Root Stock T-Mobile Springboard - Huawei MediaPad, T-Mobile SpringBoard

Update:
I was able to use this method to root the new ICS update. The thread has been edited accordingly.
----------------------------------------------
I was unable to find a single thread that detailed how to root the stock T-Mobile Springboard firmware and keep the boot and recovery partitions intact to allow future updates, so I have consolidated information from other threads and posts, as well as adding a little myself. Full credit goes to the users and thread OP's referenced in the post links below.
The usual warnings apply: Under no circumstances should anyone do this to their device. You are likely to brick your device and render it completey unusable. In addition, you will void your warantee with T-Mobile. So you will have an out-of-warantee brick instead of a nice, functional tablet. Turn back now while there is still time.
Before you begin, I obviously did this to my device without any problems. My device is running full stock T-Mobile Springboard firmware with the following:
Android version: 4.0.3
Baseband version: 314007
Kernel version: 3.0.8
Build number: S7-303uV100R002C201B035
I do not know if it will work on a device with any other version of the firmware. The following also assumes that you have fastboot and ADB installed and functional on your computer.
In describing how to boot into fastboot and recovery modes below, the description of the volume buttons is how they are while in portrait mode in Honeycomb....as this is where I first used this method. In other words, the volume button closer to the power button is volume up and the other volume button is volume down.
1. Download the CWM Recovery image from this post:
http://forum.xda-developers.com/showpost.php?p=23601045&postcount=7
2. Download CWM-SuperSU-v0.95.zip from this post:
http://forum.xda-developers.com/showpost.php?p=27678611&postcount=22
3. Copy the CWM-SuperSU-v0.95.zip file to an sdcard and put the card in your device.
4. Flash the CWM recovery image to your first recovery partition ONLY:
a.) Boot into fastboot by powering down the device and starting it back up by pressing the
volume up and power buttons at the same time. After the device vibrates, release the
power button but keep holding the volume button until it is booted into fastboot.
b.) Once in fastboot, flash the recovery image:
Code:
fastboot flash recovery recovery5.5.0.4.img
5. Press and hold the power key for 10 seconds to reboot the device. It will boot into the
T-mobile firmware.
6. Power down the device in the usual fashion.
7. Boot into recovery by starting the device back up by pressing the volume down and power
buttons at the same time. After the device vibrates, release the power button but keep
holding the volume button until it is booted into CWM Recovery.
8. Choose 'install zip from sdcard' -> 'choose zip from sdcard', then select the
CWM-SuperSU-v0.95.zip file you put on your sdcard above, then confirm installation.
9. Go back to the main menu and select 'reboot system now'. It will boot into the T-Mobile
firmware.
10. Shut the device down again in the usual fashion, then restart normally and boot into the
T-Mobile firmware again.
11. Now you need to get your stock recovery partition back and get rid of CWM recovery.
There are two copies of the stock recovery- one on each 'recovery' and 'recovery2'. You can
get back to stock recovery by extracting an image from 'recovery2' and flashing it back to
'recovery'. The following (using adb from your computer) will dump the image from recovery2
to your sdcard:
Code:
adb shell
su
dd if=/dev/block/mmcblk0p18 of=/mnt/sdcard2/recovery.img
12. Take the sd card out of your device and copy this file back to your computer, then flash the
first recovery partition with this image as in step 4b above, but with your new recovery.img file.
You are now rooted and your recovery partitions are returned to stock.

---

Once you are rooted, if you would like to remove some of the T-Mobile bloatware note that the apk files are not in the usual location (/system/app). I found them tucked away in the following directory:
/data/cust/app
Of course, you will need an app like Root Explorer to get to them and delete them...or you can just use adb. I deleted several of the apk files in that directory, rebooted, and everything is working just fine...with less bloatware.
Also, be aware that any changes you make will be permanent. I tried hard reseting the device through the usual android settings menu security method, and I kept root and all of my deleted bloatware was still gone after it finished and rebooted. There does not appear to be a way to get all of your stock stuff back once you start deleting things...so make backups of files before you delete them in case removing them causes unexpected consequences.

