Post Reply Subscribe to Thread Email Thread

How-To: Unlock and Root the HP Slate 8 Pro

17th December 2013, 07:46 AM   |  #1  
OP Senior Member
Thanks Meter: 206
 
799 posts
Join Date:Joined: Feb 2011
This is revision 1.5. It works on both currently available HP firmware releases,
1.00.05 and 1.00.08. If you upgrade from '05 to '08 you will need to re-root.

Both releases are Android 4.2 - if there's a 4.3, the method will change.

At a high level, the steps are:

- OEM unlock your bootloader using the Shield naked drivers developed by 1wayjohnny
- boot your device using a CWM originally developed for the Transformer 701 by Drgravy
- on rebooting the CWM, it will offer to root your system. Do so.
- install SuperSU or another SU manager.
- Done.

Prerequisites:

- Willingness to wipe your Slate 8's user memory - this willl happen during the process of unlocking, and, not by accident.
- Android SDK tools from Google
- Java (IIRC, the SDK is looking for 32 bit Java 1.6)
- 1wayjonny's "Naked USB Driver" from the Shield forum on XDA http://forum.xda-developers.com/show....php?t=2386956
- Drgravy's Clockwork 6.0.3.7 for the TF 701 available at http://forum.xda-developers.com/show....php?t=2524401
- a microSD card and a copy of the update.zip file from HP's website, to attempt a recovery if you hose your device.

I: Preparing ADB on the PC

Download and install the SDK tools. You don't need every single thing the SDK manager offers to fetch; just the minimum to get functioning ADB support, which is the platform tools package.

Put the ADB command set into your PATH variable. In Windows, do this by using the system settings tool, Advanced... Environmental Variables.. System Variables. Scroll down until you see 'PATH" click the Edit button and append the path to the directory with the ADB.EXE and FASTBOOT.EXE files in it.

In win 7, that path is C:\Users\username\AppData\Local\Android\android-sdk\platform-tools\

Next, find the .android environment folder on your computer. In win7, it is
C:\Users\username\.android

You need to create a adb_usb.ini file here that contains the vendor ID string for your Slate.

The value is
0x03F0

Reboot your PC and be sure that from a command prompt, typing adb start-server results in

* daemon not running. starting it now on port 5037 *
* daemon started successfully *

II Enabling ADB in Android

Go to your device and tap on the build number field 8 times (in System.. About Tablet)

That enables developer mode. In the new developer options menu that is now available, tick "enable USB debugging"

III Installing and Testing the Drivers to Talk to Your Device via ADB

Download and install the Naked driver.

Connect your Slate to your USB port. You should get an unknown device followed by a failure to install driver message. Right-click on the device and manually install the ADB composite driver from the Naked driver android_winusb.inf file, choosing the nvidia shield as your device. You will get a warning that the driver is unsigned.

Once the driver is installed, open a command prompt and type
adb devices

You should get

List of devices attached
CND34609YG device

IV Unlock the Bootloader

Now type

adb reboot-bootloader

Your device restarts. A screen shows up all black with white lettering; this screen is telling you your boot loader is locked

Go to device manager; you should have a new device without a driver.

Navigate to the Naked driver folder and manually install the driver from the android_apxusb.inf file.

(that is, not the file you installed the regular ADB driver using)

Install the Shield fastboot driver.

At the command prompt, type
fastboot -i 0x03F0 oem unlock

The display on your Slate should change, warning you that you're about to void the warranty and erase all data on your device.

Use the volume up and volume down key to navigate the menu that comes up on your slate and choose "unlock."

This will erase all data on your Slate, and reinstall existing /system apps. It will not remove /system apps you shouldn't have put there in the first place!

Let your device restart and rerun its setup routine.

V Rooting the device

Connect the USB cable to the fully booted device. Open a command prompt and navigate to the directory the Clockwork recovery is downloaded to.
type
adb reboot-bootloader

At the bootloader screen, use the volume down button to select "Fastboot Protocol" and press the power button once

Now, type

fastboot -i 0x03F0 boot recovery.img

The command prompt will tell you how long it took to download the recovery; the display will
tell you it is booting from the donwloaded image.

Give it a minute or two, and your device will boot into clockwork.

Choose reboot.

Clockwork will notice that you are not rooted, and offer to drop su into /system for you.

It will also offer to disable the onboard recovery system from updating. You probably don't want to do so until
- you've backed up the recovery partition
- you've decided to install Clockwork permanently.

V Reinstalling HP software using Clockwork

This is fairly simple to do. You need to have booted into Clockwork and to have a copy of one of the HP zip files that contains a full software update, available from HP.

Those HP files are flashable in clockwork with a little editing:

To get the recovery to install, I found I needed to edit the recovery script from HP a bit:

- unzip the recovery
- navigate to

\update\META-INF\com\google\android

Open the updater-script in a text editor

delete the first few lines:

assert(!less_than_int(1381289516, getprop("ro.build.date.utc")));
assert(getprop("ro.product.device") == "fig" ||
getprop("ro.build.product") == "fig");
assert(getprop("ro.product.name") == "kadota_w_a");

those values were not being retrieved and that stopped the update from flashing.

Save updater-script

Re-zip everything below \\update\

Verify that your zipfile is structured correctly, ie, at the top level you have
- meta-inf
- recovery
- system
- blob
- boot.img

You can then put your update.zip on an sdcard and navigate to it in Clockwork (only the volume up key works for navigation as of now) or get into the advanced menu in Clockwork and do an adb sideload.
Last edited by roustabout; 5th February 2014 at 06:42 AM.
The Following 6 Users Say Thank You to roustabout For This Useful Post: [ View ]
18th December 2013, 01:38 PM   |  #2  
Junior Member
Thanks Meter: 2
 
17 posts
Join Date:Joined: Mar 2010
Successfully rooted and bootloader unlocked.

Ta muchly.

23rd December 2013, 10:37 PM   |  #3  
Junior Member
Thanks Meter: 0
 
1 posts
Join Date:Joined: Dec 2013
Updated to 1.0.8 by accident
Unfortunately, I updated my slate 8 pro to 1.0.8 by accident and now have lost my root. Is there a way to revert back to 1.0.5 or is there a method of rooting 1.0.8 yet?

Thanks for the help!
23rd December 2013, 11:32 PM   |  #4  
OP Senior Member
Thanks Meter: 206
 
799 posts
Join Date:Joined: Feb 2011
boomboom, I'm in the same boat right now.

The possibilities are:
- figure out how to get the nvidia shield / note 7 boot and root image to work on our devices
- come up with a new exploit allowing root (keep looking for Cydia updates)
- try to force the recovery boot and reload the '05 firmware via recovery.

I was not able to get that to work this weekend and am now looking into linux boot a la the gnurou disks.

The 1.00.05 files are up on the HP site still, as a zip file at
http://h10025.www1.hp.com/ewfrf/wc/s...t=6608624#N147

supposedly you can place that zip (be sure it's called update.zip) on an sdcard, power your device off, put the sdcard in, and power on while holding volume down.

In the menu that comes up, use the volume down button to highlight "recovery kernel" and click the power button to start recovery.

I was not able to get this technique to restore my device to '05 but hope others have better luck.

Part of my problem was not realizing that even though the recovery looks as if nothing is happening, if you leave it alone long enough, the device eventually restarts, implying that there may be a recovery process going on which is just impossible to monitor.

If that's true, the recovery is installing the update again regardless of what's on the card, though.
24th December 2013, 10:53 PM   |  #5  
Senior Member
Thanks Meter: 125
 
664 posts
Join Date:Joined: Apr 2012
thats a lot of info. thanks for posting it
28th December 2013, 09:15 AM   |  #6  
Junior Member
Thanks Meter: 2
 
17 posts
Join Date:Joined: Mar 2010
Damn. Through sheer blind luck my 1.00.08 update failed when I tried it... Makes me wonder what was different between our tablets for mine to fail and yours to update?

UPDATE:

In case anyone else is stuck rooted on 1.00.05 like I have been... here's what I found with my limited experience/knowledge of this kinda stuff. So my 1.00.08 update failed because I removed some of the system apps - which meant that the 'assert' commands were failing in the 'updater-script'. Luckily, I kept a backup of all the ones I removed. Putting them back in the system and then re-flashing the 1.00.08 update zip via CWM recovery and rooting via the OP's method worked. Now on rooted 1.00.08.
Last edited by kenneth2008; 30th December 2013 at 01:52 PM.
30th December 2013, 04:46 PM   |  #7  
Junior Member
Thanks Meter: 2
 
24 posts
Join Date:Joined: Feb 2008
Quote:
Originally Posted by kenneth2008

Damn. Through sheer blind luck my 1.00.08 update failed when I tried it... Makes me wonder what was different between our tablets for mine to fail and yours to update?

UPDATE:

In case anyone else is stuck rooted on 1.00.05 like I have been... here's what I found with my limited experience/knowledge of this kinda stuff. So my 1.00.08 update failed because I removed some of the system apps - which meant that the 'assert' commands were failing in the 'updater-script'. Luckily, I kept a backup of all the ones I removed. Putting them back in the system and then re-flashing the 1.00.08 update zip via CWM recovery and rooting via the OP's method worked. Now on rooted 1.00.08.

Sorry, but i didn't get it...
i thought after updating a rooted 1.00.05 to 1.00.08 the root is lost?
30th December 2013, 06:43 PM   |  #8  
OP Senior Member
Thanks Meter: 206
 
799 posts
Join Date:Joined: Feb 2011
Take a look at the update in the first post. '08 is now rootable.

There is a CWR originally written by Drgravy for the TF701 which will boot the Slate 8 as well.

It's a fully functional CWR, lets you flash zips and the whole nine yards.

It also sees if you're not rooted and offers to fix it for you.

I borked my partition table completely. I just finished repairing it and getting the OS reinstalled. I'll detail that tomorrow, but if anyone is willing to share what a "stock" layout looks like, I'd love to see one.

Very short version: image the damaged internal memory. Repair gpt in linux. Reimage back to device. Assign correct names using gdisk. Reinstall OS using CWR.

the output from these commands would be great:

mount
cat /proc/mounts
cat /proc/partitions

and one other - this one requires grabbing a copy of a utility called gptfdisk and running it. (It's fdisk for gpt based disks; like fdisk, it does not commit changes without asking.)

http://dl.dropbox.com/u/64885133/gptfdisk.zip is where the file lives (originally compiled by meghd00t)

Copy gdisk to your device and make it executable

adb push gdisk /system/bin/gdisk
adb shell
# chmod 777 gdisk

invoke by
# gdisk /dev/block/mmcblk0

then

p for print

On a nexus 7, the output looks like this:

root@flo:/ # gdisk /dev/block/mmcblk0
gdisk /dev/block/mmcblk0
GPT fdisk (gdisk) version 0.8.4

Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): p
p
Disk /dev/block/mmcblk0: 60424192 sectors, 28.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 98101B32-BBE2-4BF2-A06E-2BB33D000C20
Partition table holds up to 32 entries
First usable sector is 34, last usable sector is 60424158
Partitions will be aligned on 2-sector boundaries
Total free space is 1526010 sectors (745.1 MiB)

Number Start (sector) End (sector) Size Code Name
1 131072 306143 85.5 MiB 0700 radio
2 393216 399359 3.0 MiB FFFF modemst1
3 399360 405503 3.0 MiB FFFF modemst2
4 524288 554287 14.6 MiB 8300 persist
5 655360 656919 780.0 KiB FFFF m9kefs1
6 656920 658479 780.0 KiB FFFF m9kefs2
7 786432 787991 780.0 KiB FFFF m9kefs3
8 787992 794135 3.0 MiB FFFF fsg
9 917504 920503 1.5 MiB FFFF sbl1
10 920504 923503 1.5 MiB FFFF sbl2
11 923504 927599 2.0 MiB FFFF sbl3
12 927600 937839 5.0 MiB FFFF aboot
13 937840 938863 512.0 KiB FFFF rpm
14 1048576 1081343 16.0 MiB FFFF boot
15 1179648 1180671 512.0 KiB FFFF tz
16 1180672 1180673 1024 bytes FFFF pad
17 1180674 1183673 1.5 MiB FFFF sbl2b
18 1183674 1187769 2.0 MiB FFFF sbl3b
19 1187770 1198009 5.0 MiB FFFF abootb
20 1198010 1199033 512.0 KiB FFFF rpmb
21 1199034 1200057 512.0 KiB FFFF tzb
22 1310720 3031039 840.0 MiB 8300 system
23 3031040 4177919 560.0 MiB 8300 cache
24 4194304 4196351 1024.0 KiB FFFF misc
25 4325376 4345855 10.0 MiB FFFF recovery
26 4456448 4456463 8.0 KiB FFFF DDR
27 4456464 4456479 8.0 KiB FFFF ssd
28 4456480 4456481 1024 bytes FFFF m9kefsc
29 4587520 4587583 32.0 KiB FFFF metadata
30 4718592 60424158 26.6 GiB 8300 userdata

thanks very much. If you're willing to post here, great; if you want to discuss offline, PM me?
Last edited by roustabout; 31st December 2013 at 09:34 AM.
31st December 2013, 01:27 PM   |  #9  
Junior Member
Thanks Meter: 2
 
24 posts
Join Date:Joined: Feb 2008
Hi roustabout,
due to the fact that I'm not sure which part of your OP step by step guide relates to 1.05 and which to 1.08 I will wait for your update.
In the meantime I prepared my PC with and unlocked the bootloader.

Everything is installed and working, so I'm ready for your instructions

Big Thanx for your work !!!
31st December 2013, 06:12 PM   |  #10  
OP Senior Member
Thanks Meter: 206
 
799 posts
Join Date:Joined: Feb 2011
Quote:
Originally Posted by heino69

Hi roustabout,
due to the fact that I'm not sure which part of your OP step by step guide relates to 1.05 and which to 1.08 I will wait for your update.
In the meantime I prepared my PC with and unlocked the bootloader.

Everything is installed and working, so I'm ready for your instructions

Big Thanx for your work !!!

You're ready - the OP is updated. The CWM method using Drgravy's CWM works to root both the '05 and '08 releases.

fastboot -i 0x03F0 boot recovery.img will boot you up into Clockwork and once you choose reboot it'll offer to root for you.

Post Reply Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes