• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[HOWTO] Unlock TF700T in 2020

Search This thread

Pabos

New member
Feb 3, 2013
2
1
Holy barking turtles!!!! I don't know what I did but it FINALLY worked!!!!
I AM UNLOCKED!
Man you guys don't know my relief - @Ice_83 , @maisomenos , @GloGlorius @d.l.i.w (feel like I'm at the Oscars here ! :ROFLMAO:) - I'm jumping around the room with excitement. Thank all of you and everyone else who's contributed on here for all of your help and patience!

For the record, I couldn't get the Ubuntu VB working for me, all I did was, playing around off @Ice_83 's above, went in and changed a couple of the settings on windows. I set tls_version_client_min and tls_version_server_min to Unbounded instead of TLS1_2 and hey presto! All sites were working on my tab!

View attachment 5379997

Now to go and see if I can totally brick it flashing a new ROM. :ROFLMAO:

Thanks again everyone!
DUDE!! I went on and made an account especially so that I could THANK YOU! Was stuck on the exact same issue like you and @Ice_83, was about to lose all hope. But DAYUM! Changin those tls versions did the trick. I used windows MTM with --ssl-insecure argument.

You guys are frickin legends. Thanks again :)
 
  • Like
Reactions: Stealth75

Stealth75

Member
Feb 22, 2021
32
4
DUDE!! I went on and made an account especially so that I could THANK YOU! Was stuck on the exact same issue like you and @Ice_83, was about to lose all hope. But DAYUM! Changin those tls versions did the trick. I used windows MTM with --ssl-insecure argument.

You guys are frickin legends. Thanks again :)
That's awesome man! I've got almost zero knowhow when it comes to this sort of stuff so I'm glad i was able to help in any way.
However many months on my little tf201 is my main writing machine now, still going strong.
Enjoy your new tablet!
 

duckfly

New member
Feb 22, 2008
1
0
thanks for all great guys in this thread, I successfully unlock my TF300T at 2021/10/18 !

here are some important points for unlocking that previous replies has or never mentioned :

1. make sure your ROM verion is v10.6.1.x (Android 4.2, SDK17), but NEVER USE 10.6.1.27, or you can't root device, and modified DMClient.apk (only for SDK17 !!) won't run normally also.
I downgrade my device to V10.6.1.15.3 (you can find it ==here==, extract the content to the sdcard or internal storage root, push power button twice and system will detect it, follow system prompt to downgrade or upgrade.)

2.root your device. I use motochopper, easy and fast.
enable usb debug in developer setting and allow unsafe apk in security setting.
use motochopper to root, reboot, run SuperSU and update su binary,

3.install adbd inseure to get root access more easily, execute & enable it from your device.
#adb install adbd-Insecure-v2.00.apk

4. now you can get root access to install DMClient.apk & UnLock_App_V7_update.apk :
bash# adb shell
[email protected]# mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system
[email protected]# cd /system/app/
[email protected]# mv DMClient.apk DMClient.apk.bak
[email protected]# mv DMClient.odex DMClient.odex.bak
[email protected]# exit
bash# adb push DMClient.apk /system/app/
bash# adb push UnLock_App_V7_update.apk /system/app/
bash # adb reboot

5.no need to download the mitmproxy VM image, just download it from official site and run mitmweb directly, then check the following options:

showhost Enable
ssl_insecure Enable
tls_version_client_min UNBOUNDED
tls_version_server_min UNBOUNDED

and set your device wifi to go through mitm proxy: <your_pc_ip:8080>
open browser to http://mitm.it, find Android OS, and install certs.

6. now run Unlock App V7, then enjoy!
 
Last edited:

xda-korea0799

New member
Oct 30, 2021
2
0
thanks for all great guys in this thread, I successfully unlock my TF300T at 2021/10/18 !

here are some important points for unlocking that previous replies has or never mentioned :

1. make sure your ROM verion is v10.6.1.x (Android 4.2, SDK17), but NEVER USE 10.6.1.27, or you can't root device, and modified DMClient.apk (only for SDK17 !!) won't run normally also.
I downgrade my device to V10.6.1.15.3 (you can find it ==here==, extract the content to the sdcard or internal storage root, push power button twice and system will detect it, follow system prompt to downgrade or upgrade.)

2.root your device. I use motochopper, easy and fast.
enable usb debug in developer setting and allow unsafe apk in security setting.
use motochopper to root, reboot, run SuperSU and update su binary,

3.install adbd inseure to get root access more easily, execute & enable it from your device.
#adb install adbd-Insecure-v2.00.apk

4. now you can get root access to install DMClient.apk & UnLock_App_V7_update.apk :
bash# adb shell
[email protected]# mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system
[email protected]# cd /system/app/
[email protected]# mv DMClient.apk DMClient.apk.bak
[email protected]# mv DMClient.odex DMClient.odex.bak
[email protected]# exit
bash# adb push DMClient.apk /system/app/
bash# adb push UnLock_App_V7_update.apk /system/app/
bash # adb reboot

5.no need to download the mitmproxy VM image, just download it from official site and run mitmweb directly, then check the following options:

showhost Enable
ssl_insecure Enable
tls_version_client_min UNBOUNDED
tls_version_server_min UNBOUNDED

and set your device wifi to go through mitm proxy: <your_pc_ip:8080>
open browser to http://mitm.it, find Android OS, and install certs.

6. now run Unlock App V7, then enjoy!
@duckfly ,
Could you share DMClient.apk & UnLock_App_V7_update.apk ?
The poster links are dead.
Thx.

-- Update 2021/11/05 --
I have successful to unlock my TFT300T today,
The issue is client tls handshake failed between android and mitmproxy PC.


55iQ02D.png


Here is tip of commands for mitmproxy option of windows version (in power shell):

mitmproxy.exe --set tls_version_server_min=UNBOUNDED --set tls_version_client_min=UNBOUNDED --set showhost=true --set ssl_insecure=true

Then modify your wifi ,Append proxy ip and port,
Open browser ,install mitmproxy android certification,
Execute unlockapp.
 

Attachments

  • TF300T.zip
    749.5 KB · Views: 13
Last edited:

4321cb

New member
Oct 30, 2021
1
0
Instead of the burned-out motherboard, I put the one I bought at Aliexpress. Serial number of the tablet is 111111111111.

Will the described unlocking method work in my case?
Is the serial number checked on the Asus server when unlocking by this method?
Thank you in advance!
 

lelik200969

New member
Oct 30, 2021
2
0
Спасибо всем отличным ребятам в этой теме, я успешно разблокировал свой TF300T 2021.10.18!

Вот некоторые важные моменты для разблокировки, о которых в предыдущих ответах не упоминалось или никогда не упоминалось:

1. убедитесь, что версия вашего ПЗУ v10.6.1.x (Android 4.2, SDK17), но НИКОГДА НЕ ИСПОЛЬЗУЙТЕ 10.6.1.27, иначе вы не можете получить root-права, и модифицированный DMClient.apk (только для SDK17 !!) не будет также нормально работать.
Я понижаю версию своего устройства до V10.6.1.15.3 (вы можете найти его == здесь == , извлеките содержимое на SD-карту или корень внутреннего хранилища, дважды нажмите кнопку питания, и система обнаружит его, следуйте системным подсказкам для понижения или обновления. )

2. рутировать ваше устройство. Я использую моточоппер , легко и быстро.
включить отладку по usb в настройках разработчика и разрешить небезопасный apk в настройках безопасности.
используйте motochopper для рутирования, перезагрузки, запуска SuperSU и обновления бинарного файла su,

3. установите adbd Inseure, чтобы упростить получение root-доступа, запустите и включите его со своего устройства.
#adb install adbd-Insecure-v2.00.apk

4. Теперь вы можете получить root-доступ для установки DMClient.apk & UnLock_App_V7_update.apk:
bash # оболочка adb
root @ android # монтировать -o remount, rw -t ext4 / dev / block / mmcblk0p1 / system
корень @ android # cd / system / app /
root @ android # mv DMClient.apk DMClient.apk.bak
root @ android # mv DMClient.odex DMClient.odex.bak
root @ android # выход
bash # adb push DMClient.apk / system / app /
bash # adb push UnLock_App_V7_update.apk / system / app /
bash # adb reboot

5. нет необходимости загружать образ виртуальной машины mitmproxy, просто загрузите его с официального сайта и запустите mitmweb напрямую, затем проверьте следующие параметры:

showhost Включить
ssl_insecure Включить
tls_version_client_min НЕОГРАНИЧЕННЫЙ
tls_version_server_min НЕОГРАНИЧЕННЫЙ

и настройте Wi-Fi устройства для прохождения через прокси-сервер mitm: <your_pc_ip: 8080>
откройте браузер на http://mitm.it , найдите ОС Android и установите сертификаты.

6. Теперь запустите Unlock App V7 и наслаждайтесь!
Поделитесь пож-та DMClient.apk и UnLock_App_V7_update.apk для TF300T. Никак не могу разблокировать загрузчик ! Всё делаю по инструкции . Есть подозрение что DMClient.apk и UnLock_App_V7_update.apk не подходят.
 

lelik200969

New member
Oct 30, 2021
2
0
@ [USER = 849791] утенок [/ USER],
Не могли бы вы поделиться DMClient.apk и UnLock_App_V7_update.apk?
Ссылки на постеры мертвы.
Спасибо.

- Обновление 2021/11/05 -
Мне удалось разблокировать свой TFT300T сегодня,
Проблема заключается в том, что не удалось установить связь клиента tls между Android и ПК mitmproxy.


55iQ02D.png


Вот подсказка команд для опции mitmproxy версии Windows (в Power Shell):

mitmproxy.exe --set tls_version_server_min = UNBOUNDED --set tls_version_client_min = UNBOUNDED --set showhost = true --set ssl_insecure = true

Затем измените свой Wi-Fi, добавить IP-адрес и порт прокси,
Откройте браузер, устанавливайте сертификацию mitmproxy android,
Запустите unlockapp.

@ [USER = 849791] утенок [/ USER],
Не могли бы вы поделиться DMClient.apk и UnLock_App_V7_update.apk?
Ссылки на постеры мертвы.
Спасибо.

- Обновление 2021/11/05 -
Мне удалось разблокировать свой TFT300T сегодня,
Проблема заключается в том, что не удалось установить связь клиента tls между Android и ПК mitmproxy.


55iQ02D.png


Вот подсказка команд для опции mitmproxy версии Windows (в Power Shell):

mitmproxy.exe --set tls_version_server_min = UNBOUNDED --set tls_version_client_min = UNBOUNDED --set showhost = true --set ssl_insecure = true

Затем измените свой Wi-Fi, добавьте IP-адрес и порт прокси,
Откройте браузер, установите сертификацию mitmproxy android,
Запустите unlockapp.
Как с вами связаться ? Очень нуждаюсь в помощи разблокировки ASUS Pad TF300T на платной основе.
 

gzamaury

New member
Nov 9, 2021
2
2
UPDATE: Asus has updated the servers. Older protocols for HTTPS, which are required for older Android versions, are no longer supported. Unfortunately, some additional steps are needed for the unlock now. See this post for step by step instructions.


I recently got my hands on a Asus TF700T with a locked boot loader. The official unlock app did not work, so I took a closer look. What I found is that the Asus servers are still up and running, but connection fails due to certificate pinning. And that can be dealt with ;)

So here are the instructions:
  1. The device must be rooted. KingoRoot (the app) worked for me.

  2. Download the unlock bundle from the link below. I didn't find a way to directly attach files here.

  3. Copy both apks to /system/app, change the permission to 0644
    For this, a remount of the system partition may be needed:
    mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system

    DMClient.apk replaces the original DMClient.apk and DMClient.odex (i.e. you have to rename/move/delete the .odex file)
    The modified unlock app cannot be installed like any other and must be installed that way

  4. Reboot the device. On startup Android shows that one app is optimized (that's DMClient). The unlock app is now installed.

  5. Use the unlock app. Google account does not matter.

Watch logcat to get some more information on what the unlock app does. On success the device immediately reboots, so redirect adb logcat to a file if you want to keep the log.

I only tested on a TF700T with WW SKU, V10.6.1.14.10. I assume that other firmware versions work as well.
The unlock app for TF700T also supports TF201, TF300T, TF300TG, and TF300TL, but a modified DMClient is needed.


In case something goes wrong and your device gets stuck at the boot screen, this advice may be helpful:

(thanks @DieAbrissbirne)


Download links

Unlock app
and DMClient for TF700T
https://leo.pfweb.eu/dl/OaKdx
  • WW_epad-10.6.1.14.10
  • JOP40D.US_epad-10.6.1.14.10-20130801

DMClient for TF300T
https://leo.pfweb.eu/dl/vUHnp

DMClient for TF300TG
https://leo.pfweb.eu/dl/xphHy


DMClient for TF201
https://leo.pfweb.eu/dl/pKvEA
  • WW_epad_10.4.2.17

---------------------------------------------------------------------

Unlock app and DMClient for TF701T
https://leo.pfweb.eu/dl/2AcpB

DMClient for ME301T (also seems to work for ME302KL)
https://leo.pfweb.eu/dl/uiJPN
Thanks a lot!!! Asus TF300T unlocked, rooted, and flashed to KatKiss-7.1_TF300T, I´ll share my mistakes: I tried to root with KingoRoot's Android version (apk), and didn't work, then I had to make a wipe data/factory reset, and using the KingoRoot for Windows the rooting worked, about using the proxy that is described in the Update section: I had to use the command "mitmweb --ssl-insecure" to run the proxy server, then I followed the instructions to install the Unlock app and DMClient with the files provided here and finally the unlock worked. The first time I didn't read carefully and tried with other Unlock app and without replacing the DMClient, so did not work. I hope this will help.
 

pbolgar

Member
Feb 17, 2017
5
0
I was able to unlock my ME302KL (ASUS MeMO Pad FHD 10) after hours of trying and only thanks to this thread.
So I want to say huge thanks to @d.l.i.w, @GloGlorius, @Nox17 & @Stealth75.

I used:
Stock Asus Unlock app for ME302KL_UnLock.apk & DMClient for ME301T
Kingroot-pc-3-5-0-1157.exe
Root_Explorer_4.10.1.apk
mitmproxy Windows installer

Addition:
1. If you installed the certificate by going to the mitm.it site from your device then it will be installed in the user certificates folder (data/misc/keystore). You can just go to that location and copy the certificate file to the system certificates folder (system/etc/security/cacerts). You need root to do this, and make sure you restart your device after copying the file.

2. Unbounded

1637571950764.png



3. Win!

1637572007198.png
 

hedmo

Member
Mar 15, 2015
7
0
I can confim that unlock works with mitmproxy on My tf701t and to unlock a p1801 i used THE tf701t unlock Tool but swaped out THE DMClient with THE me301t One.

Thanks
 

Top Liked Posts

  • There are no posts matching your filters.
  • 10
    UPDATE: Asus has updated the servers. Older protocols for HTTPS, which are required for older Android versions, are no longer supported. Unfortunately, some additional steps are needed for the unlock now. See this post for step by step instructions.


    I recently got my hands on a Asus TF700T with a locked boot loader. The official unlock app did not work, so I took a closer look. What I found is that the Asus servers are still up and running, but connection fails due to certificate pinning. And that can be dealt with ;)

    So here are the instructions:
    1. The device must be rooted. KingoRoot (the app) worked for me.

    2. Download the unlock bundle from the link below. I didn't find a way to directly attach files here.

    3. Copy both apks to /system/app, change the permission to 0644
      For this, a remount of the system partition may be needed:
      mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system

      DMClient.apk replaces the original DMClient.apk and DMClient.odex (i.e. you have to rename/move/delete the .odex file)
      The modified unlock app cannot be installed like any other and must be installed that way

    4. Reboot the device. On startup Android shows that one app is optimized (that's DMClient). The unlock app is now installed.

    5. Use the unlock app. Google account does not matter.

    Watch logcat to get some more information on what the unlock app does. On success the device immediately reboots, so redirect adb logcat to a file if you want to keep the log.

    I only tested on a TF700T with WW SKU, V10.6.1.14.10. I assume that other firmware versions work as well.
    The unlock app for TF700T also supports TF201, TF300T, TF300TG, and TF300TL, but a modified DMClient is needed.


    In case something goes wrong and your device gets stuck at the boot screen, this advice may be helpful:

    (thanks @DieAbrissbirne)


    Download links

    Unlock app
    and DMClient for TF700T
    https://leo.pfweb.eu/dl/OaKdx
    • WW_epad-10.6.1.14.10
    • JOP40D.US_epad-10.6.1.14.10-20130801

    DMClient for TF300T
    https://leo.pfweb.eu/dl/vUHnp

    DMClient for TF300TG
    https://leo.pfweb.eu/dl/xphHy


    DMClient for TF201
    https://leo.pfweb.eu/dl/pKvEA
    • WW_epad_10.4.2.17

    ---------------------------------------------------------------------

    Unlock app and DMClient for TF701T
    https://leo.pfweb.eu/dl/2AcpB

    DMClient for ME301T (also seems to work for ME302KL)
    https://leo.pfweb.eu/dl/uiJPN
    8
    Hello everyone!
    On our local forum, we came up with this option.
    I think you already know how to install the unlocker and how to prepare the tablet.
    I prepared an image for VirtualBox with Ubuntu and mitmproxy installed and configured.
    Install VirtualBox, download the image (size 3.88 GB) and import it into VB:
    vb_Screenshot_10.png

    vb_Screenshot_11.png

    vb_Screenshot_12.png

    vb_Screenshot_13.png
    Screenshot_1.png

    Screenshot_2.png

    Screenshot_3.png

    We write down the IP address from the last screen, you will have your own. This will be the IP address of your proxy server.
    Open a terminal and enter the mitmweb command, press enter:
    Screenshot_4.png

    Screenshot_5.png

    Firefox will open and try to load the web terminal without success. Close your browser.
    Open again and go to 127.0.0.1:8081:
    Screenshot_7.png

    The web terminal will open. Here we go to the Options tab, check the Display Event Log checkbox and click on Edit Options
    Screenshot_8.png

    In the window that opens, put the checkboxes on showhost and ssl_insecure. Close the options window.
    Screenshot_9.png

    Open any site in the browser - in the terminal you will see the logs.
    1. Set the pin code in advance to access the tablet Security -> Screen lock -> PIN
    2. Go to the WiFi settings, clamp your network, select Change network.
    3. In advanced settings Proxy server -> Manual.
    4. Hostname - your recorded IP address of the virtual machine, port 8080.
    5. Save.
    6. Open the browser on the tablet, go to mitm.it, download the certificate for Android.
    7. After downloading, a window for entering a pin code will open, followed by a certificate installation wizard. Enter the name of the certificate, for example mitmproxy and click OK.
    8. After installing the certificate, open any site in a browser on the tablet, you will see the connection of your device in the logs of the web terminal.
    9. Launch the unblocker and try it.
    P.S. The time is set to GMT on the proxy server, you may need to set it to local.
    Superuser login: mitm
    Password: mitmvb

    UPD:
    It turned out that this image does not start on all systems due to Ubuntu version 20. In order for everyone to have this working, version 16 is needed. I will reload the image today with Ubuntu 16.
    7
    Hey!
    I unlocked my Me302kl today via mitmproxy with standard settings. Later I will write how I did it.
    P.S. Sorry for my English :giggle:
    3
    Oh boy.. Can't wait to see where I ****ed up in my tests... Thanks! Don't forget us :p
    My story.
    I installed mitmproxy on Windows 10, tried it via WSL (Windows Subsystem for Linux), but it didn't work for me. In the terminal, I see that there is a connection and exchange, but in the tablet logs I see the answer 502.

    But when connecting via mitmproxy, the unlocker began to respond for a long time, from which I concluded that I was moving in the right direction.

    In the end, I took a very old laptop and installed the latest Ubuntu and mitmproxy on it. I installed the certificate into the system and made a proxy server out of the laptop.

    The tablet was reset to factory settings. Google account did not connect after reboot. I got a root with KingoRoot. The first time did not work, the tablet rebooted, but the rights did not appear. The second time everything went well.

    I used the unblocker that I attached to the post. The original DMClient has been renamed. I have set permission 0644 for copied files. I prepared a certificate for Android according to this instruction. I copied it to /system/etc/security of the tablet, set the rights to 0644 (in our case, the user certificate does not suit us, we need a system one). I turned on the proxy in the WiFi settings of the tablet, specifying the IP address of the laptop and port 8080. I rebooted the tablet.

    I used mitmweb on a proxy server, it seemed more convenient to me. In the settings, I enabled the showhost and ssl_insecure options (sorry, in the previous post I said that the settings were by default, I was mistaken due to insomnia ☺️)

    I launched the unlocker and everything worked right away.

    If anyone needs details on preparing a proxy server, I am ready to describe my experience.
    3
    As far as I remember, mitmproxy (mitmweb) worked in transparent mode with default settings back then when I tested the unlock for my device. I simply created a wifi hotspot and routed all traffic through mitmproxy.

    I prepared a certificate for Android according to this instruction. I copied it to /system/etc/security of the tablet, set the rights to 0644 (in our case, the user certificate does not suit us, we need a system one). I turned on the proxy in the WiFi settings of the tablet, specifying the IP address of the laptop and port 8080. I rebooted the tablet.

    I used mitmweb on a proxy server, it seemed more convenient to me. In the settings, I enabled the showhost and ssl_insecure options (sorry, in the previous post I said that the settings were by default, I was mistaken due to insomnia ☺️)

    Oh yes. Certificate pinning is disabled, but the certificate itself is still checked. I forgot that I indeed had to add the MITM certificate to the system certificates.

    If I read (and reconstruct) my notes correctly, this is what I did (Linux):

    1. Install mitmproxy in venv
    Bash:
    python3 -m venv mitmproxy
    source mitmproxy-env/bin/activate
    
    pip install --upgrade pip setuptools
    pip install mitmproxy

    2. Start WIFI-Hotspot
    Bash:
    nmcli dev wifi hotspot ifname wlan0 ssid test password "12345678"

    3. Configure iptables for wlan0
    Bash:
    sysctl -w net.ipv4.ip_forward=1
    sysctl -w net.ipv6.conf.all.forwarding=1
    sysctl -w net.ipv4.conf.all.send_redirects=0
    
    iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    
    iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-port 8080
    iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 443 -j REDIRECT --to-port 8080
    ip6tables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-port 8080
    ip6tables -t nat -A PREROUTING -i wlan0 -p tcp --dport 443 -j REDIRECT --to-port 8080
    See https://docs.mitmproxy.org/stable/howto-transparent/

    4. Start mitmproxy
    Bash:
    mitmweb --mode transparent

    This procedure does not require setting the proxy on the tablet. At the time, I did not change any mitmproxy settings. The changes to the server now probably require ssl_insecure as mentioned by @GloGlorius .