[Guide] Lenovo Tab 2 A10-70 Root, Recovery, Xposed and Others

I no longer have this tablet. This is an amazing device, and I enjoyed my time with it. Chances are that the information that are here are not the most updated. You can expect updated information at this thread.


There are a lot of scattered information everywhere about this tablet, so this is just an attempt to put those together in one place. Recently this tablet is gaining a lot of users due to its price and performance, I just hope that it helps the new users getting started. This is not my work, so I don't take any credit. No thanks necessary. Please thank the original contributors.

All the steps mentioned here are individually tested by me and at least worked for my device. However, I cannot guarantee that it will work on yours too, and I am not responsible for any damage to your device due to following or not-following this tutorial.
This thread is made possible due to the contribution of XDA members @Sparkrite, @Old faithful, @lee2006 and others. Special thanks to @clsA for providing the download links. Many thanks to @Tzul as stock firmwares and OTA updates were originally obtained from his work @ android-hilfe.de.
And we can not mention well enough the contributions of @Chainfire for root and @rovo89 for Xposed.



1. ROOT
Root with Kingroothttp://xdaforums.com/android/apps-games/one-click-root-tool-android-2-x-5-0-t3107461

(Easy Method) Use this method if you don't want to change to a custom recovery
So far it has been reported to be working on the Kitkat 4.4 rom only. The steps are as easy as it could get. download the Kingroot app, and let it do it's work. You shall be rooted.
Replace Kingroot with SuperSu
Now, giving super user access to your device to any app is no joke. And many of us feel a bit uneasy with the Kingroot app. There are 2 ways to replace Kingroot with SuperSu

• (Paid option )Use the Super-Sume Pro app app from the play store.
• (Free option) Follow this guide here if you are not afraid of getting your hands dirty with couple lines of codes in terminal emulator. Note that the terminal will show a lot of errors, but it will still get the job done.

Root with Custom Recovery

1. Follow the steps for installing Custom Recovery in section 3
2. Reboot into Recovery mode.
3. Use the 'Install Zip' option in your Custom Recovery to install 'BETA-SuperSU-v2.49.zip' and you shall be rooted.

2. Install Xposed Framework
Installing xposed requires a rooted device. Root your tablet with one of the above methods.
Kitkat
Download the Xposed Installer apk. Install the apk, you will get a security warning. You need to check app installation from 'Unknown Sources' in Security settings. Once installed go to the xposed app, under 'Framework' click 'Install/Update' You can ignore the red warning. Restart your device after that. Download any modules you like and start customizing your tablet!
Lollipop
Lollipop requires installing Xposed via recovery, so having a custom recovery besides root is also a requirement. Download the latest version of Xposed. Android 5.0.1 =SDK21, and this tablet runs in ARM 64 bit mode. Download xposed-v##-sdk21-arm64.zip, copy it to the tablet, and install it from custom recovery. The first boot afterwards can a long time 5-10 minutes. Also download and install the latest XposedInstaller app (currently XposedInstaller_3.0_alpha4.apk ), to manage the modules.


3. Install Custom Recovery
Install USB driver
This one is a tricky process.

1. Download SP_Drivers and extract the files.
2. Start Device Manager on the PC
3. Turn off the tablet and connect it to the PC via USB cable. Device manager will refresh and show MT67xx vcom for a couple seconds only. Quickly right click on it and select install driver manually, navigating to the directory of the SP_Drivers
4. Disconnect the tablet

Install TWRP Recovery using SP Flash Tool

1. Download and extract TWRP for Lenovo Tab 2 A10-70.
2. Download and extract the latest version of SP Flash Tool
3. Start SP Flash Tool, in Download tab get the scatter file from the recovery zip package. Use the Android4 file for Android 4.4 Kitkat, and the Android5 file for Android 5 Lollipop. Make sure only the recovery is ticked, and on the drop down menu 'download only' is selected. Click on the location column on the right of 'recovery' and browse to the recovery file depending on your android version.
   
5. In SP Flash Tool, click Download.
6. Connect the turned-off tablet to the PC. Recovery will flash in a matter of seconds and you will get a big green OK on the software.
7. Close SP Flash Tool.
8. Remove the tablet and make sure you do not start it, but get into recovery instead. Press 'volume up and power' and maintain that for about 10 seconds, past the vibration and the start of splash screen. A dark screen with very small characters will show up with three options: Recovery, Fastboot and Normal. Don't touch anything unless you make sure you understand what the buttons do. Volume up is used to navigate (go to Recovery), volume down activates the selection. DON'T select any other option! The power button has no effect.
9. TWRP will start.
10. Note that if you are already rooted, you can flash recovery via Flashify, Rashr, etc. You can also flash via Fastboot.

4. Flash Stock ROM with SP Flash Tool
There could be many reason to go back to all stock. Soft brick, return device to manufacturer for repair, Downgrade or upgrade OS, etc.

1. Make sure you have the USB driver installed (procedure in the previous section)
2. Download Stock ROM. Latest Lollipop A10-70F_S000121_151222_ROW or here. Kitkat A10-70F_S000021_150501_ROW_USER. Extract.
3. Download and extract the latest version of SP Flash Tool
4. Power off the tablet and run flash_tool.exe in the extracted SP flash tool folder
5. Click 'Scatter-loading' and chose MT6752_Android_scatter.txt file in the extracted stock rom folder. Make sure on the drop down menu 'download only' is selected.
6. Click 'download' and then connect the turned off tablet to the computer. The progress bar will show. It takes about 5 mins for the flash. A big green 'OK' button will show the end of the process. Disconnect the tablet and power it on. It may take up to 10 mins for the first boot. If it still not booting force turn off by pressing on the power button and start again.

The tablet should be powered off when connecting it to the computer, for both installing the preloader drivers and for flashing. This one is a very important step, and it won't work with a turned on tablet.

5. Tips

• If you are in stock Kitkat, you can reboot to recovery mode by going to the 'system update' app and clicking the rectangular button on the top right corner.
• To give sd card write access to any apps... If you are rooted this can be overcome by using apps like SDFix, HandleExternalStorage xposed module, or others.
• Strangely there is no option to change Lockscreen wallpaper in the settings menu. This can be done by opening any image with the default Gallery app and going to 'set picture as'....

6. OTA update to latest version of Lollipop
The latest update mostly fixed the wifi issue many people have been struggling with.
Use SP Flash Tool to flash System and Recovery only from Lollipop firmware provided on section 4. Choose recovery and system only to return to stock. From stock recovery choose install update from sdcard and then choose the lenovoota.zip
Link to OTA >> A10-70F_S000120_150907_ROW_TO_A10-70F_S000121_151222_ROW
first bootup takes about 10 min like any system update

7. Useful Reads
MediaTek boot process and partitions 101
Fix a corrupted Preloader
Fix Auto-brightness

8. Additional Download Links
AndroidFileHost from Tzul
Onedrive from Tzul
AndroidFileHost from cslA

I shall continue to update this thread as more information becomes available. Please let me know if I missed anything.
.
.

Auto-brightness sucks and slows down your tablet, here's how you disable it

What is AAL?

Quote from a MediaTek press release:
"Furthermore, specifically tailored for mobile devices, the all-important power efficiency has been addressed and boosted through the Ambient-Light Adaptive Luma (AAL) technology, which intelligently adjusts the panel backlight in response to the ambient light intensity and the displayed contents to simultaneously optimize battery life and viewing experience."

That sounds a bit like the auto-brightness feature that has been around for a long time. The screen's backlight is adjusted in response to values measured by a light intensity sensor. The crucial difference is that the light intensity sensor is read out only a few times per second (or even only once every few seconds) and as a standalone hardware unit it requires no or very little CPU power for operation.
The Lenovo Tab 2 A10-70 has no light intensity sensor (no, the camera is not used for this - thankfully). So what remains for AAL? The "displayed contents" ... that means there is some software permanently running in the background which analyzes the current screen contents. At a resolution of 1920x1200 it is guaranteed to waste some processing power.
Another difference is that the traditional auto-brightness feature can be disabled in Android's user interface, but AAL cannot.

Fortunately, you can disable AAL, in MediaTek's "engineer mode" app. This app should be preinstalled on all MediaTek-based devices, but it is not directly accessible. It can be launched by dialing a special number in the phone app / search field of the contacts app (*#*#3646633#*#*), or by other apps like GravityBox (Xposed module) or this one.
In Engineer Mode, the AAL setting can be found on the "Hardware Testing" page, but only if the device supports AAL, of course. Changing the settings requires a reboot.

In Engineer Mode, there are also many other settings to discover, e.g. audio volume settings, but since the app is not intended for end users, its contents are cryptic and not explained. I'd advise against indiscriminately messing around with everything there.

Anyway, I heartily recommend disabling AAL!
AAL is absolutely counterproductive to the objectives cited by the press release: "battery life and visual experience" - AAL makes both of these worse.
The automatic and unsolicited adjustment of the backlight has annoyed me from the beginning, and AAL makes some animations noticeably less smooth.
I made this video to demonstrate the issues.

Edit: I found out what the engineer mode app does to change the AAL state. It's just setting a simple persistent property. Can be done manually with this terminal command:
Requires root, i.e. a preceeding "su" command. 0 means disabled, 6 means enabled (this is actually a bitfield, covering three AAL functions: 1="LABC", 2="CABC", and 4="DRE"; 6 means CABC & DRE enabled, LABC doesn't exist anymore for Android 5).

Unfortunately, in Android 4.4, the AAL software does not query this property. It has no off-switch there, and no setting in the engineer mode app. AAL doesn't appear to have the same negative performance impact in Android 4.4 as it does in Android 5, but the changing brightness is still present and annoying. That's why I created a patch that disables AAL. Just "install" this zip file with a custom recovery (tested in TWRP). To undo the patch, just install again (it toggles the AAL state between enabled and disabled each time you execute it). Works with both A10-70F and A10-70L tablets.

MediaTek boot process and partitions 101

Since @charlestek was asking about the purpose of all the partitions earlier, and since I've been planning to do this anyway... here comes a long post.

If you want to understand the purpose of some of the partitions, then you first need to know details about the boot sequence.

When the tablet is turned on, the CPU initializes itself and has to start executing code from somewhere. But at this time, pretty much all the hardware is uninitialized and not yet usable: no flash memory, not even the 2 GB of main memory (DRAM, dynamic random access memory). However, the CPU has a bit of integrated memory: SRAM (static random access memory, SRAM vs. DRAM see here). And the CPU has a "Boot ROM" (BROM, read-only memory).
It is this BROM that contains the first instructions for the CPU. They are fixed and unchangeable. The BROM code initializes the MediaTek chip's serial port (UART, universal asynchronous receiver/transmitter), and actually provides a read/write interface this way, which could be used to "unbrick" a dead tablet. However, the UART port isn't accessible from the outside, as far as I know, so you'd have to open the tablet, find the right contacts on its mainboard, and solder some wires to them, in order to connect that serial port to your PC - not really an option for most people.
Anyway, the BROM also initializes the internal flash memory chip(s), then loads the preloader from flash memory into the SRAM, and hands off execution to it.

The preloader continues initializing more hardware, like the DRAM (finally), the PMU (power management unit), and the USB port. While USB stands for "universal serial bus", its normal data transfer protocol is fairly complex, and not as easy to implement as the serial COM ports of yore it replaced. Since the on-chip SRAM is quite small (just a few dozen kilobytes, usually), the preloader must be small enough to fit inside, and therefore can't include a ton of features.
So, the preloader configures the USB port in a special way, as virtual COM port (VCOM), basically mimicking the BROM's UART port. And that's why you need that special preloader USB driver.
The preloader then listens on this VCOM port for about 2 seconds. If the SPFT connects during that time, they "shake hands", and the SPFT sends a "download agent" (DA) over. The preloader receives the DA, stores it in main memory (DRAM), and finally hands off execution to the DA. It is this DA then which performs the downloading (=flashing) and reading back, and afterwards turns off the tablet. The advantages of this approach are clear: the preloader doesn't have to include all this functionality (must stay small), and in case of bugs or updates concerning the download/readback procedures, nothing on the tablet needs to be changed, because the DA lives "outside" with the SPFT.

If the preloader doesn't get any response on the VCOM port within the short timeframe, it disables the port and continues with the normal boot process.
This involves checking the cryptographic signatures of several partitions, at least on "locked" (tamper-proof) systems.
If the signatures are valid (or the system is "unlocked", which ours is), the preloader loads the bootloader from flash memory into DRAM, and hands off execution to it.

