[Android Software/Hacking General [Developers Only]] MrCabana:
Great, I got your attention ;)

[MENTION=4478781]yuweng[/MENTION] : I have already tried pushing su to /system/bin instead of /system/xbin .... it ALSO gets deleted after reboot. The only thing that seems to survive reboots in these folders are simlinks. For example, if i do "ln -s /system/bin/su /system/xbin/su" the simlink will be kept through reboots, even though /system/bin/su will be either set to 0 lenght or deleted;

[MENTION=3924647]bigrammy[/MENTION] : my screen resolution is 800x480 (just as stated in persist.sys.screen.size property listed above). I am sorry, but I would have to do some reading before telling you I know what TWRP is. I figured out just yesterday what you all meant by CWM: I believe it's that ClockWorkMode thing when I reboot into recovery state. The menu has changed and a few more options were available when I flashed this hacked recovery.img file. I could successfully revert the camera not working thing, by just editing my own boot.img (extracted from my own phone, not downloaded ones for H2000+).

As a programmer, I can have a simple basic view of how the commands work and I did have to adapt a lot of scripts in order to get my things done. For example. there is this UNSECURED-V2-boot.img-MT65xx.plugin thing for Android Kitchen that will get a boot.img and make automatic changes to default.prop. I had to adjust it to give me sometime to edit the files/folders in it BEFORE it repacks the image. All the other methods I've found to extract, repack these files didn't work either in Windows' Cygwin or in Linux Ubuntu (I'm triple booting here, MacOS, Windows8 and Ubuntu), Lots of libraries and permission issues.

So, back to Android. I've tried a few thing here and here are my notes:

1) the root.sh script I adapted for my case works SOMETIMES. I made a small batch script in windows just to check "adb shell su -v" and then "adb reboot" quite a few times just to see what happens and I noticed that it's not constant at all. Sometimes it boots and gives me "3.1.1" (what it should be for the version of su I put there), sometimes it will say nothing at all (in that case, Superuser.apk and RootChecker.apk will report "no root access granted"), and some other times the phone will report that su can't be run at all. Annoyed by that nonsense, I tried to add "sync" commands to the root.sh script. It should sync all the running script assynchronally, and it indeed seems to make the correct response comes more often ("3.1.1."), but not ALL THE TIME, as it should be;

2) Why did you say it seems to be a ZP500+? And why did you think it's Android 2.3? I've read somewhere that it's perhaps what my phone really is. Is there a way to check what's the real kernel in my phone? I mean, not just those can-be-forged getprop responses?

3) I gave up on adding Superuser.apk to /system/app. As of what I've seen around, this application doesn't need to be there anymore. There are free versions of it at Google Play and they can reside normally with the other apps. After I did that, I still have the functionality, and I do have the "allow-or-deny" prompt when some app needs root access. So I just left it out of my script. My question is: is it a mistake? Do you thing it really has to be in /system/app ?

4) SuperSu apk is not working for me at all since it requires special su to operate. Since I can't mount /system read-write (for now, I promise), it is not able to download & update its binnary. So a no go for now, unless you point me to a place where I can download su for latest SuperSu. I just couldn't find it anywhere;

5) This cant remount read-write thing. I think this is the main issue. There must be a good reason for the system to insist in reverting back read-only state. After flashing boot.img (my own's or the one downloaded from the portuguese site) and recovery.img, I can't mount it read-write at all, not even for 0.000001 seconds. Before that, it seemed to work for a short period of time and once per reboot. I mean, after a reboot, I could remount it rw and put some files in places just fine if added form a script to be run fast enough before Android reverts mounting to ro. After that one try, if i did remount again, it would just say "read only file system". In either cases, files would be gone after another reboot. This is an odd thing to be happening, don't you think? If files are put manually in those folders, why and how in hell would system revert it back?

6) I have no idea what this TWRP is, but I am willing to try it. You said you can prepare it for me, just tell me what you need, the files you need and the steps I need to make to get it to my phone.

I really like this phone. It was pretty cheap and also two of my friends have this same model. I don't want to sell it and buy a branded one. I also really want to root it because I want to remove those crappy chinese apps and I want to find ways to improve its battery life (a very important issue with chinese phones IMO).

Thanks again.

---------- Post added at 08:05 PM ---------- Previous post was at 07:15 PM ----------

Asking permission to think out loud .....

I admit I have zero knowledge about file systems. But I can make some assumptions about what's happening to my phone.

1st) files really get to /system folders, but are somehow deleted/reset to 0 after reboot. This means something was written somewhere. Where exactly is this somewhere? A real file system (ie the block files which store /system files)? Or maybe a list of files to be validated by some script?

In my case, the block file system that represents /system is mmcblk0p3, or at least this is the pointing location when i ask "mount" at prompt. Well, it first points to /mmc@android and this /mmc@android is a symlink to mmcblk0p3. I wonder why all these symlinks here and there, to "hide" things? Or is there a technical reason?

2nd) maybe it's a composite mount? I mean, /system is mount of mmcblk0p3, but besides that mount there's another mount from somewhere else? This is what seems to happen with /data, for example. If so, the phone might get confused on where to save the files I change/add to this mount.

3rd) what if I mount mmcblk0p3 somewhere else? I am not sure, but maybe it's possible to have the same block file system mounted at two places at the same time. Let's say I create a folder (mount point) somewhere I have all the permissions, in /data/local/system for example, then I make the changes I want to that folder instead of /system.

4th) why would the phone be denying rw even when requested by root (su) / busybox ? At first, there seemed to be a script running to check either it had been set rw so then it would revert ro. But now, after flashing, this remount is not even performed. Maybe because of ro.secure=0 now? Is this alleged script detecting this system wide property to become more vigilant?

5th) maybe I have to edit mmcblk0p3 directly then flash it back to the phone. That would get me with su and busybox stored properly. But I don't think that will fix the rw issue which is much more important for me.

6th) what if the mmcblk0p3 file itself is marked as ro? I don't know if it makes sense, but maybe I have to manually change ownership or permissions for that block file?

Again, I'm really sorry if these thoughts sound ridiculously stupid.

PS: Do you think this post relates to my problems?