[ZTE Axon 7 ROMs, Kernels, Recoveries, & Other Deve] stepw:
tenfar's tool seems to be based on QC's emmcdl, but generic emmcdl (e.g. https://github.com/binsys/emmcdl) is useless without signed firehose PBL, which tenfar was not willing/able to release.

However I'm pretty sure there's access to all UFS LUNs /dev/block/sdX and most partitions from TWRP, so you could use dd commands rczrider gave you in http://xdaforums.com/showpost.php?p=68461077&postcount=51 to access them.

recovery filesystem table
=========================
0 /system ext4 /dev/block/bootdevice/by-name/system 0
1 /cache ext4 /dev/block/bootdevice/by-name/cache 0
2 /data ext4 /dev/block/bootdevice/by-name/userdata 0
3 /sdcard vfat /dev/block/mmcblk0p1 0
4 /boot emmc /dev/block/bootdevice/by-name/boot 0
5 /recovery emmc /dev/block/bootdevice/by-name/recovery 0
6 /misc emmc /dev/block/bootdevice/by-name/misc 0
7 /emmcboot emmc /dev/block/bootdevice/by-name/aboot 0
8 /apdp emmc /dev/block/bootdevice/by-name/apdp 0
9 /bluetooth emmc /dev/block/bootdevice/by-name/bluetooth 0
10 /cdt emmc /dev/block/bootdevice/by-name/cdt 0
11 /cmnlib emmc /dev/block/bootdevice/by-name/cmnlib 0
12 /cmnlib64 emmc /dev/block/bootdevice/by-name/cmnlib64 0
13 /cryptkey emmc /dev/block/bootdevice/by-name/cryptkey 0
14 /ddr emmc /dev/block/bootdevice/by-name/ddr 0
15 /devcfg emmc /dev/block/bootdevice/by-name/devcfg 0
16 /devcfgbak emmc /dev/block/bootdevice/by-name/devcfgbak 0
17 /devinfo emmc /dev/block/bootdevice/by-name/devinfo 0
18 /dip emmc /dev/block/bootdevice/by-name/dip 0
19 /dpo emmc /dev/block/bootdevice/by-name/dpo 0
20 /dsp emmc /dev/block/bootdevice/by-name/dsp 0
21 /echarge emmc /dev/block/bootdevice/by-name/echarge 0
22 /persistent emmc /dev/block/bootdevice/by-name/frp 0
23 /fsc emmc /dev/block/bootdevice/by-name/fsc 0
24 /fsg emmc /dev/block/bootdevice/by-name/fsg 0
25 /hyp emmc /dev/block/bootdevice/by-name/hyp 0
26 /keymaster emmc /dev/block/bootdevice/by-name/keymaster 0
27 /keystore emmc /dev/block/bootdevice/by-name/keystore 0
28 /lksecapp emmc /dev/block/bootdevice/by-name/lksecapp 0
29 /mdtp emmc /dev/block/bootdevice/by-name/mdtp 0
30 /modem emmc /dev/block/bootdevice/by-name/modem 0
31 /msadp emmc /dev/block/bootdevice/by-name/msadp 0
32 /persist emmc /dev/block/bootdevice/by-name/persist 0
33 /pmic emmc /dev/block/bootdevice/by-name/pmic 0
34 /reserve emmc /dev/block/bootdevice/by-name/reserve 0
35 /rpm emmc /dev/block/bootdevice/by-name/rpm 0
36 /sec emmc /dev/block/bootdevice/by-name/sec 0
37 /splash emmc /dev/block/bootdevice/by-name/splash 0
38 /ssd emmc /dev/block/bootdevice/by-name/ssd 0
39 /sti emmc /dev/block/bootdevice/by-name/sti 0
40 /tz emmc /dev/block/bootdevice/by-name/tz 0
41 /xbl emmc /dev/block/bootdevice/by-name/xbl 0
42 /xblbak emmc /dev/block/bootdevice/by-name/xblbak 0
43 /ztecfg emmc /dev/block/bootdevice/by-name/ztecfg 0
44 /fbop emmc /dev/block/bootdevice/by-name/fbop 0
45 /tmp ramdisk ramdisk 0

Furthermore, all partitions are also in /dev/block/sdX[1-99]. Here's a list from stock B20 kernel bootlog:

[01-01 00:00:01.369] [0][51: async_run_entry] sda: sda1 sda2 sda3 sda4 sda5 sda6 sda7 sda8 sda9
[01-01 00:00:01.369] [2][270: async_run_entry] sdb: sdb1
[01-01 00:00:01.369] [0][272: async_run_entry] sdc: sdc1
[01-01 00:00:01.379] [2][274: async_run_entry] sde: sde1 sde2 sde3 sde4 sde5 sde6 sde7 sde8 sde9 sde10 sde11 sde12 sde13 sde14 sde15 sde16 sde17 sde18 sde19 sde20 sde21 sde22 sde23 sde24 sde25 sde26
[01-01 00:00:01.379] [3][271: async_run_entry] sdf: sdf1 sdf2 sdf3 sdf4 sdf5
[01-01 00:00:01.379] [1][52: async_run_entry] sdd: sdd1 sdd2 sdd3

If you are seriously considering touching anything other than boot=sde12, system=sde13 and recovery=sde14, backup ALL partitions, maybe with the exception of (encrypted) userdata=sda9. There's unique device-specific data in some of them that is not easy to recover.

To map partitions to names, dump and parse GPT's residing in the first 5 sectors of each LUN (sda-sdf).