[Android Software/Hacking General [Developers Only]] MrCabana:
Ok, folks [MENTION=3924647]bigrammy[/MENTION] [MENTION=3868181]x1123[/MENTION] , thanks for helping .... Let me try to be more clear ....

I do have a Hero H5000, it seems to be a brazilian version of what's known internationally as Hero H2000+ (this is NOT HTC Hero). Pictures of my phone can be seen here. Also, it seems to be from ZP111 manufacturer, I'm not sure if it stants for ZOPO, everything is too uncertain with these chinese phones.

[MENTION=3924647]bigrammy[/MENTION]: I did something very similar to what you suggested just yesterday, just that I followed THIS tutorial (in portuguese), except for the iOS ROM (I don't want to make it look like iOS). As they state in the post, there's a problem with their boot.img file (back camera stops working) and recovery.img brings CWM functionality (this part works now).

Oh well, I am nosey, so I started sniffing around and decided to patch my own boot.img that I managed to "read back" using countless tolls like Cygwin, MTK Droid Tools, SP Flash Tools, MTK Rom Studio (yes, I have learned how). My own patch worked for rooting and the back camera is working. I believe the only thing they did for rooting was change default.prop (set ro.secure=0) and a small script to be called by init.rc that I decided to place in an area I can edit (at least for now) in /data/local/root/. All this little script does is push busybox and su to /system/xbin and Superuser.apk to /system/app and apply proper permition to these files. This part is also working for my own boot.img. Just in case it matters, here's a copy of this script:

I have no idea why it works with yaffs2, I don't even know what that is, but it should be ext4, no?

As I said, this part seems to be working, su and busybox and Superuser.apk are taken to their places and they're not set to 0 length or deleted by anything. The thing is: sometimes Root Checker says these files aren't granting permissions so I have to reboot. Besides, Superuser is never being called to allow root access to any application, the applications simply get access by themselves. This was not happening with the buggy boot.img provided in the tutorial I mentioned above. I don't know if they did anything else to boot.img that I not aware of.

Ok, now the read-only/read-write part. No matter what img's I use, mine or the tutorial's, the system won't let me mount rw by either adb command or using an apk (Root Mounter, SuperSU, Explorers, etc) These apps can get root access, but rw fails to be applied. This leaves me without an option to use SuperSU because it asks to update su and always fails as soon as it starts. I also could not download their binaries directly so I could try to apply them directly from the script cited above.

Now my assumptions of what is going on. There must be a script somewhere /vendor/ (maybe?) that keeps running in the background to detect if /system/ gets rw somewhen and sets it back to ro right away. It also checks contents in /system/xbin /system/bin /sbin and /system/app to set to 0 bytes any file not stored in its backup copy of /system. I can't find this script. There's no install-recovery.sh anywhere (and I have searched in a lot of places) or anything else that suggests any type of recovery. I can paste a ls -l here if you think might help.

That said, I guess my phone is half-rooted. The su file can be seen and executed by apps to use system functions, but not to make any changes to /system (ie. remove these darn chinese apk's that sucks up my battery juice).

If you know a place where I could find the reverting /system script or why the heck I can't remount it rw, please let me know. As for the Android 2.3 or 4.0.4 I am really not sure. I am a total noob when it comes to Android. I have very little experience with linux and mac, but I am a windows programmer for 20 years, I guess that helps a little.

Thanks for your time.

PS: here is my getprop response, i redded out what I think is relevant: