• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root ZTE Zmax Pro Official Root Discussion

Status
Not open for further replies.
The option after cp "-a" is a combination of 3 other options.

It is copying all files, but is failing to change permissions which is no issue as we just need the files.

I appreciate the help guys, ill try to see what i can come up with as its a bit hard to root without a actual device.
 
loonycgb2 said:
can someone please run this command and give me the output it gives from terminal?

setprop persist.sys.dlctrl 1[/QUOTE

I tried 2 ways. Setprop persist.sys.dpctrl. 1 and it said could not set blah blah blah then the second method which is the same thing as above except I added "set root" in front and it seemed to work how would I check?
Click to expand...
 
Beany23 said:
I tried 2 ways. Setprop persist.sys.dpctrl. 1 and it said could not set blah blah blah then the second method which is the same thing as above except I added "set root" in front and it seemed to work how would I check?
Click to expand...

if you ran it the same as i typed it and it produced a could not set then it did not work :(

tunajelly said:
u0_a152@urd:/ $ setprop persist.sys dlctrl 1
usage: setprop NAME VALUE

Sets an Android system property.
1|u0_a152@urd:/ $
Click to expand...

you missed the . between sys and dlctrl

anyway my main reason to try this was to see if they left it open considering they use busybox to activate download mode..

#!/system/bin/sh
#
# zte debug util
#BINDIR=/system/bin
#cd $BINDIR
#ln -s busybox [ > /dev/null 2>&1
#ln -s busybox test > /dev/null 2>&1
###########command lists#############
CMD_ENTERDOWNLOAD="enterdload"
CMD_ONEKEYLOGENABLE="enablelog"
CMD_ONEKEYLOGDISABLE="disablelog"
CMD_REBOOT="reboot"
CMD_PERFORMANCE="performance"
#####################################
echo "============debug util init==========="
utilpara=`getprop sys.zte.debugutil.data`
if busybox [ "$utilpara" == "" ];then
echo "debugutil not get any parameters, abort."
fi
if busybox [ "$utilpara" == "$CMD_ENTERDOWNLOAD" ];then
echo "cmd $utilpara starting..."
setprop persist.sys.dlctrl 1
echo "set download mode done!"
sleep 1
echo "sysrq-triggersystem will cause reboot soon!"
echo c > /proc/sysrq-trigger
sleep 1
fi
if busybox [ "$utilpara" == "$CMD_ONEKEYLOGENABLE" ];then
echo "cmd $utilpara starting..."
setprop persist.sys.dlctrl 1
setprop persist.sys.ztelog.enable 1
echo "set ztelog enable done."
sleep 1
echo "zte log full enable need resetart, executing reboot..."
reboot
fi
if busybox [ "$utilpara" == "$CMD_ONEKEYLOGDISABLE" ];then
echo "cmd $utilpara starting..."
setprop persist.sys.dlctrl 0
setprop persist.sys.ztelog.enable 0
echo "set ztelog disable done."
sleep 1
echo "zte log full disable need resetart, executing reboot..."
reboot
fi
if busybox [ "$utilpara" == "$CMD_REBOOT" ];then
echo "cmd $utilpara starting..."
reboot
fi

if busybox [ "$utilpara" == "$CMD_PERFORMANCE" ];then
echo "cmd $utilpara starting..."
/system/bin/performance1&
/system/bin/performance2&
fi
Click to expand...
 
It failed.
Screenshot_20170328-223557.png
 
thank you.

Yes it may need to be run thru the zte debug util bash file so it can run under the system permission.

If we can achieve download mode then we can actually upload a new recovery to the phone.

But i dont know if the bash script still requires root to execute as i dont know the permissions for it.
 
Ok so I'm back after someone reported me as spam for suggesting a factory cable or wire tap. But this is good and we're making progress. I ran it it fails. Actually it ask if I mean something else but idk what to enter there. .. Built in root that needs zte permission sounds ridiculous but I wouldn't put it past them. I called them with the whole nine yards and he didn't know sh** . So idk. Off topic but what's the root process that still working on the axon 7 ? Even perhaps the mi max. Both very similar specs
 
Charles367 said:
Ok so I'm back after someone reported me as spam for suggesting a factory cable or wire tap. But this is good and we're making progress. I ran it it fails. Actually it ask if I mean something else but idk what to enter there. .. Built in root that needs zte permission sounds ridiculous but I wouldn't put it past them. I called them with the whole nine yards and he didn't know sh** . So idk. Off topic but what's the root process that still working on the axon 7 ? Even perhaps the mi max. Both very similar specs
Click to expand...

Xiamoi/axon 7 all have had there firehose leaked which is a signed mbn that controls the structure of each device.

Unless another zte employee decides to leak one for the pro then that is currently not an option.
 
Charles367 said:
Could we in any way even bricking a device manage to get the key? I'll donate my phone for something in trade.
Click to expand...
Well as newer updates come of android, then more flaws will be found as coders tend to leave many vulnerabilities as they add features.

Soon there will be an exploit found which can be used on this phone.

But really how will anyone know if currently no one who owns this phone has ever rooted or have the knowledge to fully find exploits?

Messi is the only other person and he received a donated phone, but who knows what hes found or tried yet.

I personally dont request donations for phones and such as im not as advanced as jcase and rather not waste anyone money if i dont find a opportunity to get root.
 
Ya I thought Messi was close at one point working on a script but I have not heard anything. I'm thinking in the next few months. Or when the next model gets released. The main reason I want root is to remove the system apps I don't use. I tried a non root method with no luck dis abling is a joke but helps. But when root is achieved I will most likely end up going for a custom ROM if available down the road but seeing this phone has some glitches I can't see custom ROMs doing better. I have since updated and very pleased with the phone even w/ out root. Cheers hope 1 y'all gets it
 
Yes @messi received a donation phone. He tried every possible way. The reason you haven't heard from him is because he already told y'all there are only two ways two root this phone.
 
Billyckansbar said:
I wear a tinfoil hat as well. It makes sense that zte would watch this forum to patch their phones. This guy got a couple people to update their phones, and that's a shame. What a waste to have devs watching this forum (the time the money) when if word got around that zmax pro had root zte would sell more phones. Isn't that your goal zte? I guess I don't understand it, but it seems simple.
Click to expand...
I have to say I'm as paranoid as you can get, but even I find it pretty crazy. I sincerely doubt that the company is spending valuable time tracking the various forums just to track our progress to stop us. Just doesn't make sense. I mean think about it... Why? To prevent us from getting root? I eagerly they have better things to do than track the community that closely and try to thwart is at every turn. They sent out the software the way they did then walk away. Sure the updates will have but fixes but I doubt derived be spying on us. They made it hard to root and if we find a way it's easier for they to just disclaim warranty etc than some vast spring conspiracy. This is from someone who encrypts everything, uses multiple VPN's, etc. I just don't see how that level of tracking and counter intelligence measures makes business sense... Paying someone to spy etc. Just can't see a justification. Maybe the NSA pulls that but ZTE? They want a secure product sure, but they are not, I'm sure, against the increased sales a rooted phone might get. I imagine they only have it this secure to protect the average users and because of contractual restrictions with carriers. Just my 2¢ tho... They aren't that fast patching bugs but they are hyper aware to patch root avenues. What next accuse them of reading messages to Messi or other developers? I love a conspiracy but it had to be logical
 
asianrocker said:
OK. I found out something really interesting guys. We also have toybox! Google it. And android built it in all their marshmallow devices!! You can access it in terminal emulator just type toybox it works like busybox!
Click to expand...
Correct me if I'm wrong but I wouldn't put too much stock in toybox, I doubt they made that move for a secret purpose. I assume it's more for licensing issues. In the same way that in the Linux world most or all distros dumped the pico editor years ago for the almost exactly same nano. There were licensing restrictions distributing pico (from UW if I remember) so the community just made their own. Neither one is better IMHO but the developers didn't had too restrictive of a license. BusyBox is not built by Google so maybe that developer/team didn't want it used in a commercial product w/o compensation or something. - from Wikipedia "The Toybox project was started in 2006, and became a BSD-licensed BusyBox alternative.". It's just a licensing thing.
 
Greysworld007 said:
Yes @messi received a donation phone. He tried every possible way. The reason you haven't heard from him is because he already told y'all there are only two ways two root this phone.
Click to expand...
Are you talking about the post he posted after i let him know there "is" a temp root solution, but it is not viable?

He repeated what i had said was available as far as options which is why i said i dont know what all he knows.
 
enesha said:
Correct me if I'm wrong but I wouldn't put too much stock in toybox, I doubt they made that move for a secret purpose. I assume it's more for licensing issues. In the same way that in the Linux world most or all distros dumped the pico editor years ago for the almost exactly same nano. There were licensing restrictions distributing pico (from UW if I remember) so the community just made their own. Neither one is better IMHO but the developers didn't had too restrictive of a license. BusyBox is not built by Google so maybe that developer/team didn't want it used in a commercial product w/o compensation or something. - from Wikipedia "The Toybox project was started in 2006, and became a BSD-licensed BusyBox alternative.". It's just a licensing thing.
Click to expand...
The zmax pro includes both toybox and busybox in stock.
 
Hey try this on emulator:

cd $bindir
Toybox mount -o remount,re

LOL. WTF did I just do. Is re even a valid command?

Hmmm I did
Toybox mount -o remount,rw

With same output. So did I mount it rw? I can see most directories have been mounted rewritable except for rootfs it is still in ro mode.

I crack it huh? OR not? Anyone?

Holy shit guys selinux dir is rw mode! go crack it!
 
Last edited:
asianrocker said:
Hey try this on emulator:
cd $bindir

Toybox mount -o remount,re
LOL. WTF did I just do. Is re even a valid command?
Hmmm I did

Toybox mount -o remount,rw
With same output. So did I mount it rw? I can see most directories have been mounted rewritable except for rootfs it is still in ro mode.
I crack it huh? OR not? Anyone?
Click to expand...

No, I tried it and it still gave me write errors
 
Status
Not open for further replies.
Back
Top Bottom