LTBox

Quick start

Windows — x86_64 / arm64

Recommended: Install with Scoop. The Windows build carries no code-signing certificate.

1. Install LTBox:

   Command Copy

   scoop bucket add ltbox https://github.com/miner7222/scoop-bucket
   scoop install ltbox

2. Update LTBox later:

   Command Copy

   scoop update ltbox

3. Open LTBox, pick a task from the sidebar, and follow the wizard.

Quick start

Linux — x86_64 / aarch64

Recommended: Install with APT or YUM/DNF. Choose the alternative for your distribution.

1. Debian/Ubuntu (APT)

   Command Copy

   sudo install -d -m 0755 /etc/apt/keyrings
   curl -fsSL https://miner7222.github.io/ltbox-repo/ltbox-repo.asc | sudo tee /etc/apt/keyrings/ltbox-repo.asc >/dev/null
   echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/ltbox-repo.asc] https://miner7222.github.io/ltbox-repo stable main" | sudo tee /etc/apt/sources.list.d/ltbox.list >/dev/null
   sudo apt update
   sudo apt install ltbox

   Update LTBox later:

   Command Copy

   sudo apt update
   sudo apt upgrade ltbox

2. Fedora (YUM/DNF)

   Command Copy

   sudo rpm --import https://miner7222.github.io/ltbox-repo/ltbox-repo.asc
   cat <<'EOF' | sudo tee /etc/yum.repos.d/ltbox.repo >/dev/null
   [ltbox]
   name=LTBox
   baseurl=https://miner7222.github.io/ltbox-repo/yum/$basearch
   enabled=1
   gpgcheck=1
   repo_gpgcheck=1
   gpgkey=https://miner7222.github.io/ltbox-repo/ltbox-repo.asc
   EOF
   sudo dnf install ltbox

   Update LTBox later:

   Command Copy

   sudo dnf upgrade ltbox

3. Replug the device once after installing.
4. Open LTBox from the app menu, pick a task from the sidebar, and follow the wizard.

Quick start

macOS — universal (Apple Silicon + Intel)

Requires macOS 11 (Big Sur) or later.

Recommended: Install with Homebrew. The macOS build carries no code-signing certificate; the app bundle is ad-hoc signed and not notarized, so Gatekeeper blocks it until the quarantine attribute is cleared — the Homebrew install needs that step just as the manual one does. A third-party tap must also be trusted once before Homebrew will load its cask.

1. Install LTBox:

   Command Copy

   brew tap miner7222/tap
   brew trust miner7222/tap
   brew install --cask ltbox

2. Update LTBox later:

   Command Copy

   brew upgrade --cask ltbox

Then, however you installed it:

1. The bundle is ad-hoc signed, so Gatekeeper blocks the first launch. Clear the quarantine once, either way:

   • right-click LTBox.app → Open, then confirm in the dialog, or
   • run the command below (adjust the path if the app is not in /Applications).
   Command Copy

   xattr -dr com.apple.quarantine /Applications/LTBox.app

2. Open LTBox.app, pick a task from the sidebar, and follow the wizard.

No separate USB driver setup is needed on macOS — the Qualcomm 9008 (EDL) and ADB devices are reached directly through the bundled libusb. Replug a device if it isn't detected.

Guides

Supported devices

Every Snapdragon Lenovo device released before 2026 ships a bootloader that trusts the AOSP test key, starting with the Lenovo Z5 Pro‡ in 2018.§ It only became public in the Chinese community — and LTBox only written — in 2025, so support is limited to the models below, chosen for what could be tested and what was worth testing.

‡ Tablets. On tablets the range starts with the Lenovo Yoga Smart Tab, released in 2019.

§ Exception. Models with a near-identical Motorola counterpart are not affected — their firmware appears to have been built by the Motorola team, which was not exposed to this vulnerability.

† Cutoff. Some models received an OTA that replaces the AvbRSAPublicKey embedded in the ABL from the AOSP test key to a new key.

On some 2026 hardware the above vulnerability is gone, but a new GBL exploit lets unsigned code run through efisp — LTBox supports most features on the device below through that path.

Reference

Links