yashsingh1/xdaforums huggingface dataset:
[Thinkpad Tablet Android Development] Yahoo Mike:
You could try phhusson's AOSP 10.0 v222 GSI. It doesn't get much more vanilla than that. If you download a version without gapps, then you can install pico gapps with the GSI.

I use Havoc 10.0 GSI as my daily driver. It's very stable.

Everything you need to know is on the X605F/L GSI thread. You will want to load over stock Pie.
[Thinkpad Tablet Android Development] Yahoo Mike:
TWRP 3.5.0 has been released. The new twrp image for the X605F/L is available on twrp.me and the TWRP App.

I've moved discussion of the TB-X505F (M10 HD) to its own thread.
[Thinkpad Tablet Android Development] tkalfaoglu:
hi is there a TWRP for the TP-X306F, the mediatek version?

Thanks!
[Thinkpad Tablet Android Development] Yahoo Mike:
I haven't seen a TWRP for the TB-X306F.

It seems to use the same SOC as the TB-X606F/X/FA. So if your coding skills are in good order, clone the X606FA device tree. If the TB-X306F uses MTK HW FDE, then note the mod you need to cherrypick. It's progressed in gerrit, but hasn't been merged yet.
[Thinkpad Tablet Android Development] tkalfaoglu:
Many thanks. I am good at programming but I have never done anything similar in Android. I will try.
[Thinkpad Tablet Android Development] Yahoo Mike:
In case anyone bricks their X605F/L in QCom 900E mode as effectively as I did, here's how I revived mine.

If your tablet is stuck in 9008 mode (not 900E mode), then you can just use LMSA to rescue your tablet. You shouldn't need to do any of this.

You can check the 900E/9008 mode status in Windows Device Manager under "Ports", when tablet is connected to PC with USB cable.

Symptoms

Tablet goes to "Qualcomm HS-USB Diagnostics 900E" mode everytime you try to boot system, recovery or fastboot.

Cannot power off the tablet, so cannot enter EDL mode to rescue the tablet with LMSA or QFIL.

Solution

If you don't feel confident following these steps, then send your tablet to Lenovo to be fixed.

fully charge battery. Tablet should still charge in 900E mode.

disable all wifi and ethernet connections on PC. They seem to interfere with the Qualcomm drivers.

remove the SDCard tray from the tablet.

take off the back of the tablet (which is easier said than done) and then disconnect the battery. See steps 1, 2 and 3 in this guide.

connect a

short

and

high quality

USB cable to PC. Don't connect it to the tablet yet.

start QFIL and setup the flat build and programmer paths and files to the ROM you want to load. Use the QFIL that comes packaged with QPST. Don't use the standalone QFIL.

short the test points on the motherboard. I used tweezers. While shorting the test points, insert the USB cable that's already connected to your PC.

confirm in Device Manager that the tablet is connected to PC in Qualcomm 9008 mode (not 900E mode). If it booted into 900E mode, take the USB cable out of the tablet and try again.

hit "Download" in QFIL. Don't wait too long to do this, because 9008 mode (EDL mode) times out pretty quickly.

I had to run steps 6 through 9 many times, because it kept failing. But everytime I ran it, I got a little further through. On the 5th or 6th attempt, finally 100% of the images downloaded and QFIL reported "success". Woohoo!!!

once QFIL reports success, re-connect the battery

put the tablet back together again

press the power button to start the tablet

...and now you have your tablet back ! Hope that helps someone.
[Thinkpad Tablet Android Development] Heeni:
I have to ask...

what on earth did you do to need that??? :oops:
[Thinkpad Tablet Android Development] Yahoo Mike:
I was trying different ways to get Android 11 GSIs running.

I'm guessing that the 3.18.x kernel is just too old.
[Thinkpad Tablet Android Development] Heeni:
I'm fairly sure that my Moto G4 Play runs a kernel of a similar vintage in Android 11 (the Android 10 lineageOS version is 3.10.x). Perhaps that is one of the limitations of GSI: that your underlying kernel needs to be reasonably new.

