• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

ZTE Zmax Pro, State Of the Development On This Device .

the relevant info is in the script inside the uninstaller....

it reads as follows

Code:
1 ) # Magisk patched
ui_print "- Magisk patched image detected"
# Find SHA1 of stock boot image
[ -z $SHA1 ] && SHA1=`./magiskboot --cpio ramdisk.cpio sha1 2>/dev/null`
OK=false
[ ! -z $SHA1 ] && restore_imgs $SHA1 && OK=true
if ! $OK; then
ui_print "! Boot image backup unavailable"
ui_print "- Restoring ramdisk with internal backup"
./magiskboot --cpio ramdisk.cpio restore
./magiskboot --repack $BOOTIMAGE
# Sign chromeos boot
$CHROMEOS && sign_chromeos
flash_boot_image new-boot.img "$BOOTIMAGE"
fi
 
Upvote 0
so it's in a sort of Sudo - unlocked state then because according to this the damn bootloader was modified when you flashed the Magisk....

I'd say Krap on the clean up, we don't want to Un-Root, we want to replace one little binary....
we want to replace the
ocupied binary with the one from supersu...

wonder if i can re-pack this to somehow install supersu's binary instead of the magisk one....

maybe we can trick it....
now i gotta download Magisk and take that apart...
and i don't even like magisk LoL
 
Upvote 0
Code:
#!/system/bin/sh
##########################################################################################
#
# Magisk Boot Image Patcher
# by topjohnwu
#
# This script should be placed in a directory with the following files:
#
# File name type Description
#
# boot_patch.sh script A script to patch boot. Expect path to boot image as parameter.
# (this file) The script will use binaries and files in its same directory
# to complete the patching process
# monogisk binary The monolithic binary to replace /init
# magiskboot binary A tool to unpack boot image, decompress ramdisk, extract ramdisk
# , and patch the ramdisk for Magisk support
# chromeos folder This folder should store all the utilities and keys to sign
# (optional) a chromeos device, used in the tablet Pixel C
#
# If the script is not running as root, then the input boot image should be a stock image
# or have a backup included in ramdisk internally, since we cannot access the stock boot
# image placed under /data we've created when previously installed
#
##########################################################################################
##########################################################################################
# Functions
##########################################################################################
 
Upvote 0
AND HERE'S SOMETHING ELSE INTERESTING, OPTIONS THAT CAN BE CHANGED BEFORE FLASHING...
Code:
# Presets
[ -z $KEEPVERITY ] && KEEPVERITY=false
[ -z $HIGHCOMP ] && HIGHCOMP=false

if [ -z $KEEPFORCEENCRYPT ]; then
if [ "`getprop ro.crypto.state`" = "encrypted" ]; then
KEEPFORCEENCRYPT=true
ui_print "- Encrypted data detected"
else
KEEPFORCEENCRYPT=false
fi
fi
 
Upvote 0
and more
Code:
0 ) # Stock boot
ui_print "- Stock boot image detected"
ui_print "- Backing up stock boot image"
SHA1=`./magiskboot --sha1 "$BOOTIMAGE" 2>/dev/null`
STOCKDUMP=stock_boot_${SHA1}.img.gz
./magiskboot --compress "$BOOTIMAGE" $STOCKDUMP
cp -af ramdisk.cpio ramdisk.cpio.orig
;;
THIS STATEMENT, LEADS ME TO THINK THERE'S A BACK-UP COPY OF THE /BOOT HIDING SOMEWHERE ON THE DEVICE...
Going to have to dig deeper tho....
 
Upvote 0
AND HERE'S SOMETHING ELSE INTERESTING, OPTIONS THAT CAN BE CHANGED BEFORE FLASHING...
<tt>  </tt>
 
# Presets
[ -z $KEEPVERITY ] && KEEPVERITY=false
[ -z $HIGHCOMP ] && HIGHCOMP=false
 
if [ -z $KEEPFORCEENCRYPT ]; then
if [ '`getprop ro.crypto.state`' = 'encrypted' ]; then
KEEPFORCEENCRYPT=true
ui_print '- Encrypted data detected'
else
KEEPFORCEENCRYPT=false
fi
fi
 
[/LIST]
Yeah, more options to try. Bet you'll begin to enjoy Magisk, yet. LOL. I know of only two folks that can test this out.
 
  • Like
Reactions: Astr4y4L
Upvote 0
OH WOW

Code:
##########################################################################################
#
# Magisk General Utility Functions
# by topjohnwu
#
# Used everywhere in Magisk
#
##########################################################################################

MAGISK_VER="15.3"
MAGISK_VER_CODE=1531
SCRIPT_VERSION=$MAGISK_VER_CODE

# Detect whether in boot mode
ps | grep zygote | grep -v grep >/dev/null && BOOTMODE=true || BOOTMODE=false
$BOOTMODE || ps -A 2>/dev/null | grep zygote | grep -v grep >/dev/null && BOOTMODE=true
$BOOTMODE || id | grep -q 'uid=0' || BOOTMODE=true

# Default location, will override if needed
MAGISKBIN=/data/adb/magisk
[ -z $MOUNTPATH ] && MOUNTPATH=/sbin/.core/img
[ -z $IMG ] && IMG=/data/adb/magisk.img

BOOTSIGNER="/system/bin/dalvikvm -Xnodex2oat -Xnoimage-dex2oat -cp \$APK com.topjohnwu.magisk.utils.BootSigner"
BOOTSIGNED=false
 
Upvote 0
Hmm the hunt continues....

nice bit of code here too tho
Code:
flash_boot_image() {
# Make sure all blocks are writable
$MAGISKBIN/magisk --unlock-blocks 2>/dev/null
case "$1" in
*.gz) COMMAND="gzip -d < '$1'";;
*) COMMAND="cat '$1'";;
esac
$BOOTSIGNED && SIGNCOM="$BOOTSIGNER -sign" || SIGNCOM="cat -"
case "$2" in
/dev/block/*)
ui_print "- Flashing new boot image"
eval $COMMAND | eval $SIGNCOM | cat - /dev/zero 2>/dev/null | dd of="$2" bs=4096 2>/dev/null
;;
*)
ui_print "- Storing new boot image"
eval $COMMAND | eval $SIGNCOM | dd of="$2" bs=4096 2>/dev/null
;;
esac
}
 
Upvote 0
OK OK ,
so I found how the program would go about killing SuperSU if it's installed, wonder can we just kinda reverse this tid-bit...

Code:
# SuperSU
if [ -e /system/bin/.ext/.su ]; then
mv -f /system/bin/app_process32_original /system/bin/app_process32 2>/dev/null
mv -f /system/bin/app_process64_original /system/bin/app_process64 2>/dev/null
mv -f /system/bin/install-recovery_original.sh /system/bin/install-recovery.sh 2>/dev/null
cd /system/bin
if [ -e app_process64 ]; then
ln -sf app_process64 app_process
else
ln -sf app_process32 app_process
fi
fi
rm -rf /system/.pin /system/bin/.ext /system/etc/.installed_su_daemon /system/etc/.has_su_daemon \
/system/xbin/daemonsu /system/xbin/su /system/xbin/sugote /system/xbin/sugote-mksh /system/xbin/supolicy \
/system/bin/app_process_init /system/bin/su /cache/su /system/lib/libsupol.so /system/lib64/libsupol.so \
/system/su.d /system/etc/install-recovery.sh /system/etc/init.d/99SuperSUDaemon /cache/install-recovery.sh \
/system/.supersu /cache/.supersu /data/.supersu \
/system/app/Superuser.apk /system/app/SuperSU /cache/Superuser.apk 2>/dev/null
fi
}
 
Upvote 0
Ready and willing (to be the victim)

Kool will talk to ya about it more tomarrow , good night to ALL

Well other then making sure SELinux is at permissive & that it stays that way. I don't think moving to SuperSU is that important. Although maybe a byproduct of that might still help. But what really needs to be investigated are the different ways to unlock the bootloader. Since that will open the the phone for anything else one wants to do to it.
 
Upvote 0
Well other then making sure SELinux is at permissive & that it stays that way. I don't think moving to SuperSU is that important. Although maybe a byproduct of that might still help. But what really needs to be investigated are the different ways to unlock the bootloader. Since that will open the the phone for anything else one wants to do to it.

Yeah I agree but looking at how the scripts in the magisk installer work, it appears that it's "Patching" the bootloader, and not even hanging up on the signature checks .

so really Unlocked bootloader -vs- Patched bootloader

UNlocking it streight out may prove impossible, but If we take a lesson from these install scripts and files from magisk, we may make our own Boot-patcher to accomplish what we need done here...
 
Upvote 0
Yeah I agree but looking at how the scripts in the magisk installer work, it appears that it's 'Patching' the bootloader, and not even hanging up on the signature checks .
so really Unlocked bootloader -vs- Patched bootloader
UNlocking it streight out may prove impossible, but If we take a lesson from these install scripts and files from magisk, we may make our own Boot-patcher to accomplish what we need done here...
Exactly, wanted to investigate that. Other devices with locked bootloaders like FireTV's seem to brick when u try Magisk on them, even with TWRP on them. But not the Z981. It actually functions very well. Even if it is not full on Root or a fully unlocked bootloader. But that is out of my field of knowledge. I am more of an ideas guy, lol.
 
Upvote 0
Exactly, wanted to investigate that. Other devices with locked bootloaders like FireTV's seem to brick when u try Magisk on them, even with TWRP on them. But not the Z981. It actually functions very well. Even if it is not full on Root or a fully unlocked bootloader. But that is out of my field of knowledge. I am more of an ideas guy, lol.

it's definitely in the area that I tinker in...
but I still don't have one of the devices to plug into my Linux box , so unfortunately that makes my work on it very slow...

was thinking I might pick one up eventually, but just had to fork out for a Big plumbing Job, and had an electrical job too on the other place...

so ,
it'll be a bit b4 I'll be able to afford to make a purchase...sad but true.

in the mean time, as long as we can bounce things around here and everybody keeps being Kool, Who knows what might happen sooner than expected LoL!
 
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones