[TWRP][RECOVERY] Asus ZenPad 8.0 Z380M (locked bootloader ok)

[diplomatic]

This is for real, folks. The first working custom recovery for Asus ZenPad 8.0 Z380M and a method to flash it under a locked bootloader. This took quite a bit of work to make, partly due to having to find a way to bypass the locked bootloader. And because of a kernel configuration issue that limited the size of the initial ramdisk, which took some serious effort to weed out. @lss1977 helped to port it to this device. And of course, credits to TeamWin for TWRP.

In addition to this thread, the current Z300M/Z301M TWRP thread and the the old Z300M recovery/rooting thread may be helpful. These models share the same hardware and software base, so most things that apply to one tablet also apply to the other.

DISCLAIMER
As usual, you do anything described in this post at your own risk. No one but you is responsible for any data loss, bricking or damage of your device.

REQUIREMENTS
Windows PC
SP Flash Tool version 5.1532 (only this version will bypass security checks)*
MediaTek VCOM drivers (available through Windows Update)
Z380M scatter file, attached
Recovery image, attached
Z380M preloader file (optional), available inside the stock firmware download
ZenPad Z380M tablet upgraded to Android N

* If you prefer to use a more recent SP Flash Tool, check out the special image file below.

This won't be a guide on how to use SP Flash Tool. There are plenty of good guides out there like this one on how to set up drivers, load scatter files, flash and make backups with SP Flash Tool. If you're not familiar with this software or how to flash MediaTek devices in general, please do your research before attempting this. I will just get straight to the specifics about the ZenPad 8.

FIRST TIME INSTALLATION
For a locked bootloader:
At this point you should have your tablet powered off, the drivers installed, all of your data backed up, and SP Flash Tool v5.1532's Download tab open and loaded with the tablet's scatter file. Open the download agent file DA_PL.bin, replacing the default MTK_AllInOne_DA.bin. (You can use the AllInOne DA if you want, but the procedure involves extra steps as described below.) Load the extracted TWRP recovery image (twrp-3.2.1-0-z380m.img) under the recovery partition line in the partition table. Click the Download button inside SPFT. Now just connect the USB cable to your tablet and your computer's USB port. It should start the download process automatically and disconnect when finished.

Alternative Method:
If you're using MTK_AllInOne_DA.bin, you have to hold the Volume Up key as you insert the cable, which puts the device into an emergency download mode. In addition, you will need to have the stock preloader*.bin file loaded inside SPFT for it to be able to communicate with your tablet. The preloader is available inside the official zip file download. Do not flash the preloader (untick the box) or any partitions other than recovery. You just need to have a valid bin file selected under the Preloader line.

For an unlocked bootloader:
If you have used the Asus unlock tool to unlock your device, you will still not be able to use fastboot flash to install a custom recovery. However, you can do a "hot boot" or a tethered boot of TWRP. This method doesn't require SP Flash Tool. Download the TWRP image, put your tablet in fastboot mode and connect to PC. Then run this command to boot TWRP dynamically:
fastboot boot twrp-3.2.1-0-z380m.img
Once inside TWRP, flash twrp-3.2.1-0-z380m.img to Recovery using Install -> Install Image. Then reboot to recovery. You may be able to use TWRP in the tethered boot mode, but that could result in glitches due to different parameters passed by the bootloader to the kernel. That's why flashing is recommended.

To update from your installed TWRP version to a new one, just transfer the image to your tablet, then boot to TWRP and install it by going to Install -> Install Image and flashing to Recovery.

START RECOVERY
With the tablet powered off, hold the Volume Up and Power keys together until you get to a menu where you can select "recovery". Use Vol. Up to scroll and Vol. Dn to select. If you have a locked bootloader, it will show a Yellow State message because the recovery is not signed by the OEM. Just press volume up to boot it. On the welcome screen of TWRP it will ask you about modifying the system partition, I suggest you go with Keep System Read-only. Doing otherwise will complicate your OTA updates.
WARNING: Never start the stock recovery from the bootloader menu on this device. It is programmed by the bootloader to instantly wipe your data without any warning. Also, be aware that Android installs the stock recovery at every normal boot cycle. So you either have to flash the TWRP every time you want to run it, or disable the automatic recovery installation in the stock firmware. Any kind of mod to the boot image will prevent the automatic recovery installation. If you're not sure which recovery you have installed, you can always do a 'adb reboot recovery' from Android without risk of data loss.

What works: Basically everything... access to major partitions, decrypted userdata partition, decrypted adoptable storage, external SD card, ADB, USB-OTG, touch interface, splash screen, installing stock Asus OTA/web FW updates
What doesn't work: (no known problems yet, but please report any)
Not guaranteed to work: factory reset

DOWNLOAD
(Updated February 3, 2018: updated kernel to firmware 5.3.18; up-to-date TWRP 3.2.1 sources)

• SP Flash Tool v5.1532
• Z380M Scatter file for all storage sizes (right click, Save link as...)
• Recovery image
• Signed image for Flash Tool only -- may be flashed with recent SP Flash Tool versions -- DO NOT INSTALL USING ANY OTHER METHOD -- tested with SPFT 5.1736.

Development and experimental files

• Source code

P.S. The thanks button doesn't bite.

 

[lss1977]

Nice one now lets get some custom roms done.

 

[diplomatic]

Has anyone installed this yet? I see the file has been downloaded a few times. Any feedback is welcome.

 

[lss1977]

If you want the recovery to stick after reboot either rename or remove system/bin/install_recovery.sh.

 

[diplomatic]

If you want the recovery to stick after reboot either rename or remove system/bin/install_recovery.sh.

