To understand the appeal of custom firmware, one must first appreciate the constraints of the original software. When shipped by an ISP, the B760HS2 runs a heavily modified version of Android (typically 4.4.2 or 5.1.1, though hardware supports later versions). The interface is branded to the provider, and the application launcher is restricted to the operator’s proprietary IPTV app. The user cannot install third-party applications from sources like the Google Play Store; the USB debugging port is often disabled; ADB (Android Debug Bridge) access is password-protected; and the bootloader is locked to prevent unsigned code from executing.
Furthermore, the device’s full potential is squandered. The HiSilicon Hi3798M system-on-chip (SoC) features a quad-core ARM Cortex-A7 processor, a Mali-450 GPU, and hardware decoding for H.265/HEVC, making it perfectly capable of functioning as a general-purpose Android media center. However, the stock firmware blocks access to the underlying Linux kernel, prevents root privileges, and restricts storage to a tiny system partition. In essence, the user does not own the device they paid for—they merely rent a portal to their ISP’s service.
Flashing custom firmware voids any ISP support. The box will no longer function with the provider's IPTV services.
Before exploring the firmware creation process, one must understand the hardware. The ZXV10 B760HS2 is built around the Hisilicon Hi3798M (or, in some revisions, the Hi3798MV100). Key specifications include: Zte Zxv10 B760hs2 Custom Firmware
The critical element for custom firmware is the bootloader lock. In stock configuration, the bootloader verifies the digital signature of the kernel and system partitions. If a non-signed image is detected, the device refuses to boot or enters a recovery loop. Custom firmware development, therefore, begins with bypassing or replacing this bootloader.
Flip the device over and remove the rubber feet. Usually, there are Phillips-head screws hidden underneath. Once unscrewed, use a plastic pry tool to pop the plastic clips holding the top shell. Be gentle; the plastic clips are brittle.
You cannot easily transfer large files over the serial connection. You need to use TFTP (Trivial File Transfer Protocol). To understand the appeal of custom firmware, one
In the U-Boot console, you will set environment variables to tell the box where the file is:
setenv ipaddr 192.168.1.100 # Assign a temporary IP to the box
setenv serverip 192.168.1.50 # The IP of your PC running TFTP
tftp 0x44000000 custom_image.img # Download the image to RAM
Once the file is loaded into memory (RAM), you must write it to the internal NAND flash storage. The command varies based on the partition layout, but it generally looks like:
nand write 0x44000000 0x00000000 [filesize]
Note: The memory addresses and commands above are generalized examples. You must refer to a specific guide for your exact board revision, as writing to the wrong address corrupts the bootloader permanently. The critical element for custom firmware is the
If the write succeeds, you type boot or reset the device.
Plug the USB adapter into your PC. Open a terminal program like PuTTY or TeraTerm on Windows (or screen on Linux/Mac). Set the baud rate. For HiSilicon chips, this is typically 115200.
Power on the ZTE box. If your connections are correct, you will see a stream of "boot logs"—lines of code scrolling rapidly on your screen. This is the BIOS of the Android box waking up.