yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
I will not do the unpack+repack method because i would need to learn to use those aik tools and dont have time and nerves for that right now.

(Also would probablly work if the .img file came back the same, if not it wouldn't).

I appologize for being rude and not trying what you are telling me.

What I'm interested in is where the recovery_from_boot.p file is hidden.

I mean on which 0x0 to 0x8fd50000000 so i can delet it trough SPFT(if that is possible) :)

I guess I could flash format it manually from emmc_user start address and end address.

What do you think would happen if i do this?

Also if u tell me how to delet this recovery_from_boot.p file, I could just use the magisk to root the phone i think.(or am I mistakening?)

-------------------------------------------------------------------------------------------------------------------

!!!At the moment I am satisfied with the tablet as it is.(I have no errors and can install all the applications that i need)!!!

I'm only trying to anwser the questions for the good of people that will later read this thread, because i know how frustrating it is when u don't find what you are looking for on internet.
[Android Q&A, Help & Troubleshooting] alecxs:
you mistakening

AIK is very user friendly one-click-tool, all you need to do is scroll down to bottom, download AIK and click unpackimg.bat, or drag-and-drop the image (i have done this for you know)

unpackimg.bat
Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers

Supplied image: boot-verified.img

Setting up work folders . . .

Image type: AOSP

Signature with "AVBv1" type detected.

Splitting image to "split_img/" . . .

BOARD_KERNEL_CMDLINE bootopt=64S3,32N2,64N2
BOARD_KERNEL_BASE 40078000
BOARD_NAME 1508414006
BOARD_PAGE_SIZE 2048
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 00008000
BOARD_RAMDISK_OFFSET 03f88000
BOARD_SECOND_OFFSET 00e88000
BOARD_TAGS_OFFSET 0df88000
BOARD_OS_VERSION 7.0.0
BOARD_OS_PATCH_LEVEL 2017-09
BOARD_HEADER_VERSION 0

MTK header found in zImage, removing . . .
MTK header found in "rootfs" type ramdisk, removing . . .

Unpacking ramdisk to "ramdisk/" . . .

Compression used: gzip
10237 blocks

Done!

repackimg.bat
Android Image Kitchen - RepackImg Script
by osm0sis @ xda-developers

Packing ramdisk . . .

Using compression: gzip

Getting build information . . .

kernel = boot-verified.img-zImage
cmdline = bootopt=64S3,32N2,64N2
board = 1508414006
base = 40078000
pagesize = 2048
kernel_offset = 00008000
ramdisk_offset = 03f88000
second_offset = 00e88000
tags_offset = 0df88000
os_version = 7.0.0
os_patch_level = 2017-09
header_version = 0
hash = sha1

Generating MTK headers . . .

Using ramdisk type: rootfs

Building image . . .

Using format: AOSP

Signing new image . . .

Using signature: AVBv1 boot

Done!

the reason for this test is i want to know if Lenovo uses secret oem signature or just the public default signing key. if this is flashing then i can provide a rooted one. you may have to delete the checksum at the end of scatter file, or use the auth_sv5.auth file

if this image-new.img is not flashable ...

other method

... you still can try the bootless root method (see above). first you can check if mtk-su is supported

(if your prompt changes from $ into # you got a root shell)

adb push C:\Downloads\mtk-su_r20\arm64\mtk-su /data/local/tmp/
adb shell
cd /data/local/tmp
chmod 0755 mtk-su
./mtk-su -v

from root shell you can do some things like deleting files, flashing images, etc... the commands are actually easy (i can post) but modifying anything with locked bootloader most likely will make android unbootable (which should not be big deal as long as you can flash the original boot recovery system images from SP Flash Tool), but thats why i said you must read the full instructions carefully.

on the other hand, the juniojsv.mediatekeasyroot.apk seems to be more user friendly and automatizing the whole installing process, but i have not tested

image-new.img

(attachment removed)
[Android Q&A, Help & Troubleshooting] alecxs:
did you try to get bootloader unlock code from motorola support as i suggested in post #35

https://www.hardreset.info/articles/bootloader-moto-unlock-lenovo-motorola
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
This worked just fine with auth_sv5.auth file.

I can now upload all the files i needed for flashing and rooting the system after you provide rooted img file.(if the rooted img file will work)

Also here are my original boot.img and the magisk_patched.img files.

https://drive.google.com/drive/folders/1LmTFy0-mtW3wwV2j8OPynCQtxK3BgyoW

---------- Post added at 09:20 PM ---------- Previous post was at 08:55 PM ----------

I did try this method to get that data from my tablet but it just says the same as always (FAILED (remote: unknown command) finished. total time: 0.004s)
[Android Q&A, Help & Troubleshooting] alecxs:
try this both

magisk_patched-AIK-signed_TB-7304F_S000060_171019_ROW.zip

TWRP_lenovotb_7304f-030818-img-AIK-signed.zip
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
Both worked like a charm :)

It went trough :)

But when i rebooted into the system the magisk wasn't there. And also the recovery default options opened(not the TWRP options that i hoped would).

The commands were all useless none worked.

Don't know what we should do?

Maybe something about the system partition?

I will post the link to system partition when it is uploaded.

Actually it should be on the same link as when i posted earlier, that google drive FREE FOR ALL.

HF and GL for today.
[Android Q&A, Help & Troubleshooting] alecxs:
you must not boot. right after flashing TWRP_lenovotb_7304f-030818-img-AIK-signed, press and keep holding Volume Up, disconnect & reconnect the cable, don't release Volume Up until twrp splash screen appears

in twrp, swipe to allow modifications on system (this will rename recovery-from-boot.p)

the magisk_patched boot.img does not install Magisk Manager apk, it just gives the availbility to acquire root permissions. you must install Magisk Manager apk manually

if one of the images works, i can tell you later how to use it to install the other (and vice versa)

which commands? please be more precisely

btw no need to upload system.img we already have it (stock ROM)

readback of the missing partitions are more interesting (see post #33)

which one is the right Download Agent for flashing TWRP

MTK_AllInOne_DA.bin?

DA_PL.bin?
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
The fastboot flashing unlock-critical

The fastboot flashing unlock

The fastboot oem unlock

The fastboot oem unlock-critical

The fastboot oem

The right one is MTK_AllInOne_DA.bin

----I tried this as you suggested in #41--------

But i don't know where to get mtk-su.zip
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
I did get somesort of mtk-su file.

But the app just returned

./mtk-su: invalid option - Z

Cannot start: incompatible system
[Android Q&A, Help & Troubleshooting] alecxs:
scroll down to bottom, see attachments

try 32-bit and 64-bit

try older version
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
I did try r-18,r-19 and r-20

when i ran r-18

it didnt say anything good.

when i ran r-19

it said

UID: 0 cap: 3fffffffff selinux:premissive

when i ran r-20

it says

Temporary root by diplomatic@XDA

Home URL:

(url of the website)

UID: 0 cap: 3fffffffff selinux:premissive
[Android Q&A, Help & Troubleshooting] alecxs:
if the prompt changed from $ to # then it works! you can post your device model in the mtk-su thread so OP can list it as confirmed working

next steps

- rename recovery-from-boot.p

mount -o remount,rw /system
cd /system
mv recovery-from-boot.p recovery-from-boot.bak
ls -1

- after this flash twrp again
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
It now says i am rooted

https://i.postimg.cc/vHRMd5G1/Screenshot-2020-02-01-19-00-45-587.jpg

But when i reboot the device it says I'm not rooted anymore and it tryes to download an update.

https://i.postimg.cc/J7j70p63/Screenshot-2020-02-01-19-07-04-896.jpg

How do i now make it permanent?
[Android Q&A, Help & Troubleshooting] alecxs:
you aren't rooted yet, mtk-su is just a shell...
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
where do i type this?
[Android Q&A, Help & Troubleshooting] alecxs:
in the root shell right after ./mtk-su
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
ok now I tried to type this into terminal on android terminal.apk

I typed following commands:-

su root(which changed me from $ to #)

i then typed your commands

mount -o remount,rw /system

(mount: '/dev/block/dm-0'->'/system': Device or resource busy)

cd /system

TB-7304F:/system # mv recovery-from-boot.p recovery-from-boot.bak

mv: bad 'recovery-from-boot.p' read-only file system

https://i.postimg.cc/vThMPPDx/Screenshot-2020-02-01-13-51-38-128.jpg
[Android Q&A, Help & Troubleshooting] alecxs:
hm.. strange. whats the output of

getenforce
realpath $(which mount)
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
this returns:-

Enforcing(completes)

And then

/system/bin/toybox

https://i.postimg.cc/KY89L0hs/Screenshot-2020-02-01-13-59-08-922.jpg

The adb shell on my PC CMD gives me permission denied after su root command
[Android Q&A, Help & Troubleshooting] alecxs:
that's not good, run ./mtk-su multiple times until you get getenforce = permissive

try from adb shell instead of terminal emulator, adb has more permissions

wait.. thought we are talking about mtk-su, but you did run su - where did this come from? thought magisk is not working?? did you grant permissions to the magisk superuser pop-up when typed su in terminal emulator first time? then you're already rooted!
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
after i punched ./mtk-su in adb shell for 1min straight about 120 times....

i only got few beeps on my pc speakers. nothing happened.

