yashsingh1/xdaforums huggingface dataset:
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
Hey, welcome to XDA!

Yes, in fact I had to do it again just now because I found yet another way that does not work to flash the patched_boot.img :silly:

1. Power off tablet.

2. Hold VOL_DWN, then hold POWER until screen comes on, then release only the POWER (but continue holding VOL_DWN).

3. After some time, you'll see a tiny menu at the top of the screen in portrait mode. Use VOL_DWN to select Recovery, then confirm selection using VOL_UP. If you pressed VOL_UP by accident here, repeat steps 1-2 lol

4. When recovery starts, you'll see a dead green android with chest panel open, and a red exclamation mark on it. You'll also see the words "No command" on the screen. Now, press VOL_UP + POWER simultaneously. If nothing happens, try pressing VOL_UP and then POWER, or vice versa. Make sure to do this very quickly (if not simultaneously, then almost simultaneously).

5. You should see a menu with Reboot system, Apply update from ADB, etc. Select Apply update from ADB.

6. Connect tablet to PC, open command prompt, navigate to the downloaded official Asus firmware zip (yes, it is WW-14.0210.1709.27), and follow the on-tablet-screen instructions at the bottom of the screen (it will say to type adb sideload filename.zip, just replace filename.zip with the name of actual firmware zip; you can type the first few letters and just press Tab for auto-complete)

7. Wait a nice little while.

8. Once the recovery menu appears again, I like to do a data/factory wipe so that I'm sure I am starting with a clean slate (teheh pun intended :p)

9. After the factory wipe, select Reboot system.

10. Make note to self not to do .img flashing from apps like FlashFire or Flashify etc.
[Asus ZenPad 10 Guides, News, & Discussion] Joh14vers6:
I tried to reinstall OTA with injected SuperSU by Flashfire , but it gave the same white hanging Android. I afterwards in recovery and installed OTA from SDCARD (internal storage) and no wiping.
[Asus ZenPad 10 Guides, News, & Discussion] toineh:
The uninstalled bloatware you have.. is it realy bloatware? or maybe apps you don't use, or apps that you don't know about they linked to other apps? I think there were more apps needed by the system than you have delete. Hope that your backup, if you made it will undrain your device. probably better to remove app after app with constantly reboot between.

Somewhere in this threat i post this:

When you use Fastboot to only boot an image. You will boot that into ram-device. It is unthinkable that the original bootloader made part of this fastboot action. The original bootloader stay untouched and will ever be enable when you do normal boot. I guess the software you removed made part of this trouble.

We did kind of faking root to the system. The system will search al his stored dalvik-cache and cache to the right app the data belongs to. You need a full dalvik-cache wipe to clean dirt from your de-bloated apps.

Factory reset your device is the most powerful cleanup you can do to resolve boot problem.

Before that you can try to repair some device partitions after boot up your device with fastboot, boot command.

Get in to a shell like “terminal emulator for android”

e2fsck /dev/block/mmcblk0p27 (cache partition)

e2fsck /dev/block/mmcblk0p28 (data partition)
[Asus ZenPad 10 Guides, News, & Discussion] hefe21:
Maybe you are right. I backedup every app i removed except zencircle or something similiar. Non of them seemed necessary. I will try to restore them and see what happens. I am still wondering why it is booting with the patched_boot. Img, because the missing app should still be a problem then.

At least it seems, the battery drain stopped. In last 4 hours idle it lost only 1 %.

______________EDIT____________________EDIT____________________________________

neither factory reset, nore the terminal part worked. restoring the apps was not possible.

i flashed the original firmware, and rooted the device via fastboot. restarting is now no problem. did not remove any "bloatware" this time. restored some of my custom apps and i did hide the "bloadware" in nova launcher. everything is working fine now. after normal restart no root, but thats ok.

i will take an eye on battery drain, but do not expect to face this issue again.

thanks for your great work.
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
Are you saying you were able to install an injected OTA zip using the normal recovery and it booted up and was fine? If that's the case, does root persist after a regular reboot?
[Asus ZenPad 10 Guides, News, & Discussion] Mrwirez:
Yes, [MENTION=5284361]Joh14vers6[/MENTION] I would like to know also!
[Asus ZenPad 10 Guides, News, & Discussion] Joh14vers6:
No, I repeat. After install OTA with injected SuperSu after boot it was hanging on white circles. The next boot gave white steady hanging Android.
[Asus ZenPad 10 Guides, News, & Discussion] Mrwirez:
10-4

A misunderstanding.
[Asus ZenPad 10 Guides, News, & Discussion] STEALTH_NT:
My god... was just an APK I was thinking was a more complicated stuff, thanks for answer. I already root mine I have no bat drain troubles (mine was updated since there was a lot of complains with the release version) I just arrived home, the last time I charged the tablet was yesterday at 11 PM, atm is 1PM and what is gone from the battery is just 5% wifi on all the time.

For me root the tablet changed nothing in battery drain but I do remember that there really was a lot of complains about several issues with the factory version. Reboot is kinda annoying but its by far more annoying for me no root I almost sold this thing cause there was no root.
[Asus ZenPad 10 Guides, News, & Discussion] yngwieromeo:
Please look into the Chinese rom if you could. It's impossible to install Google Play on the Chinese version, so if there is an unlock for this, perhaps I could install the WW rom at some point. Plus ASUS must hate China, because we are stuck with 6.0.
[Asus ZenPad 10 Guides, News, & Discussion] ronimus:
Can you give me a step-by-step what you did to get it to work? I do not have custom recovery and I seem to be missing a step to get the ADB working. What do you have to do to get ADB to communicate with the tablet? What mode does the tablet have to be i?
[Asus ZenPad 10 Guides, News, & Discussion] hefe21:
Settings>About>Softwareinformation>Tap 5x buildnumber

Go back to settings

Developersettings > enable usb debugging.

Try another usb cable. I have at least one, thats only for charging, abd no debugging or datatransfer is possible with this.
[Asus ZenPad 10 Guides, News, & Discussion] d_fens:
any chance to get xposed working?
[Asus ZenPad 10 Guides, News, & Discussion] Mrwirez:
I have a love/hate relationship with this tablet...

I love everything about it. It blows away every tablet I've owned.

I HATE the locked bootloader!

Any news on the "root/reboot/keep-root" progress?
[Asus ZenPad 10 Guides, News, & Discussion] mstras:
Is there anyway we can get an official device forum for this guy?
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
I dunno; but I noticed that the included scatterfile in the official WW firmware cannot be used in the Sp Flash Tools. Maybe someone that's familiar with Mediatek scatterfiles can reconstruct this scatterfile so we can put the patched boot image in? I think FlashFire is able to read some info regarding the different partitions or what not, but I don't know if that's trustworthy given my personal failures using that app...
[Asus ZenPad 10 Guides, News, & Discussion] Mrwirez:
What kind of error did you get? There are a few YouTube videos for Mediatek and sp tools errors. https://youtu.be/PSRtURdBpYc

https://youtu.be/n-m-TqDQcFk
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
The error code seems to be (0xC0030001). The solutions in the videos have not helped me. I'm using Sp Tools ver 5.1728. It's as if the asus scatterfile is in a format that is not supported by this (latest) version of SP Tools. I have downloaded some generic scatter files for other devices to see how they're structured, and they look completely different from the one included by Asus. The generic ones work, but each entry contains a lot more information than simply what's in the Asus file.
[Asus ZenPad 10 Guides, News, & Discussion] zhouruixi:
I have a CN version too.

The bootloader can't boot kernel from a file at all(du to the locked bl).

Had you find a way to root it ?
[Asus ZenPad 10 Guides, News, & Discussion] russianred:
Hi! I have the Chinese version too and this method of rooting didn't work unfortunately. Can someone please find a way for rooting the CN version? Also I would like to download google play store and google services, but i failed to do that. Is there a way of doing this? I really need guidance, thank you in advance )
[Asus ZenPad 10 Guides, News, & Discussion] techeligible3322:
thanks

Great, thanks for sharing with us, great info :laugh:
[Asus ZenPad 10 Guides, News, & Discussion] Mrwirez:
Hey [MENTION=5350868]overkillZ[/MENTION]

THANKS for your work so far... was just wondering if you had any updates to pass along yet? I'm really hoping for a full root option soon. I hate not having full control on a device I paid for...

