Custom Rom / rooting Options vor TB-125FU (Lenovo Tab M10 Plus 3rd Gen)

[HansDampfi]

Hello ,
Normally ,if you update your tablet ,you receive directly the last update (then 221208) but you may update with RSA .

ok thanks

i update first and than, i catch the boot.img again.
is ist possible to root the device with the actually version? has some one else test that?

 

[joeblowma]

You can download the update and install, but don't reboot.

Didn't work unfortunately, gets to "optimizing apps" in the updater (clearly it didn't even get that far) and fails/resets the update screen without telling me any reason.

It's an incremental update and not able to apply the delta, looking at logcat I'm seeing

01-25 09:47:40.764  1155  1155 E update_engine: [ERROR:partition_writer.cc(608)] Unable to open ECC source partition boot, file /dev/block/platform/bootdevice/by-name/boot_a: No such file or directory (2)
01-25 09:47:40.768  1155  1155 E update_engine: [ERROR:delta_performer.cc(883)] The hash of the source data on disk for this operation doesn't match the expected value. This could mean that the delta update payload was targeted for another version, or that the source partition was modified after it was installed, for example, by mounting a filesystem.
01-25 09:47:40.773  1155  1155 E update_engine: [ERROR:delta_performer.cc(888)] Expected:   sha256|hex = A1630EFBAD35D30DB89BCC940E010F567DD212E244869ABDAAEE1B3DBD721BB6
01-25 09:47:40.777  1155  1155 E update_engine: [ERROR:delta_performer.cc(891)] Calculated: sha256|hex = CEC9B0A50F760A997089B474AD49457806BEC986F03D878A6BAD7B25DB007073
01-25 09:47:40.782  1155  1155 E update_engine: [ERROR:delta_performer.cc(902)] Operation source (offset:size) in blocks: 0:2452
01-25 09:47:40.786  1155  1155 E update_engine: [ERROR:partition_writer.cc(513)] source_fd != nullptr failed.
01-25 09:47:40.790  1155  1155 E update_engine: [ERROR:delta_performer.cc(969)] partition_writer_->PerformPuffDiffOperation( operation, error, buffer_.data(), buffer_.size()) failed.
01-25 09:47:40.794  1155  1155 E update_engine: [ERROR:delta_performer.cc(201)] Failed to perform PUFFDIFF operation 0, which is the operation 0 in partition "boot"
01-25 09:47:40.798  1155  1155 E update_engine: [ERROR:download_action.cc(222)] Error ErrorCode::kDownloadStateInitializationError (20) in DeltaPerformer's Write method when processing the received payload -- Terminating processing
01-25 09:47:40.806  1155  1155 I update_engine: [INFO:delta_performer.cc(217)] Discarding 2195441 unused downloaded bytes
01-25 09:47:40.854  1155  1155 I update_engine: [INFO:multi_range_http_fetcher.cc(177)] Received transfer terminated.

So presumably it's trying to patch slot A into slot B with a delta patch and the boot partition doesn't have the correct hash for the patch. I'm not actually sure which bootloader should be on there, or how to get it in place so I can "restore" it via magisk but I have a few leads in other threads here on that to try.

Great.... now it won't turn on anymore. :c

D'OH! Did you try taking it for dinner, getting it flowers and say nice things to it? I hear that works... on TV anyway. Hope it's not a hardware failure and you can use one of the flashing tools to resurrect it.

 

[HansDampfi]

Didn't work unfortunately, gets to "optimizing apps" in the updater (clearly it didn't even get that far) and fails/resets the update screen without telling me any reason.

If I understand correctly, you have the same problem as me. The version in the rescue program is higher than that in the tablet. You have performed the update and now nothing works. This sucks for me. I hope there is some solution and someone can help. I don't want to run my tablet unrooted.

 

[joeblowma]

If I understand correctly, you have the same problem as me.

Sort of, I guess. Basically I installed magisk via flashing a pre-patched boot image and thus had no backup of what was initially in the flash. Apparently, what I have isn't what it expects and thus it won't install the update at all. It's still working fine though, I just keep getting an update notification and can't update.

