[HOWTO] Unlock TF700T in 2020

d.l.i.w · Sep 1, 2020

UPDATE: Asus has updated the servers. Older protocols for HTTPS, which are required for older Android versions, are no longer supported. Unfortunately, some additional steps are needed for the unlock now. See this post for step by step instructions.

I recently got my hands on a Asus TF700T with a locked boot loader. The official unlock app did not work, so I took a closer look. What I found is that the Asus servers are still up and running, but connection fails due to certificate pinning. And that can be dealt with

So here are the instructions:

The device must be rooted. KingoRoot (the app) worked for me.
Download the unlock bundle from the link below. I didn't find a way to directly attach files here.
Copy both apks to /system/app, change the permission to 0644
For this, a remount of the system partition may be needed:
mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system

DMClient.apk replaces the original DMClient.apk and DMClient.odex (i.e. you have to rename/move/delete the .odex file)
The modified unlock app cannot be installed like any other and must be installed that way
Reboot the device. On startup Android shows that one app is optimized (that's DMClient). The unlock app is now installed.
Use the unlock app. Google account does not matter.

Watch logcat to get some more information on what the unlock app does. On success the device immediately reboots, so redirect adb logcat to a file if you want to keep the log.

I only tested on a TF700T with WW SKU, V10.6.1.14.10. I assume that other firmware versions work as well.
The unlock app for TF700T also supports TF201, TF300T, TF300TG, and TF300TL, but a modified DMClient is needed.

In case something goes wrong and your device gets stuck at the boot screen, this advice may be helpful:

Bricked my Asus TF300T? Manual JB update

First, my device failed to get the OTA Update because I deleted some system apps (see my original post). Then I found this post where another user restored original APKs in /system/apps and manage...

android.stackexchange.com

(thanks @DieAbrissbirne)

Download links

Unlock app and DMClient for TF700T
https://leo.pfweb.eu/dl/OaKdx

WW_epad-10.6.1.14.10
JOP40D.US_epad-10.6.1.14.10-20130801

DMClient for TF300T
https://leo.pfweb.eu/dl/vUHnp

DMClient for TF300TG
https://leo.pfweb.eu/dl/xphHy

DMClient for TF201
https://leo.pfweb.eu/dl/pKvEA

WW_epad_10.4.2.17

---------------------------------------------------------------------

Unlock app and DMClient for TF701T
https://leo.pfweb.eu/dl/2AcpB

DMClient for ME301T (also seems to work for ME302KL)
https://leo.pfweb.eu/dl/uiJPN

2020tf700 · Sep 2, 2020

Dealing with this same issue, but can't get your method to work... Do I need to already have the v7 unlock tool installed before this? And do I just remove the DMClient.odex file from /system/app since there is only the replacement file for DMClient.apk?

Any help is appreciated!

d.l.i.w · Sep 3, 2020

You don't need the original unlock app. I recommend uninstalling it. DMClient.odex is not needed, you can rename or delete it. I don't know what happens if you keep it as is.

At which point does it fail?
Is the unlock app installed after restart? If not, check the permissions of both files. It must be 644 (-rw-r--r--).
If you can start the modified unlock app: Do you get an error message? Is there anything relevant in logcat (search for "unlock")? Is the internet connection ok?

2020tf700 · Sep 3, 2020

Code:

-rw-r--r-- root     root       442064 2020-09-02 22:19 UnLock_App_V7_update.apk

Removed both DMClient.apk and .odex and don't have any original unlock apps installed. But I don't have the modified unlock app installed after restart.

d.l.i.w · Sep 3, 2020

Which firmware version do you have?

The permissions look good. Basically all apks in /system/app should have the same owner and permissions.
If I understand correctly, you have removed the original DMClient.apk and DMClient.odex and copied the modified one from the download. Is the permission correct?

If permissions are ok, it's hard to say, what is wrong. I would suggest to rename UnLock_App_V7_update.apk to something else (maybe unlock.apk) and reboot the device. This forces a reinstall. Best would be if you could watch logcat during startup. The log will tell you why the installation fails.

Edit: Are you sure, the app is not installed? Depending on the locale it may not be literally translated as "unlock app". The icon is a gear with a lock.

2020tf700 · Sep 3, 2020

JOP40D.US_epad-10.6.1.14.10-20130801

Code:

W/ActivityManager(  524): No content provider found for permission revoke: file:///data/local/tmp/UnLock_App_V7_update.apk
W/ActivityManager(  524): No content provider found for permission revoke: file:///data/local/tmp/UnLock_App_V7_update.apk
I/PackageManager(  524): Copying native libraries to /data/app-lib/vmdl1192069982
W/PackageParser(  524): Exception reading classes.dex in /data/app/vmdl1192069982.tmp
W/PackageParser(  524): java.lang.SecurityException: META-INF/MANIFEST.MF has invalid digest for classes.dex in /data/app/vmdl1192069982.tmp
W/PackageParser(  524): 	at java.util.jar.JarVerifier.invalidDigest(JarVerifier.java:131)
W/PackageParser(  524): 	at java.util.jar.JarVerifier.access$100(JarVerifier.java:53)
W/PackageParser(  524): 	at java.util.jar.JarVerifier$VerifierEntry.verify(JarVerifier.java:123)
W/PackageParser(  524): 	at java.util.jar.JarFile$JarFileInputStream.read(JarFile.java:119)
W/PackageParser(  524): 	at java.io.BufferedInputStream.read(BufferedInputStream.java:304)
W/PackageParser(  524): 	at android.content.pm.PackageParser.loadCertificates(PackageParser.java:447)
W/PackageParser(  524): 	at android.content.pm.PackageParser.collectCertificates(PackageParser.java:634)
W/PackageParser(  524): 	at com.android.server.pm.PackageManagerService.installPackageLI(PackageManagerService.java:7959)
W/PackageParser(  524): 	at com.android.server.pm.PackageManagerService.access$1900(PackageManagerService.java:180)
W/PackageParser(  524): 	at com.android.server.pm.PackageManagerService$5.run(PackageManagerService.java:6108)
W/PackageParser(  524): 	at android.os.Handler.handleCallback(Handler.java:725)
W/PackageParser(  524): 	at android.os.Handler.dispatchMessage(Handler.java:92)
W/PackageParser(  524): 	at android.os.Looper.loop(Looper.java:137)
W/PackageParser(  524): 	at android.os.HandlerThread.run(HandlerThread.java:60)
E/PackageParser(  524): Package com.asus.unlock has no certificates at entry classes.dex; ignoring!

Does this SO post make sense as the issue? stackoverflow DOT com/questions/44386464/android-app-installation-failed-package-com-my-app-has-no-certificates-at-entry

d.l.i.w · Sep 3, 2020

That's interesting. The app isn't signed at all, that's why "normal install" does not work. But as system app things worked for me and there was no error.
Besides rooting the device I had unlocked developer options and allowed install from unknown sources. But I wouldn't expect these to make any difference.

Is there anything about DMClient in the log? The same applies here. It would be strange if it works for one and not for the other.

2020tf700 · Sep 3, 2020

Got it to work. After digging a bit deeper into the logs I think it was confused because I had already installed and uninstalled the original unlock tool. It was complaining about the unlock package already existing, etc.

So, I just went all the way back to a factory reset to remove everything and then did your original steps and it worked. I was watching logcat and it didn't say anything about the unlock package for the time it worked too btw. I guess uninstalling the original and restarting wasn't enough to truly get rid of it enough without a factory reset.

Thanks for your help and effort to put this together!

d.l.i.w · Sep 3, 2020

Great! Do you mean, there was no output from the unlock app at all? There should have been some information starting with

Code:

/****Unlock

. However, it does not persist reboot, so you have to watch live or redirect to a file.

2020tf700 · Sep 3, 2020

I was watching it live and did a find on the output for 'unlock' once it restarted and didn't see anything but I suppose I could have missed it.

d.l.i.w · Sep 3, 2020

It's only a couple of lines so indeed easy to miss. Thanks for the feedback :good:

iserver · Sep 7, 2020

d.l.i.w said:
It's only a couple of lines so indeed easy to miss. Thanks for the feedback :good:

Didn't work for me, unfotunatly

. I still get message - "Failed to unlock your device, please try again later".
Device: TF300TG.
FW: WW_epad-10.4.3.9-20121106
Android: 4.1.1

Tried to reset to factory settings. Didn't help either.

Please, tell me - can I use V7 apk with Android 4.2 / 4.2.1 or i need patched version of Unlock_V8.apk ?

I/*** Unlock: request( 2000): h t t p s: //mdm.asus.com/DMServer/DeviceState?id=XXXXXXXXXXXX&AUTH=YYYYYYYYYYYYYYY&ACTION=get

D/dalvikvm( 2000): GC_CONCURRENT freed 269K, 5% free 6796K/7111K, paused 16ms+20ms, total 86ms

D/DMServerUnlock( 2000): index of line: 1

D/DMServerUnlock( 2000): DM Server Response: 0

W/GoogleVerify( 2000): no google account

I/UnLockActivity( 2000): no Google account and pin code

Of course, I changed variable values in request URL.

d.l.i.w · Sep 8, 2020

iserver said:
Device: TF300TG

Obviously DMClient is specific to each device model. So, the modified DMClient is not compatible with devices other than TF700T.

Is the original firmware for the TF300TG available somewhere? If so, I might be able to create a modified DMClient also for this model, but I can't promise anything.

Down0038 · Sep 17, 2020

So I am fairly early into this root / unlock of my new tf700t.

I rooted / unlocked my old tf300t at least 8 years ago now.
I recently dusted it off and immediately after getting 7.1.2 installed on it and having it set up just right, stepped on it by accident.
So I bought a tf700t and have been trying to root it for a whole day with out success....

I have successfully upgraded the boot loader from 10.4.4.25 to WW 10.6.1.14.8 and gotten Motochopper to root.

Can you go over the tools and method you used to put the two files from the package into the system/apps folder with he new permissions?
When I try and move the files my go-to rooted file explorer (Ghost commander) refuses to change the permissions or move the files.

Is it possible that GhostCommander and TotalCommander simply don't work with the motochopper version of rooting? or am I missing something more fundamental?
I get that given the age of the tablet I will not be able to unlock with the normal v7 unlocker and b/c Asus are bastards.

What a Deus-ex it was to find a post from only a few weeks ago on the topic.
I love XDA.

d.l.i.w · Sep 17, 2020

Down0038 said:
Can you go over the tools and method you used to put the two files from the package into the system/apps folder with he new permissions?
When I try and move the files my go-to rooted file explorer (Ghost commander) refuses to change the permissions or move the files.

Is it possible that GhostCommander and TotalCommander simply don't work with the motochopper version of rooting? or am I missing something more fundamental?
I get that given the age of the tablet I will not be able to unlock with the normal v7 unlocker and b/c Asus are bastards.

Total Commander worked for me just fine. It asked if the system partition should be mounted writable and then copied the files. The same with setting permissions.
I used KingoRoot, because Motochopper does not work on the latest firmware, but this shouldn't make any difference. You could try to copy the files via adb shell.

I was quite surprised that the Asus servers are still running and functional. The only issue is that the original unlock app does not trust the new server certificates.

Down0038 · Sep 17, 2020

"the device is unlocked"

mak8tack · Sep 26, 2020

Thanks for this work! Dusted off an old TF700T, but I'm unable to unlock, with the following logs (grepped for unlock):

Code:

I/ActivityManager(  520): START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.asus.unlock/.EulaActivity} from pid 835
I/ActivityManager(  520): Start proc com.asus.unlock for activity com.asus.unlock/.EulaActivity: pid=1715 uid=1000 gids={41000, 3003, 1015, 1028, 3002, 3001, 1006, 3007}
I/ActivityManager(  520): START u0 {cmp=com.asus.unlock/.UnLockActivity} from pid 1715
D/DMServerUnlock( 1715): get DMServer Response retry count = 3
I/*** Unlock: md5 input( 1715): 50465d2a5837unknown8bf0d93b7649a513c736f4016495a5ec5b2ab8a0dm_servernEEd_query_STATe
I/*** Unlock: request( 1715): [url]https://mdm.asus.com/DMServer/DeviceState?id=50465d2a5837&AUTH=OsYXBMvoh62t24Ukl025Lw&ACTION=get[/url]
D/DMServerUnlock( 1715): index of line: 3
D/DMServerUnlock( 1715): DM Server Response: 105
I/ActivityManager(  520): START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.asus.unlock/.EulaActivity} from pid 835
I/UnLockActivity( 1715): ============= UnLockActivity  onStart =======================
I/UnLockActivity( 1715): ============= UnLockActivity  onResume =======================
D/DMServerUnlock( 1715): get DMServer Response retry count = 3
I/*** Unlock: md5 input( 1715): 50465d2a5837unknown8bf0d93b7649a513c736f4016495a5ec5b2ab8a0dm_servernEEd_query_STATe
I/*** Unlock: request( 1715): [url]https://mdm.asus.com/DMServer/DeviceState?id=50465d2a5837&AUTH=OsYXBMvoh62t24Ukl025Lw&ACTION=get[/url]
D/DMServerUnlock( 1715): index of line: 3
D/DMServerUnlock( 1715): DM Server Response: 105
D/DMServerUnlock( 1715): get DMServer Response retry count = 3
I/*** Unlock: md5 input( 1715): 50465d2a5837unknown8bf0d93b7649a513c736f4016495a5ec5b2ab8a0dm_servernEEd_query_STATe
I/*** Unlock: request( 1715): [url]https://mdm.asus.com/DMServer/DeviceState?id=50465d2a5837&AUTH=OsYXBMvoh62t24Ukl025Lw&ACTION=get[/url]
D/DMServerUnlock( 1715): index of line: 3
D/DMServerUnlock( 1715): DM Server Response: 105

I fear I have one of those TF700's that doesn't have a valid serial number, so it can't unlock?

d.l.i.w · Sep 26, 2020

For me unlock worked, although the Asus website did not recognize the serial number when I tried to register my device.

I don't know what the response 105 means, but this does not necessarily mean an error. It could be that the modified DMClient was not installed correctly.
Which firmware version do you have? Did you do a factory reset before?

mak8tack · Sep 29, 2020

d.l.i.w said:
For me unlock worked, although the Asus website did not recognize the serial number when I tried to register my device.

I don't know what the response 105 means, but this does not necessarily mean an error. It could be that the modified DMClient was not installed correctly.
Which firmware version do you have? Did you do a factory reset before?

Yes, I factory reset before installing. I had rooted with Kingo Root / Superuser, but had to root via ADB, because I couldn't download and run the apk directly on the tablet after the factory reset. I did allow it to install all the associated root utilities/apps. I used a console/terminal app called "Material Terminal" (by Yaroslav Shevchuk) installed by the play store to su, mv the DMClient and Unlock_App_v7 apk files to /system/app and chmod 0644 them... every reboot shows it "Optimizing the app".

I have Android v 4.2.1 Kernel version 3.1.10-gb1a9af5 dated Aug 1 2013

I'll probably try doing another factory reset, root, and install again just to be sure.

solo786 · Oct 10, 2020

Does someone have a correct version of Kingoroot apk that does work for ICS tf700t please :fingers-crossed:? I tried all i've found it doesnt work
EDIT: Found it

The tutorials works!!! Thank you very much

))
TF700T 4.2.1 - 10.6.1.14.10-20130801