[Thinkpad Tablet General] wpinacz:
Hi all,

First of all I wanted to thank baikal0912 from lenovo-forums.ru , without Him this guide haven’t been possible, so all the glory and kudos go to Him in first place. (baikal0912 if You’re reading this – Thank You once again)

THIS GUIDE IS FOR LENOVO YOGA TAB 3 YT3-850L! AS ALWAYS I’M NOT RESPONSIBLE FOR DAMAGED DEVICES AND LOST DATA! ALWAYS MAKE BACKUP! (DON’T MAKE MY MISTAKES)

SOME HISTORY (read if You want to know how I bricked my device)

I had stock 5.1.1 Android on my Yoga, tablet has been updated to 6.0.1 in which i had problems with writing to SDCard (permissions), so I managed to unlock bootloader, flash TWRP, install Xposed and SDFix. Sadly after some time I saw that randomly applications disappeared (like Google Play Store).

So I was searching for 5.1.1 ROM (because I didn’t had any backup), only 2 ROM’s where available to download and it was for „M” model (YT3-850M) not „L”. First ROM was 785MB – it was only Chinese/English language, after flashing my device I saw that my LTE didn’t work, WIFI, BT, GPS and Sound doesn’t work either.

So I tried second ROM downloaded for „M”, It was 1,2GB and there were all languages available, but still LTE, WIFI, BT, GPS and Sound didn’t work.

I was searching for some info about my problem and manager to go to lenovo-forums.ru where I find out It’s because missing/damaged NVRam data (the data where tablet stores IMEI, Mac address and other stuff)

Surely It was my fault because I didn’t do any backup in first place (and yes, I’m an idiot)

Trying to find NVRam backup (in .QCN file) I ended in lenovo-forums.ru talking with baikal0912, He shared with me stock „L” ROM and trying to help me flash the device back again, so I made this topic because there is a problem finding „L” ROM and so everyone know how I flashed my device (which tools and drivers are needed, which mode to enter to flash device.

So let’s get started….

First, if Your tablet boots to Android make sure it has ADB debugging enabled (If You want to know how to enable ADB debug search the forum, there are plenty of answers)

Second make sure You grab SIMCard from device (You’ll gonna insert it later at end of my guide)

GRAB ALL THE NEEDED FILES: (ROM is 1GB 7zip compressed)

https://drive.google.com/drive/folders/0B2EmK9gw0mTdYUdJUGlDUm0zTW8?resourcekey=0-1iw6MlGugBOz6J5sDQRcaw&usp=sharing

You will need ROM (YT3-850L_S000026_151217_ROW_qpst.7z), QPST v2.7.429 (QPST_2.7.429.7z), drivers (Qualcomm USB Drivers For Windows.zip and Qualcomm_USBDriver_2.1.0.5_x64.cab), IMEI writing software (A100_WriteDualIMEI(W+G_eMMC).rar).

Also You are going to need ADB tools, search for them here at XDA (minimal ADB and fastboot).

NOTE: I’ve been trying to restore ROM with other QPST version and drivers without any success.

Install QPST, extract ROM to „C:\Lenovo” then connect turned on Yoga to PC, there should be 3 new devices shown in device manager named YT3-850M (in my case it was „M”, Yours can be „L”), install drivers from „Qualcomm USB Drivers for Windows.zip”, Windows should install two of them (modem fails to install, just ignore), the most important is device installed as „Lenovo HS-USB Diagnostics (COMx)” where X is Your COM port numer needed LATER.

ENTER FLASHING MODE

For now run ADB command to check if Your device is recognized:

adb devices

If It’s recognized then command will show You some numbers, if You’re ready to go then run this command:

adb reboot edl

Above command will change Android to something I call „Flashing Mode” (the screen on tablet will be black), for now tablet is waiting for flashing, You should now see that device manager in Windows shows only one new devices o install from „Qualcomm_USBDriver_2.1.0.5_x64.cab”, the device manager should install „Qualcomm HS-USB QDLoader 9008 (COMx)”, note the COM port X needed to flash.

Others at forums tell me to enter „Diagnostic Mode” to start flashing but they were wrong, „Diagnostic Mode” is something else needed later.

FLASH THE DEVICE

Run QFIL.exe from installed QPST directory (c:\Program Files (x86)\Qualcomm\QPST\bin\), make sure to run with Administrator privileges (from right click context menu).

- Make sure that QFIL recognized Your device showing „Qualcomm HS-USB DQLoader 9008” with COM port numer at top of QFIL screen.
- Select FLAT BUILD
- In „Programmer Path” choose „Browse”, go to extracted ROM directory and choose file named „prog_emmc_firehose_8909_ddr.mbn”
- Click on „LoadXML” below on right, choose „rawprogram0” file, then choose „patch0” file

If You are 100% sure You want to flash then press blue „Download” button and wait to finish flashing (don’t disconnect or turn off tablet before it ends).

You should notice that in „Status” window in QFIL there should be LOG, here’s my example of LOG file (shortened, doesn't fit all):

Start Download

Program Path:C:\lenovo\prog_emmc_firehose_8909_ddr.mbn

COM Port number:5

Sahara Connecting ...

Sahara Version:2

Start Sending Programmer

Sending Programmer Finished

Switch To FireHose

Wait for 3 seconds...

Max Payload Size to Target:49152 Bytes

Device Type:eMMC

Platform:8x26

Disable Ack Raw Data Every N Packets

Skip Write:False

Always Validate:False

Use Verbose:False

COM Port number:5

Sending NOP

FireHose NOP sent successfully

Sending Configuration

Device Type:eMMC

Platform:8x26

FireHose Log: logbuf@0x08057D38 fh@0x08054BA0

Request payload size 0xc000 is not the same as support payload size, change to 0x100000

Request payload size 0x100000 is too big, reduce to 0x20000

FireHose Log: logbuf@0x08057D38 fh@0x08054BA0

Set TxBuffer 0x20000, RxBuffer 0x4000

Firehose configure packet sent successfully!

ReadBackMode:No_Readback

Disable read back

Total Bytes To Program 0x86846CA0

Download Image

PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x1e3

PROGRAM: Partition 0, Sector: 40, Length: 483 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\sbl1.mbn

FireHose Log: start 40, num 483

FireHose Log: Finished sector address 523

PROGRAM: Written Bytes 0x3c600 (64)

Program Size: 0.24 MB

PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x1e3

PROGRAM: Partition 0, Sector: 1064, Length: 483 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\sbl1.mbn

.......

.......

.......

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 7799808, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_8.img

FireHose Log: start 7799808, num 16

FireHose Log: Finished sector address 7799824

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 7800712, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_9.img

FireHose Log: start 7800712, num 16

FireHose Log: Finished sector address 7800728

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 8061952, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_10.img

FireHose Log: start 8061952, num 16

FireHose Log: Finished sector address 8061968

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 8324096, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_11.img

FireHose Log: start 8324096, num 16

FireHose Log: Finished sector address 8324112

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 8325000, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_12.img

FireHose Log: start 8325000, num 16

FireHose Log: Finished sector address 8325016

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 8586240, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_13.img

FireHose Log: start 8586240, num 16

FireHose Log: Finished sector address 8586256

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 8848384, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_14.img

FireHose Log: start 8848384, num 16

FireHose Log: Finished sector address 8848400

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 8849288, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_15.img

FireHose Log: start 8849288, num 16

FireHose Log: Finished sector address 8849304

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 9110528, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_16.img

FireHose Log: start 9110528, num 16

FireHose Log: Finished sector address 9110544

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 9372672, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_17.img

FireHose Log: start 9372672, num 16

FireHose Log: Finished sector address 9372688

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 9634816, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_18.img

FireHose Log: start 9634816, num 16

FireHose Log: Finished sector address 9634832

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 9896960, Length: 16 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_19.img

FireHose Log: start 9896960, num 16

FireHose Log: Finished sector address 9896976

PROGRAM: Written Bytes 0x2000 (64)

Program Size: 0.01 MB

PROGRAM: Partition 0, Sector: 9901032, Length: 218048 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\userdata_20.img

FireHose Log: start 9901032, num 218048

FireHose Log: Finished sector address 10119080

PROGRAM: Written Bytes 0x6a78000 (64)

Program Size: 106.47 MB

PROGRAM: Partition 0, Sector: 0, Length: 34 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\gpt_main0.bin

FireHose Log: start 0, num 34

FireHose Log: Finished sector address 34

PROGRAM: Written Bytes 0x4400 (64)

Program Size: 0.02 MB

PROGRAM: Partition 0, Sector: NUM_DISK_SECTORS-33., Length: 33 Sectors, Sector Size: 512 Bytes

File: C:\lenovo\gpt_backup0.bin

FireHose Log: start 30535647, num 33

FireHose Log: Finished sector address 30535680

PROGRAM: Written Bytes 0x4200 (64)

Program Size: 0.02 MB

Total Size: 2155.12 MB

Total Time: 265 Seconds

Throughput: 8.13 MB/Seconds

PATCH: Partition 0, Sector: 9, Offset 296 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-34.

FireHose Log: Patched sector 9 with 01D1EFDE

PATCH: Partition 0, Sector: NUM_DISK_SECTORS-26., Offset 296 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-34.

FireHose Log: Patched sector 30535654 with 01D1EFDE

PATCH: Partition 0, Sector: 1, Offset 48 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-34.

FireHose Log: Patched sector 1 with 01D1EFDE

PATCH: Partition 0, Sector: NUM_DISK_SECTORS-1., Offset 48 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-34.

FireHose Log: Patched sector 30535679 with 01D1EFDE

PATCH: Partition 0, Sector: 1, Offset 32 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-1.

FireHose Log: Patched sector 1 with 01D1EFFF

PATCH: Partition 0, Sector: NUM_DISK_SECTORS-1., Offset 24 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-1.

FireHose Log: Patched sector 30535679 with 01D1EFFF

PATCH: Partition 0, Sector: NUM_DISK_SECTORS-1, Offset 72 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-33.

FireHose Log: Patched sector 30535679 with 01D1EFDF

PATCH: Partition 0, Sector: 1, Offset 88 Bytes, Size: 4 Bytes, Value: CRC32(2,4096)

FireHose Log: crc start sector 2, over bytes 4096

FireHose Log: Patched sector 1 with 7315C503

PATCH: Partition 0, Sector: NUM_DISK_SECTORS-1., Offset 88 Bytes, Size: 4 Bytes, Value: CRC32(NUM_DISK_SECTORS-33.,4096)

FireHose Log: crc start sector 30535647, over bytes 4096

FireHose Log: Patched sector 30535679 with 7315C503

PATCH: Partition 0, Sector: 1, Offset 16 Bytes, Size: 4 Bytes, Value: 0

FireHose Log: Patched sector 1 with 00000000

PATCH: Partition 0, Sector: 1, Offset 16 Bytes, Size: 4 Bytes, Value: CRC32(1,92)

FireHose Log: crc start sector 1, over bytes 92

FireHose Log: Patched sector 1 with 2EB8C0BF

PATCH: Partition 0, Sector: NUM_DISK_SECTORS-1., Offset 16 Bytes, Size: 4 Bytes, Value: 0

FireHose Log: Patched sector 30535679 with 00000000

PATCH: Partition 0, Sector: NUM_DISK_SECTORS-1., Offset 16 Bytes, Size: 4 Bytes, Value: CRC32(NUM_DISK_SECTORS-1.,92)

FireHose Log: crc start sector 30535679, over bytes 92

FireHose Log: Patched sector 30535679 with B8615551

Total download file size: 2155,119MB

Total download time: 4 Min 26 Sec

Throughput: 8,096117MB/s

FireHose Log: Set bootable drive to 0.

Download Succeed

Finish Download

If there’s „Download Succeed” and „Finish Download” in LOG You could try to boot new ROM holding POWER button, the first boot should take some time, after boot don’t install any apps, we need to change IMEI before we use tablet.

CHECK IMEI

After booting check Your IMEI numer if exists in NVRam, go to „CONTACTS”, click „Search” magnifier button, enter:

*#06#

If IMEI is good, skip to „Region Change” guide.

If IMEI is 0 then note Your IMEI from the „Standing Plate” of Your tablet.

WRITING IMEI

First shut down tablet, boot with holding „POWER” „+” and „-„ buttons, there should show something I call „Diagnostic Mode”, there will be some tests like:

1 SYSTEM INFO
2 KEYPAD BACKLIGHT
3 LCD BACKLIGHT
…..
…..

You should connect tablet to PC, and if You previously installed „Qualcomm USB Drivers For Windows.zip” drivers, then run WriteDualIMEI(W+G_eMMC).exe as Administrator.

Program will auto detect COM port, there will be two fileds (IMEI1, IMEI2), just insert Your IMEI in BOTH FIELDS, click START, wait to program show PASS.

If it pass, disconnect tablet from USB, click on REBOOT in „Diagnostic Mode”, choose „(3) Reboot to Android”, hit „OK”

After booting check IMEI number as mentioned above, if it’s ok then last thing to do is…

CHANGE REGION CODE

To change region code, to the same as checking IMEI but with other code, so go to „CONTACTS”, click „Search” magnifier button, enter:

####682#

Region changing settings should appear, at top there is Your currently selected region, below You can choose new region, note that after changing region Android should reboot.

For now shut down Android, insert SIMCard, and enjoy.

That’s all, thanks for reading, I hope this guide will help someone like baikal0912 :good: helped me.

Regards.

P.S. If someone know how to enter „Flashing Mode” in other way than „adb reboot edl” let me know so I can update this guide (maybe there is someone who can’t boot device and enter „Flashing Mode” via ADB)

P.S.2. Flashing done under Windows 10 Home 64 bit, connected to USB 2.0

P.S.3. I haven't done Serial Number (SN) writing to tablet, don't know how.

P.S.4. Sorry for my bad English