[TWRP][RECOVERY] Asus ZenPad 10 Z300M, Z301M & Z301MF (locked bootloader ok)

Search This thread

diplomatic

Senior Member
Mar 12, 2017
1,402
1,853
This is basically a copy of my Z380M TWRP thread adopted for the ZenPad 10. I decided to start a new one since the OP of justshaun's original recovery/rooting thread has gone stale, even as I had posted several new releases of TWRP over the months. Its instructions are also a little outdated. I've also compiled a version for the new Z301M(F) models and needed a place to post it. This is where I will be posting TWRP updates from now on.

In addition to this thread, referring to the Z380M TWRP thread and the original Z300M thread (links above) may be helpful. These models share the same hardware and software base, so most things that apply to one tablet also apply to the others.

DISCLAIMER
As usual, you do anything described in this post at your own risk. No one but you is responsible for any data loss, bricking or damage of your device.

REQUIREMENTS
Windows or Linux PC
SP Flash Tool version 5.1532 (only this version will bypass security checks)
MediaTek VCOM drivers (available through Windows Update)
ZenPad 10 scatter file for SPFT, attached (choose the one for your tablet)
Recovery image, attached (choose the one for your tablet)
ZenPad Z300M, Z301M or Z301MF tablet upgraded to Android N

This won't be a guide on how to use SP Flash Tool. There are plenty of good guides out there like this one on how to set up drivers, load scatter files, flash and make backups with SP Flash Tool. If you're not familiar with this software or how to flash MediaTek devices in general, please do your research before attempting this. I will just get straight to the specifics about the ZenPad 10.

FIRST TIME INSTALLATION
For a locked bootloader:
At this point you should have your tablet powered off, the drivers installed, all of your data backed up, and SP Flash Tool v5.1532's Download tab open and loaded with the tablet's scatter file. Open the download agent file DA_PL.bin, replacing the default MTK_AllInOne_DA.bin. (You can use the AllInOne DA if you want, but the procedure involves extra steps as described below.) Load the extracted TWRP recovery image for your device (twrp-3.2.1-0-z30*m.img) under the recovery partition line in the partition table. Click the Download button inside SPFT. Now just connect the USB cable to your tablet and your computer's USB port. It should start the download process automatically and disconnect when finished.

Alternative Method:
If you're using MTK_AllInOne_DA.bin, you have to hold the Volume Up key as you insert the cable, which puts the device into an emergency download mode. In addition, you will need to have the stock preloader*.bin file loaded inside SPFT for it to be able to communicate with your tablet. The preloader is available inside the official zip file download. Do not flash the preloader (untick the box) or any partitions other than recovery. You just need to have a valid bin file selected under the Preloader line.

For an unlocked bootloader:
If you have used the Asus unlock tool to unlock your device, you will still not be able to use fastboot flash to install a custom recovery. However, you can do a "hot boot" or a tethered boot of TWRP. This method doesn't require SP Flash Tool. Download the TWRP image, put your tablet in fastboot mode and connect to PC. Then run this command to boot TWRP dynamically:
fastboot boot twrp-3.2.1-0-z30*m.img
Once inside TWRP, flash twrp-3.2.1-0-z30*m.img to Recovery using Install -> Install Image. Then reboot to recovery. You may be able to use TWRP in the tethered boot mode, but that could result in glitches due to different parameters passed by the bootloader to the kernel. That's why flashing is recommended.

To update from your installed TWRP version to a new one, just transfer the image to your tablet, then boot to TWRP and install it by going to Install -> Install Image and flashing to Recovery.

START RECOVERY
With the tablet powered off, hold the Volume Up and Power keys together until you get to a menu where you can select "recovery". On the Z301M/Z301MF, that option is labeled Factory Reset. Use Vol. Up to scroll and Vol. Dn to select. If you have a locked bootloader, it will show a Yellow State message because the recovery is not signed by the OEM. Just press volume up to boot it. On the welcome screen of TWRP it will ask you about modifying the system partition, I suggest you go with Keep System Read-only. Doing otherwise will complicate your OTA updates.
WARNING: Never start the stock recovery from the bootloader menu on this device. It is programmed by the bootloader to instantly wipe your data without any warning. Also, be aware that Android installs the stock recovery at every normal boot cycle. So you either have to flash the TWRP every time you want to run it, or disable the automatic recovery installation in the stock firmware. Any kind of mod to the boot image will prevent the automatic recovery installation. If you're not sure which recovery you have installed, you can always do a 'adb reboot recovery' from Android without risk of data loss.

WARNING 2: Make sure you use the correct scatter file for your device (i.e. don't mix up the Z300 and Z301 files). For the initial flash, there is no check for scatter file correctness. If you use the wrong one, SP Flash Tool will alter and lock your GPT to that scatter file layout, possibly bricking your device. It will not be easy to restore it. Flashing with the correct scatter file later on will not work because Flash Tool will not allow you to use a different file than the one you used initially.

What works: Basically everything... access to major partitions, decrypted userdata partition, decrypted adoptable storage, external SD card, ADB, USB-OTG, touch interface, splash screen, installing stock Asus OTA/web FW updates
What doesn't work: (no known problems yet, but please report any)
Not guaranteed to work: factory reset

DOWNLOAD
Development and experimental files

P.S. The thanks button doesn't bite.
 

Attachments

  • twrp-3.2.1-0-z301m.zip
    13.8 MB · Views: 3,676
  • twrp-3.2.1-0-z300m.zip
    13.7 MB · Views: 5,065
  • twrp-3.2.3-0-z301mf.zip
    13.8 MB · Views: 2,114
  • asus8163_ew_380_Z300M_scatter.txt
    10.6 KB · Views: 2,630
  • asus8163_ew_380_Z301_scatter.txt
    10.9 KB · Views: 2,201
Last edited:

Wilsonb

Senior Member
Nov 23, 2010
1,101
230
Austin
Heya, thanks for the new thread..

Stupid question(coming from Samsung flashing)
Ive got Zenpad S3 10 P027, is this TRWP not ideal for this?
Currently, have some su (root) issues. Recovery shows Android icon chest with ! and says "No Command"

When running su in Terminal ADB via PC, says command not recognized.
Looks like I need to reflash recovery. When in TRWP (launched via fastboot boot twrp on PC) I flashed stock recovery but had system mounted read only. Could that be the problem?
 

diplomatic

Senior Member
Mar 12, 2017
1,402
1,853
Bro, I think you need to do some more homework on root, su, dm-verity, mods, etc. and read the instructions more carefully before applying these hacks. You are making a lot of simple mistakes and ending up shooting yourself in the foot for it. I don't think there's anything wrong with the Z500 TWRP. It can handle installing the stock firmware just fine. The problem is elsewhere. The unlock tool also works fine in TWRP as well in my testing.

The No Command screen is normal. That's been answered many times... you need to hold power+vol. up (or down) to get to the menu. There is no way the stock recovery image can be broken and still boot up.

The su thing, IDK what the problem is, but I'm sure if you install Magisk Manager and make your own patched image from your currently installed firmware, and fastboot-boot with it, you will have su functionality. Just like what it says in the unlock tool instructions.

Lastly and most important, never mount system in read-write mode, as I've repeated several times and exactly as it says in the directions:
7. At the TWRP welcome screen, do not select to modify the system partition and touch Keep System Read-only instead. Doing otherwise will render your tablet unbootable.
8. Mount system in TWRP (in read-only mode)
The only time you can mount it in read-write mode is when you are absolutely sure you have disabled dm-verity in your boot image.
 

ahacker

Senior Member
Aug 4, 2012
90
23
I've successfully installed TWRP on Z301M using the instructions from the first post, but then I somehow managed to lose the system. Yes, I should have backed up like the OP suggests.
I thought I should be able to reinstall the original firmware downloaded from Asus (e.g. UL-ASUS_P028_1-WW-3.3.12.0-user.zip) but both the 'adb sideload' method and the TWRP failed to install that firmware zip. My device looks bricked. The only thing I can do is to boot into TWRP (I actually need to select Factory Reset on the bootloader screen to get into TWRP). The folder 'system' is empty.

Can anyone suggest what I am doing wrong when trying to restore the Asus firmware?

When I try to sideload the zip, setting TWRP in the sideload mode, the computer begins uploading but after a few seconds gives the message "Total xfer: 0.01x" and stops, while Android errors with "set boot part fail. can not open misc-sd".
When I install the firmware zip from TWRP it also starts installing fine but shortly gives the same error "set boot part fail. can not open misc-sd".

Thanks
 
Last edited:
  • Like
Reactions: diplomatic

diplomatic

Senior Member
Mar 12, 2017
1,402
1,853
@ahacker, first of all, thank you for the feedback on the Z301M platform. You are literally the first person to have said anything about that version of TWRP. :)

To see the files on system, you first have to mount the system partition. Did you do that? If not, I suggest mounting it read-only. If there was any corruption on it, then reinstalling the firmware should have fixed it. The "misc-sd" errors are normal. Pretty sure they happen on stock recovery too. The stock firmware does not have dm-verity enabled, so letting TWRP modify system to prevent overwriting recovery should not have caused any problems.

At which point did it stop booting? Also, did you use the scatter file from first post? And can you tell me if the touch screen works fine in TWRP on your tablet?

I'm not sure what the deal is with adb sideload. I don't think I've ever actually tried it....
 
Last edited:

ahacker

Senior Member
Aug 4, 2012
90
23
diplomatic, thanks for replying!

[MENTION=4776997]
To see the files on system, you first have to mount the system partition. Did you do that?

I do mount the system partition. It appears empty. When I reboot into system TWRP says that the OS is not installed.

I don't remember the details of how I lost the system partition. First time I entered into TWRP it asked for a password, probably to mount some partition. I pressed cancel or something. Then I might have cleaned the caches. But I am sure I haven't wiped system. I might have pressed Factory Reset somewhere, because I don't have any data yet on the new tablet.

I would indeed try to mount the system read only. This is not the first Android system I rooted (maybe fifth), and I was always able to restore the system either from sideload or recovery. But here it seems Asus is making us jump extra hoops to do that.


[MENTION=4776997]
Reinstalling the firmware should have fixed it.

That seems to be my main problem now. I cannot reinstall the Asus firmware. It may look like I might be installing a wrong version, but I am positive that I have Z301M tablet. This is what I bought and what the boot-loader says. I download Z301M firmware from the Asus website (e.g.). So it must be a correct firmware.


[MENTION=4776997]
The "misc-sd" errors are normal. Pretty sure they happen on stock recovery too. The stock firmware does not have dm-verity enabled, so letting TWRP modify system to prevent overwriting recovery should not have caused any problems.

Thank you for the information.

[MENTION=4776997]
Also, did you use the scatter file from first post? Does the touch screen work fine in TWRP on that tablet?

Yes. I found that to be the only scatter file that worked. I tried scatter.txt from the firmware zip, but the Flash Tool refuses tio pick it up. TWRP seems to be working fine with touches working as expected.

[MENTION=4776997]
I'm not sure what the deal is with adb sideload. I don't think I've ever actually tried it....

This is the unbricking method described here. It probably does the same thing as the "Install Zip" from recovery, because the errors that both methods give are the same.

---------- Post added at 01:19 AM ---------- Previous post was at 12:57 AM ----------

Now system refuses to mount :(
 

diplomatic

Senior Member
Mar 12, 2017
1,402
1,853
I don't remember the details of how I lost the system partition. First time I entered into TWRP it asked for a password, probably to mount some partition. I pressed cancel or something. Then I might have cleaned the caches. But I am sure I haven't wiped system. I might have pressed Factory Reset somewhere, because I don't have any data yet on the new tablet.
Er, the password should have been for decrypting your userdata. If you didn't have one set up, there might be something wrong there.... Or possibly just unformatted.

That seems to be my main problem now. I cannot reinstall the Asus firmware. It may look like I might be installing a wrong version, but I am positive that I have Z301M tablet. This is what I bought and what the boot-loader says. I download Z301M firmware from the Asus website (e.g.). So it must be a correct firmware.
Yeah, that has to be the right one. The installation script has to match the model name reported by the recovery. Otherwise it would simply abort.

Yes. I found that to be the only scatter file that worked. I tried scatter.txt from the firmware zip, but the Flash Tool refuses tio pick it up. TWRP seems to be working fine with touches working as expected.
Great! Guess my kernel patch was on the dot and the partition layout has not changed from the Z300.

This is the unbricking method described here. It probably does the same thing as the "Install Zip" from recovery, because the errors that both methods give are the same.
When you installed the zip, did you unmount system completely? BTW, when you mentioned the errors, the installation does keep going for like 5 to 10 minutes afterwards, right?

If you still can't resurrect it, please post or send me the recovery & kernel log that has your installation attempt.
 

ahacker

Senior Member
Aug 4, 2012
90
23
When you installed the zip, did you unmount system completely? BTW, when you mentioned the errors, the installation does keep going for like 5 to 10 minutes afterwards, right?

I've tried both ways, with and without system mounted, a few times. The installation would fail after something like 5 seconds.


If you still can't resurrect it, please post or send me the recovery & kernel log that has your installation attempt.

I think I am giving up on this cheap tablet. I cannot even format it in the Flash Tool: it says "To format code area is forbidden on this phone". Asus is forbidding too much for me to ever buy it again. Attached the logs.

Thanks, diplomatic
 

Attachments

  • recoveryLogs.7z
    38.1 KB · Views: 159
Last edited:

ahacker

Senior Member
Aug 4, 2012
90
23
I have z301m.
One thing that was a surprise for me is that the TWRP recovery flashed with the method described in the original post does not stick. You have to flash it each time you use it. If you are like me this information is important, because the original recovery plainly wipes your data without asking or warning.
After you have flashed TWRP on the device, to go to the recovery mode you have to chose "Factory Reset" in the bootloader. Then it will complain about wrong OS, which is the sign that flashing TWRP worked; choose 'yes'. The first thing you should do in TWRP is a ful nandroid backup. (Not listening the OP's advice about backing up when Installing TWRP with a wrong scatter file almost cost me the device. Thankfully diplomatic managed to remotely fix my problem, probably spending a lot of his personal time. The scatter file in the original post is a correct one now.)
Creating a nandroid backup in TWRP takes unusually long time, I even once decided that it hanged. Taking long time, like 10-30 minutes, for a full backup is normal.
 
Last edited:

ahacker

Senior Member
Aug 4, 2012
90
23
z301m, WW-3.3.12.0 firmware

For rooting I've installed in TWRP Magisk v15.3 (diplomatic warned against 16.x, someone else against 15.4) - link.
Installed in TWRP xPosed framework 88.2 - link, and xPosed Installer apk from within Android - link.
So far, so good.

What I've found is that TWRP seems to have problems with external sd cards (lots of fs corruption). I found it safer to unmount by hand by unticking the sd card checkbox in "Mount". Not very conclusive about this though.
 
Last edited:

diplomatic

Senior Member
Mar 12, 2017
1,402
1,853
Thanks, ahacker. Good feedback. Although to be fair, I didn't say to avoid Magisk 16.x. I said 16.0. I'm pretty sure whatever bug it had is already fixed in the latest version.

Now that you've installed root, TWRP will stick around on the emmc. The stock recovery only gets installed if you have the original unpatched boot image on it. I mean, this is not unique to these devices. That's been standard Android functionality since some 4.x or 5.x version. And this is essentially what's in the warning on the OP.

The backup I'm talking about in the installation method is done with the SP Flash Tool readback function. That will pull the partition tables and your device's "metadata" that's unique to your unit. I don't think nandroid covers that...

Oh, and what is this SD corruption you're talking about? What file system is it formatted in? Have you checked your card for errors in Windows?
 
Last edited:
  • Like
Reactions: swear0730

wilson2008.hsu

New member
Mar 28, 2018
3
0
Asus releases so many difference Z301M model, so I am curious if this also works on Z301MF model?

Notice Z300MF has the MTK8163BA (or MTK8163A?) CPU model while Z301M uses : 8163B

Anyone tested that already? Thanks.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 33
    This is basically a copy of my Z380M TWRP thread adopted for the ZenPad 10. I decided to start a new one since the OP of justshaun's original recovery/rooting thread has gone stale, even as I had posted several new releases of TWRP over the months. Its instructions are also a little outdated. I've also compiled a version for the new Z301M(F) models and needed a place to post it. This is where I will be posting TWRP updates from now on.

    In addition to this thread, referring to the Z380M TWRP thread and the original Z300M thread (links above) may be helpful. These models share the same hardware and software base, so most things that apply to one tablet also apply to the others.

    DISCLAIMER
    As usual, you do anything described in this post at your own risk. No one but you is responsible for any data loss, bricking or damage of your device.

    REQUIREMENTS
    Windows or Linux PC
    SP Flash Tool version 5.1532 (only this version will bypass security checks)
    MediaTek VCOM drivers (available through Windows Update)
    ZenPad 10 scatter file for SPFT, attached (choose the one for your tablet)
    Recovery image, attached (choose the one for your tablet)
    ZenPad Z300M, Z301M or Z301MF tablet upgraded to Android N

    This won't be a guide on how to use SP Flash Tool. There are plenty of good guides out there like this one on how to set up drivers, load scatter files, flash and make backups with SP Flash Tool. If you're not familiar with this software or how to flash MediaTek devices in general, please do your research before attempting this. I will just get straight to the specifics about the ZenPad 10.

    FIRST TIME INSTALLATION
    For a locked bootloader:
    At this point you should have your tablet powered off, the drivers installed, all of your data backed up, and SP Flash Tool v5.1532's Download tab open and loaded with the tablet's scatter file. Open the download agent file DA_PL.bin, replacing the default MTK_AllInOne_DA.bin. (You can use the AllInOne DA if you want, but the procedure involves extra steps as described below.) Load the extracted TWRP recovery image for your device (twrp-3.2.1-0-z30*m.img) under the recovery partition line in the partition table. Click the Download button inside SPFT. Now just connect the USB cable to your tablet and your computer's USB port. It should start the download process automatically and disconnect when finished.

    Alternative Method:
    If you're using MTK_AllInOne_DA.bin, you have to hold the Volume Up key as you insert the cable, which puts the device into an emergency download mode. In addition, you will need to have the stock preloader*.bin file loaded inside SPFT for it to be able to communicate with your tablet. The preloader is available inside the official zip file download. Do not flash the preloader (untick the box) or any partitions other than recovery. You just need to have a valid bin file selected under the Preloader line.

    For an unlocked bootloader:
    If you have used the Asus unlock tool to unlock your device, you will still not be able to use fastboot flash to install a custom recovery. However, you can do a "hot boot" or a tethered boot of TWRP. This method doesn't require SP Flash Tool. Download the TWRP image, put your tablet in fastboot mode and connect to PC. Then run this command to boot TWRP dynamically:
    fastboot boot twrp-3.2.1-0-z30*m.img
    Once inside TWRP, flash twrp-3.2.1-0-z30*m.img to Recovery using Install -> Install Image. Then reboot to recovery. You may be able to use TWRP in the tethered boot mode, but that could result in glitches due to different parameters passed by the bootloader to the kernel. That's why flashing is recommended.

    To update from your installed TWRP version to a new one, just transfer the image to your tablet, then boot to TWRP and install it by going to Install -> Install Image and flashing to Recovery.

