[Asus Zenpad 8.0 Guides, News, & Discussion] satelliteseeker:
Recently I came across a string "pub/ASUS/LiveUpdate/Debug/ZenPad/ASUS_P00J.idx" when searching inside v3.7.4 aboot binary (emmc_appsboot.signed.mbn) in an attempt to find root method for this aging but still capable 8" 2048x1536 Android 7 tablet.

View attachment 5617709

Out of curiosity I put it after Asus download server https://dlcdnet.asus.com to build a download URL (The domain dlcdnlpdv.asus.com shown above no longer exists), and inside downloaded ASUS_P00J.idx there are 3 firmware packages listed: v3.7.3, v3.7.4, and unknown to virtually all Z8s owners, a v5.1.5 firmware.

- The "Release" ASUS_P00J.idx file has fewer firmwares in it (only v3.7.3).

View attachment 5617711

It came as a surprise as the version 5 indicates something big. I combined it with dlcdnet.asus.com into download URL (https://dlcdnet.asus.com/pub/ASUS/EeePAD/Zenpad/ZT582KL/VZW_ZT582KL_V515_all_user.zip), extracted .raw firmware file, unpacked it with https://github.com/Yoti/unraw and the extracted build.prop in system.img proves it is indeed Android 8.0.0, the lost Oreo build of Z8s released in May 2018 but for unknown reason, never pushed by Verizon as OTA update.

View attachment 5617715

I successfully flashed the .raw firmware to my Z8s tablet with Asus Flash Tool v1.0.0.45 under fastboot mode (adb reboot bootloader, or volume down + power buttons when turned off). Theoretically it can also flash by simply copying downloaded .zip file to root of internal storage (/sdcard folder). Now it brings native split-window and 8.0+ app support to our forgotten gem Z8s!

View attachment 5617719View attachment 5617721

Potentially to root and unlock bootloader:

The new Oreo aboot no longer verifies integrity of boot.img and recovery.img. Flashing to Z8s is already possible with an extra command in fastboot mode:

With Nougat bootloader, you have to flash the officially signed image from extracted .raw firmware or it will refuse to boot ("Start Up Failed").

Now with Oreo it lets you to boot even with a modified boot.img, displaying a "Your device has loaded a different operating system" screen but allows continuing to boot into OS.

- After that I made it past Verizon splash screen, got "To start Android, enter your password" message and cannot enter OS with a Magisk-patched boot.img flashed.

- Going back by flashing stock boot.img returned it to normal with no data loss.

- UNTESTED: a factory reset (after logging out all Google accounts) can potentially remove the encryption and grant root access.

"fastbook oem unlock" is also possible with new bootloader, but there's no OEM Unlock option available inside Settings -> Developer options.

- UNTESTED: with root you can flip several bits in devinfo partition to achieve direct bootloader unlock (see https://xdaforums.com/t/bootloader-...vices-devinfo-partition-modification.4100897/, unfortunately there's no firehose / ZT582KL_EMERGENCY_DLOAD.zip publicly shared yet)

- Also UNTESTED and requires root: or toggle the value of sys.oem_unlock_allowed from 0 to 1 (stored in last byte of config partition), which then allows fastboot oem unlock command inside fastboot mode.

Enjoy!