yashsingh1/xdaforums huggingface dataset:
[Thinkpad Tablet General] joeblowma:
Indeed!

With the GUI you basically load it up, load a scatter file, deselect certain partitions, have it start and then plug your powered off device into the USB and it just goes. Presumably the act of plugging in the usb starts some kind of preboot situation (I think that was the partition you never format) that gives the mfg tool access. Here are two topics I bookmarked on the issue I'm having that would prove more informative than what I can explain (not suggesting to do this out the gate, see the second link first):

https://xdaforums.com/t/how-to-fix-pmt-changed-for-the-rom-it-must-be-downloaded.4041027/

And why the recovery software is unlikely to ever flash one of these devices (going by the errors I received when it was still stock) - the scatter file doesn't match what the flash has:

https://xdaforums.com/t/steps-to-get-scatter-file-of-any-android-phone-with-video.2151251/

There are probably better ones, that have things that are taken for granted like the boot instead of flash bootloader thing I somehow missed. But this is where I'm starting, I'm going to try to recover the scatter info and see if it lines up or deviates a lot.

As far as I know the tool is shared freely. I just googled "SP_Flash_Tool_v5.2136_Win" and found a copy out there, which matches the version bundled and passworded in lenovo's files along with countless explanations on how to use it.
[Thinkpad Tablet General] GuyInDogSuit:
Whew... that's... a lot to sink my teeth into. I'll probably take a bit to go through this and let it soak in before I even consider attempting it. But at first glance it seems like something similar to other "unfecker" processes I've done before, lol, so this isn't exactly my first rodeo, but it's still a bit daunting nonetheless.
[Thinkpad Tablet General] joeblowma:
Which is probably why it's wrong and the rescue tool can't work, I mean it's not like I've changed partition sizes and the scatter files are identical for the 3 versions of firmware I have download from lenovo. If you want I will try to retrieve my scatter info (I'm on TB125FU_S000118_220927_ROW, the next version as I said clearly had partition resizes mapped in the logs I pulled of the delta patch parsing) as outlined, as it stands I'm pretty busy but not too busy to grab that for you if it'll help.

edit:/ nix that, I'm not seeing any /proc/mmc or similar in the /proc/ dir at all. There must be a way...
[Thinkpad Tablet General] GuyInDogSuit:
Best to take some time and think things over on this, I guess. That or risk messing up this thing even more. lol
[Thinkpad Tablet General] HansDampfi:
Hey everyone.

i reading all your posts, but i cant imagine bring my tablet to a root. i have a different firmware like rescue image. What can i do? Can everone tell my step by step?

Please

My Firmware Version on Tablet

TB125FU_S000118_220927_ROW

The Download

TB125FU_S000139_221208_ROW

@joeblowma

You have the boot.img from 220927? Can you give it to me? :D

can it work with tah t for me?

thx

have a nice week
[Thinkpad Tablet General] joeblowma:
Indeed, though "not working" is probably no worse than "not working" there is also "not ever working again" which would be tragic.

You should wait for OTA update so you have 139_221208, get the boot.img from that and don't do like I did - instead of flashing it from fastboot like me, boot it and then use magisk to patch the one on the device directly instead so you have a backup. I haven't been able to update because the lenovo tool never would let me flash it back to stock even when it was stock, and I can't take the OTA because boot partition fails sha check now.

And yes, I have the files (and full update the lenovo tool downloaded) from TB125FU_S000118_220927_ROW if you absolutely need it.
[Thinkpad Tablet General] HansDampfi:
@joeblowma

"You should wait for OTA update so you have 139_221208"

what do you mean about "waiting"

the update is now. I can install this over RSA or i install that over system normaly. i think.

Then i take the boot.img from rsa and patch it with magisk. is that right?

or

you gave me the 220927 boot.img and i patch it with magisk on the life system?

can this work?

sorry i am a little bit unsure. i dont like bricks :)
[Thinkpad Tablet General] joeblowma:
I would take the update over system normally. I tried updating mine from 90_220805 to 118_220927 with lenovo tool (before unlock/root) and it just failed to do it. If I had it to do over again, here is how I would do it:

1 - update to latest normally via the tablet itself

2 - get copy of latest firmware that matches tablet (preferably from lenovo tool)

3 - unlock bootloader

4 - once booted and in desktop after unlock, install magisk and patch boot.img from lenovo tool (on magisk line at top, press install, then select and patch file)

5 - get now boot_patched image onto computer with at least minimal platform tools (adb/fastboot exe)

6 - issue reboot fastboot via adb on booted tablet

7 - once in fasboot do fastboot boot boot_patched

8 - once booted again, install magisk apk from their git

9 - start magisk and press install again, this time select "direct install"

10 - this should have given you a flashed rooted boot image on the tablet based on the boot image already on the tablet, as well as a backup of the boot image you had in case you ever want to go stock, or if you want to do regular updates again you might need to temporarily restore it and then follow #9/10 again before rebooting.

also, one more step that is entirely optional but possibly extremely helpful

11 - (optional) share this new backup boot image with me that magisk made to try to help get me out of my own unable to update bind

I say "boot_patched" but the filename will be like "magisk_patched-25200_bCdDz.img" you don't need to rename it or anything.

I followed the above steps, except 7-10 were replaced by directly flashing the patched boot image to the tablet via fastboot. That was my mistake, I can't update by any method right now, so please don't repeat it.

Good luck, and if you are not comfortable with the risk/cost of (a small chance of) losing the tablet... don't do it. I love having it rooted, but with how little I'm using it I would rather prefer to keep updates coming especially when they gear up for android 13 later this year. Plus it causes some issue that have to be worked around, things like having to do safetynet fix modules so I can use netflix on it, which I had to install from a 3rd party app store because google hid it.

I feel given that a caveat is needed, while I have confidence in these instructions you should understand the risk isn't mine and I can't personally afford a new tablet for myself let alone you so it's your choices make them knowing you are responsible for them.
[Thinkpad Tablet General] HansDampfi:
@joeblowma

ok. i am on Step 7 an got this message:

..\fastboot boot magisk_patched.img

booting...

Failed (remote:not allowed in booting state)

i have also try

fastboot oem unlock

Failed

finish

.....

or sould i try this from the Guide?

Type “fastboot flashing unlock” read the instructions on screen which will tell you to press the volume up button (volume button closest to power button) to unlock bootloader.

Press the volume up button, It will say it was successful, wait a few seconds for the tablet to return to fastboot

Type “fastboot flash boot magisk_patched.img” and when you hit enter you should see a transferring status on your tablet (if you named your modified .img file something else, type that into the command instead)

When you see the transfer is complete type “fastboot reboot” which will restart the tablet.

thank you
[Thinkpad Tablet General] joeblowma:
If you did step 3, which involves entering developer mode in system settings and then turning on "OEM unlocking", rebooting to fastboot and issuing "fastboot flashing unlock", which reset my tablet to stock settings and boot up to set up again - you should (theoretically) then be able to go to fastboot again and boot the boot image. I wasn't super thorough in my instructions, I was only trying to show where what I screwed up you hopefully won't.

That was pretty much what I did, and now have no backup and can no longer return to actual stock or use the OTA update I keep getting offered - it panics because I replaced the bootloader, but I don't have the magisk backed up bootloader to put back because I flashed over it. And lenovo tool won't recover to stock either, because it thinks the partitions aren't the correct size.

edit:/ if it was actually unlocked already and this still fails, not sure what to do. You will need a backup of your boot image before flashing the magisk patched bootloader or you may never be able to update unless someone else has a copy of what is supposed to be there :(
[Thinkpad Tablet General] HansDampfi:
@joeblowma

ok. no problem. it is not your fault. i belive that this option i have enable. but i like to enable it again...

ok it was definitly enable. Dev Options in System -> OEm Unlock is Enable.

But same issue :(

UPDATE:

i try this:

fastboot flashing unlock

volume Button Up for agree this

than

fastboot boot boot_patched.img

...

Failed (status: read failed too many links)

despite this message, the device boots. but as if it had just come out of the packaging. Now when I turn on developer option it says oem bootlock is already enabled.

should I still patch it with magisk?
[Thinkpad Tablet General] joeblowma:
so you completed "fastboot flashing unlock" successfully and followed the on screen instructions and it still won't allow you to boot the patched image via fastboot? Hrm I wonder if I can boot the same one I flashed here...
[Thinkpad Tablet General] HansDampfi:
Update - see above. i have edit my post
[Thinkpad Tablet General] joeblowma:
I just tried to boot the boot.img I flashed to get root and it just says this:

Z:\__lenovo_m10\platform-tools>fastboot boot magisk_patched-25200_BtA00.img
Sending 'boot.img' (32768 KB) OKAY [ 0.859s]
Booting FAILED (remote: 'Unrecognized command boot')
fastboot: error: Command failed

Right, once you unlock and boot the developer option should say device is already unlocked. That completed step 3 I mentioned.

If you successfully boot from the patched boot image you should be able to run the magisk app and install in step 9 I mentioned. If not then magisk will not have root ability which will make it so it can't patch the boot.img on the device.
[Thinkpad Tablet General] HansDampfi:
OK. according to my description, should I continue with step 9 right now?

I'm still on the stand, failed too many links but started tablet.

Installed Magisk. Well when I go to install I can only select one file...which he then patched again. but don't install directly.
[Thinkpad Tablet General] joeblowma:
If it booted your patched boot.img, it should have let you do 'direct install' in magisk which would have backed up your boot.img from flash, patched it and flashed the patched one.

As you saw above I wasn't able to get it to boot boot.img sent from PC at all, nothing about links or anything just 'not supported' so no idea what you are doing different than me.
[Thinkpad Tablet General] HansDampfi:
well different, but also not successful apparently.

At least I can't install it. patch only

I'd love to get rid of all that google crap
[Thinkpad Tablet General] joeblowma:
Well that was interesting, on a lark I tried going to fastboot by power off tablet, waiting a few and then holding power and up volume, then when it asked pressed down to enter fastboot. Then I tried booting the magisk patched bootloader and I got:

Z:\__lenovo_m10\platform-tools>fastboot boot magisk_patched-25200_BtA00.img
Sending 'boot.img' (32768 KB) OKAY [ 20.531s]
Booting FAILED (Status read failed (Too many open files in system))
fastboot: error: Command failed

Why you fight us so hard m10? Why? :cautious: I'm gonna go finish sleeping on it, originally up because sick kitty needed special food and she woke me up...
[Thinkpad Tablet General] HansDampfi:
@joeblowma

well, nice. And now you have the same state as i

can you install boot.img now?
[Thinkpad Tablet General] joeblowma:
If you are in that state in fastboot, you can try "fastboot reboot fastboot" to get to the fastboot that is supposed to be able to boot these images. There are two different fastboots, one you get to by issuing 'adb reboot fastboot' and the other you get to using power and volume button, and selecting down when prompted. One is fastboot, the other fastbootd.

edit:/ neither will let me send and boot boot.img, but one of the two definitely let me flash it - neither provides a method for back up though.
[Thinkpad Tablet General] HansDampfi:
oh ok. slowly. i am confused.

i boot the patched_image on fastboot. The fastboot with the big letters with "Press volume down and Power button to turn off"

I know about the another fastboot. The fastboot with blue and orange letters. looks like every fastboot on different devices.

what do you mean to do?

UPDATE:

i boot in fastboot mode. the mode with the big red letters. then i write

fastboot flash boot_patched.img

i was flashing without errors.

then reboot. can now permanently install an img file. if i want that the option is there. but I don't know if that makes sense since I already flashed boot img. have. should I do it again? How do I know if I'm root now? I still can't uninstall google play store

hope i can help you, too.
[Thinkpad Tablet General] joeblowma:
You did the thing I said was not the right thing to do, so you've flashed over the original boot.img and can probably never OTA update again. You can install magisk now, in the app there are two installs that need to be done, one to the boot image and one to the app which gives super user.

I don't know about removing play store. I always just used ROM with minimal play stuff (don't remember offhand what it's called), never tried to rip out play services and such.

BTW: to get from the fastboot at screen with the big red letters to the other one, you can do "fastboot reboot fastboot" and it goes to the other one with the little menu. From what I understand one is fastboot and the other fastbootd.
[Thinkpad Tablet General] HansDampfi:
OTA updates I hope I will never need them and someday a CFW will come out for the device and everything will be fine. No more Google.

i thought i was successful. since it seems to be rooted now and magisk also seems to work.

The only question that remains is how can I get rid of google
[Thinkpad Tablet General] GuyInDogSuit:
Rooting isn't required to disable apps, which is the best thing to do for system apps that you can NOT find on the Play Store (in other words, might be important to that flavor of the Android OS's framework. Think OneUI and so on). The majority of Google apps that come preinstalled (YT Music, Drive, Slides, etc, crap MOST people don't need or even want), can be "uninstalled" via ADB as well, and I prefer to do it that way. As far as perma-uninstall, Titanium Backup is an old go-to, and I think Swift Backup (my preferred tool) can uninstall system apps, too.

For thing like this in the future, look into Shizuku. You can use low-level shell commands to do some things that were previously only accomplished via rooting. You just need to activate it once per reboot to use with apps like Swift Backup.

As far as OTAs go, you could try unrooting via Magisk BEFORE installing the update (you can download it though, just don't install yet or reboot), then install the update, and once it's successful, if you still want to remain rooted, return to Magisk and RE-ROOT (direct install for OTA option), and then reboot. Hopefully that works.
[Thinkpad Tablet General] joeblowma:
Swift is exactly what I was looking for, backups are good. Plus it led me to a far better authenticator app (Aegis) than Google Auth, which was a huge bonus. Thanks, so much!

He's in the same boat I'm in, proverbially speaking. He's overwritten the booloader without magisk snagging a backup of it to restore for these incremental system updates to work, and Lenovo doesn't put full updates (aside from their recovery tool, which as we both know doesn't work) OTA for those of us rooted.

We're back to my first assumption, those warnings about unlocking were true - can't update until it's relocked and returned to stock... unless we can find a way around that. Still no luck finding the partition table info, or a way to dump the alternate slot's binary data (I'd like to see if the bootloader on there matches the ones I have).
[Thinkpad Tablet General] HansDampfi:
@joeblowma

hey if you want me to test something or you need files from me. let me know
[Thinkpad Tablet General] GuyInDogSuit:
---snip---

Could this potentially be applied to my situation?
[Thinkpad Tablet General] joeblowma:
I honestly think our (anyone who owns this tablet) best bet is to get on lenovo to fix their tool. I have to wonder if they are even aware the tool is incapable of recovering the tablet with the files they give.

You should be able to format the partitions like the one guide said and flash it with the mfg tool, provided none of them are bounding outside the flash space. That said, I haven't been able to find a way to verify the addresses in the scatter file or why they caused issues in the log when I tried to use the tool.

Also, are you certain it's not a hardware failure? It sounded to me like something that just happened randomly and these should still be well within the warranty if you haven't unlocked it.
[Thinkpad Tablet General] GuyInDogSuit:
Could be a hardware issue, yeah. It started with it just randomly rebooting into recovery unless I forced it to boot back into Android, but that usually only last 2-3 minutes before the reboots started again. Hence the attempt to "recover" the tablet (aka "whoops, our tool's borked and now so is your tablet").
[Thinkpad Tablet General] joeblowma:
I just spent the last hour or so trying to read back a the boot_a/boot_b partitions using the flash tool, looks like it wants some kind of auth file (google c0030012), so I can't read back this way and verify but obviously they believe they can flash it. Situation is just plain weird with their recovery tool.
[Thinkpad Tablet General] HansDampfi:
@joeblowma

hi

nice. you have solved the Problem.

when i have time, can you write a short manual?

-----

well, i have used Universal Android Debloater GUI today.

thats a good tool i think. i have uninstall many apps such youtube, kids, google file and photos and lenovo tablet center

has someone else xp with that?

i cant find the com.google.android.apps.XXX

for

- gmail

- google PlayStore (not recommended)

- google Assist

- Memo (lenovo i think)

- GBoard (i have no idea. its for digital key board, when i deactivate, only speechassist work)

- Google-Service

- SMART Launcher (whats that?)
[Thinkpad Tablet General] joeblowma:
Here, this is from memory and I've been using computers/coding for so long I tend to take a lot for granted and don't think to document... so someone trying to follow this may have to ask questions to get clearer instructions but...

*note* <-- denotes a comment, not something you put on the shell lines
make a folder in internal memory called backup
copy stock boot.img from before you patched it with magisk into the folder you just made

adb shell
su
cd /data/adb/magisk
./magiskboot sha1 /mnt/sdcard/backup/boot.img
98f0afe1e43ef84da9d29b69ad7f1f37b3a07dbd <-- copy this output for your file to the 2 places it is below
mkdir -p /data/magisk_backup_98f0afe1e43ef84da9d29b69ad7f1f37b3a07dbd
./magiskboot compress /mnt/sdcard/backup/boot.img /mnt/sdcard/backup/stock_boot.img.gz
cp /mnt/sdcard/backup/stock_boot.img.gz /data/magisk_backup_98f0afe1e43ef84da9d29b69ad7f1f37b3a07dbd/boot.img.gz

magisk --path <-- to get the path to magisk (useful if you are hiding the app)
cp magiskpath/.magisk/config /mnt/sdcard/backup/config
<-- copy the config file to verify hash above is in it with a text editor or reader of some kind
<-- if not you will need to edit it and put in the proper hash then cp the file back over the original

You should now be able to use magisk app to uninstall/restore the bootloader to stock/unhacked
and install updates if you've not made any changes to read only partitions
I had to factory reset, it was stuck in a loop that stopped update at around 98% completion
let the update sit for a good 15 or so minutes just in case it's just busy, even after factory reset that
last bit took a long while

if the update succeeds, use magisk to install to the update/OTA bootloader and reboot. If not,
after factory resetting I had to use magisk to patch a boot image, boot into fastboot again and flash
the bootloader like when I first rooted it.
[Thinkpad Tablet General] GuyInDogSuit:
You can install a lot of those from APKmirror. GBoard is the keyboard. If you don't want to reinstall it, check to see in the language/input settings to see if there's another soft/virtual keyboard to set as default.

Smart Launcher is the default home launcher. If you uninstalled that, you'll have to adb push and install another launcher apk.
[Thinkpad Tablet General] fire_cuber:
Do you still have the download TB125FU_S000139_221208_ROW?

I need the boot.img of it please.

I am currently on TB125FU_S000139_221208.

I wanted to do the OTA update to TB125FU_S000144_230105_ROW today but Magisk says.

stock backup does not exist.

I know how to fix this but I need the boot.img from the TB125FU_S000139_221208_ROW

fix-magisk-stock-backup-does-not-exist.md

GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
[Thinkpad Tablet General] joeblowma:
Here you go, let me know if it works out for you. I just did this second update to 144 and nothing except a factory reset worked. This time, I couldn't even get magisk to recognize the clean copy following instructions that worked before, the instructions you just mentioned, and the shell script talked about in the comments there... weird all around.
[Thinkpad Tablet General] fire_cuber:
Thank you very much, I will test it.
[Thinkpad Tablet General] GuyInDogSuit:
I ended up RMA-ing the tablet. Couldn't find any other solution to fixing it, so that was the end result. :/
[Thinkpad Tablet General] fire_cuber:
Yes, it's a pity that it didn't work for me either, so I'll reset the whole thing.

But thanks anyway for the file.

[Edit]

Hmm, resetting with the "Rescue and Smart Assistant" tool from Lenovo doesn't work either.

But the tablet still starts as it is with root+magisk.

I will now leave the tablet as it is and not install any further updates.

I don't feel like doing any more tests.
[Thinkpad Tablet General] joeblowma:
We discussed copiously how broken their "smart" assistant is. They seem to have prioritized security, oddly as we can root it fairly easily, over end users being able to restore software problems.

I have no idea why the process of having root even after reflashing the unmodified bootloader doesn't let updating work without a factory reset, but with Swift Backup I'm able to use root to backup around 95% of everything, put the clean bootloader, factory reset, update, root again and restore nearly everything in around an hour (mostly spent waiting).

After doing it twice inside a month or so... I'm almost at the point of trying some GSI ROMs instead.
[Thinkpad Tablet General] GuyInDogSuit:
Let us know if you succeed in that venture. I'd love to ditch Lenovo's software as well.
[Thinkpad Tablet General] HansDampfi:
I am very satisfied with the tablet and its quality. It's a pity that there aren't that many and that the incentive to push CFW is so low
[Thinkpad Tablet General] klutzyT:
Hey i got one of these tablets ( a TB125FU) how do i go with installing a custom rom on it ive rooted it with magisk already but now i want to put a gsi on it or something
[Thinkpad Tablet General] klutzyT:
Ive tried putting one on in the past and it just bootloops