Skip to content

Home

Jump to bottom
OO edited this page Jun 17, 2026 · 15 revisions

LTBox is a tool for flashing and modifying firmware on certain Lenovo tablets. It can switch firmware between the PRC (China) and ROW (Global) regions, root and unroot the device, bypass anti-rollback, and read or write partitions over EDL (9008) mode.

⚠️ Educational purposes only. Modifying firmware can brick your device, cause data loss, or void your warranty. You use LTBox at your own risk.

LTBox dashboard

Quick Start

🪟 Windows — x86_64 / arm64

  1. Download the latest release and extract the zip (no spaces or special characters in the path).
  2. Double-click ltbox.exe.
  3. Pick a task from the sidebar and follow the wizard.

Qualcomm USB drivers: LTBox can use either the kernel or the userspace Qualcomm USB driver, switchable in Settings → Qualcomm USB driver. Windows defaults to the kernel driver (the same one QFIL uses, so you can switch between the two tools without reinstalling). When the selected driver is missing, the dashboard shows a driver banner — click Install and LTBox downloads the matching signed release (qcom-usb-kernel-drivers or qcom-usb-userspace-drivers) and runs its installer; approve the Windows UAC prompt when it appears. A reboot is recommended afterward.

🐧 Linux — x86_64 / aarch64

  1. Install the runtime dependencies (Debian/Ubuntu shown — adapt for your distro): 
    sudo apt install \
  libusb-1.0-0 libudev1 \
  libxkbcommon0 libxkbcommon-x11-0 libwayland-client0 \
  libxcb1 libxcb-render0 libxcb-shape0 libxcb-xfixes0 \
  libfontconfig1 \
  xdg-utils
  2. Download the latest release Linux tarball and extract it (tar -xzf LTBox-linux_*.tar.gz). The executable bit on ltbox is preserved.
  3. Install the udev rules so the desktop session can open the Qualcomm 9008 / Lenovo USB devices without root: 
    sudo ./ltbox --install-udev
  4. Replug any connected device.
  5. (Optional) Add an app-menu entry and icon (per-user, no root): 
    ./ltbox --install-desktop
    This drops a .desktop file under ~/.local/share/applications/ and the SVG icon under ~/.local/share/icons/hicolor/scalable/apps/. GNOME / KDE pick it up within a few seconds. Re-run after moving the binary.
  6. Run ./ltbox.

EDL driver mode (Linux): the udev rules above cover ADB access and the userspace EDL path. On Debian-based distros LTBox defaults to the kernel EDL driver (Qualcomm's qud package) and offers to install it from the dashboard banner via pkexec. Non-Debian distros stay on userspace. Switch modes anytime in Settings → Qualcomm USB driver.

🍎 macOS — universal (Apple Silicon + Intel)

Requires macOS 11 (Big Sur) or later.

  1. Download the latest release macOS tarball (LTBox-macos_universal-*.tar.gz) and extract it (tar -xzf LTBox-macos_universal-*.tar.gz).
  2. (Optional) Move LTBox.app to /Applications.
  3. The bundle is ad-hoc signed, so Gatekeeper blocks the first launch. Clear the quarantine once, either way:
    • right-click LTBox.app → Open, then confirm in the dialog, or
    • run xattr -dr com.apple.quarantine /path/to/LTBox.app.
  4. Open LTBox.app, pick a task from the sidebar, and follow the wizard.

Still won't open / "LTBox was blocked"? macOS may still block the app even after the steps above. Open System Settings → Privacy & Security, scroll down to the Security section, and click Open Anyway next to the "LTBox" was blocked to protect your Mac message, then confirm with Touch ID or your password.

No separate USB driver setup is needed on macOS — the Qualcomm 9008 (EDL) and ADB devices are reached directly through the bundled libusb. Replug a device if it isn't detected.

Guides

Supported devices

The devices below ship a bootloader that trusts the AOSP test key. Hardware released from 2026 on has this vulnerability patched.

Device ZUXOS ZUI
Legion Tab Y700 2nd Gen Full support 17.0.339 and earlier †
Xiaoxin Pad Pro GT / Yoga Tab 11.1 AI 1.5.04.428 and earlier † 17.5.04.059 and earlier †
Yoga Pad Pro AI / Yoga Tab Plus AI 1.5.10.186 and earlier † 17.5.10.096 and earlier †
Legion Tab Y700 3rd Gen 1.5.10.236 and earlier † 17.5.10.170 and earlier †
Legion Tab Y700 4th Gen 1.5.10.138 and earlier † NONE

† Cutoff. Some models received an OTA that replaces the AvbRSAPublicKey embedded in the ABL from the AOSP test key to a new key.

On some 2026 hardware the above vulnerability is gone, but a new GBL exploit lets unsigned code run through efisp — LTBox supports most features on the device below through that path.

Device ZUXOS ZUI
Legion Tab Y700 5th Gen Full support Full support

Reference

  • How It Works — the technology behind region conversion, rooting, anti-rollback bypass, and EDL flashing.
  • Troubleshooting — fixes for known issues (TEE repair, Play Integrity, Widevine).

Links

Clone this wiki locally