---

Just to add another bit of information - a list of what I believe are the internal partitions and their locations appears below. I got this from the output from 'cat /proc/partitions' and 'mount', as well as further inspection of the stock recovery image that I extracted from my device. As we don't have a functional CWM Recovery, and I am not sure that I would use any version that was built for the Mediapad (i.e. non-Springboard) for backup and restoring, this list should give Springboard users a way to back up their devices. Using the 'dd' command as in the coding box at the bottom of the OP for each of the paritions should result in a partition image stored out on the sdcard. Fastboot then should be able to flash these 'backed up' images back to the device as in step 4b of the OP...with the correct partition names and backup files substituted of course. I did do this for the recovery partition as I detailed in the OP, but have not tried it for the rest of the partitions.
Code:
/misc emmc /dev/block/mmcblk0p14
/vrcb emmc /dev/block/mmcblk0p16
/recovery emmc /dev/block/mmcblk0p17
/recovery2 emmc /dev/block/mmcblk0p18
/boot emmc /dev/block/mmcblk0p19
/system ext4 /dev/block/mmcblk0p20
/cache ext4 /dev/block/mmcblk0p22
/cust ext4 /dev/block/mmcblk0p15
/data ext4 /dev/block/mmcblk0p27
/tmpdata ext4 /dev/block/mmcblk0p23
/persist ext4 /dev/block/mmcblk0p21
/tombstones ext4 /dev/block/mmcblk0p24
/firmware ext4 /dev/block/mmcblk0p1

---

Thanks
Many ty's for this.

---

Thanks you help me rooted my Springboard. Have you try the MediaPad Phone app can we use the tablet for calling? :good:

---

Do I have to do step 11 ?
Sent from my SpringBoard using XDA Premium App
---------- Post added at 06:11 PM ---------- Previous post was at 05:49 PM ----------
robkaos said:
Do I have to do step 11 ?
Sent from my SpringBoard using XDA Premium App
Click to expand...
Click to collapse
Also can I do it without PC?
Sent from my SpringBoard using XDA Premium App

---

Can I use the recovery image from the update that is still on my sd card,what is the difference between the I've springboard .rar, and the su files
Sent from my SpringBoard using XDA Premium App

---

robkaos said:
Do I have to do step 11 ?
......
Also can I do it without PC?
Click to expand...
Click to collapse
If you do not return your recovery partition to stock, then you will not be able to install future firmware updates from T-Mobile as their updates rely on the stock recovery. So no, you don't have to return your recovery partition to stock, but if you don't you will not be able to install future T-Mobile updates. As far as doing this without a computer - you can use a terminal emulator on your Springboard to create the recovery image from 'recovery2'....the commands should be the same. However, you need to fastboot flash that image back to 'recovery', which you must do from your computer with your device in fastboot mode.
robkaos said:
Can I use the recovery image from the update that is still on my sd card....
Click to expand...
Click to collapse
Yes, if you extract the recovery image from the official T-Mobile update package, you can use this image to flash 'recovery' back to stock when you are done.
Some people have reported that they are unable to boot into CWM recovery if it is flashed only to 'recovery' and not also to 'recovery2'. It is my experience that the device seems to alternate which recovery partition it boots into when you sequentially boot it into recovery mode. When I have CWM on 'recovery' and the stock recovery on 'recovery2', my device will boot into CWM every other time I boot into recovery mode. The other times it boots into the stock recovery. If you can't get CWM recovery to appear when you boot into recovery mode, you could do things a bit different than the instructions. Extract the stock recovery image from the official T-Mobile update package. Store this away on your computer. Then, instead of only flashing 'recovery' with CWM recovery, also flash 'recovery2'. Once you are done rooting the device, use your stored image of the stock recovery to flash 'recovery' and 'recovery2' back to stock.
Originally, I used this method to root Honeycomb. I did not have the T-Mobile update package for Honeycomb and so could not simply extract the stock recovery image from that package. You cannot use the 'dd' command as in step 11 above until you are rooted to dump the image of 'recovery2'. So, without a copy of the update package I could not get an image of my recovery partition without already being rooted. But to root, I have to overwrite my recovery partition with CWM recovery, thereby making it impossible to dump a copy of the stock recovery as I had wiped it out and replaced it with CWM. The solution was to only flash one of the recovery partitions and keep the other one as a backup until the device was rooted and the image could then be extracted.
robkaos said:
...what is the difference between the I've springboard .rar, and the su files
Click to expand...
Click to collapse
Not sure what you are asking here...please clarify.

---

I haVe found two different root files one su zip and the other is for media pad orange Tahiti ,andspringbord .rar which is the difference?there is not a one click Method like motor defy? My phone wasn't such a problem
Sent from my SpringBoard using XDA Premium App