    START RECOVERY
    With the tablet powered off, hold the Volume Up and Power keys together until you get to a menu where you can select "recovery". On the Z301M/Z301MF, that option is labeled Factory Reset. Use Vol. Up to scroll and Vol. Dn to select. If you have a locked bootloader, it will show a Yellow State message because the recovery is not signed by the OEM. Just press volume up to boot it. On the welcome screen of TWRP it will ask you about modifying the system partition, I suggest you go with Keep System Read-only. Doing otherwise will complicate your OTA updates.
    WARNING: Never start the stock recovery from the bootloader menu on this device. It is programmed by the bootloader to instantly wipe your data without any warning. Also, be aware that Android installs the stock recovery at every normal boot cycle. So you either have to flash the TWRP every time you want to run it, or disable the automatic recovery installation in the stock firmware. Any kind of mod to the boot image will prevent the automatic recovery installation. If you're not sure which recovery you have installed, you can always do a 'adb reboot recovery' from Android without risk of data loss.

    WARNING 2: Make sure you use the correct scatter file for your device (i.e. don't mix up the Z300 and Z301 files). For the initial flash, there is no check for scatter file correctness. If you use the wrong one, SP Flash Tool will alter and lock your GPT to that scatter file layout, possibly bricking your device. It will not be easy to restore it. Flashing with the correct scatter file later on will not work because Flash Tool will not allow you to use a different file than the one you used initially.

    What works: Basically everything... access to major partitions, decrypted userdata partition, decrypted adoptable storage, external SD card, ADB, USB-OTG, touch interface, splash screen, installing stock Asus OTA/web FW updates
    What doesn't work: (no known problems yet, but please report any)
    Not guaranteed to work: factory reset

    DOWNLOAD
    Development and experimental files

    P.S. The thanks button doesn't bite.
    3
    Bro, I think you need to do some more homework on root, su, dm-verity, mods, etc. and read the instructions more carefully before applying these hacks. You are making a lot of simple mistakes and ending up shooting yourself in the foot for it. I don't think there's anything wrong with the Z500 TWRP. It can handle installing the stock firmware just fine. The problem is elsewhere. The unlock tool also works fine in TWRP as well in my testing.

    The No Command screen is normal. That's been answered many times... you need to hold power+vol. up (or down) to get to the menu. There is no way the stock recovery image can be broken and still boot up.

    The su thing, IDK what the problem is, but I'm sure if you install Magisk Manager and make your own patched image from your currently installed firmware, and fastboot-boot with it, you will have su functionality. Just like what it says in the unlock tool instructions.

    Lastly and most important, never mount system in read-write mode, as I've repeated several times and exactly as it says in the directions:
    7. At the TWRP welcome screen, do not select to modify the system partition and touch Keep System Read-only instead. Doing otherwise will render your tablet unbootable.
    8. Mount system in TWRP (in read-only mode)
    The only time you can mount it in read-write mode is when you are absolutely sure you have disabled dm-verity in your boot image.
    3
    It includes both the TWRP recovery and the boot image.
    Here is the TWRP recovery for my original fix, in case you want to try it.

    Tell me how it goes, and if needed we'll try a different model.

    That's great... something I forgot to mention, and maybe you took care of this already, the touchscreen driver does not work in recovery mode by default. You have to remove the 2 references to entry_mode. That variable is how it checks which boot mode it's in, and disables itself in modes other than the main OS. In my TWRP I patched the binary kernel for this (on Z300M and Z301M(F)).
    2
    @ahacker, first of all, thank you for the feedback on the Z301M platform. You are literally the first person to have said anything about that version of TWRP. :)

    To see the files on system, you first have to mount the system partition. Did you do that? If not, I suggest mounting it read-only. If there was any corruption on it, then reinstalling the firmware should have fixed it. The "misc-sd" errors are normal. Pretty sure they happen on stock recovery too. The stock firmware does not have dm-verity enabled, so letting TWRP modify system to prevent overwriting recovery should not have caused any problems.

    At which point did it stop booting? Also, did you use the scatter file from first post? And can you tell me if the touch screen works fine in TWRP on your tablet?

    I'm not sure what the deal is with adb sideload. I don't think I've ever actually tried it....
    2
    OK, found the problem. Check your PMs, ahacker.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone