tb330fu

This is a rough guide of how I rooted my Lenovo Tab M11 (tb330fu). This repo aims to provide a reproducible environment to perform these steps.

Please read the full guide before attempting to replicate it.

The following steps assume you the environment of the Nix shell of the flake in the repo.

$ nix develop

Dump the flash.

1. Power off the device.
2. Disconnect the device from the computer (if connected).
3. Do: sudo mtk_gui.
4. Connect the device to the computer.
5. Hold down the "Volume Up" and "Volume Down" buttons together.
6. Hold down the "Power" button to start the device.

You should see the log of mtk_gui output some device information. If yes, then proceed. If no, check to see if you have performed the mtkclient system setup correctly. If you have performed the setup correctly, go back to step 2 and retry. You might have to do this many times in order to get a stable connection.

In general, you are looking to get into something called "BROM mode". This is a special mode of the system implemented by MediaTek to allow repairing a device. mtkclient implements an exploit which gives us access to work with "BROM mode" as it is normally locked down.

7. In the tab Read partition(s), select every partition except userdata and cache (if present).
8. Press the Read partition(s) button and choose a directory where to save the partition images.

This will probably take some time...

Warning

Make sure to keep these images safe, because it is the only way to revert the changes we are about to make in later steps.

9. Disconnect the device.

The device will now be powered off.

Patching the LK partitions

The device uses an A/B partition scheme. This means that for a partition foo, the actual partitions on the flash chip are foo_a and foo_b. The bootloader decides which _a or _b to use on every boot based on the variable current-slot. You can check this with fastboot getvar all 2>&1 | grep current-slot when in fastboot mode.

We need to patch something called the "LK" partitions. I don't exactly know what these do, but found that not patching them results in the device unable to boot with a "Dm-verity corruption error".

1. Patch the partitions with lkpatcher:

$ lkpatcher ./path/to/partitions/lk_a.bin -o lk_a.patched.bin
$ lkpatcher ./path/to/partitions/lk_b.bin -o lk_b.patched.bin

2. Enter "BROM mode" again with mtkclient (refer to the previous section for instructions) and go to "Write partition(s)".
3. Select the appropriate patched LK images for lk_a and lk_b from the list.
4. Press "Write partition(s)".
5. Once complete, you can then disconnect the device.

The device will now be powered off.

Patching the boot images with Magisk

Our chosen root solution is going to be Magisk.

1. Boot into the stock OS.
2. Install the Magisk apk from the official releases.
3. Transfer the images to the device with:

$ adb push ./path/to/partitions/boot_a.bin /sdcard/boot_a.bin
$ adb push ./path/to/partitions/vendor_boot_a.bin /sdcard/vendor_boot_a.bin

$ adb push ./path/to/partitions/boot_b.bin /sdcard/boot_b.bin
$ adb push ./path/to/partitions/vendor_boot_b.bin /sdcard/vendor_boot_b.bin

4. In the Magisk application, do the patch sequence for every image above.

Warning

Magisk will output patched images with a random name. Make sure you do not lose track of which patched image corresponds to which input image, making a mistake here will make your device unbootable and you will have to reflash the originals in "BROM mode" again.

5. Transfer the patched images back to the computer.

Note

You can use the command adb pull /path/to/image to pull the image from the device back to the computer.

Unlocking the bootloader

1. Boot into the stock OS.
2. Go to Settings -> About tablet and tap 7-10 times the "Software version" card.
3. Go to Settings -> Developer options and enable the option "OEM unlocking".
4. Connect the device with USB to the computer and do: adb reboot bootloader.

Note

The device will now power off and reboot into fastboot.

5. While still connected with USB, do: fastboot devices. It should show a device connected.

Expected output:

<serial number>       fastboot

If you see something like this, you are good to proceed.

6. Do: fastboot flashing unlock.

I've seen posts on XDA about needing to use Lenovo's proprietary rescue software in this step but I didn't have to so I don't know what's up with that.

Flashing the patched boot images

1. Flash the patched images:

$ fastboot flash --disable-verity --disable-verification vbmeta_a path/to/partitions/vbmeta_a.bin
$ fastboot flash --disable-verity --disable-verification boot_a boot_a.patched.bin
$ fastboot flash --disable-verity --disable-verification vendor_boot_a vendor_boot_a.patched.bin

$ fastboot flash --disable-verity --disable-verification vbmeta_b path/to/partitions/vbmeta_b.bin
$ fastboot flash --disable-verity --disable-verification boot_b boot_b.patched.bin
$ fastboot flash --disable-verity --disable-verification vendor_boot_b vendor_boot_b.patched.bin

2. (optional) Do: fastboot -w

Warning

This will wipe all user data on the device.

3. Reboot into the system with: fastboot reboot.
4. You should now have root. Profit??

(optional) Debloating the default OS

Tou can flash some other GSI on the device but I had problems with the Secure Element of the device to play nicely with the newer Android versions. For example, screen lock did not work at all. So I stuck with the default OS. A battery-hungry privacy nightmare. To remedy this, I wrote a simple Magisk module which removes many of the unwanted parts of the default OS.

See: ./lenovo-zui-debloater.

You can build the module using the package inside this flake:

$ nix build '.#lenovo-zui-debloater'

or get it from the releases page of this repo.