[Device Reviews and Information] Yahoo Mike:
UPDATE: by accident, I got the tablet working again by:

(accidently) erasing the first physical partition (lun0) . I used a modified version of emmcdl, but you could also use QFIL's Partition Manager or the "edl" tool.

telling QFIL to download lun0 again, by running with only rawprogram0.xml

restoring my oem, persist and frp backups

LESSON: if you're going to play with this tablet, make sure you backup the oem, persist and frp partitions.

Can anyone PM me the abl.elf file from TB128FU_S300168_220916_ROW ? I want to check how it was compiled. Thanks.

---- original post ----

I have a global TB-128FU running TB128FU_S000058_220816_ROW. I've been playing around with it and very successfully bricked it.

But I thought I'd share what I learned about the device's bootloader. Hopefully it helps with further development on this tablet.

bootloader

​

The bootloader is contained in the abl.elf file. It is called LinuxLoader.efi.

The bootloader was not compiled with the ENABLE_UPDATE_PARTITIONS_CMDS and ENABLE_DEVICE_CRITICAL_LOCK_UNLOCK_CMDS flags. That's why bootloader commands are limited. This means that the bootloader does not recognise flash, erase, set_active, flashing get-unlock-ability, flashing unlock, flashing lock, flashing unlock_critical and flashing lock_critical commands from the fastboot utility. Some of those commands might work in fastbootd, but I didn't test that before I bricked my tablet.

Hopefully Lenovo will compile the bootloader with those flags enabled in the next OTA.

oem unlock-flash

​

There are some fastboot oem commands, including fastboot oem unlock-flash. But that command seems to relate to a device state, rather than un/locking the bootloader.

The device state is "unlocked" when byte 0x20 of the lenovolock partition is set to 0x02. It is "locked" when byte 0x20 is set to 0x01.

DO NOT set byte 0x20 to 0x01

. You will lock your device...just like I did. And I think you'd probably lock your device by running fastboot oem lock-flash. So

DO NOT run fastboot oem lock-flash

either.

When byte 0x20 is set to 0x01, you can read from the device but you can't write to it. So you can enter bootloader, fastbootd, edl and stock recovery. You can query the device and read from the device in those modes, but you can't write to the device. So emmcdl, qfil, LMSA etc are all denied permission to write to the device. The bootloader can't flash/erase because it doesn't recognise those commands. Android just bootloops.

There is a process to set byte 0x20 back to 0x02 using the bootloader, but it requires a private RSA key - which is presumably in Lenovo's labs. The process is:

run fastboot oem getRandom. This gives you two random hex numbers.

use SHA256 to create a hash of a message (without the brackets): <random#1><serialno><random#2>

sign the hash with the correct private RSA key. The paired public RSA key is hardcoded in the bootloader.

run fastboot oem token multiple times passing first the hash and then the signature in 32-byte chunks. The last fastboot oem token command will tell you it's okay to run the unlock-flash command.

run fastboot oem unlock-flash. If it accepts your hash and signature, it will set byte 0x20 of lenovolock to 0x02 and erase the lenovoraw and lenovocust partitions.

You have to run those commands in exactly that order, or you'll get errors.

I'd love to get this to work, because it's the only way I can unbrick my tablet. But none of the private RSA keys I could find on the stock ROM are the correct pair for the bootloader's hardcoded public RSA key. If anyone has the correct key, I promise I won't share it if you PM it to me. ;)

Or if anyone knows a way to flash my backup of lenovolock.img, I'd love to hear it. Remember - I can't use edl, fastboot, fastbootd or stock recovery to write to the device...and I can't get into Android to use adb. I think I have a shiny new paperweight.