[Zuk Z1 Q&A, Help & Troubleshooting] SkandaH:
Introduction

As we know, the official way to unlock the bootloader of Zuk Z1 is through fastboot.

For a untouched device, the status of the bootloader should be:

fastboot -i 0x2b4c oem device-info
...
(bootloader) Device tampered: [COLOR="Red"]false[/COLOR]
(bootloader) Device unlocked: [COLOR="Red"]false[/COLOR]
(bootloader) Charger screen enabled: false
(bootloader) Display panel:

To unlock the bootloader, you need to enable 'OEM unlocking' under Developer options first, then via bootloader/fastboot interface:

fastboot -i 0x2b4c oem unlock-go

It'll eventually erase the userdata.

Then the status of the bootloader should be:

fastboot -i 0x2b4c oem device-info
...
(bootloader) Device tampered: [COLOR="Red"]false[/COLOR]
(bootloader) Device unlocked: [COLOR="Red"]true[/COLOR]
(bootloader) Charger screen enabled: false
(bootloader) Display panel:

Inspired by the findings on similar devices, we can actually unlock the bootloader of Zuk Z1 without using fastboot, while keeping the userdata intact.

How-to

Warning!

It is dangerous! This whole thing is basically one giant hack - which is not intended to be done by normal users. It is messing with the bootloader partition, so it is possible that something goes wrong and you will have a nice & costly brick in your pocket. Be prepared to revive the device from a hard-brick.

1.

Enable 'OEM unlocking' under Developer options. You may need to tap the Build number 7 times under About phone to get the Developer options under Settings.

2.

We need root access (kinda expected!). To root the device without unlocking bootloader, use KingRoot. Use the Android version.

Now there is a catch! KingRoot can root the device, cause the latest build of Cyanogen OS (cm-12.1-YOG4PAS3OH-ham ATM) contains such vulnerabilities which can be exploited by the root exploits used by KingRoot. But we can't ensure about future.

3.

After being rooted, use adb shell or any terminal emulator to dump the 'aboot' i.e bootloader partition in internal sdcard:

su
dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/aboot.img

4.

Now we need to modify the dumped image using hex-editor. For Zuk Z1:

Unlock Bit Position - 0x001FFE10 Hex
Tamper Bit Position - 0x001FFE14 Hex

'00' means false, '01' means true. So to set the bootloader as unlocked, we just need to change the following:

Save the modified image as 'abootmod.img' inside your sdcard.

5.

Now its time to flash back the modded bootloader. Execute the following from adb shell or any terminal emulator:

su
dd if=/sdcard/abootmod.img of=/dev/block/bootdevice/by-name/aboot

Do a reboot & voila! You have unlocked the bootloader! Don't just believe me - check the status of the bootloader to ensure.

Note

1. We can also reset the tamper bit using this procedure.

2. If you prefer GUI, then you can use this fantastic app by [MENTION=3562083]wanam[/MENTION].

3. This is tested on an international Zuk Z1 running cm-12.1-YOG4PAS3OH-ham. Please test & post feedback to ensure compatibility.

4. I'm not providing pre-modified images as it increases the risk of bricking the devices having older/newer bootloaders - please do it yourself. The offsets should be unchanged in future, though.

Credits

1. [MENTION=4544860]osm0sis[/MENTION]

2. [MENTION=4551856]segv11[/MENTION]

3. [MENTION=5381511]Mnt-XDA[/MENTION]

4. [MENTION=7044935]Tengo10[/MENTION] - for risking his device for this experiment.

5. Users of XDA.

Happy tinkering! :highfive: :good: