Question Huawei Mediapad t3 7

[dorpmuller]

Hello folks,

Bought a Mediapad T3 7 from Walmart recently. Has anyone found root yet? I tried all of the Kingroot, etc. APK's so far. Don't waste your time. Tried them all.

If our magicians here can find root, I'd love it!

Thanks,

Rich

 

[n3r0b0l]

i have a similar problem, i fail to solve it

 

[tek3195]

add

i have a similar problem, i fail to solve it

It looks like the bootloader is locked. Run "fastboot getvar all" or better yet do "fastboot oem get-bootinfo" without the quotation marks. that will tell you if locked or not. If unlocked it may be because of security patch. I don't know if recovery is flashable or not but you can try twrp.img in this thread. If recovery flashes then you can flash boot from it. Everything in twrp.img works. USB-OTG does not work but it isn't supposed to. Put it in trying to make it work but original twrp.img I used had it uncommented. Up to you.

https://drive.google.com/file/d/1JQiX5_Y35zUDi4DfZ-0ulZuSVpcMPify/view?usp=sharing

 

[n3r0b0l]

not work,bootloader is locked ,the same mistake,thanks anyway...

tried with TWRP

 

[megaraider]

Unbrick Huawei Mediapad T3 7 Wi-Fi [BG2-W09]

My device is stuck on Huawei Mediapad logo.
It became like that for no apparent reason, just turned it on one day and it is stuck there [Image].

https://xdaforums.com/picture.php?albumid=15861&pictureid=59511

Even worst it is OEM locked (bootloader locked) and FRP locked.
I should have known better before this happened…!

I do not own any JTAG box neither I can afford to buy one.
Furthermore Huawei support store charges, at least, a quarter of a new device price!
My last hope is to use a salvaged USB Memory Stick to JTAG the eMMC, but I have no clue where the needed signals are located on the circuit board.
Does anyone know?

BG2-W09 Mainboard Front Image

https://xdaforums.com/picture.php?albumid=15861&pictureid=59505

BG2-W09 Mainboard Front Uncovered Image

https://xdaforums.com/picture.php?albumid=15861&pictureid=59507

BG2-W09 Mainboard Back Image

https://xdaforums.com/picture.php?albumid=15861&pictureid=59509

Moreover, i've tried several SP Flash Tool versions, but because the authentication file is nowhere to be found,
it immediately throws an error “S_AUTH_HANDLE_IS_NOT_READY (5000)” [Image].

https://xdaforums.com/picture.php?albumid=15861&pictureid=59527

Help and other ideas are welcome, thanks.

 

[tek3195]

My device is stuck on Huawei Mediapad logo.
It became like that for no apparent reason, just turned it on one day and it is stuck there [Image].


Even worst it is OEM locked (bootloader locked) and FRP locked.
I should have known better before this happened…!

I do not own any JTAG box neither I can afford to buy one.
Furthermore Huawei support store charges, at least, a quarter of a new device price!
My last hope is to use a salvaged USB Memory Stick to JTAG the eMMC, but I have no clue where the needed signals are located on the circuit board.
Does anyone know?

BG2-W09 Mainboard Front Image

BG2-W09 Mainboard Front Uncovered Image

BG2-W09 Mainboard Back Image


Moreover, i've tried several SP Flash Tool versions, but because the authentication file is nowhere to be found,
it immediately throws an error “S_AUTH_HANDLE_IS_NOT_READY (5000)” [Image].


Help and other ideas are welcome, thanks.

Can you get into fastboot?

---------- Post added at 11:41 PM ---------- Previous post was at 11:40 PM ----------

If you can get into fastboot there is a way to flash images with a locked bootloader. It only cost a few bucks and I still have twrp for it. In fact I think there's a link to twrp in this thread.

Another thought is have you tried dload with update.app from sdcard ?

 

[megaraider]

Can you get into fastboot? If you can get into fastboot there is a way to flash images with a locked bootloader. It only cost a few bucks and I still have twrp for it. In fact I think there's a link to twrp in this thread.

Another thought is have you tried dload with update.app from sdcard ?

Can't get into fastboot, unfortunately. Is there any other way to flash / boot from that twrp image?
Yes i've tried to force it into update mode from the sdcard without any luck

 

[tek3195]

Can't get into fastboot, unfortunately. Is there any other way to flash / boot from that twrp image?
Yes i've tried to force it into update mode from the sdcard without any luck

Had another thought, have you tried sdcard method connected to pc? If I remember correctly I used the three buttons and immediately plugged usb in to pc which would take me straight to e-recovery. That was how I was getting to twrp when I had both recoveries on mine. From there you should be able to get to recovery or possibly be able to use adb in recovery mode. If you're on a windows machine pull up device manager so you can see what its doing. You may have to hold the buttons down for quite a good bit, it took probably between 3 ~ 5 minutes once for mine to respond. Device manager will give you an idea of what's going on and if you watch it cycle thru ports more than 10 times I wouldn't keep holding them. I said if I remember correctly which I may not have. If three buttons then plug in doesn't work try it with power and volume up plugging in immediately after pressing and holding, again 3~5 minutes. Make sure you have update.app in dload folder on sdcard. One of those firmware packages I gave you should have the update.app in it. In that package should be a bunch of documentation you will need to run thru a translator, but one is about unbricking with both update.app and the other file that everybody always leaves out. The instructions for renaming and process for applying the two are in on of those files. If you cant find that in package let me know and I'll dig it out as I'm not sure which one it was in.

 

[megaraider]

Make sure you have update.app in dload folder on sdcard. One of those firmware packages I gave you should have the update.app in it. In that package should be a bunch of documentation you will need to run thru a translator, but one is about unbricking with both update.app and the other file that everybody always leaves out. The instructions for renaming and process for applying the two are in on of those files. If you cant find that in package let me know and I'll dig it out as I'm not sure which one it was in.

Went thru the documentation, couldn't get any other information on "and the other file that everybody always leaves out.".
Could it be you were referring to the files located under the SDcard\dload\hw folder? (Those i've included)
Due to location, and version installed i'm using:
BG2-W09C100B009CUSTC100D001 Firmware 6.0.0 r1 EMUI4.1 05014LEW

 

[tek3195]

Went thru the documentation, couldn't get any other information on "and the other file that everybody always leaves out.".
Could it be you were referring to the files located under the SDcard\dload\hw folder? (Those i've included)
Due to location, and version installed i'm using:
BG2-W09C100B009CUSTC100D001 Firmware 6.0.0 r1 EMUI4.1 05014LEW

Well I don't know how I can get those files from my source of unfortunate choice. When I paid for account they didn't have their stuff encrypted or passwd protected. Now they do and you have to use their hack job extractor that you have to turn of anti-virus to use. I now have to figure a way to access all of it as winrar shows the true 11 files inside but cant open without password. EF extractor that is supposed to open it does so by giving one file, the other 10 aren't hidden anywhere I can find. They just aren't there after extraction and winrar is not wrong because atool shows same in linux. Plus I had them at one time when I could access them anyway. They seem to have been important because one of them was for un-bricking and involved renaming the update_data_hw_region.app and the order in which you have to flash them.
The 'and the other file that everybody always leaves out' was because I wasn't looking at it at that moment to know exact name, it is the only other file needed when using update via sdcard and I don't like guessing at file names because it can get bad rather quickly when of by 1 character.
You have yet to tell me what your tablet is being recognized as or how it is being seen by PC. That will tell you what mode it is in which determines what options you have available in communicating with it.

 

[megaraider]

Well I don't know how I can get those files from my source of unfortunate choice. When I paid for account they didn't have their stuff encrypted or passwd protected. Now they do and you have to use their hack job extractor that you have to turn of anti-virus to use. I now have to figure a way to access all of it as winrar shows the true 11 files inside but cant open without password. EF extractor that is supposed to open it does so by giving one file, the other 10 aren't hidden anywhere I can find. They just aren't there after extraction and winrar is not wrong because atool shows same in linux. Plus I had them at one time when I could access them anyway. They seem to have been important because one of them was for un-bricking and involved renaming the update_data_hw_region.app and the order in which you have to flash them.
The 'and the other file that everybody always leaves out' was because I wasn't looking at it at that moment to know exact name, it is the only other file needed when using update via sdcard and I don't like guessing at file names because it can get bad rather quickly when of by 1 character.

Did some digging on renaming the update_data_hw_eu.app but all i could find was not Mediatek related, but rather HiSilicon or Qualcomm.
Related links:

[URL="https://xdaforums.com/p9/how-to/huawei-p9-rollback-package-eva-l09-t3497882"]HUAWEI P9 Rollback Package (EVA-L09, from An…[/URL]
[URL="https://xdaforums.com/mate-8/general/how-to-install-nxt-l29c432b560-official-t3540042/page39/page39"]How to install NXT-L29C432B560 (Official)[/URL]
[URL="https://xdaforums.com/mate-8/general/guide-root-nougat-mate-8-phh-superuser-t3570898/page16"][GUIDE]FULL ROOT Nougat Mate 8[/URL]
[URL="https://xdaforums.com/p9-plus/development/rom-stock-firmware-c636b130-t3414711/page12"][ROM] Huawei P9 Plus Stock Firmware Thread[/URL]
[URL="https://xdaforums.com/p9/development/rom-stock-rom-eva-l19c636b168-t3419586/page42"][Warehouse] All Stock Firmware Huawei P9
[/URL]

Just to make sure even tried out renaming update_data_hw_eu.app and place it under the 2 new locations on the SDCard, like this:

/dload/UPDATE.APP
/dload/hw/eu/update_data_hw_eu.app
/dload/dt/default/update_data_dt_default.app
/dload/hw/normal/update_data_hw_normal.app

but without any success :crying:

You have yet to tell me what your tablet is being recognized as or how it is being seen by PC. That will tell you what mode it is in which determines what options you have available in communicating with it.

Under Windows:

Event Type	Event Time	Device Name					Description								Device Type		Drive		V.ID	P.ID	Serial Number	Vendor Name		PName	FWRev	USB Class	USB SubClass	USB Protocol	
Plug	2019.11.27 00:48:19	Port_#0002.Hub_#0001	MediaTek USB Port						Communication	COM14		0e8d	0003					MediaTek Inc.	MT6227 phone	1.00	02		02			01	
Unplug	2019.11.27 00:48:24	Port_#0002.Hub_#0001	MediaTek USB Port						Communication	COM14		0e8d	0003					MediaTek Inc.	MT6227 phone	1.00	02		02			01	
Plug	2019.11.27 00:48:26	Port_#0002.Hub_#0001	MediaTek USB Port						Communication	COM14		0e8d	0003					MediaTek Inc.	MT6227 phone	1.00	02		02			01	
Unplug	2019.11.27 00:48:29	Port_#0002.Hub_#0001	MediaTek USB Port						Communication	COM14		0e8d	0003					MediaTek Inc.	MT6227 phone	1.00	02		02			01	
Plug	2019.11.27 00:48:30	Port_#0002.Hub_#0003	MediaTek PreLoader USB VCOM (Android)	CDC Data		COM15		0e8d	2000					MediaTek Inc.					1.00	0a		00			00	
Unplug	2019.11.27 00:48:33	Port_#0002.Hub_#0003	MediaTek PreLoader USB VCOM (Android)	CDC Data		COM15		0e8d	2000					MediaTek Inc.					1.00	0a		00			00	
Plug	2019.11.27 00:49:05	Port_#0002.Hub_#0003	Android Composite ADB Interface			Vendor Specific				0e8d	201c	0123456789ABCDEF MediaTek Inc.					0.00	ff		42			01

Under Linux:

[  467.460828] usb 2-1.2: new full-speed USB device number 9 using ehci-pci
[  467.569674] usb 2-1.2: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
[  467.569689] usb 2-1.2: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  472.104342] usb 2-1.2: USB disconnect, device number 9

[  474.628823] usb 2-1.2: new full-speed USB device number 10 using ehci-pci
[  474.737634] usb 2-1.2: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
[  474.737648] usb 2-1.2: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  477.224019] usb 2-1.2: USB disconnect, device number 10

[  478.468787] usb 2-1.2: new high-speed USB device number 11 using ehci-pci
[  478.578874] usb 2-1.2: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice= 1.00
[  478.578888] usb 2-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  478.578895] usb 2-1.2: Product: MT65xx Preloader
[  478.578901] usb 2-1.2: Manufacturer: MediaTek
[  481.319991] usb 2-1.2: USB disconnect, device number 11

[  513.540826] usb 2-1.2: new high-speed USB device number 12 using ehci-pci
[  513.649733] usb 2-1.2: New USB device found, idVendor=0e8d, idProduct=201c, bcdDevice=ff.ff
[  513.649752] usb 2-1.2: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[  513.649763] usb 2-1.2: Product: MT65xx Android Phone
[  513.649773] usb 2-1.2: Manufacturer: MediaTek
[  513.649782] usb 2-1.2: SerialNumber: 0123456789ABCDEF

Thanks.

 

[tek3195]

Did some digging on renaming the update_data_hw_eu.app but all i could find was not Mediatek related, but rather HiSilicon or Qualcomm.
Related links:

Just to make sure even tried out renaming update_data_hw_eu.app and place it under the 2 new locations on the SDCard, like this:

but without any success :crying:



Under Windows:


Under Linux:


Thanks.

The only thing stopping you is that stupid phucking auth file or DA file. I don't think you have to have both to start flashing but maybe, never seen either one to try it. You wouldn't be able to use amonet without test point to short into bootrom which shows as mediatek phone mt6227. Have you looked into HCU Client & DC Phoenix. Not free but not expensive either. You can just buy server credits for what you need or best bet for me has always been 72hour license for 20 bucks. Our tablet is not on their supported list but there is a full page of exclusive dc-phoenix firmware and customization files. It can be a pain asking for help from them because if they don't know the answer they scream not supported. One of their admins told me the software they have for this device is meant for people willing to take risks and who sometimes think outside of the box. I say I'm way outside the box and explain what I'm trying to do and he said NOT SUPPORTED. If you haven't already, read functionality of hcu client and what it does for other mtk devices it will do for yours for the most part. There are some device specific things listed but what I can remember it was kinda obvious wouldn't work on ours, kinda like 4G and LTE stuff isn't gonna work on wifi-only tablet.
DC Phoenix is what I used to flash twrp past a locked bootloader. If hcu client will do repairs you can get fastboot working and dc phoenix will flash whatever you feed it, literally whatever so can be very dangerous. I was fine with it because I know my twrp works on the device no problem. Anything else would be a total gamble. What it does is circumvents device checks and fastboot checks, so fastboot doesn't care what you feed it, it will send and write it. The device doesn't get to say no because they've gotten around the checks it does. That's my explaination not theirs on what it does in a nutshell. It does more but that you can read if you want. To start off go to dc-unlocker to get hcu & dc phoenix and buy credits or license from them as some resellers try to increase the price. Had one telling me $40 for a $20 license and blaming it on exchange rates. Bought from dc-unlocker and exchange rate put it at $21.73 a far cry from the 40 that other cat was trying to rob me of.

 

[megaraider]

The only thing stopping you is that stupid phucking auth file or DA file. I don't think you have to have both to start flashing but maybe, never seen either one to try it.

Neither do I.
But IMO JTAG Boxs use a tweaked custom DA file only, while the auth file is needed when using SP Flash Tool.

You wouldn't be able to use amonet without test point to short into bootrom which shows as mediatek phone mt6227.

BG2-W09 test point location has not yet been revealed

Have you looked into HCU Client & DC Phoenix. Not free but not expensive either. You can just buy server credits for what you need or best bet for me has always been 72 hour license for 20 bucks. Our tablet is not on their supported list but there is a full page of exclusive dc-phoenix firmware and customization files. [...]