Anyway, I was a bit concerned that maybe I was likely to run into a situation myself where drastic measures were needed, and I know that my coordination isn't good enough for the process that you describe. I would certainly need to take the "return to Lenovo" route for that reason. Quite likely I won't encounter this; but I want to say thanks for doing the investigations and taking the hit for the rest of us.
[Thinkpad Tablet Android Development] sd_shadow:
Test: @amanas I can post here.
[Thinkpad Tablet Android Development] amansas:
Hello, i just read your thread on installing TWRP on my device and followed it to the letter. However, it seems that after flashing the twrp.img, i'm unable to get it to boot into recovery using the 3 buttons. It just keeps flashing the logo till i release and then boots up normally... this happens no matter how long i keep pressing the buttons

Is there something i'm doing wrong or is my device incompatible? My build No. is TB-X605L_S210224_200910_ROW

Please help me out
[Thinkpad Tablet Android Development] Yahoo Mike:
The 3 button combo can be tricky, but keep trying and it will work.

One trick is to release the power button 2 or 3 seconds after the Lenovo logo appears, but keep pressing the volUp+volDown buttons until twrp logo appears.
[Thinkpad Tablet Android Development] safaan0313:
Hi ,I would really like to know how you get it to run on TBX605L.Can you explain it to me??
[Thinkpad Tablet Android Development] Yahoo Mike:
Can you describe your problem?

For example, which version of Android are you running? Which twrp image are you using? What happens after you flash the twrp image? Are there any errors in the recovery.log?
[Thinkpad Tablet Android Development] safaan0313:
i am running android 9.0,i tried rooting the phone using magisk (boot.img),when i did the phone suddenly got stuck at bootloop,i let it running for like a whole day, now the bootloop somehow stopped, i entered recovery mode to perform factory data reset it completed successfully.now the device is stuck at the logo screen. I tried flashing the twrp 3.4.0 1.img just like you mentioned.but a blue screen suddenly comes for less than a second a the device just reboots
[Thinkpad Tablet Android Development] Lamntox:
sounds like a brick. try using LMSA
[Thinkpad Tablet Android Development] Lamntox:
even though my past attempt of rooting lenovo tab 7 was successful, trying to root my new tablet (TB-X605L) even though i have followed all steps carefully didnt work since 3 button combo only worked for twrp 3.4 (which couldnt decrypt data).

android version 9, TB-X605L_S210224_200910_ROW
[Thinkpad Tablet Android Development] safaan0313:
i forgot to edit previously what i said.I repaired my tablet with the help of my friend.But thanksfor replying.
[Thinkpad Tablet Android Development] safaan0313:
so you are saying its not possible to twrp??
[Thinkpad Tablet Android Development] Lamntox:
Its possible, but i dunno why twrp 3.4-1 and higher doesnt wanna load with 3 key recovery combo, only did the trick for 3.4 which couldnt decrypt data, if its confirmed that its no longer possible to twrp the recovery then data force decryption is the only method i can see. Until then, well see if mike can figure out something from a situation like this.
[Thinkpad Tablet Android Development] Lamntox:
thanks to yahoo mike for solving the problem with the TWRP not working, you're a saint!

due to the fact that i want to prevent the painful process of trying to find out which twrp works for TB-X605L_S210224_200910_ROW, i will have to point it out to those who have the kind of firmware installed on their Lenovo Tab M10 - TWRP wont work, but there's still a way out:

THE MAGISK BOOT.IMG METHOD IN THE FLESH FOR PEOPLE WITH TB-X605L_S210224_200910_ROW

Disclaimer: the boot.img file which was patched by magisk only works with TB-X605L_S210224_200910_ROW

what will you need:

2 - a tablet, obviously (common sense)

3 - a computer

4 - Android SDK platform tools

5 - boot.img with magisk installed on it

6 (optional) - If you have no ramdisk, LMSA to at least get the recovery.img file

THE STEPS:

if you havent started the rooting process yet:

Spoiler content hidden.

If you already unlocked OEM (ROOTING PROCESS PART 2):

1 - Go on your device and download Magisk Manager (Version is 23.0)

2 - install the APK file

3 - open magisk manager and check the ramdisk

We will look at 2 situations:

Yay! Ramdisk is checked as Yes! The process will be hassle free and you wont have to use LMSA to get the firmware!:

Spoiler content hidden.

edit note: if your device has 605FC instead of F or L, youll need LMSA to extract boot.img and patch magisk on it via magisk app on the device.

OH HELL NAH! IN THIS RARE CIRCUMSTANCE YOUR RAMDISK IS LITERALLY NONEXISTANT AS CONFIRMED BY THE CHECKED NO! HERE'S THE HARD WAY:

Spoiler content hidden.
[Thinkpad Tablet Android Development] Yahoo Mike:
So TWRP is not working for you?
[Thinkpad Tablet Android Development] Lamntox:
Unfortunately no. Not even the root method can flash it in my system. It just crashes.

Still, thanks for your help.
[Thinkpad Tablet Android Development] safaan0313:
i think you are not doing it right.The twrp is completely working for me
[Thinkpad Tablet Android Development] Shreyanks24:
@Yahoo Mike

Could you please make a TWRP version for the X605FC (Lenovo Tab M10 FHD rel)?

Thanks!
[Thinkpad Tablet Android Development] Yahoo Mike:
The X605FC seems similar to the X605F: same SOC, but better battery, cameras and display. It's probably running a very similar kernel.

You can try this twrp. It might work. No guarantees, though.

Let us know how you go.
[Thinkpad Tablet Android Development] Shreyanks24:
I tried to flash the twrp , it shows that the twrp is flashed, but when I press the Vol up + Vol down + power the tablet turns on instead of booting into twrp. I also tried the command "fastboot boot twrp.img " and it showed command failed
[Thinkpad Tablet Android Development] jbcubana:
Hello everyone, to begin with a big thank to Mike for his work.

Everything worked perfectly for me on TB-605F, but my daughter did the OTA update without uninstalling Magisk.

Following that the device boot always on TWRP.

Not worried, I thought I had a backup on my pc, but I don't.

On 6 tablets and 4 smartphones, it is the only one for which I don't have a backup!

Not having this backup I tried LMSA, but could not finish the flash.

At best it charge at 84%, then fail.

I think my EDL is corrupted, the device is recognized as QUALCOMM HS-USB Diagnostics 900E (with the error symbol).

And if I force the driver on HS-USB QDLoader 9008, I still have the symbol indicating an error, I manage to pass the EDL verification step of LMSA but next failed.

I have tried directly with QFil but I get the following error: Failed to open com part handle:

Having recovered the stock firmware with LMSA, I tried to restore the aboot partition with fastboot but I get: FAILED (remote: Critical partition flashing is not allowed)

Even if I try to unlock the bootloader.

I have the same error with the sbl1, rpm, tz, fsg and persist partitions.

But I can flash the bak partitions:

As you can see, my device is recognized by fastboot but not by ADB, yet I have the right driver:

I also tried to recompile cache, system and userdata partitions from stock firmware with packsparseimg but I can only flash cache.

For system and userdata I have the error: Invalid sparse file format at header magi.

But by pressing Enter at the moment of the error, the flash is done:

Despite everything, the device bootloop...

I can no longer, or I don't know anymore install TWRP but I still have access to the recovery mode.

I have spent hours doing all of this to no avail, so I come to ask for your help to help me restore my daughter's tablet.

Thank you.
[Thinkpad Tablet Android Development] Yahoo Mike:
QCom 9008 is EDL mode. QCom 900E is diagnostics mode. They are different.

The tablet usually goes into 900E mode when there is a dm-verity or trust issue during boot.

If by "force the driver" you mean you removed the 900E driver and changed it to the 9008 driver, then that won't work. The tablet will still be in 900E mode.

You'll just be using the wrong driver (9008) to talk to it.

I think LMSA and QFil are both failing because the tablet is not really in 9008 (EDL) mode.

"aboot" is the Android bootloader. You do

not

want to flash that. So this error is ok.

The fastboot program will only recognise your tablet when it's in fastboot (bootloader) mode.

The adb program will only recognise your tablet when it's in recovery mode or in Android.

If the stock firmware you have is a different version to what you had before on the tablet, then you might have dm-verity issues. If the versions are different, the tablet usually goes into 900E mode and/or bootloops.

Ok, so you can get into fastboot and stock recovery? If that's right, then your tablet is not hard-bricked. That's good.

Try flashing the boot.img and recovery.img from the stock firmware. If you can boot to Android, then try LMSA again and use adb reboot edl to put tablet into EDL mode.

If you can't boot to Android, then try to flash twrp to recovery. Boot to twrp (3-buttons). Now try LMSA again and use twrp (reboot->edl) to put tablet into EDL mode.
[Thinkpad Tablet Android Development] jbcubana:
I don't know how to thank you, if I were a woman I would ask you to marry me 👰‍♀️😁

I stubbornly flashed the firmware TB-X605F S210224 201119 ROW downloaded by LMSA.

I had found, with great difficulty, a valid link for firmware TB-X605F USER S000022 20181026 Q00020 ROW Bundle, here: TB-X605F_USER_S000022_20181026_Q00020_ROW_Bundle.zip

I don't even know if this is the firmware I had previously updated but I still tried to flash boot.img and recovery.img with fastboot as you suggested.

Following that I was finally able to launch EDL mode, the device is well recognized as HS-USB QDLoader 9008 and LMSA can finally restore the tablet.

Thank you very much for your help, I know a little girl who is going to be very happy 😊
[Thinkpad Tablet Android Development] pyrothox:
Hi everyone! Thank you for this amazing work, I managed to install TWRP, what I thought what absolutely impossible just a few days ago. But now that I installed it, I'm always booting on it, my tablet doesn't seem to have an os anymore.

I tried to flash few zip files on TWRP but it didn't work.

My problem is really close to jbcubana's one, I tried to reflash the tablet with LMSA but got an error at 84% and QFIL didn't work either.

But the difference is that my computer actually detect my tablet as Qualcomm HS-USB QDloader while it is in edl mode.

So i really don't get why LMSA doesn't work, i am completly lost. At the moment I have access to the recovery mode, fastboot and edl mode.

If you have any idea on how to resolve this problem I would be so relieved.

Thank you !
[Thinkpad Tablet Android Development] Lamntox:
lamn from the hibernation again. if its like that youve most likely patched twrp into boot instead of recovery. try following yahoo mike's post above
[Thinkpad Tablet Android Development] Yahoo Mike:
Use fastboot to flash the stock boot.img.

fastboot flash boot boot.img

Hopefully that fixes the problem.

Use the boot.img with the same release number as your Android system. If you're not sure what version you were running, try this when you are connected in twrp:

adb shell mount -o ro /vendor
adb shell grep incremental /vendor/*prop*

If the result matches the version you have on your PC in c:\Program Data\LMSA\Download\RomFiles\, then you can use the boot.img from there.

Be aware that when you reboot, Android will re-flash

stock

recovery. If you want twrp, you'll have to re-flash it and re-install Magisk.

Edit: I'm not sure why EDL is not working for you. Maybe try a different USB cable ?
[Thinkpad Tablet Android Development] pyrothox:
Thank you so much for responding so fast! Unfortunately, I tried both changing the cable and flashing a new boot.img but it is still not working.

I used your commands to see which ROM I do have installed on the tablet and looked for a new boot.img.

But I couldn't find the entire ROM file anywhere so I used the magisk patched boot image you posted 2 years ago here: https://xdaforums.com/t/fastboot-lenovo-tb-x605f-unknown-command.3987747/

It didn't work, the LENOVO logo showed up instead of TWRP but it remained displayed for a bit less than an hour without doing anything.

I should also tell you that I was given this tablet from my school, which I left 2 months ago, and it had a pretty annoying overlay that actually made unlocking the oem difficult, so it may be why I have such stranges problems.

Thank you again for your help!
[Thinkpad Tablet Android Development] Yahoo Mike:
That hanging is usually caused by dm-verity. There's some kind of mismatch.

You can try turning off dm-verity with this tool. Make sure you flash the patched boot.img before running the tool.

If that fails, we need to work out why EDL mode isn't working. Send me a PM and we'll try to work it out offline.
[Thinkpad Tablet Android Development] Fedroid:
Hi there,

I can't install OTA updates as is informed before.

I tried uninstalling magisk in order to make it work but it doesn't works.

I'm on latest oficial TWRP and it remains after uninstalling magisk and is not changed by stock recovery.

I imagine that if I want to apply OTA I need to flash stock recovery, then OTA and afterwards TWRP again and magisk and etc...

If this is true, where can I get stock recovery?

I'm on TB-X605F_USR_S210175_200327_Q00332_ROW
[Thinkpad Tablet Android Development] darrien273:
Hello,

I have the problem that TWRP-3.5.2 _0-0-X605F.img does not boot on my TB-X605FC (with Android 10).

It looks like the flashing with fastboot works, but when I then restart into recovery from fastboot, it ends up in fastboot again.

If I do the same with the stock recovery (restored by booting into system), I do end up in recovery mode.

The power+vol up+vol down is disabled in my bootloader:

..
(bootloader) Device tampered: false
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
(bootloader) Display panel:
(bootloader) Fastboot_hotkey_enabled: true
(bootloader) Recovery_hotkey_enabled: false
(bootloader) Factory_mode_hotkey_enabled: true
OKAY [ 0.100s]
finished. total time: 0.100s

any help would be appreciated

Darrien

PS: I may have one more tidbit of useful information: when I fastboot boot twrp.img, i get a message aboout a missing DTB, which may also be the reason it does not boot into recovery correctly.
[Thinkpad Tablet Android Development] Lamntox:
Lamn out of hiatus from a random email here,

try lenovo recovery tools on the pc (rescue mode, wipes all data so back it up) and see if it works

another one of boot.img flashers, use lenovo recovery tools on your pc if its too severe

but in that case dont do that, and if recovery keys are disabled, thats brutal considering patching anything other than the recovery with twrp just screws up the system's boot up

good news is, you still have that "panic" factory mode combo, find the combo and use it, if it doesnt work then congratulations, you get to have to use lenovo recovery tools
[Thinkpad Tablet Android Development] Lamntox:
btw lenovo recovery tools dont have any risk of putting you into qualcomm diagnostics mode so dont worry
[Thinkpad Tablet Android Development] darrien273:
You assume much. The tablet still boots properly into Stock Android and I can go into Stock Recovery.

I never flashed to boot.

As I said: after flashing TWRP to recovery and selecting Recovery Mode from fastboot, it returns to fastboot. If I then Reboot to system, it boots normally.

If I try to boot TWRP without flashing, I get the DTB error.

I suppose it might be due to this being a TB-X605FC not an TB-X605F (supposedly only the cameras have been upgraded)
[Thinkpad Tablet Android Development] Lamntox:
I see. Try my root method in 6th page since your device has the same problem as mine which prevents twrp from booting. Since only the cameras have been upgraded, the method i described most likely wont have a problem with this upgrade. However, you'll need LMSA to download the firmware since the boot.img file is for X605L models, the extraction and magisk injection process shouldnt really take long though.

Good luck.
[Thinkpad Tablet Android Development] Lamntox:
the file youre looking for is boot.img, if you find that theres no ramdisk look for recovery.img.
[Thinkpad Tablet Android Development] Yahoo Mike:
Interesting. It sounds like the TB-X605FC with stock Android 10 has an updated Android bootloader (aboot).

