# Lenovo Ideapad K1 Rooting Guide (Messy)



## djmwj (Oct 21, 2011)

Rooting The Lenovo Ideapad K1 (MESSY)

This method is a messy method, it should work but IT WILL ERASE EVERYTHING OFF YOUR SYSTEM!! Please backup everything as I outline in the instructions. I AM NOT RESPONSIBLE FOR ANY DAMAGE TO YOUR HARDWARE OR SOFTWARE.

RECCOMMENDED ONLY FOR ADVANCED USERS..... do not do this if you don't understand whats going on. I am working on a recovery that should make this easier (just trying to work out some kinks) the images i included include my current recovery attempts (not working)... if you want the stock recovery thats fine when it gets to that step see the comments.

Read through this whole thing first so you know what your getting into.

These instuctions assume you are using linux, although the methods should be similar for windows. (you will need to modify drivers to work with windows if you go that route)

Files you will need:
NVFLASH (with ideapad bootloader.bin, flash.bct) - This was leaked, it can be found here see post #18: http://forum.xda-dev...=1180266&page=2

Transformer bootloader.bin - see download link below

ADB - you must have adb on your computer.

**make_ext4fs - must be compiled for your system, if you need to compile it you need to essentially build android from source which will compile the tools as part of the process - see downloads below for a precompiled linux file

**latest lenovo ota - (this method tested with US builds 111017 and 110829 although it should work with any (as long as it has a complete system file) download from http://download.leno.../slates/k1/OTA/

** Only needed if you want to make your own /system from the OTA, i have included prebuilt ones already (for ota111017).

Link to these files: http://www.megaupload.com/?d=NQLCZDUZ

sha1sum for the tools:
45f50a332c9de03c2b140fb865fcfc67ab5abd7d ideapad_root_tools.zip

##################STEP 1###############
Setting up the environment.

The NVFlash that was leaked is the key to this whole thing. In the leaked files there is a .bat with the needed sbk key: 0x0d0a6f49 0x6c577634 0x4d634e55 0x47336d55. This key is essential to the method, without it we could not use this method.

NOTE: may have to run commands as root if you have not setup udev for your user -> this is because you will not have permissions to the USB devices if not. if you don't know what this means just run the commands with as root (sudo).

1. unzip the NVFLASH zip to whatever directory you choose. If you get this file from the source listed above it will include a couple of different folders, you need to go to Lenovo_windows>Burn_image . This is the directory where the magic will happen. From now on will refer to this directory as NVFLASH_HOME.

2. put the transformer bootloader into NVFLASH_HOME. Name it transformer_bootloader.bin (if not already named as such DO NOT REPLACE ideapad's bootloader)

3. Remove boot.img, (recovery.img if you want to see/use my cwm progress not working though only for advanced Devs) and system.img from NVFLASH_HOME. you can put them in another directory inside NVFLASH_HOME called ORIG_IMG

4. Whenever using NVFLASH, you must put the tablet in APX mode by holding vol up vol down and powering on the unit. It will turn on to a blank black screen.

##################STEP 2###############
BACKUP your system ... this may take a little while but its worth it. This should just about garuntee that you can get back to your original system should something not go right.

1. create BACKUP_ORIG directory in NVFLASH_HOME.
2. navigate to NVFLASH_HOME in terminal
3. type in terminal "./nvflash --sbk 0x0d0a6f49 0x6c577634 0x4d634e55 0x47336d55 --bct flash.bct --setbct --odmdata 0x300c0011 --configfile flash.cfg --bl transformer_bootloader.bin --sync" (this assumes you got nvflash and accompanied files via above dload, if not your filenames could be different NOTICE: we use transformer_bootloader.bin instead of ideapad's bootloader!)
4. type in terminal "./nvflash -r --getpartitiontable ./BACKUP_ORIG/partitions.cfg" - this pulls your patition table to your backup folder
5. open the partitions.cfg (its a text file) in it will list the paritions and there partition ID numbers for example:

=============SAMPLE partitions.cfg================================
PartitionId=2
Name=BCT
DeviceId=18
StartSector=0
NumSectors=1536
BytesPerSector=2048

PartitionId=3
Name=PT
DeviceId=18
StartSector=1536
NumSectors=256
BytesPerSector=2048

PartitionId=4
Name=EBT
DeviceId=18
StartSector=1792
NumSectors=1536
BytesPerSector=2048
==================================================================

These PartitionId numbers will be used to backup the complete system.

6. Backup each partition using the following commands (in the same terminal we have not exited)
"./nvflash -r --read BOOTPARTID PART_NAME.img" Replace BOOTPARTID with a Partition ID from partition.cfg and replace PART_NAME.img with the name of the parition that corresponds to the parition id. for example

=============SAMPLE partitions.cfg================================
"./nvflash -r --read 4 BACKUP_ORIG/EBT.img" (this command would copy the EBT partition to the file EBT.img in the BACKUP_ORIG directory that you made)
"./nvflash -r --read 2 BACKUP_ORIG/BCT.img" (does the same thing just for a different parition (BCT partition))
==================================================================

Do this for every parition.

Especially these:
BCT - boot config table
PT - partition Table
EBT - bootloader
SOS - recovery partion
LNX - boot.img / boot partition
APP - /system
UDA - User data - i think this is user data where all the premium apps are stored that came with it. Back this up if you want them back

There are other partitions as well... and i am not sure of all of them.... use due diligence and back them all up its worth your patience.

THIS STEP WILL TAKE TIME AND REQUIRE A GOOD AMOUNT OF HARD DRIVE SPACE Approx 30GB to get it all!
if thats a problem and there is no way at lease back up userdata and bootloader and parition table! (userdata will take up approx 3.3 GB alone)
You can calulate the space per partition yourself just multiply bytes per sector by NumSectors, and that gives you how many bytes. Divide that number by 1073741824 to put convert to Gigabytes)

##################STEP 3###############
MAKE SURE YOU HAVE BACKED UP BEFORE THIS

Now we will format the tablet and load up the rooted img files.

1. Unpack the system.img, (recovery.img from dload and name it as such if you want the cwm i am working on it does not work right though... advanced users only), and boot.img to NVFLASH_HOME from the download listed above.
2. Run this command in terminal: "./nvflash --bct flash.bct --setbct --odmdata 0x300c0011 --sbk 0x0d0a6f49 0x6c577634 0x4d634e55 0x47336d55 --configfile flash.cfg --create --bl bootloader.bin --go" (note this time we use the ideapad booloader!!!! NOT transformer bootloader)
4. This will take a little while to complete. When done it should reboot into your new rooted OS!!!! (although right now you can only get root through ADB)

################STEP 4###############3
This will allow you to access root from inside android, and allow other apps to use root when needed. (note that the image already included the superuser.apk

1. in terminal use adb to push the modified su to /system/xbin/ do this first remount the filesystem as read/write (rw) "./adb remount" (should show remount successful) 
2. in terminal "./adb push <location of su on computer. /system/xbin/su"
3. adb shell into the tablet to change permissions of su "./adb shell"
4. in the adb shell: "cd /system/xbin"
5. still in adb shell: "chmod 4755 su" (this changes permission so that any user can access it and assume root through it)
6. in adb shell: "exit"

THATS IT!! you should now have root... download a terminal emulator from marketplace and see if you can su! (superuser should ask you to whitelist the app) and thats it

I will need to update this guide to show people how to build the image themselves this is for those who are feeling antsy.

###############Making your own system.img files####################
Currently and the main problem with this method, is that you must wipe your entire system to use the new image. This is why a working recovery would be so nice. This is a quick writeup of how to. Note that you actually get root access from the boot.img file. This file is not particularly unique as compared to other androids systems. however if you want guidance on how to edit boot.img i will include this upon request. (The tools to do so i have already posted)

Use the system folder from an OTA update, you can modify it as you deem. You must add the symlinks back to the system folder. They should be added to "/system/bin/" These can be found in the img that i have already included. They are:
cat
chmod
chown
cmp
date
dd
df
dmesg
getevent
getprop
hd
id
ifconfig
iftop
insmod
ioctl
ionice
kill
ln
log
ls
lsmod
lsof
mkdir
mount
mv
nandread
netstat
newfs_msdos
notify
printenv
ps
reboot
renice
rm
rmdir
rmmod
route
schedtop
sendevent
setprop
sh
sleep
smd
start
stop
sync
top
umount
uptime
vmstat
watchprops
wipe

Next you must set the permissions for system so they are appropriate for android. to do this in terminal assuming your in the system directory type: "sudo chown 0:0 -R ."
This sets the owner to root
then type "sudo chmod 777 -R ."
This sets the access permissions for all (they will be overwritten when loaded by the phone however)
next you must run the included make_ext4fs with the following command:

"sudo ./make_ext4fs -l 400M -a system system.img.new dir_of_system_folder"

This command will convert the system folder found at dir_of_system_folder and create a system.img.new file for it.

