Asus Z380kl Unlock Bootloader Site Forum.xda-developers.com
Dozens of old ZTE phones with Qualcomm processors can now be bootloader unlocked
The regular kick sequence of a typical Qualcomm Snapdragon chipset-powered Android device is initiated with the
Primary
Bootloader (PBL), although there exists an culling boot mode called
Emergency
Down50oad Mode (EDL). The latter is strictly intended for OEM servicing and can exist used to
‘unbrick’ a device
with appropriate software binaries via a protocol named ‘Firehose’. Interestingly, EDL is often utilized by tinkerers to get low-level sectionalisation admission, which can further exist exploited to
accomplish bootloader unlock on some devices. Based on this principle as well equally the
previous research work washed by the Aleph Security team, XDA Senior Member
alexenferman
has now discovered a generic method to unlock the bootloader of a bunch of ZTE phones without any information loss.
ZTE apparently uses the ‘devinfo’ partition to store crucial bootloader state parameters, including the lock/unlock status. Equally the Firehose protocol has a provision of reading the contents of individual partitions, one tin can dump the ‘devinfo’ partition from a bootloader-locked device, alter the offset where the unlocking parameters are stored, and write the modified image back to the device to unlock the bootloader.
Unlike Xiaomi
and some other OEMs, ZTE doesn’t even put a safeguard before the EDL mode against such ‘attacks’, thus yous can easily trigger the device to boot to emergency download mode via a simple
ADB
command. The only take hold of is that the method won’t work on ZTE phones that launched with Android 8.0 Oreo or newer, and information technology also won’t work on flagship devices like the
Axon ix Pro,
Axon 10 Pro,
Axon M, etc.
Dumping the ‘devinfo’ partition using QFIL
According to XDA Recognized Developer
deadman96385, this method works with the following devices:
Devices with MSM8909 (Qualcomm Snapdragon 210) SoC
- ZTE Avid 4 (Z855) (code-name: calbee)
- ZTE Maven 2 (Z831) (code-proper noun: chapel)
- ZTE Maven 3 (Z835) (lawmaking-name: draco)
- ZTE Majesty Pro Plus (Z899VL) (code-proper noun: elden)
- Unknown ZTE (lawmaking-name: forbes)
- ZTE ZMAX I (Z719DL) (code-name: gemi)
- ZTE Tempo Ten (N9137) (code-name: grayjoylite)
- ZTE M X View 2 (K81) (code-proper name: helen)
- ZTE Overture 3 (Z851) (lawmaking-name: jeff)
- ZTE Fanfare iii (Z852) (code-proper noun: kelly)
- ZTE ZFive Chiliad LTE (Z557BL) (code-proper noun: lewis)
- ZTE ZFive C (Z558VL) (code-proper noun: loft)
- Unknown ZTE (code-name: refuge)
- ZTE N818S (lawmaking-proper name: sapphire/sapphire4G)
- ZTE Blade Vantage (Z839) (lawmaking-name: sweet)
Devices with MSM8952 (Qualcomm Snapdragon 617) SoC
- Android v.i.1
- ZTE Grand X Max 2 (Z988) (code-proper noun: jerry)
- ZTE Imperial Max (Z963U) (code-name: lily)
- ZTE Max Duo LTE (Z963VL) (code-proper noun: nancy)
- ZTE Axon Max (C2016) (code-name: orchid)
- ZTE Max Duo LTE (Z962BL) (code-name: tom)
- Android 6.0.i
- ZTE ZPAD (K90U) (code-proper noun: gevjon)
- ZTE AT&T Trek 2 (K88) (code-proper noun: jasmine)
- ZTE Grand 10 Max two (Z988) (code-name: jerry)
- ZTE Axon Max (C2016) (code-name: orchid)
- ZTE ZMAX Pro (Z981) (code-name: urd)
- Android vii.one.ane
- ZTE AT&T Trek 2 (K88) (code-proper name: jasmine)
-
ZTE Axon 7 Mini
(B2017G) (lawmaking-proper name: tulip)
Devices with MSM8920/MSM8937/MSM8940/MSM8953 (Qualcomm Snapdragon 427/430/435/625) SoCs
- ZTE Blade Force/ZTE Warp eight (N9517) (code-name: warp8)
- ZTE 1000 X4 (Z956/Z957) (code-name: finacier)
- ZTE Bract Spark (Z971) (code-proper noun: peony)
- ZTE Blade 10 (Z965) (code-proper name: proline)
- ZTE Max XL/ZTE Bolton (N9560) (lawmaking-name: bolton)
- ZTE Bract Z Max (Z982) (lawmaking-name: crocus)
- Unknown ZTE (code-name: flame)
- ZTE Blade 10 Max (Z983) (lawmaking-proper noun: stollen)
- ZTE Blade Max View (Z610DL) (code-name: violet)
- ZTE Max Blue LTE (Z986DL) (code-name: florist)
- ZTE AT&T Primtime (K92) (code-proper noun: primerose)
Additionally, the ZTE Avid 4, ZTE Tempo X, ZTE Regal Max, and ZTE K X View 2 should as well be compatible with this process. Interested users should accept a await at
deadman96385‘s
unofficial ZTE Firehose repo
and pick the correct set of programmers before lilliputian with their devices. The step-past-pace bootloader unlocking process can be found in the thread linked below.
Bootloader Unlocking on Qualcomm ZTE Devices — XDA Give-and-take Thread
