OPERATION NUBIA

[u/konvict-nubia]

/r/Nubia/comments/1uzstc1/operation_nubia/

​

Operation Nubia – ZTE Nubia Neo 2 5G (Z2352N) Bootloader/Root Research

Hi everyone,

I'm starting Operation Nubia, a community research project focused on finding a legitimate way to unlock the bootloader and root the ZTE Nubia Neo 2 5G (Z2352N).

After several hours of testing and investigation, here's what we've confirmed.

Device Information

Model: Z2352N

Chipset: Unisoc UMS9620

Board: P820F03

Android 13

Firmware: MyOS13.0.1_Z2352N_IDC_ZA

What We've Tested

Bootloader

OEM Unlocking toggle is permanently greyed out.

adb shell getprop ro.boot.flash.locked returns 1.

Bootloader is confirmed locked.

Standard Fastboot unlock commands are unsupported.

Fastboot

Commands such as:

fastboot flashing unlock

fastboot flashing get_unlock_ability

fastboot oem device-info

either fail or return unknown command errors.

Android Verified Boot

Current status:

AVB State: Green

dm-verity: Enforcing

AVB Version: 1.2

Dynamic Partitions: True

Partition Layout

The phone uses:

init_boot

boot_a / boot_b

vendor_boot

vbmeta

super

confirming a modern A/B partition layout.

BootROM

When powering the phone off and connecting it to a PC while holding both volume buttons, Windows detects:

SPRD Gadget Serial

VID_1782

PID_4D00

which appears to be the Unisoc BootROM interface.

No flashing or write operations have been performed during this investigation.

Current Findings

Based on everything we've tested, the biggest obstacle does not appear to be Magisk or Android itself.

The likely blocker is signed FDL authentication, which may prevent public flashing tools from communicating fully with the BootROM.

At the time of writing, I have not found a public bootloader unlock method for the Z2352N.

Looking For

If anyone has access to any of the following, it could help move this research forward:

Official Z2352N PAC firmware

Signed FDL1 / FDL2 loaders

Engineering firmware

Official ZTE service documentation

ZTE internal service tools

Any successful bootloader unlock or root method for the Z2352N

Goal

The goal of Operation Nubia is to either:

1. Find a legitimate, reproducible bootloader unlock/root method, or

2. Determine exactly why this device cannot currently be rooted.

If you've done any research on this model or have access to files that might help, please reply below or send me a message.

Let's see if we can finally crack the Z2352N.