[GUIDE] Unlock bootloader of Lenovo Tab 4 10 with OEM unlock "greyed out" (TB-X304F/L and other Qcom tablets)

Search This thread

jsgraphicart

Senior Member
Nov 25, 2011
6,288
1,878
OnePlus 7T
I've tried this multiple times and still can't get it to work. I can't get passed the step to get the devinfo.img file. It runs the process and always tells me the device isn't ready but still tells me it completes and the devinfo.img is in the current directory. Only it's not. I think it's about time to give up on this. And probably give up on this tablet. I think I need to get myself a new one and be done with Lenovo.
 

Metal_Box

New member
Apr 1, 2021
1
0
It was crazy hard on my desktop. I spend at least 4 hours and nothing. I tried my laptop and breezed through the process.

I just had to share my experience because I noticed there is a post saying a cable made a difference. I figured devices to connect to tablet can make a difference too.

Thanks for the instructions and everyone sharing their experiences and solutions.
 

Akash23q2

Senior Member
Jan 9, 2020
218
49
It can might sound a bit odd to you all, like everyone my oem unlock switch was greyed out aswell but when I was just playing around and I literally typed oem unlock-go command, mine tab bootloader got unlocked without any issues, idk how it is possible but it worked somehow xD
 

shaurya26

Member
May 1, 2018
11
0
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET



This guide is only for devices with "OEM Unlocking" option greyed out !!!
Others can follow the simpler procedure mentioned in the TWRP thread...

Prerequisites:
QDLoader_HS_USB_Driver (Google it and find)
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

  1. Install the drivers and hex editor.
  2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev (y) )
  3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
  4. Boot into edl mode using key combo
    or using adb
    Code:
    adb reboot edl
  5. Check the port number in device manager and run " dump_devinfo.bat ".
  6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
  7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
  8. Save the devinfo.img after editing and run " unlock.bat "
  9. Reboot after success message.
  10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...:giggle:


View attachment 5154955View attachment 5154957


PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks(y) if this helped....
Hi can't I do this using Android ADB, e.g. Bugjaegar App. Please tell..
 

shaurya26

Member
May 1, 2018
11
0
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET



This guide is only for devices with "OEM Unlocking" option greyed out !!!
Others can follow the simpler procedure mentioned in the TWRP thread...

Prerequisites:
QDLoader_HS_USB_Driver (Google it and find)
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

  1. Install the drivers and hex editor.
  2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev (y) )
  3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
  4. Boot into edl mode using key combo
    or using adb
    Code:
    adb reboot edl
  5. Check the port number in device manager and run " dump_devinfo.bat ".
  6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
  7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
  8. Save the devinfo.img after editing and run " unlock.bat "
  9. Reboot after success message.
  10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...:giggle:


View attachment 5154955View attachment 5154957


PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks(y) if this helped....
Can't I do this by changing the stock firmware and flashing it using stock recovery?
 

_mikau_

New member
Feb 19, 2011
2
0
Xiaomi Redmi 8
Xiaomi Poco F3
Hi all!

@hk96 Thanks so much! I have a TB-X304F with the "OEM unlock" option greyed out. I bought it from Amazon Europe (I'm based in Spain) so I don't really undestand why it was locked... but it was. I've spent hours trying to find the way to unlock it, and the ONLY way I've been able to find that worked was yours. So thanks again!

In case it helps, I'd edit your tutorial to add something REALLY IMPORTANT in order for the process to work: the timing to set the tablet in "edl mode" is key. If you set it and plug the USB wire and run "dump_devinfo.bat" too soon, you'll get an error message informing there was an issue with the sahara connection. Same if you set the "edl mode" and you wait for too long to run "dump_devinfo.bat": you'll get that error as well.

I hope this is useful for someone else. Thanks again! :)
 
Last edited:

shaurya26

Member
May 1, 2018
11
0
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET



This guide is only for devices with "OEM Unlocking" option greyed out !!!
Others can follow the simpler procedure mentioned in the TWRP thread...

Prerequisites:
QDLoader_HS_USB_Driver (Google it and find)
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

  1. Install the drivers and hex editor.
  2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev (y) )
  3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
  4. Boot into edl mode using key combo
    or using adb
    Code:
    adb reboot edl
  5. Check the port number in device manager and run " dump_devinfo.bat ".
  6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
  7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
  8. Save the devinfo.img after editing and run " unlock.bat "
  9. Reboot after success message.
  10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...:giggle:


View attachment 5154955View attachment 5154957


PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks(y) if this helped....
Tried.
It says """Failed to send Hello.
Unable to ... Sahara ...
Blah blah blah.."""
It don't dump anything...
What to do now...
 

shaurya26

Member
May 1, 2018
11
0
Hi all!

@hk96 Thanks so much! I have a TB-X304F with the "OEM unlock" option greyed out. I bought it from Amazon Europe (I'm based in Spain) so I don't really undestand why it was locked... but it was. I've spent hours trying to find the way to activate it, and the ONLY way I've been able to find that worked was yours. So thanks again!

In case it helps, I'd edit your tutorial to add something REALLY IMPORTANT in order for the process to work: the timing to set the tablet in "edl mode" is key. If you set it and run "dump_devinfo.bat" too soon, you'll get an error message informing there was an issue with the sahara connection. Same if you set the "edl mode" and you wait for too long to run "dump_devinfo.bat": you'll get that error as well.

I hope this is useful for someone else. Thanks again! :)
How much time is enough...
 

Aditya-tiwari

Member
Jun 8, 2021
6
0
  1. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn
Thank you... So much for the info.
But, please explain me the 6th point in detail..
Like, I know the port number and I also know the path to .mbn file.
But, what's the actual code that I have to write on that .bat file and the arrangement of the code.
Please help..
I'm noob to this and also junior of you..
Thanks.
 
Last edited:

Aditya-tiwari

Member
Jun 8, 2021
6
0
I just tried to do this. I installed the drivers, my tablet was seen by my computer and I am connected to port 0001. When I run the dump_devinfo.bat file, it starts and looks like it gives some errors. But then it will continue for a few minutes and then tell me the devinfo.img file was saved to the current directory. But nothing is in the directory I am working out of. Am I doing something wrong here? Does it have something to do with the errors it is showing? I attached a screenshot of what it tells me.

Also, is it normal for USB Debugging to be greyed out as well? I don't know if that has any effect on EDL mode.
Same happened with me!!
Have you found any solution for that??
 

Top Liked Posts

  • There are no posts matching your filters.
  • 9
    WARNING: DO THIS AT YOUR OWN RISK !!!!
    I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET



    This guide is only for devices with "OEM Unlocking" option greyed out !!!
    Others can follow the simpler procedure mentioned in the TWRP thread...

    Prerequisites:
    QDLoader_HS_USB_Driver (Google it and find)
    Hex Editor (eg. HxD)
    PC and some brain to understand....

    Procedure:

    1. Install the drivers and hex editor.
    2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev (y) )
    3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
    4. Boot into edl mode using key combo
      or using adb
      Code:
      adb reboot edl
    5. Check the port number in device manager and run " dump_devinfo.bat ".
    6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
    7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.
      1607766281870.png
    8. Save the devinfo.img after editing and run " unlock.bat "
    9. Reboot after success message.
    10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
    EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

    Flash TWRP and Enjoy rooting...:giggle:


    Screenshot_2020-12-12-04-07-34-338.jpeg
    recovery.jpeg



    PS: The same procedure can be done using QFIL tools (QPST)

    Attached:
    Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

    Credits:
    Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
    @hk96 (Myself)

    Hit thanks(y) if this helped....
    1
    Thank you very much! It worked perfectly!
    1
    Great! I also have this problem...
    Does unlocking in this way factory resets the tablet?
    Is the "firehose" file version sensitive (i.e., if I use the S001016 file in a S001014 TB-X304F will I have any kind of trouble?)
    Thanks!
    After unlocking, when u Boot into system it asks for a password, even if u didn't set one to start with (atleast in my case).
    So you need Boot into recovery and wipe data.
    Short answer: yes, factory reset is necessary.

    Regarding file version, I hav no idea... May be u can give it a try...
    1
    I just tried to do this. I installed the drivers, my tablet was seen by my computer and I am connected to port 0001. When I run the dump_devinfo.bat file, it starts and looks like it gives some errors. But then it will continue for a few minutes and then tell me the devinfo.img file was saved to the current directory. But nothing is in the directory I am working out of. Am I doing something wrong here? Does it have something to do with the errors it is showing? I attached a screenshot of what it tells me.

    Also, is it normal for USB Debugging to be greyed out as well? I don't know if that has any effect on EDL mode.
    1
    This is what happens at the final step for me...