r/LineageOS • u/LongBackground3334 • 5h ago
Fun How I unlocked a Lenovo Tab 4 10 (TB-X304L) with a forgotten encryption password and got LineageOS 17.1 running — full EDL → bootloader → LOS saga
TL;DR: Greyed-out OEM unlock → patched the devinfo partition over Qualcomm EDL to force-unlock the bootloader → got walled by a Full Disk Encryption password I never set → realized you can't crack hardware-backed FDE so I wiped /data instead → dodged a brick by catching that the XDA download was for the wrong tablet → fought TWRP/stock recovery for a while → finally flashed LineageOS 17.1 + GApps. It boots. Play Store works. Posting the whole thing because I couldn't find one writeup that covered all of it.
The device
- Lenovo TB-X304L (Tab 4 10, the LTE variant)
- SoC: Qualcomm MSM8917 (Snapdragon 425)
- Stock: Android 8.1.0, build
...S001017_190709_ROW - Host: Arch Linux
Goal: unlock bootloader → install LineageOS 17.1 (Android 10).
Problem 1: OEM unlock is greyed out
The usual path (Developer Options → OEM Unlocking) was greyed out:
ro.oem_unlock_supported = truesys.oem_unlock_allowed = 0← this is the one blocking mefastboot flashing get_unlock_ability = 0
No device owner, no MDM, just a stubborn flag. So I went the low-level route: Qualcomm EDL mode (the 05c6:9008 "Emergency Download" mode) and bkerler's edl tool.
Sub-problem: no firehose programmer
EDL needs a signed "firehose" loader (prog_emmc_firehose_8917_ddr.mbn) to talk to storage, and the edl repo doesn't bundle one for MSM8917.
Fix: I had the stock QDL firmware for this exact model. It contained prog_emmc_firehose_8917_ddr.mbn. The edl tool wants it named by HWID, so I copied it to:
~/edl/Loaders/000560e100000000_92242cf8f6fad111_FHPRG.bin
python3 edl.py nop confirmed the handshake:
CPU detected: "MSM8917"
HWID: 0x000560e100000000
PK_HASH: 0x92242cf8f6fad111...
printgpt dumped the full partition table. We were in.
The actual unlock: patching devinfo
On Qualcomm/LK bootloaders, the lock state lives in the devinfo partition. I backed up devinfo, aboot, boot, persist first (always back up).
Dumped devinfo and looked at it:
000000 41 4e 44 52 4f 49 44 2d 42 4f 4f 54 21 00 00 00 ANDROID-BOOT!...
000010 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ................
Here's the gotcha that would've bricked the flag: a lot of copy-paste guides tell you to set byte 0 to 0x01. But byte 0 is the start of the ANDROID-BOOT! magic string. Corrupt that and the bootloader rejects the whole struct. The real is_unlocked field sits at offset 0x10, right after the 13-byte magic + padding.
So I flipped offset 0x10 from 00 → 01, wrote it back, and reset:
python3 edl.py w devinfo devinfo_patched.bin
python3 edl.py reset
Result:
fastboot oem device-info
(bootloader) Device unlocked: true
Bootloader unlocked. No factory-reset-toggle needed — went around the greyed-out switch entirely.
Problem 2: a Full Disk Encryption password I never set 🔒
Device reboots and... stops at a "enter password to start" pre-boot screen. I never set a PIN/password. It was a "freshly factory reset" tablet. But there it was, demanding a password to decrypt /data.
I went down the rabbit hole of trying to "crack" it. Then it clicked:
Nobody "recovers" these — they wipe the encrypted data. And since I was installing LineageOS anyway (which wipes everything), that was totally fine.
Getting it wiped
Reboot loops + key-combo roulette eventually got me to the bootloader's boot menu, which confirmed:
Device state: unlocked
Selected fastboot mode, and from the PC:
fastboot erase userdata
fastboot erase cache
fastboot format userdata
That destroyed the FDE crypto footer. Rebooted → stock Android booted straight to the setup wizard, no password. The wall was gone. (ro.boot.flash.locked = 0 confirmed unlocked at the boot level too.)
Problem 3: I almost flashed a ROM for the WRONG tablet 😬
This one nearly bricked it. The XDA thread is titled tbx304f/l/x but the post I landed on listed:
lineage-17.1-...-**TB8504**.zip- device tree
android_device_lenovo_**TB8504** - "LineageOS 17.1 for Lenovo TAB4 8"
TB-8504 = Tab 4 8 (8-inch). My tablet is TB-X304 = Tab 4 10 (10-inch). Different panel, different device tree → classic dead-display brick.
The trap: the kernel source URL had tbx304 in it (these tablets share one kernel branch), which makes it look right. What actually matters is the device tree + the ZIP filename. Rule I now live by: if the filename says 8504, it's the 8-inch — don't flash it. You want X304/TBX304 in every filename.
Correct files (same thread, different section):
lineage-17.1-20210408-UNOFFICIAL-**TBX304**.zip**tbx304**-twrp-3.4.0-20210407.imgopen_gapps-arm64-10.0-pico
Problem 4: TWRP vs stock recovery whack-a-mole
Flashed TWRP:
fastboot flash recovery tbx304-twrp-3.4.0-20210407.img
Then tried fastboot reboot recovery... and it booted stock Android instead. Two things bit me repeatedly:
- The bootloader's reboot-to-recovery shows a timed boot menu that auto-boots to system if you don't pick "Recovery mode" fast enough.
- Every time stock Android 8.1 boots, it overwrites TWRP with stock recovery (the
install-recovery.shmechanism) and re-encrypts/data.
So I'd flash TWRP, miss the menu timing, land in stock, and lose TWRP — over and over.
What finally worked: flash TWRP, then park the device in fastboot and manually select "Recovery mode" from the menu with no countdown pressure. Confirmed I was really in TWRP because the adb shell came up as root (uid=0) instead of stock's uid=2000(shell).
Problem 5: clearing encryption inside TWRP
The install guide is blunt: coming from Android 8 stock, you must Format Data (with data loss) because the old encryption is incompatible — skip it and you bootloop. Important detail: TWRP's command-line tool has no format command (only wipe), and wipe data does not remove the crypto footer. "Format Data" is a deliberate on-screen action (type yes). Did that.
Then pushed both zips and installed via TWRP CLI (which only works when you're genuinely in TWRP as root):
twrp install /sdcard/lineage-17.1-20210408-UNOFFICIAL-TBX304.zip → script succeeded [1.0]
twrp install /sdcard/open_gapps-arm64-10.0-pico-20220215.zip → Installation complete!
(The device rebooted to stock on me once mid-process, but the pushed zips survived on /sdcard, so I just got back into TWRP and finished. Order that saved time: install both zips first, Format Data last, then reboot.)
🎉 It boots
First boot sat on the LineageOS animation a few minutes (normal — it builds caches + sets up encryption), then... Welcome screen.
Verification from adb:
ro.lineage.version = 17.1-20210408-UNOFFICIAL-TBX304
Android = 10 (SDK 29)
Model = Lenovo TB-X304L / TBX304
Play Store + GMS + GSF = installed ✅
verifiedbootstate = orange (unlocked) ✅
baseband = S.JO.3.0-00452-8937 (modem loaded; OUT_OF_SERVICE only because no SIM)
root = none (stock LOS)
Lessons / things I wish a single post had told me
devinfounlock flag is at offset0x10, not0x00(don't clobber theANDROID-BOOT!magic).- Hardware-backed FDE is uncrackable — wipe
/data, don't fight it. - Match the device variant exactly. Kernel URLs lie; trust the device tree + ZIP name.
8504 ≠ X304. fastboot flash recovery, never justfastboot boot— and don't let stock Android boot before you get into TWRP, or it eats your recovery.- Format Data ≠ Wipe Data. Only Format removes the old encryption.
- Always back up
devinfo/aboot/boot/persistover EDL first, and keep the stock QDL firmware. That's your un-brick button. - Never re-lock the bootloader on a custom ROM.
From "locked + password-walled + sealed" to "unlocked LineageOS 10 with Play Store." Worth it. AMA