[GUIDE] Unlock bootloader of Lenovo Tab 4 10 with OEM unlock "greyed out" (TB-X304F/L and other Qcom tablets)

[Mobilelearner]

Turn on developer option. Try to enable oem unlock.
You can start mobile in fastboot mode and use command fastboot oem unlock-go.
You can use Lenovo smart assistant and use boot.img.

 

[jsgraphicart]

I've tried this multiple times and still can't get it to work. I can't get passed the step to get the devinfo.img file. It runs the process and always tells me the device isn't ready but still tells me it completes and the devinfo.img is in the current directory. Only it's not. I think it's about time to give up on this. And probably give up on this tablet. I think I need to get myself a new one and be done with Lenovo.

 

[Metal_Box]

It was crazy hard on my desktop. I spend at least 4 hours and nothing. I tried my laptop and breezed through the process.

I just had to share my experience because I noticed there is a post saying a cable made a difference. I figured devices to connect to tablet can make a difference too.

Thanks for the instructions and everyone sharing their experiences and solutions.

 

[Akash23q2]

It can might sound a bit odd to you all, like everyone my oem unlock switch was greyed out aswell but when I was just playing around and I literally typed oem unlock-go command, mine tab bootloader got unlocked without any issues, idk how it is possible but it worked somehow xD

 

[shaurya26]

WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET


This guide is only for devices with "OEM Unlocking" option greyed out !!!
Others can follow the simpler procedure mentioned in the TWRP thread...

Prerequisites:
QDLoader_HS_USB_Driver (Google it and find)
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
   or using adb

   adb reboot edl

5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.

EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

View attachment 5154955View attachment 5154957


PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....

Hi can't I do this using Android ADB, e.g. Bugjaegar App. Please tell..

 

[hk96]

Hi can't I do this using Android ADB, e.g. Bugjaegar App. Please tell..

How can you access adb in edl mode with an app ??
Isnt it highly counterintuitive ??

But you can try, if you are sure. I cant help you out on that.

p.s. btw, never quote the entire OP

 

[shaurya26]

WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET


This guide is only for devices with "OEM Unlocking" option greyed out !!!
Others can follow the simpler procedure mentioned in the TWRP thread...

Prerequisites:
QDLoader_HS_USB_Driver (Google it and find)
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
   or using adb

   adb reboot edl

5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.

EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

View attachment 5154955View attachment 5154957


PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....

Can't I do this by changing the stock firmware and flashing it using stock recovery?

 

[_mikau_]

Hi all!

@hk96 Thanks so much! I have a TB-X304F with the "OEM unlock" option greyed out. I bought it from Amazon Europe (I'm based in Spain) so I don't really undestand why it was locked... but it was. I've spent hours trying to find the way to unlock it, and the ONLY way I've been able to find that worked was yours. So thanks again!

In case it helps, I'd edit your tutorial to add something REALLY IMPORTANT in order for the process to work: the timing to set the tablet in "edl mode" is key. If you set it and plug the USB wire and run "dump_devinfo.bat" too soon, you'll get an error message informing there was an issue with the sahara connection. Same if you set the "edl mode" and you wait for too long to run "dump_devinfo.bat": you'll get that error as well.

I hope this is useful for someone else. Thanks again!

 

[shaurya26]

WARNING: DO THIS AT YOUR OWN RISK !!!!
I AM NOT RESPONSIBLE IF YOU START CRYING INTO YOUR BRICKED TABLET


This guide is only for devices with "OEM Unlocking" option greyed out !!!
Others can follow the simpler procedure mentioned in the TWRP thread...

Prerequisites:
QDLoader_HS_USB_Driver (Google it and find)
Hex Editor (eg. HxD)
PC and some brain to understand....

Procedure:

1. Install the drivers and hex editor.
2. Clone this repo to PC - https://github.com/Naveen3Singh/BLUnlocker (Thanks to the dev )
3. Extract the firehose file from stock rom. (eg. "prog_emmc_firehose_8917_ddr.mbn" for TB-X304)
4. Boot into edl mode using key combo
   or using adb

   adb reboot edl

5. Check the port number in device manager and run " dump_devinfo.bat ".
6. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn)
7. A file named " devinfo.img " will be dumped to the working dir. Edit it using an HEX editor as shown below.View attachment 5154947
8. Save the devinfo.img after editing and run " unlock.bat "
9. Reboot after success message.
10. Voila !! You have Successful unlocked the bootloader. Reboot to system by holding the power button.

EDIT (13/01/2020): After unlocking bootloader and restarting, if it asks for password, Reboot to recovery and format data...

Flash TWRP and Enjoy rooting...