You must rename this file to system.img and put it in the directory of nvflash in place of the system.img file there. Then just reflash the system as described above.

NOTE: if you are looking to just modify some files in the exising system folder you could probably do so by just using the adb push command. This would allow you to potentially moify the system files without reflashing again.


----------



## djmwj (Oct 21, 2011)

ok i need to upload alot more than 300K.... any suggestions (looking at approx 500 MB)
You might need to standby for the some of the files i am talking about till i find a place to put them.


----------



## ro6666lt (Sep 2, 2011)

dropbox?


----------



## xrs (Jul 12, 2011)

dropbox would work, megaupload or something similar


----------



## xelacac (Nov 2, 2011)

Wow.
Thanks !
Just a quick question;
Do I need to be booted in recovery mode to use nvflash ?
For me, it fails with "USB device not found"
Using strace, I can see that it is not accessing it...
I thought I would ask before trying the recovery mode, because last time I got stuck in a loop...
(ADB see my device, I can open a shell, but nvflash fails...)


----------



## djmwj (Oct 21, 2011)

Yes sorry..,.. i should put that up top you need to be in flash mode. get there by holding vol up and down while powering on. The system will turn the backlight on but show nothing on the screen. you should see it if you run lsusb
-The files are being uploaded now too


----------



## djmwj (Oct 21, 2011)

Updated guide to include files.


----------



## Shaztech (Nov 4, 2011)

The last step (4) wasn't working for me so here's what i've done:

1- Download this file: http://downloads.and...efgh-signed.zip
2- Extract the su file to C:\ (in windows)
3- adb remount
4- adb push c:/su /system/bin/su
5- adb shell
6- cd /system/bin
7- chmod 4755 su
8- exit (shell)
9- adb reboot
10- Installed this app https://market.andro...ufou.android.su
11- Optional: Remove the file "SuperUser.apk" in /system/app with the Explorer (Root) of your choice
to remove the old SuperUser Application.


----------



## Shaztech (Nov 4, 2011)

You can download the drivers for windows 32 and 64 bits compatible with adb here:

http://www.megaupload.com/?d=O0DJL0Q5

I've modified the official Lenovo drivers and i've used them on both OS.


----------



## xelacac (Nov 2, 2011)

Done and done.

Worked.

A huge thanks djmwj !


----------



## andytiedye (Nov 2, 2011)

an interesting thing about this SBK is that it is all ASCII characters: a carriage return, a linefeed, and a bunch of alphanumeric ASCII:

oIWv4McNUG3mU

This considerably reduces the search space if one is going to try to brute-force the key for the other model.


----------



## Shaztech (Nov 4, 2011)

I have a small problem with this Rom, once in a while the screen turn black (I still can see the backlight) the power button doesn't work (I can shut it off by holding it for 10 sec) all the others buttons work but cannot regain the screen... I'm I the only one ?

Thanks


----------



## djmwj (Oct 21, 2011)

thatsodd i have not seen that ... its pretty much a stock rom just rooted...


----------



## Shaztech (Nov 4, 2011)

Can I use another system.img ? or install another ota on top of it ?


----------



## djmwj (Oct 21, 2011)

yes you can use your own system.img you can make one using the make_ext4fs program thats included, you must format to 400MB when using that. I will make a post explaining this at some point.... No you cannot flash another OTA without losing root.


----------



## Shaztech (Nov 4, 2011)

do you know when you will make your post about making your own system.img ?


----------



## djmwj (Oct 21, 2011)

right now  Also i put it above, its a rough outline, if you have questions let me know. Still no luck on the recovery, i have not had alot of time recently to work at it :

###############Making your own system.img files####################
Currently and the main problem with this method, is that you must wipe your entire system to use the new image. This is why a working recovery would be so nice. This is a quick writeup of how to. Note that you actually get root access from the boot.img file. This file is not particularly unique as compared to other androids systems. however if you want guidance on how to edit boot.img i will include this upon request. (The tools to do so i have already posted)

Use the system folder from an OTA update, you can modify it as you deem. You must add the symlinks back to the system folder. They should be added to "/system/bin/" These can be found in the img that i have already included. They are:
cat
chmod
chown
cmp
date
dd
df
dmesg
getevent
getprop
hd
id
ifconfig
iftop
insmod
ioctl
ionice
kill
ln
log
ls
lsmod
lsof
mkdir
mount
mv
nandread
netstat
newfs_msdos
notify
printenv
ps
reboot
renice
rm
rmdir
rmmod
route
schedtop
sendevent
setprop
sh
sleep
smd
start
stop
sync
top
umount
uptime
vmstat
watchprops
wipe

Next you must set the permissions for system so they are appropriate for android. to do this in terminal assuming your in the system directory type: "sudo chown 0:0 -R ."
This sets the owner to root
then type "sudo chmod 777 -R ."
This sets the access permissions for all (they will be overwritten when loaded by the phone however)
next you must run the included make_ext4fs with the following command:

"sudo ./make_ext4fs -l 400M -a system system.img.new dir_of_system_folder"

This command will convert the system folder found at dir_of_system_folder and create a system.img.new file for it.

You must rename this file to system.img and put it in the directory of nvflash in place of the system.img file there. Then just reflash the system as described above.

NOTE: if you are looking to just modify some files in the exising system folder you could probably do so by just using the adb push command. This would allow you to potentially moify the system files without reflashing again.


----------



## Shaztech (Nov 4, 2011)

Do I need to use another boot.img if I change the system.img (ex for: K1_A301_02_02_110930_CA)
If I need to then I will apreciate your guide to create a boot.img

EDIT: Nevermind it's working


----------



## Shaztech (Nov 4, 2011)

On which linux I can use make_ext4fs ? I've tried with ubuntu but I got a error (Command not found)
Or a windows alternative ?

EDIT: chmod u+x make_ext4fs
Change permission to execute it.
(Not a linux expert ... LOL)


----------



## Shaztech (Nov 4, 2011)

I have the following problems and I want to know which file (.img) that come from and I want to add
that I have 2 K1 tablets at home and both have the same problem, I've tried with your system.img and the one
I have created from ota K1_A301_02_02_110930_CA.

1-Some times the battery icon have a question mark with the indication to
plug the adapter (5 min earlier my battery was at +/-75%)
--- Once per day

2-Some times, when I turn on the device (from standby) the touchscreen doesn't work
(if I hold the power btn the question to power off appear but I can't choose)
--- 3-4 Times per day

3-Some times, the device restart by itself, was on the table in standby mode.
--- 2 times per day

4-Some times the power btn is unresponsible, but if I "double click" on it that's working...

5-Netflix was working before, now I got the error 12001

Both K1 models is: 130425U
And can you give me the command to restore the backup I've made (step 1 and 2)

Thanks


----------



## djmwj (Oct 21, 2011)

Sorry to hear you are having those problems. (upon inspection i too have the 12001 error on netflix however.... will need to look into that). One possibility is that the OTA that you are making your image from is not a complete system image. The OTA may only contain certain updated files. You would need to go and add the missing files back to the image before flashing. This is a possibility as to why your problem is occurring. It may just be missing some necessary files for proper operation. You may be able to scavenge those from other OTA updates. Also you are using a Canadian version of the K1 this was done using a US image. IF you have a complete canadian OTA or can create one this method should work.

To restore, you need to download the backup partitions back to the device. You may do this by running

./nvflash --sbk 0x0d0a6f49 0x6c577634 0x4d634e55 0x47336d55 --bct flash.bct --setbct --odmdata 0x300c0011 --configfile flash.cfg --bl transformer_bootloader.bin --sync (NOTE: this is the Transformer bootloader here.)

then

sudo ./nvflash -r --download X newboot.img

X is the partition you are restoring and newboot.img is the image file that you backed up for the given partition number, you will need to do this for all partitions you wish to restore. That should put you back to were you were before. Let us know how it goes. I do find it very odd that both exhibit the same behavior.... maybe a bad download?

I should have included this before but here is the sha1sum for the tools:
45f50a332c9de03c2b140fb865fcfc67ab5abd7d ideapad_root_tools.zip


----------



## Shaztech (Nov 4, 2011)

I've tried the command to restore flash but I got an error (yes i've used the transformer bootloader)

Nvflash started
[resume mode]
failed executing command 14 NvError 0x120000
command failure: partition download failed

I've redownloaded all files because the sha1 was not the same.
So i'm trying, and tell you later.

EDIT: I was using my system.img (Canada) because of the bugs and netflix,
so i've returned with yours img because mine had the same problems. LOL

I think I know the source of the error 12001 from netflix, let me explain.
When I go into the market and search for an app, sometime the title of the app is in Chinese
(when available in chinese) (example ES File Explorer) But if I click on it, I have the page in english.
The same thing append on the web browser...
I have checked the "Locale" and it set to EN / US
But my theory is that the flash is based on Chinese so something is
still in this region (I know the boot.img and the system.img are US)
Maybe in the userdata.img ???

EDIT2: I'm still having those problems...
But I've observed that the problems 1 and 4 are there
after the self reboot (problem 3) if I reboot it manually those problem are gone.
and the self reboot happen only 15 sec after I put the tablet into sleep via the power btn. (Not always)


----------



## xelacac (Nov 2, 2011)

shaztech, 
if you have an issue rooting your device, it is ok to post it in this thread.

if you have issues with your device, please open another thread.

this thread is getting more and more attention.


----------



## Shaztech (Nov 4, 2011)

I have issues with the device caused by the rooting, it's not an hardware related matter. So i'm in the right thread. LOL


----------



## djmwj (Oct 21, 2011)

Hmmm, thats really interesting to hear that the market is displaying things in chinese.... The boot.img is actually based off the included chinese boot.img. I did not see any reason to change, i believe the kernel to be the same. Pehaps i am wrong. Do you know how to make your own boot.img? you could make your own based on the OTA and flash with it. Maybe for some reason something in there is causing it to do this. As for the download not working that is a bit more surprising... Have you tried with the normal bootloader?


----------



## Shaztech (Nov 4, 2011)

No I don't know how to make my own boot.img, can you explain.
and i've not tried with the normal bootloader, I will try later.


----------



## djmwj (Oct 21, 2011)

ok let me see if i can make a new one.... it looks like they came out with 3.2 so the kernel may have been updated as well....


----------



## Shaztech (Nov 4, 2011)

When did they came out with 3.2 ?


----------



## djmwj (Oct 21, 2011)

just thought about something if you use your own image make sure to rename the recovery-from-boot.p to something else so it does not reboot into recovery


----------



## Shaztech (Nov 4, 2011)

where is that file ? "recovery-from-boot.p"
Is it in the boot.img ?
I don't know yet how to extract files from an img file. LOL


----------



## djmwj (Oct 21, 2011)

well, i put that out there quick, it only applies if your working on trying to put a different recovery on the system..... They came out with 3.2 yesterday, via OTA. The files are up on lenovo's site. extracting files from an img file depends on the img. for boot.img the tools split_boot.img will extract the img. and mkbootimg will repack it.


----------



## Shaztech (Nov 4, 2011)

Ok, i'm downloading the new ota and waiting for your guide


----------



## djmwj (Oct 21, 2011)

If you know anyone that makes recoveries, i would really like to talk to them about a recovery for this.Let me know if you or someone you know would be willing to talk.


----------



## Shaztech (Nov 4, 2011)

Sorry I don't know anyone that makes recoveries ; ;
I've extracted the boot.img, I got 2 files, the kernel and the ramdisk
I've extracted the ramdisk, I suppose I need to edit the init.rc file...

What do I add ??? lol and what's the command to but it back together (mkbootimg...)


----------



## roustabout (Nov 13, 2011)

First off, THANK YOU! This is a great walkthrough.

I've got an nvflash and a recovery USB driver that can see the little guy, but the Chinese files (which seem to contain things the command set needs, such as flash.bct , are not available, as far as I can see.

Does anyone know of a mirror of that set of files on a working URL?

Also, last night I discovered a couple of things: if you have one of the early ROMs (sorry I can't say which for sure) you can get privilege elevation in ADB. Shell in and su once you're on - I set the user/pass for LeTools to root and root, could have helped <grin>

Also, for me, HC 3.2 is actually pretty irritating. I would prefer to roll back to a release that doesn't feature the bright white have buttons and the highly irritating favorite app bubble on the bottom of the screen.

I hope that the rollback will work, I'll advise on that once I know.

Is anyone else seeing LCD flicker with these, or is it my unit? If so, I can return it to the vendor and replace it, perhaps the simplest way of not getting the update and sticking with the much prettier earlier software.


----------



## djmwj (Oct 21, 2011)

I see screen flicker occasionally as well... annoying at times but i have a feeling its just a bad design

it should be mkbootimg --kernel kernel_from_boot.img --ramdisk your_reziped_ramdisk_filename -o output_file_name

to rezip your ramdisk cd into the directory and issue the command
"find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz "
that will repackage it for you to use in mkbootimg.

I will be interested to see your results.... i have tried using the OTA boot.img and i cannot get it to boot... which is a bit confusing to me... i am trying to figure out why. 

Let me know how it goes..... would be much easier if i could just get recovery working.....

@roustabout Also did you check where i linked to in the guide? that use to be active....


----------



## Shaztech (Nov 4, 2011)

Do I need to change something in the ramdisk to enable the root ???


----------



## djmwj (Oct 21, 2011)

yes in default.prop change the line ro.secure=1 to ro.secure=0. and thats it. you will now have root.


----------



## Shaztech (Nov 4, 2011)

I've tried and same result as yours, cannot boot...


----------



## roustabout (Nov 13, 2011)

OK, finally used MSIE and Google Translate to plink away at enough buttons to get the file to d/l from the Chinese site. Its there, it's just hard to see how to get it, if you can't read the characters









So, got it, tried the nvflash in that dir and used the APX mode drivers from one of the Asus Transformer root guides - just the driver for APX mode, not the rest of the files.)

I'm backing up all the partitions now and I have the feeling that where we are now is that the pre-build image is rooted but just before the 3.2 release. Is that true or am I wrong?

When I tried downflashing by dropping a pair of update files (the zip and the xml) into the Download folder, and renaming them update.zip and update.xml, I had no luck at all.

At this point I'm weighing my options:
try rooting,
return this to the shop for old stock which grants su over ADB without additional headstanding,
wait for something like a ZergRush to be viable on Honeycomb, or
move up to the Acer Iconia, which appears far, far more rootable and has some nice additional features like the full USB ports.

I basically like this tablet, but can't see gynormous advantages to it beyond the 16G of storage it boasts over the Iconia and Transformer. Lenovo support is terrible, and their plan for fixing these in case of trouble appears weak as well. (The Nook Color has a complete system image built in and you can actually reflash it back to its shipped state with a keypress sequence if you like. I get the feeling from talking to Lenovo that they have nothing like that built into this device. I am giving them a window for their enterprise folks to call me tomorrow)

But since - as I learned after buying this - Honeycomb makes the onboard storage damned close to worthless to me by forcing me to access it through the old, slow serial MTP protocol I'm not as interested in how much storage an Android device has as I was with Gingerbread and before.

Actually, what I'd really like is to see Gingerbread running on one of these.

OK, so an OTA test that I tried sideloading blew out my stored data. Annoying but liveable, but that point, totally worth taking a serious run at rooting.

I tried building my own system.img from the most recent OTA without success. The device booted but the display was badly corrupted.

I accidentally used the system.img and userdata.img from the Chinese files and successfully flashed (a version of the OS that I actually prefer, it uses the blue rather than the white indicator for back, forward, open apps) and booted. It is possible to change that display language to English, however. But using the 'userdata.img' file supplied with the leaked firmware, one gets the Chinese app pack. Whoops.

I took a look at my backup images and their sizes. I am 99.9% sure that the TMP.img file you create when backing up is really where your non-Lenovo branded google apps live.

I took a read through flash.cfg and it says this:

[partition]
name=TMP
id=13
type=data
allocation_policy=sequential
filesystem_type=ext3
#[Aaron|2011.5.10] Make size of /data/temp bigger to 2.1G
size=1048576000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=userdata.img

Now, one problem is that - despite the comment - tmp was never enlarged, and your .img won't fit.

Whoopsie!

Completely fixable, though. I changed that stanza to:

[partition]
name=TMP
id=13
type=data
allocation_policy=sequential
filesystem_type=ext3
#[Aaron|2011.5.10] Make size of /data/temp bigger to 2.1G
size=2148576000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=userdata.img

and copied over my backup TMP.img, and renamed it userdata.img.

I'm currently running the system.img provided by djmwj and it looks viable to me.

For restoring the Lenovo apps, this looks like the key stanza:

#[Aaron|2011.5.29] test for temp
[partition]
name=UDA
id=12
type=data
allocation_policy=sequential
filesystem_type=ext3
#[Aaron|2011.5.10] Make size of /data bigger from 2.1G to 3.1G for /data/temp
size=3147483648
file_system_attribute=0
partition_attribute=0
allocation_attribute=0x808
percent_reserved=0

Note that there's no img file queued for restore there, though, and it's far too small for the UDA.img to fit.

Since the image made of uda is way too big, I think the thing to do is going be to mount uda.img up in a linux system and pull the APKs out.

Very cool.

Also, while I was working with the blown out system, I found that it was much, much faster. I think that's because
Lenovo's doing a ton of annoying auth requests in the background all the time.

I am now officially having fun with this thing!


----------



## djmwj (Oct 21, 2011)

Awesome to see you going through it. I unfortunately did not get to make a backup of my system before i flashed everything so i do not have a backup image to work with. Keep up the good work. Also sorry i have not been around as of late, life has been kinda busy, hopefully i will get to look at some things here in the next week.


----------



## roustabout (Nov 13, 2011)

As of now, I wouldn't worry about losing root from this method, because it looks like it blocks the OTA updates. Not sure if that's a good thing or a bad thing.

I'm currently trying to rebuild boot.img to set the flage ro.secure=1 -- this may (no guarantee) enable Netflix, which this method does disable.

I am reading that NF is very aggressively locking app for HD display. I suspect (but am not sure) that the ro.secure=0 setting is making trouble for us.

I have a Samsung media player, rooted, with that flag=1, and the root works fine. Over ADB you just su yourself and you're good.

It may be that if I can't (and right now I can't) rewrite that file and generate a viable boot.img a start script that remounts / as rw, changes that value to 1, and remounts / correctly would be helpful to getting Netflix going.

Also, all of my backups except the UDA one were fine. That's basically the lenovo paid content, as far as I can see. The problem seems to be that we don't have a way to extract the original bootloader, and thus no way to reflash the original bootloader. The bootloaders we have work, but are different from being correct for the device, or so it seems.

I'm unable to use them to restore to stock, when I try doing so I get errors at boot time. (option 1 invoked and not legal, basically.)

So, I'm starting to think there needs to be a disclaimer on this method that it means your device cannot be restored to stock.

OK, so the error 12001 is persisting. I'm pretty sure this one's a dealbreaker for me. There's stuff I want from being rooted, but I did want netflix to work. I'm starting to think Iconia is looking better. Same hardware (aside from the 16 gig of flash, which is not worth as much as I'd hoped in Honeycomb, with the MTP control over files), much better rooting options, and fullsize USB. I am trying a download of my "recovery" partition to see if I can reset to stock that way. It may work, but I'm not too optimistic.

Here's some logcat around this:

I/ActivityManager( 122): Force stopping package com.netflix.mediaclient uid=10054

I/ActivityManager( 122): Force finishing activity ActivityRecord{40e2e868 com.netflix.mediaclient/.UIWebViewTabletActivity}

I/WindowManager( 122): WIN DEATH: Window{406ad408 com.netflix.mediaclient/com.netflix.mediaclient.UIWebViewTabletActivity paused=true}

I/PackageManager( 122): Package com.netflix.mediaclient codePath changed from /data/app/com.netflix.mediaclient-1.apk to /data/app/com.netflix.mediaclient-2.apk; Retaining data and using new

I/PackageManager( 122): Unpacking native libraries for /data/app/com.netflix.mediaclient-2.apk

I/ActivityManager( 122): Force stopping package com.netflix.mediaclient uid=10054

W/PackageManager( 122): Code path for pkg : com.netflix.mediaclient changing from /data/app/com.netflix.mediaclient-1.apk to /data/app/com.netflix.mediaclient-2.apk

W/PackageManager( 122): Resource path for pkg : com.netflix.mediaclient changing from /data/app/com.netflix.mediaclient-1.apk to /data/app/com.netflix.mediaclient-2.apk

I/ActivityManager( 122): Force stopping package com.netflix.mediaclient uid=10054

idiotic double post deleted, sorry.

I may still defect (I have a week to ponder), but there's stuff I like about this guy better than I like the Iconia. I also need to look at the screen on the Transformer, Ideapad and Iconia side by side.

Thinking about it, I realize that a lot of the media I want access to is actually on the filer at the house, and for that MX player + the dlna clients work fine. But I think I'd get more out of my netflix sub if I had it (as the stuff on the filer isn't portable - I prefer not to offer any services from a residential connection).

I did realize that the install we have doesn't include the DRM reader Lenovo distributes, so I added it back in, but it didn't resolve the issue. There was also something silly happening with the Exchange client, and I don't need it, so I uninstalled it.

Restoreable to stock or not, it's very nice to be able to remove the stuff I don't want, for which I absolutely need root, since so much is buried in /system.


----------



## Shaztech (Nov 4, 2011)

roustabout said:


> As of now, I wouldn't worry about losing root from this method, because it looks like it blocks the OTA updates. Not sure if that's a good thing or a bad thing.
> 
> I'm currently trying to rebuild boot.img to set the flage ro.secure=1 -- this may (no guarantee) enable Netflix, which this method does disable.
> 
> ...


I've tried to reflash with the original (PQXU200.2H.0013.W.CN.0729.zip) and the ro.secure is set a 0 in this version.
Put it in english and install netflix and still the same error, so I don't think that's the cause for this error...


----------



## ferrels (Nov 28, 2011)

@djmwj

Any news for us noobz? I just bought a K1 and once it arrives I intend to root it. I'm hoping that by the time it arrives later this week that you'll have the simplified version for rooting that you spoke of in your initial post. My lack of attention to detail and poor typing skills make me hesitant to attempt the existing process! LOL


----------



## stutech (Nov 29, 2011)

ferrels said:


> @djmwj
> 
> Any news for us noobz? I just bought a K1 and once it arrives I intend to root it. I'm hoping that by the time it arrives later this week that you'll have the simplified version for rooting that you spoke of in your initial post. My lack of attention to detail and poor typing skills make me hesitant to attempt the existing process! LOL


The process is actually quite easy I was able to do this in windows by simply entering the commands in to nvflash.exe and following almost everything exactly as it is in Linux. The only thing I had to change was to remove the ./ at the beginning of nvflash for each of the commands. It was really just a copy and paste kind of thing no typing required just make sure you have all the drivers for windows before beginning. The only other issue I had was you sometimes have to try a few times to get the tablet into nvidia apx flashing mode or it will say their is no tablet connected.


----------



## ferrels (Nov 28, 2011)

stutech said:


> The process is actually quite easy I was able to do this in windows by simply entering the commands in to nvflash.exe and following almost everything exactly as it is in Linux. The only thing I had to change was to remove the ./ at the beginning of nvflash for each of the commands. It was really just a copy and paste kind of thing no typing required just make sure you have all the drivers for windows before beginning. The only other issue I had was you sometimes have to try a few times to get the tablet into nvidia apx flashing mode or it will say their is no tablet connected.


Hey, thanks for passing that on. That gives me a bit more courage so I think I'll give it a try when my tablet arrives. I guess the hardest part was figuring out the Chinese web site. Got all the files together now so I'm itching to give it a try.


----------



## stutech (Nov 29, 2011)

ferrels said:


> Hey, thanks for passing that on. That gives me a bit more courage so I think I'll give it a try when my tablet arrives. I guess the hardest part was figuring out the Chinese web site. Got all the files together now so I'm itching to give it a try.


Oh one bit of caution though is to make sure you back up the partition with the preloaded apps if you want them otherwise you will lose stuff like Documents to Go. That is really the only thing to be hugely concerned with as the tablet can always be recovered in tegra apx mode even if you mess up the partitions flashing. I also had trouble with the Chinese site, but got a Chinese friend to help me translate it.


----------



## escouf (Nov 30, 2011)

Any way you guys can make a step by step video of how to properly root this device?


----------



## tomschmidt1969 (Dec 3, 2011)

I tried the following directions

The last step (4) wasn't working for me so here's what i've done:

1- Download this file: http://downloads.and...efgh-signed.zip
2- Extract the su file to C:\ (in windows)
3- adb push c:/su /system/bin/su
4- adb shell
5- cd /system/bin
6- chmod 4755 su
7- exit (shell)
8- adb reboot
9- Installed this app https://market.andro...ufou.android.su
10- Optional: Remove the file "SuperUser.apk" in /system/app with the Explorer (Root) of your choice
to remove the old SuperUser Application.

and as soon as i tried to push the su file it said read only access. i was able to push it to /sdcard but could not do the chmod to su on the /sdcard folder. Said operation not permitted. am i missing something? HELP. Thanks


----------



## Shaztech (Nov 4, 2011)

I forgot step between 2 and 3
adb remount


----------



## tomschmidt1969 (Dec 3, 2011)

I am still doing something wrong... See below please:

C:\temp\Lenovo>adb remount
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
error: device not found
C:\temp\Lenovo>c:
C:\temp\Lenovo>adb remount
remount failed: Operation not permitted
C:\temp\Lenovo>dir
Volume in drive C has no label.
Volume Serial Number is E465-8C20
Directory of C:\temp\Lenovo
12/03/2011 07:15 AM .
12/03/2011 07:15 AM ..
12/02/2011 09:47 PM adb
10/17/2010 11:41 PM 577,335 adb.exe
10/17/2010 11:41 PM 96,256 AdbWinApi.dll
10/17/2010 11:41 PM 60,928 AdbWinUsbApi.dll
10/16/2010 09:29 PM 1,062,992 busybox
10/26/2011 07:11 PM 4,026,368 cwrecovery.img
03/18/2011 09:44 PM 1,048,576 hbooteng.nb0
12/02/2011 10:09 PM 62,462,648 IN12STW145WW5.exe
12/02/2011 09:51 PM K1 Drivers
12/02/2011 09:51 PM 6,498,291 K1 Drivers.zip
12/02/2011 09:46 PM META-INF
03/17/2011 09:14 AM 262,144 misc.img
01/08/2011 05:02 PM 585,731 psneuter
03/19/2011 08:36 AM 365 readme.txt
12/24/2010 11:56 PM 26,264 su
12/02/2011 09:46 PM system
03/19/2011 03:49 AM 679,475 wpthis
13 File(s) 77,387,373 bytes
6 Dir(s) 105,548,750,848 bytes free
C:\temp\Lenovo>adb push su /system/bin/su
failed to copy 'su' to '/system/bin/su': Read-only file system
C:\temp\Lenovo>


----------



## Shaztech (Nov 4, 2011)

when you type adb remount
you're not supposed to have this error...
error: device not found

You have the wrong or no drivers installed or you have not set your tablet in USB Debug mode (Settings - Applications - Development - USB Debugging).
I have provided these drivers on the first page.


----------



## talon248 (Dec 3, 2011)

Has PQXU200.2H.0013.W.CN.0729.zip been posted anywhere else? It has been taken down from u.115.com/file/clsdu7e7#


----------



## LenBert (Dec 1, 2011)

Hi Guys, This has been a fun thread to follow. I think I've learned alot. Thanks.

I can confirm roustabout's statement that early builds had su from adb. I'm on build 620 US and have adb su.

I had the SDK and ADB loaded on my computer from rooting my G2. ADB wouldn't recognize the K1 at first, but seems to find it just fine since I loaded letools. Sometimes it won't find it but will after I actually start the letools program.

Questions:
1. Since I have adb su can I just start from step four? I would think I could just push a superuser apk, chmod and be good to go. Please correct me if I'm wrong. (which I often am!)

2. The site with the nvflash has shut it down. Copyright issues I think. Can I perform the backup steps in the guide with one of the other nvflashes available on the net? Do I have to use the transformer bootloader for that?

3. Is there any other way to back up your partitions w/o nvflash? From adb or Linux?

@roustabout: Did you bail on the K1? If you did what did you get instead? I can still trade mine in at Office Depot, but I can't really justify paying $100 more for the Asus, Acer or Toshiba with less memory. The K1 was $299 at the store ($499 online???). I kind of like the thrive although I'm sure the transformer is better. I checked out all four of them at OD today, I think the screen on the K1 actually looks better than the rest.

@djmwj: Thanks for all the info. Good luck on the recovery.


----------



## tomschmidt1969 (Dec 3, 2011)

The drivers that were installed were from letools. I downloaded the drivers on page 1 and tried to install them and it said the INF file does not support this type of installation (right mouse click and install) I am using WIN 7 32 bit and when I go into dev manager and click update then point it to the K1 Drivers folder it says the driver already installed is more current. I uninstalled the letools drivers and deleted them. when I plugged it back in it installed generic adb drivers and once again said they were more up to date than the K1 drivers I downloaded. I am at a loss... Help please.


----------



## tomschmidt1969 (Dec 3, 2011)

Oh, yes I confirmed I am in USB Debug mode.. This is not my first device to root by far, but I am not familiar with the adb except following directions to enter commands.


----------



## LenBert (Dec 1, 2011)

Tom, The letools drivers worked fine for me. I had mass storage before I installed letools, adb started working after letools. Try starting letools on the computer and your K1 before you use adb. I'm on 64 bit but I doubt that really matters.

If you really want to try different drivers. Go to device manager find the K1 entry and the USB composite device entry. If you have more than one composite device you'll have to figure out which one corresponds to the K1 - check the hardware id's on the properties pages. Right click on each of these entries and choose uninstall. Don't unplug your device. Right click on any device in the list and choose scan for new hardware. A dialog should pop up that will allow you to choose your drivers. Win7 is a little trickier than XP when it comes to driver installation, if it installs drivers w/o giving you a chance to choose there is a setting in windows somewhere with options that affect this behaviour. I don't remember where that setting is however so you'll have to google it.

Good luck


----------



## tomschmidt1969 (Dec 3, 2011)

I think i will install XP tomorrow morning on my tower and see if that makes a difference... I will keep you posted on any progress.. Thanks


----------



## shamirk1 (Dec 4, 2011)

Has anyone can upload PQXU200.2H.0013.W.CN.0729.zip again? The Link u.115.com/file/clsdu7e7 is not available.

I have question about #Making your own system.img files#.

In step4, K1 should be rooted. Should I do #Making your own system.img files# process?


----------



## Shaztech (Nov 4, 2011)

Here's the new link for the PQXU200.2H.0013.W.CN.0729.zip

http://www.megaupload.com/?d=8AJE2YTZ


----------



## steveziggy (Dec 4, 2011)

I have been able to root my K1 everything seams to be working I even have hulu working. titanium backup working. but am on 301_04_04_1107_us now how do i update to K1_A301_12_12_111109_US auto update downloads but not installing? Please help.

found this to get busybox and su working
# mount -o remount,rw -t rfs /dev/block/st19 /system
# exit
adb push busybox /system/bin
adb push su /system/bin
adb install Superuser.apk
adb shell
# chmod 4755 /system/bin/busybox
# chmod 4755 /system/bin/su
# mount -o remount,ro -t rfs /dev/block/st19 /system
# exit
adb reboot
then installed root explorer and made system r/w to insall hulufied flash. installed dolphin hd changed to desktop hulu 100% working.


----------



## talon248 (Dec 3, 2011)

I was able to root successfully, install the hulufied flash, and now have the tablet working exactly as I want. Thank you all so much for your time and effort!

Will this root method survive the OTA to 3.1? Has anyone tried yet? If it won't, is there a recommended method for making sure that OTA's aren't automatically installed (i.e., put the lenovo update url in /etc/hosts or something like that).

Once more, thank you!


----------



## Shaztech (Nov 4, 2011)

With the supplied files you're supposed to be on 3.1.
Build #K1_A301_04_04_111017_US


----------



## talon248 (Dec 3, 2011)

Sorry, I meant 3.2. In any case, my build number matches yours. I actually really like this build, it does everything I want. The newer build seem to be a bit slower, and the GPS worked like crap. Is there any way to prevent the thing from taking an automatic update?


----------



## Shaztech (Nov 4, 2011)

By default you cannot update, manually or automatically, it's blocked.

Did you have any problems, like the tablet reboot itself ?
I've done it on 2 tablet and they have the same problem...


----------



## talon248 (Dec 3, 2011)

Ah, I didn't know that. Thanks for the info.

I've just had it rooted and running for a few hours. So far it has only crashed once, it seems very stable.


----------



## jrq (Dec 7, 2011)

Hey djmwj any progress on the recovery that you are making?


----------



## steveziggy (Dec 4, 2011)

can someone post a new image with the latest ota also one of the best recovey for my phone i have found is here http://forum.xda-developers.com/showthread.php?t=1339654&highlight=recovery maybe they can help with a revovery.


----------



## Shaztech (Nov 4, 2011)

Got Netflix Working !!!!!!!

Download this file:
http://www.megaupload.com/?d=0Y14DWST

adb remount
adb push libnvomx.so /system/lib/
adb reboot

Install netflix from market

Done !!!


----------



## Shaztech (Nov 4, 2011)

For those who have the problem with the touch not responsive on lock screen, just disable the lock screen and if the screen become unresponsive at wake up, wait 10 to 15 sec it will be back.
I've found that some system error related to light sensor keep the touch to activate after wake up, but it take 10 to 15 sec to pass the error, but the lock screen timeout is 6 sec...
If someone can help me to change the lock screen timeout value, or disable the light sensor (not in the settings but uninstall the hardware "drivers"), i'm here


----------



## ferrels (Nov 28, 2011)

Successfully rooted my K1 today. Had a couple problems. When backing up all the partitions, nvflash failed on partition 12 for some reason. It backed up about 9GB before failing and I couldn't get it to restart. I just skipped over partitions 12-14 and went on to the final steps. The only other issue was that I had to install the latest Superuser.apk from the market before my other apps that required root access could successfully run. Other than that, it went without a hitch. Thanks for all the hard work! Much appreciated!


----------



## yuanw (Dec 10, 2011)

Shaztech said:


> Do I need to use another boot.img if I change the system.img (ex for: K1_A301_02_02_110930_CA)
> If I need to then I will apreciate your guide to create a boot.img
> 
> EDIT: Nevermind it's working


Hi, Shaztech, Are you using K1_A301_02_02_110930_CA(system.img)? Can you send it to me? I like lenovo IME in CA version, but I don't know linux, so that I'm not able to create my own img. Thank you.


----------



## yuanw (Dec 10, 2011)

tomschmidt1969 said:


> The drivers that were installed were from letools. I downloaded the drivers on page 1 and tried to install them and it said the INF file does not support this type of installation (right mouse click and install) I am using WIN 7 32 bit and when I go into dev manager and click update then point it to the K1 Drivers folder it says the driver already installed is more current. I uninstalled the letools drivers and deleted them. when I plugged it back in it installed generic adb drivers and once again said they were more up to date than the K1 drivers I downloaded. I am at a loss... Help please.


I stuck this step before. I found the solution: http://consumersuppo...0405354336.html . you got it after you make your letools working. I'm using Win7 64bit.


----------



## lp894 (Aug 24, 2011)

Ive had no probelms at all using my tablet at all. No random reboots or anything. I actually like this tablet a lot. I can't root it but honestly im not sure if I need to or not. I have my bionic rooted...when I had ky hp touchpad root came in handy but for me mostly cause since it wasnt native android I needed root for a lot. But on here....I don't need it at this point.


----------



## O.M.J (Sep 21, 2011)

would anyone have the stock .imgs they could upload?

I'll try to quickly explain why....a co-worker has this ideapad, after the last OTA the tablet was unusable due to constant force closes on boot. When he called for support, they said he needed to send it to them. He asked me to look at it, and my search brought me here.

I've downloaded/installed all the files from this thread and others. I wasn't interested in rooting, just getting the OS stable. I did not copy over the system & boot.img's (per the rooting instructions) I just used the imgs included in the PQXU200.2H.0013.W.CN.0729 file. On first boot, it has a different boot animation, and the OS was in Chinese. I managed to switch to English, but many of the apps still have Chinese. I've never used the tablet b4 so I have no idea what stocks apps should be there. I've ran the system update, and it has updated but it wont go to the latest OTA.

originally I had downloaded the latest OTA & was trying to get it in recovery to re-install the OTA but I could never get it into recovery nor could I ever get adb to recognize the device.

I would just like repeat my steps & flash the stock images.....if anyone has them & can upload, I'd appreciate it!


----------



## Shaztech (Nov 4, 2011)

Use the system.img included in the ideapad_root_tools.zip on the 1st page, and the boot.img from this file http://download.lenovo.com/slates/k1/OTA/K1_A301_04_04_111017_US.zip.

It's the boot.img that contain the root "argument", and the system.img is the stock one.


----------



## phillvigil (Dec 13, 2011)

I am fairly new to the rooting community. I rooted my OG Droid a couple weeks ago and am now running Cyanogen7. I bought a Viewsonic Gtablet when they went on sale for $200 rooted and installed Honeycomb. So, this gives me some experience flashing roms. I took back the Gtab and exchanged for the K1 when they went on sale for $300...well worth the $100 difference!!! Now I have a nice quality tablet that I don't want to screw up!
The biggest reason I want to root is to be able to connect to adhoc wireless networks for phone tether. So I have a few questions...
1. Will the K1 rooting process become less complicated in the near future?
2. Is there any other way to tether this tablet to phone?
3. If the answer to 1 and 2 is "No", can someone give a more detailed simplistic, and updated (for dummies) instruction list?
I have downloaded all the files and can access the tablet on my Windows7 64 (Letools is running and all the drivers working properly)
Once I get the nerve to do this, I don't want to screw it up. Any help would be appreciated!!!


----------



## ferrels (Nov 28, 2011)

phillvigil said:


> I am fairly new to the rooting community. I rooted my OG Droid a couple weeks ago and am now running Cyanogen7. I bought a Viewsonic Gtablet when they went on sale for $200 rooted and installed Honeycomb. So, this gives me some experience flashing roms. I took back the Gtab and exchanged for the K1 when they went on sale for $300...well worth the $100 difference!!! Now I have a nice quality tablet that I don't want to screw up!
> The biggest reason I want to root is to be able to connect to adhoc wireless networks for phone tether. So I have a few questions...
> 1. Will the K1 rooting process become less complicated in the near future?
> 2. Is there any other way to tether this tablet to phone?
> ...


Talk about deja vu! I bought the G-Tab as well and rooted it almost immediately There were a couple of interesting Gingerbread and Honeycomb distros for it but none of them supported hardware acceleration so I returned the G-Tab after less than a week. It didn't make sense to have Tegra 2 hardware and not be able to use it. I'm glad I returned the G-Tab because the Ideapad went on sale just a few days later. I was a little scared to root my K1 as well. But if you follow the instructions on the first post, you'll be just fine. The entire process is lengthy but only because of the full backups. If you skip the backups, you can probably have your tablet rooted in less than 45 minutes tops. The instructions are for a Linux command line, but if you remove the leading ./ in front of each line and paste them into a Windows command shell, it will work just fine. That's what I did. I only encountered one glitch. When attempting to back up partition ID 12, the backup timed out and I couldn't get it to restart. At that point, I just gave up on the backups, restarted the tablet and then went to step 4 and finished up. Then I went to the Market and installed the latest Superuser app. That was it. Hope this helps.


----------



## O.M.J (Sep 21, 2011)

Shaztech said:


> Use the system.img included in the ideapad_root_tools.zip on the 1st page, and the boot.img from this file http://download.leno...4_111017_US.zip.
> 
> It's the boot.img that contain the root "argument", and the system.img is the stock one.


thanks. Yeah the system.img from PQXU200.2H.0013.W.CN.0729 is Chinese, I didn't realize until I saw the build # of K1_A301_02_02_110922_cn, then compared to the list of OTA's @ http://download.leno.../slates/k1/OTA/ . In hind sight I should have looked closer at the CN in the file name.....oh well.

What about the userdata.img? I extracted the files from the userdata.img in PQXU200.2H.0013.W.CN.0729, it has 54 apks and media files and these are Chinese apps.

ok, so I copied the system.img from ideapad_root_tools.zip & the boot.img from K1_A301_04_04_111017_US.....everything writes successfully but it wont boot. I get the Lenovo logo then it loops.

I then tried using the recovery.img from ideapad_root_tools.zip.....same result.


----------



## yuanw (Dec 10, 2011)

using original PQXU200.2H.0013.W.CN.0729 files, boot your tablet in APX mode, run "install_fuse.bat", while screen shows "Wait 30 seconds for system reboot". Hold the tablet power button to shutdown. and then boot in APX mode again(please be quick). wait till the system re-flash the rom and it would restart itself when finish. Now you get a chinese version running. download a US version from OTA website, change the zip file to be update.zip, put it in tablet's download folder. boot your tablet in upgrade mode(hold "volume +" and power) to upgrade to US version. The only problem is you lost all your third part apps, like me.


----------



## O.M.J (Sep 21, 2011)

yuanw said:


> using original PQXU200.2H.0013.W.CN.0729 files, boot your tablet in APX mode, run "install_fuse.bat", while screen shows "Wait 30 seconds for system reboot". Hold the tablet power button to shutdown. and then boot in APX mode again(please be quick). wait till the system re-flash the rom and it would restart itself when finish. Now you get a chinese version running. download a US version from OTA website, change the zip file to be update.zip, put it in tablet's download folder. boot your tablet in upgrade mode(hold "volume +" and power) to upgrade to US version. The only problem is you lost all your third part apps, like me.


thanks, I'll give that a try....I had downloaded the latest US OTA but was trying to boot to recovery to flash it.....I'll try the upgrade mode.


----------



## yuanw (Dec 10, 2011)

I'm also asking who has backup userdata.img, especially CA version? I want my third part apps back.


----------



## O.M.J (Sep 21, 2011)

yuanw said:


> I'm also asking who has backup userdata.img, especially CA version? I want my third part apps back.


or even if someone did not want to upload their userdata.img, they could exract the files from it & just upload the apks & other stock media....I have the tools to extract if someone needs them.


----------



## yuanw (Dec 10, 2011)

I did it many times. I upgraded from chinese to HK to CA to US, no problem. Hold vol + and power, release while you see the 2 white lights on.


----------



## O.M.J (Sep 21, 2011)

yuanw said:


> I did it many times. I upgraded from chinese to HK to CA to US, no problem. Hold vol + and power, release while you see the 2 white lights on.


thanks for the help, but it's not working for me.....the update.zip should be in local storage\download folder, right, not the sd card? also, if it goes into upgrade mode, what should I see on the screen?

also, where did u download your chinese files from ? maybe mine are different?


----------



## yuanw (Dec 10, 2011)

not external_sd folder. The folder on your computer should be "K1\Device Storage\Download". You may see a green android robot on screen if you successful get in upgrade mode .

I think the Chinese firmware is the same. version is 0729. I can upload mine if you like.


----------



## shmn (Nov 6, 2011)

HI PHILLVIGIL.
The best way to root k1 for me was to instaled Unix OS (ubuntu). Then all instruction from first page are quite simply. As a know you also can get linux portable.


----------



## O.M.J (Sep 21, 2011)

yuanw said:


> not external_sd folder. The folder on your computer should be "K1\Device Storage\Download". You may see a green android robot on screen if you successful get in upgrade mode .
> 
> I think the Chinese firmware is the same. version is 0729. I can upload mine if you like.


I was actually viewing the folder from the the tablet, but yeah, I've got it in that folder.....strange, I've tried several times, it just wont go into upgrade mode....if you wouldn't mind uploading that would be great, who knows, maybe something is funky w/ my files.

thx!


----------



## yuanw (Dec 10, 2011)

I uploaded PQXU200.2H.0013.W.CN.0729.zip which I downloaded from a Chinese forums. http://www.megaupload.com/?d=GVXKOCJ0.

MD5:
5E7292B5A85A4458E72AEEFD5440504C PQXU200.2H.0013.W.CN.0729.zip


----------



## O.M.J (Sep 21, 2011)

yuanw said:


> I uploaded PQXU200.2H.0013.W.CN.0729.zip which I downloaded from a Chinese forums. http://www.megaupload.com/?d=GVXKOCJ0.
> 
> MD5:
> 5E7292B5A85A4458E72AEEFD5440504C PQXU200.2H.0013.W.CN.0729.zip


thanks man....downloading now....crossing my fingers...


----------



## O.M.J (Sep 21, 2011)

yuanw said:


> I uploaded PQXU200.2H.0013.W.CN.0729.zip which I downloaded from a Chinese forums. http://www.megaupload.com/?d=GVXKOCJ0.
> 
> MD5:
> 5E7292B5A85A4458E72AEEFD5440504C PQXU200.2H.0013.W.CN.0729.zip


U DA MAN! with those files I was able to boot into upgrade mode right away, and it flashed K1_A301_04_04_111017_US.zip (renamed to update.zip). once it booted, right away IME was force closing. So then I copied K1_A301_12_12_111109_US.zip (renamed to update.zip) to the download folder, but now I can't get it into upgrade mode. Can u confirm, it still works for you on a US ROM?

I'm gonna try installing the OTA from the tablet, but I have to remove the password from my wifi router since I cant use a keyboard.

thanks again

oh, and btw...it did not wipe the userdata partition....I still have all the chinese apps from the chinese userdata.img


----------



## O.M.J (Sep 21, 2011)

update....I was able to update to the latest OTA, still getting the IME force closing, but I see that the Lenovo IME.apk was in the original userdata.img, I uninstalled it along with all the other Chinese apps....everything looks good!

Thanks for all the help!!


----------



## yuanw (Dec 10, 2011)

you must install Lenovo IME by youself. Because userdata.img is still chinese version. The name is a little bit different. That's why I'm lokking a backup us or ca version userdata.img.

I'm also thinking delete the apk in userdata.img and shrink the userdata,img to release the space. There are only 25G space for using right away. The system takes too much space.


----------



## ferrels (Nov 28, 2011)

Has anyone tried installing the Clockwork Mod Recovery using ROM Manager? I'm rooted and I've installed ROM Manager and it runs OK, but I'm not brave enough to try flashing the recovery for fear of bricking my K1. I'm curious to know if it would work or not.


----------



## O.M.J (Sep 21, 2011)

yuanw said:


> you must install Lenovo IME by youself. Because userdata.img is still chinese version. The name is a little bit different. That's why I'm lokking a backup us or ca version userdata.img.
> 
> I'm also thinking delete the apk in userdata.img and shrink the userdata,img to release the space. There are only 25G space for using right away. The system takes too much space.


yeah that was one thing I was thinking about....removing all the Chinese apks from userdata.img then flash, oh well....the tablet is back in the owners hands & he is a happy camper.


----------



## steveziggy (Dec 4, 2011)

ferrels said:


> Has anyone tried installing the Clockwork Mod Recovery using ROM Manager? I'm rooted and I've installed ROM Manager and it runs OK, but I'm not brave enough to try flashing the recovery for fear of bricking my K1. I'm curious to know if it would work or not.


I tried it. First made a back up with titanium backup and moved the folder to the external sd card. it installed but when i turned on the tablet I was stuck in a boot loop so l had to reload the image file with nv flash and reload my back up. Have not tried a second time.


----------



## ferrels (Nov 28, 2011)

Thanks. Hopefully we'll have a working recovery soon.


----------



## stutech (Nov 29, 2011)

steveziggy said:


> I tried it. First made a back up with titanium backup and moved the folder to the external sd card. it installed but when i turned on the tablet I was stuck in a boot loop so l had to reload the image file with nv flash and reload my back up. Have not tried a second time.


I tried it as well, but all it did was restart the tablet. The Android OS was fine it just didn't do much of anything but startup like normal. I'm not sure why yours bricked what image did you choose?


----------



## yuanw (Dec 10, 2011)

Did somebody successfully backup all partition? I got a new K1 and tried to backup the files. But I got error in last 3 partitions(UDA, TMP and GPT).

I still got a UDA.img which is about 13G. I'm not able to mount it to see what's inside. O.M.J, can you give it a try. Thank you.

http://hotfile.com/d...69/UDA.rar.html


----------



## O.M.J (Sep 21, 2011)

yuanw said:


> Did somebody successfully backup all partition? I got a new K1 and tried to backup the files. But I got error in last 3 partitions(UDA, TMP and GPT).
> 
> I still got a UDA.img which is about 13G. I'm not able to mount it to see what's inside. O.M.J, can you give it a try. Thank you.
> 
> http://hotfile.com/d...69/UDA.rar.html


I tried using 2 different programs, I couldn't mount that image with either


----------



## xelacac (Nov 2, 2011)

O.M.J said:


> or even if someone did not want to upload their userdata.img, they could exract the files from it & just upload the apks & other stock media....I have the tools to extract if someone needs them.


I'd like to know what you are using. Just the names, no need to upload them.
Thanks.


----------



## O.M.J (Sep 21, 2011)

xelacac said:


> I'd like to know what you are using. Just the names, no need to upload them.
> Thanks.


I use 2 different programs, explore2fs & ext2explore....I seem to have better luck w/ ext2explore


----------



## khanning (Oct 29, 2011)

I'm going through the guide and backing up all my partitions. When I get to the UDA partition, while nvflash is running the backup, the byte count goes right past the expected size. I let it keep running and eventually the byte count turned negative and started counting down. When it reached 0 it started counting up again. At this time the UDA.img was over 4GB in size. I have tried this twice now with the same results. Should I just keep letting it run?

Also the guide states that the partition backups will total around 30GB. Right now I have backed up all partitions except UDA and the total is 4GB. The guide said UDA is around 3 GB. Does this seem normal?


----------



## Shaztech (Nov 4, 2011)

Forget the backup step, it's not working for anyone... Anyway you can't restore from this backup.


----------



## yuanw (Dec 10, 2011)

Shaztech said:


> Forget the backup step, it's not working for anyone... Anyway you can't restore from this backup.


You're right, don't wasting the time and HD space to backup. There are no way to restore the backup and no way to extract it. You'll lose your the third part Apps any way.


----------



## khanning (Oct 29, 2011)

Thanks, I ended up skipping that partition. I have root access via adb. I moved a current su binary to /system/xbin change permissions, but my apps cannot access root. I also downloaded the latest Superuser.apk from the market. If I try "su" from a terminal emulator I get permission denied, and Superuser.apk cannot update the su binary. Any tips?

[EDIT]
Got it. There was another su binary located at /system/bin. I had to chmod 4755 /system/bin/su. Now my apps can obtain root access.


----------



## khanning (Oct 29, 2011)

Anyone else missing the exchange email app? Exchange.apk and Exchange.odex are in the /system/app directory, and I've checked the permissions. I've also tried pushing over the Exchange apk's and odex files from various OTA updates and setting the permissions, but no luck so far.


----------



## dparker86 (Dec 22, 2011)

Please help

-------------------------------------------------------------------------
FLASHING NOW!!!!!
-------------------------------------------------------------------------
Nvflash started
rcm version 0X20001
System Information:
chip name: t20
chip id: 0x20 major: 1 minor: 4
chip sku: 0x8
chip uid: 0x04289144411f70d7
macrovision: disabled
hdcp: enabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 0
device config fuse: 0
sdram config strap: 0
sending file: flash.bct
- 4080/4080 bytes sent
flash.bct sent successfully
odm data: 0x300c0011
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: bootloader.bin
\ 1140413/1140413 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 2 3
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: GP1
creating partition: SOS
creating partition: LNX
creating partition: APP
creating partition: CAC
creating partition: MSC
creating partition: USP
creating partition: UDA
creating partition: TMP
creating partition: GPT
Formatting partition 2 BCT please wait.. done!
Formatting partition 3 PT please wait.. done!
Formatting partition 4 EBT please wait.. done!
Formatting partition 5 GP1 please wait.. done!
Formatting partition 6 SOS please wait.. done!
Formatting partition 7 LNX please wait.. done!
Formatting partition 8 APP please wait.. done!
Formatting partition 9 CAC please wait.. done!
Formatting partition 10 MSC please wait.. done!
Formatting partition 11 USP please wait.. done!
Formatting partition 12 UDA please wait.. done!
Formatting partition 13 TMP please wait.. done!
Formatting partition 14 GPT please wait.. done!
done!
sending file: bootloader.bin
\ 1140413/1140413 bytes sent
bootloader.bin sent successfully
sending file: recovery.img
\ 3508224/3508224 bytes sent
recovery.img sent successfully
sending file: boot.img
- 3158016/3158016 bytes sent
boot.img sent successfully
sending file: system.img
/ 419430400/419430400 bytes sent
system.img sent successfully
file not found: userdata.img
failed executing command 2147483647 NvError 0x4
command failure: create failed

-------------------------------------------------------------------------
ERROR! NVFlash could not connect to your device.
Please ensure drivers and connection, and try again.
Press 1 to retry, any other to quit.
-------------------------------------------------------------------------


----------



## khanning (Oct 29, 2011)

dparker86 said:


> Please help


Did you backup the TMP partition? If so, just rename the TMP.img to userdata.img and place it in the NVFLASH_HOME directory.


----------



## dparker86 (Dec 22, 2011)

khanning said:


> Did you backup the TMP partition? If so, just rename the TMP.img to userdata.img and place it in the NVFLASH_HOME directory.


i did and now get

userdata.img is too large for partition
command failure: create failed


----------



## khanning (Oct 29, 2011)

dparker86 said:


> i did and now get
> 
> userdata.img is too large for partition
> command failure: create failed


I got that too. Open your partitions.cfg file and look for the TMP partition. Calculate the size by doing NumSectors * BytesPerSector. Now in the NVFLASH_HOME directory open the flash.cfg file and change the size of the TMP to the size you calculated. That got me up and running.


----------



## dparker86 (Dec 22, 2011)

Thanks goes out to timmyDean @ XDA
http://forum.xda-developers.com/showthread.php?t=1404351

Download the files http://www.multiupload.com/ASJT84WZ0Q To Unbrick & Root Lenovo Ideapad K1


----------



## yuanw (Dec 10, 2011)

khanning said:


> I got that too. Open your partitions.cfg file and look for the TMP partition. Calculate the size by doing NumSectors * BytesPerSector. Now in the NVFLASH_HOME directory open the flash.cfg file and change the size of the TMP to the size you calculated. That got me up and running.


Did you get your third part Apps back?


----------



## khanning (Oct 29, 2011)

> Did you get your third part Apps back?


I have not


----------



## yuanw (Dec 10, 2011)

Because I'll lose my third part Apps anyway, I made up my own userdata.img(only LenovoIME inside) and shrinked the size to get me more space. I've 28G now(normally is about 25G).


----------



## Shaztech (Nov 4, 2011)

Can you post how you made your userdata.img ?
Thanks


----------



## khanning (Oct 29, 2011)

I just renamed my TMP.img backup to userdata.img (If you notice in the flash.cfg file, in the NVFLASH_HOME dir, the TMP partition has a filename of userdata.img). I then had to change the size of the TMP partition in the flash.cfg file.



> I got that too. Open your partitions.cfg file and look for the TMP partition. Calculate the size by doing NumSectors * BytesPerSector. Now in the NVFLASH_HOME directory open the flash.cfg file and change the size of the TMP to the size you calculated. That got me up and running.


You could also do like yuanw and remove some things from the userdata.img so that you don't have to increase the partition size.

@yuanw I was able to see my third party apps in my userdata.img (TMP.img) backup. Just mount the img under Linux using "mount -o loop userdata.img MOUNT_DIR". You can then try to push the files over and fix permissions.​


----------



## yuanw (Dec 10, 2011)

khanning said:


> I just renamed my TMP.img backup to userdata.img (If you notice in the flash.cfg file, in the NVFLASH_HOME dir, the TMP partition has a filename of userdata.img). I then had to change the size of the TMP partition in the flash.cfg file.
> 
> You could also do like yuanw and remove some things from the userdata.img so that you don't have to increase the partition size.
> 
> @yuanw I was able to see my third party apps in my userdata.img (TMP.img) backup. Just mount the img under Linux using "mount -o loop userdata.img MOUNT_DIR". You can then try to push the files over and fix permissions.​


Could you upload your TMP.img? My backup imgs are not working.​


----------



## yuanw (Dec 10, 2011)

Shaztech said:


> Can you post how you made your userdata.img ?
> Thanks


in linux, mount the userdata.img, copy all folder in mounted folder to other folder, like "userdata". delete all files in app folder. and put "15-LenovoIMe.apk" in.

"sudo ./make_ext4fs -l 250M -a userdata userdata.img.new dir_of_userdate_folder"

That's all. You may even make it smaller. In case you like mine:

http://hotfile.com/dl/138211645/16449a1/userdata.rar.html


----------



## ferrels (Nov 28, 2011)

Is anyone having microphone problems after rooting? My mic isn't picking up any sound and I don't know if it's because of the root process or if I'm just missing something in my settings.

I've also noticed that the option to do a full system wipe no longer works either. The tablet goes thru the motions, reboots, and nothing is changed.

Could someone please upload a stock system.img so I can try a recovery to see if it cures my microphone problem?

Nevermind.....returned it to BestBuy for a refund......


----------



## tomschmidt1969 (Dec 3, 2011)

I have a K1 as well. I followed the directions how to root the K1 using "Lenovo_Windows" zip file. It runs thru the entire process but I don't seem to have "superuser" access. I have also used the following directions and that did not work either. Can someone help please.

The last step (4) wasn't working for me so here's what i've done:

1- Download this file: http://downloads.and...efgh-signed.zip
2- Extract the su file to C:\ (in windows)
3- adb remount
4- adb push c:/su /system/bin/su
5- adb shell
6- cd /system/bin
7- chmod 4755 su
8- exit (shell)
9- adb reboot
10- Installed this app https://market.andro...ufou.android.su
11- Optional: Remove the file "SuperUser.apk" in /system/app with the Explorer (Root) of your choice
to remove the old SuperUser Application.


----------



## steveziggy (Dec 4, 2011)

Shaztech said:


> Got Netflix Working !!!!!!!
> 
> Download this file:
> http://www.megaupload.com/?d=0Y14DWST
> ...


Yes this fixed netflix but broke skype had to use an updated file and now both netflix and skype working


----------



## steveziggy (Dec 4, 2011)

tomschmidt1969 said:


> I have a K1 as well. I followed the directions how to root the K1 using "Lenovo_Windows" zip file. It runs thru the entire process but I don't seem to have "superuser" access. I have also used the following directions and that did not work either. Can someone help please.
> 
> The last step (4) wasn't working for me so here's what i've done:
> 
> ...


make sure you are using the modified su included in the download and not the one in your abd folder.


----------



## tomschmidt1969 (Dec 3, 2011)

The SU in which ZIP package? The one in step one above or the one included in Lenovo_windows.zip? I already tried the one in step one above and no luck.


----------



## tomschmidt1969 (Dec 3, 2011)

I found another copy of SU and got it working ... Thanks for all your help!


----------



## ttaiw (Dec 31, 2011)

after i did follow step. my k1 cannot ota update / factory reset.
some one can provide original backup file
for us version of boot.img / recovery.img / system.img

thank a lot. / Happy new year.


----------



## krook1 (Jan 26, 2012)

the Mega upload link for PQXU200.2H.0013.W.CN.0729.zip isbroken. Cansomeonepost a alternate link please?


----------



## rlvcosta (Jul 28, 2012)

I still confuse about theory behind this root.

After googling found the new link for the download files in the main zip. Not included the transformer_bootloader.bin.

What is the transformer bootloader? Where was it created? Also a leak from Lenovo?

Looks like there are some root tools. Understand that root is the process to modify the boot.img including some Android configuration like r0.secure=0 (what does it do?). Also include su file into /system/bin? How to cross compile to the correct version of kernel? busybox?

Using a OTA file from Lenovo stock. Do we need a image with blob file for boot? Can we use it's boot.img modifying something to root? Better use latest version?

It would be nice to include some theory.

Can someone help with these questions?


----------

