Nyrixa
Newbie
http://cfig.github.io/2015/10/15/signing-keys-in-android/ this article tells everything about the signing keys, I have only seen two so far I'll look more after work.
Follow along with the video below to see how to install our site as a web app on your home screen.
Note: This feature may not be available in some browsers.
SapphireEx
If that really is the release key, there's tons of things we can do with it. We need a way to flash images though.
If we can get someone to modify the root script where it won't freeze up and panic. So we can get temp root and install flashfire or flashify then install @messi2050 TWRP recovery then we will all set. Even though no one knows if the custom recovery works or not
.
I know the original zmax had to get temp root by kingroot i believe . Then download an app to install TWRP
.
Technically if what I'm reading is correct, it doesn't necessarily have to be the signing keys, you can create your own as long as it's signed. Haven't had time to deep look again, but disabling trusted certs gains a bit more access to files and sub-dirs in the root dir. Also it seems that "keychain/keystore" don't directly handle the keys, but they have the information about them and can access them. So it may be possible that with a "keychain/keystore dump" the information we need about the keys can be gotten.
SapphireEx
I think you messed your quote up a bit. I haven't been able to find the keys yet. Been at work all day.
Found this key idk if im right or not is worth the share
location or file
/etc/security/
Mac_permissions.xml
signature='308204ae30820396a003020102020900abf652fde78f3bc3300d06092a864886f70d0101050500308196310b300906035504061302434e3111300f060355040813085368616e676861693111300f060355040713085368616e67686169310c300a060355040a13035a544531223020060355040b1319536d61727470686f6e6520536f66747761726520446570742e310c300a060355040313035a54453121301f06092a864886f70d0109011612737570706f7274407a74652e636f6d2e636e301e170d3131303330383037313234345a170d3338303732343037313234345a308196310b300906035504061302434e3111300f060355040813085368616e676861693111300f060355040713085368616e67686169310c300a060355040a13035a544531223020060355040b1319536d61727470686f6e6520536f66747761726520446570742e310c300a060355040313035a54453121301f06092a864886f70d0109011612737570706f7274407a74652e636f6d2e636e30820120300d06092a864886f70d01010105000382010d00308201080282010100bf9aadaf6257265ebc6cc4127ab591046fff7df5cb9e5bf2dc6d86d6932f70d2218fc1070cfb66c22d5189d3156e29917233473570379748c2e1c49cd700e8851ec339f4008befaef5cf85f536f22807755c0eab9695d76fcbf8ab2c65d80975a37d859d6784a03e72bf761348c596f042a8e0d323cd57ce97001e47121493bd4c2a34bf62d1d0d09166d965e808348be551a27c1c6e9244762d3afebb3c7bba4ee9b3985c3d426c694cf7338d045c76244a6de4f686c7f84f210b9d25a6b3c8907b097c35c138abcca4cef0d7e29f1155e0c42566b7e4b5bb37fea17dcc39de2b2f9d0d4d3b17f732676c1c21002c84edce336c87b95cfdcadc6745c83f4e4b020103a381fe3081fb301d0603551d0e04160414aba2a127783c12ea32794e657dcbd8342d70680e3081cb0603551d230481c33081c08014aba2a127783c12ea32794e657dcbd8342d70680ea1819ca48199308196310b300906035504061302434e3111300f060355040813085368616e676861693111300f060355040713085368616e67686169310c300a060355040a13035a544531223020060355040b1319536d61727470686f6e6520536f66747761726520446570742e310c300a060355040313035a54453121301f06092a864886f70d0109011612737570706f7274407a74652e636f6d2e636e820900abf652fde78f3bc3300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100 7e35025f08ef1b0a0fb023dafb5d878aa460fa2fef626a9de6f5b59f3183cd0783c8426216f47d03e3b9af873880725198a85bb559eab4e277488d8220709fee7a5d281c9701b89eb30f0c9c6ea6d97abc9e8b76f6ce6e53483980868f8b3c7f2dff1fd73574830c2bb29882223d62683fa84f5108fe7f7435cbb2f32d8e0d28f94367708d02287232982f63c981871f7dcfb24e1faeb586fc255de4ad302fc4b53d7d6b43c84d53d3172024a0b8b0964f0deeca0e3a2fcb9199898c0cbf0d03cb6cace6c92817e1fccd53604f99dec8f2c130388d34cf96d300286726c6dcbea83b38dd12769ac94df9fa6b298aedf617fccc8ff9f503338015f94a8ae0ac88
In the root folder there is a file titled "Verity_Key" however it seems that according to http://en.miui.com/thread-310923-1-1.html there's a way to disable the DM_Verity. If not then with temp root the vet will have to be found.
Requires TWRP. If we had TWRP, we wouldn't be in this position to start with.
Both methods recently posted.. disable dm-verity and signing boot image with certain keys..
First zte ALWAYS requires oem keys so do not sign a boot with your own keys or upload an unsigned boot.
Second to disable dm-verity is not possible at this current moment as you cannot pull or push a new boot image.
IF someone could manage to pull the boot img so we may get to the ramdisk then YES we could disable dm-verity using dirtyc0w.
But in the end both require flashing a new boot.
Never got it to workI thought you pulled the boot a bit ago?
Much appreciated for the skepticism, nothing to prove here, I got what I came for and in the process lost the faith in humanity to continue with this device. Re-read what I said carefully, and perhaps you'll figure it out.I have seen everything about the china backdoors and such, but wheres the actual proof of what you "found".
I cant find any sodu.ja or even find a single blip of network connections to unknown sources..
How would you be able to know of a modem backdoor without direct access to a decompiled modem partition or even a kernel backdoor?
On top of it all you have a semi temp root and instead of passing the info you delete it all because you feel your done?
I seriously doubt you honestly found any real traces of anything.
Traces of a secondary root can be found in the emode decompiled source. It is the only way that is currently linked to unlocking system read and write. It was also placed in place along with ftm mode.
For the millionth time, carriers have NOTHING to do with loading software. MPCS phones ship directly from ZTE. Notice the box color (purple) of different handsets is different? Yeah well it's because they ship direct. THE OEM LOADS MPCS SOFTWARE!This has been obvious to me since the first inklings that the phone was lock down like it is not to keep us out. But to keep what it is doing behind the curtain secret. They only way we will be able to confirm anything will be thru discovery. And the real targets should be MetroPCS, TMobile & to a lesser extent the other carriers if they also did not include fastboot or a method to peak at what ZTE & the repubic of fine china is up to. Since ALL businesses from China are nothing but an extension of said completely corrupt state. The only people that can put any pressure on ZTE is MetroPCS & TMobile.
If I am not mistaken, ZTE is still under probation from getting caught for illegal sales of tech to NK & Iran.
The only award that should be accepted, other then lawyer fees. Should be the unlocking of every bootloader on any ZTE device past, present & future.
Like you had faith in humanity to begin with lolFor the millionth time, carriers have NOTHING to do with loading software. MPCS phones ship directly from ZTE. Notice the box color (purple) of different handsets is different? Yeah well it's because they ship direct. THE OEM LOADS MPCS SOFTWARE!
Im New to all this. So please excuse my stupidity. But you guys are really making progress. One question. Can we compleetly wipe the phone of its os by now