Lenovo IdeaPad K1 Unlock

A friend of mine asked me to take a look at a locked IdeaPad K1 that she got from work for free. (Seems like Lenovo is happening a lot to me this month.) Turns out it was pretty easy to unlock.

I used the khanning official ICS build, which is a stock Android Ice Cream Sandwich build, with Google Apps installed.

Contents of the archive look like so:

Archive:  K1_ICS_120607_Stock.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  2012-07-26 20:06   drivers/
     9355  2012-06-07 18:42   drivers/NvidiaUsb.inf
        0  2012-07-26 20:06   drivers/amd64/
  1533512  2012-06-07 18:42   drivers/amd64/WUDFUpdate_01007.dll
  1197128  2012-06-07 18:42   drivers/amd64/WUDFUpdate_01007_chk.dll
  1919968  2012-06-07 18:42   drivers/amd64/WdfCoInstaller01005.dll
  1490656  2012-06-07 18:42   drivers/amd64/WdfCoInstaller01007.dll
  1087200  2012-06-07 18:42   drivers/amd64/WdfCoInstaller01007_chk.dll
   708168  2012-06-07 18:42   drivers/amd64/WinUSBCoInstaller.dll
   724040  2012-06-07 18:42   drivers/amd64/WinUSBCoInstaller_chk.dll
     4258  2012-06-07 18:42   drivers/amd64/android_usb.inf
    31744  2012-06-07 18:42   drivers/amd64/androidusb.sys
     8569  2012-06-07 18:42   drivers/amd64/androidusba64.cat
        0  2012-07-26 20:06   drivers/x86/
  1302600  2012-06-07 18:42   drivers/x86/WUDFUpdate_01007.dll
   997960  2012-06-07 18:42   drivers/x86/WUDFUpdate_01007_chk.dll
  1419232  2012-06-07 18:42   drivers/x86/WdfCoInstaller01005.dll
  1112288  2012-06-07 18:42   drivers/x86/WdfCoInstaller01007.dll
   815328  2012-06-07 18:42   drivers/x86/WdfCoInstaller01007_chk.dll
   581192  2012-06-07 18:42   drivers/x86/WinUSBCoInstaller.dll
   592968  2012-06-07 18:42   drivers/x86/WinUSBCoInstaller_chk.dll
     4265  2012-06-07 18:42   drivers/x86/android_usb.inf
    25728  2012-06-07 18:42   drivers/x86/androidusb.sys
        0  2012-07-26 22:44   files/
    89122  2012-06-07 18:42   files/blob.bin
  3723264  2009-01-01 00:00   files/boot.img
  1393296  2012-06-07 18:42   files/bootloader.bin
     4080  2012-06-07 18:42   files/flash.bct
     2647  2012-06-07 18:42   files/flash.cfg
    54272  2012-04-05 14:40   files/libnv3p.dll
    45056  2012-04-05 14:40   files/libnvaes_ref.dll
    81920  2012-04-05 14:40   files/libnvapputil.dll
    43520  2012-04-05 14:40   files/libnvboothost.dll
    45056  2012-04-05 14:40   files/libnvdioconverter.dll
    80896  2012-04-05 14:40   files/libnvflash.dll
   101376  2012-04-05 14:40   files/libnvos.dll
    96768  2012-04-05 14:40   files/libnvtestio.dll
    44544  2012-04-05 14:40   files/libnvusbhost.dll
  1195311  2012-06-07 18:42   files/nvflash
   221696  2012-04-05 14:40   files/nvflash.exe
   512292  2012-06-07 18:42   files/nvsbktool
  4061184  2009-01-01 00:00   files/recovery.img
440401920  2012-07-26 21:46   files/system.img
  6344840  2012-06-07 18:41   files/userdata.img
      224  2012-07-26 22:42   flash-linux.sh
      231  2012-07-26 22:58   flash-win.bat
---------                     -------
474109674                     46 files

On 64-bit Ubuntu 15.04, when I tried to run the flash-linux.sh script, it kept giving me the following error:

$ ./flash-linux.sh 
Flashing ICS Stock Rom for Lenovo Ideapad K1
build 120607
./flash-linux.sh: line 7: ./nvflash: No such file or directory

