yashsingh1/xdaforums huggingface dataset:
[Android Software Development] ilya980:
Yes, but how do I upgrade this phone beyond Android 5.1? Many apps require newer Android OS version. Do I need to build it from scratch? Also, how do I remove the annoying bloatware from AT&T, Google, and who else knows what pre-installed on this phone. Clean custom ROM install solves this problem. With boot.img patched by Magisk I would have to chase every bloatware that is installed (and there are a lot!) and somehow manually delete them. Do you have a clean OS image for this phone?
[Android Software Development] luridphantom:
if the universal debloater script doesn't work for att apps you can use titanium backup once rooted to uninstall system apps

you can try to compile your own lineageos build to test out if you're brave enough

there's no clean os image since it's always been a subsidized carrier phone. mine is also from att like yours so it has a lot of crap i took off
[Android Software Development] ilya980:
Do you have PV_ZTE_P816A06V1.0.0B07.zip or MFG_DRV_PKG_QCV1.0.0B04.zip? What are these? Would one of them be a clean image?
[Android Software Development] g465559090:
我用c2016手机测试过，没用。Aboot有这个项目，但我不敢轻易尝试
[Android Software Development] veryspecialagent:
Sorry I'm late to the party. I have a Z983 which OP says is confirmed, but im not seeing it in the file list. Which one should I use?
[Android Software Development] alecxs:
According to post #65

https://github.com/programmer-collection/zte/tree/master/A0620
[Android Software Development] veryspecialagent:
Were you able to get this working?
[Android Software Development] BringBackTron:
Missing ZTE Z558VL Firehose file from github. OP confirmed that this ZTE phone works, how did they get the file?
[Android Software Development] BringBackTron:
@neoroid

I also have a Z558VL like the previous user and this doesn't work. I simply cannot enter EDL, and QFIL won't detect my phone. Any help trying to get it working?
[Android Software Development] luridphantom:
try an edl deep flash cable
[Android Software Development] alecxs:
check your Chipset, ZFive C Z558VL has MSM8909 with eMMC storage so what you need is ZTE signed prog_emmc_firehose_8909.mbn
[Android Software Development] BringBackTron:
Made my own EDL cable and it still won't go into EDL mode or show up as that qualcomm COM device (yes I have the right drivers, i've tried the stock ZTE ones and the qualcomm ones). I also tried unhooking the battery connector, and even shorting the test pins (however I don't know which pins are for testing, so I attached a picture of the mainboard so maybe someone can help me identify the pins used for USB debugging (test mode). Don't really don't know what to do at this point, feels like I've done everything at this point and my phone is just deadly stubborn (debating starting a post with a Paypal reward to anyone who solves this mystery), so I'm really confused how OP confirmed this device.
[Android Software Development] luridphantom:
i wonder if it will be similar to this, just going based off example: https://xdaforums.com/t/z963vl-edl-test-points-found.3869229/
[Android Software Development] BringBackTron:
I already tried all of the pins I could spot on the back twice, none of them have seemed to have trigger it :( My device is rigged
[Android Software Development] veryspecialagent:
@BringBackTron @luridphantom If you're going to do things like short out pins, you should broaden your research a bit. Forensic acquisition requires root access, so if you read up on their blogs they sometimes leave gems like this: https://www.emergingdefense.com/blog/2019/5/20/how-to-put-a-qualcomm-phone-into-edl-mode
[Android Software Development] luridphantom:
i know for sure some adb reboot edl and deep flash cables dont work on some models like the zfive series phones, therefore finding the test points is the last option to getting these devices in edl
[Android Software Development] BringBackTron:
And is root required while doing test points, or does the phone need to be in a specific state (battery dead, in Android, in recovery menu)? I already tried all of the pins, but I'm an absolute newb. However I thought I could bootloader unlock this phone by now lol
[Android Software Development] luridphantom:
root isnt required. turn the phone off, take out the battery, short the points and then insert the usb cable. if all goes well you will see the 9008d device in qfil
[Android Software Development] veryspecialagent:
@BringBackTron

Have you tried @luridphantom's last suggestion yet?
[Android Software Development] veryspecialagent:
Also, has anyone successfully unlocked an N9136 Prestige II, N9650 Max, or a Z983 Blade XMaxXL?

I don't see any in the comments, so if you have and you're a lurker, please speak up. I'm trying to not have to buy an EDL cable.
[Android Software Development] SarcBot:
Trying to figure this out myself too. Been hanging on to this ZTE Max XL for years now and haven't had any success with it. Been wondering if I should keep trying or just cut my losses because not to many of these seem to be out there.
[Android Software Development] veryspecialagent:
Same. It's an ok phone. The Z983 is a better one, imho. I've kept them around so I could experiment with them sand use them to train myself how to use forensic programs and adb and such.

Problem is, mounting and taking a forensic image requires root.

There is a last ditch option. We form a detective agency or forensic examiner LLC and get it certified as a legit LE agency, then everyone chips in (or we do a car wash/bake sale) and we buy a Cellebrite machine.

Then we could unlock and root and take images of whatever phone we wanted to.
[Android Software Development] luridphantom:
you dont need to spend that much money on a cellebrite machine when medusa/octoplus can do it for much cheaper

what we need is a chart of what zte phones support edl mode using adb/deep flash cable/shorting points. seems like different models are either generous with letting you in with adb or won't even let a deep flash cable work
[Android Software Development] veryspecialagent:
That doesn't make sense though. EVERY programmer/engineer leaves themselves a backdoor way to get in if the regular way is f*****.

And wasn't there a story like 2 years ago about ZTE phones having backdoors built in (on orders from the Chinese government) that allowed them to spy on and image ZTE phones, which would require unlocked bootloaders and root.

I want to say it causes a trade e.bargo, right about the time ZTE was launching their big flagship phone.

I'm busy right now, but I'll do some googling and see if anything changes from that.
[Android Software Development] veryspecialagent:
@luridphantom FYI, I couldn't figure out EDL mode because I had my head up my rear. Power+Vol+ to FTL mode, plug in to PC, use adb reboot edl.

First victim was my N9560 MaxXL. I ran through the process, but don't know if it worked. I wanted root, so I followed the process outlined by @RedneckTechVet using Magisk to patch the boot image.

Now it's bricked. It'll pull up the ZTE logo, but then goes into EDL mode. Well, I think it's EDL mode. The home button is lit but screen is off. You'd think that wouldn't be a problem, especially since it connects in QFIL (port 10 instead of 12 for some reason), but when you go to partition manager the first thing it wants to do is reboot into EDL. Since it doesn't reboot, it throws up an error that it failed to reboot into EDL.

I tried to factory reset. It wiped the data and cache and restarted, but the problem didn't go away.

I am able to boot to recovery, but the phone doesn't show up in ADB in recovery or EDL so I can't try to boot up a TWRP recovery image file from ADB (if one exists, I don't know). I can choose Sideload, but you can't do anything there but sideload.

Is there any other way I can flash the original boot file back onto the boot partition?
[Android Software Development] luridphantom:
seems like your device is in dfu mode. i got mine in that state by holding all 3 buttons until the notification light blinked and turned red. then i used this tool which sent it to edl from dfu: https://xdaforums.com/t/guide-tool-the-ultimate-dfu-unbrick-tool.3854229/

for some reason my firehose is not working but getting it into dfu is already a huge step forward
[Android Software Development] veryspecialagent:
@luridphantom

Same issue. That tool will kick it from comm 10 to comm 12, but gets that weird error whenever I try to flash it with QFIL.

I wonder if the fact this tool was built for different phone has anything to do with it. And if so, can we modify it to the n9560.

I haven't tried to use miflash yet. I was checking out the firmware I downloaded, looking to see if I could skip a few steps to unlock the bootloader by doing that thing with the boot image before I even flash it, but the boot image is a lot different.

You say it's a big step forward. I hope you're right.
[Android Software Development] luridphantom:
even though qfil didn't work after i wrote that post i opened miflash and was able to unbrick my z839 back to factory through a stock fw someone posted in another thread https://xdaforums.com/t/guide-zte-blade-vantage-z839-specs-information.3696635/post-78929080

with this dfu to edl miflash method, as long as you have a copy of the stock fw your phone should never be truly bricked
[Android Software Development] luridphantom:
have you tried miflash?

if not, then this might be your last hope since you already have the firehose: https://github.com/bkerler/edl
[Android Software Development] veryspecialagent:
I tried 4 or 5 different versions of Miflash. That's the "Chinese gov't" reference. Literally every step gave me error messages, and an hour into the fourth one, I just gave up on that program.

After redownloading both firehose and firmware, I just tried again. Same error. QFIL isn't picking up the system image and I don't know why. I didn't do anything with the settings, and the only box I checked was "flat build." Going through the other QPST programs and there are issues connecting with the server, etc.

In order to get it into EDL mode, I use the A2017 tool that's listed in here. Since bricking, about 80% of the time as soon as I plug it in, it'll refresh and already be in EDL mode. Unless I restart the phone, then I have to do the process to go from DFU to EDL. Like, I thought some of those rows would populate. And that big green button, am I supposed to press it? We're just going from DFU to EDL and we have to have QFIL or Miflash already up so as to hit the button in under a second.

It always shows Disconnected though. No other fields are populated except Port. I couldn't open a help file, but in the folder tree in "help" folder is a Word document. I opened it, translated it to English via Word's translator, and it talked about getting into FTM mode by pressing a volume button and power button. I tried vol up and power and it does to DFU, then power down and power, which goes to recovery menu. I mashed all three down and plugged in the USB cord and my laptop device manager started picking up weird stuff.

Under COM it shows it's in 9008 mode. But it's also showing up under Portable Devices as Drive F.

You can't open it, only right click>properties, and if you hit the Administrator button, you can see it's a Linux File-Stor Gadget USB device, and every row under Details is populated. Idk if that's of interest (like the hex code under Class Default Security) to anyone with more programming knowledge than I do.

I'll try that Github thing you linked next and report back.
[Android Software Development] sidskilly:
I got that far editing done and re patched thats it stuck on what next
[Android Software Development] Rootmaster906:
says its in edl...go to flash and it still says sahara fail. i know it is in edl. is there a known issue of zte coming out of edl during the flash process?
[Android Software Development] veryspecialagent:
You're not alone. I was able to get to the step where you oil the home and reupload it on my 9560 and 9136. Theni bricked my 9560. Sounds that time i also started getting the Firehose errors.

Read the error log. It'll tell you exactly what failed. Maybe you can find a solution that the rest of us have missed.i think I remember someone saying it was a driver issue, or it could be some malicious program hidden in an image fine because ZTE doesn't put out official firmware.

**In the recent it's an edl issue, do a quick search in here for the "2017 DFU Tool" (might not be exact verbage) for the (I think) Axon 7. It basically reads the ports, funds which I've your office is on, and you can reset it into EDL.

@steadfasterX If this is a driver issue, any chance we could run this process on mAid? I stopped just before testing whether I could run QFIL on Wine, but i did plug it in and I'm pretty sure QFIL picked up the phone. I haven't had time yet to try it again.
[Android Software Development] alecxs:
you had 5 months for testing "that Github thing"
[Android Software Development] Skorpion96:
For Zte A5 2019 (Pie) what firehose i've to use?

i've noticed that is spredtrun, so will not work probably.
[Android Software Development] luridphantom:
spreadtrums dont use firehoses, that is for qcom phones only
[Android Software Development] Skorpion96:
that is a problem, i want to root this phone but fastboot is disabled, i'm looking for an alternative solution, one thing i can do is to develop or someone can help doig it, an exploit from cve-2015-1474 which is a vulnerability that affects this model.
[Android Software Development] luridphantom:
for spreadtrum phones, hovatek has a tutorial for rooting without even unlocking the bootloader if you can manually custom sign your vbmeta

this devinfo trick will not work
[Android Software Development] Skorpion96:
the problem is that to flash custom vbmeta you need to unlock bootloader first
[Android Software Development] luridphantom:
Hovatek Unisoc

For those who think it's easier to annoy you than to Google 'Hovatek unisoc' themselves.

letmegooglethat.com
[Android Software Development] Skorpion96:
i followed already the guide you're saying and the flash of vbmeta signed fails, i already asked help on their site but they said me that the bootloader need tobe unlocked to flash vbmeta custom signed.
[Android Software Development] luridphantom:
unfortunately zte uses custom keys to sign their vbmeta so you wont be able to do the trick that hovatek wrote about

only way to unlock is to go through each partition using a hex editor and seeing where the bootloader unlock bit is if its not encrypted
[Android Software Development] KeenShayan:
Hi! I tried to use magisk and edl to try and root my grand x4 (z957) and it's bricked, I think because the screen turns off and the home button lights very dimly.

I can only access recovery mode(no ftm, edl or fastboot), and can't seem to find a stock rom for my phone.

I appreciate any help!
[Android Software Development] luridphantom:
try this https://xdaforums.com/t/guide-tool-the-ultimate-dfu-unbrick-tool.3854229/
[Android Software Development] Rootmaster906:
At times it will say Sahara fail and then when I get it into the download qhusb mode it'll say that in error
[Android Software Development] veryspecialagent:
Literally every step gave me some error that took 4-6 hours to figure out. I got to the "install requirements txt step and it kept erroring out building one of the wheels, so rather than punch my screen, i said f*** it

That being said, i have since set up an old laptop to run mAid (formerly FWUL), which is a Linux OS built from Manjaro specifically designed to use with Android devices.

I just need a way to run QFIL or another flash program that works with ZTE that can be installed on Linux.

I also just learned i can run a Win 7 environment in my Win 10 laptop, and that i wasn't using one of the tools correctly (the 2017 DFU unbrick tool; search for it in here).

I'm ready to take another crank at it as soon as I can free up some time.
[Android Software Development] alecxs:
on linux it is far more easier to setup, I recommend Xubuntu 20.04 LTS live from pendrive
[Android Software Development] veryspecialagent:
I have Ubuntu installed on my Win10 laptop via Multipass.

Check out mAid and give it a try if you can find time.
[Android Software Development] Rootmaster906:
See
[Android Software Development] luridphantom:
what device are you trying to connect to? some of them need a rawprogram and patch xml
[Android Software Development] Rootmaster906:
I tried that too. I also tried the qfil in the root pkg for z851. The program fails to load as well. Keeps saying stack exception along with other errors occasionally
[Android Software Development] veryspecialagent:
I have a Z851m in addition to the z983, N9560, and N9136. Of the four, the Z851m ties with the Z983 as being the best interms of speed and what I can do with it. The N9560 and N9136 have amazing wifi signal pickup. There were times I'd connect one to a wifi and use it as a repeater, connecting to it via bluetooth for an internet connection.
[Android Software Development] veryspecialagent:
@luridphantom see attached

I know I used the wrong firehose. The right one, as the log shows, wasn't working. And when I backtracked the firehoses, there are actually like 20 or so variations of each firehose, and not all of them labeled. I don't have the log where I was trying them.

But that's besides the point. These DID work for me at one point. That's how I bricked my N9560: Changing the boot file in a different way than the OP said to (I was following another poster with a supposed root strategy).
[Android Software Development] luridphantom:
wait you were able to flash a patched boot through edl and now you cant? thats weird, if you can access edl and flash you should be able to unbrick

my problem was that originally my z839 cant get into edl unless using the adb reboot edl command. only way to revive it was to use the dfu unbrick tool then miflash to flash everything back. for some reason qfil wouldnt work on me but miflash did
[Android Software Development] KeenShayan:
sorry, its not working out for me. I cant seem to enter ftm mode but as I mentioned before I am able to enter recovery. I have a Grand x4 (Z957, Freedom variant) if it helps.
[Android Software Development] veryspecialagent:
I can enter EDL, but I keep getting errors whenever I try to do ANYTHING with QFIL. I don't know what happened, how first I was able to connect and do what's described in the first post no problem, but a couple days later I just simply wasn't able to because of the Sahara/Firehose errors.
[Android Software Development] luridphantom:
you might not have the right firehose or supplementary rawprogram/patch file needed to connect to qfil

did you check here? https://github.com/programmer-collection/zte
[Android Software Development] alecxs:
EDL mode has 30 second timeout
[Android Software Development] veryspecialagent:
I know I'm replying to an old response, but seeing it reminded me of something:

Here is the (I think) complete Firehose library. So if the one linked in the OP didn't work, look through the folder with your chipset name on it and try to find one that does.

Firehose Library

And posting this took me to the end, where I just now read your reply.

I did go there from the start, but I'm not sure about the supplementaries because there is no official ZTE firmware site.
[Android Software Development] veryspecialagent:
For some reason this thread reminds me of that line from Tommy Boy.

"Lots of people go to college for 7 years."

"Yeah, they're called doctors."

After a few other completely unrelated projects that resulted in me learning more about python and Visual Studio, I gave this another shot. Turns out the installation errors were because the requirements file was pointing to deprecated or outdated versions of those programs. I just needed to update the text file to point to the right version and great success.

However, the driver that the instructions give you to install changes things.

Before it would show up under Ports, first as DFU, then I could use the Ultimate DFU unbrick tool I got from somewhere in there to put it into EDL (9008) and then is be free to beat my head against the wall with Sahara errors in QFIlL

Now it shows up in (I think) portable devices and as 9008, but tools like that DFU one won't pick it up.

EDL tool seems to pick it up and communicate with the phone just fine, but ALL I need to do is 1) find out what the boot partitioon's name is (pretty sure it's just boot) and 2) reflash the boot partition with a stock boot.img I have.

There are a billion different options with the EDL tool and I could just be missing it but I'm not seeing a way to do that. I tried using "w" (write), but no-go. Again, that could be because I'm not using the correct argument or telling it the right partition or using the right format for the command.

Thoughts?
[Android Software Development] UsefulSoup:
the partition manager keeps failing and doesn't want to open
[Android Software Development] veryspecialagent:
I was actually able to follow all of the steps and get into my Z983 with this firehose programmer I found in a different thread and using the latest QFIL that came with QPST.

The 0's the OP said needed changed were already 1's, and there was no second set further down. Since I can't reboot into the actual bootloader and no fastboot commands work, I have to say there has to be some other place besides devinfo where a 0-to-1 swap would unlock the bootloader.
[Android Software Development] alecxs:
can be in config or frp partition too, but is cryptographic tamper-protected. OEM unlocking byte may directly stored in TEE which tamper-resistant by design.
[Android Software Development] Lostwon:
Regarding ZTE Z983 Blade Max X (cricket) ;

Just like veryspecialagent, None of the other Firehoses worked (not even the one he uploaded) but I found one that did. Its attached, I can't remember where I got this though. When I checked my file though, it already had 01's in the correct places, sigh, also it only had the first BOOT-ANDROID! the hex only went to approx. 0033ff00.
[Android Software Development] veryspecialagent:
I've been trying to unbrick the N9560 that I bricked doing something I shouldn't have done and during like the 4th factory reset I noticed this.

My initial reaction was to come up with a joke about it being this easy, but then realized the obvious:

There is a command/process already present in the phone that is being executed during the factory reset process to do the very thing we've been trying to do.

Posting here because it's relevant to the topic. I'm hesitant to make a standalone thread because it's an older phone and I may have missed this being covered somewhere else.

Just looking for verification whether or not this was some grand discovery so I know whether to nurture that spark of hope that sprang into existence upon seeing this...or sacrifice it upon an alter to the Gods of the Firehose.
[Razer Phone Questions & Answers] hawad2:
i have razer phone 2.

I installed twrp via fastboot then I got stuck on logo screen

now I can not go to recovery mode I can just go to fastboot and flash any rom

please i need help ????
[Razer Phone Questions & Answers] wodinotus:
er.. this actually needs to be in https://xdaforums.com/razer-phone-2 (note -2) !

dunno for sure, but would think you can "fastboot flash boot <recovery_filename>.img"

Be sure to opt out of installing TWRP app, as that can cause bootlooping.

HTH
[Razer Phone Questions & Answers] simon7239:
Hello i have the same problem, and i couldn't find a solution anywhere...

Please Help !!

Edit: what i did, i switched the partition to b, then flashed it with twrp recovery, then i tried to reboot to recovery, and got the razer logo stuck up there..

when i switch back to partition a, the recovery was the original one.
[Windows Mobile Development and Hacking General] rost2006:
Is available for downloading

http://www.opera.com/products/mobile/download/
[Windows Mobile Development and Hacking General] balane:
What is the build number on this one? Is it new or is it the buggy public beta that's been floating around a while? 1718 I think it was.
[Windows Mobile Development and Hacking General] amarguli:
It is build 1718