Database Users

Idiots guide to unlocking sony Z1

After hours of trying different methods to root the z1, and struggling with chinese based apps ... and accidentally wiping the phone ..... nothing manage to root the phone. until i came across the following,
anyways to make life easy i have complied all the steps that you need to do to root the phone from 3 seperate guides. I didnt write this article i just compiled it for easy reading
http://techbeasts.com/2013/12/19/in...ng-latest-14-2-0-a-290-firmware-how-to-guide/
http://techbeasts.com/2013/12/18/in...ers-quickly-with-minimal-tool-on-windows-pc/
http://techbeasts.com/2013/12/18/how-to-unlock-bootloader-of-sony-xperia-devices-guide/
This guide is only for Sony Xperia Z1 C6903/2.
1. Do not try this on any other model, please check your device’s mode in Settings > About Device.
2. The CWM / TWRP recovery is only for Xperia Z1 C6903/C6902 running latest Android 4.3 Jelly Bean 14.2.A.0.290 firmware. Check your firmware version in Settings > About Device and make sure that it matches the one mentioned here.
3. You must have installed Android ADB & Fastboot drivers.
TO INSTALL ADB & Fastboot Drivers tool:
a. Download the Minimal ADB & Fastboot Drivers tool: Link 1 | Link 2
b. Run the minimaltool.exe file that you downloaded and install the tool.
c. You can run the tool now by either through the Start menu, through the icon that you created on the desktop or by opening Program files > Minimal ADB & Fastboot > Right click on an empty area while keeping the shift key pressed and click on “Open Command Window Here”. ( NOTE: just double clicking on the desktop icon opens the command prompt window)
d. Use the Command prompt to do whatever you want now!
e. To install any .img file, you will have to place that file in the Minimal Tool folder that is located under Program files. (in win8.1 its : C:\Program Files (x86)\Minimal ADB and Fastboot)
f. To access the Fastboot mode, you’ll have to first bring the Fastboot mode on your device and then connect it. E.g on HTC devices you can highlight Fastboot mode by accessing it through HBoot and then connect it, while on Sony you can turn off the device and then while keeping the back or volume up key pressed plug in the USB cable.
That’s All! You’ve successfully installed Android ADB & Fastboot drivers. I hope that it didn’t take more than 2 minutes for you.
4. Your device must have an unlocked bootloader. This is the slightly troublesome part but its straight forward.
How to Unlock Bootloader
Install Android ADB & Fastboot Drivers using the quick setup with Minimal tool. Find the guide here.
Now first of all you need to check if your device’s bootloader unlocking is allowed or not, to do so open the dailer on your device.
Type *#*#7378423#*#*.
As soon as you enter the above code, a menu will open up.
Tap Service info > Configuration > Bootloader Unlock. If it says Yes, that means bootloader unlocking is allowed, else you can also find out if the Bootloader is already unlocked.
Now in the dialer type “*#06#”, you should get the IMEI number of your phone. Note it down somewhere
After verifying the bootloader unlock permission, turn off your device completely.
Now open the Minimal ADB and Fastboot command prompt, that you created using the guide above.
Press the back key or Volume Up key on your Xperia Device and connect it to your PC while keeping the key pressed. The back key works for older Xperia devices, while for newer devices Volume Up key will work.
In case you are trying to unlock the bootloader of your Sony Xperia Z1, please make sure that it’s running on latest Android 4.3 Jelly Bean firmware. If you tried to unlock bootloader on Android 4.2.2 firmware, it will cause the camera crash on your device.
In the command prompt type: fastboot.exe -i 0x0fce getvar version and press enter, you should get a response now e.g (0.3). This step is to verify that your device is properly connected or not.
Now open this Pageand accept the legal terms and conditions by Sony to unlock the bootloader.
After accepting the legal terms and conditions, enter your name, your phone’s IMEI number (Remove the last digit of IMEI number) and your email and click Submit button
You should receive an email by Sony immediately, the email has the Key to unlock your phone’s bootloader.
Now again in the command prompt type this com: fastboot.exe -i 0x0fce oem unlock 0xKEY. Repalce KEY with the code that you got in the email by Sony and hit Enter.
As soon as you hit Enter, the bootloader will be unlocked and show you logs in the command prompt.
5 . Please make sure that your phone’s battery is charged at least over 60%. This is highly recommended in order to prevent any power issues during the recovery flashing process.
6. Please make sure that you backup all of your important media content, contacts, call logs and important text messages. This is highly recommended so that in case something goes wrong, you can still restore your data.
7. Use only OEM data cable to establish connection between your PC and Phone.
8. Now that the basics are done.... this is how to root
How to Install TWRP / CWM Recovery on Xperia Z1 C6903 and C6902:
Download your desired recovery.img file:
i recommend philz advance cwm , its easier and you arent required to download supersu
Philz Advance CWM Recovery for Xperia Z1 C6903/2
CWM Recovery for Xperia Z1 C6903/2
TWRP Recovery for Xperia Z1 C6903/2
Place the downloaded Recovery.img file in the Minimal ADB & Fastboot folder that you created using our ADB & Fastboot Quick Setup Guide.
If you are using Android ADB & Fastboot full package, you can place the downloaded Recovery.img file in the Fastboot folder or in the Platform-tools folder.
Open the folder where you placed the Recovery.img file. E.g Minimal ADB & Fastboot or Fastboot or Platform Tools. (in win8.1 its : C:\Program Files (x86)\Minimal ADB and Fastboot)
Press and hold the shift key and right click on an empty area within the folder, and click on “Open Command Window Here”.
Turn off your Xperia Z1 completely.
Now press the Volume Up Key and while keeping it pressed plug in the USB cable.
You should see a blue light in the notification light of your phone, that means your device is now connected in Fastboot mode.
Now type the following command: Fastboot Flash boot Recoveryname.img
You may rename the recovery.img file for your ease of access and replace it with Recoveryname in the command to flash it.
Hit Enter and it will quickly flash CWM / TWRP recovery in your Xperia Z1.
How to Root Sony Xperia Z1 C6903 and C6902:
WITH PhilZ Advance CWM without installing SuperSu:
Boot into recovery (when the sony logo appears on boot press volume up volume down until the recovery loads)
Select Reboot System Now
Select Root device
Your phone will restart
Congrats! You’re rooted now.
WITH SuperSu:
Download the latest SuperSu.zip file.
Place the downloaded SuperSu.zip file on your phone’s sd card.
Boot into CWM / TWRP recovery on your phone.
Select Install Zip / Install > Choose Zip from SD / Ext Sd card > SuperSu.zip
Select Yes and let it flash SuperSu.
As soon as flashing is done, reboot your device.
Find SuperSu in App drawer.
Congrats! You’re rooted now.

You could root Z1 by flashing 14.1.G.1.534 and root with rootkitXperia, but it was too late
If you never use music features related to DRM, it's OK though...
Learn more about TA:
http://forum.xda-developers.com/showthread.php?t=2440597

How to Root, Add Custom Recovery & Unlock Bootloader (Virgin Mobile)

Before I go on with this I'm giving you this guide from Potent Technologies and all credit goes to him I just wanted to share it with the XDA world
I am a owner of the 816 under Virgin Mobile and I would like to see more roms being made for this device as it is a great phone.
---------> https://www.youtube.com/watch?v=1NYP7V2ltpI <-------- Link to video
Back up your device information before you begin to your PC, Google Drive, etc. so that you may continue without risk of losing it. This is necessary because some devices will factory reset when you select "Yes" to unlock the bootloader.
Step 1: HTC Sync Manager
http://www.htc.com/in/support/softwar...
Step 2: Install ADB Fastboot
https://www.dropbox.com/s/aa8ri8uxyhh...
Step 3: Unlock Bootloader
http://www.htcdev.com/bootloader
Step 4: CWM Auto-Install via ADB Fastboot / Bootloader
(VIEW [NEW UPDATE] AT BOTTOM OF DESCRIPTION AS WELL!)
http://forum.xda-developers.com/devdb...
Step 5: SuperSU .zip file for Internal Storage
http://download.chainfire.eu/452/Supe...
[NEW UPDATE]:
IF YOU RECEIVE AN EXCLAMATION MARK ON THE RECOVERY SCREEN AFTER RUNNING THE .EXE AT 18:24 IN THE VIDEO THEN IT IS BECAUSE YOU NEED TO FLASH AN OLDER CLOCKWORKMOD FIRST!
POWER OFF YOUR DEVICE BY HOLDING VOLUME UP + POWER BUTTON FOR 15 SECONDS IF YOUR STUCK AND THEN POWER ON BY HOLDING VOLUME DOWN+POWER BUTTON AND YOU'LL GO BACK INTO THE BOOTLOADER.
DO AS YOU SEE FROM 11:40-12:03.
ONCE YOUR DEVICE IS SET IN THAT MODE DOWNLOAD THIS FILE BELOW:
https://s.basketbuild.com/dl/devs?dl=...
NOW SAVE THAT FILE WHERE THE ADB FOLDER IS THAT YOU INSTALLED AT THE BEGINNING OF THE VIDEO IN (Local Disk C:/adb)
ONCE THAT'S COMPLETE GO INTO THAT FOLDER AND RIGHT-CLICK IN ANY WHITE AREA OF THE FOLDER AND PRESS "RUN COMMAND LINE HERE" & RUN THE FOLLOWING COMMAND:
fastboot flash recovery recovery.img
REBOOT TO RECOVERY NOW AND IT WILL WORK!
NOW YOU CAN RUN THE .EXE FROM STEP 4 IN FASTBOOT MODE FOR THE LATEST VERSION!
Done!
This is a guide on how to Root your HTC Desire 816 and during this process you will add a Custom Recovery and Unlock your Bootloader! (Sorry; no S-Off at this time).
This will also allow you to enable moving apps and such to your SD card if you add specific properties to the build.prop file or by flashing a Kernel that's write-enabled. I will make a separate video to cover this as well when I have an SD available.

Really nice of you to make this and all, but this already exists. In fact all you did was take a previous tutorial and make it carrier specific, even though THIS clearly states all of this, and works on the Virgin Mobile version. However the video was a great addition (assuming you made it).
And most of your links are broken.

Checked and all links in the video have been updated and so has the .exe for the recovery.
Sent from my 710C using XDA Free mobile app

[Guide] Safe bootloader unlock, restore DRM, custom recovery, root, bootloader relock

** DISCLAIMER: I AM NOT A DEV AND THIS IS MY HOBBY. I ASSUME NO RESPONSIBILITY IF THIS BREAKS YOUR DEVICE **​
The following is tested on model E6553. This may work for the dual sim model too but I have not verified it. Do not flash the ftf and kernel files intended for one model onto another.​
I am not taking credit for any of the tools and kernels here. They are all developed by others. I am only telling you how to use them.
Credits: @zxz0O0, @tobias.waldvogel
0- Prerequisites
You need to have a functioning installation of adb and fastboot tools. You need to have proper Sony drivers installed on your PC to detect your phone when it is connected to the PC. You should be able to flash an ftf file using flashtool. If any of these sound unfamiliar to you, stop reading, go learn about them, and then come back.
1- How to unlock your bootloader without losing the DRM keys
Sony has designed this phone such that if you unlock your bootloader you lose your TA partition PERMANENTLY which includes some of the Xperia features and licenses that have to do with image processing etc. forever. You will also no longer receive OTAs. So in theory, without a copy of this TA partition (which is unique to each device and cannot be copied over from another) unlocking the bootloader results in an irreversible loss of some of your phone's features. Relocking the bootloader will not bring them back.
A hack exists that allows you to backup the TA partition before you unlock the bootloader. This backup will make the process completely reversible so if you ever need to send the tablet to Sony for repair or just want to return it to its original state you have a way. Follow these instructions carefully:
1.0- Before you begin keep in mind that this procedure, especially the unlocking step, completely erases your tablet. Disable myXperia and remove your google account before proceeding. The following will likely not work well with encryption.
1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the Customized NL ftf that you can get from here.
1.2- Enter service Mode by dialing *#*#7378423#*#* -> Service info -> configuration, and make sure the device is unlockable.
Also check -> Service Tests -> Security and you will see a bunch of "active" and "OK" attributes. You can take screenshots for your reference.
1.3- Turn on usb debugging mode on your phone.
1.4- Download iovyroot zip v0.4 or higher from here.
1.5- Unzip this zip file into a folder of your choice and open a command terminal there.
1.6- Connect the phone which is now in USB debugging mode to your PC and answer yes when the phone asks to authorize the PC to access it in USB debugging mode. You can check that the PC indeed sees the phone by running this command
Code:
adb devices
1.7- Run the following command:
Code:
tabackup
1.8- VERY IMPORTANT: Make sure the command completes with no errors. If all goes well you will have a file with a name like TA-05052016.img (the name may be different for you) with a size of 2MB in your folder.
1.9- Save this file in a very safe place. Save it on your hard disk, AND email it to yourself, AND put it on your google drive. If you lose this file you can never reverse the bootloader unlocking process.
1.10- Reboot the device.
1.11- Now you can unlock the bootloader. Follow the instructions at Sony's official website at http://developer.sonymobile.com/unlockbootloader Also save your unlock code that you obtain in this step somewhere. You may need it some day.
1.12- Reboot the device and it will briefly enter recovery and then start the phone initial setup.
1.13- (Optional) you can easily verify that your bootloader is unlocked by entering the fastboot mode, obtaining any boot image, and running the following command to boot your tablet with that image:
Code:
fastboot boot boot.img
1.14- (Optional) you can see that the DRM keys are erased from your tablet by repeating step 1.2 but this time you will see a bunch of errors under Service Tests -> Security.
1.15- As a side effect of unlocking the bootloader you lose the ability to receive OTA updates. Clean flash a Marshmallow ftf to continue. For this tutorial I used Marshmallow 6.0 E6553_Customized HK_1294-9654_32.1.A.1.185_R7C (the latest firmware at the time of this writing.)
2- How to emulate DRM keys and/or root and/or add recovery after unlocking the bootloader.
A hack exists that can emulate the DRM keys:
2.1- Extract the boot image from the 32.1.A.1.185 marshmallow ftf that you installed in step 1.15. Here are the steps to take:Open the ftf file with 7-zip or any zip program that you have at your disposal
Look for a file called kernel.sin and extract it.
Start flashtool and from Tools menu choose Sin Editor.
Select the kernel.sin that you extracted in the previous step and hit Extract data.
Flashtool will create a file called kernel.elf which you will use in the next step.​2.2- Download rootkernel_v4.42_Windows_Linux.zip (or a higher version) from http://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 and unzip it in a folder of your choice.
2.3- Copy the kernel.elf that you got in step 2.1 to this folder. If you want root, follow this guide through to section 5 place SuperSU 2.71 (or higher) in this folder as well. Make sure the name of the SuperSU zip starts with letters "SuperSU". The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133 (The rootkernel tool has a bug in its built-in SuperSU integration. See: http://forum.xda-developers.com/showpost.php?p=67485478&postcount=838)
2.4- Open a command terminal in this folder and run the rootkernel script. Your command should look similar to this:
Code:
rootkernel.cmd kernel.elf boot-patched.img
When prompted, answer as follows:- Sony RIC is enabled. Disable? [Y/n] Y (if you want root plus write access)
- Install TWRP recovery? [Y/n] Y (if you want to have recovery)
- Install busybox? [Y/n] Y (if you want busybox. It is very useful)
- Found SuperSU-v2.71-20160331103524.zip. Install? [Y/n] Y (if you want root)
- Install DRM fix? [Y/n] Y (if you want DRM emulation)​This will create a new kernel image called boot-patched.img which you will now flash on your phone.
2.5- Boot the phone in the fastboot mode and flash your patched image using the following fastboot command:
Code:
fastboot flash boot boot-patched.img
2.6- (Optional) You can reboot the phone and see that the DRM keys are indeed retrieved by repeating step 1.2. You can also open settings -> display, and look under Image Enhancement. If the DRM emulation is successful you will see this.
3- How to flash a custom or stock kernel
3.0- If you have already flashed the patched kernel in part 2 you will skip this part.
3.1- Whether you want to use a custom kernel or stock, and whether you have done the DRM patch described above or not, to flash a boot image (i.e. kernel) on your phone you need to restart the tablet in fastboot mode.
3.2- To flash the kernel use this command:
Code:
fastboot flash boot [I]name_of_your_kernel[/I]
You will replace name_of_your_kernel with whatever your kernel is called (e.g. boot.img, kernel.elf, etc.)
4- How to add and use recovery
4.1- Recovery is added to your kernel in step 2.4.
4.2- To enter recovery reboot the phone and touch the volume up key when the LED turns yellow during the boot splash screen.
5- How to root
5.1- Place SuperSU 2.71 zip (or higher) on the phone's sdcard. The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133
5.2- Reboot to recovery and flash the zip file.
6- How to relock bootloader and return it to original factory state
6.0- To relock the bootloader along with restoring the DRM keys the phone must have unmodified stock firmware.
6.1- Repeat step 1.1
6.2- Repeat steps 1.3, 1.4, and 1.5
6.3- Copy the TA backup image that you had obtained in section 1 in the iovyroot folder and use the tarestore command to flash the TA partition back onto the phone. The command will look similar to this:
Code:
tarestore TA-05052016.img
Make sure the command completes with no error. If it fails the first time try again. Reboot the phone. Your bootloader is now locked and your DRM keys restored.
6.4- (Optional) You can verify that you are back to the original locked state by repeating step 1.2.

