[GUIDE] Unlock bootloader of Lenovo Tab 4 10 with OEM unlock "greyed out" (TB-X304F/L and other Qcom tablets)

[hk96]

WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET


This guide is only for devices with "OEM Unlocking" option greyed out !!!
Others can follow the simpler procedure mentioned in the TWRP thread...

Prerequisites:
QDLoader_HS_USB_Driver (Google it and find)
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
   or using adb

   adb reboot edl

5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.
   
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.

EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....

 

[hk96]

Reserved !!!

 

[Hb20032003]

Thank you very much! It worked perfectly!

 

[Hb20032003]

Firehose file for X304L if anyone needs it

 

[njascgil]

Thank you very much! It worked perfectly!

Great! I also have this problem...
Does unlocking in this way factory resets the tablet?
Is the "firehose" file version sensitive (i.e., if I use the S001016 file in a S001014 TB-X304F will I have any kind of trouble?)
Thanks!

 

[hk96]

Great! I also have this problem...
Does unlocking in this way factory resets the tablet?
Is the "firehose" file version sensitive (i.e., if I use the S001016 file in a S001014 TB-X304F will I have any kind of trouble?)
Thanks!

After unlocking, when u Boot into system it asks for a password, even if u didn't set one to start with (atleast in my case).
So you need Boot into recovery and wipe data.
Short answer: yes, factory reset is necessary.

Regarding file version, I hav no idea... May be u can give it a try...

 

[hk96]

Firehose file for X304L if anyone needs it

Thanks...
Let me add this to OP, so that it is easier for others.

 

[Chhayank_Sharma]

Can you please make a video tutorial? i am new to rooting and am unable to understand the instructions properly.

 

[hk96]

Can you please make a video tutorial? i am new to rooting and am unable to understand the instructions properly.

May do it when i find time....
But there are many videos on the same procedure for other Qcom phones, you can get some hint from that.
If you are very new to this, i suggest you not to do, unless your are confident.

 

[Chhayank_Sharma]

May do it when i find time....
But there are many videos on the same procedure for other Qcom phones, you can get some hint from that.
If you are very new to this, i suggest you not to do, unless your are confident.

ok thanks.

 

[njascgil]

Regarding file version, I hav no idea... May be u can give it a try...

I was going to try it, but it's my daughter's tablet and she didn't let me do it... She is afraid of loosing some games' progress...

 

[Eagle-no1]

Nothing work for me

 

[hk96]

Nothing work for me

May be you would have missed something....
This seems to work for most people.

 

[Eagle-no1]

May be you would have missed something....
This seems to work for most people.

I got to work now, I had an old bad cable in use. Thank you.

 

[Jakeup96]

PS: The same procedure can be done using QFIL tools (QPST)

How? I watched a video and I can load the mbn but I don't know what to put in the xml thing box. I tried doing the method steps but it says Failed to write hello response back to device Did not receive Sahara hello packet from device

 

[Jakeup96]

Nevermind I got it. As you can see by my signature I haven't done anything like this in many years.

 

[rustyrust]

Nevermind I got it. As you can see by my signature I haven't done anything like this in many years.

could you explain how you did it pleasssee

 

[hk96]

Nevermind I got it. As you can see by my signature I haven't done anything like this in many years.

Haha... Everything happens gradually...

could you explain how you did it pleasssee

I think, the instructions are crisp and clear as possible...
Can u tell where u got stuck ??

 

[genziutek]

Work! You're GENIUS

 

[iostrym]

hello,

I already root some device but here I'm stuck because I don't find the port number in device manager :-( drivers installed and "lenovo tab4 10" displayed in device manager. in properties I have : port_#0002.hub_#0005

I tried use 0002 or 0005 as port number but the .bat script failed each time. do I have correct port number ?

[EDIT] I have "failed to write hello response back to device" message and my tablet is in FFBM Mode.

[EDIT] in FFBM mode, my device is recognized in device manager (but i'm not sure to find the correct port and the script don't work) and in FastBoot Mode (first menu), my device seems to be not recognized in device manager. I guess that the script must be launched in this mode but I miss a driver. I install "adb drivers" + QDLoader-HS-USB_Driver_64bit_Setup drivers. What do I miss ?