• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Stock Files: Deodexed & Unmodified ROMs, Recovery, Kernel

Man, this totally blows. I've had this device for like 2 years, and figured eventually root would be attainable. It's not a bad device, yes it's a little light on internal storage but with root and removal of bloat, it would improve somewhat. The phone doesn't spit out parse errors like some I've dealt with, so I'm generally happy with it, but not having root sucks completely. Temp root on this phone is essentially useless. I want to smash this thing with a hammer.
 
  • Like
Reactions: bcrichster
Upvote 0
anybody able to get root working and try it? find the ftm partition, and use a dd command to zero it out, completely trash the ftm, then try going into the ftm mode or running an adb reboot-bootloader, if you can gain fastboot access try the standard fastboot oem unlock command, then try fastboot boot on the twrp image. hopefully thatll work but i cant even get a temporary root :(

dd if=/dev/zero of=/dev/block/whatever the ftm is...
 
Upvote 0
I had gotten Temp Root with running Kingo Root on PC (gotta have the Kingo's "SuperUser.apk" from playstore installed on device prior to running PC app)
7bd9a02fa0f991fcc84197b04d54446e.jpg

& KingRoot.apk on device simultaneously. SuperR also done me up a TWRP for the device but once you change it out, all you get is like a dfu mode (black screen & red led) until you force reboot
I no longer have the device.. Gave it away. I'm still running the Warp Synce and there's a crapload of custom ROMs for it. I even managed to compile a cm12.1 (for the Sync) on my PC with help from phenomx4
 
Upvote 0
that works, ill take a look into it, i wanna see if i can find and destroy the ftm mode... i dont remember which device it was, might have been the warp 4g or something i dunno, but we figured out that you can destroy the ftm partition and then itll boot to fastboot instead, and once youre in fastboot... possibly unlock the bootloader and just boot the recovery without installing it which would bypass the protection and run it temporarily, at least allow modification of system, or if it unlocks the bootloader then hell we are in the clear install whatever the hell we want XD
 
  • Like
Reactions: bcrichster
Upvote 0
that works, ill take a look into it, i wanna see if i can find and destroy the ftm mode... i dont remember which device it was, might have been the warp 4g or something i dunno, but we figured out that you can destroy the ftm partition and then itll boot to fastboot instead, and once youre in fastboot... possibly unlock the bootloader and just boot the recovery without installing it which would bypass the protection and run it temporarily, at least allow modification of system, or if it unlocks the bootloader then hell we are in the clear install whatever the hell we want XD
Bangin'! Lemme know how it goes [emoji16]
The ftm thing.. Wasn't that the LG Realm also?

Post note: BTW, it's good to see ya again @junkie2100 !!
 
Last edited:
Upvote 0
its very possible that another phone had the same thing. i wont be able to work on it much right away though sadly but i gotta figure out something this is unacceptable... if anyone can get a temp root going and figure out which of these partitions is actually the ftm and then destroy it see if we can force fastboot then we might be in business right now though i gotta get to sleep its 8am and i have to work today...

Code:
shell@speed:/ $ cat /proc/partitions
cat /proc/partitions
major minor  #blocks  name

253        0     196608 zram0
179        0    7634944 mmcblk0
179        1      16384 mmcblk0p1
179        2      16384 mmcblk0p2
179        3      16384 mmcblk0p3
179        4      16384 mmcblk0p4
179        5      16384 mmcblk0p5
179        6      16384 mmcblk0p6
179        7      16384 mmcblk0p7
179        8      16384 mmcblk0p8
179        9      16384 mmcblk0p9
179       10      16384 mmcblk0p10
179       11      16384 mmcblk0p11
179       12      16384 mmcblk0p12
179       13      49152 mmcblk0p13
179       14      16384 mmcblk0p14
179       15      16384 mmcblk0p15
179       16      16384 mmcblk0p16
179       17      16384 mmcblk0p17
179       18      16384 mmcblk0p18
179       19      16384 mmcblk0p19
179       20      16384 mmcblk0p20
179       21      16384 mmcblk0p21
179       22     131072 mmcblk0p22
179       23      32768 mmcblk0p23
179       24      32768 mmcblk0p24
179       25      16384 mmcblk0p25
179       26      16384 mmcblk0p26
179       27      16384 mmcblk0p27
179       28      16384 mmcblk0p28
179       29      65536 mmcblk0p29
179       30     819200 mmcblk0p30
179       31    1572864 mmcblk0p31
179       32    4456448 mmcblk0p32
179       33      65536 mmcblk0p33
179       64       4096 mmcblk0rpmb
179      128    7761920 mmcblk1
179      129    7755299 mmcblk1p1
shell@speed:/ $ ls -l /dev/block/platform/7824900.sdhci/by-name
ls -l /dev/block/platform/7824900.sdhci/by-name
lrwxrwxrwx root     root              1971-03-16 18:57 DDR -> /dev/block/mmcblk0p3
lrwxrwxrwx root     root              1971-03-16 18:57 aboot -> /dev/block/mmcblk0p20
lrwxrwxrwx root     root              1971-03-16 18:57 abootbak -> /dev/block/mmcblk0p21
lrwxrwxrwx root     root              1971-03-16 18:57 boot -> /dev/block/mmcblk0p23
lrwxrwxrwx root     root              1971-03-16 18:57 cache -> /dev/block/mmcblk0p30
lrwxrwxrwx root     root              1971-03-16 18:57 carrier -> /dev/block/mmcblk0p33
lrwxrwxrwx root     root              1971-03-16 18:57 config -> /dev/block/mmcblk0p28
lrwxrwxrwx root     root              1971-03-16 18:57 fsc -> /dev/block/mmcblk0p16
lrwxrwxrwx root     root              1971-03-16 18:57 fsg -> /dev/block/mmcblk0p17
lrwxrwxrwx root     root              1971-03-16 18:57 hyp -> /dev/block/mmcblk0p8
lrwxrwxrwx root     root              1971-03-16 18:57 hypbak -> /dev/block/mmcblk0p9
lrwxrwxrwx root     root              1971-03-16 18:57 keystore -> /dev/block/mmcblk0p27
lrwxrwxrwx root     root              1971-03-16 18:57 misc -> /dev/block/mmcblk0p26
lrwxrwxrwx root     root              1971-03-16 18:57 modem -> /dev/block/mmcblk0p22
lrwxrwxrwx root     root              1971-03-16 18:57 modemst1 -> /dev/block/mmcblk0p18
lrwxrwxrwx root     root              1971-03-16 18:57 modemst2 -> /dev/block/mmcblk0p19
lrwxrwxrwx root     root              1971-03-16 18:57 oem -> /dev/block/mmcblk0p29
lrwxrwxrwx root     root              1971-03-16 18:57 pad -> /dev/block/mmcblk0p14
lrwxrwxrwx root     root              1971-03-16 18:57 persist -> /dev/block/mmcblk0p13
lrwxrwxrwx root     root              1971-03-16 18:57 recovery -> /dev/block/mmcblk0p24
lrwxrwxrwx root     root              1971-03-16 18:57 rpm -> /dev/block/mmcblk0p4
lrwxrwxrwx root     root              1971-03-16 18:57 rpmbak -> /dev/block/mmcblk0p5
lrwxrwxrwx root     root              1971-03-16 18:57 sbl1 -> /dev/block/mmcblk0p1
lrwxrwxrwx root     root              1971-03-16 18:57 sbl1bak -> /dev/block/mmcblk0p2
lrwxrwxrwx root     root              1971-03-16 18:57 sec -> /dev/block/mmcblk0p10
lrwxrwxrwx root     root              1971-03-16 18:57 splash -> /dev/block/mmcblk0p25
lrwxrwxrwx root     root              1971-03-16 18:57 ssd -> /dev/block/mmcblk0p15
lrwxrwxrwx root     root              1971-03-16 18:57 system -> /dev/block/mmcblk0p31
lrwxrwxrwx root     root              1971-03-16 18:57 tz -> /dev/block/mmcblk0p6
lrwxrwxrwx root     root              1971-03-16 18:57 tzbak -> /dev/block/mmcblk0p7
lrwxrwxrwx root     root              1971-03-16 18:57 userdata -> /dev/block/mmcblk0p32
lrwxrwxrwx root     root              1971-03-16 18:57 ztecfg -> /dev/block/mmcblk0p12
lrwxrwxrwx root     root              1971-03-16 18:57 ztelk -> /dev/block/mmcblk0p11
shell@speed:/ $

i know what some of them are already, the possibles are the zte ones, though ztecfg is less likely than ztelk dont know what either of them are though... i know its not fsg and im quite sure its not fsc either fsg is modem stuff... dont know what hyp is, or pad, and ssd and ddr would seem obvious but may not be its been a while they changed a lot of stuff
 
Last edited:
Upvote 0
Bahahahahah!!! hroark13 found that bit AFTER I got rid of my device.. Silly me. That's awesome on the permanent Root. Think that a TWRP will hold??

that i dont know... i assume the bootloader is still locked, BUT... theres always the ftm destruction option... im debating whether i can try it i need my phone for work but i want it so damned bad, i need a recovery before i go destroying the whole system partition lol. i dont have a backup phone but it might be worth trying still...
 
  • Like
Reactions: bcrichster
Upvote 0
that i dont know... i assume the bootloader is still locked, BUT... theres always the ftm destruction option... im debating whether i can try it i need my phone for work but i want it so damned bad, i need a recovery before i go destroying the whole system partition lol. i dont have a backup phone but it might be worth trying still...
If ya junkie that device, the Warp Sync is only $50 new. [emoji41]
 
Upvote 0
well.... the recovery still wont boot not sure if its the recovery itself or the bootloader is locked but we have nothing, im working on identifying the partitions, so far the ones i thought might be it seem to be zeroed out, oem, huge empty space, ztelk another empty space, ztecfg has its name and nothing else...

the only seemingly possible ones are hyp, rpm, and maybe fsg but i doubt fsg, its looking honestly like its the darned hyp or rpm partition i just dont know which one
 
Upvote 0
right but that is just a backup of hyp which doesnt seem to be relevant to our cause in a way we can use anyway, what im wondering is... is it even actually locked at this point or am i just flashing a bad recovery, i dont got the tools on me to modify a boot.img tho, you think you could crack the stock recovery open, change like one unimportant line of the init.rc or something, repack it and we see if that will boot?
 
Upvote 0
right but that is just a backup of hyp which doesnt seem to be relevant to our cause in a way we can use anyway, what im wondering is... is it even actually locked at this point or am i just flashing a bad recovery, i dont got the tools on me to modify a boot.img tho, you think you could crack the stock recovery open, change like one unimportant line of the init.rc or something, repack it and we see if that will boot?
Sure, but I don't know which line to remove & where from..
Edit: OK, init.rc file.. Which line? [emoji6]
 
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones