For the next three hours, in the humming silence of the server room, Arun became a surgeon. He compared the P1T4 binary against a known good P1T2 binary. He located the bootloader check routine—a small set of assembly instructions at offset 0x47F2 . Using a guide from 2012, he patched the firmware, NOP-ing out the version check.

Arun looked at his own F601 on the bench. He pried open the case with a spudger. There, on a tiny sticker near the CPU, was the forbidden truth: .

Then he posted one message on that old Reddit thread:

He chose the third path. He downloaded the official P1T4. Then he downloaded a hex editor.

"No," he whispered.

Arun leaned back, exhausted but victorious. He packaged the patched firmware into a ZIP file. He named it ZTE_F601_V2.0.4P1T4_BL31_SAFE.bin . He uploaded it to a new, clean Google Drive folder.

At 5:53 AM, with the first light of dawn slipping through the blinds, he loaded the patched firmware onto a TFTP server. He connected a serial console cable to the F601. His hands trembled as he typed: