# bootloader



## djmwj (Oct 21, 2011)

Been looking at this a bit on my ideapad.... which should be very similar to the thinkpad. Using nvflah it looks like its got a secure loader.. we need the key in order to even dump the memory. This happened with an asus product... tyings went quickly when the key was leaked.... but we need the key. Sorry in a rsh will post later more details


----------



## opnsrcaddict (Oct 17, 2011)

What process did you use to check for a locked boot loader? We have had Lenovo say that the boot loader on the TPT is unlocked, but it would be nice to confirm.


----------



## TekMason (Oct 14, 2011)

opnsrcaddict said:


> What process did you use to check for a locked boot loader? We have had Lenovo say that the boot loader on the TPT is unlocked, but it would be nice to confirm.


The fact that you can boot into recovery mode means that the boot loader is unlocked. See Booting to Recovery Mode

TekMason


----------



## xrs (Jul 12, 2011)

granted they say its "unlocked" and we can get into it we cant do anything but flash lenovo files with it


----------



## djmwj (Oct 21, 2011)

OK so i worked on this quite a bit last night here are some results.

The system runs off of nvidia's Ventana platform. I downloaded NVIDIA's NVFlash.

Using that i was able to know that the bootloader has been locked.

You may check yourself if you would like. Just dload NVFlash and try issueing any commands to it
it will respond scm 0x04 which means its secured....

However.....

There has been posts linking to some chinese? site that hosts NVflash files specific to lenovo. as it turns out within these files is the key to unlocking the bootloader.

You can read all about the SBK key you need at http://androidroot.mobi/technical/tf-secure-boot-key/

the info there was a great asset to me.

within the NVFLASH files from that site, there is a batch file with the needed key:

looks like the key was posted http://androidroot.mobi/2011/10/03/no-we-havent-given-up-or-yet-another-post-about-the-current-state/ by someone.

it is 0x0d0a6f49 0x6c577634 0x4d634e55 0x47336d55

Using that key you are able to modify the bootloader in anyway you wish using nvflash...

This should enable us to unlock needed info to move forward with new recovery software etc.... i am still working on getting some of the necessary info together...

i have been able to get the unit to respond to commands and if i get it out of fastboot i will start working on the correct files necessary to load bootloaders.

In the mean time also included is adb-lenovo program. using that program i was able to reboot the ideapad k1 to fastboot mode

I am currently trying to get fastboot to recognize the device in that mode. Unfortunately i cannot boot back to the regular os until i solve the usb driver issue, or i reflash the unit..... still working on option A... 
anyway with this info we will surely be able to get root, write ROMs etc....

I am hoping some other can help now that i think the obstacles of the lock can be overcome. I have never written boatloader level software for anroid systems so i am not entirely sure all that is entailed.... i understand i need to rebuild my PC's kernel to hand YAFFs2 file systems but i have not gotten thier yet.... still working on the fastboot thing.


----------



## yggdrsil (Oct 22, 2011)

awesome work, i will contact some friends i know and see what we can do with this. im assuming making a dump would be the first step and then simply writing and flashing a recovery that wont check for keys.


----------



## djmwj (Oct 21, 2011)

Thanks....
With this i don't think you have to worry checking for keys.... when you write the data to the partition it will write it using the key there.... i think....

I have modified the ota .zip for root my stumbling block now is changing the format of the update.zip to just the image files : system.img boot.img and recover.img.

form my post on lenovo's ideapad forums. ::
Yes you can use this to send roms..... do you know how to build the roms into the format boot.img recovery.img and system.img?

WARNING if you use this tool before backup you will lose all the premium apps..... see below

i have edited the OTA files but i do not know how to convert back to this format for flashing... also before you flash backup your user-data directory or you will lose all the included apps..... (i believe you can use the command ./nvflash --bct flash.bct --setbct --odmdata 0x300c0011 --sbk 0x0d0a6f49 0x6c577634 0x4d634e55 0x47336d55 --configfile flash.cfg --bl bootloader.bin --sync ) Then you should be able to issue the command to backup that 'partition' using something like "read 8 UDP.bin" (this should read parition 8 and copy to UDP.bin) i am not sure if that is the correct parition however.... the partitions are listed in the .cfg file. i already deleted mine so i am having trouble checking

Please let me know if you can write the roms to that format (boot.img recovery.img and system.img) i am having trouble with it....I don't know how to preserve permission on the system.img nor what base to use to repack boot.img....


----------



## yggdrsil (Oct 22, 2011)

[email protected]:~/Desktop/nvflash_linux_2010110500$ sudo ./nvflash --sbk 0x0d0a6f49 0x6c577634 0x4d634e55 0x47336d55 --getpartitiontable parts
Nvflash started
rcm version 0X4
Command send failed (usb write failed)

ok looks like the key is not correct?
Ill check in a bit later,
we are hangin out in the irc room
efnet , #thinkpad-android


----------



## ZebCrs (Oct 24, 2011)

I was just thinking here at the office this morning. Would it be possible to write directly using a Riff box over jtag?as The Riff Box supports Tegra2 chipset .
If that is possible we can write an unprotected bootloader direct until we find a way to do it via software.


