[DISCUSSION] ABOOT Unlocking / Bootloader Unlocking - ZTE Axon 7 Guides, News, & Discussion

Hey Guys,
Suspected ROM is here: http://devicedownload.zte.com.cn/support/product/201606031040/sd/20160715164404575.zip
I'm not 100% sure of that actually is the ROM, I've herd of OTA updates going out, if someone could intercept them and post them that would be great (I don't physically have the device yet)
After quickly having a look at emmc_appsboot.mbn in IDA could you guys try a few things in fastboot?
1. fastboot oem unlock-go
2. fastboot frp-unlock OR fastboot oem frp-unlock
Cheers Guys!

---

You want us to try this only after latest updates? I'm still on build B18, not B21.
No go on shipped firmware.

---

redeyss said:
You want us to try this only after latest updates? I'm still on build B18, not B21.
No go on shipped firmware.
Click to expand...
Click to collapse
Hmm, I don't think that's the actual firmware, if the OTA is being updated over SSL, add a RootCA and update, even the URL would be perfect, I'm only after emmc_appsboot.mbn

---

(dylanger) said:
Hmm, I don't think that's the actual firmware, if the OTA is being updated over SSL, add a RootCA and update, even the URL would be perfect, I'm only after emmc_appsboot.mbn
Click to expand...
Click to collapse
Actually catting build.prop
I think this is the correct firmware
Build ID: MMB29M
HTML:
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=MMB29M
ro.build.display.id=ZTE_A2017V1.0.0B06
ro.build.version.incremental=20160708.061559
ro.build.version.sdk=23
ro.build.version.preview_sdk=0
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=6.0.1
ro.build.version.security_patch=2016-05-01
ro.build.version.base_os=
ro.build.date=Fri Jul 8 06:19:57 CST 2016
ro.build.date.utc=1467929997
ro.build.type=user
ro.build.user=
ro.build.host=scm6
ro.build.tags=release-keys
ro.build.flavor=P996A03-user
ro.product.model=ZTE A2017
ro.product.brand=ZTE
ro.product.name=P996A03
ro.product.device=ailsa_ii
ro.product.board=ailsa_ii
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=arm64-v8a
ro.product.cpu.abilist=arm64-v8a,armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=arm64-v8a
ro.product.manufacturer=ZTE
ro.product.locale=zh-CN
ro.wifi.channels=
ro.board.platform=msm8996
# ro.build.product is obsolete; use ro.product.device
ro.build.product=ailsa_ii
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=P996A03-user 6.0.1 MMB29M 20160708.061559 release-keys
ro.build.fingerprint=ZTE/P996A03/ailsa_ii:6.0.1/MMB29M/20160708.061559:user/release-keys
ro.build.characteristics=default
# end build properties
#
# from device/zte/ailsa_ii/system.prop
#
#
# system.prop for msm8996
#
#rild.libpath=/system/lib/libreference-ril.so
rild.libpath=/vendor/lib64/libril-qc-qmi-1.so
#rild.libargs=-d /dev/smd0
persist.rild.nitz_plmn=
persist.rild.nitz_long_ons_0=
persist.rild.nitz_long_ons_1=
persist.rild.nitz_long_ons_2=
persist.rild.nitz_long_ons_3=
persist.rild.nitz_short_ons_0=
persist.rild.nitz_short_ons_1=
persist.rild.nitz_short_ons_2=
persist.rild.nitz_short_ons_3=
ril.subscription.types=NV,RUIM
DEVICE_PROVISIONED=1
# Start in global mode
#ro.telephony.default_network=10
debug.sf.hw=1
debug.egl.hw=1
debug.gralloc.enable_fb_ubwc=1
dalvik.vm.heapsize=36m
dev.pm.dyn_samplingrate=1
persist.demo.hdmirotationlock=false
#ro.hdmi.enable=true
#persist.speaker.prot.enable=false
qcom.hw.aac.encoder=true
#
# system props for the cne module
#
persist.cne.feature=1
#system prop for enabling/disabling Android XLAT
persist.net.doxlat=true
#system props for the MM modules
media.stagefright.enable-player=true
media.stagefright.enable-http=true
media.stagefright.enable-aac=true
media.stagefright.enable-qcp=true
media.stagefright.enable-fma2dp=true
media.stagefright.enable-scan=true
mmp.enable.3g2=true
media.aac_51_output_enabled=true
mm.enable.smoothstreaming=true
#185971 is decimal sum of supported parsers in AAL
#37491 is decimal sum of supported codecs in AAL
#codecs:(PARSER_)AAC AC3 AMR_NB AMR_WB ASF AVI DTS FLV 3GP 3G2 MKV MP2PS MP2TS MP3 OGG QCP WAV FLAC AIFF APE
mm.enable.qcom_parser=1048575
persist.mm.enable.prefetch=true
# Additional i/p buffer in case of encoder DCVS
vidc.enc.dcvs.extra-buff-count=2
# Set default power mode to low power for encoder
vidc.debug.perf.mode=2
#
# system props for the data modules
#
ro.use_data_netmgrd=true
persist.data.netmgrd.qos.enable=true
persist.data.mode=concurrent
#system props for time-services
persist.timed.enable=true
#
# system prop for opengles version
#
# 196608 is decimal for 0x30000 to report version 3.0
# 196609 is decimal for 0x30001 to report version 3.1
ro.opengles.version=196609
# system property for maximum number of HFP client connections
bt.max.hfpclient.connections=1
# System property for cabl
ro.qualcomm.cabl=0
ro.qualcomm.display.paneltype=1
ro.sf.lcd_density=640
# appical display func
ro.qcom.ad.sensortype=2
ro.qcom.ad.calib.data=/system/etc/calib.cfg
ro.qcom.ad=1
#
# System props for telephony
# System prop to turn on CdmaLTEPhone always
telephony.lteOnCdmaDevice=1
#Simulate sdcard on /data/media
#
persist.fuse_sdcard=true
#system prop for Bluetooth SOC type
qcom.bluetooth.soc=rome
#system prop for wipower support
ro.bluetooth.wipower=true
#Set this true as ROME which is programmed
#as embedded wipower mode by deafult
ro.bluetooth.emb_wp_mode=true
#
#snapdragon value add features
#
ro.qc.sdk.audio.ssr=false
persist.audio.ssr.3mic=false
##fluencetype can be "fluence" or "fluencepro" or "none"
ro.qc.sdk.audio.fluencetype=fluence
persist.audio.fluence.voicecall=true
persist.audio.fluence.voicerec=false
persist.audio.fluence.speaker=true
#system prop for RmNet Data
persist.rmnet.data.enable=true
persist.data.wda.enable=true
persist.data.df.dl_mode=5
persist.data.df.ul_mode=5
persist.data.df.agg.dl_pkt=10
persist.data.df.agg.dl_size=4096
persist.data.df.mux_count=8
persist.data.df.iwlan_mux=9
persist.data.df.dev_name=rmnet_usb0
#property to enable user to access Google WFD settings
persist.debug.wfd.enable=1
##property to choose between virtual/external wfd display
persist.sys.wfd.virtual=0
#property to enable sde downscale feature for external display
#sdm.debug.downscale_external=1
#property to specify the number of frames to skip before setting hint
sdm.perf_hint_window=50
#disable tunnel encoding
tunnel.audio.encode=false
#Buffer size in kbytes for compress offload playback
audio.offload.buffer.size.kb=32
#Enable offload audio video playback by default
audio.offload.video=true
#Enable 16 bit PCM offload by default
audio.offload.pcm.16bit.enable=true
#Enable 24 bit PCM offload by default
audio.offload.pcm.24bit.enable=true
#Enable audio track offload by default
audio.offload.track.enable=true
#Enable music through deep buffer
audio.deep_buffer.media=true
#enable voice path for PCM VoIP by default
use.voice.path.for.pcm.voip=true
#Enable multi channel aac through offload
audio.offload.multiaac.enable=true
# system prop for NFC DT
ro.nfc.port=I2C
#enable dsp gapless mode by default
audio.offload.gapless.enabled=true
#enable pbe effects
audio.safx.pbe.enabled=true
#parser input buffer size(256kb) in byte stream mode
audio.parser.ip.buffer.size=262144
#property to enable WFD WL solution
ro.vendor.wl_library=libqti-wl.so
#property for vendor specific library
ro.vendor.gt_library=libqti-gt.so
ro.vendor.at_library=libqti-at.so
sys.games.gt.prof=1
#hwui properties
ro.hwui.texture_cache_size=72
ro.hwui.layer_cache_size=48
ro.hwui.r_buffer_cache_size=8
ro.hwui.path_cache_size=32
ro.hwui.gradient_cache_size=1
ro.hwui.drop_shadow_cache_size=6
ro.hwui.texture_cache_flushrate=0.4
ro.hwui.text_small_cache_width=1024
