Root ZTE Zmax Pro Official Root Discussion

loonycgb2 · Mar 28, 2017

The option after cp "-a" is a combination of 3 other options.

It is copying all files, but is failing to change permissions which is no issue as we just need the files.

I appreciate the help guys, ill try to see what i can come up with as its a bit hard to root without a actual device.

Piplup702 · Mar 28, 2017

loonycgb2 said:
The option after cp "-a" is a combination of 3 other options.

It is copying all files, but is failing to change permissions which is no issue as we just need the files.

I appreciate the help guys, ill try to see what i can come up with as its a bit hard to root without a actual device.

Appreciate you trying man, got another 100mb and the upload will be done
Edit: https://drive.google.com/file/d/0B_T4Zb3ybDQ7Mm03Q2JualpqMEk/view?usp=drivesdk

loonycgb2 · Mar 28, 2017

Piplup702 said:
Appreciate you trying man, got another 100mb and the upload will be done
Edit: https://drive.google.com/file/d/0B_T4Zb3ybDQ7Mm03Q2JualpqMEk/view?usp=drivesdk

Downloading now thank you!

loonycgb2 · Mar 28, 2017

can someone please run this command and give me the output it gives from terminal?

setprop persist.sys.dlctrl 1

Beany23 · Mar 28, 2017

loonycgb2 said:
can someone please run this command and give me the output it gives from terminal?

setprop persist.sys.dlctrl 1[/QUOTE

I tried 2 ways. Setprop persist.sys.dpctrl. 1 and it said could not set blah blah blah then the second method which is the same thing as above except I added "set root" in front and it seemed to work how would I check?

tunajelly · Mar 28, 2017

loonycgb2 said:
can someone please run this command and give me the output it gives from terminal?

setprop persist.sys.dlctrl 1

u0_a152@urd:/ $ setprop persist.sys dlctrl 1
usage: setprop NAME VALUE

Sets an Android system property.

setprop: Max 2 arguments
1|u0_a152@urd:/ $

loonycgb2 · Mar 28, 2017

Beany23 said:
I tried 2 ways. Setprop persist.sys.dpctrl. 1 and it said could not set blah blah blah then the second method which is the same thing as above except I added "set root" in front and it seemed to work how would I check?

if you ran it the same as i typed it and it produced a could not set then it did not work

tunajelly said:
u0_a152@urd:/ $ setprop persist.sys dlctrl 1
usage: setprop NAME VALUE

Sets an Android system property.
1|u0_a152@urd:/ $

you missed the . between sys and dlctrl

anyway my main reason to try this was to see if they left it open considering they use busybox to activate download mode..

#!/system/bin/sh
#
# zte debug util
#BINDIR=/system/bin
#cd $BINDIR
#ln -s busybox [ > /dev/null 2>&1
#ln -s busybox test > /dev/null 2>&1
###########command lists#############
CMD_ENTERDOWNLOAD="enterdload"
CMD_ONEKEYLOGENABLE="enablelog"
CMD_ONEKEYLOGDISABLE="disablelog"
CMD_REBOOT="reboot"
CMD_PERFORMANCE="performance"
#####################################
echo "============debug util init==========="
utilpara=`getprop sys.zte.debugutil.data`
if busybox [ "$utilpara" == "" ];then
echo "debugutil not get any parameters, abort."
fi
if busybox [ "$utilpara" == "$CMD_ENTERDOWNLOAD" ];then
echo "cmd $utilpara starting..."
setprop persist.sys.dlctrl 1
echo "set download mode done!"
sleep 1
echo "sysrq-triggersystem will cause reboot soon!"
echo c > /proc/sysrq-trigger
sleep 1
fi
if busybox [ "$utilpara" == "$CMD_ONEKEYLOGENABLE" ];then
echo "cmd $utilpara starting..."
setprop persist.sys.dlctrl 1
setprop persist.sys.ztelog.enable 1
echo "set ztelog enable done."
sleep 1
echo "zte log full enable need resetart, executing reboot..."
reboot
fi
if busybox [ "$utilpara" == "$CMD_ONEKEYLOGDISABLE" ];then
echo "cmd $utilpara starting..."
setprop persist.sys.dlctrl 0
setprop persist.sys.ztelog.enable 0
echo "set ztelog disable done."
sleep 1
echo "zte log full disable need resetart, executing reboot..."
reboot
fi
if busybox [ "$utilpara" == "$CMD_REBOOT" ];then
echo "cmd $utilpara starting..."
reboot
fi

if busybox [ "$utilpara" == "$CMD_PERFORMANCE" ];then
echo "cmd $utilpara starting..."
/system/bin/performance1&
/system/bin/performance2&
fi

biledigger · Mar 28, 2017

It failed.

loonycgb2 · Mar 28, 2017

thank you.

Yes it may need to be run thru the zte debug util bash file so it can run under the system permission.

If we can achieve download mode then we can actually upload a new recovery to the phone.

But i dont know if the bash script still requires root to execute as i dont know the permissions for it.

Charles367 · Mar 29, 2017

Ok so I'm back after someone reported me as spam for suggesting a factory cable or wire tap. But this is good and we're making progress. I ran it it fails. Actually it ask if I mean something else but idk what to enter there. .. Built in root that needs zte permission sounds ridiculous but I wouldn't put it past them. I called them with the whole nine yards and he didn't know sh** . So idk. Off topic but what's the root process that still working on the axon 7 ? Even perhaps the mi max. Both very similar specs

loonycgb2 · Mar 29, 2017

Charles367 said:
Ok so I'm back after someone reported me as spam for suggesting a factory cable or wire tap. But this is good and we're making progress. I ran it it fails. Actually it ask if I mean something else but idk what to enter there. .. Built in root that needs zte permission sounds ridiculous but I wouldn't put it past them. I called them with the whole nine yards and he didn't know sh** . So idk. Off topic but what's the root process that still working on the axon 7 ? Even perhaps the mi max. Both very similar specs

Xiamoi/axon 7 all have had there firehose leaked which is a signed mbn that controls the structure of each device.

Unless another zte employee decides to leak one for the pro then that is currently not an option.

Charles367 · Mar 29, 2017

Then that sounds like it may be our only option unless someone creates one. And I have no idea if that's possible?? F**k android is now ios

Charles367 · Mar 29, 2017

Could we in any way even bricking a device manage to get the key? I'll donate my phone for something in trade.

loonycgb2 · Mar 29, 2017

Charles367 said:
Could we in any way even bricking a device manage to get the key? I'll donate my phone for something in trade.

Well as newer updates come of android, then more flaws will be found as coders tend to leave many vulnerabilities as they add features.

Soon there will be an exploit found which can be used on this phone.

But really how will anyone know if currently no one who owns this phone has ever rooted or have the knowledge to fully find exploits?

Messi is the only other person and he received a donated phone, but who knows what hes found or tried yet.

I personally dont request donations for phones and such as im not as advanced as jcase and rather not waste anyone money if i dont find a opportunity to get root.

tunajelly · Mar 29, 2017

Ya I thought Messi was close at one point working on a script but I have not heard anything. I'm thinking in the next few months. Or when the next model gets released. The main reason I want root is to remove the system apps I don't use. I tried a non root method with no luck dis abling is a joke but helps. But when root is achieved I will most likely end up going for a custom ROM if available down the road but seeing this phone has some glitches I can't see custom ROMs doing better. I have since updated and very pleased with the phone even w/ out root. Cheers hope 1 y'all gets it

Ethorbit · Mar 29, 2017

BluntBlowin994 said:
Precisely and I want to know how he managed to get them into data/data/ nonetheless. Root is closer than we think guys

Lol.. Closer than we think in a 70 page thread.

peekay19 · Mar 29, 2017

Are we able to exploit pileup vulnerabilities on this device? Is there a way of checking for pileup vulnerabilities?

Greysworld007 · Mar 29, 2017

Yes @messi received a donation phone. He tried every possible way. The reason you haven't heard from him is because he already told y'all there are only two ways two root this phone.

enesha · Mar 29, 2017

Billyckansbar said:
I wear a tinfoil hat as well. It makes sense that zte would watch this forum to patch their phones. This guy got a couple people to update their phones, and that's a shame. What a waste to have devs watching this forum (the time the money) when if word got around that zmax pro had root zte would sell more phones. Isn't that your goal zte? I guess I don't understand it, but it seems simple.

I have to say I'm as paranoid as you can get, but even I find it pretty crazy. I sincerely doubt that the company is spending valuable time tracking the various forums just to track our progress to stop us. Just doesn't make sense. I mean think about it... Why? To prevent us from getting root? I eagerly they have better things to do than track the community that closely and try to thwart is at every turn. They sent out the software the way they did then walk away. Sure the updates will have but fixes but I doubt derived be spying on us. They made it hard to root and if we find a way it's easier for they to just disclaim warranty etc than some vast spring conspiracy. This is from someone who encrypts everything, uses multiple VPN's, etc. I just don't see how that level of tracking and counter intelligence measures makes business sense... Paying someone to spy etc. Just can't see a justification. Maybe the NSA pulls that but ZTE? They want a secure product sure, but they are not, I'm sure, against the increased sales a rooted phone might get. I imagine they only have it this secure to protect the average users and because of contractual restrictions with carriers. Just my 2¢ tho... They aren't that fast patching bugs but they are hyper aware to patch root avenues. What next accuse them of reading messages to Messi or other developers? I love a conspiracy but it had to be logical

enesha · Mar 29, 2017

asianrocker said:
OK. I found out something really interesting guys. We also have toybox! Google it. And android built it in all their marshmallow devices!! You can access it in terminal emulator just type toybox it works like busybox!

Correct me if I'm wrong but I wouldn't put too much stock in toybox, I doubt they made that move for a secret purpose. I assume it's more for licensing issues. In the same way that in the Linux world most or all distros dumped the pico editor years ago for the almost exactly same nano. There were licensing restrictions distributing pico (from UW if I remember) so the community just made their own. Neither one is better IMHO but the developers didn't had too restrictive of a license. BusyBox is not built by Google so maybe that developer/team didn't want it used in a commercial product w/o compensation or something. - from Wikipedia "The Toybox project was started in 2006, and became a BSD-licensed BusyBox alternative.". It's just a licensing thing.

loonycgb2 · Mar 29, 2017

Greysworld007 said:
Yes @messi received a donation phone. He tried every possible way. The reason you haven't heard from him is because he already told y'all there are only two ways two root this phone.

Are you talking about the post he posted after i let him know there "is" a temp root solution, but it is not viable?

He repeated what i had said was available as far as options which is why i said i dont know what all he knows.

loonycgb2 · Mar 29, 2017

enesha said:
Correct me if I'm wrong but I wouldn't put too much stock in toybox, I doubt they made that move for a secret purpose. I assume it's more for licensing issues. In the same way that in the Linux world most or all distros dumped the pico editor years ago for the almost exactly same nano. There were licensing restrictions distributing pico (from UW if I remember) so the community just made their own. Neither one is better IMHO but the developers didn't had too restrictive of a license. BusyBox is not built by Google so maybe that developer/team didn't want it used in a commercial product w/o compensation or something. - from Wikipedia "The Toybox project was started in 2006, and became a BSD-licensed BusyBox alternative.". It's just a licensing thing.

The zmax pro includes both toybox and busybox in stock.

asianrocker · Mar 29, 2017

Hey try this on emulator:

cd $bindir
Toybox mount -o remount,re

LOL. WTF did I just do. Is re even a valid command?

Hmmm I did
Toybox mount -o remount,rw

With same output. So did I mount it rw? I can see most directories have been mounted rewritable except for rootfs it is still in ro mode.

I crack it huh? OR not? Anyone?

Holy shit guys selinux dir is rw mode! go crack it!

armandop_ · Mar 29, 2017

asianrocker said:
Hey try this on emulator:
cd $bindir

Toybox mount -o remount,re
LOL. WTF did I just do. Is re even a valid command?
Hmmm I did

Toybox mount -o remount,rw
With same output. So did I mount it rw? I can see most directories have been mounted rewritable except for rootfs it is still in ro mode.
I crack it huh? OR not? Anyone?

No, I tried it and it still gave me write errors

asianrocker · Mar 29, 2017

armandop_ said:
No, I tried it and it still gave me write errors

Yeah I tried setenforce command I got permission denied. But is your output has ro and rw on file list?

Root ZTE Zmax Pro Official Root Discussion

Android Enthusiast

Member

Android Enthusiast

Android Enthusiast

Member

Lurker

Android Enthusiast

Well-Known Member

Android Enthusiast

Well-Known Member

Android Enthusiast

Well-Known Member

Well-Known Member

Android Enthusiast

Lurker

Member

Lurker

Well-Known Member

Member

Member

Android Enthusiast

Android Enthusiast

Android Enthusiast

Member

Android Enthusiast

BEST TECH IN 2023

Smartphones

Best Android Phones

Upcoming

Best iPhones

Upcoming

Tablets

Best Tablets

Upcoming

Laptops

Best Laptops

Upcoming

Televisions

Best TVs

Upcoming

Game Consoles

Best Game Consoles

Upcoming

Wearables

Best Wearables

Upcoming

Smart Home

Smart Home Tech

Upcoming

Similar threads