LTBox

LTBox is a tool for flashing and modifying firmware on certain Lenovo tablets. It can switch firmware between the PRC (China) and ROW (Global) regions, root and unroot the device, bypass rollback protection, and read or write partitions over EDL (9008) mode.

Educational purposes only.

Modifying firmware can brick your device, cause data loss, or void your warranty. You use LTBox at your own risk.

LTBox dashboard showing the connected device information
The LTBox dashboard with a connected device.

Quick start

Windows — x86_64 / arm64

  1. Download the latest release and extract the zip (no spaces or special characters in the path).
  2. Double-click ltbox.exe.
  3. Pick a task from the sidebar and follow the wizard.
Qualcomm USB drivers

LTBox can use either the kernel or the userspace Qualcomm USB driver, switchable in Settings → Qualcomm USB driver. Windows defaults to the kernel driver (the same one QFIL uses, so you can switch between the two tools without reinstalling). When the selected driver is missing, the dashboard shows a driver banner — click Install and LTBox downloads the matching signed release (qcom-usb-kernel-drivers or qcom-usb-userspace-drivers) and runs its installer; approve the Windows UAC prompt when it appears. A reboot is recommended afterward.

Quick start

Linux — x86_64 / aarch64

  1. Install the runtime dependencies (Debian/Ubuntu shown — adapt for your distro):

    Command 
    sudo apt install \
  libusb-1.0-0 libudev1 \
  libxkbcommon0 libxkbcommon-x11-0 libwayland-client0 \
  libxcb1 libxcb-render0 libxcb-shape0 libxcb-xfixes0 \
  libfontconfig1 \
  xdg-utils
  2. Download the latest release Linux tarball and extract it (tar -xzf LTBox-linux_*.tar.gz). The executable bit on ltbox is preserved.

  3. Install the udev rules so the desktop session can open the Qualcomm 9008 / Lenovo USB devices without root:

    Command 
    sudo ./ltbox --install-udev
  4. Replug any connected device.

  5. (Optional) Add an app-menu entry and icon (per-user, no root):

    Command 
    ./ltbox --install-desktop

    This drops a .desktop file under ~/.local/share/applications/ and the SVG icon under ~/.local/share/icons/hicolor/scalable/apps/. GNOME / KDE pick it up within a few seconds. Re-run after moving the binary.

  6. Run ./ltbox.
EDL driver mode (Linux)

The udev rules above cover ADB access and the userspace EDL path. On Debian-based distros LTBox defaults to the kernel EDL driver (Qualcomm's qud package) and offers to install it from the dashboard banner via pkexec. Non-Debian distros stay on userspace. Switch modes anytime in Settings → Qualcomm USB driver.

Quick start

macOS — universal (Apple Silicon + Intel)

Requires macOS 11 (Big Sur) or later.

  1. Download the latest release macOS tarball (LTBox-macos_universal-*.tar.gz) and extract it (tar -xzf LTBox-macos_universal-*.tar.gz).
  2. (Optional) Move LTBox.app to /Applications.

  3. The bundle is ad-hoc signed, so Gatekeeper blocks the first launch. Clear the quarantine once, either way:

    • right-click LTBox.app → Open, then confirm in the dialog, or
    • run xattr -dr com.apple.quarantine /path/to/LTBox.app.
  4. Open LTBox.app, pick a task from the sidebar, and follow the wizard.
Still won't open / "LTBox was blocked"?

macOS may still block the app even after the steps above. Open System Settings → Privacy & Security, scroll down to the Security section, and click Open Anyway next to the "LTBox" was blocked to protect your Mac message, then confirm with Touch ID or your password.

No separate USB driver setup is needed on macOS — the Qualcomm 9008 (EDL) and ADB devices are reached directly through the bundled libusb. Replug a device if it isn't detected.

Guides

Connecting a Device Install the drivers and connect your tablet. Read this first. Install Other Region Firmware Put global firmware on a China device, or the reverse. Install Same Region Firmware Reinstall or restore firmware for your device's original region. Root a Device Root your tablet without unlocking the bootloader. Unroot a Device Restore the stock boot image from your root backup.

Supported devices

The devices below ship a bootloader that trusts the AOSP test key. Hardware released from 2026 on has this vulnerability patched.

DeviceZUXOSZUI
Legion Tab Y700 2nd GenFull support17.0.339 and earlier †
Xiaoxin Pad Pro GT / Yoga Tab 11.1 AI1.5.04.428 and earlier †17.5.04.059 and earlier †
Yoga Pad Pro AI / Yoga Tab Plus AI1.5.10.186 and earlier †17.5.10.096 and earlier †
Legion Tab Y700 3rd Gen1.5.10.236 and earlier †17.5.10.170 and earlier †
Legion Tab Y700 4th Gen1.5.10.138 and earlier †NONE

† Cutoff. Some models received an OTA that replaces the AvbRSAPublicKey embedded in the ABL from the AOSP test key to a new key.

On some 2026 hardware the above vulnerability is gone, but a new GBL exploit lets unsigned code run through efisp — LTBox supports most features on the device below through that path.

DeviceZUXOSZUI
Legion Tab Y700 5th GenFull supportFull support

Reference

How It Works The technology behind region conversion, rooting, rollback protection bypass, and EDL flashing. Troubleshooting Fixes for known issues (TEE repair, Play Integrity, Widevine).
Latest release Main repository