The way I did it was to edit the init.rc file inside the boot ramdisk and comment out the service block that calls install_recovery.sh. I used the MTK boot image unpack/repack tools. I don't know, it seems like changing anything on the system partition will break OTA updates because of dm-verity. Because that depends on verifying each block of the file system. I have never even mounted the system as R/W in recovery.

 

[PxYra]

how to create scater file from text posted? I copied all text to MT8163_Android_scatter.txt file but when open with splash tools give error "scatter file is invalid"
please atach your working scatter file to other atachments

 

[diplomatic]

how to create scater file from text posted? I copied all text to MT8163_Android_scatter.txt file but when open with splash tools give error "scatter file is invalid"
please atach your working scatter file to other atachments

OK, I added the scatter file as a download. It was a pain in the ass to copy & paste. (But it did work.)

 

[PxYra]

Problem fixed downloaded new version of flashtool 5.16 and scatter working

 

[PxYra]

Ok I installed TWRP on Z380M P00A, and wanna say to other
1. Use VCOM drivers only from splash tool official site
2. To install VCOM drivers first need enter chinese recovery tablet, then in windows device manager you see USB device, install manualy drivers (don forget in windows disable driver signature)
3. Use only SP-Flash-Tool-v5.1532.00, newer or older version not properly working with this phone

 

[diplomatic]

Ok, thanks for the update, PxYra. Just to let you know, there are signed versions of VCOM drivers floating around so you don't need to mess with signature enforcement. Here's one: https://www.androidfilehost.com/?fid=24591000424943663. They are also updated by Windows so you can just let Windows Update install them.

 

[freisei]

Thanks for your work.

Flashing procedure works only with "MTK_AllInOne_DA.bin" method for me. But this is OK!

(Updated May 6, 2017: added kernel from firmware 5.3.7, source code cleanup)

is it possible to get the older versions? I need Android 6.x, because of xposed-Framework for my Zenpad 8.0 Z380M.

Greets Freisei

 

[diplomatic]

Hey freisei...

I never posted a version for Android 6. There was just one based on the 5.3.6 kernel, practically the same as the current one. That's why I didn't keep it. I could try to build one for you if you want, but I can't test it of course. Does this recovery not boot at all on the old firmware?

It's strange that the DA_PL.bin method didn't work for you. What happened when you tried it? I suppose the old preloader doesn't allow it(?).

 

[Pires_7]

hello guys, you think lineage os official version for asus z380kl (p024) will work on our z380m ?

---------- Post added at 08:19 PM ---------- Previous post was at 08:05 PM ----------

Can anyone help me? after selecting recovery img, pressing download and inserting usb cable, nothing happens. Thanks in advance

 

[Pires_7]

If you want the recovery to stick after reboot either rename or remove system/bin/install_recovery.sh.

hello friend, can you please upload that file? I deleted it, but now I need it to revert to official recovery, as my zenpad is bricked! It would be of great help! thanks!

 

[diplomatic]

hello friend, can you please upload that file? I deleted it, but now I need it to revert to official recovery, as my zenpad is bricked! It would be of great help! thanks!

Your ZenPad didn't brick because you deleted install_recovery.sh. It's because you modified the system partition. Making any mods to system is bad advice unless you know exactly what you're doing. Even mounting it in r/w mode can break it. That's because dm-verity has tripped and is blocking access to changed blocks of the file system. So you have 3 options: mod your boot image fstab file to disable dm-verity, restore the original system image block-for-block (either from backup or official firmware converted to an img file), or wipe userdata (lss reported that to work).

hello guys, you think lineage os official version for asus z380kl (p024) will work on our z380m ?

Nope, no chance.

 

[Pires_7]

Your ZenPad didn't brick because you deleted install_recovery.sh. It's because you modified the system partition. Making any mods to system is bad advice unless you know exactly what you're doing. Even mounting it in r/w mode can break it. That's because dm-verity has tripped and is blocking access to changed blocks of the file system. So you have 3 options: mod your boot image fstab file to disable dm-verity, restore the original system image block-for-block (either from backup or official firmware converted to an img file), or wipe userdata (lss reported that to work).


Nope, no chance.

Ok. I made some real s*it, I think I deleted every partition except recovery. Can you provide me a twrp backup or some way around my problem?

 

[diplomatic]

What do you mean you deleted every partition except recovery? There's like 28 partitions. You would have to work hard to accomplish that.

My first suggestion is to extract a system.img from the Asus stock firmware zip using this. Then flash it with SP Flash Tool. You might also try to install a full firmware zip from TWRP. Although I have no idea if that will work or if it's even safe to try.

 

[Pires_7]

What do you mean you deleted every partition except recovery? There's like 28 partitions. You would have to work hard to accomplish that.

My first suggestion is to extract a system.img from the Asus stock firmware zip using this. Then flash it with SP Flash Tool. You might also try to install a full firmware zip from TWRP. Although I have no idea if that will work or if it's even safe to try.

i was able to extract system.new.dat from stock firmware zip, but it extracts to a system folder. How do I flash this through sp flash tool?

 

[diplomatic]

OK, the system folder you don't need. It should have produced a system.img file also. That's the file you need to flash. Just select it for the system partition row in the partition list and then Download. Hopefully that will be enough.
EDIT: I just looked at the script, and realized the system.img.img file gets deleted in the process. So what you need to do is start the extraction, then after it makes system.img.img, when it starts extracting individual files, hit Ctrl+C. Then you'll end up with the img file.

 

[asdasus]

Thank you very much! it works! YOU are the BEST!
please tell me, in your scatter file, address partition_name: frp (0x80a5000) is correct? if i format this partition (frp), google account remove?