View attachment 5154955View attachment 5154957


PS: The same procedure can be done using QFIL tools (QPST)

Attached:
Firehose file of TB-X304F and TB-X304L (DONT USE ON OTHER DEVICES!!!)

Credits:
Thanks to the dev who wrote the code ( https://github.com/Naveen3Singh )
@hk96 (Myself)

Hit thanks if this helped....

Tried.
It says """Failed to send Hello.
Unable to ... Sahara ...
Blah blah blah.."""
It don't dump anything...
What to do now...

 

[shaurya26]

Hi all!

@hk96 Thanks so much! I have a TB-X304F with the "OEM unlock" option greyed out. I bought it from Amazon Europe (I'm based in Spain) so I don't really undestand why it was locked... but it was. I've spent hours trying to find the way to activate it, and the ONLY way I've been able to find that worked was yours. So thanks again!

In case it helps, I'd edit your tutorial to add something REALLY IMPORTANT in order for the process to work: the timing to set the tablet in "edl mode" is key. If you set it and run "dump_devinfo.bat" too soon, you'll get an error message informing there was an issue with the sahara connection. Same if you set the "edl mode" and you wait for too long to run "dump_devinfo.bat": you'll get that error as well.

I hope this is useful for someone else. Thanks again!

How much time is enough...

 

[_mikau_]

How much time is enough...

I'd say to plug the USB wire not before 10 seconds and not later than 1 minute after setting the edl mode.

But this is just based on my personal experience, as I couldn't find any official documentation from Lenovo regarding this.

 

[shaurya26]

I'd say to plug the USB wire not before 10 seconds and not later than 1 minute after setting the edl mode.

But this is just based on my personal experience, as I couldn't find any official documentation from Lenovo regarding this.

Thanks.
I'll try.

 

[Aditya-tiwari]

1. Mention port number and full path to "*.mbn" file (eg. D:\where\every\it\is\prog_emmc_firehose_8917_ddr.mbn

Thank you... So much for the info.
But, please explain me the 6th point in detail..
Like, I know the port number and I also know the path to .mbn file.
But, what's the actual code that I have to write on that .bat file and the arrangement of the code.
Please help..
I'm noob to this and also junior of you..
Thanks.

 

[Aditya-tiwari]

I just tried to do this. I installed the drivers, my tablet was seen by my computer and I am connected to port 0001. When I run the dump_devinfo.bat file, it starts and looks like it gives some errors. But then it will continue for a few minutes and then tell me the devinfo.img file was saved to the current directory. But nothing is in the directory I am working out of. Am I doing something wrong here? Does it have something to do with the errors it is showing? I attached a screenshot of what it tells me.

Also, is it normal for USB Debugging to be greyed out as well? I don't know if that has any effect on EDL mode.

Same happened with me!!
Have you found any solution for that??

 

[Aditya-tiwari]

Same happened with me!!
Did you found any solution

This is what happens at the final step for me...

 

[hk96]

I just tried to do this. I installed the drivers, my tablet was seen by my computer and I am connected to port 0001. When I run the dump_devinfo.bat file, it starts and looks like it gives some errors. But then it will continue for a few minutes and then tell me the devinfo.img file was saved to the current directory. But nothing is in the directory I am working out of. Am I doing something wrong here? Does it have something to do with the errors it is showing? I attached a screenshot of what it tells me.

Also, is it normal for USB Debugging to be greyed out as well? I don't know if that has any effect on EDL mode.

The output shows that your device is not detected. Check for COM port or keep a look on the timing, as mentioned by other people.

Thank you... So much for the info.
But, please explain me the 6th point in detail..
Like, I know the port number and I also know the path to .mbn file.
But, what's the actual code that I have to write on that .bat file and the arrangement of the code.
Please help..
I'm noob to this and also junior of you..
Thanks.

Just enter the port number and path when it promtps.
Since I did long back, I don't remember properly, but the thread is sufficiently detailed ig.

 

[Rainberry]

How can you access adb in edl mode with an app ??
Isnt it highly counterintuitive ??

But you can try, if you are sure. I cant help you out on that.

p.s. btw, never quote the entire OP

I have been trying to enable the OEM unlocking on my TB-X304L. Unfortunately i do not know how the hex editor works and do not know to use it. Could I try to relock the bootloader and check whether the OEM unlocking greyed option disappears?
Thanks mate!

 

[its_vipin_52]

I am unable to understand step 5
Please explain me someone

 

[hk96]

I am unable to understand step 5
Please explain me someone

When you run the .bat file, it will ask for com port number in which the phone is connected and path for firehose file.

 

[its_vipin_52]

When you run the .bat file, it will ask for com port number in which the phone is connected and path for firehose file.

Thanks i get it!