Rooting the ZTE Blade A610 Android Phone

I purchased this phone in January 2020 for 57 euros, I think that it has a pretty good hardware: 2 GB RAM, 16 Gb Flash, 720×1280 screen, LTE, 4000 mAh battery. The only drawback is the operating system, the last release is Android 6.0 Marshmallow, with security patch 2018-08-05. The phone can be easly rooted, unfortunately there is not an official LineageOS build, or other famous custom ROMs.

One week after I purchased that phone from Amazon, the price suddenly rose to about 130 euros! I think that at this price the phone is not longer an interesting bargain, because in that price range you can find devices with 3 Gb of RAM and a more recent Android version.

	Good quality/price ratio (at 57 €). 2 Gb RAM. 16 Gb Flash. 4000 mAh Battery. 720×1280 5“ display. Easy rooting.
	Outdated Android 6.0. Non replaceable battery.

Here some specification:

This is the operating system out-of-the-box:

Afer an OTA Update I got this:

It is also possibile to download the update.zip from the ZTE Support Site. The update is labeled 365012B1468CH_EUR_BA610TV1.4, dated 2019-04-04 and sized 1.30 Gb. With the ZIP file you can try two update procedures; the first one is from Settings ⇒ About phone ⇒ System updates ⇒ Storage card updates. The alternative procedure, called forced upgrade, is started from the Recovery mode. Read the ZTE Upgrade Guide for instructions.

Power-off the device, then power-on using VolumeUp + Power. You will enter the Boot mode select menu, choose Recovery (using VolumeUp to choose and VolumeDown to confirm). You will be presented with a Broken droid image; press again VolumeUp + Power (sometimes it is required to keep them pressed for about 10 seconds) to enter the Recovery menu.

To enable root privileges on this phone we used Magisk, which has all what is needed to install and manage root privileges and to disable dm-verity.

Generally every rooting recipe requires to operate the phone in special modes, i.e. not the default running operating system. You should be familar with these modes and how to activate them. Some of these mode are specific of devices based on the MTK MediaTek chips.

• The scatter file - It is required for flashing (upload) system partitions to the phone, the numbers contained in this file are required also to backup (readback) system partitions from the phone to the PC. See this page for more insight: Android Partitions on MTK Devices. The MT6735_Scatter_ZTE_BLADE_A610_WXQMA1B1-2.txt file is included whit the TWRP download below.
• The TWRP Recovery - There is no offical TWRP build for the ZTE Blade A610, but fortunately I found a TWRP v3.2.3 compiled by the user kiruha_21 which works well on my phone (touch screen included!). Someone says that is based on the kernel DIS_ASI_P635T36V1.0.0B18 / Sun Oct 30 10:48:15 CST 2016 (Russia), but who knows! You can find the original link in this xda-developers.com post.
• Magisk-v20.3.zip and MagiskManager-v7.5.1.apk - The archives are distributed by the author, on GitHub.
• SP Flash Tool - Technically it is not required to install TWRP and to root the phone, but it is useful to make a backup of flash partitions before attempting the rooting operation. I used version 5.1916 for GNU/Linux.
• fastboot and adb - Because I run Debian GNU/Linux, I also installed that packages which contain the command line tools used to interact with Android devices. If by chance you use MS-Windows, poor you! You have to go crazy with the various MTK VCOM drivers, ADB drivers, etc.

You should backup at least three partition, you need to restore them in case you will want to install an OTA Update.

• boot.img
• recovery.img
• system.img

You can use SP Flash Tool to execute the backup.

Beware that the ZTE Blade A610 has the dm-verity protection active (at least with Android v6.0, security patch level: August 5, 2016). This means that any change to the system partition will be detected by the kernel at bootstrap, causing a freeze (boot does not complete). This can be a problem, because to have the TWRP recovery permanently installed and to install su (the root privileges binary), we need to change the /system partition.

If you do not disable dm-verity you will discover that the installation of TWRP into the recovery partition is not permanent. Once you boot in normal system, the recovery partition is modified (may be reverted to the stock recovery, or with something not functional). Infact to let TWRP stay permanent into its partition, is required to rename the file /system/recovery-from-boot.p into /system/recovery-from-boot.bak; this is performed automatically when you run TWRP for the first time if you Swipe to Allow Modifications. The required trick is to install Magisk.zip the very first time you run TWRP; the Magisk installer disables dm-verity.

If you don't install Magisk when you run TWRP and you allow system modifications, you will brick your phone (unable to boot). You will need to restore the whole system.bin from a backup. If you already installed TWRP without allowing system modification, you can change that permission selecting the Mount button and unchecking Mount system partition read-only: you are asked again to Swipe to Allow Modifications.

1. Enable Developer options, OEM unlocking and USB debugging.
2. Optional step: restart in fastboot mode, execute fastboot oem unlock and reboot (this will do a factory reset).
3. Copy Magisk-v20.3.zip and MagiskManager-v7.5.1.apk to /sdcard.
4. If you did the optional step #2, restart in fastboot mode and execute fastboot flash recovery twrp-recovery.img. Otherwise you need to flash the TWRP Recovery using SP Flash Tool.
5. Boot in TWRP recovery, allow modification, install Magisk-v20.3.zip.
6. Wipe Dalvik cache and reboot.
7. Install MagiskManager-v7.5.1.apk.

Here some more details.

To enable Developer options use the standard procedure: go to Settings ⇒ About phone ⇒ Tap 7 times on Build number. Now you have Settings ⇒ Developer options. Inside Developer options enable OEM unlocking and USB debugging.

It turned out that performing this step is not strictly required: if you flash the TWRP Recovery using the SP Flash Tool graphical software, you don't need to issue the fastboot oem unlock command and so no factory reset is performed.

Otherwise, if you wan use only the command line, now you have to actually unlock the bootloader. Once unlocked, you can boot the phone from a custom operating system image (we will use TWRP because it can install Magisk). Beware that OEM unlocking implies a factory reset: you will loose any app and any customization you made on the phone.

Start the phone in fastboot mode and execute the following command from the attached PC:

fastboot oem unlock

You will be warned on the phone that a factory reset will occurr, you must confirm. Now you can reboot in normal system issuing the command:

fasboot reboot

In normal system use the adb tool from the connected PC to copy files on the phone and return to fastboot mode:

abd push Magisk-v20.3.zip /sdcard
adb push MagiskManager-v7.5.1.apk /sdcard
abd reboot bootloader

This is the most delicate part. You have to flash the TWRP recovery and start it. From the attacched PC execute:

fastboot flash recovery twrp-3.2.3-zte-blade-a610-recovery.img

Power-off the device, restart with VolumeUp+Power and start TWRP recovery. Now you have to Swipe to Allow Modifications, navigate in the Install menu and choose to install the ZIP archive Magisk-v20.3.zip. To be safe, perform also a wipe of the Dalvik Cache.

Once rebooted in normal system, you can install the Magisk APK and confirm that su (superuser command line program) is properly working.

Once rooted, the On-The-Air updates will fail because almost certainly a new kernel with dm-verity enabled is insalled. This will detect the modifications to the system partition, freezing the bootstrap at the ZTE logo. Your chance is to perform a restore once notified that an update is available. Restore the boot.bin, recovery.bin and system.bin images from the backup before root. After the update is installed, you have to reinstall TWRP and Magisk.

This device includes by default some useless apps, following the bad habit very much in vogue in these days. Some can be removed simply by uninstalling them, others require root privileges to be removed.

This is an example on how to remove a system application, via adb. Boot the phone in normal system, connect the USB cable and execute adb shell on the connected PC, then:

su
mount -o remount,rw /system
rm -r /system/priv-app/ZTE_Cares/
reboot

Remove also directories under /system/vendor/operator/app/, /data/app-lib/ and /data/data/:

rm -r /system/vendor/operator/app/AccuWeather
rm -r /system/vendor/operator/app/Clean_Master
rm -r /system/vendor/operator/app/Facebook
rm -r /system/vendor/operator/app/WPS_Office

rm -r /data/app-lib/AccuWeather
rm -r /data/app-lib/Baidu_Location
rm -r /data/app-lib/Clean_Master
rm -r /data/app-lib/Facebook
rm -r /data/app-lib/Twitter
rm -r /data/app-lib/WPS_Office

rm -r /data/data/cn.wps.moffice_eng
rm -r /data/data/com.accuweather.android
rm -r /data/data/com.cleanmaster.mguard
rm -r /data/data/com.facebook.katana

: What are the following? Should them be removed too?

/system/vendor/operator/app/HimaxMPAP
/data/app-lib/HimaxMPAP
/data/data/com.himax.mpap

To install the Windows ADB drivers (you can download the official drivers from this page on developer.android.com), you must add the USB identifiers of this ZTE device into the android_winusb.inf file. First of all you can use lsusb on a GNU/Linux box to know the vendor and product IDs (VID and PID):

Bus 002 Device 013: ID 19d2:0306 ZTE WCDMA Technologies MSM

Then you have to add these lines into the file android_winusb.inf, after the listed Google devices:

;ZTE Blade A610
%SingleAdbInterface%        = USB_Install, USB\VID_19D2&PID_0306
%CompositeAdbInterface%     = USB_Install, USB\VID_19D2&PID_0306&MI_00
%SingleAdbInterface%        = USB_Install, USB\VID_19D2&PID_0306
%CompositeAdbInterface%     = USB_Install, USB\VID_19D2&PID_0306&MI_01

Now you can open the Windows Device Manager, right-click on the not-recognized device and update the drivers, searching then from the disk. Once properly installed, the device is listed as Android Composite ADB Interface:

Despite the ADB drivers are correctly installed, the MTK Droid Tools does not work because the smartphone runs Android 6.0. The error message is: Unknown ROM structure, backup NOT possibile!

• How to Install twrp 3.2.3 Root ZTE Blade A610 - twrp unofficial
• How to Install Android 7.1.2 Nougat On ZTE Blade A610
• LineageOS for Zte Blade A610