kutt.it/pnv-en
Verifying images...
Uploading hisi65x_a...
- xloader
- fastboot
Waiting for any device...
Connecting...
Serial number: FQB***************
Board ID: FQB*************
Model: AGS2-W09
Build number: AGS2-W09 8.0.0.360(OCEC431)
FBLOCK state: unlocked
Saved key: 6BN**************
Writing FBLOCK...
Writing WVLOCK...
Writing USRKEY...
Rebooting...
New unlock code: 3BS*************
p.s. In your video it seemed your device got disconnected somehow while uploading. You should not see that "timeout" message here now annymore.
9) Make a screenshot of your results, copy them to a text file or write down at least your "new unlock code"
So you won't have to open your tablet annymore in the future. You can use this newly obtained unlock code now to lock and unlock your tablet without opening again.
10) You should now see a warning screen everytime you reboot the tab. It warns you about that the device can't be trusted annymore because of the unlocked bootloader.
You can also enter Fastboot to check it
Fastboot/ Bootloader mode:
1. Turn off the device by holding the Power key for a few seconds.
2. Connect tablet to PC/laptop using the USB-cable.
3. Hold down Volume-Down.
4. Hold down the Power button until device starts (while still holding Volume-Down and USB connected).
4. Tablet boots now into Fastboot-mode.
You should see the following screen then (pay attention on the 2 red lines at the bottom):
You can close your tablet now!
Rockel said:
I'm home (finally)...
If the steps mentioned above didn't worked out, I would like to ask you to do axactly as I did. Just unlocked my Mediapad T5 just 1 month ago or so, so everything I've used should be recent enough I guess.
First:
- Un-install your potato version.
- Un-install your Mediapad T5 USB drivers.
So we can begin from scratch
Also:
- turn on OEM-unlock and USB-debugmode in developer settings.
I asume you have a decent and working ADB version installed on your PC?
If not, or when you're not sure, uninstall it too.
I was using the Minimal ADB and Fastboot from here:
[TOOL]Minimal ADB and Fastboot [2-9-18]
Introduction ADB and Fastboot are arguably two of the most indispensable tools used when working with Android devices. If you really want to modify, debug, and tweak along with their countless uses in rooting, and other procedures ADB and...
forum.xda-developers.com
Then:
1) Install the Huawei USB drivers from here:
Support area | files.dc-unlocker.com
(this) or (this) are the "official" sites I got this from.
2) Install the latest version of PotatoNV from here:
GitHub - mashed-potatoes/PotatoNV: Unlock bootloader of Huawei devices on Kirin 960/95х/65x/620
Unlock bootloader of Huawei devices on Kirin 960/95х/65x/620 - GitHub - mashed-potatoes/PotatoNV: Unlock bootloader of Huawei devices on Kirin 960/95х/65x/620
github.com
Open potatoNV and use these settings marked in red:
View attachment 5391609
3) Plug the USB-cable into your PC already, but don't connect the other side to the tablet. And make sure your tablet is turned off.
4) Now short the testingpoint with a shielded part. I just used a thick copper wire and used it between testingpoint and metalshield just next to it. Metal pliers as used in your video should work too ofcourse.
View attachment 5391623
P.S. I see that you also disconnected your screen in the video? It seems that it's verry important not to see a charging icon in the next step, so maybe it's better to connect it again for this step.
5) While still shorting the testingpoint with the shield, connect the USB cable to your tablet and be sure no charging icon pops up (This can be a bit difficult doing on your own. Easiest way is to have someone around te help in this step). After a few secconds when connected (without seeing an charging icon) remove the shorting between testingpoint and shield.
6) Make sure that the Huawei USB COM is selected in PotatoNV (and that the other settings are the same as the screenshot)
7) And pres "Start!"
8) You should get similar results now:
PotatoNV v2.2.1
User manual: https://kutt.it/pnv-en
Verifying images...
Uploading hisi65x_a...
- xloader
- fastboot
Waiting for any device...
Connecting...
Serial number: FQB***************
Board ID: FQB*************
Model: AGS2-W09
Build number: AGS2-W09 8.0.0.360(OCEC431)
FBLOCK state: unlocked
Saved key: 6BN**************
Writing FBLOCK...
Writing WVLOCK...
Writing USRKEY...
Rebooting...
New unlock code: 3BS*************
p.s. In your video it seemed your device got disconnected somehow while uploading. You should not see that "timeout" message here now annymore.
9) Make a screenshot of your results, copy them to a text file or write down at least your "new unlock code"
So you won't have to open your tablet annymore in the future. You can use this newly obtained unlock code now to lock and unlock your tablet without opening again.
10) You should now see a warning screen everytime you reboot the tab. It warns you about that the device can't be trusted annymore because of the unlocked bootloader.
You can also enter Fastboot to check it
Fastboot/ Bootloader mode:
1. Turn off the device by holding the Power key for a few seconds.
2. Connect tablet to PC/laptop using the USB-cable.
3. Hold down Volume-Down.
4. Hold down the Power button until device starts (while still holding Volume-Down and USB connected).
4. Tablet boots now into Fastboot-mode.
You should see the following screen then (pay attention on the 2 red lines at the bottom):
View attachment 5391639
You can close your tablet now!
Click to expand...
Click to collapse
Thanks very much for your explanation , I will do this when I am back at home and let you know .
Cheers!!
freddieventura said:
Thanks very much for your explanation , I will do this when I am back at home and let you know .
Cheers!!
Click to expand...
Click to collapse
Are you btw sure that the pliers you used in in the video are making a circuit from one point to the other? Maybe worthwile to measure the resistance first?
I just used a thick copper wire and bended it to an easy to use U-shape.
Rockel said:
Are you btw sure that the pliers you used in in the video are making a circuit from one point to the other? Maybe worthwile to measure the resistance first?
I just used a thick copper wire and bended it to an easy to use U-shape.
Click to expand...
Click to collapse
Sorry Rockel I have been very busy this week , I'm gonna try and find a little bit of time to get this done this weekend . Thank you!!
freddieventura said:
Sorry Rockel I have been very busy this week , I'm gonna try and find a little bit of time to get this done this weekend . Thank you!!
Click to expand...
Click to collapse
No problem, take your time. Hope these steps wil solve your problem. Please keep me informed when you have time
Rockel said:
No problem, take your time. Hope these steps wil solve your problem. Please keep me informed when you have time
Click to expand...
Click to collapse
Do angels wear capes? because I haven't seen yours .
Much much much appreciate your help with this, I have just done it perfectly it didn't take me much time to do it.
Whatever I was doing wrong (probably the drivers , probably the shorting point thing not doing it properly) , whatever who cares!!.
I was also a bit not confident to do it that's why it took me time to get into doing it , but you definitely coached me with your messages .
Really thanks very much Rockel . For anything we keep in touch mate
freddieventura said:
Do angels wear capes? because I haven't seen yours .
Much much much appreciate your help with this, I have just done it perfectly it didn't take me much time to do it.
Whatever I was doing wrong (probably the drivers , probably the shorting point thing not doing it properly) , whatever who cares!!.
I was also a bit not confident to do it that's why it took me time to get into doing it , but you definitely coached me with your messages .
Really thanks very much Rockel . For anything we keep in touch mate
Click to expand...
Click to collapse
Hehehehe, thanks for your nice responce!
So I asume You've managed to root unlock the device now!
It was a pleasure assisting you in this.
If you need anny other information regarding this rooted device, please let me know. I'm not a pro with this. But had to solve a few problems myself. And came there with the help of others aswell.
What is the use of New unlock code?
do anyone have system, boot, cust, recovery, userdata.img with you i want to try with multi-tool to unbrick my tab
The unlock code can be used to unlock bootloader (using something like "adb oem unlock <code>" from PC)
I have saved the OTA folder form huawei system update app just before updating from 8.0.0.320(C432) to 8.0.0.371(C432), it can be found in /data/HwOUC folder after updater finished downloading. This version cannot be found on HuaweiFirmwareFinder site but I have temporary shared then here. Perhaps we could contact the authors to upload this version.
You can later use HuaweiFirmwareExtractor to extract different images from the zip files (no clue why there are 3 of them).
You need to disable "Verify Header checksums" in the "Settings" to open the extracted update.app files from the zips.
Good luck!
denzelcris said:
The unlock code can be used to unlock bootloader (using something like "adb oem unlock <code>" from PC)
I have saved the OTA folder form huawei system update app just before updating from 8.0.0.320(C432) to 8.0.0.371(C432), it can be found in /data/HwOUC folder after updater finished downloading. This version cannot be found on HuaweiFirmwareFinder site but I have temporary shared then here. Perhaps we could contact the authors to upload this version.
You can later use HuaweiFirmwareExtractor to extract different images from the zip files (no clue why there are 3 of them).
You need to disable "Verify Header checksums" in the "Settings" to open the extracted update.app files from the zips.
Good luck!
Click to expand...
Click to collapse
thank you .. but i extract app didnt uderstand which img file to install there no exact name for boot.img, recovery.img, cust.img, can you plz tell me which file equal to those file..
I don't think Huawei has boot.img or recovery.img, they may have a different layout and names (someone correct me if I'm wrong). I know the equivalent of boot.img is ramdisk.img or kernel.img (I flash both when restoring to be sure) and recovery should be recovery_ramdisk.img. The names from HuaweiExtractor should match with the images. Cust.img can be found in the other zip: update_full_AGS2-W09_hw_eu.
There is also this partition layout table which I don't know how it works for Huawei but I know that it may change for different firmwares so it is usefull to have remembered what version you had previously or use a safe tool to flash that also.
