Root a Device

LTBox can root your device without unlocking the bootloader. Connect the tablet in USB debugging mode first (see Connecting a Device), then click Root Device in the sidebar and follow the wizard.

Which root provider should I choose?

Because LTBox roots without unlocking the bootloader, your device stays locked — a real advantage, since most app integrity checks pass far more easily on a locked device. For that reason, KernelSU Variants → LKM → KernelSU → Stable is all most users need.

EDL loader

You supply the EDL loader, extracted from your device's firmware. The firmware version and region don't matter — only the model has to match.

• Legion Tab Y700 5th Gen — qsahara_device_programmer.xml
• All other models — xbl_s_devprg_ns.melf

Confirm and start

Review your choices on the Confirm screen, then press Start.

LTBox downloads the root files from the selected provider's GitHub, and dumps the init_boot.img (or boot.img) and vbmeta.img it needs from the device. It then patches and re-signs them, flashes the result, and reboots. This is usually quick, and the device may reboot a few times. When it finishes, open your provider's manager app from the app drawer to confirm root.

Keep your backup

Every supported model except the Legion Tab Y700 4th Gen enforces rollback protection. If LTBox had to bypass it when you flashed firmware — installing other-region firmware, or downgrading within the same region — the device's vbmeta no longer matches the one in the firmware package you downloaded.

⚠️ If that applies to you, keep the backup_init_boot (or backup_boot) folder that LTBox writes during rooting — next to ltbox.exe on Windows, or under LTBox's data directory on Linux/macOS. When you later unroot, point LTBox at that backup folder instead of the original firmware's images. Otherwise the device can fail to boot, and if the backup is gone you may have to reflash the entire firmware.