Root ZTE Zmax Pro Official Root Discussion

[Bigcountry907]

All we need is the physical bootloader, and BootStomp will do the hard part of actually analyzing it. Anyone got a bootloader rip?

Why not run this on the axon 7 N bootloader. (aboot).
I actually have IDA Pro for linux but im not sure if the decompiler is included.

One thing i have been thinking about this whole time I leveraging a sdcard to get in. But i need to do alot more research on sdcards and ZTE.

I was able to unlock HTC Verizon Bootloaders by creating a bootable sd card that contained HTC Firmware from carrier devices that allowed unlocking.

If i had a device GPT and a Device Backup I could burn a bootable sd card. Depending on weather this sdcard boot function is disabled by ZTE it could be another way in.

https://forum.xda-developers.com/desire-526/general/verizon-htc-desire-526-boot-loader-root-t3587118

https://forum.xda-developers.com/desire-526/general/super-sd-htc-526-vzw-t3596497

The big advantage here is we dont need the ability to edit anything on our locked devices.
All editing and testing is done to the SD Card.
This makes it so you can try anything and not worry about bricking.
You just pull the sd card out and re burn it.

 

[Bigcountry907]

Link to BootStomp https://github.com/ucsb-seclab/BootStomp
All we need is the physical bootloader, and BootStomp will do the hard part of actually analyzing it. Anyone got a bootloader rip?

Lets run this on the Axon 7 Nougat bootloader. (aboot)
I would think our devices would have any found vulnerabilities as well.

You will need IDA Pro and Hexrays decompiler.
I have IDA for ubuntu but im not sure about the decompiler.
Anyway i will see what i can do.

 

[SapphireEx]

Did you see my inquiries

Ah, I see them now. I'll edit this once I run them.

*Edit @messi2050 Nothing. Only request is available.

1|shell@urd:/system $ mkdir /system/test
mkdir: '/system/test': Read-only file system
1|shell@urd:/system $ cd /dev/block/by-name/
/system/bin/sh: cd: /dev/block/by-name: Permission denied
2|shell@urd:/system $

 

[SapphireEx]

Lets run this on the Axon 7 Nougat bootloader. (aboot)

<br> I would think our devices would have any found vulnerabilities as well.

<br>

<br> You will need IDA Pro and Hexrays decompiler.

<br> I have IDA for ubuntu but im not sure about the decompiler.

<br> Anyway i will see what i can do.

I'm not saying pirate it, but 1,409$ is 1,409$.
I doubt ZTE/Qualcomm would have changed things up between bootloaders due to them being closed source, and rarely actually touched, so I'm with you on that. If the axon7 has a glaring bug, the Z981 should as well.
I have no idea on how I would go about actually exploiting any bugs we found though. Sure, if it allows booting from state drives then hosting the firmware on an SD would be a viable option, but if it doesn't, I wouldn't even begin to know how to interface with the bootloader to actually exploit it.

 

[Greysworld007]

No reply back from Amazon sellers. Today my zmaxpro Wich is on b20 just tried to update the firmware on it's own.

 

[Bigcountry907]

I'm not saying pirate it, but 1,409$ is 1,409$.

I wouldn't even begin to know how to interface with the bootloader to actually exploit it.

I know IDA has some of the older versions that are free to use for the general public. And im pretty sure you can get a demo of the decompiler. Knowing how to use IDA could be the hard part but there are some good tutorials.

As far as how to use an vulnerability I would think a method similar to thees would work.

http://bits-please.blogspot.com/2016/02/unlocking-motorola-bootloader.html

http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html

Despite using it for the reverse of unlocking.
This is a very good article.

https://ge0n0sis.github.io/posts/20...-mode-using-an-undocumented-feature-of-aboot/

http://newandroidbook.com/AIvI-M-RL1.pdf

http://newandroidbook.com/Articles/aboot.html

Now if one can understand and put all those things together you can figure out how to use an exploit.

 

[SapphireEx]

I know IDA has some of the older versions that are free to use for the general public. And im pretty sure you can get a demo of the decompiler. Knowing how to use IDA could be the hard part but there are some good tutorials.

As far as how to use an vulnerability I would think a method similar to thees would work.

http://bits-please.blogspot.com/2016/02/unlocking-motorola-bootloader.html

http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html

Despite using it for the reverse of unlocking.
This is a very good article.

https://ge0n0sis.github.io/posts/20...-mode-using-an-undocumented-feature-of-aboot/

http://newandroidbook.com/AIvI-M-RL1.pdf

http://newandroidbook.com/Articles/aboot.html

Now if one can understand and put all those things together you can figure out how to use an exploit.

I'm quite adept at reverse engineering and use decompilers. I don't have IDA though. I use X64DBG for all my debugging needs.

 

[GarnetSunset]

I know IDA has some of the older versions that are free to use for the general public. And im pretty sure you can get a demo of the decompiler. Knowing how to use IDA could be the hard part but there are some good tutorials.

As far as how to use an vulnerability I would think a method similar to thees would work.

http://bits-please.blogspot.com/2016/02/unlocking-motorola-bootloader.html

http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html

Despite using it for the reverse of unlocking.
This is a very good article.

https://ge0n0sis.github.io/posts/20...-mode-using-an-undocumented-feature-of-aboot/

http://newandroidbook.com/AIvI-M-RL1.pdf

http://newandroidbook.com/Articles/aboot.html

Now if one can understand and put all those things together you can figure out how to use an exploit.

Keep in mind those are curated exclusively for the Snapdragon 800 chipset which features a nasty bug.

 

[SapphireEx]

Keep in mind those are curated exclusively for the Snapdragon 800 chipset which features a nasty bug.

Hopefully BootStomp provides us with a killer bug. I'd much rather just flash Messi's TWRP than attempt to execute an overflow bug.

 

[NeoZiggy]

That's the endgame nerd.

I prefer Geek, but a compliment none the less.
My bad, I had a few too many cold ones. My laptop should be back later this week if there's anything I can help with (Linux setup to compile ROMs).

 

[messi2050]

Hopefully BootStomp provides us with a killer bug. I'd much rather just flash Messi's TWRP than attempt to execute an overflow bug.

is not that easy flashing twrp on a locked bootloader device will trigger dm-verity and you will be send to that screen [ adb reboot unauth].

 

[SapphireEx]

is not that easy flashing twrp on a locked bootloader device will trigger dm-verity and you will be send to that screen [ adb reboot unauth].

Oh I know. That's why I want to see an exploitable bug in our bootloaders to actually get the ball rolling on breaking the phone.

 

[Bigcountry907]

Well about all i can think of to do now is try to burn a sd card with the axon 7 partitions and GPT. The hope would be that our device reads the fbop partition and opens up fastboot access.

If there was a temp root or a way to get a backup of our devices the chances i could make it work would be much higher.

So generally i am passing some time.
My skills aren't so great when it comes to aboot disassembly. I'm pretty good with a hex editor and linux terminal but i need to learn arm code and dissassembly.

 

[SapphireEx]

Well about all i can think of to do now is try to burn a sd card with the axon 7 partitions and GPT. The hope would be that our device reads the fbop partition and opens up fastboot access.

<br>

<br> If there was a temp root or a way to get a backup of our devices the chances i could make it work would be much higher.

<br>

<br> So generally i am passing some time.

<br> My skills aren't so great when it comes to aboot disassembly. I'm pretty good with a hex editor and linux terminal but i need to learn arm code and dissassembly.

We have temp root, but it lasts for literally a few CPU cycles before restarting and clearing the root.

 

[loonycgb2]

Well about all i can think of to do now is try to burn a sd card with the axon 7 partitions and GPT. The hope would be that our device reads the fbop partition and opens up fastboot access.

If there was a temp root or a way to get a backup of our devices the chances i could make it work would be much higher.

So generally i am passing some time.
My skills aren't so great when it comes to aboot disassembly. I'm pretty good with a hex editor and linux terminal but i need to learn arm code and dissassembly.

