Custom Rom / rooting Options vor TB-125FU (Lenovo Tab M10 Plus 3rd Gen)

[joeblowma]

I just tried to boot the boot.img I flashed to get root and it just says this:

Z:\__lenovo_m10\platform-tools>fastboot boot magisk_patched-25200_BtA00.img
Sending 'boot.img' (32768 KB)                      OKAY [  0.859s]
Booting                                            FAILED (remote: 'Unrecognized command boot')
fastboot: error: Command failed

despite this message, the device boots. but as if it had just come out of the packaging. Now when I turn on developer option it says oem bootlock is already enabled.

Right, once you unlock and boot the developer option should say device is already unlocked. That completed step 3 I mentioned.

If you successfully boot from the patched boot image you should be able to run the magisk app and install in step 9 I mentioned. If not then magisk will not have root ability which will make it so it can't patch the boot.img on the device.

 

[HansDampfi]

OK. according to my description, should I continue with step 9 right now?

I'm still on the stand, failed too many links but started tablet.

Installed Magisk. Well when I go to install I can only select one file...which he then patched again. but don't install directly.

 

[joeblowma]

If it booted your patched boot.img, it should have let you do 'direct install' in magisk which would have backed up your boot.img from flash, patched it and flashed the patched one.

As you saw above I wasn't able to get it to boot boot.img sent from PC at all, nothing about links or anything just 'not supported' so no idea what you are doing different than me.

 

[HansDampfi]

well different, but also not successful apparently.

At least I can't install it. patch only


I'd love to get rid of all that google crap

 

[joeblowma]

Well that was interesting, on a lark I tried going to fastboot by power off tablet, waiting a few and then holding power and up volume, then when it asked pressed down to enter fastboot. Then I tried booting the magisk patched bootloader and I got:

Z:\__lenovo_m10\platform-tools>fastboot boot magisk_patched-25200_BtA00.img
Sending 'boot.img' (32768 KB)                      OKAY [ 20.531s]
Booting                                            FAILED (Status read failed (Too many open files in system))
fastboot: error: Command failed

Why you fight us so hard m10? Why? I'm gonna go finish sleeping on it, originally up because sick kitty needed special food and she woke me up...

 

[HansDampfi]

@joeblowma

well, nice. And now you have the same state as i

can you install boot.img now?

 

[joeblowma]

If you are in that state in fastboot, you can try "fastboot reboot fastboot" to get to the fastboot that is supposed to be able to boot these images. There are two different fastboots, one you get to by issuing 'adb reboot fastboot' and the other you get to using power and volume button, and selecting down when prompted. One is fastboot, the other fastbootd.

edit:/ neither will let me send and boot boot.img, but one of the two definitely let me flash it - neither provides a method for back up though.

 

[HansDampfi]

oh ok. slowly. i am confused.

i boot the patched_image on fastboot. The fastboot with the big letters with "Press volume down and Power button to turn off"

I know about the another fastboot. The fastboot with blue and orange letters. looks like every fastboot on different devices.

what do you mean to do?

UPDATE:

i boot in fastboot mode. the mode with the big red letters. then i write

fastboot flash boot_patched.img

i was flashing without errors.

then reboot. can now permanently install an img file. if i want that the option is there. but I don't know if that makes sense since I already flashed boot img. have. should I do it again? How do I know if I'm root now? I still can't uninstall google play store

hope i can help you, too.

 

[joeblowma]

You did the thing I said was not the right thing to do, so you've flashed over the original boot.img and can probably never OTA update again. You can install magisk now, in the app there are two installs that need to be done, one to the boot image and one to the app which gives super user.

I don't know about removing play store. I always just used ROM with minimal play stuff (don't remember offhand what it's called), never tried to rip out play services and such.

BTW: to get from the fastboot at screen with the big red letters to the other one, you can do "fastboot reboot fastboot" and it goes to the other one with the little menu. From what I understand one is fastboot and the other fastbootd.

 

[HansDampfi]

OTA updates I hope I will never need them and someday a CFW will come out for the device and everything will be fine. No more Google.

i thought i was successful. since it seems to be rooted now and magisk also seems to work.

The only question that remains is how can I get rid of google

 

[GuyInDogSuit]

Rooting isn't required to disable apps, which is the best thing to do for system apps that you can NOT find on the Play Store (in other words, might be important to that flavor of the Android OS's framework. Think OneUI and so on). The majority of Google apps that come preinstalled (YT Music, Drive, Slides, etc, crap MOST people don't need or even want), can be "uninstalled" via ADB as well, and I prefer to do it that way. As far as perma-uninstall, Titanium Backup is an old go-to, and I think Swift Backup (my preferred tool) can uninstall system apps, too.

For thing like this in the future, look into Shizuku. You can use low-level shell commands to do some things that were previously only accomplished via rooting. You just need to activate it once per reboot to use with apps like Swift Backup.

As far as OTAs go, you could try unrooting via Magisk BEFORE installing the update (you can download it though, just don't install yet or reboot), then install the update, and once it's successful, if you still want to remain rooted, return to Magisk and RE-ROOT (direct install for OTA option), and then reboot. Hopefully that works.

 

[joeblowma]

For thing like this in the future, look into Shizuku. You can use low-level shell commands to do some things that were previously only accomplished via rooting. You just need to activate it once per reboot to use with apps like Swift Backup.

Swift is exactly what I was looking for, backups are good. Plus it led me to a far better authenticator app (Aegis) than Google Auth, which was a huge bonus. Thanks, so much!

As far as OTAs go, you could try unrooting via Magisk BEFORE installing the update (you can download it though, just don't install yet or reboot), then install the update, and once it's successful, if you still want to remain rooted, return to Magisk and RE-ROOT (direct install for OTA option), and then reboot. Hopefully that works.

He's in the same boat I'm in, proverbially speaking. He's overwritten the booloader without magisk snagging a backup of it to restore for these incremental system updates to work, and Lenovo doesn't put full updates (aside from their recovery tool, which as we both know doesn't work) OTA for those of us rooted.

We're back to my first assumption, those warnings about unlocking were true - can't update until it's relocked and returned to stock... unless we can find a way around that. Still no luck finding the partition table info, or a way to dump the alternate slot's binary data (I'd like to see if the bootloader on there matches the ones I have).

 

[HansDampfi]

@joeblowma


hey if you want me to test something or you need files from me. let me know

 

[joeblowma]

@joeblowma


hey if you want me to test something or you need files from me. let me know

OK. I figured out what I had to do. I took dd images of boot_a and boot_b, found that I was booting boot_a and it matched the magisk patched boot image I flashed, boot_b was the same boot.img from the download I had of my previous firmware and concluded it just wanted the clean boot.img from before I had magisk patch it.

I followed the guide here (the comments are important!), took the original boot.img got it's SHA1 hash, compressed and placed it at /data/magisk_backup_ce955430833746214a5e3949e2a05d08e35abf72/boot.img.gz and magisk was able to restore it.

I started the update process again, and wow it takes a long time to download 96MB, waited and waited and decided it was stalled at around 98% complete, so I pulled a logcat and found this repeating over and over again (with other stuff thrown in):

02-04 08:13:58.947 13956 13956 I derive_classpath: export BOOTCLASSPATH /apex/com.android.art/javalib/core-oj.jar:/apex/com.android.art/javalib/core-libart.jar:/apex/com.android.art/javalib/okhttp.jar:/apex/com.android.art/javalib/bouncycastle.jar:/apex/com.android.art/javalib/apache-xml.jar:/system/framework/framework.jar:/system/framework/framework-graphics.jar:/system/framework/ext.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/ims-common.jar:/apex/com.android.i18n/javalib/core-icu4j.jar:/system/framework/mediatek-telephony-base.jar:/system/framework/mediatek-telephony-common.jar:/system/framework/mediatek-common.jar:/system/framework/mediatek-framework.jar:/system/framework/mediatek-ims-common.jar:/system/framework/mediatek-ims-base.jar:/system/framework/mediatek-telecom-common.jar:/apex/com.android.appsearch/javalib/framework-appsearch.jar:/apex/com.android.conscrypt/javalib/conscrypt.jar:/apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar:/apex/com.android.media/javalib/updatable-media.jar:/apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar:/apex/com.android.os.statsd/javalib/framework-statsd.jar:/apex/com.android.permission/javalib/framework-permission.jar:/apex/com.android.permission/javalib/framework-permission-s.jar:/apex/com.android.scheduling/javalib/framework-scheduling.jar:/apex/com.android.sdkext/javalib/framework-sdkextensions.jar:/apex/com.android.tethering/javalib/framework-connectivity.jar:/apex/com.android.tethering/javalib/framework-tethering.jar:/apex/com.android.wifi/javalib/framework-wifi.jar
02-04 08:13:58.947 13956 13956 I derive_classpath: export DEX2OATBOOTCLASSPATH /apex/com.android.art/javalib/core-oj.jar:/apex/com.android.art/javalib/core-libart.jar:/apex/com.android.art/javalib/okhttp.jar:/apex/com.android.art/javalib/bouncycastle.jar:/apex/com.android.art/javalib/apache-xml.jar:/system/framework/framework.jar:/system/framework/framework-graphics.jar:/system/framework/ext.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/ims-common.jar:/apex/com.android.i18n/javalib/core-icu4j.jar:/system/framework/mediatek-telephony-base.jar:/system/framework/mediatek-telephony-common.jar:/system/framework/mediatek-common.jar:/system/framework/mediatek-framework.jar:/system/framework/mediatek-ims-common.jar:/system/framework/mediatek-ims-base.jar:/system/framework/mediatek-telecom-common.jar
02-04 08:13:58.947 13956 13956 I derive_classpath: export SYSTEMSERVERCLASSPATH /system/framework/com.android.location.provider.jar:/system/framework/services.jar:/system/framework/ethernet-service.jar:/apex/com.android.appsearch/javalib/service-appsearch.jar:/apex/com.android.art/javalib/service-art.jar:/apex/com.android.media/javalib/service-media-s.jar:/apex/com.android.permission/javalib/service-permission.jar
02-04 08:13:58.947 13956 13956 I derive_classpath: export STANDALONE_SYSTEMSERVER_JARS /apex/com.android.os.statsd/javalib/service-statsd.jar:/apex/com.android.scheduling/javalib/service-scheduling.jar:/apex/com.android.tethering/javalib/service-connectivity.jar
02-04 08:13:58.957 13955 13955 E otapreopt: Bad access() to /apex/com.android.art/javalib/arm64/boot.art: No such file or directory
02-04 08:13:58.957 13955 13955 E otapreopt: Bad boot image.
02-04 08:13:58.961 13818 13818 E otapreopt_chroot: Running otapreopt failed: Failed execv(/system/bin/otapreopt _b 10 dexopt

The boot image isn't bad, it's stock as I rebooted without root patch. I'm in the midst of trying to update it again after factory resetting it. If that doesn't work I'm going to try the lenovo tools again, which I know will fail just like they did before I unlocked and rooted it. After that... no idea. Stick with this version rooted and hope by the time they release android 13 it's a full image update? ~sigh~ it never used to be this difficult.

edit:/ update successful, took a long time at 98% this time but wasn't stuck in a loop and did find the boot stuff. I had some foresight and pre-patched the boot.img and thanks to the backup program you recommended I should be good to go. Hopefully next time isn't quite this painful!

 

[GuyInDogSuit]

OK. I figured out what I had to do. I took dd images of boot_a and boot_b, found that I was booting boot_a and it matched the magisk patched boot image I flashed, boot_b was the same boot.img from the download I had of my previous firmware and concluded it just wanted the clean boot.img from before I had magisk patch it.

I followed the guide here (the comments are important!), took the original boot.img got it's SHA1 hash, compressed and placed it at /data/magisk_backup_ce955430833746214a5e3949e2a05d08e35abf72/boot.img.gz and magisk was able to restore it.

I started the update process again, and wow it takes a long time to download 96MB, waited and waited and decided it was stalled at around 98% complete, so I pulled a logcat and found this repeating over and over again (with other stuff thrown in):

---snip---

The boot image isn't bad, it's stock as I rebooted without root patch. I'm in the midst of trying to update it again after factory resetting it. If that doesn't work I'm going to try the lenovo tools again, which I know will fail just like they did before I unlocked and rooted it. After that... no idea. Stick with this version rooted and hope by the time they release android 13 it's a full image update? ~sigh~ it never used to be this difficult.

edit:/ update successful, took a long time at 98% this time but wasn't stuck in a loop and did find the boot stuff. I had some foresight and pre-patched the boot.img and thanks to the backup program you recommended I should be good to go. Hopefully next time isn't quite this painful!