---

robkaos said:
I haVe found two different root files one su zip and the other is for media pad orange Tahiti ,andspringbord .rar which is the difference?
Click to expand...
Click to collapse
I don't know about the root files for the Mediapad. I know there is a package that contains the su files and a Windows-based command file that contains a string of adb commands that is supposed to work to root both the Mediapad and the Springboard. I think what you are talking about can be found at either one of these locations:
http://www.modaco.com/topic/354579-...-mediapad-t-mobile-springboard-orange-tahiti/
http://www.gamefront.com/files/22185176/Huawei+MediaPad+ROOT+ICS+Android+4.0.x.rar
I tried to use this, and got a 'premission denied' fail pretty early on. I run Linux on my desktop, so perhaps this works under Windows with the specific Springboard drivers and interface software installed, but it sure does not work in Linux. I came up with my method (or rather consolidated the information for 'my' method from multiple other sources) as a result of having this root method fail for me.
robkaos said:
...there is not a one click Method like motor defy? My phone wasn't such a problem
Click to expand...
Click to collapse
If the files that I linked above work for you, then this is going to be about as close to a 'one-click' method as you can get. Unless you modified it, your Motorola Defy is running Android 2.1 (Eclair). This version of Android can be rooted pretty much just by yelling 'ROOT!' at your phone. There is even an app in the market that can be installed and run on an Android v2.1 device that provides a one-click root without the use of a computer. All of the exploits that were used for these one-click root methods were patched in Android v3+. Pretty much every device needs its own unique root method now, and the only way it is a one-click method is if someone has constructed a command script to execute all of the needed commands for you, as in the linked packages above.

---

xdajunkman said:
Also, be aware that any changes you make will be permanent. I tried hard reseting the device through the usual android settings menu security method, and I kept root and all of my deleted bloatware was still gone after it finished and rebooted. There does not appear to be a way to get all of your stock stuff back once you start deleting things...so make backups of files before you delete them in case removing them causes unexpected consequences.
Click to expand...
Click to collapse
Just to point out - now that the Springboard ICS update is out, and the zip has been captured and archived - there is a backup of complete stock ICS available. Every single partition is in there including system and cust. So worst case scenario if you bork it by zapping the wrong file in system or cust, you can reflash that partition from the bootloader.

---

Thanks for the clarification
Sent from my SpringBoard using XDA Premium App

---

cmstlist said:
Just to point out - now that the Springboard ICS update is out, and the zip has been captured and archived - there is a backup of complete stock ICS available. Every single partition is in there including system and cust. So worst case scenario if you bork it by zapping the wrong file in system or cust, you can reflash that partition from the bootloader.
Click to expand...
Click to collapse
You are, of course, correct. That statement of mine is now outdated...you can delete things to your hearts desire. If you mess something up, just reflash the firmware and start over.

---

Just finished rooting my MediaPad from t-mobile. I had to install into recovery one and two so now I have no original recovery but I don't really care, I've got the latest Android Ice Cream update beforehand. What usefull apps with root access do I need now? I've got ad free and ROM Toolbox. Was there a phone app that I could use now?

---

Failed updates and can't recover - PLEASE HELP!
xdajunkman said:
You are, of course, correct. That statement of mine is now outdated...you can delete things to your hearts desire. If you mess something up, just reflash the firmware and start over.
Click to expand...
Click to collapse
Well, unfortunately, I've messed things up. Here's what happened:
1) I received the OTA update and everything went fine with upgrading the my T-mobile Springboard tab to ICS 4.0.3
2) I then got brave and went ahead with rooting and installing SU using the technique described in "Root Stock T-Mobile Springboard" by xdajunkman. That worked fine and I was able to get CWM recovery installed.
3) I then tried to install the [ROM][ICS] [Unofficial] Root-ready Huawei/Springboard International ROM and downloaded the dload folder to my SDCard, etc. I tried using the dload folder with the ulmt.cfg file in it and that failed with a "Installation aborted" message. I then removed that file and tried to go into CWM and tried "Install from zip" approach. Same thing...installation aborted message.
4) So, then I did the next stupid thing...in CWM, I formatted my /system, /data, and /cache. That was a big mistake! I now have officially bricked by tab.
5) I tried to get rid of CWM recovery by extracting the recovery.img file from the stock rom zip file. I fastboot flashed that to the recovery and recovery2 partitions. I then thought, let me try extracting the update.zip from the stock rom zip and put that on the root of my sdcard and tried to install that. No go...it just says, update failed with a big red "FAIL" message in the center.
Any and all help would be immensely appreciated! How can I get back to some sort of working ROM? Please!
Thanks!

---

knightpawn said:
Well, unfortunately, I've messed things up. Here's what happened:
1) I received the OTA update and everything went fine with upgrading the my T-mobile Springboard tab to ICS 4.0.3
2) I then got brave and went ahead with rooting and installing SU using the technique described in "Root Stock T-Mobile Springboard" by xdajunkman. That worked fine and I was able to get CWM recovery installed.
3) I then tried to install the [ROM][ICS] [Unofficial] Root-ready Huawei/Springboard International ROM and downloaded the dload folder to my SDCard, etc. I tried using the dload folder with the ulmt.cfg file in it and that failed with a "Installation aborted" message. I then removed that file and tried to go into CWM and tried "Install from zip" approach. Same thing...installation aborted message.
4) So, then I did the next stupid thing...in CWM, I formatted my /system, /data, and /cache. That was a big mistake! I now have officially bricked by tab.
5) I tried to get rid of CWM recovery by extracting the recovery.img file from the stock rom zip file. I fastboot flashed that to the recovery and recovery2 partitions. I then thought, let me try extracting the update.zip from the stock rom zip and put that on the root of my sdcard and tried to install that. No go...it just says, update failed with a big red "FAIL" message in the center.
Any and all help would be immensely appreciated! How can I get back to some sort of working ROM? Please!
Thanks!
Click to expand...
Click to collapse
OK so you blanked system, screwed up data and possibly recovery. Cache shouldn't be an issue. Everything else is probably fine.
So from the Springboard ICS update zip, you'll want to flash each of the following from fastboot:
- stock recovery.img to recovery and recovery2
- boot.img just in case that got buggered up
- cust.img
- system.img.ext4
- userdata.img.ext4 (this will probably blank your internal storage but you probably already did that in the process because CWM doesn't know the difference)
At this point, does it boot? If it looks like it might be bootlooping on the animation, give it a good 20-30 minutes before you pronounce that it's not working. Wiping pretty much anything other than cache with CWM is a huge nono... it doesn't work right and it buggers a lot of things up.

---

Any particular locations for the other files via fastboot?
cmstlist said:
OK so you blanked system, screwed up data and possibly recovery. Cache shouldn't be an issue. Everything else is probably fine.
So from the Springboard ICS update zip, you'll want to flash each of the following from fastboot:
- stock recovery.img to recovery and recovery2
- boot.img just in case that got buggered up
- cust.img
- system.img.ext4
- userdata.img.ext4 (this will probably blank your internal storage but you probably already did that in the process because CWM doesn't know the difference)
At this point, does it boot? If it looks like it might be bootlooping on the animation, give it a good 20-30 minutes before you pronounce that it's not working. Wiping pretty much anything other than cache with CWM is a huge nono... it doesn't work right and it buggers a lot of things up.
Click to expand...
Click to collapse
Wow! Thanks for the help! I unfortunately, don't have my other computer that has the proper drivers installed to recognize the tablet and to run fastboot on. So, I'll try the fix you are suggesting once I get home today. However, in the meantime, I had some questions with regard to where I should flash the other files.
I understand that recovery.img should go to the recovery and recovery2 partitions.
What about the others? Does boot.img go to a particular partition? Effectively, what would the command line look like? (eg fastboot flash boot boot.img?)
Sorry about the newbie questions. I've installed a number of custom ROMs on phones using CWM, but this is a strange beast.
With regard to your question of whether it boots, well, kind of...it does boot to the T-mobile Springboard screen, then it sits there. I will let it sit for 20-30 minutes and see what happens. Will report back...for sure!
Thanks a ton!
[UPDATE]
So, I had a chance to install the TWRP recovery with the CM10 ROM. I loaded the CM10 ROM with the TWRP which installed successfully. I turned the tablet on and let it sit there for about 10 minutes and sure enough, CM10 runs just fine. However, I did notice that I cannot receive any calls. I am able to make calls, but when someone dials my number, it just goes straight to voicemail.
So, now, I'm wondering, if I can get the stock ICS with International ROM running so that I can try to use this thing as a phone, data and texting tab. I'll try what you suggested when I get home as mentioned earlier.

---

CM10 has too many problems, why would you want to use it?

---

cmstlist said:
OK so you blanked system, screwed up data and possibly recovery. Cache shouldn't be an issue. Everything else is probably fine.
So from the Springboard ICS update zip, you'll want to flash each of the following from fastboot:
- stock recovery.img to recovery and recovery2
- boot.img just in case that got buggered up
- cust.img
- system.img.ext4
- userdata.img.ext4 (this will probably blank your internal storage but you probably already did that in the process because CWM doesn't know the difference)
At this point, does it boot? If it looks like it might be bootlooping on the animation, give it a good 20-30 minutes before you pronounce that it's not working. Wiping pretty much anything other than cache with CWM is a huge nono... it doesn't work right and it buggers a lot of things up.
Click to expand...
Click to collapse
That worked for me. After playing with vold.fstab I had rendered my Springboard unusable (got the encryption was unsuccessful screen!).
I really wanted to switch the apps installation path to the external sd card but did not succeed.

---

What am I doing wrong
I have not been able to root my springboard at all. It will go to a black screen that says enter fastboot and it just stays there. When I type to flash the recovery it says it cannot load it. I have adb and fastboot installed...could it be a driver issue? I now know that I am in the correct screen, just can't get this thing rooted. any help would be appreciated thanks.
Well I feel quite stupid. But figured out where I went wrong and for the love of God got my Springboard rooted. *whew*