Skip to content

Home

Jump to bottom
OO edited this page Jun 9, 2026 · 12 revisions

LTBox is a tool for flashing and modifying firmware on certain Lenovo tablets. It can switch firmware between the PRC (China) and ROW (Global) regions, root and unroot the device, bypass anti-rollback, and read or write partitions over EDL (9008) mode.

⚠️ Educational purposes only. Modifying firmware can brick your device, cause data loss, or void your warranty. You use LTBox at your own risk.

LTBox dashboard

Quick Start

🪟 Windows — x86_64 / arm64

  1. Download the latest release and extract the zip (no spaces or special characters in the path).
  2. Double-click ltbox.exe.
  3. Pick a task from the sidebar and follow the wizard.

Qualcomm USB drivers: when they're missing, the dashboard shows a Qualcomm USB drivers are missing banner. Click Install and LTBox downloads the signed qcom-usb-userspace-drivers release and runs its installer — approve the Windows UAC prompt when it appears. A reboot is recommended afterward.

🐧 Linux — x86_64 / aarch64

  1. Install the runtime dependencies (Debian/Ubuntu shown — adapt for your distro): 
    sudo apt install \
  libusb-1.0-0 libudev1 \
  libxkbcommon0 libxkbcommon-x11-0 libwayland-client0 \
  libxcb1 libxcb-render0 libxcb-shape0 libxcb-xfixes0 \
  libfontconfig1 \
  xdg-utils
  2. Download the latest release Linux tarball and extract it (tar -xzf LTBox-linux_*.tar.gz). The executable bit on ltbox is preserved.
  3. Install the udev rules so the desktop session can open the Qualcomm 9008 / Lenovo USB devices without root: 
    sudo ./ltbox --install-udev
  4. Replug any connected device.
  5. (Optional) Add an app-menu entry and icon (per-user, no root): 
    ./ltbox --install-desktop
    This drops a .desktop file under ~/.local/share/applications/ and the SVG icon under ~/.local/share/icons/hicolor/scalable/apps/. GNOME / KDE pick it up within a few seconds. Re-run after moving the binary.
  6. Run ./ltbox.

🍎 macOS — universal (Apple Silicon + Intel)

Requires macOS 11 (Big Sur) or later.

  1. Download the latest release macOS tarball (LTBox-macos_universal-*.tar.gz) and extract it (tar -xzf LTBox-macos_universal-*.tar.gz).
  2. (Optional) Move LTBox.app to /Applications.
  3. The bundle is ad-hoc signed, so Gatekeeper blocks the first launch. Clear the quarantine once, either way:
    • right-click LTBox.app → Open, then confirm in the dialog, or
    • run xattr -dr com.apple.quarantine /path/to/LTBox.app.
  4. Open LTBox.app, pick a task from the sidebar, and follow the wizard.

No separate USB driver setup is needed on macOS — the Qualcomm 9008 (EDL) and ADB devices are reached directly through the bundled libusb. Replug a device if it isn't detected.

Guides

Supported devices

The devices below ship a bootloader that trusts the AOSP test key. Hardware released from 2026 on has this vulnerability patched.

Device ZUXOS ZUI
Legion Tab Y700 2nd Gen Full support Full support
Xiaoxin Pad Pro GT / Yoga Tab 11.1 AI 1.5.04.428 and earlier † 17.5.04.059 and earlier †
Yoga Pad Pro AI / Yoga Tab Plus AI 1.5.10.186 and earlier † 17.5.10.096 and earlier †
Legion Tab Y700 3rd Gen 1.5.10.236 and earlier † 17.5.10.170 and earlier †
Legion Tab Y700 4th Gen 1.5.10.138 and earlier † NONE

† Cutoff. Some models received an OTA that replaces the AvbRSAPublicKey embedded in the ABL from the AOSP test key to a new key.

On some 2026 hardware the above vulnerability is gone, but a new GBL exploit lets unsigned code run through efisp — LTBox supports most features on the device below through that path.

Device ZUXOS ZUI
Legion Tab Y700 5th Gen Full support Full support

Reference

  • How It Works — the technology behind region conversion, rooting, anti-rollback bypass, and EDL flashing.
  • Troubleshooting — fixes for known issues (TEE repair, Play Integrity, Widevine).

Links

Clone this wiki locally