FORUMS

Lenovo Tab 4 8 Plus (aka TB-8704F/X)

71 posts
Thanks Meter: 22
 
By wonderfulme, Member on 10th August 2017, 08:59 PM
Post Reply Email Thread
It's been released in Europe for quite some time and from what I'm hearing it's about to hit the American market as well. Doen't seem to get any love yet on XDA.

Lovely little thing, from my three days with it. S625/64GB/4GB RAM/SD Slot/LTE. Comes with Android 7.1.1 stock.

Looks likes something that could finally replace the N7 2013, provided the community picks it up. I'm honestly surprised there's been little to no chatter about it whatsoever.

Did anyone manage to compile TWRP for it yet or root it otherwise?
The Following 6 Users Say Thank You to wonderfulme For This Useful Post: [ View ] Gift wonderfulme Ad-Free
11th August 2017, 08:53 AM |#2  
Senior Member
Thanks Meter: 256
 
More
Quote:
Originally Posted by wonderfulme

It's been released in Europe for quite some time and from what I'm hearing it's about to hit the American market as well. Doen't seem to get any love yet on XDA.

Lovely little thing, from my three days with it. S625/64GB/4GB RAM/SD Slot/LTE. Comes with Android 7.1.1 stock.

Looks likes something that could finally replace the N7 2013, provided the community picks it up. I'm honestly surprised there's been little to no chatter about it whatsoever.

Did anyone manage to compile TWRP for it yet or root it otherwise?

I don't own the device so I cannot help you there. But what you can check is if the device can be bootloader unlocked in developer settings. That's a requirement for TWRP and also what you need is a kernel/boot image to build TRWP. Since there don't seem to be factory images available for this yet it will be difficult to retrieve a boot image from the device. Also Lenovo hasn't released any source code for this yet even though they are obliged to do so. Shame on them! I suggest you complain in the Lenovo forums about it. It's clearly a GPL violation.
The Following 2 Users Say Thank You to matshias For This Useful Post: [ View ] Gift matshias Ad-Free
11th August 2017, 09:21 PM |#3  
OP Member
Flag Moscow
Thanks Meter: 22
 
More
Quote:
Originally Posted by matshias

I don't own the device so I cannot help you there. But what you can check is if the device can be bootloader unlocked in developer settings. That's a requirement for TWRP and also what you need is a kernel/boot image to build TRWP. Since there don't seem to be factory images available for this yet it will be difficult to retrieve a boot image from the device. Also Lenovo hasn't released any source code for this yet even though they are obliged to do so. Shame on them! I suggest you complain in the Lenovo forums about it. It's clearly a GPL violation.

Thanks, I actualy did just that - asked about the kernel source on their official forum. Don't expect any major breakthroughts though (see https://forum.xda-developers.com/sho....php?t=1555099, for instance).

As for whether the bootloader is locked or not, I have honestly no idea. Neither the "long phone number" method nor the "fastboot oem device-info" works. I have Android SDK installed and it works just fine when I plug in my N7 2003. The USB debugging is enabled and allowed for my desktop. Still, zero results. The Lenovo one doesn't even show up when running "fastboot devices".

Yet the "Lenovo Moto Smart Assistant" whatever it's supposed to do identifies the tablet when connected with USB just fine.

So I guess it's a safe bet to say that we're a long way from rooting this one. Or, more likely, I'm doing something wrong. Never had adb/fastboot issues with N7 though.

I'll just sit and wait till it hits the US market and generates some deserved interest because on the surface it's not a bad tablet at all. The battery life, the screen, the price/performance ratio, the SD slot and LTE capability all make that for a good web browser/book reader. It's not that bad looking either. Although I have yet to find a proper case unless resorting to Alibaba or something. It's even got a half-decent camera.

