yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] deadman96385:
Here is the stock firmware including the firehose needed to flash it

B10 Firmware

Here

B12 Firmware

Here

ZPI file for ZTE SalesMultiDL tool

Here

Here is a step by step guide on how to flash the stock rom with QFIL and by extension any image.

Download and install the Qualcomm drivers from here

Download the firmware from above

Extract the firmware to a folder that you can easily access them from like your desktop

Download and install QPST from here

Open the QFIL application (Find it in your start menu)

In the "Select Build Type" field select Flat Build

In the "Select Programmer" field navigate to the folder you extracted the firmware and support files to and select the prog_emmc_firehose_8917.mbn file

Select the "Load XML" button and navigate to the folder you extracted the firmware and support files to and select the rawprogram0.xml and then the patch0.xml when prompted.

Plug in your tablet

Run the following adb command "adb reboot edl" (Now the screen should be blank but the led light should be red)

If the text at the top of the QFIL application says "No Port Available" click the "Select Port..." option and pick your device. If your device isn't showing up there you didn't install the drivers properly.

Click the Download Button to begin flashing your device
[Miscellaneous Android Development] deadman96385:
Here is the Stock wallpapers in case anyone wants them

https://www.androidfilehost.com/?fid=1395089523397903558
[Miscellaneous Android Development] pegb856:
I just got this device a couple days ago and was hoping I could use PDANet/Foxfi to connect more than one device at a time to wifi hotspot but they've evidently blocked the apps.. Do you have any insight to that?
[Miscellaneous Android Development] deadman96385:
I don't own this device sadly just grabbed the firmware for a friend of mine and posted it here in case anyone in the future wants it.
[Miscellaneous Android Development] pegb856:
Ok thank you for the reply.
[Miscellaneous Android Development] famewolf:
If you WANT to own this device it's currently $19 out the door on visible.com. No Trade required.

https://slickdeals.net/f/13221781-visible-r2-is-now-19-without-service-or-trade-in-requred
[Miscellaneous Android Development] Bowsa2511:
I'm gonna see if I can flash Chinese firmware to unlock the bands
[Miscellaneous Android Development] famewolf:
Good Luck finding the A0722 firmware (that's the model androidpolice thinks this is a renamed version of).
[Miscellaneous Android Development] Bowsa2511:
https://imgur.com/yOe0vIx
[Miscellaneous Android Development] famewolf:
Your elite google-fu obviously exceeded my own. Please make that sharable if you can....megaupload.nz would hold it and is free.
[Miscellaneous Android Development] Bowsa2511:
https://mega.nz/#!aRo0CaBA!nm37c3V11tr2260V23wIxb4yZufD5-_f6gID8i3HjSY

Let me know if it's helpful
[Miscellaneous Android Development] famewolf:
DISREGARD. Looks like out of date info.
[Miscellaneous Android Development] LazyCouchPotato:
Any of you able to get fastboot working on it? ADB works, but my fastboot doesn't detect the phone.
[Miscellaneous Android Development] deadman96385:
Nice looking out, just ordered one.
[Miscellaneous Android Development] dud89:
Using one of the hidden activities app from the play store. There is an option to change from LTE to 2G/3G/4G under one of the phone settings. But calling still did not work with either AT&T or T-Mobile.
[Miscellaneous Android Development] FEGuy:
Just a heads-up: even if you found the files for the A0722, you'd brick your R2 if you managed to flash them. The chassis and screen seem to be the same, but they're completely different specs-wise. Given that the A0722 has a different SoC and an eMMC chip 2-4x larger, I doubt you'd get real far in the flashing process in the first place.
[Miscellaneous Android Development] famewolf:
In my case my main goal was to use it and the factory software to learn about mbn files. I've dealt with LG's TOT and KDZ files but not the mbn's. Thanks for giving folks the warning though.
[Miscellaneous Android Development] FEGuy:
Would it be possible for someone to grab the download URL for whatever OTA update is available for the device? I don't think it's anything major but I'd like to poke around at it; the firmware uploaded here seems to be from launch.
[Miscellaneous Android Development] famewolf:
I've got a logcat recorder queued up to be installed and will try to grab an url by starting the download. If that fails there are a couple of alternatives....someone who has DONE the upgrade could rip the rom and make it available if [MENTION=4222965]deadman96385[/MENTION] can point to some instructions on how to rip the rom.