I guess my understanding now is I should have used fastboot to boot the patched image instead of flash it (no idea if that would have worked, but it seems right) and then used that booted root to patch the flash via magisk installer direct patch which would have retained the original data.

I tried using LMSA to recover it to the version it gives me access to, and it connects then nearly immediately drops the connection. Looking into the files, I see C:\ProgramData\SP_FT_Logs\SP_FT_Dump_01-27-2023-05-43-59\QT_FLASH_TOOL.log has this:

01/27/2023 05:44:18.377 FlashTool[11744][3308][D]: ConsoleMode::ConsoleModeEntry::Run(): Exception: err_code[8502], err_msg[PMT changed for the ROM; it must be downloaded.
Please select "Format All + Download" scene and try again](..\..\flashtool\ConsoleMode\ConsoleModeEntry.cpp,205)

Which seems to be a serious bug on lenovo's part - the update that we download to recover doesn't have the same scatter/flash map as what ships on the tablet and thus will never be able to recover this tablet with their own recovery tool.

Not sure what to do at this point. I know how to get around this with SP_Flash_Tool_v5.2136_Win (though given the above lenovo issue how can I really even trust this firmware package?), but it won't fix lenovo's issue because this is still the same problem I had when it was still locked and stock, as well the version I had at that time was also with the same scatter as the current version.

 

[GuyInDogSuit]

Sort of, I guess. Basically I installed magisk via flashing a pre-patched boot image and thus had no backup of what was initially in the flash. Apparently, what I have isn't what it expects and thus it won't install the update at all. It's still working fine though, I just keep getting an update notification and can't update.

I guess my understanding now is I should have used fastboot to boot the patched image instead of flash it (no idea if that would have worked, but it seems right) and then used that booted root to patch the flash via magisk installer direct patch which would have retained the original data.

I tried using LMSA to recover it to the version it gives me access to, and it connects then nearly immediately drops the connection. Looking into the files, I see C:\ProgramData\SP_FT_Logs\SP_FT_Dump_01-27-2023-05-43-59\QT_FLASH_TOOL.log has this:

01/27/2023 05:44:18.377 FlashTool[11744][3308][D]: ConsoleMode::ConsoleModeEntry::Run(): Exception: err_code[8502], err_msg[PMT changed for the ROM; it must be downloaded.
Please select "Format All + Download" scene and try again](..\..\flashtool\ConsoleMode\ConsoleModeEntry.cpp,205)

Which seems to be a serious bug on lenovo's part - the update that we download to recover doesn't have the same scatter/flash map as what ships on the tablet and thus will never be able to recover this tablet with their own recovery tool.

Not sure what to do at this point. I know how to get around this with SP_Flash_Tool_v5.2136_Win (though given the above lenovo issue how can I really even trust this firmware package?), but it won't fix lenovo's issue because this is still the same problem I had when it was still locked and stock, as well the version I had at that time was also with the same scatter as the current version.

NEVER flash the patched boot.img directly, boot it instead. I learned that the hard way. Though in my case it wasn't this tablet but rather another device from a while back. Thankfully I still kept the original boot.img (and payload) and was able to fix that.

Is your device bricked? Sounds like you have the same problem I do, that the tool isn't working on recovering your tablet either? Mine kept rebooting from Android into recovery, so I tried to recover it, and it failed spectacularly. Meaning it doesn't do anything but boot into fastboot, every time, after every recovery attempt. I mean, what good is a RECOVERY TOOL, if it fails at that, amirite?

 

[joeblowma]

NEVER flash the patched boot.img directly, boot it instead. I learned that the hard way. Though in my case it wasn't this tablet but rather another device from a while back. Thankfully I still kept the original boot.img (and payload) and was able to fix that.

Is your device bricked? Sounds like you have the same problem I do, that the tool isn't working on recovering your tablet either? Mine kept rebooting from Android into recovery, so I tried to recover it, and it failed spectacularly. Meaning it doesn't do anything but boot into fastboot, every time, after every recovery attempt. I mean, what good is a RECOVERY TOOL, if it fails at that, amirite?

Yeah, too bad absolutely none of the info I was following even mentioned that.

Not bricked, still working fine just unable to update. I could (likely, and maybe you too) use the mfg tool to format the partitions (except boot) and write the image, all from powered off (these tools expect the machine to be off then connect usb and it takes it from there) and then flash the most current firmware, but as I said it does not fix the problem normal lenovo customers will have - that they issue an updated image for recover with resized partitions or an incorrect scatter file (my guess is the scatter, though the logcat did mention partition resizes when parsing the diff descriptor) that their own tool is unable to use.

The recovery tool failed to work when I wanted to update it from TB125FU_S000090_220805_ROW to TB125FU_S000118_220927_ROW (aka: on a fully functional and not yet unlocked tablet) before the OTA was issued (took 2 more weeks after I tried) and the same error appeared in the mtk tool's log (their RSA uses mtk's tool in the background, delivered as an password encrypted compressed file that is extracted on demand and wiped after).

I fed boot.img from TB125FU_S000118_220927_ROW to magisk to get a patched image, and then flashed that to root (followed multiple sets of instructions, had problems with the flash command, never saw any boot command).

 

[GuyInDogSuit]

Yeah, too bad absolutely none of the info I was following even mentioned that.

I fed boot.img from TB125FU_S000118_220927_ROW to magisk to get a patched image, and then flashed that to root (followed multiple sets of instructions, had problems with the flash command, never saw any boot command).

Oof. Good thing you weren't stuck with a bootloop or otherwise paperweight device.

Not bricked, still working fine just unable to update. I could (likely, and maybe you too) use the mfg tool to format the partitions (except boot) and write the image, all from powered off (these tools expect the machine to be off then connect usb and it takes it from there) and then flash the most current firmware, but as I said it does not fix the problem normal lenovo customers will have - that they issue an updated image for recover with resized partitions or an incorrect scatter file (my guess is the scatter, though the logcat did mention partition resizes when parsing the diff descriptor) that their own tool is unable to use.

Could you explain more in detail what this mfg tool process would be? It might be the only thing I can do at this point to save this oversized, flat brick.

--snipped--

their RSA uses mtk's tool in the background, delivered as an password encrypted compressed file that is extracted on demand and wiped after).

I was able to grab that mtk tool, after it was extracted but before wiped, but I've no clue how to use it.

 

[joeblowma]

Oof. Good thing you weren't stuck with a bootloop or otherwise paperweight device.

Indeed!

Could you explain more in detail what this mfg tool process would be? It might be the only thing I can do at this point to save this oversized, flat brick.

With the GUI you basically load it up, load a scatter file, deselect certain partitions, have it start and then plug your powered off device into the USB and it just goes. Presumably the act of plugging in the usb starts some kind of preboot situation (I think that was the partition you never format) that gives the mfg tool access. Here are two topics I bookmarked on the issue I'm having that would prove more informative than what I can explain (not suggesting to do this out the gate, see the second link first):

How to fix "PMT changed for the ROM, it must be downloaded"

While trying to modify my KW88 Pro watch to run AsteroidOS I took the advice of the program and clicked "Format All + Download" without fully understanding what it does. It deletes all partitions. The install then failed with some random errors...

forum.xda-developers.com

And why the recovery software is unlikely to ever flash one of these devices (going by the errors I received when it was still stock) - the scatter file doesn't match what the flash has:

Steps to get scatter file of any android phone(With Video)

1.Attach your phone to ur computer in usb debugging mode. 2.If you already have ADB installed on your computer, launch a Command Prompt / Terminal window on your computer 3.Type these following commands adb shell cat /proc/mtd 4.Partition...

forum.xda-developers.com

There are probably better ones, that have things that are taken for granted like the boot instead of flash bootloader thing I somehow missed. But this is where I'm starting, I'm going to try to recover the scatter info and see if it lines up or deviates a lot.

I was able to grab that mtk tool, after it was extracted but before wiped, but I've no clue how to use it.

As far as I know the tool is shared freely. I just googled "SP_Flash_Tool_v5.2136_Win" and found a copy out there, which matches the version bundled and passworded in lenovo's files along with countless explanations on how to use it.

 

[GuyInDogSuit]

Whew... that's... a lot to sink my teeth into. I'll probably take a bit to go through this and let it soak in before I even consider attempting it. But at first glance it seems like something similar to other "unfecker" processes I've done before, lol, so this isn't exactly my first rodeo, but it's still a bit daunting nonetheless.

 

[joeblowma]

Whew... that's... a lot to sink my teeth into.

Which is probably why it's wrong and the rescue tool can't work, I mean it's not like I've changed partition sizes and the scatter files are identical for the 3 versions of firmware I have download from lenovo. If you want I will try to retrieve my scatter info (I'm on TB125FU_S000118_220927_ROW, the next version as I said clearly had partition resizes mapped in the logs I pulled of the delta patch parsing) as outlined, as it stands I'm pretty busy but not too busy to grab that for you if it'll help.

edit:/ nix that, I'm not seeing any /proc/mmc or similar in the /proc/ dir at all. There must be a way...

 

[GuyInDogSuit]

Best to take some time and think things over on this, I guess. That or risk messing up this thing even more. lol

 

[HansDampfi]

Hey everyone.
i reading all your posts, but i cant imagine bring my tablet to a root. i have a different firmware like rescue image. What can i do? Can everone tell my step by step?

Please

My Firmware Version on Tablet
TB125FU_S000118_220927_ROW
The Download
TB125FU_S000139_221208_ROW


@joeblowma
You have the boot.img from 220927? Can you give it to me?
can it work with tah t for me?

thx
have a nice week

 

[joeblowma]

Best to take some time and think things over on this, I guess. That or risk messing up this thing even more. lol

Indeed, though "not working" is probably no worse than "not working" there is also "not ever working again" which would be tragic.

Hey everyone.
i reading all your posts, but i cant imagine bring my tablet to a root. i have a different firmware like rescue image. What can i do? Can everone tell my step by step?

Please

My Firmware Version on Tablet
TB125FU_S000118_220927_ROW
The Download
TB125FU_S000139_221208_ROW


@joeblowma
You have the boot.img from 220927? Can you give it to me?
can it work with tah t for me?

thx
have a nice week

You should wait for OTA update so you have 139_221208, get the boot.img from that and don't do like I did - instead of flashing it from fastboot like me, boot it and then use magisk to patch the one on the device directly instead so you have a backup. I haven't been able to update because the lenovo tool never would let me flash it back to stock even when it was stock, and I can't take the OTA because boot partition fails sha check now.

And yes, I have the files (and full update the lenovo tool downloaded) from TB125FU_S000118_220927_ROW if you absolutely need it.

 

[HansDampfi]

@joeblowma

"You should wait for OTA update so you have 139_221208"

what do you mean about "waiting"

the update is now. I can install this over RSA or i install that over system normaly. i think.

Then i take the boot.img from rsa and patch it with magisk. is that right?

or

you gave me the 220927 boot.img and i patch it with magisk on the life system?

can this work?

sorry i am a little bit unsure. i dont like bricks

 

[joeblowma]

the update is now. I can install this over RSA or i install that over system normaly. i think.

Then i take the boot.img from rsa and patch it with magisk. is that right?

I would take the update over system normally. I tried updating mine from 90_220805 to 118_220927 with lenovo tool (before unlock/root) and it just failed to do it. If I had it to do over again, here is how I would do it:

1 - update to latest normally via the tablet itself
2 - get copy of latest firmware that matches tablet (preferably from lenovo tool)
3 - unlock bootloader
4 - once booted and in desktop after unlock, install magisk and patch boot.img from lenovo tool (on magisk line at top, press install, then select and patch file)
5 - get now boot_patched image onto computer with at least minimal platform tools (adb/fastboot exe)
6 - issue reboot fastboot via adb on booted tablet
7 - once in fasboot do fastboot boot boot_patched
8 - once booted again, install magisk apk from their git
9 - start magisk and press install again, this time select "direct install"
10 - this should have given you a flashed rooted boot image on the tablet based on the boot image already on the tablet, as well as a backup of the boot image you had in case you ever want to go stock, or if you want to do regular updates again you might need to temporarily restore it and then follow #9/10 again before rebooting.

also, one more step that is entirely optional but possibly extremely helpful

11 - (optional) share this new backup boot image with me that magisk made to try to help get me out of my own unable to update bind

I say "boot_patched" but the filename will be like "magisk_patched-25200_bCdDz.img" you don't need to rename it or anything.

