[Guide][A2017U][Root]How to RootOfficial Android 8.0 for A2017U without FASTBOOT

Teet1

Senior Member
Sep 17, 2013
439
316
0
Las Vegas
Hello everyone! In this guide I'll show you how to root ZTE's official release of Android Oreo 8.0. This is important if you wanted to upgrade (or downgrade....depending on your view) to ZTE's official release of Android 8.0 by going back to complete stock first and then installing the update zip file in stock recovery. Doing it this way fastboot does not work anymore since Nougat B32 and you do not have a custom recovery anymore, making you stuck on a rootless Android Oreo. Since there isn't a rooted TWRP flashable version of this just yet, this guide will show you how to root your Android and also become unstuck from having a stock recovery without fastboot. This could also help in unbricking with an incompatible recovery or if you accidentally flashed an official release of MiFavor or StockUI+ and the custom recovery is overwritten by stock recovery without root and fastboot.

This could also help if you have trouble with EDL drivers.

This has only been done and tested on an A2017U. If you're attempting this on another model, do so at your own risk! This guide is only for Windows 10!
This is not exactly noob friendly. This guide assumes you have ADB installed and everything.


I attempted this on my own whim. It was certainly a pain in the butt to get this to work for me as well because of EDL driver trouble. But if I managed to figure it out, you can too!

  1. First you're gonna need to download tennear's axon7tool here. Rename is to just axon7tool so it's easier to type.
  2. Download NFound's TWRP 3.2.1-8 for Oreo here and rename it to recovery.bin. Put it in the same directory where axon7tool is.
  3. Download Zadig here. This is for replacing the EDL drivers to some generic ones that this tool can use to connect to your phone in EDL mode.
  4. Download Magisk 16.2 here. Any newer Magisk version especially 17.1 causes a bootloop unfortunately so do NOT update. You can try different versions, but try at your own risk.
  5. We need to get into "proper" EDL mode. It is not recommended to do the "shut down your phone and hold both volume buttons and power on to get into EDL mode" way. This did not work for me. In order to get into proper EDL mode, make sure you're booted into Android and make sure Android Debugging is turned on. Open ADB on your computer and type
    Code:
    adb reboot edl
    and the phone will boot into proper EDL mode.
  6. After your phone is booted into proper EDL mode, connect your usb cable into your phone and go into the Control Panel of Windows and go to Device Manager
  7. In Device Manager, look for either "qualcomm usb loader 9008" or "QUSB_BULK". It doesn't really matter. Once you found it, its probably not necessary but I did it anyway, right click on it and click to uninstall. If it asks to uninstall any software then click that as well.


  8. After it is uninstalled, unplug your phone and plug it back in. It'll probably install some drivers again but that's okay. It might reinstall as QUSB_BULK even if you had "qualcomm usb loader 9008"
  9. It gets kinda tricky after this part, but it should work. If it doesn't, drop a comment below and I will try to help!
    Open Zadig. Click on Options and then click List all devices. Look for QUSB_BULK in the drop down menu and select it.

  10. After you've found it and selected it, you'll see on the bottom box it'll display what kind of driver it is loading. We need to replace it with WinUSB. Click on Replace Driver. After a few seconds it'll say it finished successfully. QUSB_BULK should read this now:

    This means that we can now use axon7tool.
  11. Open command prompt and navigate to where you downloaded axon7tool. In this case, it is on my desktop. Let's test to see if we have a connection. First we need to backup our recovery image, so we can test that out by typing
    Code:
    axon7 tool -r recovery
    This will read our recovery image and back it up and put it on our directory as "backup-recovery.bin"
    If you get an error that says
    Code:
    Connecting to device...
    S: failed to read command
    S: Failed to receive hello
    terminate called after throwing an instance of 'std::runtime_error'
      what():  error: Unknown error
    Then you need to go back into EDL mode manually again. Turn off your phone by holding power for 10 seconds and then turn it on back into Android. Once there open ADB and type again
    Code:
    adb reboot edl
    so we can go back to proper EDL mode and try the above axon7tool command again. It should work successfully this time.
  12. If it works, it'll backup recovery and then reboot your phone as shown below.

    You'll have a backup-recovery.bin saved into your directory. Now that we know this works, we can write our TWRP recovery image!
  13. Type
    Code:
    axon7tool -w recovery
    and it'll successfully write and reboot as shown below.

  14. While it reboots, go into recovery by holding Volume UP and Power, or while on the unlocked bootloader message press a volume button and select "Recovery" to get into recovery. This is to make sure that the stock rom does not overwrite our custom recovery with stock recovery
  15. You will now be greeted with NFound's custom TWRP recovery!
  16. Well, backup system and data in TWRP and then flash Magisk 16.2 as you would do! Wipe cache/dalvik if you want and then reboot, you should be rooted!


 
Last edited:

AnonVendetta

Senior Member
Apr 29, 2016
823
301
63
Portland, OR
I was able to install the official B20 zip file on my A2017U, but I already had the latest official TWRP by @jcadduono, so I was able to skip the EDL steps. Yes, it can be installed from TWRP, stock recovery not required.

Steps to success and what you need:
1. TWRP (I would use official version, just download the appropriate *.img file from twrp.me
2. B20 zip (you can download it from the support page on zteusa.com)
3. Magisk 16.7 (don't try to use 17.1 or 17.2, your phone will not boot, you can get it from https://github.com/topjohnwu/Magisk/releases

Copy both of these files to external MicroSD and place it in your phone, internal storage won't work because the installer formats /data. If you don't already have TWRP installed, then use Axon 7 EDL tool to install it. Axon7Tool will also work but it needs Zadig drivers rather than the Qualcomm EDL driver. I won't go into more detail, since the steps for using these are elsewhere on the A7 subforum.

Boot into recovery. Format /system, /data, and /cache as ext4. Make sure to format /data, not just wipe, to remove encryption.

Unmount the system and persist partitions from the Mounts menu.

Then go to TWRP's terminal and do the following commands:
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/boot
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/system

These will take some time to finish, so just wait. This zeros out the system and boot partitions. Doing this is necessary because B20 uses dm-verity, you will not be able to boot if the dm-verity check fails. This also ensures that you will be able to install future stock OTAs, as long as you don't modify /system in any way (or mount it as read/write from TWRP).

Select the B20 zip file and wait for it to install. Do not touch anything in the mounts menu, other than ensuring that system and persist boxes are unchecked.

Next, select the TWRP *.img and install it to the recovery partition. Don't forget to do this or you will temporarily be stuck with stock recovery! Last, reboot into recovery from TWRP. If a message comes up about mounting system, select the keep read only box (DONT MESS THIS UP!). Check the mounts menu and ensure that system and persist are still unchecked. Select the Magisk zip file and install it.

Go into TWRP terminal, type:
reboot disemmcwp

This will disable ZTE's system write protection, so that you can still modify /system from TWRP in the future if you wish (but system can still not be mounted as writeable while you are booted into Android, because of the bootstack).

If you did everything as I've posted then you should be running B20 with Magisk. I'm using it right now and the above were my steps.
 

bluenote73

Senior Member
Jan 12, 2009
688
154
63
I was able to install the official B20 zip file on my A2017U, but I already had the latest official TWRP by @jcadduono, so I was able to skip the EDL steps. Yes, it can be installed from TWRP, stock recovery not required.

Steps to success and what you need:
1. TWRP (I would use official version, just download the appropriate *.img file from twrp.me
2. B20 zip (you can download it from the support page on zteusa.com)
3. Magisk 16.7 (don't try to use 17.1 or 17.2, your phone will not boot, you can get it from https://github.com/topjohnwu/Magisk/releases

Copy both of these files to external MicroSD and place it in your phone, internal storage won't work because the installer formats /data. If you don't already have TWRP installed, then use Axon 7 EDL tool to install it. Axon7Tool will also work but it needs Zadig drivers rather than the Qualcomm EDL driver. I won't go into more detail, since the steps for using these are elsewhere on the A7 subforum.

Boot into recovery. Format /system, /data, and /cache as ext4. Make sure to format /data, not just wipe, to remove encryption.

Unmount the system and persist partitions from the Mounts menu.

Then go to TWRP's terminal and do the following commands:
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/boot
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/system

These will take some time to finish, so just wait. This zeros out the system and boot partitions. Doing this is necessary because B20 uses dm-verity, you will not be able to boot if the dm-verity check fails. This also ensures that you will be able to install future stock OTAs, as long as you don't modify /system in any way (or mount it as read/write from TWRP).

Select the B20 zip file and wait for it to install. Do not touch anything in the mounts menu, other than ensuring that system and persist boxes are unchecked.

Next, select the TWRP *.img and install it to the recovery partition. Don't forget to do this or you will temporarily be stuck with stock recovery! Last, reboot into recovery from TWRP. If a message comes up about mounting system, select the keep read only box (DONT MESS THIS UP!). Check the mounts menu and ensure that system and persist are still unchecked. Select the Magisk zip file and install it.

Go into TWRP terminal, type:
reboot disemmcwp

This will disable ZTE's system write protection, so that you can still modify /system from TWRP in the future if you wish (but system can still not be mounted as writeable while you are booted into Android, because of the bootstack).

If you did everything as I've posted then you should be running B20 with Magisk. I'm using it right now and the above were my steps.
Do you pass safetynet this way?

Sent from my ZTE A2017U using Tapatalk
 
  • Like
Reactions: sonophilos

AnonVendetta

Senior Member
Apr 29, 2016
823
301
63
Portland, OR
@bluenote73: No, SafetyNet check fails (according to Magisk Manager). But I also dont care about passing SN, it is so stupid. SN, Android Pay, Pokemon Go, etc, are all stupid. I dont care for Google or their apps, policies, etc. Or Magisk, for that matter. But it is the only way to root B20. Better to be rooted than unrooted. As soon as I get more free time I will be switching to an AOSP-based Oreo ROM. But I just had to try official Oreo first. Battery life is pretty good, and the near-stock look is a huge improvement over MiFavor. But it just doesnt have the level of customization that I'm used to.
 
Last edited:

agnn_a

Member
Jun 29, 2018
18
2
0
I was able to install the official B20 zip file on my A2017U, but I already had the latest official TWRP by @jcadduono, so I was able to skip the EDL steps. Yes, it can be installed from TWRP, stock recovery not required.

Steps to success and what you need:
1. TWRP (I would use official version, just download the appropriate *.img file from twrp.me
2. B20 zip (you can download it from the support page on zteusa.com)
3. Magisk 16.7 (don't try to use 17.1 or 17.2, your phone will not boot, you can get it from https://github.com/topjohnwu/Magisk/releases

Copy both of these files to external MicroSD and place it in your phone, internal storage won't work because the installer formats /data. If you don't already have TWRP installed, then use Axon 7 EDL tool to install it. Axon7Tool will also work but it needs Zadig drivers rather than the Qualcomm EDL driver. I won't go into more detail, since the steps for using these are elsewhere on the A7 subforum.

Boot into recovery. Format /system, /data, and /cache as ext4. Make sure to format /data, not just wipe, to remove encryption.

Unmount the system and persist partitions from the Mounts menu.

Then go to TWRP's terminal and do the following commands:
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/boot
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/system

These will take some time to finish, so just wait. This zeros out the system and boot partitions. Doing this is necessary because B20 uses dm-verity, you will not be able to boot if the dm-verity check fails. This also ensures that you will be able to install future stock OTAs, as long as you don't modify /system in any way (or mount it as read/write from TWRP).

Select the B20 zip file and wait for it to install. Do not touch anything in the mounts menu, other than ensuring that system and persist boxes are unchecked.

Next, select the TWRP *.img and install it to the recovery partition. Don't forget to do this or you will temporarily be stuck with stock recovery! Last, reboot into recovery from TWRP. If a message comes up about mounting system, select the keep read only box (DONT MESS THIS UP!). Check the mounts menu and ensure that system and persist are still unchecked. Select the Magisk zip file and install it.

Go into TWRP terminal, type:
reboot disemmcwp

This will disable ZTE's system write protection, so that you can still modify /system from TWRP in the future if you wish (but system can still not be mounted as writeable while you are booted into Android, because of the bootstack).

If you did everything as I've posted then you should be running B20 with Magisk. I'm using it right now and the above were my steps.
Internal storage 0 MB after flashing rom in twrp, how to fix that??
 

kgptzac

Senior Member
Aug 13, 2010
212
27
0
That's the thing. For me, even after factory reset oreo without root it seems like the official release of oreo does not pass safetynet
Ouch. Is there no way to have magisk and root on the latest stock rom that passes safetynet? I think i'll just have to stay on my beta oreo build forever...
 

EBeatFLA

Senior Member
Aug 2, 2017
623
560
103
North Hollywood, CA
Ouch. Is there no way to have magisk and root on the latest stock rom that passes safetynet? I think i'll just have to stay on my beta oreo build forever...
Is it possible to use the same method we using in the Pie GSI thread?

Install MagiskHide Props Config module and reboot
Install Termux app if you don't have it
Run Termux, in terminal type su
Grant root privileges to Termux
Then type props to run the Props config module
Choose 1 to edit device fingerprint
Choose f to pick certified fingerprint
Choose ZTE, then choose Axon
Then choose Yes you're sure and yes to reboot

Hopefully this solves the safetynet issues for those of you on stock too.
 
Last edited:

raystef66

Recognized Developer / Recognized Contributor
Jul 2, 2013
2,050
4,975
203
Ouch. Is there no way to have magisk and root on the latest stock rom that passes safetynet? I think i'll just have to stay on my beta oreo build forever...
Is it possible to use the same method we using in the Pie GSI thread?

Install MagiskHide Props Config module and reboot
Install Termux app if you don't have it
Run Termux, in terminal type su
Grant root privileges to Termux
Then type props to run the Props config module
Choose 1 to edit device fingerprint
Choose f to pick certified fingerprint
Choose ZTE, then choose Axon
Then choose Yes you're sure and yes to reboot

Hopefully this solves the safetynet issues for those of you on stock too.
This method should work but use the MagiskHidePropsConf v2.4.0 version as it is compatible for magisks lower then 17.1. From v2.4.1 it's compatible with 17.1+.
Use Termux or Terminal Emulator to run the module as mentioned above.
Let us know if you succeeded this way ;)
 
Last edited:
  • Like
Reactions: EBeatFLA

wielluk

Member
Nov 9, 2014
5
1
0
To a T...

I'VE TRIED EVERYTHING, YET THIS IS THE OUTCOME! URGH....!!!
C:\Users\wiels_xpspro\Downloads>axon7tool -w recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Writing recovery ...
F: failed to open recovery.bin
terminate called after throwing an instance of 'std::runtime_error'
what(): error: No error

---------- Post added at 07:22 AM ---------- Previous post was at 07:08 AM ----------

This is just to show the -r recovery worked, but the -w did not...

C:\Users\wiels_xpspro\Downloads>axon7tool -r recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Reading recovery ...
Success!
Reset in 5 seconds ...
Reset in 4 seconds ...
Reset in 3 seconds ...
Reset in 2 seconds ...
Reset in 1 seconds ...

C:\Users\wiels_xpspro\Downloads>axon7tool -w recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Writing recovery ...
F: failed to open recovery.bin
terminate called after throwing an instance of 'std::runtime_error'
what(): error: No error
 

amphi66

Senior Member
Dec 17, 2010
1,022
320
113
PacNW
I'VE TRIED EVERYTHING, YET THIS IS THE OUTCOME! URGH....!!!
C:\Users\wiels_xpspro\Downloads>axon7tool -w recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Writing recovery ...
F: failed to open recovery.bin
terminate called after throwing an instance of 'std::runtime_error'
what(): error: No error

---------- Post added at 07:22 AM ---------- Previous post was at 07:08 AM ----------

This is just to show the -r recovery worked, but the -w did not...

C:\Users\wiels_xpspro\Downloads>axon7tool -r recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Reading recovery ...
Success!
Reset in 5 seconds ...
Reset in 4 seconds ...
Reset in 3 seconds ...
Reset in 2 seconds ...
Reset in 1 seconds ...

C:\Users\wiels_xpspro\Downloads>axon7tool -w recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Writing recovery ...
F: failed to open recovery.bin
terminate called after throwing an instance of 'std::runtime_error'
what(): error: No error
I get the same error looking to root an existing Oreo install (unlocked), but with stock recovery. Stock Recovery backed up OK, but does not accept the TWRP Recovery. The other tool asks for Android 6 or 7 so I have not attempted it. Any other ideas? Thanks
 

AnonVendetta

Senior Member
Apr 29, 2016
823
301
63
Portland, OR
People.....stop bothering with Axon 7 Tool, use Axon 7 EDL Tool instead. TWRP will flash just fine with that. A7 Tool is very finicky, and it replaces the Qualcomm EDL drivers with Zadig drivers, which means you cant also use MiFlash or A7 EDL Tool.