For the unfortunate souls who also cheaped out on a Ting phone: Magisk can give a perm systemless root.
Listed software versions used are for posterity's sake. None of the attached is owned by me in anyway (Edit: Uploading at a later date, new acc restrictions I think). Proceed at your own risk.
1. Enable OEM unlock and USB debugging in developer options, and put the phone in MTP mode.
2. Install Magisk Manager(v 7.4.0), Root Checking Software (Root Checker off Google Play), and, optionally, BusyBox (I used BusyBox Free).
3. Reboot phone.
4. Temp Root with KingRoot v4.9.6. Verify with root checker.
5. Plug android device into computer with ADB. Open up a cmd window and enter "adb shell". Enter "su" and "setenforce 0" (the $ should become a # in the terminal window, i.e. it should be root shell).
6. Enter "ls -l dev/block/*/by-name" to list the partitions by name. Make backups of everything you don't want to lose with dd, and aboot and boot. E.g. "dd if=/dev/block/mmcblk0p18 of=/sdcard/aboot.bak"
7. Enter "exit" twice to leave root and shell. Use adb pull command (e.g. adb pull sdcard/aboot.bak) or file manager to copy aboot to your PC.
8. On you phone, start up Magisk Manager and click install magisk. "Select and Patch a File" and choose boot.img. Verify the patched boot img is in your device storage.
9. On your PC, using a hex editor (I use HxD), open up aboot and find the hex "41 4E 44 52 4F 49 44 2D 42 4F 4F 54 21 00 00 00 00" at offset 0x007FFE00.
Change it to "41 4E 44 52 4F 49 44 2D 42 4F 4F 54 21 00 00 00 01". Save this change, and save the file as patched_aboot. Move it to your phone (adb push, or a file manager).
10. Flash boot and aboot via dd (e.g. dd if=/sdcard/magisk_patched.img of=/dev/block/mmcblk0p20 and dd if=/sdcard/patched_aboot of=/dev/block/mmcblk0p18).
11. Phone should stay rooted now (and not be stuck in a bootloop) provided I remembered everything right. You can uninstall KingRoot, but some caveats are noted below.
system/ is still read-only and can't be remounted with rw permissions, but as noted before the kernel source is released (
https://opensource.ztedevices.com/, N9518 Lollipop Kernel (3.10.49)) and so I understand that can be rectified.
Further, with Qualcomm chips' EDL mode, one can supposedly always flash or backup the device with QPST, making it 'unbrickable'. I get an error akin to "can't switched to DL mode" trying to get dumps though. If anyone has more success with this avenue, please do share. Do be wary of malware though.
Hope this helps. Cheers.