Whoa Great
---------- Post added at 01:32 AM ---------- Previous post was at 12:50 AM ----------
najoor said:
** DISCLAIMER: I AM NOT A DEV AND THIS IS MY HOBBY. I ASSUME NO RESPONSIBILITY IF THIS BREAKS YOUR DEVICE **​The following is tested on model E6553. This may work for the dual sim model too but I have not verified it. Do not flash the ftf and kernel files intended for one model onto another.​I am not taking credit for any of the tools and kernels here. They are all developed by others. I am only telling you how to use them.
Credits: @zxz0O0, @tobias.waldvogel
0- Prerequisites
You need to have a functioning installation of adb and fastboot tools. You need to have proper Sony drivers installed on your PC to detect your phone when it is connected to the PC. You should be able to flash an ftf file using flashtool. If any of these sound unfamiliar to you, stop reading, go learn about them, and then come back.
1- How to unlock your bootloader without losing the DRM keys
Sony has designed this phone such that if you unlock your bootloader you lose your TA partition PERMANENTLY which includes some of the Xperia features and licenses that have to do with image processing etc. forever. You will also no longer receive OTAs. So in theory, without a copy of this TA partition (which is unique to each device and cannot be copied over from another) unlocking the bootloader results in an irreversible loss of some of your phone's features. Relocking the bootloader will not bring them back.
A hack exists that allows you to backup the TA partition before you unlock the bootloader. This backup will make the process completely reversible so if you ever need to send the tablet to Sony for repair or just want to return it to its original state you have a way. Follow these instructions carefully:
1.0- Before you begin keep in mind that this procedure, especially the unlocking step, completely erases your tablet. Disable myXperia and remove your google account before proceeding. The following will likely not work well with encryption.
1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
1.2- Enter service Mode by dialing *#*#7378423#*#* -> Service info -> configuration, and make sure the device is unlockable.
Also check -> Service Tests -> Security and you will see a bunch of "active" and "OK" attributes. You can take screenshots for your reference.
1.3- Turn on usb debugging mode on your phone.
1.4- Download iovyroot zip v0.4 or higher from here.
1.5- Unzip this zip file into a folder of your choice and open a command terminal there.
1.6- Connect the phone which is now in USB debugging mode to your PC and answer yes when the phone asks to authorize the PC to access it in USB debugging mode. You can check that the PC indeed sees the phone by running this command
Code:
adb devices
1.7- Run the following command:
Code:
tabackup
1.8- VERY IMPORTANT: Make sure the command completes with no errors. If all goes well you will have a file with a name like TA-05052016.img (the name may be different for you) with a size of 2MB in your folder.
1.9- Save this file in a very safe place. Save it on your hard disk, AND email it to yourself, AND put it on your google drive. If you lose this file you can never reverse the bootloader unlocking process.
1.10- Reboot the device.
1.11- Now you can unlock the bootloader. Follow the instructions at Sony's official website at http://developer.sonymobile.com/unlockbootloader Also save your unlock code that you obtain in this step somewhere. You may need it some day.
1.12- Reboot the device and it will briefly enter recovery and then start the phone initial setup.
1.13- (Optional) you can easily verify that your bootloader is unlocked by entering the fastboot mode, obtaining any boot image, and running the following command to boot your tablet with that image:
Code:
fastboot boot boot.img
1.14- (Optional) you can see that the DRM keys are erased from your tablet by repeating step 1.2 but this time you will see a bunch of errors under Service Tests -> Security.
1.15- As a side effect of unlocking the bootloader you lose the ability to receive OTA updates. Clean flash a Marshmallow ftf to continue. For this tutorial I used Marshmallow 6.0 E6553_Customized HK_1294-9654_32.1.A.1.185_R7C (the latest firmware at the time of this writing.)
2- How to emulate DRM keys and/or root and/or add recovery after unlocking the bootloader.
A hack exists that can emulate the DRM keys:
2.1- Extract the boot image from the 32.1.A.1.185 marshmallow ftf that you installed in step 1.15. Here are the steps to take:
Open the ftf file with 7-zip or any zip program that you have at your disposal
Look for a file called kernel.sin and extract it.
Start flashtool and from Tools menu choose Sin Editor.
Select the kernel.sin that you extracted in the previous step and hit Extract data.
Flashtool will create a file called kernel.elf which you will use in the next step.​2.2- Download rootkernel_v4.42_Windows_Linux.zip (or a higher version) from http://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 and unzip it in a folder of your choice.
2.3- Copy the kernel.elf that you got in step 2.1 to this folder. If you want root, place SuperSU 2.71 (or higher) in this folder as well. Make sure the name of the SuperSU zip starts with letters "SuperSU". The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133
2.4- Open a command terminal in this folder and run the rootkernel script. Your command should look similar to this:
Code:
rootkernel.cmd kernel.elf boot-patched.img
When prompted, answer as follows:
- Sony RIC is enabled. Disable? [Y/n] Y (if you want root plus write access)
- Install TWRP recovery? [Y/n] Y (if you want to have recovery)
- Install busybox? [Y/n] Y (if you want busybox. It is very useful)
- Found SuperSU-v2.71-20160331103524.zip. Install? [Y/n] Y (if you want root)
- Install DRM fix? [Y/n] Y (if you want DRM emulation)​This will create a new kernel image called boot-patched.img which you will now flash on your phone.
2.5- Boot the phone in the fastboot mode and flash your patched image using the following fastboot command:
Code:
fastboot flash boot boot-patched.img
2.6- (Optional) You can reboot the phone and see that the DRM keys are indeed retrieved by repeating step 1.2. You can also open settings -> display, and look under Image Enhancement. If the DRM emulation is successful you will see this.
3- How to flash a custom or stock kernel
3.0- If you have already flashed the patched kernel in part 2 you will skip this part.
3.1- Whether you want to use a custom kernel or stock, and whether you have done the DRM patch described above or not, to flash a boot image (i.e. kernel) on your phone you need to restart the tablet in fastboot mode.
3.2- To flash the kernel use this command:
Code:
fastboot flash boot [I]name_of_your_kernel[/I]
You will replace name_of_your_kernel with whatever your kernel is called (e.g. boot.img, kernel.elf, etc.)
4- How to add and use recovery
4.1- Recovery is added to your kernel in step 2.4.
4.2- To enter recovery reboot the phone and touch the volume up key when the LED turns yellow during the boot splash screen.
5- How to relock bootloader and return it to original factory state
5.0- To relock the bootloader along with restoring the DRM keys the phone must have unmodified stock firmware.
5.1- Repeat step 1.1
5.2- Repeat steps 1.3, 1.4, and 1.5
5.3- Copy the TA backup image that you had obtained in section 1 in the iovyroot folder and use the tarestore command to flash the TA partition back onto the phone. The command will look similar to this:
Code:
tarestore TA-05052016.img
Make sure the command completes with no error. If it fails the first time try again. Reboot the phone. Your bootloader is now locked and your DRM keys restored.
5.4- (Optional) You can verify that you are back to the original locked state by repeating step 1.2.
Click to expand...
Click to collapse
Very usefull step by step guide.. But is there is any method to root phone without unlocking Bl? Quite curious to know from you.

