[UNLOCK bootloader, and flash ROM with ROOT] Huawei MediaPad M5 Pro - EMUI 9.1 - 2021

[Orekaria]

Intro:
- As usual, following this guide is by your own risk and responsability
- After hours searching the web I have painfully seen how the scene seems to be so spread and freak these days. Plus there are lots of scams and **** webs floating everywhere, more even than space debris.
- I have not found any good guide to root the Huawei Mediapad M5 Pro. Most of them are old + bad.
- My model is CMR-AL19, C432 with EMUI 9.1

Instructions:
1. unlock bootloader
1.1. Check PotatoNV wiki to get the unlock bootloader code:
Download PotatoNV (or download from the link below)
Install HUAWEI USB COM drivers: (download from the link below, or this link)
Install ADB (from google or also download from the link below)
1.2 Remove the cover from the device: heat it with a hairdryer and carefully peel cover around the perimeter using a plastic card (video)
Turn off the device and unplug the USB cable
Short test point and iron shield on the motherboard
Connect the device to the computer, after a couple of seconds jumper can be removed
Make sure there’s nothing on the device’s screen if a charging animation appears go to step 4
1.3 Launch PotatoNV and select HUAWEI USB COM 1.0 in the device list (should be filled automatically)
Select bootloader: kirin 960
Unlock code - this is the future bootloader code. copy and keep it for later.
Press the Start button. Let PotatoNV to finish
1.2. unlock bootloader with fastboot
adb devices adb reboot bootloader
wait until the tablet reboots in recovery mode
fastboot devices fastboot oem unlock <unlock code from PotatoNV>

2. flash treble ROM (https://github.com/phhusson/treble_experimentations/wiki/Huawei-MediaPad-M5-Pro)
2.1. download treble ROM:
Android 10: https://github.com/phhusson/treble_...nload/v222/system-quack-arm64-ab-gapps.img.xz
Android 9: https://github.com/phhusson/treble_...download/v123/system-arm64-ab-gapps-su.img.xz
2.2 factory reset
Perform a factory reset on your device: Settings -> System -> Reset -> Reset tablet
Optionally: Reboot to your device’s stock recovery using either a button combination when booting or issuing the following ADB command when booted in Android:
adb reboot recovery
Once here, use the volume keys to navigate and the power button to select the factory reset option.
2.3 Flash ROM
Once your device has been factory reset, reboot to your device’s bootloader using either a button combination when booting or issuing the following ADB command when booted in Android:
adb reboot bootloader
With your device connected to your PC, open up a command prompt or terminal window in the same directory where you downloaded your GSI of choice.
fastboot devices fastboot erase system
Enter a command in the following format:
fastboot --unbuffered flash system system-quack-arm64-ab-gapps.img
Allow the image to flash, will take 2 minutes. Once it has completed, reboot your device either manually via power key or by entering:
fastboot reboot

3. skip all configuration. ignore any error. reboot in recovery mode
adb reboot recovery

4. wipe cache and, again, factory reset. Configure as usual. Be sure to add the SIM when asked.

enjoy

 

[goattee]

Thanks for doing this. But I wonder: will this procedure work on a wifi-only model SHT-W09 running on EMUI 8.0.0?

 

[Orekaria]

Thanks for doing this. But I wonder: will this procedure work on a wifi-only model SHT-W09 running on EMUI 8.0.0?

I don't know
You can try to get the unlock code with PotatoNV (step 1.1), which is harmless and then decide. Also the old guides are probably good for your EMUI version.

 

[thorgan3]

Thanks for the guide, just unlocked my CMR-W09. I can confirm that the CM AL19 build does work for the W09 with a couple modifications

 

[M5_42432]

Hi!

I was trying to follow your guide, but opening the cover was too hard for me.

Originally my motivation to unlock the bootloader was to install Lineage OS, and then to install Google Services.

I have tried numerous methods to do so, but somehow they did not work for MediaPad M5 Pro, due to EMUI version or recent security patches.

However, I have managed to install Google services by accident.
I almost gave up, and decided to install at least a decent browser (Brave).
I found it on APKPure.
It is a kind of a third party package manager.
To install Brave I needed to install the package manager first.

APKPure APK Downloader for Android Wear, Phones, Tablets, TV

Download and update the latest Android™ Apps apk in APKPure, the best free Android APK Downloader online right at apkpure.com. Come and join APKPure's clan.

m.apkpure.com

Brave got installed, but to my surprise I could also find Youtube app on APKPure.
When I installed Youtube, APKPure package manager have installed Google Play Store as well!
With Google Play I could install all the other apps, I needed.

 

[Gamblor2]

Thanks for doing this. But I wonder: will this procedure work on a wifi-only model SHT-W09 running on EMUI 8.0.0?

Hi, just wondering did you have any luck with this PotatoNV method for SHT-W09?

 

[SnowmanDK]

I can confirm that this works for the CMR-AL09 also.
The only problem I had, was with opening up the device.
I had to use a thin metal object to get under the screen at first.
Oh, and then I had to search around to find out why I could not find my device using ADB...
REMEMBER TO ACTIVATE USB DEBUGGING in Developer options

 

[jb231]

I'm want to use this method on my M5 SHT-W09 8.4” I've got the screen off, that wasn't too hard, but I can't find the testpoint. I've searched the web but can't find a good image for this particular device. Does anyone know where the testpoint is for this device?

 

[SnowmanDK]

I'm want to use this method on my M5 SHT-W09 8.4” I've got the screen off, that wasn't too hard, but I can't find the testpoint. I've searched the web but can't find a good image for this particular device. Does anyone know where the testpoint is for this device?

I guess this is the testpoint on your device, as it looks different than on mine: Huawei-MediaPad-M5-SHT-AL09-SHT-W09-Testpoint.jpg

 

[jb231]

I guess this is the testpoint on your device, as it looks different than on mine: Huawei-MediaPad-M5-SHT-AL09-SHT-W09-Testpoint.jpg

thanks, I've seen that one, that is not at all what my device look like inside

 

[youeitherdiehero]

Hello !
Thanks for the tutorial, it worked great for my CMR W09 which was running these specs :

dir>fastboot oem get-bootinfo
(bootloader)  unlocked

dir>fastboot oem get-product-model
(bootloader) CMR-W09

dir>fastboot oem get-build-number
(bootloader) :CMR-W09 9.1.0.360(C432E6R1P3)

dir>fastboot oem oeminforead-SYSTEM_VERSION
(bootloader) :CMR-W09 9.0.1.160(C432E3R1P3)

dir>fastboot getvar vendorcountry
vendorcountry: hw/eu

I installed the Android 9 version then the Android 10, worked perfectly fine for both. I indeed inputed the commands suggested by thorgan3. For those who have wondered when and how to input such commands, I followed the steps 1 and 2 and then I turned usb debugging ON and enterred the following instructions :

dir>adb shell pm uninstall -k --user 0 com.android.phone
dir>adb shell pm uninstall -k --user 0 com.android.providers.blockednumber
dir>adb shell pm uninstall -k --user 0 com.android.bookmarkprovider
dir>adb shell pm uninstall -k --user 0 com.android.calllogbackup
dir>adb shell pm uninstall -k --user 0 com.android.carrierdefaultapp
dir>adb shell pm uninstall -k --user 0 com.android.emergency
dir>adb shell pm uninstall -k --user 0 com.android.providers.userdictionary

though I still had to uninstall com.android.phone through SDmaid

You can also finish cleaning up the ROM for the Wifi only models by putting :

dir>adb shell pm uninstall -k --user 0 com.android.server.telecom
dir>adb shell pm uninstall -k --user 0 com.android.providers.telephony

And after all that I finally prompted the next line to pursue tutorial with step 3 :

dir>adb reboot recovery

I strongly suggest that anyone tempting this maneuver should download an official stock ROM of the model and region of his device. To do so, as huawei revoked access to any of those, I factory reseted my tablet beforehand and connected it to the mobile hotspot of my computer. Using Wireshark I was able to snif the wifi my computer was connected to and hence get back the url (which was beginning with

Spoiler

"http://update.dbankcdn.com/download....."

I hope everyone succeed in their attempt.

 

[DF5JT]

It says root in the title, but I couldn't find any further explanation.

Is an up to date version of Magisk included in one of these GSIs?

 

[youeitherdiehero]

The ROM themselves are rooted

 

[xtacb4]

Hi!

Is this guide still valid today for a SHT-W09 EMUI 8.0.0 (C567) with bootloader unlocked? (I still have the unlock code).

Thanks!

 

[Haru2001]

Custom kernel

Telegram: Contact @Hi3660

t.me

 

[air32]

Hey, did anyone manage to solve the issue with formatting a sd-card as extended phone storage? For me its quite necessary to use my sd-card for that (netflix, spotify and so on) and it doesnt work. The issue is already described here: https://github.com/phhusson/treble_experimentations/issues/1638, for now there is no solution.

Thanks in advance!

 

[whoma]

Hi,

i have an CMR-AL19 here. but unfortunately the google accoount (FRP) is blocked and USB debugging is not activated. Can I use this method to remove the FRP and flash a stock rom again?

Thank you

 

[air32]

Did someone managed to get netflix working?

 

[SnowmanDK]

Did someone managed to get netflix working?

Netflix and a lot of other streaming apps will NOT work on rooted devices.
They block them as you can actually record the streams on rooted devices.

 

[viva-yo]

Hey, did anyone manage to solve the issue with formatting a sd-card as extended phone storage? For me its quite necessary to use my sd-card for that (netflix, spotify and so on) and it doesnt work. The issue is already described here: https://github.com/phhusson/treble_experimentations/issues/1638, for now there is no solution.

Thanks in advance!

I have the same problem. What did u do????