Skip to content

Home

Jump to bottom
OO edited this page May 29, 2026 · 15 revisions

LTBox is a tool for flashing and modifying firmware on certain Lenovo tablets. It can switch firmware between the PRC (China) and ROW (Global) regions, root and unroot the device, bypass anti-rollback, and read or write partitions over EDL (9008) mode.

⚠️ Educational purposes only. Modifying firmware can brick your device, cause data loss, or void your warranty. You use LTBox at your own risk.

LTBox dashboard

Quick Start

🪟 Windows — x86_64 / arm64

  1. Download the latest release and extract the zip (no spaces or special characters in the path).
  2. Double-click ltbox.exe.
  3. Pick a task from the sidebar and follow the wizard.

Qualcomm USB drivers: the dashboard shows an "Install drivers" banner when the Qualcomm USB drivers are missing. Clicking it downloads and installs the latest qcom-usb-kernel-drivers release from GitHub via pnputil. Run LTBox as Administrator the first time so pnputil can land the .inf files.

🐧 Linux — x86_64 / aarch64

  1. Install the runtime dependencies (Debian/Ubuntu shown — adapt for your distro): 
    sudo apt install \
  libusb-1.0-0 libudev1 \
  libxkbcommon0 libxkbcommon-x11-0 libwayland-client0 \
  libxcb1 libxcb-render0 libxcb-shape0 libxcb-xfixes0 \
  libfontconfig1 \
  xdg-utils
  2. Download the latest release Linux tarball and extract it (tar -xzf LTBox-linux_*.tar.gz). The executable bit on ltbox is preserved.
  3. Install the udev rules so the desktop session can open the Qualcomm 9008 / Lenovo USB devices without root: 
    sudo ./ltbox --install-udev
  4. Replug any connected device.
  5. (Optional) Add an app-menu entry and icon (per-user, no root): 
    ./ltbox --install-desktop
    This drops a .desktop file under ~/.local/share/applications/ and the SVG icon under ~/.local/share/icons/hicolor/scalable/apps/. GNOME / KDE pick it up within a few seconds. Re-run after moving the binary.
  6. Run ./ltbox.

Guides

Supported devices

The devices below ship a bootloader that trusts the AOSP test key. Hardware released from 2026 on is patched and not supported. ‡

Device Notes
Legion Tab Y700 2nd, 3rd Gen Full support
Legion Tab Y700 4th Gen ZUXOS 1.5.10.138 and earlier †
Yoga Pad Pro AI / Yoga Tab Plus AI Full support
Xiaoxin Pad Pro GT / Yoga Tab 11.1 AI Full support

‡ Patched hardware. Devices released in 2026 or later (for example the Y700 5th Gen) ship with the AOSP test key removed from the ABL trust path at the factory, so the vulnerability LTBox relies on is no longer exploitable on them.

† Y700 4th Gen cutoff. ZUXOS 1.5.10.183 ships an updated ABL that swaps the embedded AvbRSAPublicKey from the AOSP test key to the Y700 5th Gen production RSA-4096 key, so 1.5.10.138 is the last vulnerable build for the Y700 4th Gen.

Reference

  • How It Works — the technology behind region conversion, rooting, anti-rollback bypass, and EDL flashing.

Links

Clone this wiki locally