Root ZTE Zmax Pro Official Root Discussion

[loonycgb2]

Dont get our hopes up for the big let down!

 

[Greysworld007]

Holy shit!

 

[loonycgb2]

Holy shit!

Dont expect a full blown root just yet, i have only had 2 days to play with this and still need to unpack bootloader to find where the actual permission is for main boot... Recovery position is at default.

 

[Jimmy Dixx]

Ha as soon as I came here and saw that picture, ZTE attempted to push me an update. Not happening. B08 until I have root.

 

[Jimmy Dixx]

D

dirty c0w modified does in fact exploit the system!

Now just need to find zte's suid configuration as it currently being set to a default uid to test exploit

And how exactly did you modify it to make the exploit work?

 

[loonycgb2]

D
And how exactly did you modify it to make the exploit work?

Modified what memory and kernel bits it attacks.

Have to modify it a bit for the main boot img as they have put more protection on aboot.

 

[Jimmy Dixx]

Ah ok. Seems like you are in the zone right now You have gotten further in the past couple days than anybody else has in about 9 months.

 

[Jimmy Dixx]

So with what you have now, you have root access until you reboot the phone, or how exactly does it work?

 

[ZMAX4EVER]

Finally! This is getting really gooood !!

 

[loonycgb2]

So with what you have now, you have root access until you reboot the phone, or how exactly does it work?

Currently its able to set selinux to permissive on the kernel in the recovery allowing full root shell via recovery, but since stock recovery doesnt allow adb access its useless at the moment. But does show he exploit bypassed zte's boot protection without bootloop.

But now i need to find the exact same for the main kernel to be able to get root suid to set selinux.

With current runs dirtyc0w has been able to modify a random bit on the main kernel meaning its possible to execute the exploit and get results via the main kernel.

Once i play with it a bit i will be able to get permissive on the main kernel allowing me to run dedicate run-as executable with root privilege, which will allow me to use DD command to flash twrp which in turn we can remove storage encryption and gain root.

 

[MadDeveloper]

Oh snap, so we're so close to getting full root huh?

 

[loonycgb2]

i think i may have found the issue, anyone have a link to messi's twrp for the zmax pro?

 

[MadDeveloper]

i think i may have found the issue, anyone have a link to messi's twrp for the zmax pro?

https://androidforums.com/threads/recovery-twrp-v3-for-zte-zmax-pro.1086861/

 

[Sieze]

anyone else feelin that flashaholic itch getting stronger or just me?

<--me sense seeing the recent posts i need it man i need it!

 

[MadDeveloper]

anyone else feelin that flashaholic itch getting stronger or just me?
<--me sense seeing the recent posts i need it man i need it!

Lol Same

 

[Deleted User]

There's an app that is called system ui tuner and dpi changer, by Zachary Wander on the play store system ui tuner partially works without root but does anyone know if dpi changer does without the bootloop?

 

[MadDeveloper]

I wouldn't try it

 

[Deleted User]

I wouldn't try it

I've used systemui tuner and it's cleaned my status bar but I'm too scared to try dpi changer

 

[Jimmy Dixx]

Search the disemmcwp command and dpi. I was able to do something using that command when this phone first came out to change my dpi and make it stick. I remember having a lot of trouble witb getting it to stick at first. Dont remember if it was here or another forum.

 

[GarnetSunset]

i think i may have found the issue, anyone have a link to messi's twrp for the zmax pro?

Godspeed. DD is terrifying to me, so you have quite the co-hones to do this.

 

[Jimmy Dixx]

DD isnt that terrifying, so long as you know exacltly what and where to do it. I think my first encounter with it was when I updated my old Palm Pre to webOS 2.0 (it was never officially released for the original Pre).

 

[GarnetSunset]

DD isnt that terrifying, so long as you know exacltly what and where to do it. I think my first encounter with it was when I updated my old Palm Pre to webOS 2.0 (it was never officially released for the original Pre).

Oh yeah I understand that, it's just picking knowing that if one digit is out of place you overwrite whatever sector with garbage is terrifying to me personally haha, I had to do it for the 3DS tho. Fun stuff.

 

[GarnetSunset]

dirty c0w modified does in fact exploit the system!

Now just need to find zte's suid configuration as it currently being set to a default uid to test exploit

I just realized you ran dirtycow on windows. You beautiful bastard, did you run it via ADB shell?

 

[Jimmy Dixx]

Very true.

Oh yeah I understand that, it's just picking knowing that if one digit is out of place you overwrite whatever sector with garbage is terrifying to me personally haha, I had to do it for the 3DS tho. Fun stuff.

 

[loonycgb2]

I just realized you ran dirtycow on windows. You beautiful bastard, did you run it via ADB shell?

dont be silly you can only root this phone using linux lmao