• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

ZTE Write Protection for ZMAX and other ZTE phones

darklordjord said:
Your method works perfectly on my Z955A. I have root and am happy. I've been a fan of yours since my ZTE Warp days. Thank you for your hard work and dedication. You rock!

Edit: I use MetroPCS and their hotspot tethering. Rooting breaks tethering. I'm not sure whether it's just being rooted or using Kingoroot that caused the problem. I think it's Kingoroot. Since unrooting, my tethering has gone back to normal. If you use a Z955A on Metro, and use wireless tethering, you may want to hold off on rooting.
Click to expand...

You might try apps such as "Portable Wifi Hotspot" in google play to see if they work for tethering when rooted. You can also add "net.tethering.noprovisioning=true" to your /system/build.prop which tells it to use the same apn for tethering that the phone does. This gets around some blocks. *only do this as a last resort until someone builds twrp for your device because editing the build.prop improperly can cause your phone to go into boot loops. If you can get twrp on the device then take a full backup first and it's simple enough to restore if things go south.
 
Would anyone be willing to walk me through this for my ZTE Grand X 3. I really want to root this device but I'm not very savvy with rooting. I'm computer literate and can accomplish most tasks but this is beyond me.
 
I wonder if the new zmax pro uses the same protection as the z958...might improve our odds of getting a fix. I tried rooting it via kingroot, going into a root adb shell and trying to write boot to recovery..looks like it worked but doesn't actually write it. Oh well.
 
FameWolf said:
I wonder if the new zmax pro uses the same protection as the z958...might improve our odds of getting a fix. I tried rooting it via kingroot, going into a root adb shell and trying to write boot to recovery..looks like it worked but doesn't actually write it. Oh well.
Click to expand...
I sure as hell hope not.
 
I'm really having trouble rooting my ZTE Prestige. Ive tried multiple times and failed. Would someone mind emailing me and giving me more specific directions to root my phone. My email is mcowell00@gmail.com I'd really appreciate if someone could help me root it. Thanks
 
turns out it works on the zte speed too... great work hroark :)

btw... anybody know what the situation with the kitkat bootloader is on this thing? tried a twrp it didnt work, tried a repacked stock that was just slightly modified only changed some comments in the fstab no actual code im pretty sure but i had to have bcrichester do it i dont have a build setup anymore. but i managed to get root going, permanent, this plus kingroot, just need to figure out whether we can get a recovery working or not
 
Last edited:
Hello @hroark13,

This did not appear to work on ZTE Citrine Z716BLB01 running Android 5.1.1.
I tried both before and after temp root with KingRoot v4.9.6.
Here is the output of my build.prop (don't know if this info helps or not)

Surely there's something in here I can exploit to gain permaroot?

127|shell@baffin:/ $ cat /system/build.prop

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=LMY47V
ro.build.display.id=Z716BLV1.0.0B07
ro.build.version.incremental=20160113.115848
ro.build.version.sdk=22
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=5.1.1
ro.build.version.security_patch=2016-02-01
ro.build.version.base_os=
ro.build.date=Wed Jan 13 11:59:45 CST 2016
ro.build.date.utc=1452657585
ro.build.type=user
ro.build.user=
ro.build.host=ztesuper20
ro.build.tags=release-keys
ro.build.flavor=Z716BL-user
ro.product.model=Z716BL
ro.product.brand=ZTE
ro.product.name=Z716BL
ro.product.device=baffin
ro.product.board=baffin
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.cpu.abilist=armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=
ro.product.manufacturer=ZTE
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=msm8909
# ro.build.product is obsolete; use ro.product.device
ro.build.product=baffin
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=Z716BL-user 5.1.1 LMY47V 20160113.115848 release-keys
ro.build.fingerprint=ZTE/Z716BL/baffin:5.1.1/LMY47V/20160113.115848:user/release-keys
ro.build.characteristics=default
# end build properties
#
# from device/zte/baffin/system.prop
#
#
# system.prop for msm8909
#