Overall, it's totally worth the $300 or whatever you end up paying. Comes with next to no bloatware, doesn't overheat. Even has that Dolby thing and a fingerprint scanner for some reason. Only wish it could be rooted and ran LineageOS or something.
The Following 2 Users Say Thank You to wonderfulme For This Useful Post: [ View ] Gift wonderfulme Ad-Free
12th August 2017, 11:10 AM |#4  
Senior Member
Thanks Meter: 256
 
More
Quote:
Originally Posted by wonderfulme

Thanks, I actualy did just that - asked about the kernel source on their official forum. Don't expect any major breakthroughts though (see https://forum.xda-developers.com/sho....php?t=1555099, for instance).

As for whether the bootloader is locked or not, I have honestly no idea. Neither the "long phone number" method nor the "fastboot oem device-info" works. I have Android SDK installed and it works just fine when I plug in my N7 2003. The USB debugging is enabled and allowed for my desktop. Still, zero results. The Lenovo one doesn't even show up when running "fastboot devices".

Yet the "Lenovo Moto Smart Assistant" whatever it's supposed to do identifies the tablet when connected with USB just fine.

So I guess it's a safe bet to say that we're a long way from rooting this one. Or, more likely, I'm doing something wrong. Never had adb/fastboot issues with N7 though.

I'll just sit and wait till it hits the US market and generates some deserved interest because on the surface it's not a bad tablet at all. The battery life, the screen, the price/performance ratio, the SD slot and LTE capability all make that for a good web browser/book reader. It's not that bad looking either. Although I have yet to find a proper case unless resorting to Alibaba or something. It's even got a half-decent camera.

Overall, it's totally worth the $300 or whatever you end up paying. Comes with next to no bloatware, doesn't overheat. Even has that Dolby thing and a fingerprint scanner for some reason. Only wish it could be rooted and ran LineageOS or something.

Are you sure you are in fastboot mode? Can you try adb reboot bootloader and then connect with fastboot again?

Also you should check that in developer settings you have an option OEM unlock.

Well you don't need the kernel source for TWRP. What you need is the following:
* kernel image somehow extracted
* partition layout. If cat /proc/partitions works via adb then this is sufficient.
* extracted /system/build.prop and output of mount command

This should be enough to get it booting. Decrypting the data partition is another step, but for root it's not needed.

Extracting the kernel image is the hard part as long as there is no factory image available. But first check if the tablet can be unlocked otherwise it's not worth the effort.
12th August 2017, 02:13 PM |#5  
OP Member
Flag Moscow
Thanks Meter: 22
 
More
Quote:
Originally Posted by matshias

Are you sure you are in fastboot mode? Can you try adb reboot bootloader and then connect with fastboot again?

Also you should check that in developer settings you have an option OEM unlock.

Well you don't need the kernel source for TWRP. What you need is the following:
* kernel image somehow extracted
* partition layout. If cat /proc/partitions works via adb then this is sufficient.
* extracted /system/build.prop and output of mount command

This should be enough to get it booting. Decrypting the data partition is another step, but for root it's not needed.

Extracting the kernel image is the hard part as long as there is no factory image available. But first check if the tablet can be unlocked otherwise it's not worth the effort.

There was indeed an option for "OEM unlock" in dev settings which I somehow missed. Works as intended now.

So here's the output of fastboot:
Code:
F:\AndroidSDK\platform-tools>fastboot oem device-info
...
(bootloader)    Device tampered: false
(bootloader)    Device unlocked: false
(bootloader)    Device critical unlocked: false
(bootloader)    Charger screen enabled: false
(bootloader)    Display panel:
OKAY [  0.054s]
finished. total time: 0.054s
Guess we're out of luck here?