Turns out this is because the nvflash executable was built for 32-bit systems only, so you have to install the 32-bit support libraries on Ubuntu, which goes like this:

sudo apt-get install libc6-i386 libstdc++6:i386

Then if you run the flash-linux.sh script as a normal user, you get a “Permission Denied” error, as it tries to access a resource for privileged users:

Flashing ICS Stock Rom for Lenovo Ideapad K1
build 120607
Nvflash v1.8.90246 started
Using blob v1.1.57813
Permission Denied

So you run it as sudo and… the device is missing:

Flashing ICS Stock Rom for Lenovo Ideapad K1
build 120607
Nvflash v1.8.90246 started
Using blob v1.1.57813
USB device not found

So you disconnect and reconnect the tablet, and put the tablet into NVFlash / APX mode, et voilà!

[  453.540020] usb 3-5: new high-speed USB device number 4 using ehci-pci
[  453.672744] usb 3-5: New USB device found, idVendor=0955, idProduct=7820
[  453.672747] usb 3-5: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  453.672750] usb 3-5: Product: APX
[  453.672753] usb 3-5: Manufacturer: NVIDIA Corp.

The script installs everything and before you know it, you’ve got a working tablet again.

Flashing ICS Stock Rom for Lenovo Ideapad K1
build 120607
Nvflash v1.8.90246 started
Using blob v1.1.57813
rcm version 0X20001
System Information:
   chip name: t20
   chip id: 0x20 major: 1 minor: 4
   chip sku: 0x8
   chip uid: 0x03806109435f8597
   macrovision: disabled
   hdcp: enabled
   sbk burned: true
   dk burned: true
   boot device: emmc
   operating mode: 4
   device config strap: 0
   device config fuse: 0
   sdram config strap: 0

sending file: flash.bct
- 4080/4080 bytes sent
flash.bct sent successfully
odm data: 0x300c0011
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: bootloader.bin
\ 1393296/1393296 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 2 3
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: GP1
creating partition: SOS
creating partition: LNX
creating partition: APP
creating partition: CAC
creating partition: MSC
creating partition: USP
creating partition: UDA
creating partition: TMP
creating partition: GPT
Formatting partition 2 BCT please wait.. done!
Formatting partition 3 PT please wait.. done!
Formatting partition 4 EBT please wait.. done!
Formatting partition 5 GP1 please wait.. done!
Formatting partition 6 SOS please wait.. done!
Formatting partition 7 LNX please wait.. done!
Formatting partition 8 APP please wait.. done!
Formatting partition 9 CAC please wait.. done!
Formatting partition 10 MSC please wait.. done!
Formatting partition 11 USP please wait.. done!
Formatting partition 12 UDA please wait.. done!
Formatting partition 13 TMP please wait.. done!
Formatting partition 14 GPT please wait.. done!
done!
sending file: bootloader.bin
\ 1393296/1393296 bytes sent
bootloader.bin sent successfully
sending file: recovery.img
\ 4061184/4061184 bytes sent
recovery.img sent successfully
sending file: boot.img
- 3723264/3723264 bytes sent
boot.img sent successfully
sending file: system.img
/ 440401920/440401920 bytes sent
system.img sent successfully
sending file: userdata.img
- 6344840/6344840 bytes sent
userdata.img sent successfully

Score!

ideapad-boot

And, once everything is done, you can nuke the i386 packages from Ubuntu with:

sudo apt-get remove dpkg --get-selections | grep i386 | awk '{print $1}'
[sudo] password for ----: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be REMOVED:
  gcc-4.9-base:i386 gcc-5-base:i386 lib32z1 libc6:i386 libc6-i386 libgcc1:i386 libstdc++6:i386
0 upgraded, 0 newly installed, 7 to remove and 88 not upgraded.
After this operation, 21,6 MB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 219709 files and directories currently installed.)
Removing libstdc++6:i386 (4.9.2-10ubuntu13) ...
Removing gcc-4.9-base:i386 (4.9.2-10ubuntu13) ...
Removing lib32z1 (1:1.2.8.dfsg-2ubuntu1) ...
Removing libc6-i386 (2.21-0ubuntu4) ...
Removing libc6:i386 (2.21-0ubuntu4) ...
Removing libgcc1:i386 (1:5.1~rc1-0ubuntu1) ...
Removing gcc-5-base:i386 (5.1~rc1-0ubuntu1) ...
Processing triggers for libc-bin (2.21-0ubuntu4) ...

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.