[UNLOCK bootloader, and flash ROM with ROOT] Huawei MediaPad M5 Pro - EMUI 9.1 - 2021

Search This thread

air32

Senior Member
Jul 29, 2014
103
25
Wolfsburg
Yes, months ago we had a discussion in the telegram group, with another member who did a workaround. Sadly phh was not really interested in solving this issue, so nothing happend.
 

viva-yo

Senior Member
Aug 20, 2010
75
2
Most of the img i try to flash are giving me this error:
"
target reported max download size of 471859200 bytes
Invalid sparse file format at header magi"
phh, lineage, crdroid, all give me that error
Only could flash this one:
system-quack-arm64-ab-gapps.img

Any help?
Thx
 

massima

Senior Member
Most of the img i try to flash are giving me this error:
"
target reported max download size of 471859200 bytes
Invalid sparse file format at header magi"
phh, lineage, crdroid, all give me that error
Only could flash this one:
system-quack-arm64-ab-gapps.img

Any help?
Thx
Probably those images are too big to fit in the system partition, only the gapp "non vndk" and vanilla versions can fit. It is only 2,9Gb if i remember correctly, you could resize it anyway (i never did it).
 

viva-yo

Senior Member
Aug 20, 2010
75
2
Probably those images are too big to fit in the system partition, only the gapp "non vndk" and vanilla versions can fit. It is only 2,9Gb if i remember correctly, you could resize it anyway (i never did it).
Thanks. I solved it by using a updated version of fastboot tools
The problem I have now is that I dont have root. (and I have tested several ROMs: lineage, phh,.,..)
This is the steps I follow:
- factory reset ( in android and in recovery)
- erase system in bootloader
- flash ROM in bootloader
- flash vbmeta in bootloader ( fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img)
- wipe data and cache in recovery

The ROM is installed with SU app, but I dont have root (at least that says adaway)
 

massima

Senior Member
Thanks. I solved it by using a updated version of fastboot tools
.........
The ROM is installed with SU app, but I dont have root (at least that says adaway)
All the GSI are derivate from the Phh treble. Adaway doesn't work because it cannot write onto the system partition, it is in RO mode. You have two ways, the first is to use magisk (Systemless mode for Adaway) but GSI images don't like magisk, test it. The second is to use the vndk variant but they are too big for our M5 as i wrote above.
 

viva-yo

Senior Member
Aug 20, 2010
75
2
All the GSI are derivate from the Phh treble. Adaway doesn't work because it cannot write onto the system partition, it is in RO mode. You have two ways, the first is to use magisk (Systemless mode for Adaway) but GSI images don't like magisk, test it. The second is to use the vndk variant but they are too big for our M5 as i wrote above.

I could obtain root flashing system-squeak-arm64-ab-vndklite-gapps.img from here:

Now adaway works perfectly, but I can´t install vanced because I dont have magisk :( This is endless
 

massima

Senior Member
@viva-yo , the treble project is great expecially for unsupported devices (ROMs, TWRP) like our M5 but i prefer the canonical way with custon ROMs, TWRP, etc.
If you flash gapps-vndk-secure you won't have root so you could flash magisk.
Will it be another mess?😥😑
 

viva-yo

Senior Member
Aug 20, 2010
75
2
@viva-yo , the treble project is great expecially for unsupported devices (ROMs, TWRP) like our M5 but i prefer the canonical way with custon ROMs, TWRP, etc.
If you flash gapps-vndk-secure you won't have root so you could flash magisk.
Will it be another mess?😥😑
How do you get a good layout in the apps for our tablet? Did you change the smallest width of any other option in developer settings?
 

viva-yo

Senior Member
Aug 20, 2010
75
2
Nothing, i left all with defaut values except for fast charging.
1664179453877.png
doesn´t the layout of apps like youtube , with only one column, look awful and useless on our tablet for you?
 

sbfisher

Member
Jul 27, 2010
8
0
I guess this is the testpoint on your device, as it looks different than on mine: Huawei-MediaPad-M5-SHT-AL09-SHT-W09-Testpoint.jpg

In order to find the testpoint that is pictured for the SHT-W09, you have to remove a bunch of screws at the top of the device, disconnect the screen cables, the side button cables, some other cable near the button cable (maybe speaker or vibrator), the camera cable and a bunch of screws along the top. Then there is a board that fits around a black square and the board takes up most of the top of the device that you need to flip over. It took me hours to figure out all the things to disconnect and to flip the board over in order to see something that looks like the picture of the supposed test point. If you do all that then the photo looks the same as that board once you flip it over.

