[Moto Z Guides, News, & Discussion] benzinerwin:
Warning: This is dangerous! Even if you do everything according to the following description, your phone may end up damaged! There are no warranties!!

You may want to have a look at this thread: [GUIDE] to enable DualSim on SingleSim Moto Z by xequtor.

It also describes a way to enable dual-sim capability for devices that are shipped with just single-sim capability. Based on the research by -=MoRpH=- for another MOTO device, xequtor adapted the hack for the MOTO Z - nice work!

That method requires you to perform modifications on files within the FSG partition and setup a persistent variable. This is considerably safe, since this basically affects pretty generic data. Stick with this, if you want to keep the risks of what you're doing (to your device) rather low!

Note: if you did the changes as descibed in xequtor's guide and you now want to try out this method - you first need to revert those changes, e.g. restore your backup of the original fsg partiton (TWRP)!

There is another way. I initially wanted to post it into xequtor's thread. However, I decided against it in order to avoid confusion that can easily result in irreparable data loss if done wrong! The required modification is considerably simple, even much simpler than the other approach, but it bears a different kind of risk: you're operating on per device individual data. These are usually not part of "nandroid" backups. Device-individual data is stored in the various partitons of the sdc flash drive. The following approach makes a tiny modification to the HW partition. However, we first make backups - and only with those in hand, the potential risks are severely mitigated, almost eleminated!

unlock bootloader

perform dualsim mod patch <--

here we go!

re-lock bootloader

Advantages: persistent: with patch applied, you phone will remain a dual-sim phone, regardless of OTA-/fastboot-updates and restored backups. relock-safe: with a stock rom properly installed, you can relock the bootloader and keep the dual-sim feature. It doesn't vanish after OTA-updates etc. You have to manually revert the mod to get back to single-sim mode.

Issues: IMEI-1: as with all dualsim mods: IMEI-1 will display as 0 (invalid), a carrier possibly may not let you connect. Detectable modification:Though this mod does in no way affect the security of this device, is is detectable. In the unlikely event, that this causes problems, you can still undo the changes and go back to single-sim mode. Unlocked bootloader:If you unlocked your bootloader just for this mod, as we cannot do the mod without, you can lock it again afterwards. However, the warranty-void bit keeps being set.

You need:

USB-Stick (either native or via USB-C-Hub/Adapter) ... or ... microSD card ...or... do it all via fastboot & adb

have fastboot & adb drivers installed.

have the bootloader unlocked

If you have just only unlocked the bootloader and changed nothing else then make a backup of your current recovery image! For this you can boot TWRP from ram:

fastboot boot twrp-3.1.0-0-griffin.img

Then you have to flash TWRP in order to be able to write the mod to flash - afterwards, you still can restore the original recovery and then relock the bootloader.

fastboot flash recovery twrp-3.1.0-0-griffin.img

Mod via USB-stick / microSD-card & update_signed.zip: [Note: this is experimental and risky! For now, I recommend the manual option described below]

copy the attached update_signed.zip to your USB stick (or microSD card)

connect USB-Stick/microSD card to your MOTO-Z

boot into TWRP recovery

install --> go to usb/sdcard and select the update_signed.zip

in order to activate the mod, you still need to erase the partitions modemst1, modemst2 and cache: reboot into bootloader...

fastboot oem hw
fastboot erase modemst1
fastboot erase modemst2
fastboot erase cache
fastboot reboot

Modding details / diy via fastoot & adb:

boot into bootloader mode

fastboot oem hw

you'll see the dualsim: false entry. That's what we are want to change...

boot recovery from flash (ram boot = no write access)

adb shell "dd if=/dev/block/sdc3 of=/tmp/sdc3.bin"
adb pull /tmp/sdc3.bin

Look for the dualsim entry via hex editor. There you will find the pattern "dualsim [...] \06 [..] false \00". The update script changes that to "dualsim [...] \06 [..] true \00 \00". It should be \05, but that requires proper checks of the absolute address boundaries - you might need to rearrange all the following tags. A sting with two terminating zeros keeps the structure and has no negative effect. (See hex editor screenshots below).

[IMG="dualsim=false"]http://frickelbude.net/moto/dualsim-false.png[/IMG]

[IMG="dualsim=true"]http://frickelbude.net/moto/dualsim-true.png[/IMG]

Afterwards, upload the modified file back to the phone and dd it back into flash:

adb push sdc3_mod.bin /tmp/sdc3_mod.bin
adb shell "dd if=/tmp/sdc3_mod.bin of=/dev/block/sdc3"
adb reboot bootloader

in bootloader mode you may want to check whether it worked.. & erase modemst1, modemst2 & cache!

fastboot oem hw
fastboot erase modemst1
fastboot erase modemst2
fastboot erase cache
fastboot reboot

Here are some pictures from my re-locked dualsim-modded stock rom - as you can see, full dualsim support is present. However, no IMEI for the second sim card. At least here in Germany and many other countries that's (currently) not an issue.

I didn't upgrade to the latest nougat version in order to keep my current bootloader version... (I'm running LineageOS anyway..)

Links:

https://dl.twrp.me/griffin/twrp-3.1.0-0-griffin.img.html