Root ZTE Zmax Pro Official Root Discussion

theanimespuddy · Aug 18, 2017

SapphireEx said:
If you could rip that update, that'd be great. I want to see specifically what they are patching

I got my Zmax Pro when it first came out, I've never updated it (Baseband version: Z981V1.0.0B08)
Any way I could be of help?

Spec2nirvash · Aug 18, 2017

theanimespuddy said:
I got my Zmax Pro when it first came out, I've never updated it (Baseband version: Z981V1.0.0B08)

<br> Any way I could be of help?

Probably not

SapphireEx · Aug 18, 2017

theanimespuddy said:
I got my Zmax Pro when it first came out, I've never updated it (Baseband version: Z981V1.0.0B08)
Any way I could be of help?

B08 and B14 have been dumped already. You could be useful for testing exploits though.

theanimespuddy · Aug 18, 2017

SapphireEx said:
B08 and B14 have been dumped already. You could be useful for testing exploits though.

I've never delved too deep into all of this, but feel free to tell me what needs to be tested
I plan on checking here regularly

Deleted User · Aug 18, 2017

theanimespuddy said:
I've never delved too deep into all of this, but feel free to tell me what needs to be tested
I plan on checking here regularly

Checking through the last 2700+ posts of this thread, plus the 1000+ posts of the previous thread should keep you busy for a while

SapphireEx · Aug 18, 2017

LV426 said:
Checking through the last 2700+ posts of this thread, plus the 1000+ posts of the previous thread should keep you busy for a while

Man that's depressing. All these posts and little progress. We'll get there though, one way or another.

Nyrixa · Aug 18, 2017

What's needed for trying to grab the signing keys from the ota update? I haven't updated yet so, I can try to see if I can't get what we need. @SapphireEx @messi2050

SapphireEx · Aug 18, 2017

Nyrixa said:
What's needed for trying to grab the signing keys from the ota update? I haven't updated yet so, I can try to see if I can't get what we need. @SapphireEx @messi2050

A ZTE employee lanyard.

Or a nation class super computer.

*Edit That sounded a bit dickish. But it's true. End users almost never get access to OEM keys, and if we do, it's due to a VERY lucky bruteforce, or an employee leaking it (ZTE AXON).

Nyrixa · Aug 18, 2017

Well hell, all I have is a pen testing dedicated system. Definitely not a server.

SapphireEx · Aug 18, 2017

Nyrixa said:
Well hell, all I have is a pen testing dedicated system. Definitely not a server.

I'm assuming Kali/ Backtrack. You could always help @GarnetSunset with Broadpwn (It's a very complex exploit. Easy to execute, but extremely rough in actually exploiting), or send metasploit payloads to the phone and hope something happens. If you are skilled with reverse engineering, you could always poke the phone with us and see what comes up.

Nyrixa · Aug 18, 2017

SapphireEx said:
I'm assuming Kali/ Backtrack. You could always help @GarnetSunset with Broadpwn (It's a very complex exploit. Easy to execute, but extremely rough in actually exploiting), or send metasploit payloads to the phone and hope something happens. If you are skilled with reverse engineering, you could always poke the phone with us and see what comes up.

Backtrack isn't available any more, unless you can find a legacy upload. Never had the chance to reverse engineer a phone, maybe Cyber Forensics can ahead a small light on something. I'll start running that and let you know if I can find anything worth while, and I'll read up on the exploits while forensics runs.

ZMAX4EVER · Aug 18, 2017

Enoch1333 said:
I got a Metro PCS update on mine to b21

Please let us know if this fixes the text message alert problem introduced with b20

SapphireEx · Aug 19, 2017

Nyrixa said:
Backtrack isn't available any more, unless you can find a legacy upload. Never had the chance to reverse engineer a phone, maybe Cyber Forensics can ahead a small light on something. I'll start running that and let you know if I can find anything worth while, and I'll read up on the exploits while forensics runs.

Here's a good starting place: https://www.cvedetails.com/vulnerab...7/version_id-188440/Google-Android-6.0.1.html

While most of these don't have public PoC's, they are starting points.

For a TL;DR of the Z981:
Locked bootloader
DM-Verity enabled
Fastboot has been removed/ hidden
Android version: 6.0.1
Mainboard: Qualcomm MSM8952
Driver support: Generic Google USB
/Dev/* is ---
/tmp is RWX
Phone is suspect to having a SUID user built in
Has full Toybox, and full busybox installed and symlinked.

Various commands known to work:
Reboot bootloader (Acts like a standard reboot)
Reboot recovery
Reboot disemmc (Attempts to disable EMMC write protection, only Messi has gotten anything out of this)
Reboot FTM (Field test mode, has a userland ADB interface)
Reboot EDL (Qualcomm factory interface. Only communicates over qfil and similar programs)
Updates for MetroPCS: B08, B14, B20, B21
B08 is exploitable via Quadrooter (Unconfirmed)
B14 and below confirmed exploitable via Dirty C0w variant intended for LG devices. Gives root access, but system instantly reboots, and wipes the exploit.
B20/B21 unknown

Loony has gained URD access at one point, but I think he said something failed.

Kernel source is available from ZTE (It's rather generic)

JIMMYHENDRIX · Aug 19, 2017

JIMMYHENDRIX · Aug 19, 2017

Welp new glitch my phone won't charge past 75% and it would just say full charged please disconnect

JIMMYHENDRIX · Aug 19, 2017

And now i get this evertime i plug it in

JIMMYHENDRIX · Aug 19, 2017

Okay so update if you are on metro PC's don't update while your phone is on the charger or you will have to factory reset

GarnetSunset · Aug 21, 2017

SapphireEx said:
I'm assuming Kali/ Backtrack. You could always help @GarnetSunset with Broadpwn (It's a very complex exploit. Easy to execute, but extremely rough in actually exploiting), or send metasploit payloads to the phone and hope something happens. If you are skilled with reverse engineering, you could always poke the phone with us and see what comes up.

I'd recommend they give it a shot honestly. Super simple stuff. And college just started so I'm a little full of work at the moment.

GarnetSunset · Aug 21, 2017

JIMMYHENDRIX said:
And now i get this evertime i plug it in

Cool. Note 7 flashbacks.

thatlovingaph · Aug 21, 2017

Ok I'm new here and I just want to know is there root available for zmax pro already...I been looking for forever already

SapphireEx · Aug 21, 2017

thatlovingaph said:
Ok I'm new here and I just want to know is there root available for zmax pro already...I been looking for forever already

Short answer: No
Long answer: Yes, but it's unusable due to being available for literally a few CPU cycles, then the phone reboot and wipes the root.

GarnetSunset · Aug 21, 2017

SapphireEx said:
Short answer: No
Long answer: Yes, but it's unusable due to being available for literally a few CPU cycles, then the phone reboot and wipes the root.

Thought you were gonna go with:
Long Answer: Nooooooooooooooooooooooooooooooooooooooo

SapphireEx · Aug 21, 2017

GarnetSunset said:
Thought you were gonna go with:

SapphireEx said:

Short answer: No
Long answer: Nooooooooooooooooooo

Click to expand...

Kizzmiazz · Aug 21, 2017

I have been following this thread for a long time now and the devs here deserve a huge pat on the back for there efforts.&nbsp;
I have decided to get a new phone so I can have root and I am torn between ZTE axon 7 , even though I really don't want to give ZTE any more money lol, it has root and is in my $400 price range or the LG v20 , but from what I read the updates for the phone suck. Just wondering your guys recommendations?
I really like the zmax pro, it's been a real good phone and I got it free from metro so can't complain. I just want a phone I can root and play with. Thanks again to the devs here for trying so hard.

Greysworld007 · Aug 21, 2017

Kizzmiazz said:
I have been following this thread for a long time now and the devs here deserve a huge pat on the back for there efforts.&nbsp;
I have decided to get a new phone so I can have root and I am torn between ZTE axon 7 , even though I really don't want to give ZTE any more money lol, it has root and is in my $400 price range or the LG v20 , but from what I read the updates for the phone suck. Just wondering your guys recommendations?
I really like the zmax pro, it's been a real good phone and I got it free from metro so can't complain. I just want a phone I can root and play with. Thanks again to the devs here for trying so hard.

Go with the axon 7

Root ZTE Zmax Pro Official Root Discussion

Lurker

SapphireEx

Guest

Lurker

Deleted User

Guest

SapphireEx

Guest

Newbie

SapphireEx

Guest

Newbie

SapphireEx

Guest

Newbie

Well-Known Member

SapphireEx

Guest

Well-Known Member

Well-Known Member

Well-Known Member

Attachments

Well-Known Member

Member

Member

Lurker

SapphireEx

Guest

Member

SapphireEx

Guest

Lurker

Well-Known Member

BEST TECH IN 2023

Smartphones

Best Android Phones

Upcoming

Best iPhones

Upcoming

Tablets

Best Tablets

Upcoming

Laptops

Best Laptops

Upcoming

Televisions

Best TVs

Upcoming

Game Consoles

Best Game Consoles

Upcoming

Wearables

Best Wearables

Upcoming

Smart Home

Smart Home Tech

Upcoming

Similar threads