[GUIDE] Unlock bootloader of Lenovo Tab 4 10 with OEM unlock "greyed out" (TB-X304F/L and other Qcom tablets)

hk96

Senior Member
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET

This guide is only for devices with "OEM Unlocking" option greyed out !!!

Prerequisites:
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
Code:
adb reboot edl
5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....

Attachments

• TB-X304F prog_emmc_firehose_8917_ddr.zip
214 KB · Views: 269
• TB-X304L prog_emmc_firehose_8917_ddr.zip
214 KB · Views: 314
Last edited:

Hb20032003

Senior Member
Thank you very much! It worked perfectly!

njascgil

Hb20032003

Senior Member
Firehose file for X304L if anyone needs it

Attachments

• prog_emmc_firehose_8917_ddr.zip
214 KB · Views: 136
vovserbo

njascgil

Senior Member
Thank you very much! It worked perfectly!

Great! I also have this problem...
Does unlocking in this way factory resets the tablet?
Is the "firehose" file version sensitive (i.e., if I use the S001016 file in a S001014 TB-X304F will I have any kind of trouble?)
Thanks!

hk96

Senior Member
Great! I also have this problem...
Does unlocking in this way factory resets the tablet?
Is the "firehose" file version sensitive (i.e., if I use the S001016 file in a S001014 TB-X304F will I have any kind of trouble?)
Thanks!
After unlocking, when u Boot into system it asks for a password, even if u didn't set one to start with (atleast in my case).
So you need Boot into recovery and wipe data.
Short answer: yes, factory reset is necessary.

Regarding file version, I hav no idea... May be u can give it a try...

njascgil

Chhayank_Sharma

Member
Can you please make a video tutorial? i am new to rooting and am unable to understand the instructions properly.

hk96

Senior Member
Can you please make a video tutorial? i am new to rooting and am unable to understand the instructions properly.
May do it when i find time....
But there are many videos on the same procedure for other Qcom phones, you can get some hint from that.
If you are very new to this, i suggest you not to do, unless your are confident.

Chhayank_Sharma

Member
May do it when i find time....
But there are many videos on the same procedure for other Qcom phones, you can get some hint from that.
If you are very new to this, i suggest you not to do, unless your are confident.
ok thanks.

njascgil

Senior Member
Regarding file version, I hav no idea... May be u can give it a try...

I was going to try it, but it's my daughter's tablet and she didn't let me do it... She is afraid of loosing some games' progress...

Jakeup96

Senior Member
PS: The same procedure can be done using QFIL tools (QPST)

How? I watched a video and I can load the mbn but I don't know what to put in the xml thing box. I tried doing the method steps but it says Failed to write hello response back to device Did not receive Sahara hello packet from device

Jakeup96

Senior Member
Nevermind I got it. As you can see by my signature I haven't done anything like this in many years.

rustyrust

Member
Nevermind I got it. As you can see by my signature I haven't done anything like this in many years.

could you explain how you did it pleasssee

genziutek

Senior Member
Work! You're GENIUS

iostrym

Senior Member
hello,

I already root some device but here I'm stuck because I don't find the port number in device manager :-( drivers installed and "lenovo tab4 10" displayed in device manager. in properties I have : port_#0002.hub_#0005

I tried use 0002 or 0005 as port number but the .bat script failed each time. do I have correct port number ?

[EDIT] I have "failed to write hello response back to device" message and my tablet is in FFBM Mode.

[EDIT] in FFBM mode, my device is recognized in device manager (but i'm not sure to find the correct port and the script don't work) and in FastBoot Mode (first menu), my device seems to be not recognized in device manager. I guess that the script must be launched in this mode but I miss a driver. I install "adb drivers" + QDLoader-HS-USB_Driver_64bit_Setup drivers. What do I miss ?

Last edited:

Top Liked Posts

• There are no posts matching your filters.
• 11
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET

This guide is only for devices with "OEM Unlocking" option greyed out !!!

Prerequisites:
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
Code:
adb reboot edl
5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....
1
Thank you very much! It worked perfectly!
1
Firehose file for X304L if anyone needs it
1
Great! I also have this problem...
Does unlocking in this way factory resets the tablet?
Is the "firehose" file version sensitive (i.e., if I use the S001016 file in a S001014 TB-X304F will I have any kind of trouble?)
Thanks!
After unlocking, when u Boot into system it asks for a password, even if u didn't set one to start with (atleast in my case).
So you need Boot into recovery and wipe data.
Short answer: yes, factory reset is necessary.

Regarding file version, I hav no idea... May be u can give it a try...
1
I just tried to do this. I installed the drivers, my tablet was seen by my computer and I am connected to port 0001. When I run the dump_devinfo.bat file, it starts and looks like it gives some errors. But then it will continue for a few minutes and then tell me the devinfo.img file was saved to the current directory. But nothing is in the directory I am working out of. Am I doing something wrong here? Does it have something to do with the errors it is showing? I attached a screenshot of what it tells me.

Also, is it normal for USB Debugging to be greyed out as well? I don't know if that has any effect on EDL mode.