Thanks again.
[Asus ZenPad 10 Guides, News, & Discussion] diplomatic:
Have you or anyone tried flashing the modified boot image from Android? Since you have root, you don't need the bootloader's help to flash most stuff. The dev path for the boot partition is /dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/boot . In fact, that directory has all the tablet's partitions listed by name. Same path as other ZenPads (Z300M, Z380M). So to write an image to one, you could go to a root shell and run

dd if=boot.img of=/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/boot [I]<other options>[/I]

Or there might be root apps that let you do the same thing with a GUI. And since you can do a tethered boot, there's not much danger in bricking it. You can always fastboot boot and restore the original image if the modded one doesn't work out.

As for unlocking the bootloader, has anyone tried the Z300M unlock tool? The Z500 seems to have the same unlocking framework as the other ZenPads. I've been digging through your device's firmware, in case that wasn't obvious. :)

EDIT: BTW, there's a possible danger to flashing certain boot images. The Z300/Z380 bootloader has a glitch where if the boot image has selinux set to permissive, it will not boot anything, including recovery or tethered boot. So if you'd like to try this, for the first time, don't flash any images that have androidboot.selinux=permissive as part of the command line.

I misinterpreted the symptoms of this bug... The only command line variable that matters is 'bootopt=...'. It must be the first one in the command line.
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
I have tried it a few weeks ago (see Post #36). The path that I flashed was /dev/block/mmcblk0p6 which is the actual path for the boot partition. The .../by-name/boot is merely a symbolic link (basically shortcut). Now, if you did the following:

dd if=/dev/block/mmcblk0p6 of=backup-boot.img

... you'll see that that backup file is different in size than both the original boot image as well as the patched one. So, when I saw that, I had my doubts (but I went and flashed anyway lol). See my post #36 for more details. But if you bootlooped, just breathe deep. You won't brick it because you didn't mess up the actual recovery partition.
[Asus ZenPad 10 Guides, News, & Discussion] diplomatic:
Oh, I see. Well, first of all, the backup being bigger than the image is normal. That's because with dd, you're dumping the entire partition to a file. The actual image can be any size up to the size of the boot partition. (If you're handy with a hex editor, you can trim the output file to the actual image, but that's more of a neat thing that's up to you).

As for flashing, in principle that should have worked because the bootloader is loading the same image that it does with 'fastboot boot'. As for why it didn't, I can think of two reasons. One might be that part of the image never got flushed from the write cache to the flash ROM. So you ended up with corrupt data when you rebooted. I've had this happen on my Z380M. That's why you need to make use of those "other options" of dd that I mentioned. Namely, using dd in this form:

dd if=patched-boot.img of=/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/boot bs=1M conv=fsync

The 'conv=fsync' option is what makes sure the data is physically written to disk before dd finishes. Or you can run 'sync' after dd, which will probably work too. The bs=1M option speeds up the transfer. BTW, I really prefer to use the by-name paths rather than the mmcblkXpY. That makes it much harder to mess up and write to the wrong partition. I mean, the difference between success and disaster is only one digit!

And the other possible reason why the patched image did not boot is that it's not signed, and the bootloader is configured to reject unsigned images. So I took the liberty of self-signing the patched boot image that was posted a while back. I'm attaching it. Also, I would have thought that Magisk would have added a signature. I've seen patched images that were perfectly signed by it. Care to try again?
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
This is really good info, thanks for that! I'm very willing to retry, but it may have to be sometime next week. I'll keep you posted :)
[Asus ZenPad 10 Guides, News, & Discussion] diplomatic:
Aight... In the meantime, if anyone else is eager to have permanent root on their tablet, don't be shy about trying this. :)
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
So, I tried the flashing in-device using Termux, the dd does not support bs=1M and it has disabled the conv option. Also tried in a different terminal (Material Terminal), same errors. So, i did the dd command without the bs=1M and conv=fsync options, and then simply used 'sync' after. I used your self-signed image. Seemed to complete without error.

Result: BOOTLOOP at "powered by android". Guess this didn't work, and is completely consistent with previous flashing via dd behaviour. Still, thanks [MENTION=3963622]diplomacy[/MENTION] for suggesting the different options! too bad this still didn't work.
[Asus ZenPad 10 Guides, News, & Discussion] diplomatic:
Oh, that's weird. Did you not get either of these messages on bootup (logo screen)? yellow state... Your device has loaded a different operating system OR Red State... Your device has failed verification and may not work properly

Because if not, that's not good. That means either the boot partition data still ended up corrupted, or the bootloader is rebooting and/or crashing when it can't verify the image against the signature. Either one is pretty unusual.

