# [GUIDE] Unlock bootloader of Lenovo Tab 4 10 with OEM unlock "greyed out" (TB-X304F/L and other Qcom tablets)

#### Mobilelearner

##### Senior Member
• Turn on developer option. Try to enable oem unlock.
You can start mobile in fastboot mode and use command fastboot oem unlock-go.
You can use Lenovo smart assistant and use boot.img.

#### jsgraphicart

##### Senior Member
I've tried this multiple times and still can't get it to work. I can't get passed the step to get the devinfo.img file. It runs the process and always tells me the device isn't ready but still tells me it completes and the devinfo.img is in the current directory. Only it's not. I think it's about time to give up on this. And probably give up on this tablet. I think I need to get myself a new one and be done with Lenovo.

#### Metal_Box

##### New member
It was crazy hard on my desktop. I spend at least 4 hours and nothing. I tried my laptop and breezed through the process.

I just had to share my experience because I noticed there is a post saying a cable made a difference. I figured devices to connect to tablet can make a difference too.

Thanks for the instructions and everyone sharing their experiences and solutions.

#### Akash23q2

##### Senior Member
It can might sound a bit odd to you all, like everyone my oem unlock switch was greyed out aswell but when I was just playing around and I literally typed oem unlock-go command, mine tab bootloader got unlocked without any issues, idk how it is possible but it worked somehow xD

#### shaurya26

##### Member
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET

This guide is only for devices with "OEM Unlocking" option greyed out !!!

Prerequisites:
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
Code:
adb reboot edl
5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

View attachment 5154955View attachment 5154957

PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....
Hi can't I do this using Android ADB, e.g. Bugjaegar App. Please tell..

#### hk96

##### Senior Member
• Hi can't I do this using Android ADB, e.g. Bugjaegar App. Please tell..

How can you access adb in edl mode with an app ??
Isnt it highly counterintuitive ??

But you can try, if you are sure. I cant help you out on that.

p.s. btw, never quote the entire OP

#### shaurya26

##### Member
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET

This guide is only for devices with "OEM Unlocking" option greyed out !!!

Prerequisites:
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
Code:
adb reboot edl
5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

View attachment 5154955View attachment 5154957

PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....
Can't I do this by changing the stock firmware and flashing it using stock recovery?

#### _mikau_

##### New member
Hi all!

@hk96 Thanks so much! I have a TB-X304F with the "OEM unlock" option greyed out. I bought it from Amazon Europe (I'm based in Spain) so I don't really undestand why it was locked... but it was. I've spent hours trying to find the way to unlock it, and the ONLY way I've been able to find that worked was yours. So thanks again!

In case it helps, I'd edit your tutorial to add something REALLY IMPORTANT in order for the process to work: the timing to set the tablet in "edl mode" is key. If you set it and plug the USB wire and run "dump_devinfo.bat" too soon, you'll get an error message informing there was an issue with the sahara connection. Same if you set the "edl mode" and you wait for too long to run "dump_devinfo.bat": you'll get that error as well.

I hope this is useful for someone else. Thanks again!

Last edited:

#### shaurya26

##### Member
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET

This guide is only for devices with "OEM Unlocking" option greyed out !!!

Prerequisites:
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
Code:
adb reboot edl
5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

View attachment 5154955View attachment 5154957

PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....
Tried.
It says """Failed to send Hello.
Unable to ... Sahara ...
Blah blah blah.."""
It don't dump anything...
What to do now...

#### shaurya26

##### Member
Hi all!

@hk96 Thanks so much! I have a TB-X304F with the "OEM unlock" option greyed out. I bought it from Amazon Europe (I'm based in Spain) so I don't really undestand why it was locked... but it was. I've spent hours trying to find the way to activate it, and the ONLY way I've been able to find that worked was yours. So thanks again!

In case it helps, I'd edit your tutorial to add something REALLY IMPORTANT in order for the process to work: the timing to set the tablet in "edl mode" is key. If you set it and run "dump_devinfo.bat" too soon, you'll get an error message informing there was an issue with the sahara connection. Same if you set the "edl mode" and you wait for too long to run "dump_devinfo.bat": you'll get that error as well.

I hope this is useful for someone else. Thanks again!
How much time is enough...

#### _mikau_

##### New member
How much time is enough...
I'd say to plug the USB wire not before 10 seconds and not later than 1 minute after setting the edl mode.

But this is just based on my personal experience, as I couldn't find any official documentation from Lenovo regarding this.

#### shaurya26

##### Member
I'd say to plug the USB wire not before 10 seconds and not later than 1 minute after setting the edl mode.

But this is just based on my personal experience, as I couldn't find any official documentation from Lenovo regarding this.
Thanks.
I'll try.

##### Member
1. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn
Thank you... So much for the info.
But, please explain me the 6th point in detail..
Like, I know the port number and I also know the path to .mbn file.
But, what's the actual code that I have to write on that .bat file and the arrangement of the code.
I'm noob to this and also junior of you..
Thanks.

Last edited:

##### Member
I just tried to do this. I installed the drivers, my tablet was seen by my computer and I am connected to port 0001. When I run the dump_devinfo.bat file, it starts and looks like it gives some errors. But then it will continue for a few minutes and then tell me the devinfo.img file was saved to the current directory. But nothing is in the directory I am working out of. Am I doing something wrong here? Does it have something to do with the errors it is showing? I attached a screenshot of what it tells me.

Also, is it normal for USB Debugging to be greyed out as well? I don't know if that has any effect on EDL mode.
Same happened with me!!
Have you found any solution for that??

##### Member
Same happened with me!!
Did you found any solution
This is what happens at the final step for me...

### Top Liked Posts

• There are no posts matching your filters.
• 9
WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET

This guide is only for devices with "OEM Unlocking" option greyed out !!!

Prerequisites:
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
Code:
adb reboot edl
5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.
EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....
1
Thank you very much! It worked perfectly!
1
Great! I also have this problem...
Does unlocking in this way factory resets the tablet?
Is the "firehose" file version sensitive (i.e., if I use the S001016 file in a S001014 TB-X304F will I have any kind of trouble?)
Thanks!
After unlocking, when u Boot into system it asks for a password, even if u didn't set one to start with (atleast in my case).
So you need Boot into recovery and wipe data.
Short answer: yes, factory reset is necessary.

Regarding file version, I hav no idea... May be u can give it a try...
1
I just tried to do this. I installed the drivers, my tablet was seen by my computer and I am connected to port 0001. When I run the dump_devinfo.bat file, it starts and looks like it gives some errors. But then it will continue for a few minutes and then tell me the devinfo.img file was saved to the current directory. But nothing is in the directory I am working out of. Am I doing something wrong here? Does it have something to do with the errors it is showing? I attached a screenshot of what it tells me.

Also, is it normal for USB Debugging to be greyed out as well? I don't know if that has any effect on EDL mode.
1
This is what happens at the final step for me...