The last stock update for the X605F/L was Android 9. So an attempt to fastboot boot twrp.img fails with "unknown command", not a "missing DTB" message. The bootloader version is 0.5 (fastboot getvar version).

I'm only guessing, but does adb reboot fastboot take you to the fastbootd menu? If so, select "reboot to bootloader" or use adb reboot bootloader before flashing twrp. Does that fix the problem?

Can you also check if the X605FC is an AB device:

adb shell su -c 'getprop ro.build.ab_update' <== make sure you use single quotes

If nothing is returned, it's still an a-only device like the X605F/L. So there's no need to worry about loading twrp onto different slots.
[Thinkpad Tablet Android Development] darrien273:
Here's what I get:

fastboot boot twrp-3.5.2_9-0-X605F.img
downloading 'boot.img'...
OKAY [ 1.685s]
booting...
FAILED (remote: dtb not found)
finished. total time: 7.199s

fastboot getvar version
version: 0.5
finished. total time: 0.020s

It goes into the same menus as when I use vol down + power, the "fastboot mode". I don't see a difference if I do either adb reboot fastboot from system or use the hotkey or "restart bootloader" from fastboot,

Nope, I get FAILED (remote: dtb not found) again.

that didn't work, the tab has no su, but getprop | grep ro.build.ab gives nothing, so no A/B-device.

Here's the output of getprop | grep ro.build for reference

[ro.build.characteristics]: [tablet]
[ro.build.date]: [Wed Jul 21 15:38:40 CST 2021]
[ro.build.date.utc]: [1626853120]
[ro.build.description]: [LenovoTB-X605FC-user 10 QKQ1.200216.002 TB-X605FC_S100038_210722_ROW release-keys]
[ro.build.display.id]: [TB-X605FC_S100038_210722_ROW]
[ro.build.fingerprint]: [Lenovo/LenovoTB-X605FC_EEA/TB-X605FC:10/QKQ1.200216.002/038_210722:user/release-keys]
[ro.build.flavor]: [hq_sdm450-user]
[ro.build.host]: [cm-build-42-20]
[ro.build.id]: [QKQ1.200216.002]
[ro.build.keys]: [release-keys]
[ro.build.product]: [TB-X605FC]
[ro.build.system_root_image]: [true]
[ro.build.tags]: [release-keys]
[ro.build.type]: [user]
[ro.build.user]: [cm]
[ro.build.version.all_codenames]: [REL]
[ro.build.version.base_os]: []
[ro.build.version.codename]: [REL]
[ro.build.version.incremental]: [TB-X605FC_S100038_210722_ROW]
[ro.build.version.min_supported_target_sdk]: [23]
[ro.build.version.preview_sdk]: [0]
[ro.build.version.preview_sdk_fingerprint]: [REL]
[ro.build.version.release]: [10]
[ro.build.version.sdk]: [29]
[ro.build.version.security_patch]: [2021-08-05]

I suspect the TWRP for the TB-X605F's dtb does not match with the identifier for the TB-X605FC, thus the dtb not found.

I do have a stock image for the FC should you need any files to extract the dtb.

Best regards

Darrien.
[Thinkpad Tablet Android Development] Lamntox:
If you want i can send you three test samples that yahoo mike sent me while i was trying to patch in twrp recovery. If none of them work he may as well have a look at the FC workarounds
[Thinkpad Tablet Android Development] darrien273:
That would be helpful. I'll try them ASAP.
[Thinkpad Tablet Android Development] Lamntox:
I promised and i delivered, there are 3 twrp samples, if at least ONE of them works with FC, tell us.
[Thinkpad Tablet Android Development] darrien273:
Thanks for the files, unfortunately all three fail with FAILED (remote: dtb not found)

Flashing any one of the three and starting recovery also dumps me back into fastboot mode.
[Thinkpad Tablet Android Development] Lamntox:
RIP, since i did what i could do and since i dont have the skills to slap twrp onto recovery firmware , you might wanna figure something out with yahoo mike.

Good luck.