How to recover a ZTE Blade/Libra/v880 after a bad flash
This guide is meant to help you to recover from a bad flash. It assumes at the very least that you cannot boot android, and can help you as long as your phone can boot into download mode. I have described many ways to unbrick in order of increasing difficulty and risk. Use only the first method that works. These instructions will wipe everything on your phone’s internal memory. Before you follow any of them, charge your battery and have a good night’s sleep. For the purposes of this guide, a Dell XCD35 is a European GSM Blade.
Special Case – corrupt NV memory
If your phone was flashed via windows and will not boot into anything except recovery mode (i.e. FTM mode or clockworkmod), even if you install a compatible ROM and boot normally, then the problem is usually corrupt NV memory. You must use method 4 to solve this problem. You can often solve it by following only the instructions to restore your IMEI (skipping the flashing part), but you may need to do the whole lot.
Method 1: Clockworkmod
Turn your phone on with volume down held. If it boots into clockwork, then you should be able to fix it from there. In clockworkmod:
- Go to “backup and restore” and perform a backup of your current setup.
- Go to “mounts and storage” and select mount USB storage. Connect the phone to a computer and copy your backup from the clockworkmod directory to your computer. Download a Gen1 or Gen2 ROM and copy it to your SD card (not a stock ROM, since it will overwrite clockworkmod). If you are not sure, try installing both Gen1 and Gen2 ROMs.
- Go to “mounts and storage” and format boot, system, data, cache, and sd-ext.
- Go to “install zip from SD card” and install the ROM you have downloaded. Restart your phone when it is finished.
Method 2: Fastboot
Fastboot is a method of flashing a recovery image to your phone from a computer (which can be running Windows, Linux, or OSX). It does not work with Blades that are running stock Gen2 firmware (i.e. upgraded to stock Gen2 via windows or upgraded to android 2.2 by an official update) unless both the recovery and boot partitions are completely unbootable.
For all platforms
- Download and extract this file, which contains both fastboot and clockworkmod for Gen1 and Gen2.
- Turn on your phone with volume up held and connect it to your computer. It should not progress beyond the green android. Sometimes you have to wait a few minutes for the computer to recognise it.
- Download and install the ZTE Handset drivers. Your phone should be listed as “Fastboot Interface” under “ADB Interfaces”.
- Run windows-flash-gen1-recovery.bat to flash Gen1 clockworkmod, or windows-flash-gen2-recovery.bat to flash gen2 clockworkmod.
- After rebooting with volume down held, you should be able to flash a ROM in clockworkmod.
- Navigate to the extracted folder and run one of the following commands. To flash Gen1 clockworkmod:
sudo ./fastboot-linux flash recovery recovery-clockwork-126.96.36.199-blade-gen1.img
To flash Gen2 clockworkmod:
sudo ./fastboot-linux flash recovery recovery-clockwork-188.8.131.52-blade-gen2.img
- After rebooting with volume down held, you should be able to flash a ROM in clockworkmod.
I don’t know the command but it is probably similar to linux. you need to run fastboot-mac instead of fastboot-linux and flash the appropriate .img file.
Method 3: TPT
TPT is a way of flashing part of the low-level firmware on your phone. After successfully flashing the files below you will regain access to clockworkmod. You need a different type of TPT depending on what variant of the Blade you have. If you have a China Unicom v880 or any other Chinese variant then you must not flash a TPT designed for European Blades, and vice versa. Be aware that flashing a modified or corrupt TPT can permanently brick your phone. Choose the appropriate file below.
European Gen1 TPT
Use this if your phone is a European GSM variant and if it is Gen1 or has been upgraded to Gen2 via TPT. This will flash stock Gen1 firmware.
European Gen2 TPT
Use this if your phone is a European GSM variant and if it was sold as Gen2 or upgraded to stock Gen2 via windows. This will flash stock Gen2 firmware.
China Unicom v880 Gen2 TPT
Use this if your phone is a China Unicom v880 (unsure, but may work on Chinese u880/x880). This will flash the stock Gen2 firmware taken from the B15 android 2.2.2 update.
Flashing a TPT
- Download the applicable TPT file from above.
- Unzip and put the “image” folder onto the root directory of your SD card.
- Disconnect and reconnect your SD card and check the integrity of the TPT files. There is a file called “image.hash” in the image folder which contains all the files’ md5 hashes in plain text. Make sure that the md5 of all the files match, or you may brick your phone.
- Turn on your phone with the SD card inserted and with menu and volume up held.
- The screen will either stay black or show green text (if you see the green android immediately then it didn’t work), and will restart into clockworkmod when done. Wait at least 5 minutes for it to restart if you don’t see anything.
- When it is finished (even if it didn’t work), then remove the image directory from the SD card to prevent accidental flashing later on.
You can now flash a ROM using clockworkmod. If it doesn’t work, then using a different SD card may help. If you have a European variant then it is safe to try both Gen1 and Gen2 TPTs separately in case you have made a mistake.
Method 4: Windows upgrader
This method flashes the entire low-level firmware and maintains the correct IMEI automatically. To use this method you need to be able to boot into stock recovery. This means that when you turn your phone on with volume down held, the words “FTM” must appear on the screen. If you can access clockworkmod then you don’t need to use this method – see above. This method requires windows.
- For European Blades, follow this guide and flash any firmware package linked in the guide.
- For Chinese Blades, you must follow the same guide but flash this firmware package instead.
- If your provider/country is listed here then you can also flash your stock firmware instead, and optionally the stock ROM aswell.
Method 5: The dodgy ZTE firmware flasher
This method can help if your blade cannot boot at all. Consider it a LAST RESORT – people do this all the time and only make their situation worse. Only use it if all the above methods fail or if your IMEI is corrupt. Your IMEI will be lost in the process and you will need to use hex editing to fix it up afterwards. This method also requires windows. Most of this is taken from burstlam’s thread here, which you can also refer to (burstlam has posted screenshots which also help to show what to do). Do the following in order:
Boot into download mode and set up connection
- Download and install the ZTE USB driver.
- Put your phone in download mode by turning it on with both volume buttons held down at the same time. The screen will remain black, but the notification LED should briefly flash red.
- Plug it into your computer. The phone should be recognised in windows device manager under “Ports (COM & LPT)” as “ZTE Handset Diagnostic Interface(DFU) (COMxx)”. Take note of the port number (xx). If your phone cannot turn on at all and the LED doesn’t flash, it is dead. Sorry about that.
- Download this file, which contains the ZTE flasher along with firmware to flash your phone with, and unzip it somewhere convenient.
- Run “Flasher.exe” from the extracted folder. Press the exclamation mark and login as administrator with the password “ZTEsmt123”.
- Under “SW Directory”, select the correct firmware folder inside the extracted folder (European Gen1 firmware or Chinese v880 Gen2 firmware). ONLY flash the one appropriate for your phone.
- Leave the default settings as they are – “download cefs” ticked, “no backup restore” selected, and “download” selected.
- Go to the “Option” menu and select “Port Config”. Set line 1 to the COM port that you observed in step 3, then press OK.
- Press the purple arrow next to line 1 and wait for your phone to be flashed. When finished it should boot into FTM mode.
Edit “channel1.nvm” to hold IMEI
- In the flasher folder, open the file “channel1.nvm” with HxD, or a hex editor of your choice.
- Go to offset 0x1215. The IMEI is stored between offset 0x1215 and 0x121C. You need to read your correct IMEI from behind your battery and enter it here like this:
- In 0x1215 put the first digit of your IMEI followed by A. For each successive pair of digits, enter the second digit followed by the first digit. For example: and IMEI of 123456789012345 would be recorded at 0x1215 as 1A 32 54 76 98 10 32 54. When done, save this file.
Restore channel1.nvm to your phone
- Make sure channel1.nvm is in the folder next to the flasher with the correct IMEI.
- Connect your phone to your computer and turn on your phone with volume down held. It should boot into FTM mode.
- In the flasher, select “restore NV” and “RF/BT/IMEI/unLock info”, and press the purple arrow next to line 1. Your IMEI will now be restored to your phone.
Put clockworkmod in the recovery partition
- Take out the battery and turn on the phone. Clockworkmod should load.
- Clockworkmod is now installed to your phone’s boot partition. This means that if you install a ROM at this point you will overwrite clockworkmod. You must now flash the correct version of clockworkmod to the recovery partition.
- Go to “mounts and storage”, and select mount USB storage. Connect the phone to your computer and copy the correct version of clockworkmod as a zip file (Gen1 for European Gen1 firmware, Gen2 for Chinese firmware) to your SD card, then install it using clockworkmod.
- Restart your phone with volume down held. It should boot into clockworkmod. If it boots into FTM mode or does not progress pass the green android, reboot normally and make sure you flashed the correct version of clockworkmod.
You can now flash a ROM (If you flashed Gen1 firmware you can also upgrade to Gen2 via TPT). When you do, check your IMEI. If it is wrong, flash stock recovery in clockworkmod, boot into FTM mode, and repeat (correctly) above from editing channel1.nvm onwards.
I wrote this because it seems that quasi bricked Blades are becoming a daily event and there is much confusion about which solutions work in which circumstances. Please post with questions or feedback; it would be nice to know if this helps someone!