It's a good choice and price.
But since an used one, in almost mint condition, is sold around 60 to 70 euros it doesn't pay off,
unless i also need to unbrick / unlock other devices.
Therefore, for the time being I'm going to leave this option on hold.

 

[tek3195]

Neither do I.
But IMO JTAG Boxs use a tweaked custom DA file only, while the auth file is needed when using SP Flash Tool.
Yeah furious gold definately uses some kind of tweaked proprietary file.

BG2-W09 test point location has not yet been revealed
That's why I had said unfortunately amonet wouldn't work.

It's a good choice and price.
But since an used one, in almost mint condition, is sold around 60 to 70 euros it doesn't pay off,
unless i also need to unbrick / unlock other devices.
Therefore, for the time being I'm going to leave this option on hold.

Yeah, 20 is a bit much for one repair on a tablet of this caliber. I had a few things I was trying with a couple other tablets and was able to sneak mine in with them. It says only one device but I was able to do three.

 

[Haroun]

Is there a way to downgrade BG2-U01C199 to Android 6? Which build should I dload?

 

[tek3195]

Is there a way to downgrade BG2-U01C199 to Android 6? Which build should I dload?

I looked at easy-firmware and they didn't have any marshmallow firmware. Did the U01 come with Android 6.0 or did it launch with 7.0 ?

Edit: I just looked a few places at specs and all show it launching with Android 7.0 unless I missed something. You can't go down in OS version unless it were a custom ROM. Keep in mind that the 6.0 firmware for bg2-w09 will NOT work on bg2-u01. Don't try it as they are completely different soc's and hardware.

 

[Haroun]

I looked at easy-firmware and they didn't have any marshmallow firmware. Did the U01 come with Android 6.0 or did it launch with 7.0 ?

Edit: I just looked a few places at specs and all show it launching with Android 7.0 unless I missed something. You can't go down in OS version unless it were a custom ROM. Keep in mind that the 6.0 firmware for bg2-w09 will NOT work on bg2-u01. Don't try it as they are completely different soc's and hardware.

It came with Android 6
The Android 7 update made performance worst that's why I want to rollback to marshmallow.

Envoyé de mon ALP-L29 en utilisant Tapatalk

 

[tek3195]

It came with Android 6
The Android 7 update made performance worst that's why I want to rollback to marshmallow.

Envoyé de mon ALP-L29 en utilisant Tapatalk

That's odd I couldn't find anything for it with 6.0. I didn't look a real long time either though. Guess not much demand for going back a version, but know what you mean. I have a couple that I won't update cuz I don't like their performance if upgraded. If you find 6.0 firmware grab it, not looking like you will have a lot of options to choose from.

edit: Actually quite a few to choose from here https://huaweiflash.com/how-to-flash-huawei-mediapad-t3-7-0-stock-firmware-all-firmwares/ good luck.

 

[rjbanicl]

hi, wanted to try things out. I've extracted the boot.img in unpdate.app .... now my problem is I don't know how to make the tablet work on adb. hehe. anyone willing to teach me step by step how to install the drivers? Was planning to unlock the bootloader first then patch the boot.img in magisk and then flash it on the tab.

 

[tek3195]

hi, wanted to try things out. I've extracted the boot.img in unpdate.app .... now my problem is I don't know how to make the tablet work on adb. hehe. anyone willing to teach me step by step how to install the drivers? Was planning to unlock the bootloader first then patch the boot.img in magisk and then flash it on the tab.

Just install HiSuite and it will take care of drivers. Or it used to anyway.

 

[Deleted member 11009243]

Unlock the bootloader BG2-W09

Neither do I.
But IMO JTAG Boxs use a tweaked custom DA file only, while the auth file is needed when using SP Flash Tool.


BG2-W09 test point location has not yet been revealed


It's a good choice and price.
But since an used one, in almost mint condition, is sold around 60 to 70 euros it doesn't pay off,
unless i also need to unbrick / unlock other devices.
Therefore, for the time being I'm going to leave this option on hold.

Someone already found a way to unlock the bootloader in version BG2-W09