ro.hwui.text_small_cache_height=1024
ro.hwui.text_large_cache_width=2048
ro.hwui.text_large_cache_height=1024
#Disable property for Dolby ds2
audio.dolby.ds2.enabled=false
#Disable property for hard bypass
audio.dolby.ds2.hardbypass=false
audio.offload.passthrough=false
audio.offload.multiple.enabled=true
# enable navigation bar
qemu.hw.mainkeys=0
#property to enable VDS WFD solution
persist.hwc.enable_vds=1
#Enable stm events
ro.dbg.coresight.config=stm_events
#property to enable fingerprint
persist.qfp=false
#default pd_enable value
persist.sys.pd_enable=0
#Disable rotator split feature
sdm.debug.disable_rotator_split=1
persist.camera.preview.ubwc=0
persist.camera.video.ubwc=0
#Increase cached app limit
ro.sys.fw.bg_apps_limit=60
#Camera fullscreen doesn't show navigation bar
Camera.no_navigation_bar=true
# ZTE_MODIFY liyunteng, for DOLBY_AUDIO_EFFECT
dmid=3067269873
audio.ds1.metainfo.key=273
# ZTEMODIFY, modified, end
#add pdaf prop to disable pdaf roi display ZTE_CAM_huwendi_20160217
persist.camera.stats.test=5
#
# ADDITIONAL_BUILD_PROPERTIES
#
persist.nfc.smartcard.config=SIM1,SIM2,eSE1
persist.radio.hw_mbn_update=1
persist.sys.timezone=Asia/Shanghai
ro.config.ringtone=In_the_rain.ogg
ro.build.sw_internal_version=P996A03V1.0.0B24
ro.telephony.default_network=22
ro.carrier.default_id=CHINATELECOM
ro.build.lcd.grey=1
persist.radio.phone.matchnum=11
ro.carrier.openmarket=true
ro.build.PTP_Feature=true
ro.build.MiFavor_version=4.0
persist.sys.doubleapp.enable=1
ro.build.wifihotspot=android_origin
ro.build.def_theme_name=default_theme_00
ro.config.notification_sound_2=Universe.ogg
persist.radio.rat_on=combine
ro.build.hardware_version=u57B
persist.radio.sw_mbn_openmkt=1
ro.config.ringtone_2=The_party.ogg
ro.streaming.ua.prof=http://www.zte.com.cn/mobile/uaprof/ZTE%20A2017.xml
persist.radio.mode_pref_nv10=1
ro.build.baseband_version=P996A03B01
persist.radio.sw_mbn_update=1
ro.config.alarm_alert=The_dawn_of_the_morning.ogg
ro.config.notification_sound=Glow.ogg
persist.sys.bootsound=1
persist.radio.sw_mbn_volte=1
persist.radio.multisim.config=dsds
ro.telephony.default_cdma_sub=0
persist.sys.usb.menu=disable
persist.sys.usb.config=cdrom
persist.dpm.feature=0
persist.sys.logcontrol.run=1
persist.sys.ssr.restart_level=ALL_ENABLE
ro.com.android.dataroaming=false
persist.radio.add_power_save=1
persist.radio.sap_silent_pin=true
dalvik.vm.heapgrowthlimit=256m
dalvik.vm.heapstartsize=8m
dalvik.vm.heapsize=512m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=512k
dalvik.vm.heapmaxfree=8m
keyguard.no_require_sim=true
ro.carrier=unknown
ro.vendor.extension_library=libqti-perfd-client.so
persist.radio.apm_sim_not_pwdn=1
persist.radio.sib16_support=1
persist.radio.custom_ecc=1
ro.frp.pst=/dev/block/bootdevice/by-name/frp
persist.sys.ztelog.enable=0
af.fast_track_multiplier=1
audio_hal.period_size=192
camera.disable_zsl_mode=1
drm.service.enabled=true
ro.com.google.clientidbase=android-google
ro.setupwizard.mode=DISABLED
ro.com.google.gmsversion=6.0_r2
ro.com.google.clientidbase.yt=android-zte
ro.com.google.clientidbase.am=android-zte
ro.com.google.clientidbase.ms=android-zte
ro.com.google.clientidbase.gmm=android-zte
persist.sys.dalvik.vm.lib.2=libart
dalvik.vm.isa.arm64.variant=kryo
dalvik.vm.isa.arm64.features=default
dalvik.vm.isa.arm.variant=cortex-a53
dalvik.vm.isa.arm.features=default
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
persist.gps.qc_nlp_in_use=1
persist.loc.nlp_name=com.qualcomm.location
ro.gps.agps_provider=1
persist.radio.calls.on.ims=0
persist.radio.jbims=0
persist.radio.csvt.enabled=false
persist.radio.mt_sms_ack=20
ro.expect.recovery_id=0x1db414c1ce48ec8ed8823731d62db0f10e5ae677000000000000000000000000
import /system/vendor/default.prop
import /system/vendor/vendor.prop
import /system/vendor/power.prop

---

So what makes you think this is firmare to allow bootloader unlock? Ive done a lot of searching and I dont see anything pointing to that happening. Hope im wrong, id buy it if I could.

---

fix-this! said:
So what makes you think this is firmare to allow bootloader unlock? Ive done a lot of searching and I dont see anything pointing to that happening. Hope im wrong, id buy it if I could.
Click to expand...
Click to collapse
Sometimes vendors have secret fastboot commands, or their recovery dosen't check what you've provided to it, I have a massive flight to BlackHat coming up so I know what I'll be doing on the flight

---

(dylanger) said:
Sometimes vendors have secret fastboot commands, or their recovery dosen't check what you've provided to it, I have a massive flight to BlackHat coming up so I know what I'll be doing on the flight
Click to expand...
Click to collapse
Look forward to hearing what you find out! I really really want this phone to be unlockable/rootable.

---

ScaryBugThing said:
Look forward to hearing what you find out! I really really want this phone to be unlockable/rootable.
Click to expand...
Click to collapse
If ZTE are being honest and truthful with their stated intentions then one of the first couple of updates for the international version should provide owners of the international version with an unlock-able boot-loader. No relying on the work of third parties of unknown trustworthiness or vulnerabilities that may be patched out and require new vulnerabilities to be found for later purchasers to unlock their phone.

---

Nameless One said:
If ZTE are being honest and truthful with their stated intentions then one of the first couple of updates for the international version should provide owners of the international version with an unlock-able boot-loader. No relying on the work of third parties of unknown trustworthiness or vulnerabilities that may be patched out and require new vulnerabilities to be found for later purchasers to unlock their phone.
Click to expand...
Click to collapse
It depends on how well they've written their software, I'm seeing 'Secret key is invalid, please update the bootloader with secret key' in ABOOT, so it looks like they may have the same get up as Motorola where you request a key and unlock it with that, I haven't been able to match this string back up THUMB/ARM OpCodes yet. Or they may have a signed copy of ABOOT that allows unlocking, and they'll slip that into OTA.
If I find something I'll let you all know!

---

Actually if you go in the developper options, there is an option to allow bootloader unlock
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
.

---

XblackdemonX said:
Actually if you go in the developper options, there is an option to allow bootloader unlock
.
Click to expand...
Click to collapse
That's a very generic button that does nothing on a lot of phones. We cover this already on XDA like a gazillion time. lol.
---------- Post added at 05:47 PM ---------- Previous post was at 05:46 PM ----------
(dylanger) said:
Sometimes vendors have secret fastboot commands, or their recovery dosen't check what you've provided to it, I have a massive flight to BlackHat coming up so I know what I'll be doing on the flight
Click to expand...
Click to collapse
Damn, you going to BH from Sydney? Are you a speaker or just a "researcher" . Have fun.

---

max1001 said:
That's a very generic button that does nothing on a lot of phones. We cover this already on XDA like a gazillion time. lol.
Click to expand...
Click to collapse
Oh, I didn't know that. that sucks

---

I'm really hoping that someone can crack the Axon 7, too. I guess I just assumed when I bought it since most phones get cracked. This better not be one of those that can't be unlocked/rooted. I love this phone, but I hate ZTE's skin. It looks cheap. I'm using Nova Prime right now because I just can't keeping looking at MiFavorUI.

---

daneoleary said:
I'm really hoping that someone can crack the Axon 7, too. I guess I just assumed when I bought it since most phones get cracked. This better not be one of those that can't be unlocked/rooted. I love this phone, but I hate ZTE's skin. It looks cheap. I'm using Nova Prime right now because I just can't keeping looking at MiFavorUI.
Click to expand...
Click to collapse
They are getting harder as securities of the bigger brand and Android in general is getting better but ZTE is kinda new to this game so, there's a good chance of a root exploit at least.

---

max1001 said:
They are getting harder as securities of the bigger brand and Android in general is getting better but ZTE is kinda new to this game so, there's a good chance of a root exploit at least.
Click to expand...
Click to collapse
I'll keep my phalanges crossed.
Half the reason why there are so many people using Android is because of the potential to root and customize. If OEMs start making devices that can't be rooted, Android is going to lose a bunch of previously loyal followers.

---

max1001 said:
That's a very generic button that does nothing on a lot of phones. We cover this already on XDA like a gazillion time. lol.
---------- Post added at 05:47 PM ---------- Previous post was at 05:46 PM ----------
Damn, you going to BH from Sydney? Are you a speaker or just a "researcher" . Have fun.
Click to expand...
Click to collapse
Yeah, first time in the states! Pretty excited about it, I'm a Researcher, hopefully talking next year! Cheers!

---

XblackdemonX said:
Actually if you go in the developper options, there is an option to allow bootloader unlock
.
Click to expand...
Click to collapse
I have tried this to no effect.
---------- Post added at 04:01 AM ---------- Previous post was at 03:52 AM ----------
Don't count on them unlocking it since they offering a product warranty. They don't want to have to deal with jokers that hose their devices trying to MOD it, then unroot and try to get a new device because they bricked it.

---

jim262 said:
I have tried this to no effect.
---------- Post added at 04:01 AM ---------- Previous post was at 03:52 AM ----------
Don't count on them unlocking it since they offering a product warranty. They don't want to have to deal with jokers that hose their devices trying to MOD it, then unroot and try to get a new device because they bricked it.
Click to expand...
Click to collapse
This is a bit of a cop out, procedures do exist where if you unlock the device, it will 'blow' a fuse thus permanently voiding the warranty, all OEMs should be providing this option, the worst vendor I've ever experienced is Motorola.

---

(dylanger) said:
This is a bit of a cop out, procedures do exist where if you unlock the device, it will 'blow' a fuse thus permanently voiding the warranty, all OEMs should be providing this option, the worst vendor I've ever experienced is Motorola.
Click to expand...
Click to collapse
But Android M has two classes of boot verification implementation. If ZTE went with Class A which i am sure they did, it's not going to be easy to switch to Class B. Considering there's numerous bug currently, the developers have to fixed those before they have time for this bootloader unlock business.
Ref, https://source.android.com/security/verifiedboot/verified-boot.html#glossary
---------- Post added at 03:32 AM ---------- Previous post was at 03:29 AM ----------
Can someone with the phone try this in ADB.
"fastboot flashing unlock"
fastboot oem unlock doesn't work in Android M.

---

max1001 said:
But Android M has two classes of boot verification implementation. If ZTE went with Class A which i am sure they did, it's not going to be easy to switch to Class B. Considering there's numerous bug currently, the developers have to fixed those before they have time for this bootloader unlock business.
Ref, https://source.android.com/security/verifiedboot/verified-boot.html#glossary
---------- Post added at 03:32 AM ---------- Previous post was at 03:29 AM ----------
Can someone with the phone try this in ADB.
"fastboot flashing unlock"
fastboot oem unlock doesn't work in Android M.
Click to expand...
Click to collapse
Ah yeah, this is Android's new ABOOT, allowing the user to sign their own boot.img kernels? I think they did this to disable Android Pay if you've unlocked the bootloader? Yeah it depends on ZTE, they could have just chosen with a vanilla LK/ABOOT