Also you can always let your own upgrade occur because he's already provided the original software and QFIL which would let you restore to original factory and get the update again.

As a last resort I can grab the log from my ROUTER that the phone is connected to and try to get the url that way which I've had to do with SOME devices.
[Miscellaneous Android Development] FEGuy:
I'll probably end up taking the OTA again anyways as I've been messing around with the firmware from the first post. Honestly, I'd really recommend staying away from flashing it without a good reason. Even when the flasher works, either the logging and/or the flasher hangs and it's close to impossible to tell which without unplugging your phone. If a partial flash leaves you in a state where you can't get to ADB to boot to EDL mode, you'll have to boot into diagnostics mode, use a piece of Chinese software to boot from there back to EDL, and within five seconds or so, close that software and start the flashing process from QFIL before the com port stops responding to requests, leaving you to reboot the phone and start again.

I've been trying to get non-LTE networks and calling working, but it's entirely impossible to tell whether my tweaks are having unintended side effects or if the flashing just crapped out partway through, even when I'm just flashing single partitions.
[Miscellaneous Android Development] deadman96385:
I'll be posting B12 firmware shortly, you may have better luck with miflash it's another edl flashing tool designed for xiaomi but it works on anything.

Edit: Posted B12 firmware as well as the ZPI file so you could use the ZTE MultiDL tool to flash as well if desired.
[Miscellaneous Android Development] famewolf:
If you grab the modem img and extract it you might be able to tell if it even supports additional bands. Adding the option to firmware won't do much if the modem doesn't allow for them. My adb is hung "famewolf 4717 0.0 0.0 0 0 ? Zsl 00:01 0:00 [adb] <defunct>" and won't run again till I reboot which I'm not going to do as I have other things running so I've been unable to do much with it. Since the update is only 150mb I can assume it's one big patchfile anyway. Does it not have a hotkey method to go to bootloader? Ie hold down power and up vol or down vol...one usually goes to recovery and the other bootloader...from there if fastboot works and assuming you've backed up ALL the partitions as img's a fastboot flash <partition> partition.img will usually help you get back on track.

This might be useful...says it's Power and Vol up on the ZTE Blade A511: https://hardreset24.com/instruction/how-to-put-zte-blade-a511-in-bootloader-mode
[Miscellaneous Android Development] paulCIA:
Thanks I just got one of these from Visible for $20 (best deal of prime day and didn't come from Amazon) with Oreo 8.1 preinstalled, but I'm new to all this Qualcomm firmware programming, though I have programmed a number of FPGA boards and microcontrollers in my time so hopefully I'll manage to do something useful, like get root and not brick it. [At that price, it's basically a burner phone that I won't mind if I do brick anyway.]

Also I know, from making it work with my "officially non-supported" Pixel 2 XL, that the whole Visible service runs over LTE and LTE only, but in the phone specs it literally says the thing supports GSM and CDMA so one would imagine that it is indeed possible to somehow enable the other bands and use it with other networks even if it doesn't come that way out of the box because it doesn't need them at all for Visible service.

It seems to be one of the ZTE devices that doesn't have fastboot, and I have yet to figure out how to access the bootloader or what it is. Even if you enable "OEM Unlocking" in the developer settings and adb reboot-bootloader or use VolUp+Power it just boots straight into normal user mode. You can get into EDL mode with VolDn+Power, from there, I have managed to get a QCN backup but getting some protocol errors when I try to dump the whole firmware so I'll see what I can do.
[Miscellaneous Android Development] FEGuy:
Pretty sure the bootloader's actually unlocked, but I could be wrong. Flashing Magisk just gives me bootloops rather than any sort of integrity errors, and I don't have the tools downloaded on this notebook to try and build TWRP for it.
[Miscellaneous Android Development] deadman96385:
That is promising it's either unlocked or the dm-verity images aren't implemented in the bootloader. I'll have time tonight/tommorow to play with mine it arrived and I've just charged it so far. #WorkProblems
[Miscellaneous Android Development] FEGuy:
I'm leaning towards the former; dumped devinfo.bin and the unlock bits already seemed to be set, unless I'm fundamentally misunderstanding how that works. Digging in has been slow going otherwise; I'm out in the boonies with a slow connection, no working Linux partition, and a growing hatred for how Windows/NTFS handles file permissions.
[Miscellaneous Android Development] famewolf:
Have you considered booting from a live dvd/usb drive? You can even install necessary packages which will of course only remain until you reboot. A jump drive with persistence enabled would keep your changes.
[Miscellaneous Android Development] FEGuy:
Nah, I need to set up a full Arch install again at some point anyways, I've just been putting it off due to slow internet speeds. Honestly tempted to activate my Visible SIM just to see if whatever throttled speeds I get are better than the blazing 3Mb/s we get from our ISP, but the house is right on the edge of a coverage zone; I don't think Verizon even deals up here, normally.
[Miscellaneous Android Development] FEGuy:
Now we're getting somewhere.
[Miscellaneous Android Development] deadman96385:
How did you get a non-verfied IMG to boot? Couldn't get mine to allow anything and while messing with a072 firmware I seem to have broken my partition layout because I can't flash system, userdata, vendor anymore with edl userdata and vendor come after system. So I'm stuck on a non-verfied a072 system.

I can access recovery and EDL via DFU so i should be able to recover with a un-verified twrp or if there is a way to disable verity
[Miscellaneous Android Development] FEGuy:
I'll be honest, I've done nothing to mess with verity; the bootloader seems to support enforcing it but I don't see anywhere that actually sets partitions to require verification. I just modified the rawprogram0.xml to only feature the partitions and images I wanted to flash and used QFIL to flash them. It's been hit-or-miss, but for the most part if stuff won't boot it's because of errors with init or something else. The TWRP is basically just some recovery files from the R2 mashed into a working TWRP for the moto e5 Plus (same screen res, same 425 chipset for some models, seemed like a good choice). The A0722 is a different beast in the same body, with a beefier chipset and a larger eMMC, so it's not really surprising that things didn't go so well.

I did have an issue where some bad flashes left me unable to reflash stock system and vendor partitions the proper way, and they'd basically stop flashing after the first 2M of the image. If that's what's happening for you, you can go to Tools -> Partition manager in QFIL, find the partition you want to flash, right click -> manage partition data -> load image -> select the image you want to flash. It should work with the stock images but if it complains you may need to use simg2img or something similar to convert them to a plain ext4 image first. Honestly I'm still having issues reflashing those partitions 'normally' but the phone boots so I'm not really worried about it.

If you think your partition table is screwed up, you can try just flashing the gpt files first, commenting out or removing everything else in the XML. The flasher looks for offsets on the eMMC rather than the partition table, so it'll flash those where they're supposed to go and ignore everything else. Also, just comment out the userdata section of the rawprogram xml as it's basically designed to throw errors. It tries to flash a zero-byte image as sparse, which means it stops and complains about the headers being wrong. Even if you change the XML so that it's not read as sparse, flashing a null image would probably wipe the partition; a factory reset every flash isn't always useful.

If you want, I can upload the TWRP image and the QFIL settings I used to flash it, but it's largely untested; I know sideloading and flashing ZIPs works, but I've yet to try backing up or restoring partitions. It also hangs (at least in my case) for a minute at startup because it tries to decrypt the data partition without user input, so if there's anything set up it times out before letting the user do anything.

EDIT: Here's the TWRP image, with the XMLs for QFIL. Again, not really tested, bad things bound to happen, I take no responsibility for bricked phones or lost data, etc., etc. Anyone looking to flash this had better back up whatever data they have.
[Miscellaneous Android Development] deadman96385:
msm8940 and msm8917 are actually very similar and you can boot builds across them with a bit of work (I have done it on other devices). So with your method of using partition manager, I was able to get back to a booting system. I have been trying to get my source built twrps working but haven't been able too. What all did you change in your mashed up twrp? That one works minus the delay with it failing to decrypt. It's really weird though if i unpack and repack your twrp just as a test it does the same thing as my source built ones which is instantly go to DFU.
[Miscellaneous Android Development] FEGuy:
I don't have all the tools downloaded yet to build from source so I basically just followed this guide; some small changes to prop.default (default.prop is just a symlink to it, and there's two attempts to force ro.secure to 1), added old-format external_sd and usb-otg entries to the recovery fstab (even though I don't think this thing supports OTG, and TWRP seems to want to default to looking at /sdcard anyways), then threw in the verity_key from stock recovery for good measure and rebuilt with the AIK scripts. If you're extracting/rebuilding it'd probably be best if you're doing it from Linux, since Windows makes anything with root-only permissions or symlinks a royal pain in the ass.
[Miscellaneous Android Development] FEGuy:
So for anyone who wants root, Magisk works fine up to 16.7 from about a year ago. Just flash it through TWRP, but be warned that it'll probably corrupt /data on install and force you to factory reset; you can wipe or format /data from TWRP. Even when it installs properly, it might reboot once right before hitting the home or setup screen, so don't freak out.

Newer versions of Magisk (17.0 and higher, from what I've tested) will cause endless boot loops. I suspect it's something similar to the ZTE Axon 7, where the stock kernel requires patching to work with newer versions of Magisk, so I guess that's something else to work on.
[Miscellaneous Android Development] famewolf:
Have you tested a nandroid backup/restore?
[Miscellaneous Android Development] FEGuy:
Not for the data partition, since it seems TWRP is unable to decrypt it even if the user doesn't set up any encryption themselves. I made liberal use of it for the boot partition while trying to get Magisk working, though, and I assume other partitions should work fine as long as TWRP can mount them.
[Miscellaneous Android Development] famewolf:
Did you try formatting the data partition from inside TWRP vs letting the factory rom format it? Great job on Magisk!
[Miscellaneous Android Development] FEGuy:
So the neat thing about the lack of pretty much any bootloader security features is that this device launched with Oreo, meaning it's using Google's Treble framework.

In theory, custom ROMs are close to as simple as flashing any generic Project Treble system image. You'd want the A-only, 64-bit images. You could theoretically even flash Pie or Q images, although it's not something I've tested.

In practice, it takes a bit more work. I can't find any way to flash the system partition from an image in the TWRP build I posted above, so easiest way is to convert the desired image from a sparse image to a standard one with simg2img, then either flashing the partition directly from QFIL or dd'ing it from TWRP's terminal or a root adb shell directly to the system partition. Out of the box, phhusson's AOSP Oreo ROM seems to be working fine, minus adaptive brightness; from the network menus I can access it looks like the forced provisioning for VoLTE and WiFi calling isn't happening, but it still doesn't want to connect to 3G networks, which is a whole other issue.

If I'd known it'd mess with the data partition I might've just done a factory reset from inside the Settings menu first, but I didn't, so instead I got an error screen telling me I needed to do a factory reset. That just booted me into recovery, so it's all the same in the end; even if I wipe and try flashing something to disable forced encryption, the data partition still gets encrypted on the next standard boot, which means there's either something non-standard happening (possible, given that the kernel also reacts poorly to new versions of Magisk) or I'm missing something obvious (also possible, since most of what I've managed to do has been the result of guesswork and trial-and-error).

Honestly I haven't messed with rooting a phone since my LG G4 was still running Lollipop, and the last time I really dug in was on devices that probably shipped with Gingerbread, so I'm kind of flying by the seat of my pants with all this.
[Miscellaneous Android Development] famewolf:
When you were running that alternate treble rom did the encryption issue still occur? If it's specific to the factory rom that would indicate it. Did you access the built in phone network settings via the *# code to see if they gave you additional choices? I recall when I was tethering on t-mobile alot on 3g I would set the mode to WCDMA only because I was right on a fringe area and it kept trying to step down to 2g because the signal quality would be poor. The wcdma only mode was NOT available from inside the rom and as I recall it would only work that way till the next reboot but it might offer you additional options especially on the alternate rom.

---------- Post added at 10:55 PM ---------- Previous post was at 10:48 PM ----------

As far as flashing a partition in twrp....a zip would use something like "package_extract_file("recovery.img", "/dev/block/bootdevice/by-name/recovery");" in the updater-script but as you indicated it's expecting a raw image. You've done wonders for the device....next stop Pie or Lineage 16. *ducks*
[Miscellaneous Android Development] FEGuy:
Y'know, I'm just realizing I might've screwed up with the fstabs. The phone does re-encrypt on other ROMs, but I'm pretty sure the default fstab lives on /vendor, which is smart as it means traditional system updates and ROM flashes don't touch it. I'l have to double-check that one, and also make sure I'm not accidentally making TWRP re-encrypt things itself.

I've been messing with the data dialer code since day one, and while I can get it to remember switching from LTE Only to something else (Global, LTE/UMTS Auto, WCDMA only, etc.) none of those seem to have an effect on how it connects - I've never seen it latch on to anything but LTE towers. Additionally, on the stock ROM the VoLTE Provisioned and the Wifi Calling Provisioned toggles turn themselves right back on if you turn them off, on the AOSP ROM without patching anything back from the stock frameworks they're grayed out and entirely unselectable.

As for packaging and flashing ROM zips, I don't really have a lot of expertise on the subject. With the G4 I had to deal with a bootloader lock, which meant exploiting the stock flashing tool and then using dd to write an image, whereas the Treble guides say to directly flash the sparse image through TWRP, as a sparse image file to the system partition, and I can't even find an option for that.

EDIT: Yeah, so it turns out I'm an idiot. Fairly certain I didn't reflash /vendor after my last attempt to remove force-encryption, but the forceencrypt property for /data was still set in /vendor/etc/fstab.qcom regardless. Additionally, it was still in TWRP's fstab files because I copied them wholesale from the stock recovery. The former's a quick fix from a root shell and I can push another version of TWRP up real quick to fix the latter (although I should really get around to doing a proper build from source at some point). I should also note that removing the forceencrypt property caused the phone to bootloop until I formatted /data, so that's something to be aware of.
[Miscellaneous Android Development] famewolf:
I know at least the basics for creating zip's that can flash a .img file to the appropriate partition. I can even have it check to make sure that it's the right device and abort otherwise...pretty sure I can mod a rom zip from another device to use our img's/roms if those are available etc. I have not dealt with treble but it looks awesome and I'm wondering if there is a pie image available to test. As far a twrp flashing images when you are in the gui you should be able to just go to install and then click on "install image" and navigate to the appropriate folder on the device that has the .img file. Apologies if I'm misunderstanding any of the things you mention. I've been working with a cheap chinese device for a while (le pro 3) and previous device was a lg v10 which was locked down more than anything I've ever seen with it's KDZ and TOT files.
[Miscellaneous Android Development] FEGuy:
The only options that are showing up for images in TWRP that I can see are to flash them as boot or recovery - no other partitions, mounted or otherwise. Might be because of a build flag or config for the Moto e5 Plus TWRP I mutilated to make it.

Meanwhile I did hack together another TWRP build with no force-encrypt and no attempts to mount carrier. Still not perfect but I've done enough testing to call it close to stable, although it's still probably not going to like the stock /data partition as it's pretty much guaranteed to be encrypted. Download it here, I'll update the link from the last time I posted it. Should be fine to flash from QFIL or to flash the image itself from TWRP, but the zip itself isn't flashable.