how i rooted my Lenovo Tab M8 HD (TB-8505X)

I have a Lenovo Tab M8 HD lying around. The first-gen one, TB-8505X, MediaTek Helio A22, 2 GB of RAM. It's a shitbox, i know.

This is one of those tablets BYJU'S shipped with their courses, so if you were an Indian student in that era there's a good chance you have the exact same brick rotting in a drawer. Mine showed up locked down as a delivery device for their app, tied to their content, and the second i was done with the coaching it turned into a paperweight. Cheap hardware, chosen to lock kids into an overpriced subscription, and worthless the moment you stopped paying. That was the whole point of it.

I don't have much love for the company that sent it, and going by everything that's happened to them since (the layoffs, the lawsuits, the very public financial implosion), i'm clearly not alone. Plenty has been written about the pressure their sales machine put on parents, and none of it made me feel bad about wiping their software off this thing. So this post is also for everyone else stuck with one of these: it's your tablet now, not theirs. Rip their stuff off it and make it do something you actually want.

It was doing nothing except collecting dust, so one evening i decided to root it and see what it could turn into. (The Wi-Fi model, TB-8505F, is the same platform, but never flash X firmware on an F or the other way round.)

the short version

If you just want to root a Lenovo Tab M8 HD, this is what worked:

Download the exact stock firmware with Lenovo's Software Fix tool, and copy the ROM folder out before closing it.
Unlock the bootloader with fastboot flashing unlock. This wipes the tablet.
Patch boot.img with Magisk and flash it.
Disable vbmeta verification by setting byte 123 of vbmeta.img to 0x03, because fastboot 36 fails with Failed to find AVB_MAGIC.
Back up nvram, nvdata, proinfo and persist before you touch anything else.
Optional: flash AndyYan's LineageOS 18.1 arm64_bvS GSI.

Don't install TWRP on this model. The full step-by-step guide, with the scripts and the exact commands, is on GitHub: udaysinh-git/root-lenovo-tab-m8. The long version, with everything that went wrong on the way, is below.

rooting the tab m8 (what actually worked)

The first plan was mtkclient, the tool everyone on XDA points to for MediaTek chips. On Windows it just did not want to work. mtk.exe was broken, then libusb couldn't find its DLL, then UsbDk wanted admin rights, and after all of that the handshake kept failing anyway. A stray mtkclient process i'd forgotten about even put the tablet into a connect-disconnect loop over USB until i killed it. At one point the tablet booted into safe mode on its own. I gave up on mtkclient.

What finally worked was Lenovo's own Software Fix tool (it used to be called Rescue and Smart Assistant). It downloads the exact stock firmware build for your tablet, for free. One catch: it deletes the zip after extracting it, so copy the ROM folder somewhere else before you close it.

With the stock images on my laptop, the rest was the usual MediaTek routine. Unlock the bootloader with fastboot flashing unlock (this wipes the tablet), patch the boot image with Magisk, flash it back. Then comes the vbmeta step, which is exactly where the XDA threads stop being useful. Current fastboot (36.x) refuses to disable verification on the Tab M8's vbmeta image:

Failed to find AVB_MAGIC at offset: 0

The image is fine, fastboot just can't find the header it expects. The flags it wants to set live in a single byte, so i set it myself: offset 123 → 0x03, flashed that, and the Tab M8 was rooted.

Before touching anything else i backed up nvram, nvdata, proinfo and persist. Those hold the IMEI and the radio calibration, and no firmware package can give them back if something overwrites them. While reading around i also saw enough people brick this exact model with TWRP that i never installed it. Everything was plain fastboot.

installing lineageos 18.1 on the tab m8

Stock Android 10 on 2 GB of RAM is slow, so the next step was a GSI. The tablet claims system_root_image=false, but / really is the system partition, so the arm64 "b" images are the right ones. The Android 15 GSIs i tried didn't boot. AndyYan's LineageOS 18.1 (arm64_bvS, the vanilla build with no Google apps) did, in about 100 seconds on the first boot.

Getting the image was an adventure of its own. SourceForge was crawling and the browser download kept dying halfway, so i ended up pulling it with aria2 from several mirrors at once and checking the SHA1 at the end, which took minutes instead of forever.

a charge limiter for a tablet that's always plugged in

This tablet is going to stay on USB power all the time, so it needed a charge limiter. MediaTek exposes a switch at /proc/mtk_battery_cmd/current_cmd, where "0 1" stops charging and "0 0" starts it again. A tiny Magisk boot script keeps checking the battery and holds it between 50 and 60%, so it doesn't sit at 100% all day and slowly cook itself.

If you want to try it on yours, everything is in the repo, including the partition backup script and the charge limiter. Usual warning: this is what worked on my TB-8505X with its firmware. Yours might behave differently, and if something breaks while you follow along, that's on you, so back up first.

So now there's a rooted LineageOS tablet on my desk that manages its own battery. The actual plan for it is a bit bigger: it's going on my wall as a third monitor for my laptop, which is the next post.