Axon 7 root without bootloader unlocked

Search This thread
By:
Advanced…
T

tenfar

Retired Recognized Developer
Jul 16, 2007
299
719
36
Beijing
www.tenfar.com
[MOD EDIT:]In the absence of the OP I have been asked to make it very clear that the included TWRP build flashes fine on Chinese and US models but bricks Euro models (The "G" model)


CAUTION: this might be outdated,since this method is using a qualcomm bootloader logical bug.that is fixed in 2016/12 .so the latest firmware dont have this vulnerability.


By attempting any of the processes listed this thread you accept full responsibility for your actions. I will not be held responsible if your device stops working, catches on fire, or turns into a hipster and claims to have been modified before it was cool.

Backup all your important data before you do any steps below:

Step 1: Download the zip file and extract to your local disk. a2017 for Chinese model,and a2017u for US model,a2017g for HK & EU model
a2017u :B20_blunlockedhttp://d-h.st/KaaQ
a2017u B20 http://d-h.st/LqR5 (modified from @rczrider‘s backup real stock b20 boot.img)
a2017u B27 http://d-h.st/kRgq
a2017 B06:http://d-h.st/ztXw
a2017 B07:http://d-h.st/VVlf
a2017 B08: http://d-h.st/bT6r
a2017 B09:http://d-h.st/sBjo
a2017 B10:http://d-h.st/cBOE(wifi not working) http://d-h.st/aceq (from official update.zip)
a2017g B02 :removed by mod due to above note
a2017g B03:removed by mod due to above note
TWRP recovery 3.0.2-2 : http://d-h.st/dgWW
latest tools:http://d-h.st/Ienb with dump function

Step 2:Shut down your phone, hold volume down + volume up ,then plug your phone with USB cable. or you can use adb
Code: 
adb reboot edl

Step 3:install the Qualcomm's driver .
Download Qualcomm driver to your local disk ,extract and install it
Qualcomm 9008 driver :http://d-h.st/35tx
in the install process choose WWAN ,the first option.
Step 4 : open your PC's device manager and find out the com port number which your phone is .as the Pic shows ,in my case,the port number is 4
View attachment 3844965
Step 5: right click in Explorer with SHIFT key press, open a Command Window.
in the command window, run the program

Code: 
Usage: axon7root.exe -p COM4 -b -r
       Options:
       -p                             Port number eg:COM8 or 8
       -b                             write boot.img only
       -r                             write recovery.img only
       -d                             dump boot.img and recovery.img from phone(not impl yet)
the 4 is my com port number in my system. change it to your's
command.png
before you do any thing do a dump use my latest program:
Code: 
axon7backup.exe -p 4 -d
two backup will read from your phone to local disk.
backup.png
for flash boot.img to boot partition:
Code: 
 axon7root.exe -p 4 -b
for flash recovery.img to recovery partition:
Code: 
 axon7root.exe -p 4 -r
for flash both boot.img and recovery.img :
Code: 
 axon7root.exe -p 4 -b -r
or just without -b and -r options:
Code: 
 axon7root.exe -p 4
after the program exit,
if you have flashed a TWRP recovery.
press volume up+ power to boot into recovery
FORMAT the data partition
if you only flash the boot.img :
boot into stock recovery do a factory reset
when your boot into your system. you will need to install a superuser manager.
you should install https://play.google.com/store/apps/details?id=me.phh.superuser&hl=en
Thank Pierre-Hugues Husson for his superboot for the hint on root this without an unlocked bootloader
by the test .so we can confirm that all model have same hardware.
I don't have a2017u and a2017g ,so i took the boot.img and twrp recovery image form idlekernel.com .thanks the owner.
and since i don't have a2017u adn a2017g ,i didn't test this on these two models use at your own risk.
but i test it on a2017 Chinese version. it works very well.
also i tested that flash the a2017u and a2017g's boot.img and recovery.img to my a2017,both worked.

from @r3xx3r test,we can know that the metod works on a2017u ,
Thanks @Cricius test and report it also work on a2017g.
Thanks @rczrider and @KyJelly69 to share their b20 stock backup. but for b20_boot and b18 we still need those stock files.

Thanks @mmamedov post a detailed step by step at post #157
http://xdaforums.com/showpost.php?p=68302434&postcount=157
 

Attachments

  • axon7root.zip
    863.5 KB · Views: 7,042
Last edited:
  • Like
Reactions: tokinger, hackvier1, mozerxdaven and 64 others
M

mischa_martin

Senior Member
Apr 12, 2011
312
115
Frankfurt
Any chance for european model A2017G?

Also how does dm-verity gets bypassed?
As far as I know Boot partiton gets verifed at every Boot on all recent Android devices.
 
rczrider

rczrider

Senior Member
May 20, 2015
733
543
Markarth
If this works on the US model, would it allow for a dump and generation of stock firmware (without bootloader unlock)?
 
R

rikin93

Senior Member
Jun 28, 2016
368
277
Anyone get a version for A2017G (EU)? Would be nice to have root on EU models.
@tenfar
There is a EU rom here which maybe you can test a root for?

A2017G B02 Update Released!
http://www.ztedevice.com/support/detail?Id={E68B5101-20E9-4955-A8D6-FFF274776F46}

Mirror download:
http://uploaded.net/file/npj4c0fj
 
Last edited:
  • Like
Reactions: celticchrys
T

tenfar

Retired Recognized Developer
Jul 16, 2007
299
719
36
Beijing
www.tenfar.com
rikin93 said:
Literally just editted my post haha
@tenfar
There is a EU rom here which maybe you can test a root for?

A2017G B02 Update Released!
http://www.ztedevice.com/support/detail?Id={E68B5101-20E9-4955-A8D6-FFF274776F46}

Mirror download:
http://uploaded.net/file/npj4c0fj
Click to expand...
Click to collapse



is the device's hardware same with a2017 ？i dont have the device to test ，so can't help. Needed someone who is brave to test this. And the test is a little complicated,pm me if any one willing to help.i will show you how to test and provide needed tools.
 
  • Like
Reactions: onearmedscissor
R

rikin93

Senior Member
Jun 28, 2016
368
277
tenfar said:
is the device's hardware same with a2017 ？i dont have the device to test ，so can't help. Needed someone who is brave to test this. And the test is a little complicated,pm me if any one willing to help.i will show you how to test and provide needed tools.
Click to expand...
Click to collapse
It is more similar to USA build as it has capacitive buttons but software is not similar.

I dont know how brave i am but am willing to help
 
T

TeutonJon78

Senior Member
Jul 24, 2010
574
287
tenfar said:
seems i need to provide more options with the program eg：-b for boot.img -r for recovery.img -d for dump
Click to expand...
Click to collapse

If the program can flash around the locked bootloader, does it have the option to be able to download the partitions while NOT changing anything? Then we could finally get some clean backups.
 
P

peramikic

Senior Member
Nov 12, 2008
524
298
tenfar said:
I don't have a2017u ,so i took the boot.img and twrp recovery image form idlekernel.org.thanks the owner.
and since i dont't have a2017u ,i didn't test this on a2017u. use at your own risk.
but i test this on a2017 Chinese version. it works very well. also i tested that flash the us version boot.img to my chinese version phone, the recovery works as it should.but the system boot froze.

if you have and unlocked bootloader and you have brave souls to test this on us version, if it works ,please let us know.
Click to expand...
Click to collapse
I am almost positive that the boot.img that @jcadduono uploaded to idlekernal is the B20_Boot update, since it came from a post unlocked BL dump from @jkuczera . It might be good proof of concept that root works, and could provide way to get pre-B20_boot system image. We will need a B18 or B20 full image to confirm ability to root without BL unlock. The 2017G(EU-HK) has a full firmware release B02, i'll see to attach it's boot.img later if you want to spin up a version for them

Link to boot img from A2017G B02
http://www.filedropper.com/boot-a2017g-b02
 
Last edited:
  • Like
Reactions: tenfar
You must log in or register to reply here.

Similar threads

Unjustified Dev
[OFFICIAL]LineageOS 14.1 for ZTE Axon 7
Replies
4K
Views
638K
A
afef
Unjustified Dev
[ROM][UNOFFICIAL]CyanogenMod 13 for Axon 7
Replies
2K
Views
378K
T
Tonybigedsnow
OrdenKrieger
[OFFICIAL] LineageOS 15.1 for ZTE Axon 7
Replies
3K
Views
354K
paparazzo79
paparazzo79
OrdenKrieger
[UNOFFICIAL] LineageOS 16.0 for ZTE Axon 7
Replies
1K
Views
245K
A
axon7one
B
Axon7Toolkit - Unlock BL, Root, and more! (1.2.1 - 09/04/17)
Replies
891
Views
230K
B
Boristheliar

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 67
    T
    tenfar
    [MOD EDIT:]In the absence of the OP I have been asked to make it very clear that the included TWRP build flashes fine on Chinese and US models but bricks Euro models (The "G" model)


    CAUTION: this might be outdated,since this method is using a qualcomm bootloader logical bug.that is fixed in 2016/12 .so the latest firmware dont have this vulnerability.


    By attempting any of the processes listed this thread you accept full responsibility for your actions. I will not be held responsible if your device stops working, catches on fire, or turns into a hipster and claims to have been modified before it was cool.

    Backup all your important data before you do any steps below:

    Step 1: Download the zip file and extract to your local disk. a2017 for Chinese model,and a2017u for US model,a2017g for HK & EU model
    a2017u :B20_blunlockedhttp://d-h.st/KaaQ
    a2017u B20 http://d-h.st/LqR5 (modified from @rczrider‘s backup real stock b20 boot.img)
    a2017u B27 http://d-h.st/kRgq
    a2017 B06:http://d-h.st/ztXw
    a2017 B07:http://d-h.st/VVlf
    a2017 B08: http://d-h.st/bT6r
    a2017 B09:http://d-h.st/sBjo
    a2017 B10:http://d-h.st/cBOE(wifi not working) http://d-h.st/aceq (from official update.zip)
    a2017g B02 :removed by mod due to above note
    a2017g B03:removed by mod due to above note
    TWRP recovery 3.0.2-2 : http://d-h.st/dgWW
    latest tools:http://d-h.st/Ienb with dump function

    Step 2:Shut down your phone, hold volume down + volume up ,then plug your phone with USB cable. or you can use adb
    Code: 
    adb reboot edl

    Step 3:install the Qualcomm's driver .
    Download Qualcomm driver to your local disk ,extract and install it
    Qualcomm 9008 driver :http://d-h.st/35tx
    in the install process choose WWAN ,the first option.
    Step 4 : open your PC's device manager and find out the com port number which your phone is .as the Pic shows ,in my case,the port number is 4
    View attachment 3844965
    Step 5: right click in Explorer with SHIFT key press, open a Command Window.
    in the command window, run the program

    Code: 
    Usage: axon7root.exe -p COM4 -b -r
       Options:
       -p                             Port number eg:COM8 or 8
       -b                             write boot.img only
       -r                             write recovery.img only
       -d                             dump boot.img and recovery.img from phone(not impl yet)
    the 4 is my com port number in my system. change it to your's
    command.png
    before you do any thing do a dump use my latest program:
    Code: 
    axon7backup.exe -p 4 -d
    two backup will read from your phone to local disk.
    backup.png
    for flash boot.img to boot partition:
    Code: 
     axon7root.exe -p 4 -b
    for flash recovery.img to recovery partition:
    Code: 
     axon7root.exe -p 4 -r
    for flash both boot.img and recovery.img :
    Code: 
     axon7root.exe -p 4 -b -r
    or just without -b and -r options:
    Code: 
     axon7root.exe -p 4
    after the program exit,
    if you have flashed a TWRP recovery.
    press volume up+ power to boot into recovery
    FORMAT the data partition
    if you only flash the boot.img :
    boot into stock recovery do a factory reset
    when your boot into your system. you will need to install a superuser manager.
    you should install https://play.google.com/store/apps/details?id=me.phh.superuser&hl=en
    Thank Pierre-Hugues Husson for his superboot for the hint on root this without an unlocked bootloader
    by the test .so we can confirm that all model have same hardware.
    I don't have a2017u and a2017g ,so i took the boot.img and twrp recovery image form idlekernel.com .thanks the owner.
    and since i don't have a2017u adn a2017g ,i didn't test this on these two models use at your own risk.
    but i test it on a2017 Chinese version. it works very well.
    also i tested that flash the a2017u and a2017g's boot.img and recovery.img to my a2017,both worked.

    from @r3xx3r test,we can know that the metod works on a2017u ,
    Thanks @Cricius test and report it also work on a2017g.
    Thanks @rczrider and @KyJelly69 to share their b20 stock backup. but for b20_boot and b18 we still need those stock files.

    Thanks @mmamedov post a detailed step by step at post #157
    http://xdaforums.com/showpost.php?p=68302434&postcount=157
    View
    31
    M
    mmamedov
    As suggested by @tdgillihan, I will write step-by-step instruction on how I got root (& TWRP) to work on my a2017u B20 device.

    Disclaimer: there might be easier/better/faster ways to do this, but this is the way that worked for me.

    All links & some steps are taken from the original post in this thread.

    Skip to step 8 if you have done this before, but haven't been successful.

    tl;dr version: flash boot first, clear data using stock recovery, then flash TWRP.


    1. Download the latest package by @tenfar for a2017u B20 (here: http://d-h.st/LqR5), unpack.
    2. Download @tenfar's backup tool (here: http://d-h.st/Ienb), unpack.
    3. Download Qualcomm drivers (here: http://d-h.st/35tx), install them (choose WWAN when prompted).
    4. Plug the phone in while holding volume up & volume down buttons.
    5. Go to Device Manager in Windows & check which port you're connected to. Look for a Qualcomm USB device.
    6. Go to the folder where the backup tool is unpacked (from step 2), right click while holding shift, choose "Open command window here."
    7. Type in "axon7backup.exe -p X -d" where X is the port number you're connected to (ex. axon7backup.exe -p 4 -d). This will create 2 backup files, save both of them in case of bootloop.
    8. Go to the folder where the rooting tool is unpacked (from step 1), right click while holding shift, choose "Open a Command Window."
    9. Type in " axon7root.exe -p X -b" where X is the port number you're connected to. DO NOT include -r at the end.
    10. Unplug from computer, boot into recovery by holding volume up & power button (it might take 2 tries.)
    11. Navigate using volume buttons, choose "wipe data/factory reset" using power button, choose "power off" after successful wipe.
    12. Plug the phone back to the computer while holding volume up & volume down buttons.
    13. Go to the folder where the rooting tool is unpacked (from step 1), right click while holding shift, choose "Open a Command Window."
    14. Type in " axon7root.exe -p X -r" where X is the port number you're connected to.
    15. Unplug from computer, boot into recovery by holding volume up & power button. This time it should boot into TWRP recovery.
    16. Reboot into the system.
    17. Don't forget to support @tenfar, @DrakenFX, @tdgillihan, and everyone else that has contributed to the community behind this device.
    View
    11
    T
    tennear
    Folks,

    I have successfully retrieved the firehose image from the OP's tool. I will be making my own tool for Linux (and maybe Mac and Windows) in the coming few days. If you have bricked your device somehow with the OP's tool, this should allow you to fix your device.
    View
    8
    JeromeLeung
    JeromeLeung
    I have root and xposed working just fine on B20. However, I didn't bother with TWRP.
    Here are the steps I took (after dumping boot and recovery of course):
    1) Ran Tenfar's app but told it to flash the boot.img only
    Code: 
    axon7root -p 4 -b
    2) Booted into stock recovery and did a factory reset
    3) Booted up and installed PHH's superuser
    4) Installed Terminal Emulator in order to turn off system write protection using:
    Code: 
    reboot disemmcwp
    if you want to do this via abd, it should be this instead:
    Code: 
    adb shell reboot disemmcwp
    After it booted up, root was working properly and changes I made with root stuck even after reboots.

    I do all my flashing with chainfire's Flashfire. Make sure to set selinux to permissive first tho
    in terminal emulator:
    Code: 
    setenforce 0
    I haven't tried backing up and restoring with Flashfire yet...

    Anyway, hope this might help someone!
    View
    7
    rczrider
    rczrider
    Thanks for creating this tool, @tenfar!

    I was able to do a full dump (boot, recovery, system) for locked B20 (US) and I'm in the process of uploading those now.
    View

New posts