Huawei Mediapad T1 8.0 Pro (huawei-t18p0)
Manufacturer | Huawei |
---|---|
Name | Mediapad T1 8.0 Pro |
Codename | huawei-t18p0 |
Released | 2015 |
Hardware | |
Chipset | Qualcomm Snapdragon 410 (MSM8916) |
CPU | Quad-core Cortex-A53 1.2 GHz |
GPU | Adreno 306 |
Display | 800x1280 IPS TFT |
Storage | 16 GB |
Memory | 1/2 GB |
Architecture | aarch64 |
Software | |
Original software | Android |
Original version | 4.4.4 (EmotionUI 2.3) |
postmarketOS | |
Category | testing |
Pre-built images | no |
Contributors
- Roboe: collecting scarce available information and sources before trying to port pmOS. Currently brute-forcing the bootloader unlock.
Users owning this device
- Roboe (Notes: (second hand) T1-821W; running stock Android until I manage to unlock its bootloader)
- SomnIncedo
Models
There seems to be three different models: one wifi-only with 1 GB of RAM, and two others with a LTE modem and 1 GB/2 GB of RAM.
Model | LTE modem | RAM |
---|---|---|
T1-821W | No | 1 GB |
T1-821L | Yes | 1 GB |
T1-823L | Yes | 2 GB |
Anyway, I (Roboe) have the wifi-only model and its stock Android's ro.product.device
is hwt1821l
and its ro.product.name
is t1_8p0lte
.
How to enter flash mode
Using ADB from stock Android:
- Recovery:
adb reboot recovery
- Fastboot:
adb reboot bootloader
- Qualcomm EDL:
adb reboot edl
(works with a locked bootloader)
TODO: EDL is only accessible from the booted stock Android. That means it can only be used safely to read partitions o dump them. Writing them risks bricking the device. I've tried (Roboe) shorting every test point combination I'm aware of in the PCB in order to get access to EDL, multiple times, with and without battery connected, but all those efforts have been in vain so far. A Xiaomi EDL cable does not work either. |
With hardware buttons:
- Recovery: Power on the device with both
Power
andVolume Up
buttons. - Fastboot: With the device off, hold
Volume Down
button while connecting a micro USB cable.
Unlock bootloader
Unfortunately, official unlock method was shut down by Huawei on May 24th, 2018.[1][2] See also Bootloader#Huawei.
Fortunately, the open source community is awesome and there are a number of brute-force alternatives:
- https://github.com/B83C/huawei_bootloader_unlocker (testing for some hours... nothing yet)
- https://github.com/haexhub/huaweiBootloaderHack
- etc.
Stock images
Huawei seems to have removed any references to these tablets from their websites, but diving into the Spanish Support page or the German Support page, you can still get your hands in the T1-821W's firmware for Spain and the T1-821L's firmware for Germany:
- T1 WIFI_Open Market_Spain_B003
- Huawei T1 WIFI Firmware(T1-821W, Android 4.4, EMUI 2.3, V100R001C232B003CUSTC100D001, Spain).zip|December 29, 2015|1G
- Huawei MediaPad T1 8.0 LTE Firmware (T1-821L, Android 4.4, EMUI 2.3, V100R001C278B003CUSTC278D001, Germany, Telefonica)
- Huawei_MediaPad T1 8.0 LTE_Firmware_T1-821L_Android 4.4_EMUI 2.3_V100R001C278B003CUSTC278D001_Germany_Telefonica.zip|March 29, 2016|1013M
These contain a PDF file with instructions (in English) to sideload the update from the SD card using the stock recovery, and the UPDATE.APP
file containing the actual OS. There's a number of projects to extract flashable images from UPDATE.APP
:
- rogarb/huextract: written in Rust, you need to compile it with Cargo before running it. Tested: extracting images works fine.
- chinaykl/HuaweiUnpack: written in Java, there's a precompiled
jar
file in theout/
folder. You need to run it in a terminal withjava -jar
. Tested: CLI is a little weird, but extracting works fine. - etc.
Hidden fastboot OEM commands
Analyzing the extracted ABOOT.img
brings some hidden fastboot OEM commands:
# apt install binutils #or apk add binutils $ strings huawei-t18p0_ABOOT.img | grep "^oem " oem get-psid oem enable-charger-screen oem disable-charger-screen oem emmc_diag oem dump oem emmc-dump oem select-display-panel oem getversion oem log-ctr oem get-product-model oem get-build-number oem battery_present_check
Particularly interesting are the fastboot oem dump
and the fastboot oem emmc-dump
commands.
There's a hidden menu in the stock OS with useful information. Open it like this:
- Open the Calculator app in landscape mode
- Type in order:
()()2846579()()=
- A menu should appear listing three options (beware the third option!):
MMITest_II
: seems like a common diagnostic tool called MMI Test or HwMMITest, depending on the device.ProjectMenu
: this will bring you to another menu with multiple options. Caution with them, since they can e.g. reset your tablet entirely. Beware the 7th option,Battery Charge Control
, it seem to be the same as the next top-menu option.BatteryCharge
: beware that clicking this option will set the tablet's brightness and volume to their full and start vibrating while reproducing a Chinese video, in order to test the battery duration.
There are a number of interesting options behind the ProjectMenu
option:
2. Background setting
->3. Usb ports setting
will let you change USB mode. As far as I've read on the internet, the proprietary DC Unlocker program requires this to be changed tomanufacturer mode
in order to give you Huawei devices' bootloader unlock code. In case you change it, it defaults toOther mode
, at least on my (Roboe) Spanish T1-821W.2. Background setting
->6. Dump & Log
will let you check some logs, apparently. Needs further investigation.3. Veneer information query
->1. S/H version query
will list software and hardware version, like AMSS, OEMSXL, EFS, APPSBOOT, baseline or CUST version numbers. My (Roboe) T1-821W seems to correspond to the hardware version numberSH1T121WM_VERA
(pun not intended).3. Veneer information query
->2. Apparatus type query
gives a quite interesting hardware overview, read below.
According to the Apparatus type query
, my (Roboe) T1-821W seems to have this hardware:
Entry | Value |
---|---|
Touch screen type | SYNAPTICS_S3207A_ofilm_0005 |
Camera type | External camera type:s5k4e1_liteon_13p1_pad Internal camera type:ov2680_ofilm_fe16_pad |
EMMC Flash type | SanDisk |
LCD type | BOE_NEW_BP080WX_8_800P_VIDEO |
board ID | Mediapad T1 8.0-821W |
Light sensor type | APS9930/TMD27723T |
Gsensor type | ST LIS3DH |
Installation
Not yet.
See also
- Huawei Mediapad T1 8.0 WiFi T1-821W Detailed Tech Specs - PhoneDB
- Kernel DTS (from the Mediapad T1 10 source): T1-821W, T1-821L, T1-823L
- Unofficial TWRP device tree
- Custom recovery build (TWRP-based?)
- A wild
t18p0_junda_fw.img
firmware blob appeared in an unrelated codebase! - A wild
t18p0_ofilm_fw.img
firmware blob appeared in an unrelated codebase!