I followed the above steps, except 7-10 were replaced by directly flashing the patched boot image to the tablet via fastboot. That was my mistake, I can't update by any method right now, so please don't repeat it.

Good luck, and if you are not comfortable with the risk/cost of (a small chance of) losing the tablet... don't do it. I love having it rooted, but with how little I'm using it I would rather prefer to keep updates coming especially when they gear up for android 13 later this year. Plus it causes some issue that have to be worked around, things like having to do safetynet fix modules so I can use netflix on it, which I had to install from a 3rd party app store because google hid it.

I feel given that a caveat is needed, while I have confidence in these instructions you should understand the risk isn't mine and I can't personally afford a new tablet for myself let alone you so it's your choices make them knowing you are responsible for them.

 

[HansDampfi]

@joeblowma

ok. i am on Step 7 an got this message:

..\fastboot boot magisk_patched.img

booting...
Failed (remote:not allowed in booting state)

i have also try

fastboot oem unlock

Failed
finish

.....

or sould i try this from the Guide?

Type “fastboot flashing unlock” read the instructions on screen which will tell you to press the volume up button (volume button closest to power button) to unlock bootloader.
Press the volume up button, It will say it was successful, wait a few seconds for the tablet to return to fastboot
Type “fastboot flash boot magisk_patched.img” and when you hit enter you should see a transferring status on your tablet (if you named your modified .img file something else, type that into the command instead)
When you see the transfer is complete type “fastboot reboot” which will restart the tablet.



thank you

 

[joeblowma]

ok. i am on Step 7 an got this message:

..\fastboot boot magisk_patched.img

If you did step 3, which involves entering developer mode in system settings and then turning on "OEM unlocking", rebooting to fastboot and issuing "fastboot flashing unlock", which reset my tablet to stock settings and boot up to set up again - you should (theoretically) then be able to go to fastboot again and boot the boot image. I wasn't super thorough in my instructions, I was only trying to show where what I screwed up you hopefully won't.

or sould i try this from the Guide?

Type “fastboot flashing unlock” read the instructions on screen which will tell you to press the volume up button (volume button closest to power button) to unlock bootloader.
Press the volume up button, It will say it was successful, wait a few seconds for the tablet to return to fastboot
Type “fastboot flash boot magisk_patched.img” and when you hit enter you should see a transferring status on your tablet (if you named your modified .img file something else, type that into the command instead)
When you see the transfer is complete type “fastboot reboot” which will restart the tablet.

That was pretty much what I did, and now have no backup and can no longer return to actual stock or use the OTA update I keep getting offered - it panics because I replaced the bootloader, but I don't have the magisk backed up bootloader to put back because I flashed over it. And lenovo tool won't recover to stock either, because it thinks the partitions aren't the correct size.

edit:/ if it was actually unlocked already and this still fails, not sure what to do. You will need a backup of your boot image before flashing the magisk patched bootloader or you may never be able to update unless someone else has a copy of what is supposed to be there

 

[HansDampfi]

@joeblowma

ok. no problem. it is not your fault. i belive that this option i have enable. but i like to enable it again...

ok it was definitly enable. Dev Options in System -> OEm Unlock is Enable.
But same issue

UPDATE:

i try this:

fastboot flashing unlock

volume Button Up for agree this

than

fastboot boot boot_patched.img

...
Failed (status: read failed too many links)


despite this message, the device boots. but as if it had just come out of the packaging. Now when I turn on developer option it says oem bootlock is already enabled.

should I still patch it with magisk?

 

[joeblowma]

@joeblowma

ok. no problem. it is not your fault. i belive that this option i have enable. but i like to enable it again...

ok it was definitly enable. Dev Options in System -> OEm Unlock is Enable.
But same issue

so you completed "fastboot flashing unlock" successfully and followed the on screen instructions and it still won't allow you to boot the patched image via fastboot? Hrm I wonder if I can boot the same one I flashed here...

 

[HansDampfi]

Update - see above. i have edit my post