arokososoo said:
Whoa Great
---------- Post added at 01:32 AM ---------- Previous post was at 12:50 AM ----------
Very usefull step by step guide.. But is there is any method to root phone without unlocking Bl? Quite curious to know from you.
Click to expand...
Click to collapse
Not yet, atleast for my Dual SIM Version.

njaya95 said:
Not yet, atleast for my Dual SIM Version.
Click to expand...
Click to collapse
So you mean there is a way to root single sim version without unlocking BL?

Thanks ú so much! this is well writen, i will try this when i get the time to do a fresh install. Cheers mate

@arokososoo
Please, in the future never quote long OP and any other long posts. This is very annoying for mobile and desktop users to scroll to the next post. Thanks.
Sent from my Sony E6553 using XDA Labs

I wonder if E6533 can use this guide

Got as far as going to the sony website, there's no mention of phones that can be unlocked there and for some reason Ive got bootloader unlock allowed no, even with a sim free phone and my xperia turned off.....bummer

Stoneybridge said:
Got as far as going to the sony website, there's no mention of phones that can be unlocked there and for some reason Ive got bootloader unlock allowed no, even with a sim free phone and my xperia turned off.....bummer
Click to expand...
Click to collapse
I also unlocked my Z3+, although it wasn't supported. I just picked Z4 Tablet since it is the "nearest" one. Worked Got MM rooted now.

How long did that take on your devices? 1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
I am waiting for half an hour now...
Spoiler

Trilliard said:
How long did that take on your devices? 1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
I am waiting for half an hour now...
Spoiler
Click to expand...
Click to collapse
I can't see your picture, but I assume you have that stucking at modem/system ?
If so, downgrade Flashtool to 0.9.19

Well i got a soft brick, but was able to restore it trough Sony Companion. Here is the picture on another hoster http://fs5.directupload.net/images/160529/gr5fpf8t.png dont know on what point it stuck.
Funfact that two germans writting in english
Edit, big thanks version 0.9.19 worked perfect. Cant understand why the newest one doesnt work
Edit 2: System boots up, but when the setup start the process com.android.phone stops instant and if i hit ok the message comes instantly again after about ten times the phone reboot, i cant do anything else... next repair through sony companion and back to stock german 6.0. I´ll stop try it for today.

Trilliard said:
Well i got a soft brick, but was able to restore it trough Sony Companion. Here is the picture on another hoster http://fs5.directupload.net/images/160529/gr5fpf8t.png dont know on what point it stuck.
Funfact that two germans writting in english
Edit, big thanks version 0.9.19 worked perfect. Cant understand why the newest one doesnt work
Edit 2: System boots up, but when the setup start the process com.android.phone stops instant and if i hit ok the message comes instantly again after about ten times the phone reboot, i cant do anything else... next repair through sony companion and back to stock german 6.0. I´ll stop try it for today.
Click to expand...
Click to collapse
Did you forget to wipe?

In a thread i opened in Q&A a user said that even though service info reported bl unlock allowed NO, he managed to unlock it anyways using standard procedure, what do you think?

it seems like Sony RIC is not fully disabled with this patch.

Finally ! Works like a charm in my E6533 (Dual sim) !!! Thanks a lot !!!

Hi thiefxhunter,
How you do this? could you explain us step by step. I like to root my dual sim model.
Thanks.

Hi.. I am stuck in 2.5
My device is unlocked, It is connected in fastboot mode (blue led).
error msg
'Fastboot is not recognised as an internal or external command, operable program or batch file'
Please help me in this.
Solved..
Thanks for this post..

Thanks for this guide, it worked like a charm on my E6553 with 32.2.A.0.224

CorzCorry said:
I also unlocked my Z3+, although it wasn't supported. I just picked Z4 Tablet since it is the "nearest" one. Worked Got MM rooted now.
Click to expand...
Click to collapse
Can you please explain how did you do that? Thanks

[BEGINNERS GUIDE][Lollipop 5.1.1 .236] Root,Backup TA, UBL, Install Recovery

NOTE: DON'T HOLD ANYONE RESPONSIBLE IF SOMETHING GOES WRONG DURING THE PROCESS!
This thread contains full information you might need for rooting, backing up TA partition, unlocking bootloader, installing custom recovery, installing custom rom etc.
Some notes below, read them
-I try to keep this thread clean so people have easier time navigating. @derjango has ALOT of info and fixes on his THREAD which is related to this one, give it a read
-Read comments if you have problems. You may find answer and fix there by other users. I wrote this thread few months after I did these steps to my phone so I likely made mistakes (e.g. I forgot or got some steps wrong). If you do see those mistakes or have problems that nobody else has, feel free to ask in comments.
-We will use legit rooting methods and not those sketchy one click root apps
-These instructions may apply for other z line devices but you will have to find ftf files for your own device
-Written for 14.6.A.1.236 firmware but it will work on any version that you have currently.
0. PREPARATIONS
Backup all your data (photos, videos, contacts etc.)
Fully charge your battery
Enable USB debugging
Download the following:
Latest XperiaCompanion from HERE (for drivers mainly)
Sony flashtool from HERE
Follow THIS thread to install adb drivers
Navigate to your C:\Flashtool\drivers and run Flashtool-drivers
Select Flashmode drivers, Fastboot drivers and Xperia Z1 Compact drivers and click install
Now download THIS and THIS and put it in C:\Users\username\.flashTool\firmwares
(Windows 8/8.1/10 users can try - THIS fix if you can't install flashtool drivers)
1. FLASHING .108 FIRMWARE
1.1. Run Flashtool and click on lightning button, make sure flashmode is selected and hit Ok
1.2. In left window click on + symbol until you find 14.4.A.0.108
1.3. Under wipe check both options
1.4. Click Flash
1.5. Wait
1.6. Follow the on screen instructions
(You can release vol- when you see activity in flashtool window)
(If you get device disconnected just unplug phone and repeat all from step 1.1)
1.7. Don't touch anything until blue progress bar disappears. You should see Device disconnected> Device connected in flash mode.
(Don't worry if bar gets stuck near end just let it do it's thing)
1.8. Disconnect phone and reboot
1.9. Done!!!
(Do only basic setup, we won't be staying on this rom for long)
2. ROOTING .108 FIRMWARE
2.1. Make sure USB debugging is enabled
2.2. Download THIS Easy Root Tool by zxz0O0
2.3. Unzip and run install.bat
2.4. Download SuperSu apk form HERE put it in internal storage and install it.
2.5. Update binary normally.
2.6. Done!!! You should have root now.
(Download Root Checker to make sure you do)
3. TA PARTITION BACKUP
(NOTE: This is absolutely not necessary and is only needed if you plan to go back to stock firmware AND use BionZ, X-Reality and Music ID/Gracenote. TA partition and DRM keys stored inside get erased when you unlock bootloader.
3.1 Download THIS Backup TA v9.11 by DevShaft
3.2. Extract and run Backup-TA.bat. You should see backup>TA backup.zip in main folder where you extracted
3.3. Backup whole folder to cloud since you can't flash someone's else backup if you loose yours
3.4. Done!!!
(Read linked thread for useful information and FAQ)
4. UNLOCKING BOOTLOADER
4.1. Dial *#06# on your device. You will see your IMEI code
4.2. Go HERE and scroll to bottom
4.3. Under select device select Z1 Compact and enter your IMEI code
4.4. Check the 2 boxes and click on submit. You will get your unlock code. Copy it to clipboard
4.5. Run Flashtool again and click on "BLU" button
4.6. Connect phone in flashmode.
4.7. When prompted, enter your unlocking code that you copied form SONY website
4.8. Click unlock.
(Follow any instructions that flashtool gives you. I don't remember if there are any after this)
4.9. Done!!! Your bootloader is unlocked!
5. FLASHING RECOVERY
This is how I did it. You can try to skip step 5.2. If it doesn't work try again following all steps
5.1. Download THIS TWRP by 115ek and extract recovery image in new folder
5.2. Run Flashtool and flash 14.6.A.1.236 just like you did with .108 in first step (If you have problems here see THIS comment)
5.3. Now without rebooting or disconnecting your phone flash THIS open bootloader with flashtool just like you flashed system ftf-s.
5.4. Disconnect your phone and press volume up and connect your data cable. You should see blue led.
5.5. Now enter that folder where you extracted recovery image and press shift and right click in empty window area and select Open Command window here (Powershell for windows 10 users should work fine I think. Never used it)
5.6. Type "fastboot flash recovery recovery.img" and hit enter.
5.6 Done!!! You should have your recovery now.
To reboot to recovery first disconnect your phone and hold volume down and power button. Release power button when phone vibrates but keep holding volume down until you see twrp logo.
AND THAT IS IT
Now that you have your recovery and unlocked bootloader you can flash whatever roms, kernels, mods that you want for your phone.
Thanks to:
derjango for his thread mentioned above
munjeni For supplying open bootloader ftf and for giving me support with my problems
Androxyde For Flashtool
Snoop05 For ADB driver tool
zxz0O0 For Root tool And PRF Creator tool
DevShaft For Backup TA tool
115ek For TWRP
[NUT] For XZDualRecovery
kulvertti For SuperSu Dummy

Placeholder

I'm really struggling to get past unlocking the bootloader and starting to get quite confused.
Sony Companion is up to date.
Flashtool installed and used to flash .108 firmware.
Device is rooted using Easyroot tool.
Supersu installed and binary updated.
When I go to run BLU in Flashtool it prompts me to connect my device whilst holding the volume-down button (so flash mode). A couple of seconds after doing that it prompts me to re-connect the device whilst holding the volume-up button (so fastboot mode), but nothing happens. Blue LED is on the device, but Flashtool does absolutely nothing.
When I check Flashtool-driver it does fail to install the AndroidUsbDeviceClass driver, but when I run the 15-second ADB Installer it completes successfully - plus I was able to flash the firmware earlier so I don't see why I'd now have a driver issue.
Any ideas? It's starting to drive me crazy.

Here is what you can try.
Connect your phone to pc and in command prompt type adb reboot bootloader or hold vol+ and connect your phone
Your phone will be booted to fastboot now
Now type fastboot devices
You should see
XXXXXXXXXblabla fastboot
If you see this that means that your phone is recognized in fastboot by your pc.
If you see <waiting for device> or something else go to your device manager while still in fastboot
IIRC you should see under other devices something like saXXXX or something
You can tell me what exactly it says or you can fix it yourself by googling that number and adding fastboot driver and update it manually through device manager
If you decide to do it yourself make sure you link me website where you link me thread where you found driver and write down instructions so other people can see it
If you have any other problems feel free to reply
Also i just noticed that i didn't include that you lose ta partition when ubl and since you don't have ta backup make sure you make one. You never know when you might need it

Ok, thanks for that I definitely had a problem with driver installation so followed the steps in this video - https://www.youtube.com/watch?v=fcz4o6fpDGc
Now I am a bit stuck on flashing recovery.
5.2. Run Flashtool and flash 14.6.A.1.236 just like you did with .108 in first step --- do I also check both options under Wipe? will this not remove root?
5.3. Now without rebooting or disconnecting your phone flash THIS just like you did with system ftf-s. --- not sure what I'm meant to do here

Glad you fixed that problem
Flash that file through flashtool just like you flashed system ftf
Also yes that will remove root but we had that root only to backup ta and unlock bootloader. Since you unlocked bootloader and you install twrp you can easily root any rom

I get the "'fastboot' is not a recognised ..." error when trying to flash recovery - using Windows PowerShell as I'm on Win10.
EDIT: running CMD then moving to the location of where ADB was installed and contains Fastoot.exe worked.
Thanks for the guide!

scanz said:
I get the "'fastboot' is not a recognised ..." error when trying to flash recovery - using Windows PowerShell as I'm on Win10.
Click to expand...
Click to collapse
That means you don't have fastboot drivers installed. Here is temporary fix that got me out of frustrating situations when i can't install drivers systemwise
https://mega.nz/#F!aBoUXI5Q!RmxLAO638aHNJKLwo00Hew
If it downloads as zip first unzip it and run command prompt/powershell in that folder or in powershell type cd and drag that folder, that should do the same.
fastboot will now be recognised as command
this also includes adb drivers

Just wondering, I'm trying to get Magisk running after finishing the steps in your guide, but it does not pass any of the SafetyNet checks - even basicIntegrity check comes back false. Have you any ideas or experience with this? If so perhaps you could include it as part of the guide

If you get cts fasle that means you flashed rom that comes with supersu preinstalled. You could try installing rom without magisk and removing su then flashing mahgisk.
Not sure about integrity tho. I heard that xposed can cause problems with that.

colaigor said:
5.3. Now without rebooting or disconnecting your phone flash THIS with flashtool just like you flashed system ftf-s.
Click to expand...
Click to collapse
I get this:
23/015/2018 22:15:07 - INFO - Selected Bundle for Sony Xperia Z1 Compact(D5503). FW release : 1. Customization : openbootloader
23/015/2018 22:15:07 - INFO - Preparing files for flashing
23/015/2018 22:15:07 - INFO - Please connect your device into flashmode.
23/015/2018 22:15:08 - INFO - Opening device for R/W
23/015/2018 22:15:08 - INFO - Device ready for R/W.
23/015/2018 22:15:08 - INFO - Reading device information
23/015/2018 22:15:08 - INFO - Unable to read from phone after having opened it.
23/015/2018 22:15:08 - INFO - trying to continue anyway
23/015/2018 22:15:08 - INFO - Phone ready for flashmode operations.
23/015/2018 22:15:08 - INFO - Opening TA partition 2
23/015/2018 22:15:08 - INFO - Start Flashing
23/015/2018 22:15:08 - INFO - No loader in the bundle. Searching for one
23/015/2018 22:15:13 - INFO - Processing loader.sin
23/015/2018 22:15:13 - INFO - Checking header
23/015/2018 22:15:13 - ERROR - Processing of loader.sin finished with errors.
23/015/2018 22:15:13 - INFO - Ending flash session
23/015/2018 22:15:13 - ERROR - null
23/015/2018 22:15:13 - ERROR - Error flashing. Aborted
23/015/2018 22:15:14 - INFO - Device connected in flash mode
Click to expand...
Click to collapse

Are you sure you installed flashtool and other drivers? I can't think of any other cause for this problem right now

I flash 14.6.A.1.236 without problems using flashtool, so drivers should be ok; maybe why I'm using a Mac istead Windows?

_Pano_ said:
I flash 14.6.A.1.236 without problems using flashtool, so drivers should be ok; maybe why I'm using a Mac istead Windows?
Click to expand...
Click to collapse
Found this boot bridge for mac users. you may try it and see if it works. Can't really tell you anything about drivers on mac since i never touched one.
Also mega file may be corrupted. You can try downloading from this comment where i downloaded openbl from
Do you have windows machine to try flashing ?

yes, I try tomorrow using Windows 10, thanks

colaigor said:
Found this boot bridge for mac users. you may try it and see if it works. Can't really tell you anything about drivers on mac since i never touched one.
Also mega file may be corrupted. You can try downloading from this comment where i downloaded openbl from
Do you have windows machine to try flashing ?
Click to expand...
Click to collapse
ok, I flash .236 linked in your first post and then without rebooting or disconnecting the device I flash openbootloader and I see:
24/020/2018 09:20:14 - INFO - Closing TA partition
24/020/2018 09:20:14 - INFO - Ending flash session
24/020/2018 09:20:14 - INFO - Flashing finished.
24/020/2018 09:20:14 - INFO - Please unplug and start your phone
24/020/2018 09:20:14 - INFO - For flashtool, Unknown Sources and Debugging must be checked in phone settings
24/020/2018 09:20:16 - INFO - Device connected in flash mode
24/022/2018 09:22:15 - INFO - Selected Bundle for Sony Xperia Z1 Compact(D5503). FW release : 1. Customization : openbootloader
24/022/2018 09:22:15 - INFO - Preparing files for flashing
24/022/2018 09:22:15 - INFO - Please connect your device into flashmode.
24/022/2018 09:22:15 - INFO - Device connected in flash mode
24/022/2018 09:22:16 - INFO - Using Gordon gate drivers version 3.1.0.0
24/022/2018 09:22:16 - INFO - Opening device for R/W
24/022/2018 09:22:16 - INFO - Device connected in flash mode
Click to expand...
Click to collapse
that's all? 1 second flash?

_Pano_ said:
that's all? 1 second flash?
Click to expand...
Click to collapse
Sorry for late answer.
Does it work? I don't remember how much it took to flash tbh

colaigor said:
Sorry for late answer.
Does it work? I don't remember how much it took to flash tbh
Click to expand...
Click to collapse
yes, after various attempts: after flashing .236 I had to disconect and reconnect the phone in order to flash openbootloader; otherwise it doens't flash

thank you for these tutorials..I now have a rooted z1compact lollipop 5.11 locked bootloaders..My question is how can I debloat my phone..I want to uninstall other system apps that I don't need and I want to install xposed on my own..sorry I am newbie

xjhayar09 said:
thank you for these tutorials..I now have a rooted z1compact lollipop 5.11 locked bootloaders..My question is how can I debloat my phone..I want to uninstall other system apps that I don't need and I want to install xposed on my own..sorry I am newbie
Click to expand...
Click to collapse
You can download Titanium backup from playstore and delete all that you dont need and keep what you nees. Also you can find twrp flashable script that deletes all bloatware. Just sreach xperia lolipop debloat script on xda.

Lenovo M10 Plus 3rd Gen Root Guide (TB125FU)

Notice! This process also completely resets your tablet! Backup all files and information.
This is just me documenting my process for rooting my tablet. I am not responsible for any damage or lost information due to the process changing, errors in execution, or mistakes in my documentation. Let me know of any errors, corrections, or updates that may need made.
Thank you to contributors to the thread linked below for the information provided that allowed me to create this more detailed root guide.
Custom Rom / rooting Options vor TB-125FU (Lenovo Tab M10 Plus 3rd Gen)
Hey everyone, I've been looking for options to Install a custom Rom or root since I bought the Tablet several month ago. It seems like there are some options for the Full Hd Version, but I have a hard time finding anything useful for the 125FU...
forum.xda-developers.com
This process was completed on Model: TB125FU
Follow documentation at your own risk!
First I updated my tablet until it was the newest system update available. For me that was version "TB125FU_S000118_220927_ROW"
Step 1 - Install tablet drivers on your computer
Download drivers folder and unzip
https://forum.xda-developers.com/attachments/android_adb_interface-zip.5741369/
Plug tablet into computer
Open Device Manager
You’ll see a line item labeled “ANDROID” with a yellow exclamation mark
Right click on it and select update drivers
Select Browse Computer and navigate to the unzipped driver folder
Make sure the Include Subfolders box is checked and select Next
This will install the drivers for the tablet
Step 2 - Unlock your tablet for usb debugging
Open settings on your tablet
Search for “build”
Click “Build Number”
Click the Build Number box seven times to unlock developer options
Close and reopen the settings app
Under System there is now a Developer options, open it
Toggle the selections for OEM Unlocking and USB debugging
Step 3 - Obtain boot.img
Download and install Lenovo LSMA
https://support.lenovo.com/us/en/downloads/ds101291-rescue-and-smart-assistant-lmsa
plug your tablet into the computer
run program, select rescue
check the allow USB debugging popup on your tablet
select tablet in the LSMA program and select the allow popups on your tablet
select Download when it shows the firmware for your tablet
DO NOT CLICK START RESCUE
close the program when it finishes downloading the ROM
The ROM will download to C:\ProgramData\RSA\Download\RomFiles
Make sure ROM folder name matches the current system update version on your tablet
Copy from the downloaded ROM folder “boot.img” to your tablet
Step 4 - Modify boot.img
Download Magisk apk from the official Github page
https://github.com/topjohnwu/Magisk/releases
install APK on your tablet
open Magisk
Select Install
Select “Select and Patch a File”
Navigate to the location you copied the boot.img file and select the file
Select “Let’s Go”
Wait for flashing lot to say “All done” indicating it modified the boot.img file
Transer modified file to your computer, for me it was called “magisk_patched-25200_rgIWh.img” I then renamed it “magisk_patched.img” to make future typing commands shorter
Step 5 - Unlock bootloader and flash modified boot.img
Download Minimal ADB and Fastboot Tools
I chose to download the portable version
https://forum.xda-developers.com/t/tool-minimal-adb-and-fastboot-2-9-18.2317790/
unzip folder
Place the modified .img file in this folder as well
Navigate to this folder, right click and launch a Command Prompt
Plug in your tablet to your computer if it isn’t already
Type “adb devices” to confirm your computer sees your tablet
Type “adb reboot bootloader” this should reboot your tablet into fastboot
Type “fastboot devices” to confirm the computer sees your tablet
Type “fastboot flashing unlock” read the instructions on screen which will tell you to press the volume up button (volume button closest to power button) to unlock bootloader.
Press the volume up button, It will say it was successful, wait a few seconds for the tablet to return to fastboot
Type “fastboot flash boot magisk_patched.img” and when you hit enter you should see a transferring status on your tablet (if you named your modified .img file something else, type that into the command instead)
When you see the transfer is complete type “fastboot reboot” which will restart the tablet.
The tablet should now be rooted which will completely reset the tablet. You will need to setup the tablet again and reinstall the Magisk app from the official Github. The Magisk App should now have superuser controls
You can relock the bootloader and return the tablet to factory image. IT WILL WIPE ALL DATA AGAIN!
To unroot you just reverse a couple steps.
Put the original boot.img (Make sure it is the boot.img of the same version ROM) in the Minimal ADB and Fastboot Tools folder on your computer
Navigate to this folder, right click, and launch a Command Prompt
Plug in the tablet to your computer
Type “adb reboot bootloader” this should reboot your tablet into fastboot
When the tablet reboots into fastboot type “fastboot flash boot boot.img”
When you see the transfer is complete type “fastboot flashing lock” read the instructions on screen which will tell you to press the volume up button (volume button closest to power button) to lock bootloader. Press the volume up button.
Type “fastboot reboot” which will restart the tablet
You tablet should now be back to normal.
***Note, if you relock the bootloader first it will not let you flash the original boot.img file. If you make that mistake as I did once you'll be able to manually startup recovery mode by first powering off the tablet by holding down the power button, then boot into recovery by holding the power button and the volume up button until the recovery screen appears. Then you can unlock the bootloader again.

Hello,
Please can you confirm that the model you tested is the same as
Lenovo Android TB125​ZAAJ0198SE​
The one above is a mediatek helio G80 4GB+64GB 2000*1200 resolution with Android 12 (bought some days ago, for sure it is M10 Plus 3rd Gen).
Thanks in advance.

Mine is: ZAAJ0401US
The process detailed above should still work on yours. Remember, you will be downloading the boot.img that Lenovo is recommending for your tablet, not using one I uploaded. So you will be rooting your specific file.
I doubt there would be differences between our ROM anyway but even if there were, it wouldn't effect you be because you are creating your own rooted .img.

Thanks for this guide. What system app did you uninstall after rooting?

I didn't remove any system apps when I rooted. I'm sure some are extra and can be removed safely.

Sorry, what is the reason for rooting then, when there are no custom roms yet?

Some apps require root access.

fastboot flash boot magisk_patched-25200_ofAPj.img
Sending 'boot_a' (98304 KB) OKAY [ 2.660s]
Writing 'boot_a' FAILED (remote: 'unknown command')
fastboot: error: Command failed
Click to expand...
Click to collapse
Now what? The bootloader is already unlocked.
EDIT: I had to use the volume keys to select "recovery mode" which opens a menu. From there I have to select "fastboot" (not "bootloader") which displays "fastbootd" (note the "d" on the end), then fastboot commands work.
BUT, after flashing the boot.img, it just powers off after the logo, no option to enter any kind of recovery, no USB connection. At most, if I hold Power for 15 seconds, then release and hold again, sometimes it turns on, and then if I hold VolUp, it boots to a recovery menu, but the only options are "try again" and "factory data reset". if I reset, it shows the animation for half a second, then shuts down.
On this menu it appears in "adb devices" as "unauthorized".
UPDATE: I was able to use Lenovo's "Recovery and Smart Assistant" tool to repair, but it has to be run on a Windows machine (will not connect in VirtualBox). It doesn't recognize the serial number, but by selecting "help finding serial" there's an option for manual entry of model number.
Choosing TB128FU and following the directions I was able to flash the stock firmware, but, the tool downloaded the wrong version. After flashing, the device claims the firmware isn't compatible with the hardware, and shuts down.
To fix this, I've had to find "TB128FU_CN_OPEN_USER_Q00012.0_S_ZUI_13.5.365_ST_220526_qpst" online. The tool downloads to C:\ProgramData\RSA\Downloads\RomFiles. You need to replace the contents of the folder in there (back it up!) with the contents of this, then it will flash a working firmware. (I think you can also use this to flash the patched boot.img, but I haven't tried). The only catch is, this is the Chinese ZIUI firmware, not the Global firmware it came with. It can be used in English, so I might keep it if I can't find the correct Global firmware.
https://wiki.postmarketos.org/wiki/Lenovo_Tab_M10_FHD_Plus_(lenovo_tbx606) PostMarketOS Wiki mentions that another file needs to be flashed any time you enter fastboot to prevent this brick. The article is for a different model, but probably the same applies.

I'm not sure why you got that error if the bootloader was unlocked. My patched .img file only failed like that when I failed to unlock the bootloader first.
Did you toggle the "OEM unlocking" in developer options on the tablet before trying to unlock the bootloader with command prompt commands?
When the bootloader is unlocked the tablet gives a warning message for a few seconds on every boot telling you that the bootloader is unlocked.

The "OEM unlocking" was grayed out saying the bootloader is already unlocked, and it does show the message at startup.
The problem might be that this is model TB128FU (not TB125FU) which is only sold in China, so it doesn't accept the same firmware. I don't know how the seller put the global firmware on it originally.

ok, i think i understand. Your tablet model number is different.
When going through the rooting process it downloaded the wrong version for your tablet without you realizing it so you patched and attempted to install the wrong version of ROM boot.img.
If so it means it is extra important to follow the line in step 3, "Make sure ROM folder name matches the current system update version on your tablet"
It is weird though that the Lenovo Rescue Tool didn't download the correct software for your tablet.

Does anybody know how to unlock bootloader for TB128XU? It is the same tablet but with Snapdragon SOC.
I am failing on unlock command. Both of these won't work :-(
fastboot oem unlock
FAILED (remote: 'unknown command')
fastboot: error: Command failed
fastboot flashing unlock
FAILED (remote: 'unknown command')
fastboot: error: Command failed
Click to expand...
Click to collapse

So everything worked great for me.
As a launcher I now use the Microsoft Launcher.
Nice interface and features.
The OTAs with Magisk Root also work great.
As described by the developer.
Section Devices with A/B Partitions
OTA Upgrade Guides
The Magic Mask for Android
topjohnwu.github.io