----------



## jeitzen (Oct 20, 2011)

djmwj said:


> In the mean time also included is adb-lenovo program. using that program i was able to reboot the ideapad k1 to fastboot mode


Can you provide a link to the adb-lenovo.exe program?

Are you able to boot the tablet into download mode?


----------



## djmwj (Oct 21, 2011)

i cannot, what i can however flash new boot.img to the device giving me root. the problem is i do not know how to build recovery for it.... i have a good recovery.img and boot.img but i need to add some type of custom recovery....... so i can update the device.


----------



## dsw1ft (Oct 19, 2011)

djmwj. Thats for all your work. I don't know exact what your problem with is for the recovery, but I hope this can guide you in the right direction.

I remember when I tried to install clockword recovery into the TPT there was a forum or a blog where they requested for some information about the tablet. The problem was that if you want to get the info, you need to have root first.

If you have already gained root access, I think you would be able to provide information to clockword recovery to add TPT into their APP so we can install it directly from the app.

I'll try to find this on the web.


----------



## jeitzen (Oct 20, 2011)

Are you flashing with ADB? How are you getting rw access?

Can you post the steps you used to execute a command with su access?


----------



## ker2gsr (Jul 26, 2011)

djmwj said:


> i cannot, what i can however flash new boot.img to the device giving me root. the problem is i do not know how to build recovery for it.... i have a good recovery.img and boot.img but i need to add some type of custom recovery....... so i can update the device.


how did you achieve root ... @yggdrasil says nipqer has a recovery ready to go

Sent from my DROIDX using Tapatalk


----------



## TekMason (Oct 14, 2011)

jeitzen said:


> Are you flashing with ADB? How are you getting rw access?
> 
> Can you post the steps you used to execute a command with su access?


Where did you go djmwj?


----------



## xrs (Jul 12, 2011)

root feels so close but yet so far. need to get my ps3 remote working for shadowgun


----------



## djmwj (Oct 21, 2011)

hi sorry i have not had a chance to get back to you. Thanks for your help, i can load img files through NVFLASH. So to get root i mrerely edited the boot.img that i have and flashed it back. The NVflash was leaked, along with the keys and bootloader that was needed. However, I cannot install any updated software without recovery.


----------



## djmwj (Oct 21, 2011)

The files for the ideapad were leaked and posted here: http://forum.xda-developers.com/showthread.php?t=1180266&page=2


----------



## djmwj (Oct 21, 2011)

I can use this to systemdump everything off of it. i can put any image back on it as well, however it does not get me very far because i cannot get a recovery to work. I have tried compiling my own and failed, if you could or you know someone else who knows how to correctly build recovery we would be on out way.


----------



## djmwj (Oct 21, 2011)

Right now i have root through adb on an earlier software build (in chinese) but if i can make a recovery than i can load an updated os that is in english (the chinese image files were leaked ) i am haveing trouble converting the update.zip to the form needed to flash them directly they need the form of recover.img, boot.img, and system.img. I am having trouble with system.img and recovery.img.


----------



## djmwj (Oct 21, 2011)

If someone else can build a recovery, that would be cool (although i really would like to learn how myself at some point) i should be able to provide ANY info needed. I have access to all parts of the device.


----------



## djmwj (Oct 21, 2011)

i wanted to warn anyone using nflash to backup your partition first before flashing or you will lose all your premium apps.... as i did.... you can back it up partition by partition. to do so you need to sync it using a different bootloader than the leaked one. (the Asus transformer bootloader USE ONLY TO SYNC never to CREATE). THIS IS FOR IDEAPAD K1 although the process should be the same for the thinkpad with different keys and possibly different cfg and bct

TO BACKUP:
to sync: ./nvflash --bct flash.bct --setbct --odmdata 0x300c0011 --sbk 0xXXXXXXXX 0xXXXXXXXX 0xXXXXXXXX 0xXXXXXXX --configfile flash.cfg --bl bootloader.bin --sync
the bootloader.bin must be the transformer one or you will get an error. for sbk XXXXXXX use the sbk for your system. (leaked from above. also posted here: http://androidroot.m...-current-state/ in the comments. note aslo that the flash.bct and flash.cfg are system specific and were leaked through a site in the post above.
--odmdata 0x300c0011 is some type of hardware profile it may vary slightly per model THis is the ideapad K1 stock odm.

then run: ./nvflash -r --getpartitiontable parts.cfg

This will backup the partition table and show you were all the partitions are

Then to backup all the partitions

./nvflash -r --read 2 enc_bct.bin

Change the filename and the number to correspond to each partition as found in the partition table.

Then you will be backed up, and are nearly guaranteed to always be able to return to that state.


----------



## xrs (Jul 12, 2011)

djmwj id lke to commend you on your awesome work and amzing breakthroughs with our tablets. i dont know how i could help you but if i can contribute inn anyway let me know.


----------



## jeitzen (Oct 20, 2011)

Gotcha.

Thanks for the update.