Could this potentially be applied to my situation?

 

[joeblowma]

Could this potentially be applied to my situation?

I honestly think our (anyone who owns this tablet) best bet is to get on lenovo to fix their tool. I have to wonder if they are even aware the tool is incapable of recovering the tablet with the files they give.

You should be able to format the partitions like the one guide said and flash it with the mfg tool, provided none of them are bounding outside the flash space. That said, I haven't been able to find a way to verify the addresses in the scatter file or why they caused issues in the log when I tried to use the tool.

Also, are you certain it's not a hardware failure? It sounded to me like something that just happened randomly and these should still be well within the warranty if you haven't unlocked it.

 

[GuyInDogSuit]

I honestly think our (anyone who owns this tablet) best bet is to get on lenovo to fix their tool. I have to wonder if they are even aware the tool is incapable of recovering the tablet with the files they give.

You should be able to format the partitions like the one guide said and flash it with the mfg tool, provided none of them are bounding outside the flash space. That said, I haven't been able to find a way to verify the addresses in the scatter file or why they caused issues in the log when I tried to use the tool.

Also, are you certain it's not a hardware failure? It sounded to me like something that just happened randomly and these should still be well within the warranty if you haven't unlocked it.

Could be a hardware issue, yeah. It started with it just randomly rebooting into recovery unless I forced it to boot back into Android, but that usually only last 2-3 minutes before the reboots started again. Hence the attempt to "recover" the tablet (aka "whoops, our tool's borked and now so is your tablet").

 

[joeblowma]

I just spent the last hour or so trying to read back a the boot_a/boot_b partitions using the flash tool, looks like it wants some kind of auth file (google c0030012), so I can't read back this way and verify but obviously they believe they can flash it. Situation is just plain weird with their recovery tool.

 

[HansDampfi]

@joeblowma

hi

nice. you have solved the Problem.
when i have time, can you write a short manual?

-----

well, i have used Universal Android Debloater GUI today.

thats a good tool i think. i have uninstall many apps such youtube, kids, google file and photos and lenovo tablet center

has someone else xp with that?

i cant find the com.google.android.apps.XXX

for

- gmail
- google PlayStore (not recommended)
- google Assist
- Memo (lenovo i think)
- GBoard (i have no idea. its for digital key board, when i deactivate, only speechassist work)
- Google-Service
- SMART Launcher (whats that?)

 

[joeblowma]

can you write a short manual?

Here, this is from memory and I've been using computers/coding for so long I tend to take a lot for granted and don't think to document... so someone trying to follow this may have to ask questions to get clearer instructions but...

 *note* <-- denotes a comment, not something you put on the shell lines
make a folder in internal memory called backup
copy stock boot.img from before you patched it with magisk into the folder you just made

adb shell
su
cd /data/adb/magisk
./magiskboot sha1 /mnt/sdcard/backup/boot.img
98f0afe1e43ef84da9d29b69ad7f1f37b3a07dbd         <-- copy this output for your file to the 2 places it is below
mkdir -p /data/magisk_backup_98f0afe1e43ef84da9d29b69ad7f1f37b3a07dbd
./magiskboot compress /mnt/sdcard/backup/boot.img /mnt/sdcard/backup/stock_boot.img.gz
cp /mnt/sdcard/backup/stock_boot.img.gz /data/magisk_backup_98f0afe1e43ef84da9d29b69ad7f1f37b3a07dbd/boot.img.gz

magisk --path            <-- to get the path to magisk (useful if you are hiding the app)
cp magiskpath/.magisk/config /mnt/sdcard/backup/config
<-- copy the config file to verify hash above is in it with a text editor or reader of some kind
<-- if not you will need to edit it and put in the proper hash then cp the file back over the original

You should now be able to use magisk app to uninstall/restore the bootloader to stock/unhacked
and install updates if you've not made any changes to read only partitions
I had to factory reset, it was stuck in a loop that stopped update at around 98% completion
let the update sit for a good 15 or so minutes just in case it's just busy, even after factory reset that
last bit took a long while

if the update succeeds, use magisk to install to the update/OTA bootloader and reboot. If not,
after factory resetting I had to use magisk to patch a boot image, boot into fastboot again and flash
the bootloader like when I first rooted it.