---------- Post added at 07:13 PM ---------- Previous post was at 07:11 PM ----------

yes i am rooted but after device reboot it starts to download and install updates and when i check if im rooted with root-check tool it says im not rooted anymore.

I would like to make my device root permanent so if i reboot, it won't unroot.

Should i now try to flash recovery with twrp? and see what happens when i try to reboot into it?
[Android Q&A, Help & Troubleshooting] alecxs:
forget these rootchecker apps they are useless.

you are permanently rooted with magisk since you flashed boot.img and installed Magisk Manager. all you have to do is initial grant permissions for each app you want to allow root access. also for terminal emulator you need to fine-tune settings

- in Magisk Manager in the superuser section you can see what apps have already granted/denied root

- set namespace to global in Magisk Manager settings (look around i don't know where exactly)

- install SELinuxModeChanger.apk

(github - Assets - app-release-v11.apk)

- grant superuser permissions forever

- set permissive as default on reboot

- reboot and check getenforce

- rename recovery-from-boot.p (if toybox mount not working, skip this step)

- install TWRP app

- flash twrp (just provide the image file to twrp app, don't let the app search for your device)

- in terminal type su -c reboot recovery

- try the unsigned twrp if the signed not working

- if device is bricked, flash stock recovery from SP Flash Tool
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
https://i.postimg.cc/q7SL90W2/cmd1.png

Dude i swear that when we finish with this and root it.

I will backup the system.img and let the internet have it.

After i successfully flashed recovery with TWRP and then executed order 66(su -c reboot recovery)

The device said

Red state!

failed verification!

your device will now reboot.
[Android Q&A, Help & Troubleshooting] alecxs:
- download Busybox-1.29.2-YDS-ARM.tgz from github

- extract busybox-arm64-sel with 7-zip and rename the file busybox

- copy to tablet and run busybox mount

adb push busybox /data/local/tmp
adb shell
su
cd /data/local/tmp
chmod 0755 busybox
./busybox mount -o remount,rw /system
cd /system
mv recovery-from-boot.p recovery-from-boot.bak
ls -1

---------- Post added at 22:17 ---------- Previous post was at 21:49 ----------

Red state = brick

this is dead end for TWRP. it's because the AVBv1 signature is invalid

:good: you are rooted, nothing more to do

someone with unlocked bootloader needs to upload seccfg
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
Here i uploaded the TB-7304F How to Unbrick.zip file. I will upload and explain everything trough next week. I hope that aIecxs will read it carefully and tell me if I will make a mistake. Cya tomorrow when we will discuse how to make a great guide for ppl with same tablet.(TB-7304F no sim only WLAN)
[Android Q&A, Help & Troubleshooting] alecxs:
it's a systemless root method. all the root stuff is done in boot.img from Magisk Manager. system is a read-only partition, none of the installed apps does modify anything

the change you have done is renaming recovery-from-boot.p which only purpose is restore stock recovery on boot, but this change is done automatically from twrp when twrp ask for modifying system on the initial setup screen

you don't need to make a guide for rooting, all this is already documented very well in original threads, besides this rooting steps are most likely always the same and well known for most users. just add the missing step post #42 (step 8. flash boot.img)

the strange behaviour of mount looks like a bug (or feature, who knows?) in toybox. there is a busybox module in magisk, if you need busybox often you should install

The more important information is focus on topic of this thread and revise your Unbricking Guide post #28 as you spent 3 days to figure out this is the real benefit of your great help and testing :)

if you want to share the missing partitions which are not included in stock ROM, readback proinfo nvram protect persist seccfg para expdb frp kb dkb metadata pgpt sgpt

helpful too would be to figure out scatter for secro, for this you need WwR MTK (link post #19) to analyze a full rom dump (time consuming)
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
I will try to readback all those partitions and to analyze full rom dump.

Can you please meanwhile download the unbrick guide I uploaded in .zip file on my google drive and tell me what you think about it.

The (How to unbrick!!reademe!!.txt) file has instructions in it.
[Android Q&A, Help & Troubleshooting] alecxs:
perfect except for the flashing. the power + vol key combo is for recovery and fastboot modes, but the preloader mode comes up before, only for a second when connecting usb-cable (this might confuse if vcom drivers missing) it should not necessary to press any button, flashing works even without battery at all... just the order is important (1. switch off, 2. start flashing, 3. connect cable) here is a little video ;)

edit: and for the formatting with sp flash tool it is important to select EMMC_USER otherwise preloader may destroyed (preloader is in EMMC_BOOT)

btw i am busy today
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
Can you just tell me, how to save all these partitions?(.img .bin .mdf , etc.)

And i will readback tomorrow when i get from work.(nightshift)
[Android Q&A, Help & Troubleshooting] alecxs:
file names doesn't matter you can just save files without any suffix
[Android Q&A, Help & Troubleshooting] alecxs:
found a bug in Magisk Manager, kindly ask you to delete magisk_patched from your files, it's probably broken. wait for next release, meanwhile use the magisk_patched-AIK-signed_TB-7304F_S000060_171019_ROW.zip from post #50 only
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
I now readback all those partitions that you asked of me.

Except for sgpt which i couldn't get into spft for readback because it said (Address or length bytes not align).

READBACK
[Android Q&A, Help & Troubleshooting] alecxs:
it seems the partitions are lost. the files are all empty (except for seccfg para metadata pgpt). i wonder how tablet can connect to wifi with empty nvram partition...?

pgpt

partition table (scatter)

nvram

calibration data, MAC address, IMEI (empty)

protect_f

carrier sim lock information (empty)

persist

unique phone data?

(couldn't find any useful information what this partition is for, but they all claim it's important)

seccfg

probably bootloader lock status (but looks encrypted)

para

parameters for boot mode (off-mode-charge=1)

metadata

Android FDE crypto footer (generated automatically)
[Android Q&A, Help & Troubleshooting] alecxs:
i have added verity_key from stock recovery in TWRP maybe it works now
[Android Q&A, Help & Troubleshooting] keeneeto:
Have you managed to sort this out? I have the same tablet.
[Android Q&A, Help & Troubleshooting] alecxs:
if your bootloader is unlocked you can upload seccfg maybe it is helpful for others
[Android Q&A, Help & Troubleshooting] keeneeto:
How do I upload that? I can OEM unlock the bootloader from the developer options menu.
[Android Q&A, Help & Troubleshooting] alecxs:
oem unlock in developer options is just the first step (see post #33 page 4). i guess this tablet is not unlockable. however, you can check unlock status with

fastboot oem device-info
[Android Q&A, Help & Troubleshooting] MFrabbitjr:
Yes you can Unlock the bootloader in settings but you can't unlock it in fastboot mode...

If your device works, pls dont flash it.

You can just brick yourself out if you dont know what you are doing.

If you are going to flash it just flash recovery partition and nothing else.

!!!DO NOT FLASH PRELOADER!!!

You can download this torrent
[Android Q&A, Help & Troubleshooting] a7000:
Good day! Can I have a complete guide on how I can root my Lenovo tab 7 304f? Thank you and Godbless!
[Android Q&A, Help & Troubleshooting] alecxs:
- read Magisk Installation Instructions

- read about Mediatek Secure Boot Download Agent and Authentification

- read about readback in SP Flash Tool

- dump boot.img from readback

- patch boot.img with Magisk

- carefully read & understand warnings about SP Flash Tool Download mode and preloader

- flash patched boot.img (on locked bootloader)
[Android Q&A, Help & Troubleshooting] a7000:
Amazing Temp Root for MediaTek ARMv8 [2020-08-24]

Software root method for MediaTek MT67xx, MT816x, and MT817x! So it's no big secret that not too long ago, I found a way to achieve temporary root on MediaTek chipsets. No preinstalled root solution or device unlock was needed. The tool I...

xdaforums.com

Can I use the above method as instruction on rooting my device?
[Android Q&A, Help & Troubleshooting] a7000:
Or can I use this method to root my device? Thanks for answering!
[Android Q&A, Help & Troubleshooting] alecxs:
no. this is Unbricking Guide. i do not recommend to format your EMMC_USER as you will lose important partitions (see post #78)

