[UNLOCK] Tuliptool: unlock, TWRP, and custom boot

[tdm]

First let's get the warnings out of the way:


This is a dangerous tool. It can render your device permanently unusable.
If you use it, your warranty will likely be void.
You accept all responsibility for the consequences.

This is not an official ZTE unlock tool. The official ZTE unlock tool is in another thread.


Acknowledgments
Special thanks to @rombdeta for providing the OEM programmer binary. This would not be possible without his help.

What is tuliptool?
This tool allows you to:

• Check status of your boot loader
• Unlock your boot loader
• Lock your boot loader
• Install a custom recovery
• Install a custom boot image

NOTE WELL
The first rule of intelligent tinkering is to save all the parts.

• Always backup your partitions before writing new contents, so that you can get back to where you started.
• Never write both boot and recovery in one session. Always make sure that you can boot into the other partition in case something fails.
• Locking and unlocking will erase all user data. Make sure you backup first!

The zip includes:

• tuliptool for Linux
• tuliptool for Win64
• tuliptool for Win32
• tuliptool for MacOS

Preparation
1. Extract the package.
You will find the binary files listed above. Note: This is a command line utility, so you must open a command prompt to run it.

2a. Setup for Linux
Create a file named /etc/udev/rules.d/99-qcom.rules with this content exactly as shown:
SUBSYSTEM=="usb", ATTRS{idVendor}=="05c6", GROUP="plugdev"
Ensure your login user is in the plugdev group.

2b. Setup for Win32/Win64

1. Download zadig.
2. Connect your device in EDL mode (see below).
3. Windows will want to install the Qualcomm USB driver. We won't be using it so you can cancel if you wish, but it won't hurt anything.
4. Run zadig. Find device 05c6:9008 and install the WinUSB driver for it.
5. Disconnect the device.

2c. Setup for MacOS
No setup should be necessary.

3. Download boot and/or recovery files to flash.
You will find these in other threads in this section.

Connecting in EDL mode
Via adb
This should work for all models, but you need adb access.
adb reboot edl
Via key combo
If you have a US model device (or the aboot from a US model device) you may use the key combo:

1. Power off and unplug the device.
2. Hold both volume buttons.
3. Plug device into your PC.
4. Wait about 3 seconds and release the buttons.

Note: There will be no feedback on the device -- no lights, no vibration, nothing. The only way to verify that the device is in EDL mode is that device 05c6:9008 is visible on the PC.

Usage: (un)locking
After some testing, it appears that the Axon 7 Mini is not locked in any way. In other words, unlocking seems to be completely unnecessary. This section is mostly provided for completeness.

tuliptool lock status
tuliptool lock unlock
tuliptool lock lock

Usage: reading boot/recovery
Note command line options have changed
tuliptool read boot
tuliptool read recovery

Usage: writing boot/recovery
Note command line options have changed
tuliptool write boot <filename>/I]
tuliptool write recovery <filename>

So, for example, to write a TWRP image, run:
tuliptool write recovery tulip-twrp-7.1-r1.img.

Multiple operations
This is a "one shot" tool. After performing an operation, it will reset the device with a 5 second countdown. If you wish do perform multiple operations (eg. backup, unlock, flash), simply hold down the volume buttons while the device resets and it should go back to EDL mode.

Download
tuliptool.zip
md5=58f34850005510b51a832d27a6bce607

Common problems
Device not found: first enter EDL mode, then run the tool.
Device is visible in device manager or lspci but cannot be found by the tool: connect directly to the PC, not through a hub.
Windows says bad file descriptor: the WinUSB driver is not installed.
Linux says permission denied: your login user is not in the plugdev group.

Why call it tuliptool?
Tulip is the device "code name" for the Axon 7 Mini (at least the US version).

 

[Meme Queen]

first! it's nice to see someone working on the lesser-known devices for once, thanks love!

okay so on that note everything goes perfectly, right up until i try to actually run the tool lol. installing the driver through Zadig does fine, and from everything i can tell, the PC recognizes it. i mean, it's in EDL and everything. what's going wrong? running the tuliptool-win64.exe just opens and closes instantly, and opening a command prompt in the directory just tells me that tuliptool is not a valid command/operation blah blah blah. it's probably something simple but i'm kind of trying to get all over this so :good:

 

[MrWhite0429]

Perhaps try running it as administrator? I'm heading home from work and then I'll be taking a shot at this myself.

 

[tdm]

I just tried on a Windows 10 virtual machine and it works perfectly.

This is a commandline program so you open a command prompt and type eg:
tuliptool-win64.exe lock status

first! it's nice to see someone working on the lesser-known devices for once, thanks love!

okay so on that note everything goes perfectly, right up until i try to actually run the tool lol. installing the driver through Zadig does fine, and from everything i can tell, the PC recognizes it. i mean, it's in EDL and everything. what's going wrong? running the tuliptool-win64.exe just opens and closes instantly, and opening a command prompt in the directory just tells me that tuliptool is not a valid command/operation blah blah blah. it's probably something simple but i'm kind of trying to get all over this so :good:

 

[Meme Queen]

I just tried on a Windows 10 virtual machine and it works perfectly.

This is a commandline program so you open a command prompt and type eg:
tuliptool-win64.exe lock status

so it's gone past that, but now it fails to unlock with an unknown error. checking unlock status after returns "Failed to send programmer: failed to read packet". i have to unplug it and go back into EDL mode, and when i check the lock status, it says unlocked and not tampered. when i try to go ahead with flashing TWRP, it crashes with this:

Sending programmer...Connecting to programmer...log: logbuf@0x08067EB8 fh@0x08064D20
log: logbuf@0x08067EB8 fh@0x08064D20
log: Finished sector address 0
log: Finished sector address 0
log: Finished sector address 0
Writing recovery ...
terminate called after throwing an instance of 'std::runtime_error'
what(): No error

This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.

 

[MrWhite0429]

I guess im stuck waiting for the update.zip because Zadig is refusing to install drivers. no matter what i do it will not install drivers. it keeps telling me "Remote Source Not Allocated: Driver install Aborted"

 

[tdm]

Hmm, looks like something strange is going on there. I'll take a look tomorrow.

so it's gone past that, but now it fails to unlock with an unknown error. checking unlock status after returns "Failed to send programmer: failed to read packet". i have to unplug it and go back into EDL mode, and when i check the lock status, it says unlocked and not tampered. when i try to go ahead with flashing TWRP, it crashes with this:

Sending programmer...Connecting to programmer...log: logbuf@0x08067EB8 fh@0x08064D20
log: logbuf@0x08067EB8 fh@0x08064D20
log: Finished sector address 0
log: Finished sector address 0
log: Finished sector address 0
Writing recovery ...
terminate called after throwing an instance of 'std::runtime_error'
what(): No error

This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.

 

[Meme Queen]

Hmm, looks like something strange is going on there. I'll take a look tomorrow.

thanks! if there's any information you want me to provide, just let me know.

 

[pxzei]

I cannot get my device to boot into EDL mode, everytime I try it gets stuck on the splash screen. Can anyone help?

 

[rombdeta]

I cannot get my device to boot into EDL mode, everytime I try it gets stuck on the splash screen. Can anyone help?

Yeah, try pressing the power button for 10 seconds, until the display turns off, hold down VOL + and enter recovery "power down" and try to enter edl again

 

[MrWhite0429]

Ok. Now ive retraced my steps and found that letting the qualcomm drivers install will not allow the WinUSB drivers to install in Windows 7. Once I told Windows update to not install the qualcomm drivers Zadig was able to install drivers successfully. Now that the drivers are installed, Device is in EDL (im assuming this because screen is black but my computer is recognizing the device), I run the Tuliptool and it keeps telling me "Device Not Detected" . I cant seem to get it to find the device but i can see it in Device Manager just fine. And it shows the WinUSB drivers are installed correctly, any insight on to what I may be doing wrong?

 

[tdm]

There won't be any lights or other indication that the phone is on when it's in EDL mode. But you should see the device in device manager, as USB id=05c6:9008. I don't normally run windows so I can't give detailed steps to find that.

You may need to have admin privileges to talk to USB devices, I'm not sure.

Ok. Now ive retraced my steps and found that letting the qualcomm drivers install will not allow the WinUSB drivers to install in Windows 7. Once I told Windows update to not install the qualcomm drivers Zadig was able to install drivers successfully. Now that the drivers are installed, Device is in EDL (im assuming this because screen is black but my computer is recognizing the device), I run the Tuliptool and it keeps telling me "Device Not Detected" . I cant seem to get it to find the device but i can see it in Device Manager just fine. And it shows the WinUSB drivers are installed correctly, any insight on to what I may be doing wrong?

 

[MrWhite0429]

There won't be any lights or other indication that the phone is on when it's in EDL mode. But you should see the device in device manager, as USB id=05c6:9008. I don't normally run windows so I can't give detailed steps to find that.

You may need to have admin privileges to talk to USB devices, I'm not sure.

Device Shows connected and drivers installed under device manager.

Command prompt is being run as so:

Start --> type cmd ---> Right click on Command prompt ---> Run as Administrator

cd C:\users\admin\desktop\tuliptool

C:\users\admin\desktop\tuliptool> tuliptool-win64.exe lock status
Device Not Detected

---------- Post added at 03:59 AM ---------- Previous post was at 03:38 AM ----------

UPDATE:
I found that I had to use a USB 3.0 hub in order to get the phone to be detected.

Once detected I ran commands as followed.

tuliptool-win64.exe lock unlock

(The unlocking procedure said it failed, phone bootlooped three times, then it showed as unlocked when I ran the Lock status command)

tuliptool-win64.exe read boot

(This created the backup-boot.bin file in the directory)

Tuliptool-win64.exe read recovery

(This created a backup-recovery file in the directory)

tuliptool-win64.exe write boot

Its at this point here I get a Runtime Error as well. The entire process comes to a halt.

 

[pxzei]

Thsnks, tried that, but no luck. It's still stuck on the splash screen.
Update: The device is running B09 7.1.1, The charger seems to be ZTE authentic. Single sim variant. If you need more info, let me know.

Yeah, try pressing the power button for 10 seconds, until the display turns off, hold down VOL + and enter recovery "power down" and try to enter edl again

 

[fallen00sniper]

This is not an official ZTE unlock tool. ZTE will likely be providing an official boot loader unlock in the coming few days. You should wait for that if you have any reservations about modifying your device.
[/B][/COLOR]

Awesome you got the tool out, I think I am going to wait for the 'Official' tool so if I ever need to send it in for repair in the next 2 years I can say 'well I used your tool' lol

Can't wait to see the roms @tdm, keep it up and I think the mini is going to get a lot more interesting.

I'd like to get a bloat removed(if any) and more lightweight faster rom on mine, maybe try the latest cyanogenmod or w/e they call it now and AOKP, etc.

New roms without MiFavor would be awesome too and ones that improve performance!

 

[CRAFTER0302002]

ZTE

@tdm, do you think zte will also be giving the official boot loader unlock soon? If not I will use yours that looks solid, but just thought I would ask first.

 

[saymonek]

@tdm, do you think zte will also be giving the official boot loader unlock soon? If not I will use yours that looks solid, but just thought I would ask first.

First post:
"This is not an official ZTE unlock tool. ZTE will likely be providing an official boot loader unlock in the coming few days. You should wait for that if you have any reservations about modifying your device."

 

[tdm]

Okay I've uploaded a new version of the tool with better error handling and better error messages (particularly for the Win64 version). I successfully wrote TWRP using the Win64 version. Please check the OP for the new link and download it again.

@Meme Queen and @MrWhite0429 please try again. I think the problem was that you didn't copy tulip-twrp-7.1.1.img to recovery.bin.

I can modify the tool to take a filename as a parameter if that helps with the confusion.

Edit: Also fixed a typo in the OP which had the wrong filename in the example. This may have been the source of the confusion.

 

[MrWhite0429]

Okay I've uploaded a new version of the tool with better error handling and better error messages (particularly for the Win64 version). I successfully wrote TWRP using the Win64 version. Please check the OP for the new link and download it again.

@Meme Queen and @MrWhite0429 please try again. I think the problem was that you didn't copy tulip-twrp-7.1.1.img to recovery.bin.

I can modify the tool to take a filename as a parameter if that helps with the confusion.

Edit: Also fixed a typo in the OP which had the wrong filename in the example. This may have been the source of the confusion.

as in rename to recovery.bin?

 

[tdm]

Yes, that.

as in rename to recovery.bin?