I also did an "adb shell" and /proc/partitions as well as /system/build.prop are readable, "mount" works, however I have no idea where the kernel is stored. There's a "/firmware" dir but it's unaccessible, I'm thinking maybe that's where:
Code:
2|TB-8704X:/ $ uname -a
Linux localhost 3.18.31-perf-g40dd5c6-dirty #1 SMP PREEMPT Fri Jul 7 02:02:41 CST 2017 aarch64
TB-8704X:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0
TB-8704X:/ $ ls -ld firmware
dr-xr-x--- 4 system system 16384 1970-01-01 03:00 firmware
TB-8704X:/ $ cd firmware
/system/bin/sh: cd: /firmware: Permission denied
Also, FWIW, here's a list of files/dirs in / in case I missed something of note. I'm not really comfortable with Android internals.
Code:
130|TB-8704X:/ $ ls -l
total 4232
dr-xr-xr-x  61 root   root         0 1970-03-08 03:34 acct
drwxr-xr-x   2 root   root        40 1970-01-01 03:00 bt_firmware
drwxrwx---   7 system cache     4096 2017-08-10 16:42 cache
lrwxrwxrwx   1 root   root        13 1970-01-01 03:00 charger -> /sbin/healthd
drwxr-xr-x   2 root   root         0 1970-03-08 03:34 config
lrwxrwxrwx   1 root   root        17 1970-01-01 03:00 d -> /sys/kernel/debug
drwxrwx--x  43 system system    4096 1970-03-08 03:34 data
-rw-r--r--   1 root   root       995 1970-01-01 03:00 default.prop
drwxr-xr-x  15 root   root      3500 1970-03-08 03:34 dev
drwxr-xr-x   3 root   root      4096 1970-01-01 03:00 dsp
lrwxrwxrwx   1 root   root        11 1970-01-01 03:00 etc -> /system/etc
-rw-r--r--   1 root   root    186677 1970-01-01 03:00 file_contexts.bin
dr-xr-x---   4 system system   16384 1970-01-01 03:00 firmware
-rw-r-----   1 root   root      1578 1970-01-01 03:00 fstab.qcom
-rwxr-x---   1 root   root   1246704 1970-01-01 03:00 init
-rwxr-x---   1 root   root      1846 1970-01-01 03:00 init.carrier.rc
-rwxr-x---   1 root   root      3295 1970-01-01 03:00 init.class_main.sh
-rwxr-x---   1 root   root      1156 1970-01-01 03:00 init.environ.rc
-rwxr-x---   1 root   root      1730 1970-01-01 03:00 init.mdm.sh
-rwxr-x---   1 root   root     29161 1970-01-01 03:00 init.msm.usb.configfs.rc
-rwxr-x---   1 root   root      7054 1970-01-01 03:00 init.qcom.class_core.sh
-rwxr-x---   1 root   root     12035 1970-01-01 03:00 init.qcom.early_boot.sh
-rwxr-x---   1 root   root      3775 1970-01-01 03:00 init.qcom.factory.rc
-rwxr-x---   1 root   root     37960 1970-01-01 03:00 init.qcom.rc
-rwxr-x---   1 root   root      2029 1970-01-01 03:00 init.qcom.sensors.sh
-rwxr-x---   1 root   root     12173 1970-01-01 03:00 init.qcom.sh
-rwxr-x---   1 root   root      2962 1970-01-01 03:00 init.qcom.syspart_fixup.sh
-rwxr-x---   1 root   root     97623 1970-01-01 03:00 init.qcom.usb.rc
-rwxr-x---   1 root   root     10950 1970-01-01 03:00 init.qcom.usb.sh
-rwxr-x---   1 root   root     26676 1970-01-01 03:00 init.rc
-rwxr-x---   1 root   root      9584 1970-01-01 03:00 init.target.rc
-rwxr-x---   1 root   root     12058 1970-01-01 03:00 init.usb.configfs.rc
-rwxr-x---   1 root   root      5715 1970-01-01 03:00 init.usb.rc
-rwxr-x---   1 root   root       411 1970-01-01 03:00 init.zygote32.rc
-rwxr-x---   1 root   root       684 1970-01-01 03:00 init.zygote64_32.rc
drwxr-xr-x  10 root   system     220 1970-03-08 03:34 mnt
drwxr-xr-x   2 root   root        40 1970-01-01 03:00 oem
drwxrwx--x  13 root   system    4096 1970-01-01 03:00 persist
dr-xr-xr-x 518 root   root         0 1970-01-01 03:00 proc
-rw-r--r--   1 root   root     11549 1970-01-01 03:00 property_contexts
drwxr-xr-x   3 root   root        60 1970-01-01 03:00 res
drwx------   2 root   root        40 2017-07-06 21:00 root
drwxr-x---   2 root   root       160 1970-01-01 03:00 sbin
lrwxrwxrwx   1 root   root        21 1970-01-01 03:00 sdcard -> /storage/self/primary
-rw-r--r--   1 root   root      1957 1970-01-01 03:00 seapp_contexts
-rw-r--r--   1 root   root        90 1970-01-01 03:00 selinux_version
-rw-r--r--   1 root   root    285602 1970-01-01 03:00 sepolicy
-rw-r--r--   1 root   root     17999 1970-01-01 03:00 service_contexts
drwxr-xr-x   4 root   root        80 2017-08-12 15:57 storage
dr-xr-xr-x  16 root   root         0 1970-03-08 03:34 sys
drwxr-xr-x  21 root   root      4096 1970-01-01 03:00 system
lrwxrwxrwx   1 root   root        16 1970-03-08 03:34 tombstones -> /data/tombstones
-rw-r--r--   1 root   root     14131 1970-01-01 03:00 ueventd.qcom.rc
-rw-r--r--   1 root   root      4857 1970-01-01 03:00 ueventd.rc
lrwxrwxrwx   1 root   root        14 1970-01-01 03:00 vendor -> /system/vendor
-rw-r--r--   1 root   root       524 1970-01-01 03:00 verity_key
So are we out of options yet unless a new Linux kernel exploit eventually comes along OR Lenovo decides to release the firmware? I don't believe dirtycow would work here, considering July 2017 security updates have been applied.
14th August 2017, 04:36 PM |#6  
Senior Member
Flag Dublin
Thanks Meter: 159
 