The bootloader, LK = Little Kernel in our case, initializes yet more hardware, like the screen, and displays the boot logo ("Lenovo - powered by Android", this boot logo is not the same as the boot animation that follows later). It also analyzes the boot reason (power key pressed, USB connected, alarm clock went off, and a few more), and decides how to continue. It checks if certain hardware keys are pressed, and if power key + volume up key are pressed, it shows the tiny "Normal, Recovery, Fastboot" selection menu. Yes, the bootloader also implements Fastboot, which has nothing to do with the speed of booting, but is a USB protocol for flashing partitions, and sending a few other commands to the bootloader.
NB: preloader and LK are sometimes called first and second stage bootloaders.

Once the boot mode has been decided, the bootloader will either go into Fastboot mode, do some other boot stuff that isn't important here, or finally load and run the recovery, or the boot image. These two partitions, boot and recovery, share the same basic format. They start with a header containing information about memory addresses and sizes, followed by the Linux kernel, followed by the ramdisk. This ramdisk contains the initial Linux/Android filesystem, most importantly the init executable, its script file init.rc, and often more .rc scripts (referenced by init.rc).

In case of the recovery, init.rc contains relatively few commands. Its main purpose is to launch the recovery executable, normally /sbin/recovery, which is of course included in the recovery's ramdisk.
In case of the normal boot partition, init.rc does a lot more work, like mounting the /system and /data filesystems from their respective partitions, launching various background services, including the boot animation that is supposed to keep users entertained / at ease, while Android and everything that belongs to it is starting up.
By the way, the init executable is also responsible for Android's property system. It parses the default.prop file from the ramdisk, and /system/build.prop, and also "persistent" properties from /data/property/. But properties are a topic in and of themselves...

So, let's look at a list of all partitions of this tablet. Unless a filesystem (e.g. ext4) is mentioned, all partitions are "raw" (binary blobs with mostly unknown formats).

• preloader: Explained above. It's perhaps the most crucial of all partitions. Don't flash if you don't have to, because if the preloader gets damaged, your device is "bricked", and the SPFT won't work anymore. Unless the device has a special recovery mode in the Boot ROM that allows the SPFT to restore a missing/broken preloader (this tablet apparently has this feature).
• pgpt: primary GUID partition table
• proinfo: product info; empty on my phone, contains my unique serial number on my tablet; probably the vendor's choice whether this gets used or not
• nvram: the non-volatile random access memory; holds unique configuration info such as the WiFi and Bluetooth MAC addresses, IMEI (for devices with SIM card), and some other stuff related to audio, camera, GPS. This data gets "unpacked" to /data/nvram/ (or on newer devices to a dedicated "nvdata" partition) by an init.rc service (nvram daemon), if not present there already. This service also stores a little activity log inside the nvram partition!
• protect1: alternate name "protect_f"; ext4 filesystem, usually empty. No idea what it's for.
• protect2: alternate name "protect_s"; same as protect1 ...
• kb: "keyblock", no idea, appears to be empty
• dkb: same as kb
• seccfg: appears to be related to security/signature checks performed by preloader and bootloader. Empty on this tablet.
• lk: "Little Kernel", the bootloader, explained above. Alternate name "uboot", because previously, a bootloader called Das U-Boot was used. But all MediaTek devices I've seen in the past few years use LK, even if the partition name wasn't updated accordingly.
• boot: Android boot image: Linux kernel + Android ramdisk
• recovery: Recovery boot image: Linux kernel + recovery ramdisk
• secro: appears to be related to security/signature checks performed by preloader and bootloader. Not empty.
• para: alternate name "misc"; space for miscellaneous parameters. The bootloader stores some variables here (e.g. whether "off-mode charging" is enabled or disabled), and maybe messages to the recovery or Android. Some logging info could also be stored here.
• logo: the boot logo, and other graphics the bootloader might need (like battery charging graphics, if the device can do "off-mode charging").
• expdb: no idea, mostly empty, contains some log fragments?
• tee1: Trusted Execution Environment, something to do with ARM's TrustZone, apparently involved in "full disk encryption", more on that in a second.
• tee2: same as tee1, gotta have two for redundancy, I guess.
• metadata: The crypto metadata, used for Android's "full disk encryption". This feature actually "only" encrypts the /data partition (userdata). In some older devices, the crypto metadata used to be stored in a "footer" at the end of the encrypted data partition, but newer devices store it in this dedicated partition, which is probably safer and more convenient. So, if you use Android's "full disk encryption" feature (Android system settings, security), then you should not mindlessly backup and restore this metadata partition, or you might literally trash the key to all your data. Otherwise, this partition is probably unused and empty.
• system: the main Android system files, ext4 filesystem, gets mounted to /system
• cache: the Android cache partition, ext4 filesystem, gets mounted to /cache, used for some temporary files, and also by the recovery for its log file
• userdata: the main data partition, ext4 filesystem, gets mounted to /data, used for user-installed apps, and all app settings. Also contains /sdcard, which is not the actual MicroSD card, but the "internal storage", where media files and other app data files can be placed. In the past, /sdcard used to be its own partition with FAT32 filesystem, but here it is emulated and actually a link to /data/media/0. This so-called "data media" layout has the advantage that the available space is shared dynamically: don't have many picture and music files in /sdcard? More space for apps in /data! Don't have many apps installed? More space for music, pictures, videos! The disadvantage is that /sdcard can't be mounted in USB mass storage mode anymore, because Windows PCs don't understand the ext4 filesystem.
• flashinfo: alternate name "bmtpool", I think. Might have contained the flash block mapping table in the past, used for wear leveling and to keep track of bad blocks. But nowadays, eMMC flash has a built-in controller for that, so that can't be the purpose anymore. The SPFT stores some info here, but I don't know details.
• sgpt: secondary GUID partition table; gotta have two for redundancy, I guess.

If anybody has more insight to offer where mine was lacking, please contribute.

TWRP 3.0 arm64 for A10-70F and A10-70L with 5.0.1 ROM

Finally I've managed to build arm64 (aarch64) version of TWRP 3.0 from actual sources.
I've packed two images for F and L versions. Difference only in kernel (I've include kernel from corresponding ROMs - S120 for F and S115 for L ) and in device name, model and fingerprint in default.prop.
I've tested both on my A10-70L with 5.0.1 ROM (A10-70L_S000115_160119_ROW) - both runs smoothly - kernel version doesn't make much sence. Backup folders differs based on model.

Images on Google drive - 11Mb each:
recovery-TWRP_300-0_A10-70F_arm64_lion567.img Control sums for the image:
MD5: b6e909ea04a92ff3ae4dd1565bc311f5
SHA1: 2cb8243140a3b097abd58795dbc51402cf98f3ad

recovery-TWRP_300-0_A10-70L_arm64_lion567.img Control sums for the image:
MD5: 2e920ca4ff8d99bc330921fa0d166a28
SHA1: d0d1f13e8275f1ca5fd0cfff032a1ab512ade038

suhridkhan said:

...

I shall continue to update this thread as more information becomes available. Please let me know if I missed anything.

Click to expand...

Click to collapse

You need the latest Lollipop software installed from #4 above (A10-70F_S000121_151222_ROW_clsA) - and you need the latest TWRP from @Tzul as your custom recovery.


01. Boot to TWRP.
02. Create a backup on your external SD card. (Backing up "Boot" is more than enough. We only want TWRP to create the needed directories on your SD card.)
03. Download the backup I uploaded here >> nova.xposed.gsam.airdroid.supersu.zip
04. Unzip the downloaded backup.
05. Copy the unzipped backup folder to "TWRP/BACKUPS/Lenovo_Tab_2_A10-70F/"on your SD card.
06. Restore the backup.
07. Boot to system. First boot may take about 3 or 4 min.


Nova Launcher (you can choose it on first boot or use the normal launcher, your choice)
Busybox
SuperSU
Xposed + Xprivacy and Gravitybox
Gsam Battery Monitor
Airdroid
ES File explorer
Terminal Emulator
Custom Wallpapers
bloat apps removed (most google stuff left in)
Boot and shutdown animations disabled.

Here's some screen shots - it's nothing too fancy but it should save you some time setting everything up if you need to redo your system.
If you like these Apps buy the pro versions in the Play store
If you want to thank Tzul for his work you can do so here >> http://xdaforums.com/donatetome.php?u=5919159

Thanks go to
@Tzul for TWRP
@Hashbang173 for the Xposed
@C3C076 for Gravitybox
@M66B for Xprivacy
and @Chainfire for SuperSU