I would like to help you resolve this. PM me if you're interested in pursuing this. There are other things we can try.
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
PM'd. No red or yellow anything, just that "powered by android" and then it gives up and shuts itself down lol. Incidentally, I could still do:

fastboot boot original_boot.img
adb reboot bootloader
fastboot boot patched_boot.img

Then in a terminal app I can do:

su
dd if=original_boot.img of=/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/boot
sync

Btw there's no need to actually adb sideload the original firmware lol I was a doof before. Just need to restore the original boot image to the boot partition and then tether boot the patched boot image for root again. Discovering this saved me like 3h of installation / configuration.
[Asus ZenPad 10 Guides, News, & Discussion] notoriouspk:
So anyone tried to root the zenpad 3s 10

Successfully?
[Asus ZenPad 10 Guides, News, & Discussion] Camacho1607:
I can't see then download link :(
[Asus ZenPad 10 Guides, News, & Discussion] Prinz069:
There is none :crying:
[Asus ZenPad 10 Guides, News, & Discussion] amartolos:
Yeah we successfully have root via the fastboot boot, but it does not persist across device reboots. The method has been described in earlier posts by [MENTION=6994388]toineh[/MENTION]. [MENTION=3963622]diplomacy[/MENTION] and I have tried some things that didn't end up working, so it seems we are stuck with this consolation prize for the moment.
[Asus ZenPad 10 Guides, News, & Discussion] diplomatic:
So yeah, it looks like no amount of tweaking will get the rooted image to boot from storage. The bootloader is truly locked. I had a decent look at the disassembly of this tablet's LK (2nd stage of bootloader). I used the LK source from another Mtk chipset a kind citizen has posted here, to help me navigate. (Otherwise it's near impossible to follow the code.) As best as I can tell, this BL will reboot whenever it encounters a Red State, which results from a missing/invalid OEM signature. This is more restrictive than how its lower end cousins, the Z300/Z380, behave. But that would be fine, except for this next part.

This BL has no support for Yellow State.

A Yellow State results from a valid signature that's not the OEM's signature. If it detected this, you could sign the patched image yourself or have Magisk do it and the rest would be smooth sailing. The code that gets you to confirm if you want to keep booting into a modified OS is simply not compiled in. (I wonder if it's because they could not get text to show on the display.) So you might have to wait for Asus to provide the ability to unlock the BL. Or resort to more drastic measures.

So why does tethered boot work? Because it uses a separate image loading routine that skips the whole verification process. Now I could be wrong about any of this, and I don't want to discourage further hacking of this device. Browsing disassembled code with no symbol names is murky business at best. This is only my best guess.

fixed link :p
[Asus ZenPad 10 Guides, News, & Discussion] txx3:
delete
[Asus ZenPad 10 Guides, News, & Discussion] divyeshgopal:
I can't wait. I purchased this tablet few months ago and have been waiting for a root tool for it.
[Asus ZenPad 10 Guides, News, & Discussion] txx3:
can someone explain how xposed and temp. root can work? i always thought xposed always needs root?

the main reason i root is for xposed

second reason would ne the rest of root apps

-root explorer this

-on screen button (zenpad having thoes virtual Buttons :( )

-nova launcher can do things to with root

so as long as i dont reboot it should work?

whats the process if i reboot or battery goes empty

all over again i guess right?

Can we all send a mail to asus to unlock the bootlader!!

like collectively tell them to do it! i would participate!!!!!!!!
[Asus ZenPad 10 Guides, News, & Discussion] toineh:
Correction @ step 4. patched_boot.img should have fixed location. See below↓

1. First of all you need to extract the bootloader of your device firmware version.

2. The extracted boot.img must be accessible from your device storage.

3. Then you have to install Magisk Manager and try patching the bootloader.

4. If patch succeed, you can fastboot boot "extracted boot.img location"/boot.img

4. If patch succeed, you have to type "fastboot boot /sdcard/MagiskManager/patched_boot.img".

fastboot boot /sdcard/MagiskManager/patched_boot.img

5. After first reboot Magisk root should be there.

6. First thing now is to get busybox installed.

7. Now you can grant root permissions to Xposed installer.

8. After successful install, root permission is no longer needed to get Xposed working.

!NOTE - You have to install Xposed direct to the system.

Let me know if this will work. Think this option is possible.
[Asus ZenPad 10 Guides, News, & Discussion] txx3:
:confused: that's ohne level higher than my flashing experience and skills

but thank you for sharing this with us...

i think i keep waiting and hoping that someday we get the easy/classic way of installation to work on our device.
[Asus ZenPad 10 Guides, News, & Discussion] JackOfOwls:
So, if I'm understanding this correctly, the current State of the Root for the ZenPad 10 3S is that it can now be rooted using procedures described in this topic but that it becomes unrooted again after reboot, and that the key to complete success is to find a way to unlock the bootloader? at any rate, it seems we are getting closer and closer to true Root for this device and that's at least something.
[Asus ZenPad 10 Guides, News, & Discussion] txx3:
that's an optimistic way of seeing it
[Asus ZenPad 10 Guides, News, & Discussion] Banana Gun:
Sorry for the noob question, but does that temporary root process also work for the LTE version? It does seem to have very different hardware for being marketed as the same model.
[Asus ZenPad 10 Guides, News, & Discussion] blade001:
i'll try it

i'll try your script

---------- Post added at 08:36 PM ---------- Previous post was at 08:32 PM ----------

I will try your script
[Asus ZenPad 10 Guides, News, & Discussion] toineh:
If you have a little time, it's worth trying out. I will give you some support for at least boot up to rooted. When quite easy following all the steps, there's no reason to be confused about.

You can find the firmware version of your device in your settings menu. Search for 'about device'. Something like: WW_V14.0210.1709.27

The official Asus firmwares are available for download on their website. Your PC and also your 3s 10 can unpacking the boot.img from the zip.

https://www.asus.com/us/Tablets/ASUS-ZenPad-3S-10-Z500M/HelpDesk_Download/

MagiskManager can be downloaded from XDA. You have to enable 'unknown sources' for install it.

https://xdaforums.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445

You need to have fastboot installed at a device that runs a command line tool like 'cmd on Windows'. Also important be sure to know you can connect your 3s 10 to. (recommended using original usb cable)

https://www.xda-developers.com/install-adb-windows-macos-linux/

Hope this helps you further.

If you want you may ask for anything. Trying to get skills at flash level!! :laugh:
[Asus ZenPad 10 Guides, News, & Discussion] txx3:
sorry i wont do that, please you do it...and report back

thank you
[Asus ZenPad 10 Guides, News, & Discussion] toineh:
I already have!

Check post #22 [MENTION=754512]page[/MENTION] 3.

You're welcome
[Asus ZenPad 10 Guides, News, & Discussion] megasxlr01:
Have you been able to unlock the BL
[Asus ZenPad 10 Guides, News, & Discussion] toineh:
Not yet, and I think it's not gonna happen for the 3s 10. But so long this device exist, we never lose hope.

Asus won't be there. It probably might be unknown and also an unstable compare of hardware to be sure that unlocking the 3s 10 won't affect a very nice and fast device.

For you and also for me, will it be a very expensive try out doing something we don't know at all.
[Asus ZenPad 10 Guides, News, & Discussion] megasxlr01:
does anyone have the stock recovery... :P
[Asus ZenPad 10 Guides, News, & Discussion] megasxlr01:
i was able to flash the recovery and when i got the recovery back i was able to sideload the ota. :p
[Asus ZenPad 10 Guides, News, & Discussion] aleMarvel:
hi, i not understand, is rootable or not ? tx (asus zempad 3s model 90NP0272-M00340)
[Asus ZenPad 10 Guides, News, & Discussion] diplomatic:
I might have an unofficial method to unlock the bootloader. Any developers or advanced users that want to work with me, send me a PM. By power users, I mean someone who can use a Linux command shell in their tablet and can read kernel logs. I can't test it myself because I don't have this tablet. But this method works on my ZenPad Z380M (mt8163 based).
[Asus ZenPad 10 Guides, News, & Discussion] megasxlr01:
Post your method and I'll try it out. I won't have anytime until Sunday to try it out though, because of work.
[Asus ZenPad 10 Guides, News, & Discussion] diplomatic:
megasxlr01, I can't post it on the forum just yet. It's still very much a work in progress. There is software that needs to be run on your tablet. It's nowhere near user-friendly at this point. I need someone to work with me one-on-one, who should be able to reply at least once a day. Otherwise this might take forever. If you can do that, shoot me a PM.