Yet Another Root Exploit For Thinkpad Tablet … more on the way UPDATED

Works with Honeycomb (Android 3) only. If you’ve upgraded to ICS, you have to wait. Sorry!

UPDATED TO WORKAROUND THE ro.kernel.qemu MODE REMOVAL FROM ADBD
UPDATE 2: If rooting fails: do this

Common instructions:

  1. Go to http://download.lenovo.com/slates/think/tablet1/ and download the OLDEST update (currently: tablet1/ThinkPadTablet_A310_02_0024_0060_US.zip)
  2. Put it on SD card and plug the SD card in the tablet
  3. On the tablet enable USB Debugging: [Settings->Applications->Developmnet->USB Debugging]
  4. Download the root script package here
  5. unpacking yareftpt2.zip will create directory: yareftpt
  6. (Windows only)If the lenovo driver is not installed on your PC, install it : http://support.lenovo.com/en_US/downloads/detail.page?DocID=DS022366
  7. (Linux Only)Make sure adb is in your PATH
  8. Connect the tablet to the PC (USB)
  9. Make sure you know how to boot the tablet in Recovery mode:
    – Shutdown, then start it, in the moment “LENOVO” image appears on the screen, press “Volume Up” few times
    – You can navigate through the menu with the volume buttons, and select option with the power button
    – If everything ok, just reboot in normal mode
  10. on the PC, go to command line, and navigate to that directory where you’ve unpacked the exploit download.

Windows instructions:

  1. On command line execute: run.bat
  2. Follow on-screen instructions

Linux instructions:

  1. execute ./run.sh
  2. Follow the on screen instructions




If rooting failed, do not retry immediately:
First reinstall your CURRENT update,
enable USB debugging
finally, redo the whole rooting procedure (including: Installation of VERY OLD update)
Ack: thanks to Driver’z on xda for
discovering it

Ack: thanks to @djrbliss, without his tpt exploit this one would not be possible.

This program/instructions come with ABSOLUTELY NO WARRANTY.

This entry was posted in tpt and tagged . Bookmark the permalink.

15 Responses to Yet Another Root Exploit For Thinkpad Tablet … more on the way UPDATED

  1. Stewart Adam says:

    Yay! Root works with 0089_ROW (OTA 2.5) The issue was with the bootloader USB drivers. I did a factory reset, but that was unnecessary in my view.
    Do make sure you have the right drivers and lines in the
    android_winusb.inf file:
    Code:
    [Google.NTamd64]
    ;
    ;NVIDIATegra
    %SingleAdbInterface% = USB_Install, USB\VID_0955&PID_7000
    %CompositeAdbInterface% = USB_Install, USB\VID_0955&PID_7100&MI_01
    ;
    ;NVIDIA Tegra %SingleAdbInterface% = USB_Install, USB\VID_17EF&PID_741C
    %CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741C&MI_01
    ;
    ;Lenovo Think Tablet
    ;%CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741B&MI_01
    ;%CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741C&MI_01
    ;%CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741D&MI_02
    ;%CompositeAdbInterface% = USB_Install, USB\VID_17EF&PID_741E&MI_02
    The script does work. So now I have 0089_ROW with root.

  2. tpcollector says:

    Wonderful! I just updated to OTA2.5 and lost my root and re-rooted it now with these instructions. Impressive piece of work.

  3. Bigfreak says:

    Thx rooted successfully my Thinkpad tablet

  4. Belly says:

    Successful!!!!
    Rooted A310_02_0024_0089_US

  5. Ambar Rahie says:

    Thanks for your help. Successfully rooted my think-pad tablet
    A310_02_0039_0089_US
    Android 3.1

    Hope you can help us with the root on ICS being released in May.

  6. Pingback: Problem bei ICS Update "Recovery v5.5.0.4." - Seite 2 - Android-Hilfe.de

  7. Dimi says:

    @Stewart Adam: How dude!? I am trying but no luck!

  8. Patricio says:

    Hi,

    I’m sorry to report that this didn’t work for me. I have just bought my TPT and have not applied any OTA. Buildnumber is ThinkPadTablet_A310_02_0039_0089_US.

    The only clearly suspicious parts are the
    * expected failed update from external storage. I get an error about “assert failed” and my windows 7 starts trying to install some drivers but failed.
    * After following “When wipe cache complete, press .” I got some “mkdir failed for …, file exists”

    Then, after the reboot, I only get an “The system update failed. Please try again. Version: ThinkpadTablet_A310_02_0039_0089_US” message on the tablet, and /cache/recovery/pwn/su on “adb shell” gives me permission denied.

    Any help would be greatly appreciated!

    Pato
    .at. oan
    .dot. cl

    —-
    My full log is
    C:\android-sdk\platform-tools\thinkpad\yareftpt>run.bat
    Lenovo Thinkpad Tablet root script
    Exploit copyright (C) 2012 @opdecirkel
    This program comes with ABSOLUTELY NO WARRANTY
    Licensed under WTFPL
    ECHO está desactivado.
    Make sure:
    1. You have external SD pluged in the tablet card with ThinkPadTablet_A310_02_00
    24_0060_US.zip (from lenovo) on it
    2. Your tablet is in dev mode [Settings->Applications->Development->USB Debuggin
    g.]
    3. Lenovo USB driver is installed
    IF NOT, press Ctrl-C. To continue press
    Presione una tecla para continuar . . .
    [*]
    [*]
    [*]
    4. Reboot in RECOVERY: (shutdown the tablet, then start it and press volume + fe
    w times until it starts in recovery)
    5. Go to apply update, select the update from the sdcard and try to apply it. It
    will fail, but that is OK.
    5. Then, go to ‘WIPE CACHE PARTITION’ and select it (navigate with volume button
    s and select it with power button),
    6. When wipe cache complete, press (here) .
    Presione una tecla para continuar . . .
    [*]
    [*]
    [*]
    mkdir failed for /data/local/pwn, File exists
    mkdir failed for /data/local/pwn-bak, File exists
    727 KB/s (22364 bytes in 0.030s)
    7. On the device, go to ‘DISABLE BATTERY DISCHARGE’ and select it. When complete
    press (here)
    Presione una tecla para continuar . . .
    8. On the device, select REBOOT. When startup COMPLETE press (here)
    Presione una tecla para continuar . . .
    1307 KB/s (843503 bytes in 0.630s)
    1293 KB/s (1867568 bytes in 1.410s)
    1091 KB/s (22364 bytes in 0.020s)
    120 KB/s (1232 bytes in 0.010s)
    Your PC command prompt appears next. Do the following things:
    1. adb shell
    when ‘$’ (adb shell) appear, do:
    2. /cache/recovery/pwn/su
    when ‘#’ appears. You are root. run the following:
    3. /data/local/pwn/pwn-in.sh
    C:\android-sdk\platform-tools\thinkpad\yareftpt>adb shell
    $ /cache/recovery/pwn/su
    /cache/recovery/pwn/su
    /cache/recovery/pwn/su: permission denied
    $

    • Patricio says:

      Update to my previous post: I am rooted!

      Maybe some of you are having the same problem…. I could only interpret correctly the instructions after reading the whole original thread at the forums. My problem was that I was not reading

      ‘First reinstall your CURRENT update,
      enable USB debugging
      finally’

      As

      ‘ First download from Lenovo your CURRENT update, copy it to the SD, and then install it from recovery,then
      enable USB debugging
      finally,… ‘

      Also,the message about failing to install old update after reboot can be safely ignored.

      Good luck!

  9. Janis says:

    I had to do the double-up method, but it worked a dream. Thank you, thank you, thank you!

  10. Aleksey says:

    Root not granted.
    ThinkPadTablet_A310_02_0039_0089_ROW
    on PC – Windows 7 Home Basic RUS

    script log:
    Lenovo Thinkpad Tablet root script
    Exploit copyright (C) 2012 @opdecirkel
    This program comes with ABSOLUTELY NO WARRANTY
    Licensed under WTFPL
    Режим вывода команд на экран (ECHO) отключен.
    Make sure:
    1. You have external SD pluged in the tablet card with ThinkPadTablet_A310_02_00
    24_0060_US.zip (from lenovo) on it
    2. Your tablet is in dev mode [Settings->Applications->Development->USB Debuggin
    g.]
    3. Lenovo USB driver is installed
    IF NOT, press Ctrl-C. To continue press
    Для продолжения нажмите любую клавишу . . .
    [*]
    [*]
    [*]
    4. Reboot in RECOVERY: (shutdown the tablet, then start it and press volume + fe
    w times until it starts in recovery)
    5. Go to apply update, select the update from the sdcard and try to apply it. It
    will fail, but that is OK.
    5. Then, go to ‘WIPE CACHE PARTITION’ and select it (navigate with volume button
    s and select it with power button),
    6. When wipe cache complete, press (here) .
    Для продолжения нажмите любую клавишу . . .
    [*]
    [*]
    [*]
    /system/bin/mkdir: not found
    /system/bin/mkdir: not found
    cannot create /data/local/pwn-bak/install-recovery.sh.orig: directory nonexisten
    t
    /system/bin/mkdir: not found
    992 KB/s (22364 bytes in 0.022s)
    /system/bin/rm: not found
    /system/bin/ln: not found
    7. On the device, go to ‘DISABLE BATTERY DISCHARGE’ and select it. When complete
    press (here)
    Для продолжения нажмите любую клавишу . . .
    /system/bin/rm: not found
    8. On the device, select REBOOT. When startup COMPLETE press (here)
    Для продолжения нажмите любую клавишу . . .
    1175 KB/s (843503 bytes in 0.701s)
    1151 KB/s (1867568 bytes in 1.584s)
    623 KB/s (22364 bytes in 0.035s)
    35 KB/s (1232 bytes in 0.034s)
    /system/bin/chmod: not found
    Your PC command prompt appears next. Do the following things:
    1. adb shell
    when ‘$’ (adb shell) appear, do:
    2. /cache/recovery/pwn/su
    when ‘#’ appears. You are root. run the following:
    3. /data/local/pwn/pwn-in.sh

    CMD windows don’t appear.

  11. Aleksey says:

    go to recovery (do not run.sh or run.bat). While in recovery (after “installing” the failing update AND wiping out cache partition), do
    adb shell
    when you get the shell prompt ($)
    /system/bin/mount

    ADB shell log:
    $ /system/bin/mount
    /system/bin/mount
    /system/bin/mount: not found

  12. Garypen says:

    Worked great on my 1838-25U w/ A310_02_0024_0089_US

    Thanks!

  13. Dan Finn says:

    I have A310_02_0039_0089_US and it worked after one retry as per instructions.

Leave a reply to Ambar Rahie Cancel reply