Unbricking, restoring and rooting a Z530 smartphone

I bricked an Acer Liquid Z530 smartphone by trying to flash TWRP on it, unbricked it with SP Flash Tool, restored the original official firmware and rooted it.

A relative of mine has an Acer Liquid Z530 model T02 low-end smart phone running Android 5.1. The phone said "no space left" on the internal memory, although it has a 32 GB micro SD card to store images and videos on.

"System data" uses all space on sdcard1 Disk Usage (available on F-Droid) showed that of the 3.2 GiB accessible internal memory, 3.1 GiB were in use by "System data".

Via ADB I got the same information:

shell@acer_T02:/ $ df  
Filesystem               Size     Used     Free   Blksize
/system                  3.0G     2.6G   473.2M   4096
/data                    3.2G     3.1G   109.9M   4096
/storage/sdcard1         3.2G     3.1G    59.9M   4096
/mnt/media_rw/sdcard0   29.8G    98.6M    29.7G   32768

More information were not available because the phone was not rooted and I could not access the partition for examination.

How to brick the phone

Rooting an Android Phone involves downloading Chainfire's SuperSU which contains an su binary and an app that shows a confirmation screen whenever super user rights are requested.

The su binary can only be installed in recovery mode, usually with a recovery manager like TWRP because the normal stock recovery tools only allow installation of signed .zip files.

Installation of TWRP is easy: Unlock the bootloader and then install TWRP by running

$ fastboot flash recovery twrp-1.2.3.img
$ fastboot reboot

I downloaded the unofficial TWRP for Z530, ran the steps above and the phone was stuck in a boot loop. It started up for about 5 seconds and then rebooted.

Recovering from boot loop

It turns out that low-price android devices often are based on MediaTek chips/boards, and those want to be flashed with their own tool: SP Flash Tool.

SP flash tool does not work with the official Z530 firmware provided by Acer (OS_Acer_AV0L0.1.034.00.WW.GEN1_A51L_A.zip) but needs a special crafted Acer Liquid Z530 T02 Stock Firmware (Flash File) file that can be downloaded from AndroidMTK.com. (Acer_Liquid_Z530_T02_MT6735_07192017_5.1.zip)

I installed SP flash tool on Windows (it does not work on Ubuntu 18.04 [kernel too old] and neither on Debian unstable [libpng12.so.0 missing]) and had to install all of the firmware parts. Just flashing the boot image did not work, it led to a boot loop of 30 seconds.

Following the how to flash instructions is important:

  1. Remove battery from phone
  2. Do not connect your phone to computer yet
  3. Do all the settings in SP flash tool
  4. Click download
  5. Now connect the phone via USB
  6. Flashing will start (may take some time until you see something in flash tool)

After the new firmware had been flashed onto the Z530 (and all user data had been lost), it booted up again and I could select the language.. chinese or english :/

Installing original firmware

After getting the phone to start up, I wanted the German language back.

I downloaded the official Z530 firmware provided by Acer (OS_Acer_AV0L0.1.034.00.WW.GEN1_A51L_A.zip), copied it onto the micro SD card and then started the phone in official recovery mode by pressing Power and Volume up for ~ 15 seconds until the green recovery mode screen was visible.

After selecting the .zip file for recovery I got an error message:

Opening update package...
Installing update...
This package is for "WW_GEN1" sku; this is a "AAP_SUN".
Installation aborted

AAP is "Asia PAcific", and the German firmware could not be installed onto that one :/

Acer Z530 recovery mode Error trying to install WW_GEN1 over AAP_SUN firmware

The SKU or "Carrier ID" can be changed: The Acer Z530 service manual page 10 shows a Switch Carrier ID application that can be used. Unfortunately this app was not available and I could not access is via the #2237243# dial code.

I tried to find a SP flash tools compatible german firmware file (or at least one with WW_GEN1) and got hold of FirmwareX.Net_Acer_AV0L0_Z530_1.025.00_WW_GEN1_MT6735.rar but that one could not be flashed at all.

I was lost until I remembered that I only needed a recovery tool that did not do such silly SKU/CID checks.. TWRP!

Installing TWRP

I already knew that flashing the recovery "partition" with fastboot would not work, and I knew that flashing with SP flash tools did work.

In the extracted Acer_Liquid_Z530_T02_MT6735_07192017_5.1.zip I replaced recovery.img with the TWRP image file from unofficial TWRP for Z530. Then I used SP flash tool to only flash the recovery partition, and that worked fine!

I booted up the phone into recovery mode by keeping Power + Volume Up pressed and was greeted with the TWRP splash screen.

TWRP: Installing official german Z530 firmware TWRP: Success

TWRP had no problems flashing the WW_GEN1 firmware over the AAP_SUN one. Now I could finally select "German" as language.

Success! Setup screen with German language

Rooting

With TWRP working, I could easily install the SuperSU zip file via recovery mode and had root access, which finally let me inspect the "system data" partition.

Cleanup

The Acer stock firmware comes with many unneeded pre-installed applications, and I used adb shell + root to get rid of them by finding the package name with

$ pm list packages $keyword

and then removing the application with

$ pm uninstall $packagename

Some could not be removed at all despite root access, so I disabled them with

$ pm disable $packagename

After removing and disabling those packages, /storage/sdcard1 (a.k.a /data) was still pretty full:

655 MiB /data/data/com.android.providers.downloads
656 MiB /data/dalvik-cache
500 MiB /data/app
 96 MiB /data/app-lib

I deleted all download files and everything in app-lib except PreinstallProvider-Acer_58.

As result, the data partition has 1.32 GiB of free space now:

1.32 GiB of free space now

Findings

Mediatek Engineer mode

You may start the "engineer mode" via adb shell:

$ am start -n com.mediatek.engineermode/com.mediatek.engineermode.EngineerMode

Engineer mode: Telephony menu Engineer mode: Telephony menu #2 Engineer mode: Log and Debugging Engineer mode: YGPS

Switch Carrier ID

The official German Z530 firmware from Acer's site did contain the "Switch CID" app. It's hidden in the com.cci.nvramapp package and can be started with the dial code or adb shell:

$ am start -n com.cci.nvramapp/com.cci.nvramapp.NvRamActivity

Carrier ID selection Switch Carrier ID app

Disable "Left Page"

The unnerving "Acer Left page" home screen can be disabled by:

  1. long tap on home screen
  2. tap on settings
  3. turn off Left Page

F-Droid: Der Erweiterung wurden keine Sonderrechte erteilt

You need to install the F-Droid service extension via recovery/TWRP and not just via F-Droid itself.

Written by Christian Weiske.

Comments? Please send an e-mail.