Thanks for this! I haven't rooted an Android device since Gingerbread (2.3) in 2010, so it was good to have a basic guide for the newer stuff.
One thing I noticed: Step 1 says to find the "Android" device in Device Manager and manually install the drivers. However, that device didn't appear in Device Manager for me until I booted into fastboot mode. So effectively I had to move step 1 to instead be later, immediately after this sentence:
Type “adb reboot bootloader” this should reboot your tablet into fastboot
Click to expand...
Click to collapse

zippy411 said:
Notice! This process also completely resets your tablet! Backup all files and information.
This is just me documenting my process for rooting my tablet. I am not responsible for any damage or lost information due to the process changing, errors in execution, or mistakes in my documentation. Let me know of any errors, corrections, or updates that may need made.
Thank you to contributors to the thread linked below for the information provided that allowed me to create this more detailed root guide.
Custom Rom / rooting Options vor TB-125FU (Lenovo Tab M10 Plus 3rd Gen)
Hey everyone, I've been looking for options to Install a custom Rom or root since I bought the Tablet several month ago. It seems like there are some options for the Full Hd Version, but I have a hard time finding anything useful for the 125FU...
forum.xda-developers.com
This process was completed on Model: TB125FU
Follow documentation at your own risk!
First I updated my tablet until it was the newest system update available. For me that was version "TB125FU_S000118_220927_ROW"
Step 1 - Install tablet drivers on your computer
Download drivers folder and unzip
https://forum.xda-developers.com/attachments/android_adb_interface-zip.5741369/
Plug tablet into computer
Open Device Manager
You’ll see a line item labeled “ANDROID” with a yellow exclamation mark
Right click on it and select update drivers
Select Browse Computer and navigate to the unzipped driver folder
Make sure the Include Subfolders box is checked and select Next
This will install the drivers for the tablet
Step 2 - Unlock your tablet for usb debugging
Open settings on your tablet
Search for “build”
Click “Build Number”
Click the Build Number box seven times to unlock developer options
Close and reopen the settings app
Under System there is now a Developer options, open it
Toggle the selections for OEM Unlocking and USB debugging
Step 3 - Obtain boot.img
Download and install Lenovo LSMA
https://support.lenovo.com/us/en/downloads/ds101291-rescue-and-smart-assistant-lmsa
plug your tablet into the computer
run program, select rescue
check the allow USB debugging popup on your tablet
select tablet in the LSMA program and select the allow popups on your tablet
select Download when it shows the firmware for your tablet
DO NOT CLICK START RESCUE
close the program when it finishes downloading the ROM
The ROM will download to C:\ProgramData\RSA\Download\RomFiles
Make sure ROM folder name matches the current system update version on your tablet
Copy from the downloaded ROM folder “boot.img” to your tablet
Step 4 - Modify boot.img
Download Magisk apk from the official Github page
https://github.com/topjohnwu/Magisk/releases
install APK on your tablet
open Magisk
Select Install
Select “Select and Patch a File”
Navigate to the location you copied the boot.img file and select the file
Select “Let’s Go”
Wait for flashing lot to say “All done” indicating it modified the boot.img file
Transer modified file to your computer, for me it was called “magisk_patched-25200_rgIWh.img” I then renamed it “magisk_patched.img” to make future typing commands shorter
Step 5 - Unlock bootloader and flash modified boot.img
Download Minimal ADB and Fastboot Tools
I chose to download the portable version
https://forum.xda-developers.com/t/tool-minimal-adb-and-fastboot-2-9-18.2317790/
unzip folder
Place the modified .img file in this folder as well
Navigate to this folder, right click and launch a Command Prompt
Plug in your tablet to your computer if it isn’t already
Type “adb devices” to confirm your computer sees your tablet
Type “adb reboot bootloader” this should reboot your tablet into fastboot
Type “fastboot devices” to confirm the computer sees your tablet
Type “fastboot flashing unlock” read the instructions on screen which will tell you to press the volume up button (volume button closest to power button) to unlock bootloader.
Press the volume up button, It will say it was successful, wait a few seconds for the tablet to return to fastboot
Type “fastboot flash boot magisk_patched.img” and when you hit enter you should see a transferring status on your tablet (if you named your modified .img file something else, type that into the command instead)
When you see the transfer is complete type “fastboot reboot” which will restart the tablet.
The tablet should now be rooted which will completely reset the tablet. You will need to setup the tablet again and reinstall the Magisk app from the official Github. The Magisk App should now have superuser controls
You can relock the bootloader and return the tablet to factory image. IT WILL WIPE ALL DATA AGAIN!
To unroot you just reverse a couple steps.
Put the original boot.img (Make sure it is the boot.img of the same version ROM) in the Minimal ADB and Fastboot Tools folder on your computer
Navigate to this folder, right click, and launch a Command Prompt
Plug in the tablet to your computer
Type “adb reboot bootloader” this should reboot your tablet into fastboot
When the tablet reboots into fastboot type “fastboot flash boot boot.img”
When you see the transfer is complete type “fastboot flashing lock” read the instructions on screen which will tell you to press the volume up button (volume button closest to power button) to lock bootloader. Press the volume up button.
Type “fastboot reboot” which will restart the tablet
You tablet should now be back to normal.
***Note, if you relock the bootloader first it will not let you flash the original boot.img file. If you make that mistake as I did once you'll be able to manually startup recovery mode by first powering off the tablet by holding down the power button, then boot into recovery by holding the power button and the volume up button until the recovery screen appears. Then you can unlock the bootloader again.
Click to expand...
Click to collapse
ok thank you bro for this very clean tuto, for me all went well, all works well, except for the restart where I have the Orange state problem with the 5 sec delay !!! ????
I tried what I was advised:
modify the LK.img, all went very well saying ok on the tab, ok on my Pc, but NO !!!!
I was a brick I think: black screen and nothing.
From there I rescued and redid everything,
conclusion : still the same, all goes except orange state and 5 delay
Can anyone or you ZIPPY411 help me with this please, I am lost with the veritydm pls
Thanks for reading and thanks again for all the work

Tacotac78570 said:
ok thank you bro for this very clean tuto, for me all went well, all works well, except for the restart where I have the Orange state problem with the 5 sec delay !!! ????
I tried what I was advised:
modify the LK.img, all went very well saying ok on the tab, ok on my Pc, but NO !!!!
I was a brick I think: black screen and nothing.
From there I rescued and redid everything,
conclusion : still the same, all goes except orange state and 5 delay
Can anyone or you ZIPPY411 help me with this please, I am lost with the veritydm pls
Thanks for reading and thanks again for all the work
Click to expand...
Click to collapse
By orange state I assume you are describing the unlocked bootloader warning screen.
Unfortunately I don't know of a way to get rid of that delay and warning screen from the boot process. It should not have any effect on your tablet other than just notifying you that the bootloader is unsecured. Rooting a tablet does this and creates a more vulnerable system state that the manufacturer wants to make sure you are aware of. The tablet should boot normally after the few second delay.

zippy411 said:
By orange state I assume you are describing the unlocked bootloader warning screen.
Unfortunately I don't know of a way to get rid of that delay and warning screen from the boot process. It should not have any effect on your tablet other than just notifying you that the bootloader is unsecured. Rooting a tablet does this and creates a more vulnerable system state that the manufacturer wants to make sure you are aware of. The tablet should boot normally after the few second delay.
Click to expand...
Click to collapse
Yeahhh all good bro ty, well I ve just change the lk.img in XD.dex and after flash fastboot the lk_a and perfect ,finish the Orange state

Tacotac78570 said:
Yeahhh all good bro ty, well I ve just change the lk.img in XD.dex and after flash fastboot the lk_a and perfect ,finish the Orange state
Click to expand...
Click to collapse
Hello @Tacotac78570
Could you write a tutorial how to remove orange state? What software you used to remove orange state in lk.img?
Best regards!

tajfunPL said:
Hello @Tacotac78570
Could you write a tutorial how to remove orange state? What software you used to remove orange state in lk.img?
Best regards!
Click to expand...
Click to collapse
Sup bro anyway easy u follow this thread and that take 10 min //
How to remove Orange, Yellow & Red state warnings on MTK
This guide will explain how to hide or remove Yellow, Red and Orange state warnings on a Mediatek Android device. Its ideal for those who feel irritated by constantly seeing these warnings on reboot.
www.hovatek.com

Hello,
Got a new TB125FU with firmware ver. "TB125FU_S000160_230227_ROW".
Anyone tried and succeeded rooting with this version?
Thank you