If you can manage to get a aboot image I can deal with the arm code and removing encryption flags.

Only other way someone can get a copy that I know of is to take the time to convert the patch file in one of the updates to a regular image.

 

[NeoZiggy]

We have temp root, but it lasts for literally a few CPU cycles before restarting and clearing the root.

Any chance to slow down the cpu within that time... Or some trick like a "Do Loop" type of command to keep it from initiating a reboot?

 

[fspkwon]

_content_removed

 

[fspkwon]

_content_removed

 

[GrifterGrifts]

is not that easy flashing twrp on a locked bootloader device will trigger dm-verity and you will be send to that screen [ adb reboot unauth].

I've heard that the screen executed by adb reboot unauth is on its own partition hidden until the phone is modified maybe with any of the possible above exploits if we could disable it completely we could make the whole partition useless so adb reboot unauth would be no different than typing adb reboot ysydhd which will default to system giving it's possible root if paired with an exploit idk it's all speculation

 

[messi2050]

I've heard that the screen executed by adb reboot unauth is on its own partition hidden until the phone is modified maybe with any of the possible above exploits if we could disable it completely we could make the whole partition useless so adb reboot unauth would be no different than typing adb reboot ysydhd which will default to system giving it's possible root if paired with an exploit idk it's all speculation

Yes it get enabled when the device detect changes on boot, It can't be disabled as built in kernel, no communications are available when you are in this mode is just a way to force you to not use your device after making modifications to it.

 

[Chloe936]

Hey, Everyone. Sorry to say I am one of the few that has been lurking since the old post got taken down due to off topic stuff.
Anyways! I have a zmax pro on b01 I have never updated. It was from Walmart on T. I did say I was lurking for awhile, as for b00 I never knew it existed. I got my zmax pro back in Aug of last year.
(Honestly I wonder if the ones still left in Walmart are on b01...)

 

[Nyrixa]

My charger crapped out on me, so I have to get a new one. However I did come across the Google source site that says we need the dev key for signing recovery images, it's for Oreo, but maybe it can help us to remove verity or get rolling on a permanent root for our 981. https://android.googlesource.com/platform/build/+/oreo-r6-release/target/product/verity.mk#17

 

[Y314K]

Hey, Everyone. Sorry to say I am one of the few that has been lurking since the old post got taken down due to off topic stuff.
<br> Anyways! I have a zmax pro on b01 I have never updated. It was from Walmart on T. I did say I was lurking for awhile, as for b00 I never knew it existed. I got my zmax pro back in Aug of last year.
<br> (Honestly I wonder if the ones still left in Walmart are on b01...)

Doubt about them still being available at Walmart. But you never know. Maybe the ones that can dump them can check a few stores. Is that phone your daily driver ? Would you want to just donate it or would you prefer to exchange your T-B01 for a M-B08. Or would you like to get specifics instructions on how to try to dump your phones FW yourself. Not sure what it would all in tale. What are your thoughts right now ?

 

[messi2050]

Hey, Everyone. Sorry to say I am one of the few that has been lurking since the old post got taken down due to off topic stuff.
Anyways! I have a zmax pro on b01 I have never updated. It was from Walmart on T. I did say I was lurking for awhile, as for b00 I never knew it existed. I got my zmax pro back in Aug of last year.
(Honestly I wonder if the ones still left in Walmart are on b01...)

Does issuing the command
Adb reboot bootloader
Send you to fastboot or it just reboots back to system

 

[Y314K]

Hey, Everyone. Sorry to say I am one of the few that has been lurking since the old post got taken down due to off topic stuff.

<br> Anyways! I have a zmax pro on b01 I have never updated. It was from Walmart on T. I did say I was lurking for awhile, as for b00 I never knew it existed. I got my zmax pro back in Aug of last year.

<br> (Honestly I wonder if the ones still left in Walmart are on b01...)

Now you are reading B01 in the Build Number right ? & Not on the BaseBand ?