# Lenovo Legion Y700 Gen 4 (TB322FC) – "our1.0.9" Full ROM Package

- **Build Version**: `our1.0.9`
- **Target Device**: Lenovo Legion Y700 Gen 4 (`TB322FC TAB 12G+256GBL-CN`, Snapdragon 8 Elite / SM8750)
- **Base Firmware**: Official Lenovo ZUXOS 2.5.02.086 (Android 17) — based on a 100% original, unmodified `payload.bin`.
- **Kernel State**: **100% original, stock kernel (`init_boot.img`, SHA256: `1fd4b524…`, 8,388,608 bytes)** (No root/modified kernel components included).
- **Signing Key**: `testkey_rsa4096.pem` (RSA-4096)
- **Rollback Index**: `1788566400` (Locations 0 & 2)

—

## Cumulative Changelog (vs. Official 086 Firmware)

This build is a complete Full ROM package based on the official 086 firmware. It incorporates all optimizations and usability enhancements developed to date, applied via in-place modification of the system partition. —

### 1. Security and Signing System Alignment (AVB & Security Architecture)
1. **100% Synchronization of Security Patch Levels (SPL)**:
- Resolved discrepancies in security patch dates across partitions found in the official stock firmware by standardizing the SPL for `system`, `product`, `system_ext`, `vendor`, and `init_boot` to a single, unified date: **`2026-09-05`**. 
- Effectively eliminates errors related to "Device not certified by Google Play" and prevents bootloader SPL verification mismatches.
2. **Consistent AVB RSA-4096 Digital Signing (`testkey_rsa4096.pem`)**:
- Applied a consistent, unified test key to sign `boot.img`, `vbmeta.img`, and `vbmeta_system.img`. 
- Eliminates the risk of forced user data wipes (factory resets) caused by TEE/Keymint key mismatches.
3. **Physical Recalculation and Alignment of dm-verity Merkle Trees**:
- Precisely mapped and recorded the Merkle trees for the patched `system` (`super_4.img`) and `product` (`super_3.img`) partitions to their exact physical disk offsets. 
- Configured `fec=0` to ensure full alignment and prevent kernel panics resulting from parity mismatches.
4. **Preservation of the Original Stock Kernel**:
- Retained the official, unmodified stock `init_boot.img` without injecting any custom or rooted kernel components. —

### 2. System Partition Enhancements and Optimization Patches (`super_4.img` / system)
1. **Fix for 'Safety & Emergency' Crash in Settings App (`ZuiSettings.apk`) [New in v1.0.9]**:
- **Root Cause (Stock Firmware Defect)**: Although the device property `ro.zui.software.safeurl` is set to `true`, the tablet-specific UI layout lacks the `url_security` element (designed for smartphones). This causes `findPreference("url_security")` to return `null`; due to a lack of defensive coding by the Lenovo development team, this triggers a NullPointerException (NPE) and forces the app to close. 
- **Patch Details**: Injected bytecode—specifically an early return (`return-void`)—at the beginning of the `ZuiEmergencyDashboardFragment.updateSafeUrlstate()V` method within `classes7.dex` to handle cases where `mUrlSecurity` is `null`. 
- **Integrity**: The original file size (`190,952,820` bytes) is maintained exactly, ensuring the integrity of the ext4 file system structure.
2. **Restoration of Face Unlock (`framework.jar`)**:
- Properly enabled four key LGSI flags (including `ZuiFaceAuth` and `HalFaceImportServer`) within `classes6.dex`. 
- Restored front-camera-based face unlocking and biometric authentication functionality.
3. **Improvements to Package Installer (`ZuiPackageInstaller.apk`)**:
- Fixed an issue where the [Done] and [Open] buttons were unresponsive on the APK installation completion screen. 
- Changed the default state of the "Delete original APK after installation" checkbox to `OFF` (unchecked) to prevent the unintended deletion of files. 4. **AccuWeather Global Weather Integration (`WeatherCenter.apk` & `ZuiWeather.apk`)**:
- Replaced the China-exclusive weather server with the AccuWeather global backend. 
- Fixed the notorious "7,667,811-degree" temperature display bug; weather data for Korea and other global regions is now retrieved correctly.
5. **Permanent Removal of 18 Placeholder Icons for Uninstalled Chinese Apps (`launcher_2layer.db`)**:
- Completely purged database records for 18 "empty shell" shortcut icons—such as those for Weibo, TikTok, Kuaishou, and Baidu—that would otherwise appear on the home screen when the corresponding Chinese-market apps are not installed.
6. **Integration of Official, Unmodified `services.jar` (Version 086)**:
- Prevents ART `VerifyError` issues and bootloops caused by custom modifications.

—

### 3. Product Partition Whitelist Patch (`super_3.img` / product)
1. **System Whitelist Injection for Google Play Games (`product/etc/sysconfig/google.xml`)**:
- Registers the `com.google.android.play.games` package into the system whitelist, granting exemptions from power-saving restrictions, data-usage limitations, and background network constraints (exact match: 6,854 bytes).

—

### 4. Flash Package Specifications and Safety Mechanisms
- **Full Package for EDL / QFIL / Qualcomm Flash Tool**: Includes 117 partition images, along with a complete set of 7 `rawprogram*.xml` and 6 `patch*.xml` manifest files.
- **Bootloop Prevention Mechanism**: Includes a 1MB `zeros_misc.bin` file designed to block "Fastboot Fallback" loops. – **Genuine Merkle tree specifications**: 
- `system`: Image Size `13,151,711,232` B, Root Digest: `30fa57d4746b9af0e4aee0d93af073bc2ef2e54162f7d2f0a7ca2d88b20f8b1e` 
- `product`: Image Size `1,181,896,704` B, Root Digest: `1f15665637854327aa658f327a6bda44a802a39bf13bc22e1fd4aac7213cb3c0` 
- `system_ext`: Image Size `547,602,432` B, Root Digest: `4481a89618d447ad9909832abadb0a21694aefc4dee87fd9d5dea20950fff4c3` 
- `vendor`: Image Size `1,650,774,016` B, Root Digest: `7b1f4f68b7a7a09d17fac499b6e0d92aa86868c34c21c4e5ffe1056cb57f97e8`