#rild.libpath=/system/lib/libreference-ril.so
rild.libpath=/system/vendor/lib/libril-qc-qmi-1.so
rild.libargs=-d /dev/smd0
persist.rild.nitz_plmn=
persist.rild.nitz_long_ons_0=
persist.rild.nitz_long_ons_1=
persist.rild.nitz_long_ons_2=
persist.rild.nitz_long_ons_3=
persist.rild.nitz_short_ons_0=
persist.rild.nitz_short_ons_1=
persist.rild.nitz_short_ons_2=
persist.rild.nitz_short_ons_3=
ril.subscription.types=NV,RUIM
DEVICE_PROVISIONED=1
# Start in cdma mode
#ro.telephony.default_network=5

debug.sf.hw=1
debug.egl.hw=1
debug.composition.type=dyn
debug.hwc.dynThreshold=2.5
debug.mdpcomp.logs=0
dalvik.vm.heapsize=36m
dev.pm.dyn_samplingrate=1
persist.demo.hdmirotationlock=false

#enable dirty rect
debug.sf.swaprect=1
#enable app buffer composition
debug.sf.hwc.canUseABC=0
# disable vsync for cpu render apps
debug.cpurend.vsync=false

#enable gpu perf hint
sys.hwc.gpu_perf_mode=1
#ro.hdmi.enable=true
#tunnel.decode=true
#tunnel.audiovideo.decode=true
#lpa.decode=false
#lpa.use-stagefright=true
#persist.speaker.prot.enable=false

#
# system props for the cne module
#
persist.cne.feature=1

#system props for the MM modules
media.stagefright.enable-player=true
media.stagefright.enable-http=true
media.stagefright.enable-aac=true
media.stagefright.enable-qcp=true
media.stagefright.enable-fma2dp=true
media.stagefright.enable-scan=true
mmp.enable.3g2=true
media.aac_51_output_enabled=true
#codecs:(PARSER_)AAC AC3 AMR_NB AMR_WB ASF AVI DTS 3GP 3G2 MKV MP2PS MP2TS MP3 OGG QCP WAV FLAC
mm.enable.qcom_parser=262143
# Default to AwesomePlayer
media.stagefright.use-awesome=false

#
# system props for the data modules
#
ro.use_data_netmgrd=true
persist.data.netmgrd.qos.enable=true
persist.data.mode=concurrent

#system props for time-services
persist.timed.enable=true

#
# system prop for opengles version
#
# 196608 is decimal for 0x30000 to report version 3
ro.opengles.version=196608

# System property for cabl
ro.qualcomm.cabl=2
# ro.qualcomm.svi=1
# ro.qcom.svi.sensortype=2
persist.gralloc.cp.level3=1
# System property for QDCM
persist.tuning.qdcm=1

# System property for Screen Color
ro.qcom.screencolor=1

#
# System props for telephony
# System prop to turn on CdmaLTEPhone always
telephony.lteOnCdmaDevice=1

#Simulate sdcard on /data/media
#
persist.fuse_sdcard=true

#
# System property for Camera
# System prop to allocate Reprocess buffer as "1"
# during Longshot usecase
persist.camera.longshot.stages=1

#
# dirty ratio value when enable ums
#
ro.sys.umsdirtyratio=20

#
#snapdragon value add features
#
ro.qc.sdk.audio.ssr=false
##fluencetype can be "fluence" or "fluencepro" or "none"
ro.qc.sdk.audio.fluencetype=fluence
persist.audio.fluence.voicecall=true
persist.audio.fluence.voicerec=false
persist.audio.fluence.speaker=false
#Set for msm8909
tunnel.audio.encode = false
ro.config.low_ram=false
#Buffer size in kbytes for compress offload playback
audio.offload.buffer.size.kb=64
#Minimum duration for offload playback in secs
audio.offload.min.duration.secs=30
#Enable offload audio video playback by default
av.offload.enable=true
#enable voice path for PCM VoIP by default
use.voice.path.for.pcm.voip=true
#
#System property for FM transmitter
#
ro.fm.transmitter=false
#enable dsp gapless mode by default
audio.offload.gapless.enabled=true

#Audio voice concurrency related flags
voice.playback.conc.disabled=true
voice.record.conc.disabled=true
voice.voip.conc.disabled=true

#Audio VoIP / playback record concurrency flags
rec.playback.conc.disabled=true

#Set composition for USB
persist.sys.usb.config=diag,serial_smd,rmnet_qti_bam,adb
#Set read only default composition for USB
ro.sys.usb.default.config=diag,serial_smd,rmnet_qti_bam,adb

# set max background services
ro.config.max_starting_bg=8

#property to enable user to access Google WFD settings
persist.debug.wfd.enable=1
#propery to enable VDS WFD solution
persist.hwc.enable_vds=1

#property to enable image unload by audio HAL
sys.audio.init=false

#property to enable DS2 dap
audio.dolby.ds2.enabled=true

#property to change touch screen resolution
persist.sys.synaptics_dsx.qhd=false

#HWUI properties
ro.hwui.text_large_cache_height=2048

# enable sta proxy bydefault
persist.mm.sta.enable=1
#Trim properties
ro.sys.fw.use_trim_settings=true
ro.sys.fw.empty_app_percent=50
ro.sys.fw.trim_empty_percent=100
ro.sys.fw.trim_cache_percent=100
ro.sys.fw.trim_enable_memory=1073741824

# set cutoff voltage to 3200mV
ro.cutoff_voltage_mv=3200

#min/max cpu in core control
ro.core_ctl_min_cpu=2
ro.core_ctl_max_cpu=4

#Enable B service adj transition by default
ro.sys.fw.bservice_enable=true
ro.sys.fw.bservice_limit=5
ro.sys.fw.bservice_age=5000

#set device emmc size
ro.emmc_size=8GB


#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.com.google.clientidbase=android-zte
ro.com.google.clientidbase.yt=android-zte
ro.com.google.clientidbase.gmm=android-zte
ro.build.baseband_version=Z716BLB01
ro.com.google.clientidbase.am=android-americamovil-us
ro.emode.flashtest=true
persist.sys.ssr.restart_level=ALL_DISABLE
persist.mdc_initial_max_retry=10
ro.build.sw_internal_version=P890A12V1.0.0B13
ro.emode.fm=0
ro.emode.keytest=home,back,appswitch
ro.telephony.default_network=9
ro.build.hardware_version=Z716BLHWV1.0
ro.emmc=1
persist.shell.tcpip.debug=1
ro.streaming.ua.prof=http://www.zte.com.cn/mobile/uaprof/Z716BL.xml
ro.com.google.clientidbase.ms=android-americamovil-us
ro.build.secure_version=15
persist.sys.chinese.enable=true
persist.radio.atfwd.start=true
net.tcp.windowsize.init=65535
persist.carrier.selected_id=ATT
persist.carrier.activated_id=ATT
drm.service.enabled=true
ro.tf.projectname=P890A12
persist.sys.usb.menu=enable
persist.sys.usb.config=cdrom
ro.config.alarm_alert=Dawn_of_the_jungle.ogg
ro.config.notification_sound=Glow.ogg
ro.config.ringtone=Standard.ogg
persist.dpm.feature=0
persist.sys.logcontrol.run=1
persist.radio.add_power_save=1
keyguard.no_require_sim=true
ro.com.android.dataroaming=true
ro.com.android.dateformat=MM-dd-yyyy
ro.carrier=unknown
ro.vendor.extension_library=libqti-perfd-client.so
persist.radio.apm_sim_not_pwdn=1
persist.radio.sib16_support=1
ro.frp.pst=/dev/block/bootdevice/by-name/config
dalvik.vm.heapstartsize=8m
dalvik.vm.heapgrowthlimit=96m
dalvik.vm.heapsize=256m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=512k
dalvik.vm.heapmaxfree=8m
ro.setupwizard.mode=OPTIONAL
ro.com.google.gmsversion=5.1_r1
ro.adb.secure=1
persist.sys.dalvik.vm.lib.2=libart.so
dalvik.vm.isa.arm.features=div
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
persist.gps.qc_nlp_in_use=1
persist.loc.nlp_name=com.qualcomm.location
ro.gps.agps_provider=1
ro.pip.gated=0
 
Any chance you could take a look into the Z988 hroark13? The kernel source is available if that helps any
 
No its not rooted. Thats what im looking for is root. The op said run that comnand and then try root app, so thats what i tried to no avail. My misunderstanding
 
PizzaG said:
No its not rooted. Thats what im looking for is root. The op said run that comnand and then try root app, so thats what i tried to no avail. My misunderstanding
Click to expand...

PizzaG said:
We need to get a rooting app made that uses the quadroot exploit.
Click to expand...

No the command only disables the system write protection (on some zte devices). Writing to the system still requires root though. Also, disabling system write protection won't necessarily make a root app work magically. Also, rooting a device that is running marshmallow or nougat doesn't even affect the system partition at all. Your superuser app goes in /data/app and all the binaries go to the boot partition instead of the system.
 
You must log in or register to reply here.
Back
Top Bottom