[Miscellaneous Android Development] diplomatic:
Tool to Unlock Bootloader in ASUS ZenPad 3S 10 Z500M (P027)

​

This software essentially unlocks the bootloader in your tablet. I've developed a way to switch a Mediatek bootloader into an unlocked state using root privileges. Luckily, the Z500M does give us temporary root access to run this tool. The result is an "Orange State" boot mode, which disables boot partition verification. As a bonus, this procedure does not erase your data like a typical unlock routine does. It also does not require a PC except to start the temporary rooted image. Note that your tablet will still lack fastboot flashing functionality. But flashing by other means is still possible.

WARNING: Running this tool should be pretty safe. But I don't encourage anyone to try this. Before trying this out, consider the risks and drawbacks involved. By unlocking, you are essentially giving up the security of your device. It's also possible that a future firmware update will relock the bootloader or become incompatible with this tool.

This software is only for ASUS model Z500M/P027. Do not try it on any other device. It will not work. Support for other Mediatek devices may be added in the future. (That's why this is posted in the general forum rather than the ZenPad 10 one.)

And by the way, I don't own this tablet. :)

DISCLAIMER

This software is for educational purposes only. Anything you do that is described in this post is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software.

REQUIREMENTS

A ZenPad Z500M tablet upgraded to Android N

A rooted/patched boot image such as one made by Magisk Manager (method 1)

Temporary root with Magisk or other superuser manager installed (method 1)

TWRP image (method 2)

Knowledge of adb/fastboot and of basic Linux command shell

INSTRUCTIONS

Method 1

Read all of these instructions and make sure you understand them before starting

If you don't have an offline patched boot image, use Magisk Manager to make one from the stock boot.img of your current firmware. Transfer it to your PC.

Reboot your tablet into fastboot mode--either hold vol. down + power to power up, and select Fastboot. Or run 'adb reboot bootloader' while in Android.

Connect your tablet to a PC and run fastboot boot patched_boot.img to start the rooted image in tethered mode

Download the tool zip file to your tablet.

Extract the zip to your /data/local/tmp folder.

Open a root shell with adb shell, then run 'su'

Change your shell current directory to that folder (cd /data/local/tmp)

Run this command to unlock or lock the bootloader

sh unlockbl.sh

Follow the instructions on the screen and type the requested confirmation into the prompt.

Check for completion or any error messages. Report them here.

If no errors, you are unlocked and may modify your boot partition (e.g. install root).

Method 2

Read all of these instructions and make sure you understand them before starting

If you don't have TWRP for your tablet, download the latest image to your PC from this thread.

Download the tool zip file to your tablet.

Extract the zip to your /data/local/tmp folder. (For this method, most other folders should work as well due to permissive selinux mode)

Reboot your tablet into fastboot mode--either hold vol. down + power to start up and select Fastboot, or run 'adb reboot bootloader' from Android

Connect your tablet to a PC and run fastboot boot twrp-*.img to start TWRP in tethered mode

At the TWRP welcome screen, do not select to modify the system partition and touch Keep System Read-only instead. Doing otherwise will render your tablet unbootable.

Mount system in TWRP in read-only mode. Mounting in read/write mode will render your tablet unbootable.

Open a shell with adb shell on your PC or open TWRP's built-in terminal

Change your shell current directory to the folder that you extracted the tool zip into (cd /data/local/tmp)

Run this command to unlock or lock the bootloader

sh unlockbl.sh

Follow the instructions on the screen and type the requested confirmation into the prompt.

Check for completion or any error messages. Report them here.

If no errors, you are unlocked and may modify your boot partition (e.g. install root).

DOWNLOAD

Current Version

Unlock Tool v0.6a

Changelog

v0.6a

Actually improve compatibility with TWRP

v0.6

Handle units with blank bootloader configs

Improve compatibility with TWRP

Improve text wrapping for TWRP's terminal

v0.5

Major overhaul to remove the need for kernel module

v0.2

Made compatible with other FW versions

v0.1

First release

CREDITS

[MENTION=5217150]amartolos[/MENTION] for being a kick-ass tester

If anyone wants to develop a full Android app around this script, be my guest.

Also, that Thanks button will not click itself...