ZTE Blade X1001 — Root with Magisk (Android 15, Unisoc UMS9230)

⚠️ WARNING: Rooting a device can void the warranty, brick the device if done incorrectly, and erase all data. Proceed at your own risk. This repository is for educational purposes only.

Table of Contents

• Device information
• Prerequisites
• Phase 0 — Verify the device
• Phase 1 — Preparation on Windows
• Phase 2 — Run the CVE-2022-38694 exploit
• Phase 3 — Patch and install Magisk
• Final verification
• Troubleshooting

Device information

Prerequisites

Required software (all on Windows):

• ADB + Fastboot — Android Platform Tools
• SPD Research Driver R4.20.4201 — manufacturer: UNISOC Communications Inc.
• CVE-2022-38694 exploit script — ums9230_universal_unlock (UFS build)
• Magisk APK

Hardware:

• PC with Windows 10/11
• USB cable directly to PC (no hubs)
• Tablet with battery > 30%

Phase 0 — Verify the device

Before starting, confirm that your device matches this profile. With ADB active and the tablet connected, run these commands one by one:

adb shell getprop ro.board.platform
adb shell getprop ro.hardware
adb shell getprop ro.bootloader
adb shell getprop ro.build.version.security_patch
adb shell cat /proc/cpuinfo | head -20
adb shell ls -la /dev/block/ | grep -E "mmcblk|sd[a-z]"

With these results you can confirm:

• The chipset is UMS9230
• The storage is UFS (it will appear as sda/sdb/sdc, not mmcblk)
• The CVE-2022-38694 exploit is applicable

If the storage appears as mmcblk, use the eMMC build of the script instead of the UFS one.

Phase 1 — Preparation on Windows

1.1 — Install the SPD driver

1. Download and extract SPD_Driver_R4.20.4201.zip
2. Disconnect the tablet from the PC
3. Run the installer as administrator
4. Verify in Device Manager that the driver appears correctly under UNISOC Communications Inc.

1.2 — Prepare the unlock script

1. Download ums9230_universal_unlock.zip (UFS build)
2. Extract the contents into a path without spaces, e.g.:
   root@kitploit:~

   C:\unisoc_unlock\
   

1.3 — Verify Platform Tools

Make sure you have ADB and Fastboot available. If you installed them with Android Studio, they are usually located at:

C:\Users\YOUR_USER\AppData\Local\Android\Sdk\platform-tools\

To use them from any folder, add that path to the system environment variables (PATH).

Phase 2 — Run the CVE-2022-38694 exploit

This exploit writes directly to the bootloader configuration area via BROM (Boot ROM) mode, changing the oem_unlocked flag at hardware level and bypassing ZTE's verification.

Pre-checklist

• SPD driver installed and verified in Device Manager
• Script extracted in C:\unisoc_unlock\ (no spaces in the path)
• Tablet battery > 30%
• USB cable directly to PC, no hubs

Step 1 — Open CMD as administrator in the script folder

In Windows Explorer, navigate to C:\unisoc_unlock\. Click on the address bar, type cmd and press Enter. In the window that opens:

unlock_autopatch_9230.bat

You will see the message Waiting for device... — the script is waiting.

Step 2 — Enter BROM mode

With the script waiting:

1. Disconnect the USB from the tablet
2. Turn off the tablet completely (do not restart; wait until the screen is black and no vibration)
3. Hold Volume Down
4. While holding the button, connect the USB to the PC
5. Hold the button for 2–3 more seconds and release it

How to know it worked:

In Device Manager a new device will appear under Ports (COM & LPT) with a name similar to:

• Spreadtrum Phone
• SPRD U2S Diag (COMx)
• SPD...

If it appears with a yellow triangle → reinstall the SPD driver.
If nothing appears after 5 attempts → try Volume Up instead of Volume Down.

Step 3 — The script runs automatically

Once the device is detected, the script proceeds on its own. You will see messages similar to:

[*] Waiting for device in BROM mode...
[*] Device found!
[*] Connecting to BROM...
[*] Reading chipset info... UMS9230
[*] Sending exploit payload...
[*] Bypassing DAM...
[*] Writing unlock flag...
[*] Done! Rebooting device...

⚠️ During the entire process:

• DO NOT disconnect the USB
• DO NOT press any button on the tablet
• DO NOT close the script window
• The tablet screen may stay black — this is normal

Estimated duration: 1 to 3 minutes

Step 4 — Confirm the unlock

Upon reboot, the tablet may display an orange/yellow warning:

Your device software can't be checked for corruption. Please lock the bootloader.

That's a good sign. To confirm via commands:

adb reboot bootloader
fastboot getvar unlocked

The result should be unlocked: yes.

In addition, the script will have automatically generated a boot.bin file in the C:\unisoc_unlock\ folder. Rename it to boot.img:

copy C:\unisoc_unlock\boot.bin C:\unisoc_unlock\boot.img

Phase 3 — Patch and install Magisk

Step 1 — Install the Magisk APK on the tablet

adb install C:\path\to\Magisk.apk

Or download it directly from the tablet's browser from github.com/topjohnwu/Magisk/releases/latest.

Step 2 — Send boot.img to the tablet

adb push C:\unisoc_unlock\boot.img /sdcard/boot.img

Step 3 — Patch boot.img with Magisk

1. Open the Magisk app on the tablet
2. Press Install → Select and Patch a File
3. Select /sdcard/boot.img
4. Magisk will generate a patched file in /sdcard/Download/ with a name similar to magisk_patched-XXXXX_XXXXX.img

Step 4 — Retrieve the patched file to the PC

adb pull /sdcard/Download/magisk_patched-XXXXX_XXXXX.img C:\unisoc_unlock\magisk_patched.img

Step 5 — Flash to the active slot's boot partition

adb reboot bootloader
fastboot flash boot_b C:\unisoc_unlock\magisk_patched.img
fastboot reboot

If your active slot is not _b, adjust the command to boot_a.

Final verification

After reboot, open the Magisk app. If it shows as installed and with a version, root is active. You can also verify with any root checker app.

Troubleshooting

Credits

• CVE-2022-38694 exploit: TomKing062
• Magisk: topjohnwu

Documentation written for ZTE Blade X1001, firmware C1.0.10_X1001_EEA, Android 12.