[Blade General] Azaze666:
A small reminder before everything:

* I'm not responsible for bricked devices, dead SD cards, thermonuclear war, or you getting fired because the alarm app failed (like it did for me...).

* YOU are choosing to make these modifications, and if you point the finger at me for messing up your device, I will laugh at you.

* Your warranty will not be void if you tamper with any part of your device / software while being on locked bootloader.

As from title here is a guide from https://github.com/Skorpion96 discovery. The guide is pretty simple, download:https://androidhost.ru/Y56 and flash it from Research Download Tool:https://www.mediafire.com/file_premium/1dfp455qi6dlshn/SPD_Research_Tool_R2.9.6011.zip/file. To flash it power off the phone, load the pac file, start the flashing and connect the phone to the pc pressing vol-. After flashing is done boot the engineering firmware. Install:https://androidfilehost.com/?fid=746010030569952951, then download the attached zip and follow these steps:

adb shell

mount -o remount,rw /

rm -rf /system/app/ZFTDoctor

reboot

adb push '/home/homefolder/Scaricati/magisk-start.sh' /data/local/tmp

adb push '/home/homefolder/Scaricati/magisk-setup.sh' /data/local/tmp

adb push '/home/homefolder/Scaricati/magisk' /data/local/tmp

adb shell

cd /data/local/tmp

chmod 755 magisk-setup.sh magisk-start.sh

./magisk-setup.sh

./magisk-start.sh -1

./magisk-start.sh -2

./magisk-start.sh -3

This will load temp root on the engineering firmware.

Or if you want you can flash a GSI trough Research Download Tool. To do this just open the tool, wait until eng firmware loads and click on the double gears icon, from there you can deselect everything except system and load the gsi you want to flash as system, after that start the flashing and connect the phone to the pc pressing vol-. A small trick from me, you can select cache and userdata as well so that those partitions will be flashed, this will equal to a wipe of /data and /cache partition, consider it like wiping data from recovery.

I'm uploading files here:https://terabox.com/s/1M-FvQQJo4tsM0KdIoLXPlA

Here is a video guide for rooting the eng firmware and for gsi flashing:

1-GSI Flashing:

View attachment 6112684

2-Root on Eng FW:

View attachment 6112687

Note that to root by this method other models you will have to find an engineering firmware according to your model, the best place to search is:https://androidhost.ru/search.html

Engineering firmwares always start with PV so they are easy to recognize.

About vbmeta ZTE engineering firmwares have dm-verity disabled for system and vendor partition, that's why you don't need to flash any vbmeta and you can flash GSIs and vendors, and delete stuff on the stock firmware. Thanks ZTE for being dumb.

About a future custom recovery we will see, only ways to boot it is to patch or unlock bootloader with some exploit (if there will be in the future), or to build a safestrap recovery (a recovery that can run on locked bootloader with root). The only problem is that unlocked bootloader alone won't disable dm-verity, that's why eng firmwares are needed, on them the bootloader misses some checks on system, vendor and product partition making this root possible.

I talked with unisoc, this vulnerability was patched on Android 12, so if you are on Android 11 or earlier you can use it, and the fun thing is that they didn't tell me that I was wrong about one thing, this vulnerability regards u-boot, meaning that doesn't affect only ZTE devices (probably), it is applicable to other brands as well, you just need an engineering firmware for your device. Also it has to be tried but maybe you can flash magisk patched boot and patched vbmeta made from hovatek tutorial on non ZTE.

Engineering Firmwares list:

ZTE Blade V10 Vita:https://androidhost.ru/Y5a (unisoc)

ZTE Blade V10 Vita:https://terabox.com/s/1bpr9gj966FZGDXl1vpVo7Q (mtk variant)

ZTE Blade A5 2020 (Android 9 variant, don't flash it on android 11 variant or you will brick):https://androidhost.ru/y97 (unisoc) (confirmed to work)

ZTE Blade A5 2019:https://androidhost.ru/Y56 (unisoc) (confirmed to work)

ZTE Blade A3 2020:https://androidhost.ru/Y68 (unisoc)

ZTE Blade A3 2019:https://androidhost.ru/Y67 https://terabox.com/s/1ojlXy3K-EsgJogC119qAdA (unisoc)

ZTE Blade L8:https://terabox.com/s/1lFGbVNyCvskQdyaVDekmLg (unisoc)

ZTE Optus Vista X:https://terabox.com/s/15t7iEaVfj9ALQebQBfa4UA (unisoc)

I'll add more when I find them.

Other Engineering Firmwares i found but not unisoc, and so this method doesn't work for them, I'll link them anyway:https://terabox.com/s/1s8LkyVLgUXcXwR8GwurHfg

About those firmware phone names, here are:

Spoiler content hidden.

This is an unisoc vulnerability, so it doesn't work on mediatek and qualcomm variants.

Today 8-Nov-2023 with https://github.com/TomKing062 help Bootloader on ZTE Blade A5 2019 was Unlocked, i used the files to unlock mine as well:https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/issues/4

Files to do it on github and on terabox

Spoiler content hidden.

Spoiler content hidden.