• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[GUIDE][UNOFFICIAL METHOD] Unlock Bootloader Without Asus Unlock App [*ROOT*]

Search This thread

dr.vats

New member
Sep 22, 2017
3
0
Yes you heard it right! It is possible to unlock bootloader of ZenFone 2 Laser without the buggy Asus Unlock App.
This method was developed by @osm0sis with @Titokhan's analysis and my testing. Also thanks to @MiauLightouch for his unofficial method of unlocking ZE500KL and special thanks to @shakalaca since achieving root on locked bootloader was not possible without him.

READ ENTIRE OP BEFORE POSTING COMMENTS

This method was tested on my rooted ZE550KL (MSM8916) and it worked like a charm!
I expect it to work on ZE600KL and ZE550KG and probably on other variants too. Currently, it's a one-way method i.e. you can't relock bootloader but with your help, we may be able to relock bootloader as well.
Update: This doesn't work on ZE500KL and ZE500KG. Use MiauLightouch's guide for unlocking these devices.

You MUST be rooted to use this method. If your phone is not rooted, follow a relevant guide listed in this thread. Or search yourself to find a proper rooting guide. Tip: Use shakalaca's pre-rooted patched system img from here ZE550KL 's system.img works on all Z00L devices and ZE601KL's system.img works on all Z00T devices.

DISCLAIMER
By proceeding to this guide you agree to exempt osm0sis, Titokhan, sziraqui and xda-developers.com from any harm/damage that "may" happen to your device.



INSTRUCTIONS

STEP 1: Create a partition dump
Note: Script updated on 7 July,2016
This will backup your critical partitions. If you skip this step, and messed up your device, don't expect me to help you recover it.
i) From Termux (Download from playstore), type

OR
Using adb (assuming you have enabled USB Debugging and device is connected to computer)

For both cases, wait to see a pop from SuperSU and grant root access. If you don't see SuperSU pop-up even after 15 seconds, go to Auto Start Manager and "Allow" SuperSU and then try again.

ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter


[Link to original thread of above script http://forum.xda-developers.com/showpost.php?p=67147071&postcount=575 ]

old script (just for my reference)
Long script but works on both LP and MM for ZE550KL with a drawback of not dumping out "persistent" partition.


The script will take approx. 6 mins to complete. Be Patient. Do not close the terminal session.
You should see a folder with name "dumps-lockedbl" in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

STEP 2: Unlock your bootloaderWarning: This may void your warranty
(All credits to osm0sis for this)
Now the following magical code will unlock your bootloader! Copy paste it to Termux/adb-shell


To check your bootloader status, Reboot to fastboot mode. Connect it to a computer (computer should have adb and fastboot files, and assus drivers installed)On your computer, hold down shift key and right click on the folder in which you have adb and fastboot files. Select "Open command window here". Type the following command and hit enter-


You will get the following output

"Device unlocked: true" means bootloader is unlocked!
Troubleshoot:Not needed
If your output has "Device unlocked: false" then it means your bootloader is still locked. In that case, type the following code

Yes you need to type it twice. Now check status again

Now the output should be


Now repeat step 2 again. Your bootloader will be unlocked


STEP 3: If you want to help us in relocking bootloader, then do this step
This is similar to step 1 with the difference that we are now dumping out partitions that might have changed after unlocking bootloader to folder name dumps-unlockedbl
i) From Termux terminal emulator app (Download from playstore), type

OR
Using adb (assuming you have enabled USB Debugging and device is connected to computer)


ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter:


old script (just for my reference)
Long script but works on both LP and MM for ZE550KL



Again, the script will take approx. 6 mins to complete. You can close terminal seession once the script completes (i.e. ~6mins)
You should see a folder with name "dumps-unlockedbl" in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

Facing issues or didn't understand something? Here's a video Tutorial
https://www.youtube.com/watch?v=https://youtu.be/eMaIM7JCrgo

HELP US ACHIEVE RELOCKING BOOTLOADER:
We may be able to relock bootloader if you send us your partition backups. So compress together "dumps-lockedbl" and "dumps-unlockedbl" folders. Zip name should be "Partitions_YourXdaUsername". Upload to any reliable cloud storage (preferable your google drive). PM me a link to your file, DO NOT POST A LINK IN COMMENTS SINCE YOUR BACKUP CONTAINS SENSITIVE INFORMATION. Don't worry, we won't misuse it, you can trust me on that :eek:


POST YOUR RESULTS
Post your results in the following format-
1. Device model:
2. Soc/Chipset:
3. SKU:
4. Output of "fastboot oem device-info" or BL Status :
.
.
Video Tutorial is not available :(
 

hiimbored

Senior Member
Aug 25, 2017
53
5
Hi guys i tried that method to unlock bootloader along with other methods i found on the net...
and none works for my Asus ZenFone 2 Z00LD...
and suggestion?
is there another way suitable for my phone...
P.S.
before anybody says it i tested that method 2 times and the results in the end is the same
bootloader still locked
nor i can flash any custom roms coz after verifying the .zip file tell me various number of error from wrong firmware to incompatible update..
please somebody help i'm stuck on android 5.2 lollipop..
TY very much in advance!
any lil help is appreciated....
Just download adb shell and run all the command's give but before doing any thing make sure your device is properly rooted.
If you have any query text me.
 

cyberknight01

New member
Aug 26, 2019
2
0
it isnt working! my device is asus ze550kl lollipop running with raw firmware 1.17

[[/B]
Yes you heard it right! It is possible to unlock bootloader of ZenFone 2 Laser without the buggy Asus Unlock App.
This method was developed by @osm0sis with @Titokhan's analysis and my testing. Also thanks to @MiauLightouch for his unofficial method of unlocking ZE500KL and special thanks to @shakalaca since achieving root on locked bootloader was not possible without him.

READ ENTIRE OP BEFORE POSTING COMMENTS

This method was tested on my rooted ZE550KL (MSM8916) and it worked like a charm!
I expect it to work on ZE600KL and ZE550KG and probably on other variants too. Currently, it's a one-way method i.e. you can't relock bootloader but with your help, we may be able to relock bootloader as well.
Update: This doesn't work on ZE500KL and ZE500KG. Use MiauLightouch's guide for unlocking these devices.

You MUST be rooted to use this method. If your phone is not rooted, follow a relevant guide listed in this thread. Or search yourself to find a proper rooting guide. Tip: Use shakalaca's pre-rooted patched system img from here ZE550KL 's system.img works on all Z00L devices and ZE601KL's system.img works on all Z00T devices.

DISCLAIMER
By proceeding to this guide you agree to exempt osm0sis, Titokhan, sziraqui and xda-developers.com from any harm/damage that "may" happen to your device.
Code:
#include 
/*
 * Your warranty is now void.
 *
 * I am not responsible for bricked devices,
 * thermonuclear war, or you getting fired because the alarm app failed.
 * YOU are choosing to make these modifications, and if
 * you point the finger at me for messing up your device, I will laugh at you.
 *
 */


INSTRUCTIONS

STEP 1: Create a partition dump
Note: Script updated on 7 July,2016
This will backup your critical partitions. If you skip this step, and messed up your device, don't expect me to help you recover it.
i) From Termux (Download from playstore), type
Code:
su
OR
Using adb (assuming you have enabled USB Debugging and device is connected to computer)
Code:
adb shell
su
For both cases, wait to see a pop from SuperSU and grant root access. If you don't see SuperSU pop-up even after 15 seconds, go to Auto Start Manager and "Allow" SuperSU and then try again.

ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter
Code:
state=locked;
outdir=/sdcard/dumps-lockedbl;

if [ -e /dev/block/platform/*/by-name ]; then
  target=/dev/block/platform/*/by-name;
elif [ -e /dev/block/platform/*/*/by-name ]; then
  target=/dev/block/platform/*/*/by-name;
fi;
if [ "$target" ]; then
  target=`echo -n $target`;
  mkdir $outdir;
  echo $target > $outdir/targets.txt;
  bootdev=/dev/block/bootdevice/by-name;
  test -e $bootdev && echo $bootdev >> $outdir/targets.txt;
  for part in $(ls $target); do
    case $part in
      system|APP|cache|CAC|userdata|UDA|boot|LNX|recovery|SOS) ;;
      *) dd if=$target/$part of=$outdir/$part-$state.img;;
    esac;
  done;
fi;

[Link to original thread of above script http://forum.xda-developers.com/showpost.php?p=67147071&postcount=575 ]

old script (just for my reference)
Long script but works on both LP and MM for ZE550KL with a drawback of not dumping out "persistent" partition.
Code:
mkdir /sdcard/dump_locked
dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/dump_locked/aboot_locked.img
dd if=/dev/block/bootdevice/by-name/abootbak of=/sdcard/dump_locked/abootbak_locked.img
dd if=/dev/block/bootdevice/by-name/abootdebug of=/sdcard/dump_locked/abootdebug_locked.img
dd if=/dev/block/bootdevice/by-name/ADF of=/sdcard/dump_locked/ADF_locked.img
dd if=/dev/block/bootdevice/by-name/APD of=/sdcard/dump_locked/APD_locked.img
dd if=/dev/block/bootdevice/by-name/asdf of=/sdcard/dump_locked/asdf_locked.img
dd if=/dev/block/bootdevice/by-name/asusfw of=/sdcard/dump_locked/asusfw_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt of=/sdcard/dump_locked/asusgptt_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt1 of=/sdcard/dump_locked/asusgpt1_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt2 of=/sdcard/dump_locked/asusgpt2_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey of=/sdcard/dump_locked/asuskey_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey2 of=/sdcard/dump_locked/auskey2_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey3 of=/sdcard/dump_locked/asuskey3_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/dump_locked/asuskey4_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey5 of=/sdcard/dump_locked/asuskey5_locked.img
dd if=/dev/block/bootdevice/by-name/config of=/sdcard/dump_locked/config_locked.img
dd if=/dev/block/bootdevice/by-name/DDR of=/sdcard/dump_locked/DDR_locked.img
dd if=/dev/block/bootdevice/by-name/devinfo of=/sdcard/dump_locked/devinfo_locked.img
dd if=/dev/block/bootdevice/by-name/factory of=sdcard/dump_locked/factory_locked.img
dd if=/dev/block/bootdevice/by-name/factorybak of=sdcard/dump_locked/factorybak_locked.img
dd if=/dev/block/bootdevice/by-name/fsc of=/sdcard/dump_locked/fsc_locked.img
dd if=/dev/block/bootdevice/by-name/fsg of=/sdcard/dump_locked/fsg_locked.img
dd if=/dev/block/bootdevice/by-name/hyp of=/sdcard/dump_locked/hyp_locked.img
dd if=/dev/block/bootdevice/by-name/hypbak of=/sdcard/dump_locked/hypbak_locked.img
dd if=/dev/block/bootdevice/by-name/keystore of=/sdcard/dump_locked/keystore_locked.img
dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/dump_locked/misc_locked.img
dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/dump_locked/modem_locked.img
dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/dump_locked/modemst1_locked.img
dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/dump_locked/modemst2_locked.img
dd if=/dev/block/bootdevice/by-name/oem of=/sdcard/dump_locked/oem_locked.img
dd if=/dev/block/bootdevice/by-name/persistent of=/dump_locked/sdcard/persistent_locked.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/dump_locked/persist_locked.img
dd if=/dev/block/bootdevice/by-name/rpm of=/sdcard/dump_locked/rpm_locked.img
dd if=/dev/block/bootdevice/by-name/rpmbak of=/sdcard/dump_locked/rpmbak_locked.img
dd if=/dev/block/bootdevice/by-name/sbl1 of=/sdcard/dump_locked/sbl1_locked.img
dd if=/dev/block/bootdevice/by-name/sec of=/sdcard/dump_locked/sec_locked.img
dd if=/dev/block/bootdevice/by-name/splash of=/sdcard/dump_locked/splash_locked.img
dd if=/dev/block/bootdevice/by-name/ssd of=/sdcard/dump_locked/ssd_locked.img
dd if=/dev/block/bootdevice/by-name/tz of=/sdcard/dump_locked/tz_locked.img
dd if=/dev/block/bootdevice/by-name/tzbak of=/sdcard/dump_locked/tzbak_locked.img
echo "Finished Partition Backup!"

The script will take approx. 6 mins to complete. Be Patient. Do not close the terminal session.
You should see a folder with name "dumps-lockedbl" in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

STEP 2: Unlock your bootloader Warning: This may void your warranty
(All credits to osm0sis for this)
Now the following magical code will unlock your bootloader! Copy paste it to Termux/adb-shell
Code:
echo -ne "\x01" | dd obs=1 count=1 seek=16 of=/dev/block/bootdevice/by-name/devinfo

To check your bootloader status, Reboot to fastboot mode. Connect it to a computer (computer should have adb and fastboot files, and assus drivers installed)On your computer, hold down shift key and right click on the folder in which you have adb and fastboot files. Select "Open command window here". Type the following command and hit enter-
Code:
fastboot oem device-info

You will get the following output
Code:
...
(bootloader) 	Device unlocked: true
(bootloader) 	Charger screen enabled: false
(bootloader) 	Display panel: 
(bootloader) 	Adb Enable: 0
OKAY [  0.004s]
"Device unlocked: true" means bootloader is unlocked!
Troubleshoot:Not needed
If your output has "Device unlocked: false" then it means your bootloader is still locked. In that case, type the following code
Code:
fastboot oem adb_enable
fastboot oem adb_enable
Yes you need to type it twice. Now check status again
Code:
fastboot oem device-info
Now the output should be
Code:
...
(bootloader) 	Device unlocked: false
(bootloader) 	Charger screen enabled: false
(bootloader) 	Display panel: 
(bootloader) 	Adb Enable: 1
OKAY [  0.004s]

Now repeat step 2 again. Your bootloader will be unlocked


STEP 3: If you want to help us in relocking bootloader, then do this step
This is similar to step 1 with the difference that we are now dumping out partitions that might have changed after unlocking bootloader to folder name dumps-unlockedbl
i) From Termux terminal emulator app (Download from playstore), type
Code:
su
OR
Using adb (assuming you have enabled USB Debugging and device is connected to computer)
Code:
adb shell
su

ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter:
Code:
state=unlocked;
outdir=/sdcard/dumps-unlockedbl;

if [ -e /dev/block/platform/*/by-name ]; then
  target=/dev/block/platform/*/by-name;
elif [ -e /dev/block/platform/*/*/by-name ]; then
  target=/dev/block/platform/*/*/by-name;
fi;
if [ "$target" ]; then
  target=`echo -n $target`;
  mkdir $outdir;
  echo $target > $outdir/targets.txt;
  bootdev=/dev/block/bootdevice/by-name;
  test -e $bootdev && echo $bootdev >> $outdir/targets.txt;
  for part in $(ls $target); do
    case $part in
      system|APP|cache|CAC|userdata|UDA|boot|LNX|recovery|SOS) ;;
      *) dd if=$target/$part of=$outdir/$part-$state.img;;
    esac;
  done;
fi;

old script (just for my reference)
Long script but works on both LP and MM for ZE550KL
Code:
mkdir /sdcard/dump_unlocked
dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/dump_locked/aboot_unlocked.img
dd if=/dev/block/bootdevice/by-name/abootbak of=/sdcard/dump_unlocked/abootbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/abootdebug of=/sdcard/dump_unlocked/abootdebug_unlocked.img
dd if=/dev/block/bootdevice/by-name/ADF of=/sdcard/dump_unlocked/ADF_unlocked.img
dd if=/dev/block/bootdevice/by-name/APD of=/sdcard/dump_unlocked/APD_unlocked.img
dd if=/dev/block/bootdevice/by-name/asdf of=/sdcard/dump_unlocked/asdf_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusfw of=/sdcard/dump_unlocked/asusfw_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt of=/sdcard/dump_unlocked/asusgptt_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt1 of=/sdcard/dump_unlocked/asusgpt1_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt2 of=/sdcard/dump_unlocked/asusgpt2_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey of=/sdcard/dump_unlocked/asuskey_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey2 of=/sdcard/dump_unlocked/auskey2_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey3 of=/sdcard/dump_unlocked/asuskey3_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/dump_unlocked/asuskey4_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey5 of=/sdcard/dump_unlocked/asuskey5_unlocked.img
dd if=/dev/block/bootdevice/by-name/config of=/sdcard/dump_unlocked/config_unlocked.img
dd if=/dev/block/bootdevice/by-name/DDR of=/sdcard/dump_unlocked/DDR_unlocked.img
dd if=/dev/block/bootdevice/by-name/devinfo of=/sdcard/dump_unlocked/devinfo_unlocked.img
dd if=/dev/block/bootdevice/by-name/factory of=sdcard/dump_unlocked/factory_unlocked.img
dd if=/dev/block/bootdevice/by-name/factorybak of=sdcard/dump_unlocked/factorybak_unlocked.img
dd if=/dev/block/bootdevice/by-name/fsc of=/sdcard/dump_unlocked/fsc_unlocked.img
dd if=/dev/block/bootdevice/by-name/fsg of=/sdcard/dump_unlocked/fsg_unlocked.img
dd if=/dev/block/bootdevice/by-name/hyp of=/sdcard/dump_unlocked/hyp_unlocked.img
dd if=/dev/block/bootdevice/by-name/hypbak of=/sdcard/dump_unlocked/hypbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/keystore of=/sdcard/dump_unlocked/keystore_unlocked.img
dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/dump_unlocked/misc_unlocked.img
dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/dump_unlocked/modem_unlocked.img
dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/dump_unlocked/modemst1_unlocked.img
dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/dump_unlocked/modemst2_unlocked.img
dd if=/dev/block/bootdevice/by-name/oem of=/sdcard/dump_unlocked/oem_unlocked.img
dd if=/dev/block/bootdevice/by-name/persistent of=/dump_unlocked/sdcard/persistent_unlocked.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/dump_unlocked/persist_unlocked.img
dd if=/dev/block/bootdevice/by-name/rpm of=/sdcard/dump_unlocked/rpm_unlocked.img
dd if=/dev/block/bootdevice/by-name/rpmbak of=/sdcard/dump_unlocked/rpmbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/sbl1 of=/sdcard/dump_unlocked/sbl1_unlocked.img
dd if=/dev/block/bootdevice/by-name/sec of=/sdcard/dump_unlocked/sec_unlocked.img
dd if=/dev/block/bootdevice/by-name/splash of=/sdcard/dump_unlocked/splash_unlocked.img
dd if=/dev/block/bootdevice/by-name/ssd of=/sdcard/dump_unlocked/ssd_unlocked.img
dd if=/dev/block/bootdevice/by-name/tz of=/sdcard/dump_unlocked/tz_unlocked.img
dd if=/dev/block/bootdevice/by-name/tzbak of=/sdcard/dump_unlocked/tzbak_unlocked.img
echo "Finished Partition Backup!"


Again, the script will take approx. 6 mins to complete. You can close terminal seession once the script completes (i.e. ~6mins)
You should see a folder with name "dumps-unlockedbl" in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

Facing issues or didn't understand something? Here's a video Tutorial

HELP US ACHIEVE RELOCKING BOOTLOADER:
We may be able to relock bootloader if you send us your partition backups. So compress together "dumps-lockedbl" and "dumps-unlockedbl" folders. Zip name should be "Partitions_YourXdaUsername". Upload to any reliable cloud storage (preferable your google drive). PM me a link to your file, DO NOT POST A LINK IN COMMENTS SINCE YOUR BACKUP CONTAINS SENSITIVE INFORMATION. Don't worry, we won't misuse it, you can trust me on that :eek:


POST YOUR RESULTS
Post your results in the following format-
1. Device model:
2. Soc/Chipset:
3. SKU:
4. Output of "fastboot oem device-info" or BL Status :
.
.
i cant unlock the bootloader
the device model is ze550kl lollipop in raw firmware and i just wanted to unlock the bootloader and the unlock app just reboot and doesnt even do a thing therfore i just tried this root method!i rooted my device via pc and tried this via both adb and termux but nothung is working!i need your help as soon as possible
:crying:
 

cyberknight01

New member
Aug 26, 2019
2
0
it isnt working! i need help!

[[/B]
Yes you heard it right! It is possible to unlock bootloader of ZenFone 2 Laser without the buggy Asus Unlock App.
This method was developed by @osm0sis with @Titokhan's analysis and my testing. Also thanks to @MiauLightouch for his unofficial method of unlocking ZE500KL and special thanks to @shakalaca since achieving root on locked bootloader was not possible without him.

READ ENTIRE OP BEFORE POSTING COMMENTS

This method was tested on my rooted ZE550KL (MSM8916) and it worked like a charm!
I expect it to work on ZE600KL and ZE550KG and probably on other variants too. Currently, it's a one-way method i.e. you can't relock bootloader but with your help, we may be able to relock bootloader as well.
Update: This doesn't work on ZE500KL and ZE500KG. Use MiauLightouch's guide for unlocking these devices.

You MUST be rooted to use this method. If your phone is not rooted, follow a relevant guide listed in this thread. Or search yourself to find a proper rooting guide. Tip: Use shakalaca's pre-rooted patched system img from here ZE550KL 's system.img works on all Z00L devices and ZE601KL's system.img works on all Z00T devices.

DISCLAIMER
By proceeding to this guide you agree to exempt osm0sis, Titokhan, sziraqui and xda-developers.com from any harm/damage that "may" happen to your device.
Code:
#include 
/*
 * Your warranty is now void.
 *
 * I am not responsible for bricked devices,
 * thermonuclear war, or you getting fired because the alarm app failed.
 * YOU are choosing to make these modifications, and if
 * you point the finger at me for messing up your device, I will laugh at you.
 *
 */


INSTRUCTIONS

STEP 1: Create a partition dump
Note: Script updated on 7 July,2016
This will backup your critical partitions. If you skip this step, and messed up your device, don't expect me to help you recover it.
i) From Termux (Download from playstore), type
Code:
su
OR
Using adb (assuming you have enabled USB Debugging and device is connected to computer)
Code:
adb shell
su
For both cases, wait to see a pop from SuperSU and grant root access. If you don't see SuperSU pop-up even after 15 seconds, go to Auto Start Manager and "Allow" SuperSU and then try again.

ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter
Code:
state=locked;
outdir=/sdcard/dumps-lockedbl;

if [ -e /dev/block/platform/*/by-name ]; then
  target=/dev/block/platform/*/by-name;
elif [ -e /dev/block/platform/*/*/by-name ]; then
  target=/dev/block/platform/*/*/by-name;
fi;
if [ "$target" ]; then
  target=`echo -n $target`;
  mkdir $outdir;
  echo $target > $outdir/targets.txt;
  bootdev=/dev/block/bootdevice/by-name;
  test -e $bootdev && echo $bootdev >> $outdir/targets.txt;
  for part in $(ls $target); do
    case $part in
      system|APP|cache|CAC|userdata|UDA|boot|LNX|recovery|SOS) ;;
      *) dd if=$target/$part of=$outdir/$part-$state.img;;
    esac;
  done;
fi;

[Link to original thread of above script http://forum.xda-developers.com/showpost.php?p=67147071&postcount=575 ]

old script (just for my reference)
Long script but works on both LP and MM for ZE550KL with a drawback of not dumping out "persistent" partition.
Code:
mkdir /sdcard/dump_locked
dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/dump_locked/aboot_locked.img
dd if=/dev/block/bootdevice/by-name/abootbak of=/sdcard/dump_locked/abootbak_locked.img
dd if=/dev/block/bootdevice/by-name/abootdebug of=/sdcard/dump_locked/abootdebug_locked.img
dd if=/dev/block/bootdevice/by-name/ADF of=/sdcard/dump_locked/ADF_locked.img
dd if=/dev/block/bootdevice/by-name/APD of=/sdcard/dump_locked/APD_locked.img
dd if=/dev/block/bootdevice/by-name/asdf of=/sdcard/dump_locked/asdf_locked.img
dd if=/dev/block/bootdevice/by-name/asusfw of=/sdcard/dump_locked/asusfw_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt of=/sdcard/dump_locked/asusgptt_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt1 of=/sdcard/dump_locked/asusgpt1_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt2 of=/sdcard/dump_locked/asusgpt2_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey of=/sdcard/dump_locked/asuskey_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey2 of=/sdcard/dump_locked/auskey2_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey3 of=/sdcard/dump_locked/asuskey3_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/dump_locked/asuskey4_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey5 of=/sdcard/dump_locked/asuskey5_locked.img
dd if=/dev/block/bootdevice/by-name/config of=/sdcard/dump_locked/config_locked.img
dd if=/dev/block/bootdevice/by-name/DDR of=/sdcard/dump_locked/DDR_locked.img
dd if=/dev/block/bootdevice/by-name/devinfo of=/sdcard/dump_locked/devinfo_locked.img
dd if=/dev/block/bootdevice/by-name/factory of=sdcard/dump_locked/factory_locked.img
dd if=/dev/block/bootdevice/by-name/factorybak of=sdcard/dump_locked/factorybak_locked.img
dd if=/dev/block/bootdevice/by-name/fsc of=/sdcard/dump_locked/fsc_locked.img
dd if=/dev/block/bootdevice/by-name/fsg of=/sdcard/dump_locked/fsg_locked.img
dd if=/dev/block/bootdevice/by-name/hyp of=/sdcard/dump_locked/hyp_locked.img
dd if=/dev/block/bootdevice/by-name/hypbak of=/sdcard/dump_locked/hypbak_locked.img
dd if=/dev/block/bootdevice/by-name/keystore of=/sdcard/dump_locked/keystore_locked.img
dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/dump_locked/misc_locked.img
dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/dump_locked/modem_locked.img
dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/dump_locked/modemst1_locked.img
dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/dump_locked/modemst2_locked.img
dd if=/dev/block/bootdevice/by-name/oem of=/sdcard/dump_locked/oem_locked.img
dd if=/dev/block/bootdevice/by-name/persistent of=/dump_locked/sdcard/persistent_locked.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/dump_locked/persist_locked.img
dd if=/dev/block/bootdevice/by-name/rpm of=/sdcard/dump_locked/rpm_locked.img
dd if=/dev/block/bootdevice/by-name/rpmbak of=/sdcard/dump_locked/rpmbak_locked.img
dd if=/dev/block/bootdevice/by-name/sbl1 of=/sdcard/dump_locked/sbl1_locked.img
dd if=/dev/block/bootdevice/by-name/sec of=/sdcard/dump_locked/sec_locked.img
dd if=/dev/block/bootdevice/by-name/splash of=/sdcard/dump_locked/splash_locked.img
dd if=/dev/block/bootdevice/by-name/ssd of=/sdcard/dump_locked/ssd_locked.img
dd if=/dev/block/bootdevice/by-name/tz of=/sdcard/dump_locked/tz_locked.img
dd if=/dev/block/bootdevice/by-name/tzbak of=/sdcard/dump_locked/tzbak_locked.img
echo "Finished Partition Backup!"

The script will take approx. 6 mins to complete. Be Patient. Do not close the terminal session.
You should see a folder with name "dumps-lockedbl" in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

STEP 2: Unlock your bootloader Warning: This may void your warranty
(All credits to osm0sis for this)
Now the following magical code will unlock your bootloader! Copy paste it to Termux/adb-shell
Code:
echo -ne "\x01" | dd obs=1 count=1 seek=16 of=/dev/block/bootdevice/by-name/devinfo

To check your bootloader status, Reboot to fastboot mode. Connect it to a computer (computer should have adb and fastboot files, and assus drivers installed)On your computer, hold down shift key and right click on the folder in which you have adb and fastboot files. Select "Open command window here". Type the following command and hit enter-
Code:
fastboot oem device-info

You will get the following output
Code:
...
(bootloader) 	Device unlocked: true
(bootloader) 	Charger screen enabled: false
(bootloader) 	Display panel: 
(bootloader) 	Adb Enable: 0
OKAY [  0.004s]
"Device unlocked: true" means bootloader is unlocked!
Troubleshoot:Not needed
If your output has "Device unlocked: false" then it means your bootloader is still locked. In that case, type the following code
Code:
fastboot oem adb_enable
fastboot oem adb_enable
Yes you need to type it twice. Now check status again
Code:
fastboot oem device-info
Now the output should be
Code:
...
(bootloader) 	Device unlocked: false
(bootloader) 	Charger screen enabled: false
(bootloader) 	Display panel: 
(bootloader) 	Adb Enable: 1
OKAY [  0.004s]

Now repeat step 2 again. Your bootloader will be unlocked


STEP 3: If you want to help us in relocking bootloader, then do this step
This is similar to step 1 with the difference that we are now dumping out partitions that might have changed after unlocking bootloader to folder name dumps-unlockedbl
i) From Termux terminal emulator app (Download from playstore), type
Code:
su
OR
Using adb (assuming you have enabled USB Debugging and device is connected to computer)
Code:
adb shell
su

ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter:
Code:
state=unlocked;
outdir=/sdcard/dumps-unlockedbl;

if [ -e /dev/block/platform/*/by-name ]; then
  target=/dev/block/platform/*/by-name;
elif [ -e /dev/block/platform/*/*/by-name ]; then
  target=/dev/block/platform/*/*/by-name;
fi;
if [ "$target" ]; then
  target=`echo -n $target`;
  mkdir $outdir;
  echo $target > $outdir/targets.txt;
  bootdev=/dev/block/bootdevice/by-name;
  test -e $bootdev && echo $bootdev >> $outdir/targets.txt;
  for part in $(ls $target); do
    case $part in
      system|APP|cache|CAC|userdata|UDA|boot|LNX|recovery|SOS) ;;
      *) dd if=$target/$part of=$outdir/$part-$state.img;;
    esac;
  done;
fi;

old script (just for my reference)
Long script but works on both LP and MM for ZE550KL
Code:
mkdir /sdcard/dump_unlocked
dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/dump_locked/aboot_unlocked.img
dd if=/dev/block/bootdevice/by-name/abootbak of=/sdcard/dump_unlocked/abootbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/abootdebug of=/sdcard/dump_unlocked/abootdebug_unlocked.img
dd if=/dev/block/bootdevice/by-name/ADF of=/sdcard/dump_unlocked/ADF_unlocked.img
dd if=/dev/block/bootdevice/by-name/APD of=/sdcard/dump_unlocked/APD_unlocked.img
dd if=/dev/block/bootdevice/by-name/asdf of=/sdcard/dump_unlocked/asdf_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusfw of=/sdcard/dump_unlocked/asusfw_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt of=/sdcard/dump_unlocked/asusgptt_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt1 of=/sdcard/dump_unlocked/asusgpt1_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt2 of=/sdcard/dump_unlocked/asusgpt2_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey of=/sdcard/dump_unlocked/asuskey_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey2 of=/sdcard/dump_unlocked/auskey2_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey3 of=/sdcard/dump_unlocked/asuskey3_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/dump_unlocked/asuskey4_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey5 of=/sdcard/dump_unlocked/asuskey5_unlocked.img
dd if=/dev/block/bootdevice/by-name/config of=/sdcard/dump_unlocked/config_unlocked.img
dd if=/dev/block/bootdevice/by-name/DDR of=/sdcard/dump_unlocked/DDR_unlocked.img
dd if=/dev/block/bootdevice/by-name/devinfo of=/sdcard/dump_unlocked/devinfo_unlocked.img
dd if=/dev/block/bootdevice/by-name/factory of=sdcard/dump_unlocked/factory_unlocked.img
dd if=/dev/block/bootdevice/by-name/factorybak of=sdcard/dump_unlocked/factorybak_unlocked.img
dd if=/dev/block/bootdevice/by-name/fsc of=/sdcard/dump_unlocked/fsc_unlocked.img
dd if=/dev/block/bootdevice/by-name/fsg of=/sdcard/dump_unlocked/fsg_unlocked.img
dd if=/dev/block/bootdevice/by-name/hyp of=/sdcard/dump_unlocked/hyp_unlocked.img
dd if=/dev/block/bootdevice/by-name/hypbak of=/sdcard/dump_unlocked/hypbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/keystore of=/sdcard/dump_unlocked/keystore_unlocked.img
dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/dump_unlocked/misc_unlocked.img
dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/dump_unlocked/modem_unlocked.img
dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/dump_unlocked/modemst1_unlocked.img
dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/dump_unlocked/modemst2_unlocked.img
dd if=/dev/block/bootdevice/by-name/oem of=/sdcard/dump_unlocked/oem_unlocked.img
dd if=/dev/block/bootdevice/by-name/persistent of=/dump_unlocked/sdcard/persistent_unlocked.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/dump_unlocked/persist_unlocked.img
dd if=/dev/block/bootdevice/by-name/rpm of=/sdcard/dump_unlocked/rpm_unlocked.img
dd if=/dev/block/bootdevice/by-name/rpmbak of=/sdcard/dump_unlocked/rpmbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/sbl1 of=/sdcard/dump_unlocked/sbl1_unlocked.img
dd if=/dev/block/bootdevice/by-name/sec of=/sdcard/dump_unlocked/sec_unlocked.img
dd if=/dev/block/bootdevice/by-name/splash of=/sdcard/dump_unlocked/splash_unlocked.img
dd if=/dev/block/bootdevice/by-name/ssd of=/sdcard/dump_unlocked/ssd_unlocked.img
dd if=/dev/block/bootdevice/by-name/tz of=/sdcard/dump_unlocked/tz_unlocked.img
dd if=/dev/block/bootdevice/by-name/tzbak of=/sdcard/dump_unlocked/tzbak_unlocked.img
echo "Finished Partition Backup!"


Again, the script will take approx. 6 mins to complete. You can close terminal seession once the script completes (i.e. ~6mins)
You should see a folder with name "dumps-unlockedbl" in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

Facing issues or didn't understand something? Here's a video Tutorial

HELP US ACHIEVE RELOCKING BOOTLOADER:
We may be able to relock bootloader if you send us your partition backups. So compress together "dumps-lockedbl" and "dumps-unlockedbl" folders. Zip name should be "Partitions_YourXdaUsername". Upload to any reliable cloud storage (preferable your google drive). PM me a link to your file, DO NOT POST A LINK IN COMMENTS SINCE YOUR BACKUP CONTAINS SENSITIVE INFORMATION. Don't worry, we won't misuse it, you can trust me on that :eek:


POST YOUR RESULTS
Post your results in the following format-
1. Device model:
2. Soc/Chipset:
3. SKU:
4. Output of "fastboot oem device-info" or BL Status :
.
.
i cant unlock the bootloader
the device model is ze550kl lollipop in raw firmware and i just wanted to unlock the bootloader and the unlock app just reboot and doesnt even do a thing therfore i just tried this root method!i rooted my device via pc and tried this via both adb and termux but nothung is working!i need your help as soon as possible
:crying:
 

safiulla

Member
Mar 30, 2016
27
1
I have asus zenfone 2 laser ze550kl locked bootloader. is that still we need to unlock bootloader to flash files like custom roms...becasue my phone is rebooting not able to use and i have installed twrp using fastboot without unlocking and rooting.....pleas reply me....now i my phone is in latest firmware from asus site..
 

Hitman'

New member
Sep 6, 2020
1
0
:: Simplest n 101% working Root fr Z00L ZE550kl ::

U need NOT flash rooted ROM. Again Many such links r already expired as provided by @shakalaca
Instead Downgrade to Lollipop
Thn Simply Root using Kingroot
Dtz it.. ? Can Run the Magic Code to redeem ur Bootloader.. Followed by Flashing Latest Twrp... Done
Ure Worth it ?
 
Help me, i'm using zb551kl snap400. Step 1 and "echo -ne "\x01" | dd obs=1 count=1 seek=16 of=/dev/block/bootdevice/by-name/devinfo" work but the bootloader still locked. I tried fastboot oem adb_enable but it freeze and do nothing so i cant next step.
 

dav0dav0

Member
May 7, 2018
37
1
Is there an equivalent method for Android 7? I'm running a Zenfone 3 Ultra and it won't let me su (the command literally isn't in the ROM) and all the methods suggested here fail due to lack of permissions.

Ideas???
 

Tataty

New member
Dec 26, 2018
3
2
WOW! GREAT thanks to @sziraqui @osm0sis and all who posted in this aging thread!

I have 3 old ZC520TL from family which I wanted for development/testing.
MANY posts here say how unhelpful/unwilling ASS-US is and NO unlocked bootlaoder = no testing of ROM.
LAST I found this thread and YES this worked PERFECTLY with some small changes.

1) there is a post how to gain ROOT using init.d AND magisk which eventually worked for me. Getting su in ADB shell is a requirement for THIS neat trick figured by you guys..

2) The ZC520TL (X008D) does NOT have the path to ..../driveinfo .... However, I found "by-name" and the target is "proinfo" for this device (A wild leap of faith, since there is nothing to lose if the phone can no be unlocked - might as well brick it! LOL - Well, I do have a 1/2 dozen factory ROMs I can flash with SPFT...)

Code:
echo -ne "\x01" | dd obs=1 count=1 seek=16 of=/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/proinfo

@osm0sis: If it is still of interest, I will be happy to re-lock using your suggestions (noob at work!). For this first attempt I skipped the entire backup (since my structure is different and I wanted to see if/how it will work). However, this phone is currently flashing stock ROM (I had the wrong SKU on there...) and I presume I have to do everything again from scratch... Then I will likely flash Lineage and/or RR to see if it will flash ... IF not - I have two more of the same model to prepare before and after snapshots... :cool:

@dav0dav0: in answer to your question THIS was done with STOCK 7.0 from Ass-us... = YES can likely be done with yours. NOTE: there is a separate thread on how to gain root with a LOCKED bootloader using init.d and Magisk app... (THAT will allow you to connect adb shell and then request "su" THEN you are ready to look for this thread.)
 
Last edited:

dav0dav0

Member
May 7, 2018
37
1
WOW! GREAT thanks to @sziraqui @osm0sis and all who posted in this aging thread!

I have 3 old ZC520TL from family which I wanted for development/testing.
MANY posts here say how unhelpful/unwilling ASS-US is and NO unlocked bootlaoder = no testing of ROM.
LAST I found this thread and YES this worked PERFECTLY with some small changes.

1) there is a post how to gain ROOT using init.d AND magisk which eventually worked for me. Getting su in ADB shell is a requirement for THIS neat trick figured by you guys..

2) The ZC520TL (X008D) does NOT have the path to ..../driveinfo .... However, I found "by-name" and the target is "proinfo" for this device (A wild leap of faith, since there is nothing to lose if the phone can no be unlocked - might as well brick it! LOL - Well, I do have a 1/2 dozen factory ROMs I can flash with SPFT...)

Code:
echo -ne "\x01" | dd obs=1 count=1 seek=16 of=/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/proinfo

@osm0sis: If it is still of interest, I will be happy to re-lock using your suggestions (noob at work!). For this first attempt I skipped the entire backup (since my structure is different and I wanted to see if/how it will work). However, this phone is currently flashing stock ROM (I had the wrong SKU on there...) and I presume I have to do everything again from scratch... Then I will likely flash Lineage and/or RR to see if it will flash ... IF not - I have two more of the same model to prepare before and after snapshots... :cool:

@dav0dav0: in answer to your question THIS was done with STOCK 7.0 from Ass-us... = YES can likely be done with yours. NOTE: there is a separate thread on how to gain root with a LOCKED bootloader using init.d and Magisk app... (THAT will allow you to connect adb shell and then request "su" THEN you are ready to look for this thread.)
Tataty--thanks for posting!
I'm a little confused...in my situation, I have no access to SU. are you saying that your dd trick will work without SU (I'm thinking no)??? Can you point me to that thread about init.d and Magisk--you make it sound like that gets you to SU...
 

Tataty

New member
Dec 26, 2018
3
2
Tataty--thanks for posting!
I'm a little confused...in my situation, I have no access to SU. are you saying that your dd trick will work without SU (I'm thinking no)??? Can you point me to that thread about init.d and Magisk--you make it sound like that gets you to SU...
@dav0dav0 Sorry if I was confusing you - my post was saying that this thread (unlocking bootloader) ONLY works WITH su...AND,

YES - there is a great thread on gaining Temporary ROOT access by @diplomatic which you will have to follow first.
EDIT: the above link is for gaining root WHILE in ADB shell. @diplomatic ALSO has a post on getting Magisk to work with init.d (which I used first AND successfully!) here getting Magisk with init.d - My BAD for making reference to wrong content... (simple noob at work!)

IF successful, you will THEN connect to ADB SHELL and type su ...
Which will prompt Magisk (on the phone) to pop up a "grant" window... ONCE you do "grant" the shell on the ADB will have root access and you can look for the file to patch as per this thread.

HINT: I used # find /dev -name "by-name" and dsicovered that on my device there is NO 'devinfo'. HOWEVER, I found proinfo (presumably "Product info) and patched THAT one instead... SUCCESS

Hope it works for you!

oops - and surely it is not "my" dd trick ... credit to @osm0sis and the other great people here who figured that one out... AND all those who posted questions and answers with detail on finding the right target!

PS: After unlocking sucessfuly I flashed another SKU of the stock ROM from Ass-us (the version I had on there failed to detect NVRAM/IMEI) and ALL went back to locked - normal WARRANTY flag untouched! Which I fully expected. = You can repeat the process. NOW repeating the process and saving a patched version to flash in future and with custom recovery/ROM
 
Last edited:
  • Like
Reactions: oslo83

dav0dav0

Member
May 7, 2018
37
1
@dav0dav0 Sorry if I was confusing you - my post was saying that this thread (unlocking bootloader) ONLY works WITH su...AND,

YES - there is a great thread on gaining Temporary ROOT access by @diplomatic which you will have to follow first.
EDIT: the above link is for gaining root WHILE in ADB shell. @diplomatic ALSO has a post on getting Magisk to work with init.d (which I used first AND successfully!) here getting Magisk with init.d - My BAD for making reference to wrong content... (simple noob at work!)

IF successful, you will THEN connect to ADB SHELL and type su ...
Which will prompt Magisk (on the phone) to pop up a "grant" window... ONCE you do "grant" the shell on the ADB will have root access and you can look for the file to patch as per this thread.

HINT: I used # find /dev -name "by-name" and dsicovered that on my device there is NO 'devinfo'. HOWEVER, I found proinfo (presumably "Product info) and patched THAT one instead... SUCCESS

Hope it works for you!

oops - and surely it is not "my" dd trick ... credit to @osm0sis and the other great people here who figured that one out... AND all those who posted questions and answers with detail on finding the right target!

PS: After unlocking sucessfuly I flashed another SKU of the stock ROM from Ass-us (the version I had on there failed to detect NVRAM/IMEI) and ALL went back to locked - normal WARRANTY flag untouched! Which I fully expected. = You can repeat the process. NOW repeating the process and saving a patched version to flash in future and with custom recovery/ROM
Thanks for the extra info!
Unfortunately, the Zenfone 3 Ultra is based on Sanpdragon, not MediaTek...so the magic from @diplomatic won't work. I'll read the thread (it's loooong) to see if there's a Snapdragon equivalent.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 25
    Yes you heard it right! It is possible to unlock bootloader of ZenFone 2 Laser without the buggy Asus Unlock App.
    This method was developed by @osm0sis with @Titokhan's analysis and my testing. Also thanks to @MiauLightouch for his unofficial method of unlocking ZE500KL and special thanks to @shakalaca since achieving root on locked bootloader was not possible without him.

    READ ENTIRE OP BEFORE POSTING COMMENTS

    This method was tested on my rooted ZE550KL (MSM8916) and it worked like a charm!
    I expect it to work on ZE600KL and ZE550KG and probably on other variants too. Currently, it's a one-way method i.e. you can't relock bootloader but with your help, we may be able to relock bootloader as well.
    Update: This doesn't work on ZE500KL and ZE500KG. Use MiauLightouch's guide for unlocking these devices.

    You MUST be rooted to use this method. If your phone is not rooted, follow a relevant guide listed in this thread. Or search yourself to find a proper rooting guide. Tip: Use shakalaca's pre-rooted patched system img from here ZE550KL 's system.img works on all Z00L devices and ZE601KL's system.img works on all Z00T devices.

    DISCLAIMER
    By proceeding to this guide you agree to exempt osm0sis, Titokhan, sziraqui and xda-developers.com from any harm/damage that "may" happen to your device.
    Code:
    #include 
    /*
     * Your warranty is now void.
     *
     * I am not responsible for bricked devices,
     * thermonuclear war, or you getting fired because the alarm app failed.
     * YOU are choosing to make these modifications, and if
     * you point the finger at me for messing up your device, I will laugh at you.
     *
     */


    INSTRUCTIONS

    STEP 1: Create a partition dump
    Note: Script updated on 7 July,2016
    This will backup your critical partitions. If you skip this step, and messed up your device, don't expect me to help you recover it.
    i) From Termux (Download from playstore), type
    Code:
    su
    OR
    Using adb (assuming you have enabled USB Debugging and device is connected to computer)
    Code:
    adb shell
    su
    For both cases, wait to see a pop from SuperSU and grant root access. If you don't see SuperSU pop-up even after 15 seconds, go to Auto Start Manager and "Allow" SuperSU and then try again.

    ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter
    Code:
    state=locked;
    outdir=/sdcard/dumps-lockedbl;
    
    if [ -e /dev/block/platform/*/by-name ]; then
      target=/dev/block/platform/*/by-name;
    elif [ -e /dev/block/platform/*/*/by-name ]; then
      target=/dev/block/platform/*/*/by-name;
    fi;
    if [ "$target" ]; then
      target=`echo -n $target`;
      mkdir $outdir;
      echo $target > $outdir/targets.txt;
      bootdev=/dev/block/bootdevice/by-name;
      test -e $bootdev && echo $bootdev >> $outdir/targets.txt;
      for part in $(ls $target); do
        case $part in
          system|APP|cache|CAC|userdata|UDA|boot|LNX|recovery|SOS) ;;
          *) dd if=$target/$part of=$outdir/$part-$state.img;;
        esac;
      done;
    fi;

    [Link to original thread of above script http://forum.xda-developers.com/showpost.php?p=67147071&postcount=575 ]

    old script (just for my reference)
    Long script but works on both LP and MM for ZE550KL with a drawback of not dumping out "persistent" partition.
    Code:
    mkdir /sdcard/dump_locked
    dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/dump_locked/aboot_locked.img
    dd if=/dev/block/bootdevice/by-name/abootbak of=/sdcard/dump_locked/abootbak_locked.img
    dd if=/dev/block/bootdevice/by-name/abootdebug of=/sdcard/dump_locked/abootdebug_locked.img
    dd if=/dev/block/bootdevice/by-name/ADF of=/sdcard/dump_locked/ADF_locked.img
    dd if=/dev/block/bootdevice/by-name/APD of=/sdcard/dump_locked/APD_locked.img
    dd if=/dev/block/bootdevice/by-name/asdf of=/sdcard/dump_locked/asdf_locked.img
    dd if=/dev/block/bootdevice/by-name/asusfw of=/sdcard/dump_locked/asusfw_locked.img
    dd if=/dev/block/bootdevice/by-name/asusgpt of=/sdcard/dump_locked/asusgptt_locked.img
    dd if=/dev/block/bootdevice/by-name/asusgpt1 of=/sdcard/dump_locked/asusgpt1_locked.img
    dd if=/dev/block/bootdevice/by-name/asusgpt2 of=/sdcard/dump_locked/asusgpt2_locked.img
    dd if=/dev/block/bootdevice/by-name/asuskey of=/sdcard/dump_locked/asuskey_locked.img
    dd if=/dev/block/bootdevice/by-name/asuskey2 of=/sdcard/dump_locked/auskey2_locked.img
    dd if=/dev/block/bootdevice/by-name/asuskey3 of=/sdcard/dump_locked/asuskey3_locked.img
    dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/dump_locked/asuskey4_locked.img
    dd if=/dev/block/bootdevice/by-name/asuskey5 of=/sdcard/dump_locked/asuskey5_locked.img
    dd if=/dev/block/bootdevice/by-name/config of=/sdcard/dump_locked/config_locked.img
    dd if=/dev/block/bootdevice/by-name/DDR of=/sdcard/dump_locked/DDR_locked.img
    dd if=/dev/block/bootdevice/by-name/devinfo of=/sdcard/dump_locked/devinfo_locked.img
    dd if=/dev/block/bootdevice/by-name/factory of=sdcard/dump_locked/factory_locked.img
    dd if=/dev/block/bootdevice/by-name/factorybak of=sdcard/dump_locked/factorybak_locked.img
    dd if=/dev/block/bootdevice/by-name/fsc of=/sdcard/dump_locked/fsc_locked.img
    dd if=/dev/block/bootdevice/by-name/fsg of=/sdcard/dump_locked/fsg_locked.img
    dd if=/dev/block/bootdevice/by-name/hyp of=/sdcard/dump_locked/hyp_locked.img
    dd if=/dev/block/bootdevice/by-name/hypbak of=/sdcard/dump_locked/hypbak_locked.img
    dd if=/dev/block/bootdevice/by-name/keystore of=/sdcard/dump_locked/keystore_locked.img
    dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/dump_locked/misc_locked.img
    dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/dump_locked/modem_locked.img
    dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/dump_locked/modemst1_locked.img
    dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/dump_locked/modemst2_locked.img
    dd if=/dev/block/bootdevice/by-name/oem of=/sdcard/dump_locked/oem_locked.img
    dd if=/dev/block/bootdevice/by-name/persistent of=/dump_locked/sdcard/persistent_locked.img
    dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/dump_locked/persist_locked.img
    dd if=/dev/block/bootdevice/by-name/rpm of=/sdcard/dump_locked/rpm_locked.img
    dd if=/dev/block/bootdevice/by-name/rpmbak of=/sdcard/dump_locked/rpmbak_locked.img
    dd if=/dev/block/bootdevice/by-name/sbl1 of=/sdcard/dump_locked/sbl1_locked.img
    dd if=/dev/block/bootdevice/by-name/sec of=/sdcard/dump_locked/sec_locked.img
    dd if=/dev/block/bootdevice/by-name/splash of=/sdcard/dump_locked/splash_locked.img
    dd if=/dev/block/bootdevice/by-name/ssd of=/sdcard/dump_locked/ssd_locked.img
    dd if=/dev/block/bootdevice/by-name/tz of=/sdcard/dump_locked/tz_locked.img
    dd if=/dev/block/bootdevice/by-name/tzbak of=/sdcard/dump_locked/tzbak_locked.img
    echo "Finished Partition Backup!"

    The script will take approx. 6 mins to complete. Be Patient. Do not close the terminal session.
    You should see a folder with name "dumps-lockedbl" in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

    STEP 2: Unlock your bootloader Warning: This may void your warranty
    (All credits to osm0sis for this)
    Now the following magical code will unlock your bootloader! Copy paste it to Termux/adb-shell
    Code:
    echo -ne "\x01" | dd obs=1 count=1 seek=16 of=/dev/block/bootdevice/by-name/devinfo

    To check your bootloader status, Reboot to fastboot mode. Connect it to a computer (computer should have adb and fastboot files, and assus drivers installed)On your computer, hold down shift key and right click on the folder in which you have adb and fastboot files. Select "Open command window here". Type the following command and hit enter-
    Code:
    fastboot oem device-info

    You will get the following output
    Code:
    ...
    (bootloader) 	Device unlocked: true
    (bootloader) 	Charger screen enabled: false
    (bootloader) 	Display panel: 
    (bootloader) 	Adb Enable: 0
    OKAY [  0.004s]
    "Device unlocked: true" means bootloader is unlocked!
    Troubleshoot:Not needed
    If your output has "Device unlocked: false" then it means your bootloader is still locked. In that case, type the following code
    Code:
    fastboot oem adb_enable
    fastboot oem adb_enable
    Yes you need to type it twice. Now check status again
    Code:
    fastboot oem device-info
    Now the output should be
    Code:
    ...
    (bootloader) 	Device unlocked: false
    (bootloader) 	Charger screen enabled: false
    (bootloader) 	Display panel: 
    (bootloader) 	Adb Enable: 1
    OKAY [  0.004s]

    Now repeat step 2 again. Your bootloader will be unlocked


    STEP 3: If you want to help us in relocking bootloader, then do this step
    This is similar to step 1 with the difference that we are now dumping out partitions that might have changed after unlocking bootloader to folder name dumps-unlockedbl
    i) From Termux terminal emulator app (Download from playstore), type
    Code:
    su
    OR
    Using adb (assuming you have enabled USB Debugging and device is connected to computer)
    Code:
    adb shell
    su

    ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter:
    Code:
    state=unlocked;
    outdir=/sdcard/dumps-unlockedbl;
    
    if [ -e /dev/block/platform/*/by-name ]; then
      target=/dev/block/platform/*/by-name;
    elif [ -e /dev/block/platform/*/*/by-name ]; then
      target=/dev/block/platform/*/*/by-name;
    fi;
    if [ "$target" ]; then
      target=`echo -n $target`;
      mkdir $outdir;
      echo $target > $outdir/targets.txt;
      bootdev=/dev/block/bootdevice/by-name;
      test -e $bootdev && echo $bootdev >> $outdir/targets.txt;
      for part in $(ls $target); do
        case $part in
          system|APP|cache|CAC|userdata|UDA|boot|LNX|recovery|SOS) ;;
          *) dd if=$target/$part of=$outdir/$part-$state.img;;
        esac;
      done;
    fi;

    old script (just for my reference)
    Long script but works on both LP and MM for ZE550KL
    Code:
    mkdir /sdcard/dump_unlocked
    dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/dump_locked/aboot_unlocked.img
    dd if=/dev/block/bootdevice/by-name/abootbak of=/sdcard/dump_unlocked/abootbak_unlocked.img
    dd if=/dev/block/bootdevice/by-name/abootdebug of=/sdcard/dump_unlocked/abootdebug_unlocked.img
    dd if=/dev/block/bootdevice/by-name/ADF of=/sdcard/dump_unlocked/ADF_unlocked.img
    dd if=/dev/block/bootdevice/by-name/APD of=/sdcard/dump_unlocked/APD_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asdf of=/sdcard/dump_unlocked/asdf_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asusfw of=/sdcard/dump_unlocked/asusfw_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asusgpt of=/sdcard/dump_unlocked/asusgptt_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asusgpt1 of=/sdcard/dump_unlocked/asusgpt1_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asusgpt2 of=/sdcard/dump_unlocked/asusgpt2_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asuskey of=/sdcard/dump_unlocked/asuskey_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asuskey2 of=/sdcard/dump_unlocked/auskey2_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asuskey3 of=/sdcard/dump_unlocked/asuskey3_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/dump_unlocked/asuskey4_unlocked.img
    dd if=/dev/block/bootdevice/by-name/asuskey5 of=/sdcard/dump_unlocked/asuskey5_unlocked.img
    dd if=/dev/block/bootdevice/by-name/config of=/sdcard/dump_unlocked/config_unlocked.img
    dd if=/dev/block/bootdevice/by-name/DDR of=/sdcard/dump_unlocked/DDR_unlocked.img
    dd if=/dev/block/bootdevice/by-name/devinfo of=/sdcard/dump_unlocked/devinfo_unlocked.img
    dd if=/dev/block/bootdevice/by-name/factory of=sdcard/dump_unlocked/factory_unlocked.img
    dd if=/dev/block/bootdevice/by-name/factorybak of=sdcard/dump_unlocked/factorybak_unlocked.img
    dd if=/dev/block/bootdevice/by-name/fsc of=/sdcard/dump_unlocked/fsc_unlocked.img
    dd if=/dev/block/bootdevice/by-name/fsg of=/sdcard/dump_unlocked/fsg_unlocked.img
    dd if=/dev/block/bootdevice/by-name/hyp of=/sdcard/dump_unlocked/hyp_unlocked.img
    dd if=/dev/block/bootdevice/by-name/hypbak of=/sdcard/dump_unlocked/hypbak_unlocked.img
    dd if=/dev/block/bootdevice/by-name/keystore of=/sdcard/dump_unlocked/keystore_unlocked.img
    dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/dump_unlocked/misc_unlocked.img
    dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/dump_unlocked/modem_unlocked.img
    dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/dump_unlocked/modemst1_unlocked.img
    dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/dump_unlocked/modemst2_unlocked.img
    dd if=/dev/block/bootdevice/by-name/oem of=/sdcard/dump_unlocked/oem_unlocked.img
    dd if=/dev/block/bootdevice/by-name/persistent of=/dump_unlocked/sdcard/persistent_unlocked.img
    dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/dump_unlocked/persist_unlocked.img
    dd if=/dev/block/bootdevice/by-name/rpm of=/sdcard/dump_unlocked/rpm_unlocked.img
    dd if=/dev/block/bootdevice/by-name/rpmbak of=/sdcard/dump_unlocked/rpmbak_unlocked.img
    dd if=/dev/block/bootdevice/by-name/sbl1 of=/sdcard/dump_unlocked/sbl1_unlocked.img
    dd if=/dev/block/bootdevice/by-name/sec of=/sdcard/dump_unlocked/sec_unlocked.img
    dd if=/dev/block/bootdevice/by-name/splash of=/sdcard/dump_unlocked/splash_unlocked.img
    dd if=/dev/block/bootdevice/by-name/ssd of=/sdcard/dump_unlocked/ssd_unlocked.img
    dd if=/dev/block/bootdevice/by-name/tz of=/sdcard/dump_unlocked/tz_unlocked.img
    dd if=/dev/block/bootdevice/by-name/tzbak of=/sdcard/dump_unlocked/tzbak_unlocked.img
    echo "Finished Partition Backup!"


    Again, the script will take approx. 6 mins to complete. You can close terminal seession once the script completes (i.e. ~6mins)
    You should see a folder with name "dumps-unlockedbl" in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

    Facing issues or didn't understand something? Here's a video Tutorial

    HELP US ACHIEVE RELOCKING BOOTLOADER:
    We may be able to relock bootloader if you send us your partition backups. So compress together "dumps-lockedbl" and "dumps-unlockedbl" folders. Zip name should be "Partitions_YourXdaUsername". Upload to any reliable cloud storage (preferable your google drive). PM me a link to your file, DO NOT POST A LINK IN COMMENTS SINCE YOUR BACKUP CONTAINS SENSITIVE INFORMATION. Don't worry, we won't misuse it, you can trust me on that :eek:


    POST YOUR RESULTS
    Post your results in the following format-
    1. Device model:
    2. Soc/Chipset:
    3. SKU:
    4. Output of "fastboot oem device-info" or BL Status :
    .
    .
    4
    This method is working, thank you so much for it! I've already installed custom recovery. The only problem I have is I don't know SKU. I also saved the dumps and I will send it later.

    1. Device model: ZE550KL
    2. Soc/Chipset: Qualcomm Snapdragon 410
    3. SKU: WW
    4. Output of "fastboot oem device-info":
    (bootloader) Device unlocked: true
    (bootloader) Charger screen enabled: false
    (bootloader) Display panel:
    (bootloader) Adb Enable: 0
    OKAY [ 0.015s]
    finished. total time: 0.016s
    3
    @4llerbuntu
    It definitely works. I added a video tut too https://youtu.be/eMaIM7JCrgo
    You will need to delete the existing "backup-locked-bl" folder
    Partition backup app can backup just a few common partitions ( just 6, while we need all 46 excluding system)
    3
    Not working for me, it says mkdir failed
    Are you on Marshmallow? If yes you need to grant it "storage" permissions. Goto settings>app>termux>permissions
    Click on the the toggle which is on right side of "Storage" . The toggle will turn blue if Storage permissions is granted/enabled.
    Also did you got SuperSU pop up when you entered "su"?
    When the pop up appears you need to click on grant.
    Try again and do post back your results ;)


    important note:
    if u cant get it done, try to remove devinfo file first
    i have successed like this.

    rm /dev/block/bootdevice/by-name/devinfo .

    Please don't instruct people to remove "devinfo" Removing devinfo can brick devices. Your device is different, a test model. Please edit your comment and remove your suggestion of removing devinfo.
    Did you made partition backup before and after unlocking. If yes, can you upload it and PM me a link? This will help us to achieve relocking bootloader.


    I am unable to unlock the phone.
    Could you say me in detail??
    Which step are you facing difficulties? Its already a very detailed guide. Nevertheless, I will add a video tutorial soon
    2
    Does this method work on Android 6.0 firmware?

    Yes.