More
That's quite sad.
Just got it and been playing with it for a couple days now. Device itself seems to be fine, but not having root is PITA.
18th August 2017, 09:42 AM |#7  
Senior Member
Thanks Meter: 256
 
More
Quote:
Originally Posted by wonderfulme

So are we out of options yet unless a new Linux kernel exploit eventually comes along OR Lenovo decides to release the firmware? I don't believe dirtycow would work here, considering July 2017 security updates have been applied.

The firmwares just showed up on the Russian Lenovo forums. So we can build TWRP if you post all the prerequisites mentioned a few posts earlier (partition layout, mount output, ...)
The Following 2 Users Say Thank You to matshias For This Useful Post: [ View ] Gift matshias Ad-Free
18th August 2017, 10:49 AM |#8  
OP Member
Flag Moscow
Thanks Meter: 22
 
More
Quote:
Originally Posted by matshias

The firmwares just showed up on the Russian Lenovo forums. So we can build TWRP if you post all the prerequisites mentioned a few posts earlier (partition layout, mount output, ...)


Here's the output for the TB-8704X LTE version.

Mount points:
Code:
TB-8704X:/ $ mount
rootfs on / type rootfs (ro,seclabel,size=1705664k,nr_inodes=426416)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,size=1811380k,nr_inodes=452845,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600)
proc on /proc type proc (rw,relatime,gid=3009,hidepid=2)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,seclabel,relatime)
none on /acct type cgroup (rw,relatime,cpuacct)
tmpfs on /mnt type tmpfs (rw,seclabel,relatime,size=1811380k,nr_inodes=452845,mode=755,gid=1000)
none on /config type configfs (rw,relatime)
none on /dev/cpuctl type cgroup (rw,relatime,cpu)
/dev/block/dm-0 on /system type ext4 (ro,seclabel,relatime,discard,data=ordered)
/dev/block/bootdevice/by-name/cache on /cache type ext4 (rw,seclabel,nosuid,nodev,relatime,data=ordered)
/dev/block/bootdevice/by-name/persist on /persist type ext4 (rw,seclabel,nosuid,nodev,relatime,data=ordered)
/dev/block/bootdevice/by-name/dsp on /dsp type ext4 (ro,seclabel,nosuid,nodev,relatime,data=ordered)
/dev/block/bootdevice/by-name/modem on /firmware type vfat (ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro)
tmpfs on /storage type tmpfs (rw,seclabel,relatime,size=1811380k,nr_inodes=452845,mode=755,gid=1000)
adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
/dev/block/dm-1 on /data type ext4 (rw,seclabel,nosuid,nodev,relatime,discard,noauto_da_alloc,data=ordered)
/dev/fuse on /mnt/runtime/default/emulated type fuse (rw,nosuid,nodev,noexec,noatime,user_id=1023,group_id=1023,default_permissions,allow_other)
/dev/fuse on /storage/emulated type fuse (rw,nosuid,nodev,noexec,noatime,user_id=1023,group_id=1023,default_permissions,allow_other)
/dev/fuse on /mnt/runtime/read/emulated type fuse (rw,nosuid,nodev,noexec,noatime,user_id=1023,group_id=1023,default_permissions,allow_other)
/dev/fuse on /mnt/runtime/write/emulated type fuse (rw,nosuid,nodev,noexec,noatime,user_id=1023,group_id=1023,default_permissions,allow_other)
Partitions:

Code:
TB-8704X:/etc $ df -h
Filesystem                            Size  Used Avail Use% Mounted on
rootfs                                1.6G  4.7M  1.6G   1% /
tmpfs                                 1.7G  652K  1.7G   1% /dev
tmpfs                                 1.7G     0  1.7G   0% /mnt
/dev/block/dm-0                       3.6G  3.2G  336M  91% /system
/dev/block/bootdevice/by-name/cache   248M  744K  242M   1% /cache
/dev/block/bootdevice/by-name/persist  27M  512K   26M   2% /persist
/dev/block/bootdevice/by-name/dsp      12M  4.9M  6.4M  44% /dsp
/dev/block/bootdevice/by-name/modem    84M   74M   10M  88% /firmware
tmpfs                                 1.7G     0  1.7G   0% /storage
/dev/block/dm-1                        52G   14G   38G  27% /data
/dev/fuse                              52G   14G   38G  27% /storage/emulated

TB-8704X:/ $ cat /proc/partitions
major minor  #blocks  name

 254        0     524288 zram0
 179        0   61071360 mmcblk0
 179        1      86016 mmcblk0p1
 179        2          1 mmcblk0p2
 179        3          8 mmcblk0p3
 179        4        512 mmcblk0p4
 179        5        512 mmcblk0p5
 179        6        512 mmcblk0p6
 179        7        512 mmcblk0p7
 179        8       2048 mmcblk0p8
 179        9       2048 mmcblk0p9
 179       10        256 mmcblk0p10
 179       11        256 mmcblk0p11
 179       12      16384 mmcblk0p12
 179       13       1536 mmcblk0p13
 179       14       1536 mmcblk0p14
 179       15         32 mmcblk0p15
 179       16         32 mmcblk0p16
 179       17       1536 mmcblk0p17
 179       18         16 mmcblk0p18
 179       19      15360 mmcblk0p19
 179       20       1024 mmcblk0p20
 179       21       1024 mmcblk0p21
 179       22      65536 mmcblk0p22
 179       23      65536 mmcblk0p23
 179       24       1024 mmcblk0p24
 179       25    3984588 mmcblk0p25
 179       26     262144 mmcblk0p26
 179       27      32768 mmcblk0p27
 179       28       1024 mmcblk0p28
 179       29        512 mmcblk0p29
 179       30         32 mmcblk0p30
 179       31     262144 mmcblk0p31
 259        0         32 mmcblk0p32
 259        1        512 mmcblk0p33
 259        2       1024 mmcblk0p34
 259        3      32768 mmcblk0p35
 259        4        512 mmcblk0p36
 259        5       4096 mmcblk0p37
 259        6        128 mmcblk0p38
 259        7        128 mmcblk0p39
 259        8        256 mmcblk0p40
 259        9        256 mmcblk0p41
 259       10        256 mmcblk0p42
 259       11        256 mmcblk0p43
 259       12        256 mmcblk0p44
 259       13        256 mmcblk0p45
 259       14        256 mmcblk0p46
 259       15        256 mmcblk0p47
 259       16          8 mmcblk0p48
 259       17      65536 mmcblk0p49
 259       18     204800 mmcblk0p50
 259       19   55492071 mmcblk0p51
 179       32       4096 mmcblk0rpmb
 253        0    3922408 dm-0
 253        1   55492055 dm-1
/system/build.prop, just in case: https://pastebin.com/raw/jQn9N8nc

