TL;DR: Greyed-out OEM unlock → patched the devinfo partition over Qualcomm EDL to force-unlock the bootloader → got walled by a Full Disk Encryption password I never set → realized you can't crack hardware-backed FDE so I wiped /data instead → dodged a brick by catching that the XDA download was for the wrong tablet → fought TWRP/stock recovery for a while → finally flashed LineageOS 17.1 + GApps. It boots. Play Store works. Posting the whole thing because I couldn't find one writeup that covered all of it.

The device

• Lenovo TB-X304L (Tab 4 10, the LTE variant)
• SoC: Qualcomm MSM8917 (Snapdragon 425)
• Stock: Android 8.1.0, build ...S001017_190709_ROW
• Host: Arch Linux

Goal: unlock bootloader → install LineageOS 17.1 (Android 10).

Problem 1: OEM unlock is greyed out

The usual path (Developer Options → OEM Unlocking) was greyed out:

• ro.oem_unlock_supported = true
• sys.oem_unlock_allowed = 0 ← this is the one blocking me
• fastboot flashing get_unlock_ability = 0

No device owner, no MDM, just a stubborn flag. So I went the low-level route: Qualcomm EDL mode (the 05c6:9008 "Emergency Download" mode) and bkerler's edl tool.

Sub-problem: no firehose programmer

EDL needs a signed "firehose" loader (prog_emmc_firehose_8917_ddr.mbn) to talk to storage, and the edl repo doesn't bundle one for MSM8917.

Fix: I had the stock QDL firmware for this exact model. It contained prog_emmc_firehose_8917_ddr.mbn. The edl tool wants it named by HWID, so I copied it to:

~/edl/Loaders/000560e100000000_92242cf8f6fad111_FHPRG.bin

python3 edl.py nop confirmed the handshake:

CPU detected: "MSM8917"
HWID:   0x000560e100000000
PK_HASH: 0x92242cf8f6fad111...

printgpt dumped the full partition table. We were in.

The actual unlock: patching devinfo

On Qualcomm/LK bootloaders, the lock state lives in the devinfo partition. I backed up devinfo, aboot, boot, persist first (always back up).

Dumped devinfo and looked at it:

000000  41 4e 44 52 4f 49 44 2d 42 4f 4f 54 21 00 00 00  ANDROID-BOOT!...
000010  00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00  ................

Here's the gotcha that would've bricked the flag: a lot of copy-paste guides tell you to set byte 0 to 0x01. But byte 0 is the start of the ANDROID-BOOT! magic string. Corrupt that and the bootloader rejects the whole struct. The real is_unlocked field sits at offset 0x10, right after the 13-byte magic + padding.

So I flipped offset 0x10 from 00 → 01, wrote it back, and reset:

python3 edl.py w devinfo devinfo_patched.bin
python3 edl.py reset

Result:

fastboot oem device-info
(bootloader) Device unlocked: true

Bootloader unlocked. No factory-reset-toggle needed — went around the greyed-out switch entirely.

Problem 2: a Full Disk Encryption password I never set 🔒

Device reboots and... stops at a "enter password to start" pre-boot screen. I never set a PIN/password. It was a "freshly factory reset" tablet. But there it was, demanding a password to decrypt /data.

I went down the rabbit hole of trying to "crack" it. Then it clicked:

>

Nobody "recovers" these — they wipe the encrypted data. And since I was installing LineageOS anyway (which wipes everything), that was totally fine.

Getting it wiped

Reboot loops + key-combo roulette eventually got me to the bootloader's boot menu, which confirmed:

Device state: unlocked

Selected fastboot mode, and from the PC:

fastboot erase userdata
fastboot erase cache
fastboot format userdata

That destroyed the FDE crypto footer. Rebooted → stock Android booted straight to the setup wizard, no password. The wall was gone. (ro.boot.flash.locked = 0 confirmed unlocked at the boot level too.)

Problem 3: I almost flashed a ROM for the WRONG tablet 😬

This one nearly bricked it. The XDA thread is titled tbx304f/l/x but the post I landed on listed:

• lineage-17.1-...-**TB8504**.zip
• device tree android_device_lenovo_**TB8504**
• "LineageOS 17.1 for Lenovo TAB4 8"

TB-8504 = Tab 4 8 (8-inch). My tablet is TB-X304 = Tab 4 10 (10-inch). Different panel, different device tree → classic dead-display brick.

The trap: the kernel source URL had tbx304 in it (these tablets share one kernel branch), which makes it look right. What actually matters is the device tree + the ZIP filename. Rule I now live by: if the filename says 8504, it's the 8-inch — don't flash it. You want X304/TBX304 in every filename.

Correct files (same thread, different section):

• lineage-17.1-20210408-UNOFFICIAL-**TBX304**.zip
• **tbx304**-twrp-3.4.0-20210407.img
• open_gapps-arm64-10.0-pico

Problem 4: TWRP vs stock recovery whack-a-mole

Flashed TWRP:

fastboot flash recovery tbx304-twrp-3.4.0-20210407.img

Then tried fastboot reboot recovery... and it booted stock Android instead. Two things bit me repeatedly:

1. The bootloader's reboot-to-recovery shows a timed boot menu that auto-boots to system if you don't pick "Recovery mode" fast enough.
2. Every time stock Android 8.1 boots, it overwrites TWRP with stock recovery (the install-recovery.sh mechanism) and re-encrypts /data.

So I'd flash TWRP, miss the menu timing, land in stock, and lose TWRP — over and over.

What finally worked: flash TWRP, then park the device in fastboot and manually select "Recovery mode" from the menu with no countdown pressure. Confirmed I was really in TWRP because the adb shell came up as root (uid=0) instead of stock's uid=2000(shell).

Problem 5: clearing encryption inside TWRP

The install guide is blunt: coming from Android 8 stock, you must Format Data (with data loss) because the old encryption is incompatible — skip it and you bootloop. Important detail: TWRP's command-line tool has no format command (only wipe), and wipe data does not remove the crypto footer. "Format Data" is a deliberate on-screen action (type yes). Did that.

Then pushed both zips and installed via TWRP CLI (which only works when you're genuinely in TWRP as root):

twrp install /sdcard/lineage-17.1-20210408-UNOFFICIAL-TBX304.zip   → script succeeded [1.0]
twrp install /sdcard/open_gapps-arm64-10.0-pico-20220215.zip       → Installation complete!

(The device rebooted to stock on me once mid-process, but the pushed zips survived on /sdcard, so I just got back into TWRP and finished. Order that saved time: install both zips first, Format Data last, then reboot.)

🎉 It boots

First boot sat on the LineageOS animation a few minutes (normal — it builds caches + sets up encryption), then... Welcome screen.

Verification from adb:

ro.lineage.version = 17.1-20210408-UNOFFICIAL-TBX304
Android = 10 (SDK 29)
Model = Lenovo TB-X304L / TBX304
Play Store + GMS + GSF = installed ✅
verifiedbootstate = orange (unlocked) ✅
baseband = S.JO.3.0-00452-8937 (modem loaded; OUT_OF_SERVICE only because no SIM)
root = none (stock LOS)

Lessons / things I wish a single post had told me

1. devinfo unlock flag is at offset 0x10, not 0x00 (don't clobber the ANDROID-BOOT! magic).
2. Hardware-backed FDE is uncrackable — wipe /data, don't fight it.
3. Match the device variant exactly. Kernel URLs lie; trust the device tree + ZIP name. 8504 ≠ X304.
4. fastboot flash recovery, never just fastboot boot — and don't let stock Android boot before you get into TWRP, or it eats your recovery.
5. Format Data ≠ Wipe Data. Only Format removes the old encryption.
6. Always back up devinfo/aboot/boot/persist over EDL first, and keep the stock QDL firmware. That's your un-brick button.
7. Never re-lock the bootloader on a custom ROM.

From "locked + password-walled + sealed" to "unlocked LineageOS 10 with Play Store." Worth it. AMA

Any information?