yashsingh1/xdaforums huggingface dataset:
[Android Software Development] alexenferman:
Read the tutorial first. You don't need to get into the BL.
[Android Software Development] EonOfBlack:
Thank you sir, I will try.
[Android Software Development] luridphantom:
looks like this is the factory reset process being logged? oem_unlock_enabled just tells you that the flag is set, which should be 1 if the bl is unlocked
[Android Software Development] veryspecialagent:
It is the factory reset log. And 0=True, 1=False

You can see OEM_unlocked_enabled is 1 before the wipe

Wiping the data changes OEM_unlocked_enabled to 0

It writes the disk

Then relocks the bootloader, changing the OEM_unlocked_enabled back to 1

I'm telling you, it's there (it being the commands to unlock the bootloader safely).

I have like 3 versions of the OEM image for this phone on my laptop, but I don't even know what program I'd use to open or look through the code.
[Android Software Development] lilredfox92:
I never get a pop-up for the partitions. Anyone know why that might be?
[Android Software Development] luridphantom:
check your firehose
[Android Software Development] lilredfox92:
I used the one listed at https://github.com/programmer-collection/zte for the N9560 which is what the phone is. I'm not sure which other one to try. Any recommendations?
[Android Software Development] luridphantom:
if you know what soc chip your phone uses you might be able to try another one from zte

just be careful though, i bricked a couple phones trying this
[Android Software Development] veryspecialagent:
(also @luridphantom for reference)

First, make sure you're using the correct QFIL, cable, and USB port before doing anything below. I have a Boost N9560 and following the instructions worked for me, but then I did something stupid and bricked it and haven't been able to get it to stay in EDL long enough to make a connection.

The firehose collection linked in the OP is not an all inclusive list. The full library can be found here. When you download the zip for the 8937, you'll see there are 11 different firehose files, some of which have what brand they work for in the filename.
[Android Software Development] veryspecialagent:
Since I'm here, I might as well ask: A month later and I'm still fairly certain I stumbled across the magic ticket for this. I have 3 different versions of the firmware. Do you know what program I should use to look at the code and see if I can't find what it is I think is there?
[Android Software Development] luridphantom:
hxd for windows, otherwise any general hex editor will do

ive even used web based ones to cross check what i use on linux/mac
[Android Software Development] r1pp3d2:
Got the bootloader unlocked and rooted on the cricket Z832.
[Android Software Development] Boyd LaRue III:
My Partition Manager Files don't list ANY "DeviceInfo" listings. What should I do??? I have the ZTE Warp Elite N9518. This has been the ONLY option I have found that remotely comes close to being a real option to unlocking the bootloader. Please respond as soon as you can, so I know if I should just shelf this phone or keep trying. Thanx so much for your time...You're awesome!!!
[Android Software Development] luridphantom:
partition is called devinfo
[Android Software Development] mixxoo:
I messed with primary bootloader files , erased all of them I think after using magisk patch, zte835. Where can I get the bootloader files . It goes into edl mode. Shows filehose error
[Android Software Development] mixxoo:
Should we install bootloader files first then firmware
[Android Software Development] Grigori88:
Is it possible to unlock bootloader and install GSI ROM on Nubia Z50?
[Android Software Development] hassy1216:
Hello. I am using a Japanese device with Snapdoragon 210 and when I try to go into EDL mode, Andoroid starts up normally. What should I do?

That phone is a KDDI ZTF32.
[Android Software Development] acer23:
I need bootloader files , erased all of them after using magisk patch, phone is zte835. Where can I get the bootloader files . It goes into edl mode.
[Android Software Development] acer23:
I need secondary bootloader sbl files for zte835.

Save all partitions and upload

Deleted sbl by mistake while using qfil.
[Android Software Development] bird>dog:
GitHub - linux-msm/qdl

Contribute to linux-msm/qdl development by creating an account on GitHub.

github.com

havent actually used it as i dont have the firehose for zte z799vl

Did you ever find it? If so how can i get it?
[Android Software Development] acer23:
I Need secondary bootloader files for zte835, and which qfil version , programmer to use
[Android Software Development] acer23:
I got my phone zte835 unbricked, I don't find 2nd Android boot at 007ffee00 and 1st android boot at 00000000 are different.
[Android Software Development] veryspecialagent:
I don't think that is possible. What errors are happening
[Android Software Development] veryspecialagent:
The ZTE Majesty Pro has the Qualcomm Snapdragon 210 MSM8909 chipset
[Android Software Development] veryspecialagent:
Not all phones have the 2nd boot. Try scrolling down though and seeing if it's just further down (the OP mentioned doing this).
[Android Software Development] acer23:
Edit: I got my phone zte835 unbricked in a shop, I don't find 2nd Android boot at 007ffee00. 1st android boot values at 00000000 are different after unbricking. How to network unlock , it's locked to ATT.
[Android Software Development] acer23:
How to network unlock?
[Android Software Development] veryspecialagent:
This thread is about unlocking the bootloader in order to root phones, not network unlock. For that your need to go to the ATT website as they have a process that involves getting a 16-digit code and using another carrier's SIM.

I will also mention that phone was released 9 years ago. Do you still have cell service active on it? Do you plan on using it as a phone?

Because if you're only planning on using it WiFi-only, there's no reason to network unlock it.
[Android Software Development] acer23:
Cell service may not be active as it's bought to different country 5y ago . How to make calls .
[Android Software Development] DaeDae<3:
Zero luck.
[Android Software Development] JazzieBoi:
Hey guys just found this post and its a relief to know it's a possibility of getting magisk on my ZTE P839 Sweet cuz its the only backup phone i have atm and it can be rooted, sweeeeeeet. I'll give it a try soon once I get my hands on a good computer haha. Only part I'm confused about is flashing TWRP? I'm assuming flashing that .bin file somehow installs TWRP as well? There's no need to "fastboot flash recovery TWRP.img" in fastboot mode? These phones are strange ? Honestly the A and B partitions were more of a pain in the ass than anything haha. Damn phone company's tryna encrypt everything annoyingggg hehe.
[Android Software Development] deadman96385:
So zte removes the traditional bootloader UI so there is no bootloader mode. So if you want to for example install twrp, you would use your firehose to write twrp to the phone via qfil. Like what you did with this guide. The snag here is every device is different so a developer would need to build a twrp for your specific device. Now that the bootloader are unlockable there is a higher chance for someone to pop in and make twrp or a mod or something similar. Until then I’d recommend you either wait for twrp, or if you want to live life on the edge. Look at how some of the other low-mid range zte devices get root because the same principles as they use you can as well. I don’t want to get anyone’s hopes up but I am working on twrp for atleast 5 zte devices now. Will make a post here when I release them. Again no eta just when I have time.

This guide is purely unlocking your bootloader, it can be confusing at times because lots of guides combine the action of unlocking the bootloader with flashing a custom recovery. In this case it’s just allowing you to flash custom imgs be it twrp or a rooted boot, etc. But isn’t providing those custom imgs because every devices is different so a twrp, or rooted boot. Would only work on the one it was designed for. On the topic of fastboot and flashing on the device. So zte removes the traditional bootloader UI so there is no bootloader mode. So if you want to for example install twrp, you would use your firehose to write twrp to the phone via qfil. Like what you did with this guide.
[Android Software Development] bernshood:
Makes sense. Thanks deadman!
[Android Software Development] top chopa:
i tried the method on my zte maven 2. Sadly, every time i used Qualcomm to flash it. it would fail to find my device. any solution ?
[Android Software Development] alexenferman:
Did you install the qualcomm drivers? Is it showing as QDLoader 9008?
[Android Software Development] jamie1157:
Trying to boot loader unlock my zte
[Android Software Development] Abdullah.Csit:
Sorry i post

my reply

in the wrong tobic
[Android Software Development] neoroid:
Anyone was able to make this work on ZTE A1R? which OS and drivers did you use?

---------- Post added at 09:15 AM ---------- Previous post was at 09:13 AM ----------

This is the error I am getting and I really want to unlock this phone as it is useless due to overheating...

2020-05-27 05:13:04.666 13: C:\platform-tools\Qualcomm_Flash_Image_Loader_v2.0.1.9\prog_emmc_firehose_8974.mbn

2020-05-27 05:13:04.668 05:13:04: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.

2020-05-27 05:13:04.671 05:13:04: ERROR: function: sahara_main:924 Sahara protocol error

2020-05-27 05:13:04.673 05:13:04: ERROR: function: main:303 Uploading Image using Sahara protocol failed

2020-05-27 05:13:04.689 Download Fail:Sahara Fail:QSaharaServer Fail:Process fail

2020-05-27 05:13:04.701 Finish Get GPT
[Android Software Development] Rolling Hills of Green:
Hello.

I have ZTE ZFive C Z558VL. It is TracFone. I shut off the phone and held down the volume button and the power, but if I hold the power down too long the phone resets. If I let go of the power button the phone boots up normally. I also tried holding volume up and plugging in the Micro USB cable but it just went to charging mode. I do not know how to get into FTM mode.

I looked up a command "adb reboot edl" to try getting to EDL mode but it did not work. I used Windows Vista with adb and driver installed.

Below is interesting information about my other TracFone.

Interesting enough, I also have an Alcatel OneTouch Pop Icon A564C (Yaris5NA). I enable USB debugging and installed drivers from "Minimal ADB and Fastboot" driver for adb in Device Manager. When I issued "adb reboot edl" command while phone was on, the screen turns off and an interesting thing happens; the driver for Qualcomm HS USB is installed and the phone ports to COM4. I opened QFIL and the device shows up. I tried three different firehoses I found online; 8x26, 8x26_alc1 and 8x26_alc2. The 8x26_alc1 goes further when using partition manager, but firehose fails and no window pops up. I would think 8x26 refers to the chipset the phone uses.

I think if the firmware to the A564C and the firehose to this phone are found someone may be able to get root on it. I have tried to use KingRoot 4.10 and 4.0 on it many times but they reboot or they get stuck on the screen and the phone is unusable until reset. It is like the phone achieves a temporary breach when at the 23% mark then five seconds later the whole phone gets stuck. I had used a older SuperSU apk from a script and it says "No Binary Found" while opening it, but when using KingRoot in the background and constantly opening SuperSU, I eventually get "The binary needs to be updated". I try to work fast by pressing "Confirm" and "Normal" but it does not do anything but get stuck at the screen. When that five seconds runs out the phone quits anything. I even tried using adb shell when I acheive the "temp root" and doing su the connection times out.
[Android Software Development] alexenferman:
You have to restart your phone into EDL again, otherwise, your driver is not working
[Android Software Development] alexenferman:
Press VOL down and POWER, and when you see the ZTE logo, remove your finger from the POWER button only, it should get you into FTM mode. Other than that, I have no Idea about your phone (I don't own it)
[Android Software Development] neoroid:
I get it into EDL mode but not like described here (as it doesn't work) and I can get it recognized but I guess it is mostly a driver issue (I am using Windows 10 and tried different drivers)...

---------- Post added at 11:08 AM ---------- Previous post was at 10:57 AM ----------

just ignore "adb reboot edl" and proceed with the software and it will detect that the phone isn't in EDL mode and will reboot it to that mode and it will get detected properly so you can proceed...

Let us know if this worked for you
[Android Software Development] tails618:
There doesn't seem to be a firehose in the GitHub repo for the ZTE Majesty Pro. Does anyone know where I can find it?
[Android Software Development] darkherman:
error with device z851m help
[Android Software Development] 382462949:
Redmi NOTE8 ，No solution for BL, there is an account lock，Can the boot file be modified? I don’t know how to modify things，Modify that file?？
[Android Software Development] alexenferman:
Put your firehose and folder in C:\ drive and not in download.
[Android Software Development] alexenferman:
Put your firehose and folder in C:\ drive and not in download
[Android Software Development] darkherman:
not working again

log and picture
[Android Software Development] darkherman:
[MENTION=10365003]alexenferman[/MENTION]

I found a problem with the portable version QFIL 2.0.1.9 not working and I fixed it by installing QPST_2.7.474.exe which includes QFIL 2.0.1.9 and it worked.

it seems that the installer has all the necessary files and the required parameters

link installer QPST http://www.mediafire.com/file/4fx9mu79cv09e7n/QPST_2.7.474.zip/file

picture
[Android Software Development] darkherman:
installer this version is work http://www.mediafire.com/file/4fx9mu79cv09e7n/QPST_2.7.474.zip/file
[Android Software Development] darkherman:
good job [MENTION=10365003]alexenferman[/MENTION]

bootloader unlocked on Z851m and root with magisk, only boot patch with magisk manager app and I get rooted without using modified recovery

guide patch boot without custom recovery https://topjohnwu.github.io/Magisk/install.html#boot-image-patching

picture
[Android Software Development] S_T_A_R:
Is it work on HONOR che1-L04 for unlock bootloader?
[Android Software Development] neoroid:
Thankfully I was able to access to partition after installing QPST (you've linked to) but unluckly the devinfo partiton doesn't contain the bootloader section on Axon A1R... so I am stuck again :/
[Android Software Development] darkherman:
But if you have the devinfo partition you should be able to unlock bootloader just write in Hex editor and that's it

Enviado desde mi REVVLRY+ mediante Tapatalk
[Android Software Development] MassExplosion213:
Are there firehose binaries for Z983? I see it in the compatibility list, but not the firehose binary repo.
[Android Software Development] darkherman:
Use firehose from A0620 has same msm8940 chipset

Enviado desde mi REVVLRY+ mediante Tapatalk
[Android Software Development] S_T_A_R:
Is this tool work with Honor che1-L04?

I want to unlock bootloader of my phone.
[Android Software Development] crborga:
Z851M

I have followed the guide but I got stuck when I went to edit the file in hex. The values are slightly different then shown in the pictures. I have attached the bin from devinfo below. I could use some guidance please.
[Android Software Development] alexenferman:
It should be fine. There is nothing at 007FFE00, so this means that this phone won't read that offset. You can safely flash it. Even if you make some sort of mistake on the devinfo, it won't brick the device.
[Android Software Development] jochenoyoshi:
ZTE Overture 3 Z851M doesn't EDL

Device reboots normally when the "adb reboot EDL" command is used in FTM mode.

Can't seem to get it into EDL mode. QFIL only picks it up as "Qualcomm HS-USB QDLoader 9008 (COM9)" when in FTM mode. When booted it just appears as "MTP USB Device" or "ZTE Overture 3". Does anyone know how a solution?

BTW, if I try to access the Partition Manager in FTM it just gives a "Download failed: Sahara..." error.
[Android Software Development] PAPACELULAR:
Error x blootloader bloking
[Android Software Development] ibrickedakindlefire1stgen:
I've been trying this out on my Blade Force (N9517, codename "warp8", Android 7.1.1), but the devinfo partition seems to be much different from what's shown in your thread and video. For starters, the file I get is only 4194304 bytes, 4.1 MB and only goes until 0x003ffff0. But more importantly, it already has the unlocked bits set:

[N9517 Stuff]$ hexdump devinfo.bin -C
00000000 41 4e 44 52 4f 49 44 2d 42 4f 4f 54 21 00 00 00 |ANDROID-BOOT!...|
00000010 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

I know for certain it isn't unlocked, because when I flash a modified system partition, it doesn't boot, and gets stuck in the bootloader, with "ZTE Powered By Android", never playing the boot animation. A bit stranger is that there are some other bytes in devinfo, and I don't know what they do:

000000e0 01 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
000000f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|

If I could get someone to follow up with me on if a bootloader unlock might be possible, that would be much appreciated. I'd be happy to provide any dumps of other partitions, or any other information which would be helpful.
[Android Software Development] RedneckTechVet:
Thank you for this. I think I went through about every commonly mentioned fail several times, every time was when I clicked "ok" after selecting Partition Manager (I even tried selecting the raw file and clicking "partition manager" without clicking "download") I couldn't even get to the partition list. I didn't bother downloading QPST at first, only QFIL. But even after downloading QPST (with which I never got anywhere) and using QFIL from my QPST folder, I still ran into fails. I was only able to proceed past that point to the full end of this endeavor after downloading deadman96385's B12 firmware package http://xdaforums.com/maven-3/how-to/rom-stock-b12-b13-qpst-flashable-t3899926 and flashing the raw file. I'm on a Maven 2.

When I opened devinfo with HxD, I noticed that the two bits at offset 10 and 18 were already 01, and there was no second boot. However, 000000E0 was 01, 000000E4 was 02, and every offset from 000000E8-000001FF (that's 280 bits if my math is correct) was FF. The decoded text column translated every FF to ÿ, and every offset after that last FF was 00. After some research, I decided to change 000000E0 and every offset after that to 00 and flashed it. Drastic? Nah, fortune favors the bold. After all, what harm could I do? If it bricked, I could just flash stock and start over. I finished the reboot to EDL process in QFIL and disconnected the USB, pulled the battery out and back in, and the phone booted and operated like it always has. But my bl wasn't unlocked. Tried to reboot to bootloader from recovery and it just rebooted normally. Tried adb reboot fastboot and got the same result. Then I started looking at the list of files that came with the firmware package and noticed that one was named "boot.img". I patched it with Magisk Manager and flashed it with QFIL.

I got root. I rebooted about 5 or 6 times over the next 30-60 minutes to see if it would stay rooted and it did, and still is. Magisk Manager passes Safetynet, Terminal Emulator allows root access...

...but my bootloader is STILL locked. I'm sure it's a simple emulator command, but I got busy reading the descriptions of every last one of and downloading about a dozen Magisk modules through the app and haven't had much time to look back into it. I'm wondering if I should change offset 000000E0 back to 01 and 000000E4 back to 02 (or maybe even to 01). What do you think?

Also, is there any way at all for me to learn exactly what each offset controls? I pursue knowledge like it's my job.
[Android Software Development] deadman96385:
If you we're able to flash magisks and it boots up then your bootloader is unlocked.
[Android Software Development] RedneckTechVet:
My interpretation of everything I researched is that flashing through QFIL in EDL mode is a way to bypass the need for an unlocked bl. If the ability to flash through QFIL indicates that the bl is unlocked, then why is it necessary to flash a modified devinfo to unlock it? I flashed my patched boot.img through the partition manager in QFIL using the same method that is described for flashing the modified devinfo. I downloaded MM directly to my phone and patched boot.img.

If the bootloader is unlocked, then why can't I reboot to bootloader. I'm not saying you're wrong, I just ask alot of questions.

Thank you in advance.
[Android Software Development] ibrickedakindlefire1stgen:
I just tried everything RedneckTechVet did, since it seemed his devinfo partition was similar enough to mine, but with no luck. When I flash my device's modified boot partition (from Magisk Manager) and reboot, it just goes into DFU mode rather than booting normally. And I did try padding the boot partition image to the proper size, but that didn't work either. Also interesting to note is that my devinfo partition changes after rebooting, to this:

[N9517 Stuff]$ xxd new_devinfo.bin
00000000: 0000 0000 0000 0000 9c65 6b8f 0000 0000 .........ek.....
00000010: 0000 0000 0000 0000 5041 4548 1830 6b8f ........PAEH.0k.
00000020: 1000 0000 6da7 7400 5041 4548 2830 6b8f ....m.t.PAEH(0k.
00000030: 3400 0000 4c34 6b8f 1832 6b8f 6830 6b8f 4...L4k..2k.h0k.
00000040: 3432 6b8f a832 6b8f f432 6b8f 6833 6b8f 42k..2k..2k.h3k.
00000050: 0000 0000 0000 0000 3038 6b8f 5041 4548 ........08k.PAEH
00000060: 5c30 6b8f 1800 0000 9034 6b8f cc34 6b8f \0k......4k..4k.
00000070: 0010 0000 5041 4548 7430 6b8f 2c00 0000 ....PAEHt0k.,...
00000080: 0600 0000 0600 0000 0100 0000 3059 678f ............0Yg.
00000090: 0000 0000 ac30 6b8f 0100 0000 0000 0000 .....0k.........
000000a0: 5041 4548 a030 6b8f 6400 0000 0000 0000 PAEH.0k.d.......
000000b0: 0000 0000 cc96 688f 1200 0000 d444 6b8f ......h......Dk.
000000c0: f48c 6b8f 0000 0000 0000 0000 0000 0000 ..k.............
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000e0: 0000 0000 0200 0000 0600 0000 3894 6b8f ............8.k.
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000100: 0000 0000 5041 4548 0431 6b8f 6c00 0000 ....PAEH.1k.l...
00000110: e033 6b8f dcb9 638f a4b9 638f 0800 0000 .3k...c...c.....
00000120: 1000 0000 0000 0000 0800 0000 0002 0000 ................
00000130: 0001 0000 0100 0000 0000 0000 0000 0000 ................
00000140: 0000 0000 0000 0000 0200 0000 0000 0000 ................
00000150: 0100 0000 0000 0000 0000 0000 0000 0000 ................
00000160: 0000 0000 0100 0000 0000 0000 0000 0000 ................
00000170: 5041 4548 7031 6b8f 1800 0000 0a00 0000 PAEHp1k.........
00000180: 2c34 6b8f 0000 0000 5041 4548 8831 6b8f ,4k.....PAEH.1k.
00000190: 1000 0000 0100 0100 5041 4548 9831 6b8f ........PAEH.1k.
000001a0: 7400 0000 3430 6b8f b033 6b8f c433 6b8f t...40k..3k..3k.
000001b0: 0000 0000 0100 0000 7442 6b8f 0000 0000 ........tBk.....
000001c0: 0000 0000 ffff ffff 0000 0000 0000 0000 ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................

Is there anywhere I can look for logs as to why the bootloader fails, or is there anything else I can try to get it to boot?
[Android Software Development] Rykuro:
Has this method been tested this on a ZTE Avid Trio (Z833) yet? Android 6.0.1, Qualcomm Snapdragon 425 MSM8917
[Android Software Development] speck1234:
The Majesty Pro Plus Z899VL which I have is in the list in the OP, but I don't see it in the list in the GitHub page or the firehose for it. Therefore I cannot continue unless I have the firehose.