EDIT: FIXED. I flashed persist.img from version "S250260_210804..." (unzip, flash via `fastboot flash persist persist.img`) https://mirrors.lolinet.com/firmware/lenovo/Tab_P11_Pro/TB-J706F/
Hello dear community,
I am in need of some help. So here is what I did:
* Coming from latest Android 11 ROW, flashed ZUI using QFIL from here: https://mirrors.lolinet.com/firmware/lenovo/Tab_P11_Pro/TB-J706F/
* tried upgrading to ZUI 12.5, 12.6 and 13 but didn't work
* used fastboot to unlock and unlock_critical (i know, i know...)
* used payload_dumper (from some github repo) to extract zui 13 update.zip
* flashed every image I extracted manually using fastboot (I know, I'm stupid)
* Got ZUI 12.0 working, didn't like it and wanted ROW android 11 back
* flashed latest ROW rom using QFIL from lolinet url -> bootloop
* flashed oldest ROW rom using QFIL, updated 3x via OTA to latest version -> few bootloops, then device booted back to android 10 and created notification "failed to install ota"
So I can install any version between TB-J706F_S210002_201015_ROW and TB-J706F_S250260_210804_ROW from lolinet url, but nothing above that. Neither through QFIL, nor using lenovo smart rescue assistent, nor using OTA update from android 10 (which is working fine).
I tried following things to fix this:
* ####6030# -> change to CN and change the NV value to 00
* ####6030# -> change to DE and change the NV value to 02 or 00
* flash latest ROW using QFIL, then change NV value from 02 to 00
nothing of that worked and I'm starting to believe, that I ****ed up some partitions using fastboot. Because I flashed images from ZUI android 11 and I can't install ROW android 11 now.
Could I possibly try restoring a TWRP backup from some other user?
What else could I do to install android 11?
PS: I used QFIL backup and restore tool to change the NV value. Because the nv reader/writer tool didn't seem to work.
It might help, if someone would be kind enough to provide me with the following images (by backing them up with twrp):
* abl
* xbl_a
* xbl_b
Hi there, I also got into this trouble that can't flash any global ROM including TB-J706F_S250260_210804_ROW. What I did is change the NV value to 02 and not 00 using QFIL. After that I was able to update via OTA and currently on the latest global ROM.
Thanks to this thread: https://forum.xda-developers.com/t/check-region-unlock-p11-tb-j606f-l-n.4356451/
MateUserHHTTI have similar problem before, can not flash to Android 11, even ROW or ZUI, bootloop~
please check your J706F screen auto rotate and auto brightness(and pair bluetooth devices) still functional?
If not functional, I'm following below post instruction to flash presist.img, and can upgrade to Android 11, both of ROW & ZUI are available.
<TB-J706F> Auto-rotation & Auto Brightness Broken.But Serial Number shows 123456789ABCDEF, wifi /bluetooth MAC shows 00:00:00... still not solve even functional.
auston said:
But Serial Number shows 123456789ABCDEF, wifi /bluetooth MAC shows 00:00:00... still not solve even functional.
Click to expand...
Click to collapse
I may found a fix for Bluetooth MAC by generating a file for the "NV-items_reader_writer.exe" and wrote it to NV item 447 (some one sait this is BT). Problem was that this item (447) was NOT present at this time inn QCN.
WARNING! May my guess of "Items size" 128 is wrong, I don't know. Use at your own risk and change the file to your MAC.
After that I flashed "persist.img" (matching the actual ROM), some one wrote that this fixed the autorotate. I can confirm this.
But still not found solution for serial, the correct serial is still in NV item 2497.
Okay, Serial number restore can be done the same way.
See here https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/
Best would be to have the full original QCN file (or an editor for this files)
MateUserHHTT said:
* abl
* xbl_a
* xbl_b
Click to expand...
Click to collapse
abl (_a and _b) = abl.elf
xbl (_a and _b) = xbl.elf
You will find both in the ROM Zip's at lolinet.
Mine updates successfully from 10 to 11 after I have restored BT, Wifi, SN, PN and region lock. And flashed persist.img.
Oh, and you have to set region code in QCN NV 6858, somebody found out that Android 11 checks that value. If it is wrong, device boot loops.
auston said:
please check your J706F screen auto rotate and auto brightness(and pair bluetooth devices) still functional?
Click to expand...
Click to collapse
Firstly, let me thank you for your reply! It's interesting, I indeed noticed just a few days ago, that auto rotation isn't working!
I will follow the guide you linked and update my post accordingly.
Edit: THANK you very much indeed! My problem was solved instantly by this!
Flashed persist.img via fastboot, flashed the latest ROM from lolinet using QFIL and had no issues whatsoever.
Oh, and you have to set region code in QCN NV 6858, somebody found out that Android 11 checks that value. If it is wrong, device boot loops.
Click to expand...
Click to collapse
as I said in my post, I did tried both 00 and 02. I read the thread about the second region code checking.
CryptMan said:
Mine updates successfully from 10 to 11 after I have restored BT, Wifi, SN, PN and region lock. And flashed persist.img.
Click to expand...
Click to collapse
I don't have any problem but just in case...
I guess PN is Product Number where did you change it and where do you get the correct value? I only found a code before the SN that looks unique per tablet but it's not in the box.
MrCrayon said:
I guess PN is Product Number where did you change it and where do you get the correct value?
Click to expand...
Click to collapse
Well I changed the PN in NV item 2497
I found this PN number here: https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/#post-86315607
My other device, P11 (TB-J606F), has this number: 8SSP69A6PB5XHA6213L0864
Because they look pretty same (length, etc.) I decided to try it.
May somebody would confirm if this PN are the same on all device.
Open settings and type in the search bar "####2222#". That will display PN and SN.
One issue persists though, which is that my widewine level is set to L3.
1. I flashed persist.img from TB-J706F_S250260_210804_ROW
2. I then installed the TB-J706F_S620150_211226_ROW via QFIL and
3. updated to TB-J706F_S630185_220128_ROW via OTA in system settings.
My serial number is also 1-9A-F. My device is locked. I'm unlocking my device and flashing the persist.img of the latest ROM. If that doesn't work, what are my options to restore L1?
CryptMan said:
Well I changed the PN in NV item 2497
I found this PN number here: https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/#post-86315607
My other device, P11 (TB-J606F), has this number: 8SSP69A6PB5XHA6213L0864
Because they look pretty same (length, etc.) I decided to try it.
May somebody would confirm if this PN are the same on all device.
Open settings and type in the search bar "####2222#". That will display PN and SN.
Click to expand...
Click to collapse
Ah ok, so the number before SN is the PN.
I have two J706F and they have different PN, The last 8-9 digits are different and the other ones are the same.
I could not find that code anywhere else.
MateUserHHTT said:
One issue persists though, which is that my widewine level is set to L3.
Click to expand...
Click to collapse
If you check in play store settings does it say your device is certified?
On my J706F, the one on which I have lost QCN with SN MAC etc. , I have the same problem as MateUserHHTT.
The device lost L1 cert. PlayStore says NOT certified and "DRM Info" app says L3.
I also have a property "sys.lenovo.widevine_security_level" with value "L3".
My guess it that there is a file or partition holding this certifications, but I don' t know which.
And of course I don't have a backup ...
If you check in play store settings does it say your device is certified?
Click to expand...
Click to collapse
It says "Device is not certified"
Now that's curious: my tablet, running the latest Android 11 ROW version, is offering me to upgrade my device to Android Kitkat 4.4. Now that's an offer I can't resist (yes, of course I clicked "update". I want all the new features!)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
CryptMan said:
The device lost L1 cert. PlayStore says NOT certified and "DRM Info" app says L3.
I also have a property "sys.lenovo.widevine_security_level" with value "L3".
Click to expand...
Click to collapse
Is your bootloader unlocked or did you unlock it previously and relocked?
MateUserHHTT said:
It says "Device is not certified"
Now that's curious: my tablet, running the latest Android 11 ROW version, is offering me to upgrade my device to Android Kitkat 4.4. Now that's an offer I can't resist (yes, of course I clicked "update". I want all the new features!)
Click to expand...
Click to collapse
Maybe the OTA app is getting some wrong data / not set data and that's the result
I tried to decompile that app to get the address called to download updates but my knowledge of android programming is really basic and did not have enough time.
MrCrayon said:
Is your bootloader unlocked or did you unlock it previously and relocked?
Maybe the OTA app is getting some wrong data / not set data and that's the result
I tried to decompile that app to get the address called to download updates but my knowledge of android programming is really basic and did not have enough time.
Click to expand...
Click to collapse
I previousl, unlocked and afterwards relocked it (both flashing lock and flashing lock_critical)
Yes, I once said "erase all before download" and accidentally deleted my original qcn file so some NV fields seem to be missing. Maybe that caused the app to default back to 4.4 it was Lenovo Feature Updater by the way, not the settings - system - update.
If you share your past work in a git repo I will take a look at it. I'm no expert for sure but I'm developing fir android for some years and have stuck my nose a tiny bit under the surface of android rom development (1mm and it was very painful still).
My widewine lvl is L3. Any chance of resetting to L1 myself? I don't know much about how trust attestation works. :/
MateUserHHTT said:
It was Lenovo Feature Updater by the way, not the settings - system - update.
Click to expand...
Click to collapse
I disabled that as soon as I saw it
MateUserHHTT said:
If you share your past work in a git repo I will take a look at it. I'm no expert for sure but I'm developing fir android for some years and have stuck my nose a tiny bit under the surface of android rom development (1mm and it was very painful still).
Click to expand...
Click to collapse
Not much really, I'm not at my desk now but I extracted LenovoOTA from stock ROM and decompiled it with apktools, but even with online tools is probably ok.
Then I see two options:
Recompile that package changing package name and adding a log with full address and parameters or get the code that construct the URL and put it in a new app.
For you probably the last one is easier.
I went for a third I was trying to understand if i could get the data with adb or in files but I did not find documentation.
MateUserHHTT said:
My widewine lvl is L3. Any chance of resetting to L1 myself? I don't know much about how trust attestation works. :/
Click to expand...
Click to collapse
I don't think there is a way to force it, this widevine a thing is a pain.
MrCrayon said:
Is your bootloader unlocked or did you unlock it previously and relocked?
Click to expand...
Click to collapse
Locked, and was never unlocked before.
I tried to unlock now, but does not succeed with flashing sn.img.
Because I'm not interested on Custum ROM, I will leave it locked.
Do you know where the device certification is stored?
I unlocked without flashing sn.img. Does that make a difference?
Did you try monitoring the network traffic with wireshark?
Read carefully:This is a dedicated post for general questions only. If you need technical support about flashing or restoring your device, please use the general topic for TB132FU. Please search for your question below before asking.NEW: How to restore the lost Serial Number (on the second response)
How to flash Official global romDid my work help you? Be free to buy me a coffee. PayPal me at @alsbvg
FAQ:
Why so many versions of TB132FU and why so much confusion about the Android system, updates, etc?
There are currently 3 systems available for the tablet known as TB132FU and is really important to find which one you have.
Fake Global version - Modified Android 12
Official International version - Official Android 12 or latest by Lenovo international
Chinese version - Zui 14 based on Android 12 or latest by Lenovo China
But why so many versions then? The Chinese model is apparently cheaper than the international version, so Chinese sellers are selling online the Chinese model with a modified android version to look like the international version.
How to identify which version of TB132FU I have? By the seller:If you purchased your tablet online from china like on Aliexpress or from a seller that sells items from china, you most likely have the “Fake” Global version.
If you purchased your tablet on Lenovos’s website or a certified local or national seller in your country, you most likely have the International version. This version usually costs more.
If you purchased from china or anywhere else, but your tablet has a Chinese interface, you have the Chinese version running ZUI 14 or latest.
How to identify which version of TB132FU I have? By the system version:To make sure which one you have you can also do the following:
On your tablet go to SETTINGS > ABOUT DEVICE > and find your system version.
If it starts with TB132FU_S3 you have the Chinese version running an unofficial android version. The number S3 confirms it’s a modified OS. You will never get any updates.
If it says TB132FU_S0 you have the official international version. This is the official version, so you already have the best compatible system for your tablet. You will get official updates.
If you open the settings and see on the About device menu the system version ZUI, well you have the chinese official device and system.
Can I convert my Chinese TB132FU into the international version?The answer currently is no. Why? To keep it short: There is a code inside your tablet saying “This is the Chinese tablet” and because of this code you can't install the international android system. Maybe in the future, someone from the community will be able to find that code and change it so the tablet thinks it is the international version.
Can I convert my Official Lenovo-bought TB132FU to the Chinese version to use ZUI?Same as the answer above. We need to find the code and how to modify it first.
Can I use Lenovo’s Rescue and Smart Assistant software to convert my Chinese TB132FU into the international version?No. You will brick your device if you try to update your system using this tool.
What are the differences between the Chinese TB132FU and the International version?Chinese version with ZUI 14
Software: It comes with an Android flavor called ZUI currently based on android 12. Updates will be available.
System languages: English and Chinese only.
Full support for super fast charging with the original charger. Full charge in less than 90 minutes in most cases.
Computer mode: No longer available. The online community is pushing Lenovo to enable this option again.
HDR and L1 status: Fully functional HDR and L1 status for HD content on Netflix in most cases.
Chinese version with Fake global version
Software: It comes with a modified Android 12. No updates will be available.
System languages: All languages available.
Slow charging. Can take up to 3 hours to fully charge.
Computer mode: Available.
HDR and L1 status: Falty HDR on most apps. L1 status for HD content on Netflix.
Official International Version
Software: It comes with Android 12. Updates will be available by Lenovo.
System languages: All languages available.
Slow charging. Can take up to 3 hours to fully charge. (By some reports online) This information hasn't been confirmed yet as the community with the official international version is still small.
Computer mode: Available.
HDR and L1 status: Working HDR. L1 status for HD content on Netflix.
(Under construction)
How-tos and tutorials links:
How to install/restore ZUI on my fake global version?There are three options available. Please read all 3 below and decide which one you want to try.
OPTION ONE: If you are in a hurry and have technical knowledge download the file our community colleague @Fatperman managed to upload and install it using the SP flash tool. Thread here. A Step-by-step tutorial will be provided by another community member soon. A link will be provided once available.
OPTION TWO: If you are not in a hurry and don't have the technical knowledge to flash the system, there is an easier way, but it takes one or two days.
1 - Download Lenovo’s Rescue and Smart Assistant software here.
2 - Open the software and create an account. Connecting to Google is easier.
3 - Once connected to an account, find the SMALL blue FEEDBACK button on the right side bottom of your screen and click there.
4 - Put your email address and in COMMENTS write that you have problems flashing the Chinese version of TB132FU and that you would like to restore it to the original ZUI 14 software. PLEASE USE YOUR OWN WORDS.
5 - After one or two days (usually), INSIDE the software you will receive a response with instructions on how to install ZUI more easily. Note: You will not get a response via email, you will receive institutions inside Lenovo’s Rescue and Smart Assistant software.
The instructions are pretty simple. READ THEM carefully once you receive them. It's really easy. Basically, they will send you a link to download a special rescue tool and some credentials. Take a screenshot of the instructions as you will need to uninstall the official Rescue software and will lose the message.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Download and install the software they sent, enter using the temporary credentials (the credential are confidential and should not be shared), and follow the instructions on the screenshot you took. You will just need to turn off the tablet, click to restore, and connect the cable. After a few minutes, you will have the original ZUI 14 software.
Thanks again for the amazing help of our colleague @Fatperman for his exceptional work!
NEW - OPTION THREE:
This is by far the easist way to recover or flash the original ZUI 14 on our TB132FU. DON'T CLICK to Restore before reading all the steps.
Step 1: Download the original ZUI firmware here. Extract the files to a new folder. Password is on the table. Read carefully.
Step 2: Download and log in on the official rescue and smart assistant.
Step 3: Select to rescue your device and select as in the picture below:
Step 4: Click to download the firmware.
Step 5: Wait for the download to be completed until you see START Rescue. But don't click there yet. Don't close the program.
Step 6: Click the donwloads icon at the top and identify the folder where the download was saved.
On mine it was saved at C:\ProgramData\RSA\Download\RomFiles
Step 7: Access and Open the folder of the downloaded firmware and DELETE all files there, but don't delete the folder.
Step 8: Go to the ZUI firmware you downloaded before and copy all files inside the folder. Paste them inside the folder where you just deleted all files.
It should look something like this:
Step 9: TURN OFF YOUR TABLET and Go back to the rescue tool and now click the blue button Start Rescue. Follow the instructions on your screen.
Wait for the tablet to restar and DONE. You recovered or donwloaded the original ZUI on your tablet.
How to debloat my recently installed ZUI 14 and remove the Chinese apps and make it look better?1 - After starting your device, select English and connect to your wifi network.
2 - Once you are set, press the home screen for 3 seconds. Click Desktop Settings.
Switch off the "Left one screen".
Change to "Drawer Style"
3 - Find the setting button and go to General Settings > Language & input > Current Keyboard. Change it to English. (You can download Gboard or another keyboard later)
4 - Go back to the original setting screen and click on the search box. Search for google play services. Click to enable. Then search for Google Play Store and enable it as well.
5 - Before opening the Play store and connecting to your account, go to Apps management and uninstall any apps with Chinese characters you may find. Do not uninstall the HD browser just yet in case you need to download something later. Then restart your device.
6 - Open the Google Play store, and connect your account. Now you can update and download all your apps.
(If you see an error saying Google can't connect please follow the steps in this tutorial)
7 - Unistall HD Browser and done.
How to ROOT my TB132FU running ZUI 14?DISCLAMER: You will lose your data, so backup. It can brick your device if you don't know what to do. You need to know how to use ADB and fastboot commands. The tutorial is for advanced users that knows how to use ADB. Do your research first. If anything goes wrong, flash the ZUI firmware again.
For this tutorial you will need:
Windows computer with all necessary drivers installed
Know how to use ADB
The latest MAGISK manager app.
The latest ZUI firmware for TB132FU
Some minutes to complete all the steps.
Step 1: Go to SETTINGS Menu and click multiple times on your ZUI version. This will give you Developer access.
Step 2: Go General Settings menu > Developer options
Step 3: Click to enable OEM unlocking, also enable debugging mode.
Step 4: Connect your USB cable and run the following command:
adb reboot bootloader
Step 5: Run the fllowing command:
fastboot flashing unlock
On your tablet Click volume UP to unlock your bootloader
Wait for the confirmation on the tablet screen
Step 6: Run command:
fastboot reboot
This will make your tablet restart. Skip all configuarion steps on your tablet and install the latest version of MAGISK on your tablet.
Step 7: On your computer, go to the Firmware folder and copy the file boot.img to your tablet.
Step 8: Open MAGISK and click Select and patch a file. Find the boot.img you copied and patch this file. Wait for the process to be completed.
Step 9: Connect your tablet to your computer and access the folder Downloads in your tablet. There you will see a new boot image Magisk created. Rename that file to boot.img
Step 10: This is the most important step. You will now flash this boot.img file using the following commands:
adb reboot bootloader - to reboot to fastboot
fastboot flash boot boot.img
Wait for it to complete then:
fastboot reboot
Done, your tablet is now rooted. You can install Magisk again and root checker to make sure.
How to UNLOCK the bootloader of my TB132FU running ZUI 14?This will delete all you data
Step 1: Go to SETTINGS Menu and click multiple times on your ZUI version. This will give you Developer access.
Step 2: Go General Settings menu > Developer options
Step 3: Click to enable OEM unlocking, also enable debugging mode.
Step 4: Connect your USB cable and run the following command:
adb reboot bootloader
Step 5: Run the fllowing command:
fastboot flashing unlock
On your tablet Click volume UP to unlock your bootloader
Wait for the confirmation on the tablet screen
Step 6: Run command:
fastboot reboot
Done! Your bootloader is now unlocked.
How to Install and use GOOGLE PLAY on my TB132FU running ZUI 14?First you have to download and install a compatible Google Framework app. Got to APKmirror and search for google framework. Click the one that says Google Services Framework 12. Scroll down and find the version "December 17, 2021 GMT-0300". Install this version. Only this or older version will work. Do not try a different one. It will update automatically eventually.
Then go to settings and search for Google Play and enable the app. Done. You can now log in and use the PLay Store
How to RESTORE lost S/N Seria number?
Step 1 - Go back to ZUI 14. Use one of the options provided in this thread.
Step 2 - Unlock bootloader and OEM. Please refer to the tutorial to unlock the bootloader in this thread.
Step 3 - Once your bootloader is unlocked go and install on your computer MTK META Utility. Link here. Also install HxD here.
Step 4 - Turn off your tablet, disconnect the USB cable and open MTK META.
Step 5 - Click the option Dump NV region. Wait for it to finish reading. It will open a folder.
Step 6 - On the folder that opened, right-click with your mouse the file proinfo.bin and click to open with HxD, or open the software and drag and drop the file there.
Step 7 - Edit the proinfo.bin to add your Serial Number. Change the 12345ABCDE you see to your actual S/N. It's on the back of your tablet on a small sticker.
Step 8 - On the same folder press SHIFT on your keyboard and right-click on an empty space and click OPEN CMD/SHELL terminal here. Or if you use a ADB folder, copy the proinfo.bin file to it so you can flash it.
Step 9 - Turn on your tablet, make sure Debugging is active, connect your tablet to the computer and send these two commands:
adb reboot bootloader
(this will reboot your tablet to fastboot although the line says bootloader)
Once you see the red lines send the command:
fastboot flash proinfo proinfo.bin
And done. You can check in your setting menu if your serial number changed.
Now you can reflash ZUI or the global rom.
thanks man
Great job !
als_bvg said:
How to debloat my recently installed ZUI 14 and remove the Chinese apps and make it look better?
4 - Go back to the original setting screen and click on the search box. Search for google play services. Click to enable. Then search for Google Play Store and enable it as well.
5 - Before opening the Play store and connecting to your account, go to Apps management and uninstall any apps with Chinese characters you may find. Do not uninstall the HD browser just yet in case you need to download something later. Then restart your device.
6 - Open the Google Play store, and connect your account. Now you can update and download all your apps.
(If you see an error saying Google can't connect please follow the steps in this tutorial)
7 - Unistall HD Browser and done.
(Under construction)
Click to expand...
Click to collapse
bro im on zui14 and uninstall all apps, i download the google services and play store but cant still connecting to google account, i dtryed the google installer and stay on 3%... any help?
did it, first intall google services framwork, then google play and restart before log in
Hi can you please guys share the Chinese version of the Lenovo RSA no need for the personal credentials, I tried too contact them as you said but I haven't received any answers thanks
Swanzzl said:
Hi can you please guys share the Chinese version of the Lenovo RSA no need for the personal credentials, I tried too contact them as you said but I haven't received any answers
Click to expand...
Click to collapse
I don't think there's a Chinese version of the software. The credentials are needed. They may be off for the holidays so you will need to wait. Hopefully someone gets back to you during this week. Otherwise I would recommend writing again.
after install zui14 my device show message "orange state" in boot, I can't update even with vpn.
can i lock bootloader after installing zui14 in chinese version? how to proceed?
Yes you can. If anything goes wrong you can do everything again. I Unlocked the bootloader and tried flashing a recovery, bricked the tablet and used the tool to fix again.
ednardo777 said:
after install zui14 my device show message "orange state" in boot, I can't update even with vpn.
can i lock bootloader after installing zui14 in chinese version? how to proceed?
Click to expand...
Click to collapse
als_bvg said:
5 - After one or two days (usually), INSIDE the software you will receive a response with instructions on how to install ZUI more easily. Note: You will not get a response via email, you will receive institutions inside Lenovo’s Rescue and Smart Assistant software.
Click to expand...
Click to collapse
Where do I find the instructions in the software? Do they appear as a notification? p.s. I sent the message (feedback) two days ago and still haven't received a answer.
als_bvg said:
Sim você pode. Se algo der errado, você pode fazer tudo de novo. Desbloqueei o bootloader e tentei fazer uma recuperação, bloqueei o tablet e usei a ferramenta para consertar novamente.
Click to expand...
Click to collapse
thanks man
eamcardoso said:
Where do I find the instructions in the software? Do they appear as a notification? p.s. I sent the message (feedback) two days ago and still haven't received a answer.
Click to expand...
Click to collapse
It will popup as a notification inside the rescue tool. They might be off for the holidays. I'll share another method tonight.
Third method on how to flash ZUI or restore the tablet added to the FAQ. Enjoy! Also Tutorial on how to root the device.
als_bvg said:
Third method on how to flash ZUI or restore the tablet added to the FAQ. Enjoy! Also Tutorial on how to root the device.
Click to expand...
Click to collapse
This method worked for me thanks bro
After unlocking the bootloader every time you boot up the device the following text will be displayed on the screen:
Code:
Orange State
Your device has been unlocked and can't be trusted..
Your device will boot in 5 seconds
To remove this text warning and 5s delay you need to change the file "lk.img" (firmware folder):
Open "lk.img" with a hex editor (for example, HxD)
In menu toolbar click "Search-Find" and select "Hex-values" tab.
Search 08 B5 0E 4B 7B 44 1B 68 1B 68 02 2B
Copy text 08 B5 00 20 08 BD 1B 68 1B 68 02 2B
Return back to hex editor window then right click on the highlighted items and select "Paste Insert"
The newly modified 24 characters will be displayed in red
Click "File" and select "Save".
Flash the modified "lk.img" in fastboot mode
fastboot flash lk lk.img
ZUI_14.0.691
The firmware already includes Google Services Framework.
/system/system_ext/priv-app/GoogleServicesFramework/GoogleServicesFramework.apk
com.google.android.gsf - version 12-7567768
It is disabled by default.
When you turn on "Settings - Apps management - Google Basic Services" the application status changes to enabled (installed).
ug0o said:
After unlocking the bootloader every time you boot up the device the following text will be displayed on the screen:
Code:
Orange State
Your device has been unlocked and can't be trusted..
Your device will boot in 5 seconds
To remove this text warning and 5s delay you need to change the file "lk.img" (firmware folder):
Open "lk.img" with a hex editor (for example, HxD)
In menu toolbar click "Search-Find" and select "Hex-values" tab.
Search 08 B5 0E 4B 7B 44 1B 68 1B 68 02 2BView attachment 5799489
Copy text 08 B5 00 20 08 BD 1B 68 1B 68 02 2B
Return back to hex editor window then right click on the highlighted items and select "Paste Insert"View attachment 5799501
The newly modified 24 characters will be displayed in redView attachment 5799503
Click "File" and select "Save".
Flash the modified "lk.img" in fastboot mode
fastboot flash lk lk.img
Click to expand...
Click to collapse
Nice work! Do you have any idea where the code for text on the picture below might be? Technically, if we are able to find this code and modify it, it should allow us to use the Offical Global rom. I tried to replicate these steps and these steps with no success. I can flash the image using fastboot but the message doesn't disappear.
Protip: The version TB132FU_USR_S000034_2206180119_MPR0_ROW allows the bootloader to remain unlocked. Useful for tests with the Global version
While the version "TB132FU_USR_S000089_2210200620_MPR0_ROW" will lock the bootloader and the commands to unlock will not work.
Let me know if you have any insights.
als_bvg said:
Protip: The version TB132FU_USR_S000034_2206180119_MPR0_ROW allows the bootloader to remain unlocked. Useful for tests with the Global version
While the version "TB132FU_USR_S000089_2210200620_MPR0_ROW" will lock the bootloader and the commands to unlock will not work.
Click to expand...
Click to collapse
I had TB132FU_S000034_220618_ROW installed.
I flashed ZUI 14.0.691.
And now I can't flash any firmware through the flashtool. I can't flash my backup of TB132FU_S000034_220618_ROW.
That's why I'm still on the ZUI 14.0.691.
I'm getting used to it
ug0o said:
I had TB132FU_S000034_220618_ROW installed.
I flashed ZUI 14.0.691.
And now I can't flash any firmware through the flashtool. I can't flash my backup of TB132FU_S000034_220618_ROW.
That's why I'm still on the ZUI 14.0.691.
I'm getting used to it
Click to expand...
Click to collapse
Awesome. Just a note: The fake global was TB132FU_S300062_220921_ROW, and the version we could use to try removing the code is TB132FU_USR_S000034_2206180119_MPR0_ROW. This version is flashable via the Third method on the FAQ. I tried to flash a backup using the Flash Tool and even splitting the dump using Wwr MTK tool and using the third flashing method, but no success with the backup either.
But If we manage to locate the 'Incompatible software' code we could use an official ROM.