[Android Software Development] alexenferman:
Warning: This unlocking method might not work on newer ZTE devices with Oreo+ and flagship devices. You have nothing to lose, but it might not do anything.

This tutorial is only for Qualcomm ZTE Devices.

Unlocking the Bootloader:

Warning: This bootloader unlocking method is not for beginners. It requires at least some knowleage on how to flash ROMS or partitions via QFIL and ADB commands. If you do not understand something here, than the tutorial might not be suitable for you. You can still try it, but at your own risk of course.

Will not work on:

Axon 7

Axon 7 Mini

Axon 9

Axon 10

Axon M

Zmax 2 (Z958)

Anything else that has Oreo, PIE or 10

The unlocking bit on those devices are stored in another partition that can't be easily modifiable

Working on: (Thanks [MENTION=4222965]deadman96385[/MENTION])

Snapdragon 210 Processors:

ZTE Avid Plus (Z828)

ZTE Maven 2 (Z831) (code-name: chapel)

ZTE Maven 3 (Z835) (code-name: draco)

ZTE Majesty Pro Plus (Z899VL) (code-name: elden)

Unknown ZTE (code-name: forbes)

ZTE ZMAX One (Z719DL) (code-name: gemi)

ZTE Tempo X (N9137) (code-name: grayjoylite)

ZTE Grand X View 2 (K81) (code-name: helen)

ZTE Overture 3 (Z851) (code-name: jeff)

ZTE Fanfare 3 (Z852) (code-name: kelly)

ZTE ZFive G LTE (Z557BL) (code-name: lewis)

ZTE ZFive C (Z558VL) (code-name: loft)

Unknown ZTE (code-name: refuge)

ZTE N818S (code-name: sapphire/sapphire4G)

ZTE Blade Vantage (Z839) (code-name: sweet)

Snapdragon 617:

Android 5.1.1

ZTE Grand X Max 2 (Z988) (code-name: jerry)

ZTE Imperial Max (Z963U) (code-name: lily)

ZTE Max Duo LTE (Z963VL) (code-name: nancy)

ZTE Axon Max (C2016) (code-name: orchid)

ZTE Max Duo LTE (Z962BL) (code-name: tom)

Android 6.0.1

ZTE ZPAD (K90U) (code-name: gevjon)

ZTE AT&T Trek 2 (K88) (code-name: jasmine)

ZTE Grand X Max 2 (Z988) (code-name: jerry)

ZTE Axon Max (C2016) (code-name: orchid)

ZTE ZMAX Pro (Z981) (code-name: urd)

Android 7.1.1

ZTE AT&T Trek 2 (K88) (code-name: jasmine)

MSM8920/MSM8937/MSM8940/MSM8953 (Qualcomm Snapdragon 427/430/435/625):

ZTE Blade Force/ZTE Warp 8 (N9517) (code-name: warp8)

ZTE Grand X4 (Z956/Z957) (code-name: finacier)

ZTE Blade Spark (Z971) (code-name: peony)

ZTE Blade X (Z965) (code-name: proline)

ZTE Max XL/ZTE Bolton (N9560) (code-name: bolton)

Unknown ZTE (code-name: flame)

ZTE Blade X Max (Z983) (code-name: stollen)

ZTE Blade Max View (Z610DL) (code-name: violet)

ZTE Max Blue LTE (Z986DL) (code-name: florist)

ZTE AT&T Primtime (K92) (code-name: primerose)

Of course, it might work on more models that might not be listed here.

Want to watch a video instead?

https://www.youtube.com/watch?v=FdWtJKCcPh4

You will need:

A Qualcomm ZTE device (I am using a ZTE Avid Plus Z828)

A PC

Adb Commands installed

QFIL 2.0.1.9

Your QFIL firehose (emmc_firehose_8***.mbn) You can get it from here: https://github.com/programmer-collection/zte

A Hex editor (Like HxD)

Tutorial:

Hold power and volume down to boot to FTM mode

Using ADB commands, type: adb reboot EDL

Open QFIL, You should see Qualcomm HS-USB QD-Loader 9008 (COM****)

Select "Flat build"

Select your firehose (emmc_firehose_8***.mbn)

Select tools, partition manager

Click ok

We are intrested in the /devinfo partition only!

Right click devinfo only and click on "Manage Partition data"

Click on "Read Data"

Check the logs on the main window, it will show you where it will be saved (Most frequently in the Appdata/Roaming/Qualcomm folder) and the file will be named something like this: ReadData_emmc_Lun0_0x1c000_Len16384_DT_**_**_****_**_**_**.bin

Copy the file we read to somewhere like the desktop and make a backup in case it does not work.

Next, open HxD or any other hex editor

Click File>Open and select the file we copied to the desktop

You should see a layout like this:

Edit this:

41 4E 44 52 4F 49 44 2D 42 4F 4F 54 21 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

to this:

41 4E 44 52 4F 49 44 2D 42 4F 4F 54 21 00 00 00

01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00

Go to offset 007FFE00 and repeat the same steps:

It looks like ZTE did put another ANDROID-BOOT! at this section, they thought I would not see the second one :D Make sure you edit that second one, otherwise the BL won't be unlocked.

___________________________________________________________________________

What will this do?! The two 01s we put in this file will show to the bootloader that it was unlocked before via fastboot. Of course, we are editing it now and it was never unlocked via fastboot. This is enough to fool it :D

For people who don't know, on all android devices, there is the /devinfo partition that stores the information of the bootloader such as is_unlocked (aboot), is_tampered, is_verified, charger_screen_enabled, display_panel, bootloader_version, radio_version etc.

We have to modify it into saying is_unlocked and is_Critiacal_unlocked

____________________________________________________________________________________

Do not touch anything else and click File>Save

Boot your phone into EDL again.

(You might need to reopen QFIL)

Back to the partitions, right-click /devinfo again and click "Manage partition Data" again

Click "Load image"

Select the file we modified (Should be a .bin)

Wait a few seconds and restart your phone and IT SHOULD BOOT SURELY!!

Your bootloader should be unlocked!!

You cannot really tell if the Bootloader is unlocked unfortunatley. But, if TWRP boots or ROOT persists then here is your sign :D

TWRP is booting!

You can now ROOT, Install custom ROMs, Install Custom Recoveries, kernel modifications & More using QFIL!

You are now free :D

Credits to aleph security in the Unlocking the bootloader section at the bottom of the page for showing the Hex values to change: https://alephsecurity.com/2018/01/22/qualcomm-edl-2/