Yet Another Root Exploit For Thinkpad Tablet … more on the way UPDATED

Works with Honeycomb (Android 3) only. If you’ve upgraded to ICS, you have to wait. Sorry!

UPDATE 2: If rooting fails: do this

Common instructions:

  1. Go to and download the OLDEST update (currently: tablet1/
  2. Put it on SD card and plug the SD card in the tablet
  3. On the tablet enable USB Debugging: [Settings->Applications->Developmnet->USB Debugging]
  4. Download the root script package here
  5. unpacking will create directory: yareftpt
  6. (Windows only)If the lenovo driver is not installed on your PC, install it :
  7. (Linux Only)Make sure adb is in your PATH
  8. Connect the tablet to the PC (USB)
  9. Make sure you know how to boot the tablet in Recovery mode:
    – Shutdown, then start it, in the moment “LENOVO” image appears on the screen, press “Volume Up” few times
    – You can navigate through the menu with the volume buttons, and select option with the power button
    – If everything ok, just reboot in normal mode
  10. on the PC, go to command line, and navigate to that directory where you’ve unpacked the exploit download.

Windows instructions:

  1. On command line execute: run.bat
  2. Follow on-screen instructions

Linux instructions:

  1. execute ./
  2. Follow the on screen instructions

If rooting failed, do not retry immediately:
First reinstall your CURRENT update,
enable USB debugging
finally, redo the whole rooting procedure (including: Installation of VERY OLD update)
Ack: thanks to Driver’z on xda for
discovering it

Ack: thanks to @djrbliss, without his tpt exploit this one would not be possible.

This program/instructions come with ABSOLUTELY NO WARRANTY.

About these ads
This entry was posted in tpt and tagged . Bookmark the permalink.

12 Responses to Yet Another Root Exploit For Thinkpad Tablet … more on the way UPDATED

  1. Stewart Adam says:

    Yay! Root works with 0089_ROW (OTA 2.5) The issue was with the bootloader USB drivers. I did a factory reset, but that was unnecessary in my view.
    Do make sure you have the right drivers and lines in the
    android_winusb.inf file:
    %SingleAdbInterface% = USB_Install, USB\VID_0955&PID_7000
    %CompositeAdbInterface% = USB_Install, USB\VID_0955&PID_7100&MI_01
    ;NVIDIA Tegra %SingleAdbInterface% = USB_Install, USB\VID_17EF&PID_741C
    %CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741C&MI_01
    ;Lenovo Think Tablet
    ;%CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741B&MI_01
    ;%CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741C&MI_01
    ;%CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741D&MI_02
    ;%CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741E&MI_02
    The script does work. So now I have 0089_ROW with root.

  2. tpcollector says:

    Wonderful! I just updated to OTA2.5 and lost my root and re-rooted it now with these instructions. Impressive piece of work.

  3. Bigfreak says:

    Thx rooted successfully my Thinkpad tablet

  4. Belly says:

    Rooted A310_02_0024_0089_US

  5. Ambar Rahie says:

    Thanks for your help. Successfully rooted my think-pad tablet
    Android 3.1

    Hope you can help us with the root on ICS being released in May.

  6. Dimi says:

    @Stewart Adam: How dude!? I am trying but no luck!

  7. Patricio says:


    I’m sorry to report that this didn’t work for me. I have just bought my TPT and have not applied any OTA. Buildnumber is ThinkPadTablet_A310_02_0039_0089_US.

    The only clearly suspicious parts are the
    * expected failed update from external storage. I get an error about “assert failed” and my windows 7 starts trying to install some drivers but failed.
    * After following “When wipe cache complete, press .” I got some “mkdir failed for …, file exists”

    Then, after the reboot, I only get an “The system update failed. Please try again. Version: ThinkpadTablet_A310_02_0039_0089_US” message on the tablet, and /cache/recovery/pwn/su on “adb shell” gives me permission denied.

    Any help would be greatly appreciated!

    .at. oan
    .dot. cl

    My full log is
    Lenovo Thinkpad Tablet root script
    Exploit copyright (C) 2012 @opdecirkel
    This program comes with ABSOLUTELY NO WARRANTY
    Licensed under WTFPL
    ECHO está desactivado.
    Make sure:
    1. You have external SD pluged in the tablet card with ThinkPadTablet_A310_02_00 (from lenovo) on it
    2. Your tablet is in dev mode [Settings->Applications->Development->USB Debuggin
    3. Lenovo USB driver is installed
    IF NOT, press Ctrl-C. To continue press
    Presione una tecla para continuar . . .
    4. Reboot in RECOVERY: (shutdown the tablet, then start it and press volume + fe
    w times until it starts in recovery)
    5. Go to apply update, select the update from the sdcard and try to apply it. It
    will fail, but that is OK.
    5. Then, go to ‘WIPE CACHE PARTITION’ and select it (navigate with volume button
    s and select it with power button),
    6. When wipe cache complete, press (here) .
    Presione una tecla para continuar . . .
    mkdir failed for /data/local/pwn, File exists
    mkdir failed for /data/local/pwn-bak, File exists
    727 KB/s (22364 bytes in 0.030s)
    7. On the device, go to ‘DISABLE BATTERY DISCHARGE’ and select it. When complete
    press (here)
    Presione una tecla para continuar . . .
    8. On the device, select REBOOT. When startup COMPLETE press (here)
    Presione una tecla para continuar . . .
    1307 KB/s (843503 bytes in 0.630s)
    1293 KB/s (1867568 bytes in 1.410s)
    1091 KB/s (22364 bytes in 0.020s)
    120 KB/s (1232 bytes in 0.010s)
    Your PC command prompt appears next. Do the following things:
    1. adb shell
    when ‘$’ (adb shell) appear, do:
    2. /cache/recovery/pwn/su
    when ‘#’ appears. You are root. run the following:
    3. /data/local/pwn/
    C:\android-sdk\platform-tools\thinkpad\yareftpt>adb shell
    $ /cache/recovery/pwn/su
    /cache/recovery/pwn/su: permission denied

  8. Janis says:

    I had to do the double-up method, but it worked a dream. Thank you, thank you, thank you!

  9. Aleksey says:

    go to recovery (do not or run.bat). While in recovery (after “installing” the failing update AND wiping out cache partition), do
    adb shell
    when you get the shell prompt ($)

    ADB shell log:
    $ /system/bin/mount
    /system/bin/mount: not found

  10. Garypen says:

    Worked great on my 1838-25U w/ A310_02_0024_0089_US


  11. Dan Finn says:

    I have A310_02_0039_0089_US and it worked after one retry as per instructions.

  12. Slava says:

    I have A310_02_0039_0089_RAW, tried few time no success.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s