i have updated my previous post with links

- make sure to always flash in Download only mode

- do not flash preloader in any case

(if you prefer bootless-root method head over the mtk-su thread)
[Android Q&A, Help & Troubleshooting] a7000:
Does bootless-root method will trigger dm-verity? I'm scared that my device can become unusable after the rooting process.
[Android Q&A, Help & Troubleshooting] subjectnull:
No it doesn't, but it also doesn't stay rooted between reboots. I own a TB-7304F and have used this technique so can confirm it works fine.
[Android Q&A, Help & Troubleshooting] trueAK:
I bricked my lenovo z2 plus (z2_plus), it is only vibrating after holding power button for 10 sec, I am not able to boot it to fastboot mode, will EDL cable (deep flash cable) help me??
[Android Q&A, Help & Troubleshooting] amrel:
Hey there ! My little sister was given a Lenovo TB-7304I for school but I guess the previous owner messed up or something with the reset so it keeps asking for a previous google account. Tried contacting the help desk of the government but they can't get in touch with previous owner so I tried flashing the device myself since I had previous experience rooting so it can't be that hard right? (famous last words) The kicker here is that for some reason during the download process the flasher did not progress at all even after a few hours and after a few tries, I absent-mindedly unplugged the usb cable while the download process was going and suddenly got an error, then the device just got hard-bricked. I'm talking not even booting up or charging kind of hard bricked. is there any way I can recover this tablet or has it become a paper weight? Any help would be appreciated since I can't share my laptop with my lil sis for her school all the time since I'm using it to work from home at times.
[Android Q&A, Help & Troubleshooting] alecxs:
https://forum.hovatek.com/thread-11802.html
[Android Q&A, Help & Troubleshooting] alecxs:
We can now OEM unlock seccfg thanks to mtkclient!

https://github.com/bkerler/mtkclient

It's even possible to by-pass auth_sv5.auth :)

https://www.xda-developers.com/bypass-mediatek-sp-flash-tool-authentication-requirement
[Android Q&A, Help & Troubleshooting] mat320:
Hello! Do you have a guide on how to unlock bootloader and root TB-7304F? I have not touched this tablet for a long time since it was so slow. I have tried the temporary root last year but I want to have a permanent root if possible. Thank you!
[Android Q&A, Help & Troubleshooting] alecxs:
you have quoted the guide

python3 mtk da seccfg unlock

you have temporary root with mtk-su? backup your apps with Migrate
[Android Q&A, Help & Troubleshooting] mat320:
Thank you! I'll try to unlock my tablet after my exams! Are there existing guides for rooting this tablet?
[Android Q&A, Help & Troubleshooting] alecxs:
install Magisk app, patch boot.img and flash from fastboot, as always (refer to post #31). it even worked on locked bootloader when flashed with SP Flash tool or mtkclient (refer to post #50) but the attachment at time of patching requires old version.

Note: due the forum migration all page references became invalid, as the posts per page have doubled ;)
[Android Q&A, Help & Troubleshooting] mat320:
Unlocking the tablet was so fast using the mtkclient! Do you have the drivers for this tablet? The tablet was detected via adb and I was able to 'adb reboot bootloader' to enter fastboot. However, when I try 'fastboot devices', the tablet was not detected. What drivers should I install? Thanks!
[Android Q&A, Help & Troubleshooting] alecxs:
while device connected in fastboot mode -> device manager -> pick device -> Update Driver -> Browse my computer for driver software -> Let me pick from the list of device drivers on my computer -> Show all devices -> Have Disk -> android_winusb.inf -> Android Bootloader Interface -> confirm anyway (although it says not suitable for this device)

https://developer.android.com/studio/run/win-usb

may require disabled windows driver signature enforcement (restart -> Startup Settings F7)
[Android Q&A, Help & Troubleshooting] mat320:
I found the required drivers for fastboot. I also managed to make a full rom dump using the spflashtool. How do I get the boot.img from that? Thank you!
[Android Q&A, Help & Troubleshooting] alecxs:
either from mtkclient or split ROM dump with Wwr MTK v2.51 (post #19)

python3 mtk r boot boot.img
[Android Q&A, Help & Troubleshooting] mat320:
I managed to root my tablet! Thank you so much!!! I'll add some tweaks later
[Android Q&A, Help & Troubleshooting] mat320:
However, after I restarted my tablet the root was gone. I checked magisk and it says magisk is not installed. Is this the case for you also?
[Android Q&A, Help & Troubleshooting] alecxs:
I don't own that tablet. flash magisk_patched.img again. if that doesn't root, uninstall Magisk and try older version.

fastboot flash boot magisk_patched.img
[Android Q&A, Help & Troubleshooting] mat320:
I managed to retain the root even after reboot. It seems that enabling zygisk in Magisk makes the root access malfunction after a reboot
[Android Q&A, Help & Troubleshooting] madri23:
Hi, can you, please, post a guide to share how you managed to root the Lenovo Tab TB-7304F? Thank you so much in advance!
[Android Q&A, Help & Troubleshooting] oldman20:
my 7305X cant detectable on my PC