I still can't get it to work with shorting the test point to the shield. It looks like their red line goes between a silver indentation to the nearest shield. Does that seem right, or should it be one of the smaller copper or gold-colored dots?
 

sbfisher

Member
Jul 27, 2010
8
0
For anyone still looking to get the testpoint to activate on the SHT-W09, this image makes it much more clear what point you should short to the shield. https://forum.gsmhosting.com/vbb/f1...set-done-test-point-uni-android-tool-2976508/ . (the lavendar dots on the photo.) The more common photo that is everywhere in search engines has a big red line that is kind of unclear what it's pointing at (top dot? middle silver bit? bottom dot?)

I also had to disconnect the black cable coming from the battery area and only leave the tan-colored wire coming from the USB port connected. I got the boot loader unlocked now, so maybe I can breathe new life into this old device that rarely got updates. I wish the Lenovo Y700 was being sold normally in the US since there aren't a lot of 8-9 inch tablets these days and I don't really want to buy an iPad mini, a low resolution kids tablet or a the weird "global firmware" edition of the Y700 which seems to be kind of half-baked.
 
Last edited:
Having a CMR-W09 with testpoint and Potato NV the bootloader unlocked but for almost one week was trying to get rid of the FRP lock . Ended up getting rid of the lock by flashing CMR-W09_hw_eu with Android 9.0. now I have the TWRP vtr3.2.1.0-v0.4. At least for me this recovery remained even after flashed the Android 9. Dont forget the button combinations.
Put official ROM on SD card in folder dload , turn tablet off keep Volume up and Volume down pressed together with Power botton. When Huawei logo comes up, release Power button and the ROM will be flashed.
Few tips when in TWRP you get failed to mount '/vendor '/cust '/odm etc. Get to Wipe in TWRP >Advanced Wipe >Repair or Change File System and select the partition can not be mounted >Change file system> select EXT2 > after that select EXT4, now that partition can be mounted again. The only you can not repair here ist the '/odm . For that solution is Huawei Update Extractor found here >https://xdaforums.com/t/tool-huawei-update-extractor-updated-v0-9-9-5-open-source-library.2433454/ Extract the ODM.img from original ROM into the ADB folder and flash it on fastboot > fastboot flash odm ODM.img
One tip.... you dont have to use command > fastboot reboot , just keep volume up and power button> release power when Huawei logo comes up, so you will not have the custom recovery replaced with erecovery. That especially when you dont have all workj done in custom recovery and you dont want to lose it. :)
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Intro:
    - As usual, following this guide is by your own risk and responsability
    - After hours searching the web I have painfully seen how the scene seems to be so spread and freak these days. Plus there are lots of scams and **** webs floating everywhere, more even than space debris.
    - I have not found any good guide to root the Huawei Mediapad M5 Pro. Most of them are old + bad.
    - My model is CMR-AL19, C432 with EMUI 9.1

    Instructions:
    1. unlock bootloader
    1.1. Check PotatoNV wiki to get the unlock bootloader code:
    Download PotatoNV (or download from the link below)
    Install HUAWEI USB COM drivers: (download from the link below, or this link)
    Install ADB (from google or also download from the link below)
    1.2 Remove the cover from the device: heat it with a hairdryer and carefully peel cover around the perimeter using a plastic card (video)
    Turn off the device and unplug the USB cable
    Short test point and iron shield on the motherboard
    Connect the device to the computer, after a couple of seconds jumper can be removed
    Make sure there’s nothing on the device’s screen if a charging animation appears go to step 4
    1.3 Launch PotatoNV and select HUAWEI USB COM 1.0 in the device list (should be filled automatically)
    Select bootloader: kirin 960
    Unlock code - this is the future bootloader code. copy and keep it for later.
    Press the Start button. Let PotatoNV to finish
    1.2. unlock bootloader with fastboot
    adb devices adb reboot bootloader
    wait until the tablet reboots in recovery mode
    fastboot devices fastboot oem unlock <unlock code from PotatoNV>

    2. flash treble ROM (https://github.com/phhusson/treble_experimentations/wiki/Huawei-MediaPad-M5-Pro)
    2.1. download treble ROM:
    Android 10: https://github.com/phhusson/treble_...nload/v222/system-quack-arm64-ab-gapps.img.xz
    Android 9: https://github.com/phhusson/treble_...download/v123/system-arm64-ab-gapps-su.img.xz
    2.2 factory reset
    Perform a factory reset on your device: Settings -> System -> Reset -> Reset tablet
    Optionally: Reboot to your device’s stock recovery using either a button combination when booting or issuing the following ADB command when booted in Android:
    adb reboot recovery
    Once here, use the volume keys to navigate and the power button to select the factory reset option.
    2.3 Flash ROM
    Once your device has been factory reset, reboot to your device’s bootloader using either a button combination when booting or issuing the following ADB command when booted in Android:
    adb reboot bootloader
    With your device connected to your PC, open up a command prompt or terminal window in the same directory where you downloaded your GSI of choice.
    fastboot devices fastboot erase system
    Enter a command in the following format:
    fastboot --unbuffered flash system system-quack-arm64-ab-gapps.img
    Allow the image to flash, will take 2 minutes. Once it has completed, reboot your device either manually via power key or by entering:
    fastboot reboot

    3. skip all configuration. ignore any error. reboot in recovery mode
    adb reboot recovery

    4. wipe cache and, again, factory reset. Configure as usual. Be sure to add the SIM when asked.

    enjoy
    1
    Hello !
    Thanks for the tutorial, it worked great for my CMR W09 which was running these specs :
    Code:
    dir>fastboot oem get-bootinfo
    (bootloader)  unlocked
    
    dir>fastboot oem get-product-model
    (bootloader) CMR-W09
    
    dir>fastboot oem get-build-number
    (bootloader) :CMR-W09 9.1.0.360(C432E6R1P3)
    
    dir>fastboot oem oeminforead-SYSTEM_VERSION
    (bootloader) :CMR-W09 9.0.1.160(C432E3R1P3)
    
    dir>fastboot getvar vendorcountry
    vendorcountry: hw/eu

    I installed the Android 9 version then the Android 10, worked perfectly fine for both. I indeed inputed the commands suggested by thorgan3. For those who have wondered when and how to input such commands, I followed the steps 1 and 2 and then I turned usb debugging ON and enterred the following instructions :
    Code:
    dir>adb shell pm uninstall -k --user 0 com.android.phone
    dir>adb shell pm uninstall -k --user 0 com.android.providers.blockednumber
    dir>adb shell pm uninstall -k --user 0 com.android.bookmarkprovider
    dir>adb shell pm uninstall -k --user 0 com.android.calllogbackup
    dir>adb shell pm uninstall -k --user 0 com.android.carrierdefaultapp
    dir>adb shell pm uninstall -k --user 0 com.android.emergency
    dir>adb shell pm uninstall -k --user 0 com.android.providers.userdictionary

    though I still had to uninstall com.android.phone through SDmaid

    You can also finish cleaning up the ROM for the Wifi only models by putting :
    Code:
    dir>adb shell pm uninstall -k --user 0 com.android.server.telecom
    dir>adb shell pm uninstall -k --user 0 com.android.providers.telephony

    And after all that I finally prompted the next line to pursue tutorial with step 3 :
    Code:
    dir>adb reboot recovery

    I strongly suggest that anyone tempting this maneuver should download an official stock ROM of the model and region of his device. To do so, as huawei revoked access to any of those, I factory reseted my tablet beforehand and connected it to the mobile hotspot of my computer. Using Wireshark I was able to snif the wifi my computer was connected to and hence get back the url (which was beginning with
    I hope everyone succeed in their attempt.