A friend of mine asked me to take a look at a locked IdeaPad K1 that she got from work for free. (Seems like Lenovo is happening a lot to me this month.) Turns out it was pretty easy to unlock.
I used the khanning official ICS build, which is a stock Android Ice Cream Sandwich build, with Google Apps installed.
Contents of the archive look like so:
Archive: K1_ICS_120607_Stock.zip
Length Date Time Name
--------- ---------- ----- ----
0 2012-07-26 20:06 drivers/
9355 2012-06-07 18:42 drivers/NvidiaUsb.inf
0 2012-07-26 20:06 drivers/amd64/
1533512 2012-06-07 18:42 drivers/amd64/WUDFUpdate_01007.dll
1197128 2012-06-07 18:42 drivers/amd64/WUDFUpdate_01007_chk.dll
1919968 2012-06-07 18:42 drivers/amd64/WdfCoInstaller01005.dll
1490656 2012-06-07 18:42 drivers/amd64/WdfCoInstaller01007.dll
1087200 2012-06-07 18:42 drivers/amd64/WdfCoInstaller01007_chk.dll
708168 2012-06-07 18:42 drivers/amd64/WinUSBCoInstaller.dll
724040 2012-06-07 18:42 drivers/amd64/WinUSBCoInstaller_chk.dll
4258 2012-06-07 18:42 drivers/amd64/android_usb.inf
31744 2012-06-07 18:42 drivers/amd64/androidusb.sys
8569 2012-06-07 18:42 drivers/amd64/androidusba64.cat
0 2012-07-26 20:06 drivers/x86/
1302600 2012-06-07 18:42 drivers/x86/WUDFUpdate_01007.dll
997960 2012-06-07 18:42 drivers/x86/WUDFUpdate_01007_chk.dll
1419232 2012-06-07 18:42 drivers/x86/WdfCoInstaller01005.dll
1112288 2012-06-07 18:42 drivers/x86/WdfCoInstaller01007.dll
815328 2012-06-07 18:42 drivers/x86/WdfCoInstaller01007_chk.dll
581192 2012-06-07 18:42 drivers/x86/WinUSBCoInstaller.dll
592968 2012-06-07 18:42 drivers/x86/WinUSBCoInstaller_chk.dll
4265 2012-06-07 18:42 drivers/x86/android_usb.inf
25728 2012-06-07 18:42 drivers/x86/androidusb.sys
0 2012-07-26 22:44 files/
89122 2012-06-07 18:42 files/blob.bin
3723264 2009-01-01 00:00 files/boot.img
1393296 2012-06-07 18:42 files/bootloader.bin
4080 2012-06-07 18:42 files/flash.bct
2647 2012-06-07 18:42 files/flash.cfg
54272 2012-04-05 14:40 files/libnv3p.dll
45056 2012-04-05 14:40 files/libnvaes_ref.dll
81920 2012-04-05 14:40 files/libnvapputil.dll
43520 2012-04-05 14:40 files/libnvboothost.dll
45056 2012-04-05 14:40 files/libnvdioconverter.dll
80896 2012-04-05 14:40 files/libnvflash.dll
101376 2012-04-05 14:40 files/libnvos.dll
96768 2012-04-05 14:40 files/libnvtestio.dll
44544 2012-04-05 14:40 files/libnvusbhost.dll
1195311 2012-06-07 18:42 files/nvflash
221696 2012-04-05 14:40 files/nvflash.exe
512292 2012-06-07 18:42 files/nvsbktool
4061184 2009-01-01 00:00 files/recovery.img
440401920 2012-07-26 21:46 files/system.img
6344840 2012-06-07 18:41 files/userdata.img
224 2012-07-26 22:42 flash-linux.sh
231 2012-07-26 22:58 flash-win.bat
--------- -------
474109674 46 files
On 64-bit Ubuntu 15.04, when I tried to run the flash-linux.sh script, it kept giving me the following error:
$ ./flash-linux.sh Flashing ICS Stock Rom for Lenovo Ideapad K1 build 120607 ./flash-linux.sh: line 7: ./nvflash: No such file or directory
Turns out this is because the nvflash executable was built for 32-bit systems only, so you have to install the 32-bit support libraries on Ubuntu, which goes like this:
sudo apt-get install libc6-i386 libstdc++6:i386
Then if you run the flash-linux.sh script as a normal user, you get a “Permission Denied” error, as it tries to access a resource for privileged users:
Flashing ICS Stock Rom for Lenovo Ideapad K1 build 120607 Nvflash v1.8.90246 started Using blob v1.1.57813 Permission Denied
So you run it as sudo and… the device is missing:
Flashing ICS Stock Rom for Lenovo Ideapad K1 build 120607 Nvflash v1.8.90246 started Using blob v1.1.57813 USB device not found
So you disconnect and reconnect the tablet, and put the tablet into NVFlash / APX mode, et voilà!
[ 453.540020] usb 3-5: new high-speed USB device number 4 using ehci-pci [ 453.672744] usb 3-5: New USB device found, idVendor=0955, idProduct=7820 [ 453.672747] usb 3-5: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 453.672750] usb 3-5: Product: APX [ 453.672753] usb 3-5: Manufacturer: NVIDIA Corp.
The script installs everything and before you know it, you’ve got a working tablet again.
Flashing ICS Stock Rom for Lenovo Ideapad K1 build 120607 Nvflash v1.8.90246 started Using blob v1.1.57813 rcm version 0X20001 System Information: chip name: t20 chip id: 0x20 major: 1 minor: 4 chip sku: 0x8 chip uid: 0x03806109435f8597 macrovision: disabled hdcp: enabled sbk burned: true dk burned: true boot device: emmc operating mode: 4 device config strap: 0 device config fuse: 0 sdram config strap: 0 sending file: flash.bct - 4080/4080 bytes sent flash.bct sent successfully odm data: 0x300c0011 downloading bootloader -- load address: 0x108000 entry point: 0x108000 sending file: bootloader.bin \ 1393296/1393296 bytes sent bootloader.bin sent successfully waiting for bootloader to initialize bootloader downloaded successfully setting device: 2 3 creating partition: BCT creating partition: PT creating partition: EBT creating partition: GP1 creating partition: SOS creating partition: LNX creating partition: APP creating partition: CAC creating partition: MSC creating partition: USP creating partition: UDA creating partition: TMP creating partition: GPT Formatting partition 2 BCT please wait.. done! Formatting partition 3 PT please wait.. done! Formatting partition 4 EBT please wait.. done! Formatting partition 5 GP1 please wait.. done! Formatting partition 6 SOS please wait.. done! Formatting partition 7 LNX please wait.. done! Formatting partition 8 APP please wait.. done! Formatting partition 9 CAC please wait.. done! Formatting partition 10 MSC please wait.. done! Formatting partition 11 USP please wait.. done! Formatting partition 12 UDA please wait.. done! Formatting partition 13 TMP please wait.. done! Formatting partition 14 GPT please wait.. done! done! sending file: bootloader.bin \ 1393296/1393296 bytes sent bootloader.bin sent successfully sending file: recovery.img \ 4061184/4061184 bytes sent recovery.img sent successfully sending file: boot.img - 3723264/3723264 bytes sent boot.img sent successfully sending file: system.img / 440401920/440401920 bytes sent system.img sent successfully sending file: userdata.img - 6344840/6344840 bytes sent userdata.img sent successfully
Score!
And, once everything is done, you can nuke the i386 packages from Ubuntu with:
sudo apt-get remove dpkg --get-selections | grep i386 | awk '{print $1}'
[sudo] password for ----:
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be REMOVED:
gcc-4.9-base:i386 gcc-5-base:i386 lib32z1 libc6:i386 libc6-i386 libgcc1:i386 libstdc++6:i386
0 upgraded, 0 newly installed, 7 to remove and 88 not upgraded.
After this operation, 21,6 MB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 219709 files and directories currently installed.)
Removing libstdc++6:i386 (4.9.2-10ubuntu13) ...
Removing gcc-4.9-base:i386 (4.9.2-10ubuntu13) ...
Removing lib32z1 (1:1.2.8.dfsg-2ubuntu1) ...
Removing libc6-i386 (2.21-0ubuntu4) ...
Removing libc6:i386 (2.21-0ubuntu4) ...
Removing libgcc1:i386 (1:5.1~rc1-0ubuntu1) ...
Removing gcc-5-base:i386 (5.1~rc1-0ubuntu1) ...
Processing triggers for libc-bin (2.21-0ubuntu4) ...