----------



## dsw1ft (Oct 19, 2011)

ker2gsr said:


> how did you achieve root ... @yggdrasil says nipqer has a recovery ready to go
> 
> Sent from my DROIDX using Tapatalk


Can you connect djmwj with the recovery so we can try it out?


----------



## djmwj (Oct 21, 2011)

Yes if you have one, i would love to try it. all the ones i have compiled do not work.....


----------



## ker2gsr (Jul 26, 2011)

djmwj said:


> Yes if you have one, i would love to try it. all the ones i have compiled do not work.....


as soon as I get it from Yggdrasil or nipqer ill send it to u

Sent from my DROIDX using Tapatalk


----------



## ker2gsr (Jul 26, 2011)

djmwj said:


> Yes if you have one, i would love to try it. all the ones i have compiled do not work.....


you need to get on irc.freenode.net # thinkpad-android

Sent from my DROIDX using Tapatalk


----------



## djmwj (Oct 21, 2011)

i got clockworkmod on the ideapad !!! but...... i cannot select anything on the menu..... when i compile with the no select button feature however i cannot access the menu... a catch 22... any ideas? anyone know of touch supported clockwork recovery? or another method to select?


----------



## ker2gsr (Jul 26, 2011)

> i got clockworkmod on the ideapad !!! but...... i cannot select anything on the menu..... when i compile with the no select button feature however i cannot access the menu... a catch 22... any ideas? anyone know of touch supported clockwork recovery? or another method to select?


let us get what you got so we can try it on The thinkpad

Sent from my DROIDX using Tapatalk


----------



## xrs (Jul 12, 2011)

typically it uses volume buttons to navigate menus and power/sleep button to select, ive never seen a touch supported CWM recovery


----------



## ker2gsr (Jul 26, 2011)

There's a thread on porting cwr onto a device here in rootzwiki see if that helps

Sent from my DROIDX using Tapatalk


----------



## jeitzen (Oct 20, 2011)

Did you try all the Hard buttons too?


----------



## dsw1ft (Oct 19, 2011)

djmwj said:


> i got clockworkmod on the ideapad !!! but...... i cannot select anything on the menu..... when i compile with the no select button feature however i cannot access the menu... a catch 22... any ideas? anyone know of touch supported clockwork recovery? or another method to select?


Great job. Thanks for all your hard work!

Usually they use the volume buttons as up and down and the powerbutton for selection. Can you configure it in that way?

Can you also start a new thread and provide us with steps on how to get this done?


----------



## ker2gsr (Jul 26, 2011)

I'm not sure djmwj there is a bounty for confirmed root it up to $105 so far http://ThinkPadTabletForums.com/index.php?topic=343.0

Sent from my DROIDX using Tapatalk


----------



## djmwj (Oct 21, 2011)

Thanks for the inputs. I will be putting together a complete how to once i get the recovery thing figured out.... its no good to have a recovery you can't actually use.... This is for the ideapad, which is different from the thinkpad. Although i imagine the steps are very similar, i do not have a thinkpad to work on. my understanding is the sbk will not work with the thinkpad however. If anyone can point me to changing the button mapping in cwm it would be very much appreciated.


----------



## djmwj (Oct 21, 2011)

So i was finally able to get root on the latest software  The procedure is a little messy, i look forward to sharing with you as soon as i get off work tomorrow. It is not clean and streamlined yet.... i still do not have recovery working so that still needs to be fixed but progress is being made.


----------



## userno69 (Aug 1, 2011)

djmwj said:


> So i was finally able to get root on the latest software  The procedure is a little messy, i look forward to sharing with you as soon as i get off work tomorrow. It is not clean and streamlined yet.... i still do not have recovery working so that still needs to be fixed but progress is being made.


 That is fantastic! But did you do that on the IdeaPad K1? Doesn't the Thinkpad Tablet require a different hash key or something that we will surely never get a hold of? Still great for IdeaPad owners none the less!


----------



## obscure.detour (Nov 2, 2011)

djmwj said:


> So i was finally able to get root on the latest software  The procedure is a little messy, i look forward to sharing with you as soon as i get off work tomorrow. It is not clean and streamlined yet.... i still do not have recovery working so that still needs to be fixed but progress is being made.


Have you been able to dump the recovery image from your ideapad? I'm going to attempt to dump it and extract it from my TPT tonight. I've got a linux box running and am trying to put something together following these tutorials.

http://android-dls.com/wiki/index.php?title=Build_a_custom_recovery_image
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images


----------



## djmwj (Oct 21, 2011)

Yes i can dump everything off the unit... I would be interested to know how you dump from the TPT as it uses a different sbk. or do you have another method.


----------



## djmwj (Oct 21, 2011)

see my post above for more detail on how to back up the Ideapad... again i don't think the sbk has been leaked for TPT.... if so let me know i can help


----------



## xelacac (Nov 2, 2011)

Hey djmwj,
Thanks for your work so far...
All I've been able to do was put the device in fastboot, but then it complained about the SHA sign of the .img...

Any hints you can give us (even messy) ?
Thx


----------



## explit (May 20, 2014)

Any news on the tpt bootloader unlock?


----------