Kindly let me know if I missed anything.

Also, that Russian site lists the model number as TB-8704X_S000026_170707_ROW_QFIL, while my version of build.prop contains TB-8704X_S000026_170707_ROW (withot the "QFIL"). I'm not entirely up to date on Lenovo's naming conventions, but could that possibly suggest a slightly different model or should we disregard it altogether?

Edit: Nevermind, QFIL seems to be the name of the Qualcomm firmware update software.

Thanks!
The Following 2 Users Say Thank You to wonderfulme For This Useful Post: [ View ] Gift wonderfulme Ad-Free
26th August 2017, 07:00 AM |#9  
Junior Member
Thanks Meter: 3
 
More
I also hope that rooting or later a LineageOS will be available. I bought my one from Amazon in Germany 64GB/4GB/WiFi and it has following build number TB-8704F_S000024_170706_ROW. I came from Nexus 7 (2012).
The Following 2 Users Say Thank You to Distman For This Useful Post: [ View ] Gift Distman Ad-Free
27th August 2017, 08:59 AM |#10  
SimonTS's Avatar
Senior Member
Flag Bristol
Thanks Meter: 1,631
 
More
Bought mine via Lenovo in the UK for £280 and loving it. I've been looking for a decent 8" tablet which wasn't stupidly expensive and this ticks all the boxes.

4GB /64GB + SD card
1920x1080 screen
Good audio with those front facing speakers
Decent battery life so far

Would love to be able to root and install Lineage as I use on my OPO as well, that would be perfect.

Love it so much I've ordered one for my old man as well.
The Following User Says Thank You to SimonTS For This Useful Post: [ View ] Gift SimonTS Ad-Free
29th August 2017, 10:32 AM |#11  
Junior Member
Flag Tampa
Thanks Meter: 2
 
More
Quote:
Originally Posted by wonderfulme

Thanks, I actualy did just that - asked about the kernel source on their official forum. Don't expect any major breakthroughts though (see https://forum.xda-developers.com/sho...php?t=1555099, for instance).

As for whether the bootloader is locked or not, I have honestly no idea. Neither the "long phone number" method nor the "fastboot oem device-info" works. I have Android SDK installed and it works just fine when I plug in my N7 2003. The USB debugging is enabled and allowed for my desktop. Still, zero results. The Lenovo one doesn't even show up when running "fastboot devices".

Yet the "Lenovo Moto Smart Assistant" whatever it's supposed to do identifies the tablet when connected with USB just fine.

So I guess it's a safe bet to say that we're a long way from rooting this one. Or, more likely, I'm doing something wrong. Never had adb/fastboot issues with N7 though.

I'll just sit and wait till it hits the US market and generates some deserved interest because on the surface it's not a bad tablet at all. The battery life, the screen, the price/performance ratio, the SD slot and LTE capability all make that for a good web browser/book reader. It's not that bad looking either. Although I have yet to find a proper case unless resorting to Alibaba or something. It's even got a half-decent camera.

Overall, it's totally worth the $300 or whatever you end up paying. Comes with next to no bloatware, doesn't overheat. Even has that Dolby thing and a fingerprint scanner for some reason. Only wish it could be rooted and ran LineageOS or something.

I have the tab 4 8" and you can unlock the boooader know developer mode.
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes