How to Unlock the Bootloader and Root Moto Z2 Play (All Gens)

The Moto Z2 Play is a solid phone that was released earlier this year by Motorola (Lenovo). The phone replaced last year’s hugely-popular Moto Z Play and continues Motorola’s modularity paradigm. The phone, like its predecessor, sports a 5.5″ full-HD AMOLED display. Powering the device is Qualcomm’s Snapdragon 626 which is an overclocked upgrade to the 625 SoC. There are many people who harbor mixed feelings about Motorola’s newest offering in its Z line.

How to Root Moto Z2 Play

The phone was originally exclusive to Verizon in the US. Motorola has since then released SIM-unlocked variants of the device available for purchase across the globe i.e. the Retus Variant which is easier to unlock. In case you’ve gotten yourself any of the variants of this phone and would like to tinker with custom ROMs and mods, you would first need to flash a custom recovery like TWRP (TeamWin Recovery Project). However, before you can do any low-level modifications to your device, you would need to have the device’s bootloader unlocked.

Unfortunately, manufacturers ship their phones with the bootloader locked by default, and in most cases, trying to unlock the bootloader will void your device’s warranty. Unlocking your bootloader opens a world of possibilities. It gives you total control of the phone’s hardware and grants you root access. This notwithstanding, doing so compromises your phone’s security and makes your device especially liable to unforeseen threats.

It is, therefore, generally a good idea to leave your phone as it is, especially if you are not too sure of what you are doing. Another thing, the Moto Z2 Play ships with near-stock Android 7 Nougat with minimal bloatware. This is a compelling reason to leave the phone as it is. However, if you are experienced or willing enough to get your hands dirty, this guide will show you how to unlock the bootloader and root your Moto Z2 Play. Although, the bootloading and rooting procedure would be the same for both variants, the files to be downloaded will be different for both.

Before we proceed, I have to let you know that this procedure may not work if your device is Verizon-locked (VZW). In other words, DO NOT attempt to unlock if the device’s contract period has not expired. A pre-unlocked Moto Z2 Play is now also available for purchase online.

Now that this concern is out of the way, let’s get onto the procedure.

Important Notes:

• Going through this will break OTA updates to your device.
• You will need to format your data due to forced encryption. Remember to back up your data.
• The TWRP recovery linked to in this guide is an incomplete mod by twelfth (of XDA Developers). External SD card mounting therefore does not work (at the time of writing this guide).
• Under no circumstance should you flash SuperSU from within TWRP. You would have to instead install Magisk for that.

Pre-requisites:

1. Motorola Device Manger: Download
2. Minimal ADB & Fastboot Setup
3. ADB Driver
4. Charge your device’s battery upto 60% to avoid any shutdowns during the process.
5. Backup all your data, contacts, apps and important files as unlocking the bootloader erases everything in your Internal storage.
6. Modified TWRP by twelfth: Download
7. Magisk Manager: Download

Unlocking the Bootloader of Motorola Z2 Play

Step 1: First, make sure you have ADB drivers installed on your computer.

Step 2: Install the Motorola Device Manager and Minimal ADB & Fastboot.

Step 3: Connect your Moto Z2 Play to your computer.

Step 4: Enable Developer Options on the phone by going to Settings>>About phone and clicking on Build number 7 times (until Developer options will be enabled) Go to Settings>>Developer options and allow USB Debugging and OEM Unlocking by toggling the respective buttons on.

Step 5: Power off your device and reboot into bootloader mode by pressing and holding Volume Down + Power button simultaneously.

Step 6: Open the folder in which you installed the Minimal ADB and Fastboot on your computer. In this folder press Shift + Right click and select Open command window here.

Step 7: Type “fastboot devices” in the command window to ensure that your device is connected.

Step 8: Enter “fastboot oem get_unlock_data” to get unlock code.

Example: On a Windows Desktop, the returned string format would be

$ fastboot oem get_unlock_data
(bootloader) 0A40040192024205#4C4D3556313230
(bootloader) 30373731363031303332323239#BD00
(bootloader) 8A672BA4746C2CE02328A2AC0C39F95
(bootloader) 1A3E5#1F53280002000000000000000
(bootloader) 0000000

Example: On a Mac OS Desktop, the returned string format would be

INFO0A40040192024205#4C4D3556313230
INFO30373731363031303332323239#BD00
INFO8A672BA4746C2CE02328A2AC0C39F95
INFO1A3E5#1F53280002000000000000000
INFO0000000

Step 9:  Paste together the 5 lines of output into one continuous string without (bootloader) or ‘INFO’ or white spaces. Your string needs to look like this:

0A40040192024205#4C4D355631323030373731363031303332323239#BD008A672BA4746C2
CE02328A2AC0C39F951A3E5#1F532800020000000000000000000000

Step 10: Visit Motorola’s site and sign in to your Motorola account. Create a new account if you already do not have one.

Step 11: Paste the string into the specific field on Motorola site and click on “Can my device be unlocked”.

Step 12: If your device can be unlocked, “Request unlock key” will appear. Click on that and an unlock key will be sent to your email account.

Step 13: Check your mail and copy the unlock key.

Step 14: Go back into the command window and enter “fastboot oem unlock unlock–key“. Replace “unlock-key” with the unlock key Motorola sent you.

Wait for the bootloader to be unlocked.

Once your bootloader is unlocked, the phone will reboot. You can then proceed to flash a custom recovery for further rooting moto Z2 play. Follow the below-mentioned steps for the same.

Flash TWRP Recovery and Root Moto Z2 Play

Step 1: You must first unlock the bootloader on your Moto Z2 Play (with the above-mentioned steps)

Step 2: Boot the phone into Fastboot Mode by pressing and holding Volume Down + Power buttons simultaneously

Step 3. Connect the phone to the computer, making sure ADB drivers are properly installed

Step 4: Open fastboot command prompt inside the folder where you have it installed. The modded TWRP you downloaded should also be put in this folder.

Step 5: Transfer the downloaded TWRP Recovery file in the Minimal ADB Folder.

Step 6: Type the below command to boot Moto Z2 Play into TWRP Recovery mode.

fastboot boot albus_twrp.img

(Note that this command will boot the TWRP, but not flash it. Flashing this particular modded TWRP file is not recommended)

Step 7: Swipe to allow modification. Click ‘cancel’ when it asks for passphrase to read encrypted partition

Step 8: Press Wipe on main screen, select Data, cache, Dalvik and then slide to wipe. This will wipe Data, Cache and Dalvik partitions. You will need to do this because the partitions will have to remain unencrypted after you flash DM Verity and Encryption Disabler.

Step 9: Backup your device. Attempting to back up System Image may fail because the partition is over 4GB and nearly every thumbdrive will be formatted in Fat32. So backup System, Boot and Recovery.

Step 10: Install DM-Verity ZIP. Install Magisk ZIP linked in this thread to root your Moto Z2 Play.

Step 11: Reboot into system. Anticipate a longer first boot.

Step 12: Sideload Magisk Manager app.

That’s it. Your Moto Z2 Play (retus and verizon) is now rooted and is ready to provide you all the benefits that rooting a device bestows. You can now install Apps that require root access; also Xposed Framework and installer to perform system level modifications to add extra features to your device.