[Q] How do I download stock ROMs from Lenovo's OTA server?

xyberz09 · May 16, 2015

Earlier today, I set up Fiddler (a web debugging proxy) on my computer and configured the WiFi connection on my Lenovo A7000-a to pass all traffic through the proxy running on my computer.

I wanted to see what requests my phone makes when checking for firmware upgrades. I found out that requests were made to http://fus.lenovomm.com, more specifically,

Code:

[B]http://fus.lenovomm.com/firmware/3.1/updateservlet?optionalparameter=%7B%7D&devicemodel=LenovoA7000_A_ROW&curfirmwarever=A7000-a_S133_150424_ROW&action=querynewfirmware&locale=en[/B]

There was nothing on that page as my phone is already running the latest firmware, so I changed the value for the attribute currfirmwarever and set it to an older firmware version (A7000-a_S129_150324_ROW) and I got an XML file with an OTA download URL at the bottom:

Code:

http://phonedl.ota.lenovomm.com/dls/v6/A7000-a_S129_150324_ROW_TO_A7000-a_S133_150424_ROW_WC52.zip

I've identified the names of 3 old firmware versions that can be switched in place of currfirmwarever to get the OTA updates for each one. They are:
1. A7000-a_S124_150303_ROW

Code:

http://fus.lenovomm.com/firmware/3.1/updateservlet?devicemodel=LenovoA7000_A_ROW&curfirmwarever=A7000-a_S124_150303_ROW&action=querynewfirmware&locale=en

2. A7000-a_S128_150319_ROW

Code:

http://fus.lenovomm.com/firmware/3.1/updateservlet?devicemodel=LenovoA7000_A_ROW&curfirmwarever=A7000-a_S128_150319_ROW&action=querynewfirmware&locale=en

3. A7000-a_S129_150324_ROW

Code:

http://fus.lenovomm.com/firmware/3.1/updateservlet?devicemodel=LenovoA7000_A_ROW&curfirmwarever=A7000-a_S129_150324_ROW&action=querynewfirmware&locale=en

However, they're essentially DIFF files used to update old ROM versions to newer ones (e.g. S129_150324 to S133_150424). I know that Lenovo stores entire ROM ZIPs on this server as you can see by visiting these links:

Code:

http://fus.lenovomm.com/firmware/3.1/updateservlet?action=querynewfirmwarehtml&curfirmwarever=VIBEROM_V1.0_1407_2_ST_K910&devicemodel=LenovoK910_ROM_ST&locale=en

Code:

http://phonedl.ota.lenovomm.com/dls/v6/Kraft-A6000_S032_150327_WCDB.zip

I want to know how I could get the stock ROM for Lenovo A7000-a from this server. I want to know the format of the URL that would get me the download for the complete ROM and not just the OTA update.

I already tried

Code:

http://phonedl.ota.lenovomm.com/dls/v6/<ROM BUILD NUMBER HERE>.zip

but it didn't work. The URL I tried was

Code:

http://phonedl.ota.lenovomm.com/dls/v6/A7000-a_S133_150424_ROW.zip

Can you guys help?

KangkanD · May 16, 2015 at 6:37 AM

xyberz09 said:
Earlier today, I set up Fiddler (a web debugging proxy) on my computer and configured the WiFi connection on my Lenovo A7000-a to pass all traffic through the proxy running on my computer.

I wanted to see what requests my phone makes when checking for firmware upgrades. I found out that requests were made to http://fus.lenovomm.com, more specifically,

Code:

[B]http://fus.lenovomm.com/firmware/3.1/updateservlet?optionalparameter=%7B%7D&devicemodel=LenovoA7000_A_ROW&curfirmwarever=A7000-a_S133_150424_ROW&action=querynewfirmware&locale=en[/B]

There was nothing on that page as my phone is already running the latest firmware, so I changed the value for the attribute currfirmwarever and set it to an older firmware version (A7000-a_S129_150324_ROW) and I got an XML file with an OTA download URL at the bottom:

Code:

http://phonedl.ota.lenovomm.com/dls/v6/A7000-a_S129_150324_ROW_TO_A7000-a_S133_150424_ROW_WC52.zip

I've identified the names of 3 old firmware versions that can be switched in place of currfirmwarever to get the OTA updates for each one. They are:
1. A7000-a_S124_150303_ROW

Code:

http://fus.lenovomm.com/firmware/3.1/updateservlet?devicemodel=LenovoA7000_A_ROW&curfirmwarever=A7000-a_S124_150303_ROW&action=querynewfirmware&locale=en

2. A7000-a_S128_150319_ROW

Code:

http://fus.lenovomm.com/firmware/3.1/updateservlet?devicemodel=LenovoA7000_A_ROW&curfirmwarever=A7000-a_S128_150319_ROW&action=querynewfirmware&locale=en

3. A7000-a_S129_150324_ROW

Code:

http://fus.lenovomm.com/firmware/3.1/updateservlet?devicemodel=LenovoA7000_A_ROW&curfirmwarever=A7000-a_S129_150324_ROW&action=querynewfirmware&locale=en

However, they're essentially DIFF files used to update old ROM versions to newer ones (e.g. S129_150324 to S133_150424). I know that Lenovo stores entire ROM ZIPs on this server as you can see by visiting these links:

Code:

http://fus.lenovomm.com/firmware/3.1/updateservlet?action=querynewfirmwarehtml&curfirmwarever=VIBEROM_V1.0_1407_2_ST_K910&devicemodel=LenovoK910_ROM_ST&locale=en

Code:

http://phonedl.ota.lenovomm.com/dls/v6/Kraft-A6000_S032_150327_WCDB.zip

I want to know how I could get the stock ROM for Lenovo A7000-a from this server. I want to know the format of the URL that would get me the download for the complete ROM and not just the OTA update.

I already tried

Code:

http://phonedl.ota.lenovomm.com/dls/v6/<ROM BUILD NUMBER HERE>.zip

but it didn't work. The URL I tried was

Code:

http://phonedl.ota.lenovomm.com/dls/v6/A7000-a_S133_150424_ROW.zip

Can you guys help?

That was helpful

n00BXperia · May 16, 2015 at 6:52 AM

xyberz09 said:
Can you guys help?

Chill..I wll Provide you stock Firmware (latest one) ASAP..I already have that firmware in my PC :highfive:

Bidyadhar · May 16, 2015 at 8:05 AM

n00BXperia said:
Chill..I wll Provide you stock Firmware (latest one) ASAP..I already have that firmware in my PC :highfive:

Hey Mann pls do that as soon as possible.. M tired of Dev firmware...

xyberz09 · Jul 21, 2014 69 17 0

n00BXperia said:
Chill..I wll Provide you stock Firmware (latest one) ASAP..I already have that firmware in my PC :highfive:

Thanks! Could you also explain how you got hold of it? I'm interested to learn how I could download them from Lenovo's own servers. For instance, the ROM for Lenovo A6000 is available here: http://phonedl.ota.lenovomm.com/dls/v6/Kraft-A6000_S032_150327_WCDB.zip

I'd like to know how to construct a query for the OTA server (http://fus.lenovomm.com) that would spit out an XML response with a link to that ROM download.

n00BXperia · May 16, 2015 at 2:12 PM

xyberz09 said:
I'd like to know how to construct a query for the OTA server (http://fus.lenovomm.com) that would spit out an XML response with a link to that ROM download.

simply accessed there server and downloaded!!

KangkanD · May 16, 2015

puchupechu said:
That was helpful

Bidyadhar said:
Hey Mann pls do that as soon as possible.. M tired of Dev firmware...

xyberz09 said:
Thanks! Could you also explain how you got hold of it? I'm interested to learn how I could download them from Lenovo's own servers. For instance, the ROM for Lenovo A6000 is available here: http://phonedl.ota.lenovomm.com/dls/v6/Kraft-A6000_S032_150327_WCDB.zip

I'd like to know how to construct a query for the OTA server (http://fus.lenovomm.com) that would spit out an XML response with a link to that ROM download.

THE LATEST BUILD OF STOCK ROM FOR LENOVO A7000a MAY BE DOWNLOADED FROM HERE:
LINK HERE

LoneWolfSK · May 16, 2015 at 2:22 PM

Try needrom if the links are not working for you

xyberz09 · Jul 21, 2014 69 17 0

More info please?

n00BXperia said:
simply accessed there server and downloaded!!

Would you care to elaborate a little on that? How did you get the official (http://phonedl.ota.lenovomm.com) download link for the ROM? What URL did you visit on the Firmware Update Server (http://fus.lenovomm.com) that gave you the link to the ROM?

xyberz09 · Jul 21, 2014 69 17 0

LoneWolfSK said:
Try needrom if the links are not working for you

http://www.needrom.com/category/lenovo/ doesn't have it. I checked.

n00BXperia · May 16, 2015 at 3:38 PM

xyberz09 said:
Would you care to elaborate a little on that? How did you get the official (http://phonedl.ota.lenovomm.com) download link for the ROM? What URL did you visit on the Firmware Update Server (http://fus.lenovomm.com) that gave you the link to the ROM?

I used there office's Computer and downloaded..that's it!!

..my friend works for Lenovo !!

xyberz09 · Jul 21, 2014 69 17 0

n00BXperia said:
I used there office's Computer and downloaded..that's it!! ..my friend works for Lenovo !!

Haha. So you went old school. That explains it. Thanks!

n00BXperia · May 17, 2015 at 2:43 PM

xyberz09 said:
Haha. So you went old school. That explains it. Thanks!

haha of course ; completed M.Sc ; so yeah.. ^Old School^ :highfive:

xyberz09 · Jul 21, 2014 69 17 0

Possible Lenovo OTA server & client source code

While looking for a way to download stock ROMs off of Lenovo's servers, I found this:
https://github.com/otaserver/

I believe that to be the source code for Lenovo's OTA server (and client). I think so because of the strings.xml file here:
https://github.com/otaserver/otaclient/blob/master/res/values/strings.xml

Translating it with Google Translate would give you a better idea of what the strings mean. It also contains a reference to "/mnt/sdcard/lenovoota".

The following search result makes it clearer:
https://github.com/otaserver/otasdk/search?utf8=✓&q=lenovo+OR+lenovomm&type=Code

You can clearly see that the code contains a reference to fus.lenovomm.com and this file in particular contains many hints on the working of the OTA server:
https://github.com/otaserver/otasdk/blob/master/src/com/otaserver/client/sdk/MobileInfo.java

I'm not very good with code. If you guys could analyze it and figure out how it works, maybe we'll understand how to make queries to the OTA server that spits out URLs for entire ROM downloads and not just OTA updates.

bitu13 · May 27, 2015 at 4:56 PM

Hey can u please get me the link to download stock rom for a6000 plus. I bricked my phone(boots into stock recovery) and its rooted so i'll need cwm too. I went to the service center to get it fixed but they ordered the whole pcb for rellacement and that is very time consuming as the part will come from china. I need to get it fixed soon plz help.

rydraj · Jul 8, 2015 at 8:59 PM

n00BXperia said:
Chill..I wll Provide you stock Firmware (latest one) ASAP..I already have that firmware in my PC :highfive:

Can you get me the stock firmware for Lenovo A6000 Plus ?

Thanks

gks131 · Aug 27, 2015 at 8:44 AM

Link for stock rom of a6000 plus?

Can you please post link for lenovo a6000 plus link I can't find...

askermk2000 · Sep 18, 2015

Hey OP

I have the solution

Look at this link: http://fus.lenovomm.com/firmware/3....l&full_rom&devicemodel=LenovoK50-T5&locale=en

Now I have the Lenovo S8 A7600 phone, so I changed "LenovoK50-T5" to "LenovoA7600". You get the picture.

As you seen in the XML-file, the filenames on the server is different. That's why you couldn't download.

xyberz09 · Jul 21, 2014 69 17 0

askermk2000 said:
Hey OP

I have the solution

Look at this link: http://fus.lenovomm.com/firmware/3....l&full_rom&devicemodel=LenovoK50-T5&locale=en

Now I have the Lenovo S8 A7600 phone, so I changed "LenovoK50-T5" to "LenovoA7600". You get the picture.

As you seen in the XML-file, the filenames on the server is different. That's why you couldn't download.

I know you can do that, but it doesn't work if I change the devicemodel parameter to LenovoA7000 or LenovoA7000-a (the server is case sensitive). I get this:

Code:

<Error>
    <Code>FUS-0112</Code>
    <Message>Invalid device model</Message>
</Error>

So I guess what I need is the correct model number string for the Lenovo A7000-a.

POQDavid · Dec 27, 2015

xyberz09 said:
I know you can do that, but it doesn't work if I change the devicemodel parameter to LenovoA7000 or LenovoA7000-a (the server is case sensitive). I get this:

Code:

<Error> <Code>FUS-0112</Code> <Message>Invalid device model</Message> </Error>

So I guess what I need is the correct model number string for the Lenovo A7000-a.

Well getting the right URL from VibeRomFlash.exe is not hard you simply connect the device to your pc and you wait for VibeRomFlash.exe to detect the phone and you read the memory of the VibeRomFlash.exe i used Process Hacker (it's some thing like Task Manager but with more options) (also sorry forums wont allow me to post links so you have to google it your self)

Well here is how to do it, in Process Hacker you will find the VibeRomFlash.exe and click on it process in the list and open the properties and there is a Tab called "Memory" and you click on "Strings" (leave option as they are and press OK) then click on "Filter" and on the menu click on "Contains..." and you can use any part of the URL but i used "querynewfirmware"

Here what i got from VibeRomFlash.exe (Note that my stock ROM is not ROW):
I was thinking if you use the ROW you might need to change the locale=zh to locale=en

I think this gives you the update only since it's size is just 396.80MB

Code:

fus.lenovomm.com/firmware/3.1/updateservlet?action=querynewfirmwarehtml&devicemodel=LenovoK50-T5&curfirmwarever=VIBEUI_V2.5_1524_5.955.1_ST_K50-T5&deviceid=<You put your deviceid here>&locale=zh

And this one gives you the full rom it's about 869.36MB

Code:

fus.lenovomm.com/firmware/3.1/updateservlet?action=querynewfirmwarehtml&full_rom&devicemodel=LenovoK50-T5&locale=zh

[Q] How do I download stock ROMs from Lenovo's OTA server?

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Member

Member

Senior Member

Senior Member

Senior Member