[Firefox OS General] cimourdain:
Hi all,

I'm the lucky owner of a ZTE Open and i'd like to share with you the process i used to root and install recovery.

Disclaimer: This process is very risky, you may brick your phone permanently, so neither xda nor me could be responsible of the resulting consequences.

Note: I did not dev or contribute to any program/process listed there, all credits are going to the listed sources.

I followed successfuly this processus with Debian 7 (32b) and a UK version of the ZTE Open.

1 - Get Root Access

Pre-requisite:

1/Install adb

sudo apt-get install android-tools-adb android-tools-fastboot

2/Update your udev rules for adb to recogize your phone:

#create a file with your udev rules
nano /etc/udev/rules.d/60-fxos

Copy the following in your newly created file:

Then:

#update permissions of the 60-fxos file
chmod 644 /etc/udev/rules.d/60-fxos
#Restart udev
sudo service udev restart

On this step my advice is to restart your computer to restart properly adb and to remap udev.

Root exploit:

1/Enable "Remote debugging" on your phone

On your device, in Settings -> Device information -> More Information -> Developer.

Disable

2/Check that your devuce is recognised

# adb devices
List of devices attached
roamer2	device

Roamer2 is the name of the ZTE Open

3/Root

Download file root-zte-open.zip (see download section below)

uzip its content and put it in your working folder (~/fos/root/ in this example)

#go to your working folder
cd ~/fos/root/
#update permissions of the root-zte-open file (you probably need admin right to do this)
chmod 755 root-zte-open
#launch exploit AS ROOT USER
./run.sh

The output should be the following:

# ./run.sh
Connect your phone to USB, then:
Settings -> Device information -> More Information -> Developer
and enable 'Remote debugging'

1142 KB/s (19208 bytes in 0.016s)

== root for Movistar zte open (roamer2) by [MENTION=240671]pof[/MENTION]
== CVE-2012-4220 - discovered by giantpune
== original exploit by Hiroyuki Ikezoe
== if the phone hangs, remove the battery and try again!
roamer2 (OPEN_EU_DEV_FFOS_V1.0.0B01) is not supported.
Attempting to detect from /proc/kallsyms...
roamer2 (OPEN_EU_DEV_FFOS_V1.0.0B01) is not supported.[diag]
Attempting to inject code...
This works only once a boot.
roamer2 (OPEN_EU_DEV_FFOS_V1.0.0B01) is not supported.[diag]
Attempting to inject code...
This works only once a boot.
failed to get root access
Exploit failed, rebooting and trying again!

[...few more fail attempts, 3 in my case]

== root for Movistar zte open (roamer2) by [MENTION=240671]pof[/MENTION]
== CVE-2012-4220 - discovered by giantpune
== original exploit by Hiroyuki Ikezoe
== if the phone hangs, remove the battery and try again!
roamer2 (OPEN_EU_DEV_FFOS_V1.0.0B01) is not supported.
Attempting to detect from /proc/kallsyms...
roamer2 (OPEN_EU_DEV_FFOS_V1.0.0B01) is not supported.[diag]
Attempting to inject code...
This works only once a boot.
roamer2 (OPEN_EU_DEV_FFOS_V1.0.0B01) is not supported.[diag]
Attempting to inject code...
This works only once a boot.
Got root! - copying su binary!
Enjoy!

You are now rooted.

Note: my few first attempts failed, i tried few time (restarting all the process) to achieve it successfully.

2 - Install Recovery

1 - Download recovery

In the download section you will find the download link to clockwork recovery 6.0.3.3.

Put the recovery .zip in your working folder.

Navigate into the working foder.

2 - Backup your current stock recovery

If not already done turn on debugging on phone and turn off USB mass storage on phone.

Plug phone in to computer.

#Launch adb shell
adb shell
#get root access
su
#Backup the stock recovery
busybox dd if=/dev/mtd/mtd0 of=/mnt/sdcard/stock-recovery.img bs=4k
exit

2 - Backup your current stock recovery

#Push the CW Recovery to your phone
adb push recovery-clockwork-6.0.3.3-roamer2.img /mnt/sdcard/cwm.img
adb shell
shell@android:/ $ su
shell@android:/ # flash_image recovery /mnt/sdcard/cwm.img

In my case the output of the las command was:

3 - Restart your phone in recovery mode

Power off your phone.

Hold both volume down up and the power button.

What now?

Now in the recovery you can install custom roms.

For example, you can flash the movistar rom (see dowload section).

Flash zip in recovery as you would do for any android rom.

Troubleshooting

"status 7" error installing or updating

This happend to me after installing the spanish rom on my Ebay ZTE (UK). it seems to me that it changed the name of the device from roamer2 to full_inari and cause the updater-script to crash.

Solution found in this topic: http://xdaforums.com/showthread.php?t=2302599

Opened the update.zip file, in the folder META_INF > COM > GOOGLE > ANDROID, edit updater-script and remove the following lines :

assert(getprop("ro.product.device") == "roamer2" ||
getprop("ro.build.product") == "roamer2");
assert(getprop_new("ro.build.display.id") == "OPEN_EU_DEV_FFOS");

Save modified zip and try to install again whith CWM.

Dowloads:

root-zte-open.zip

recovery-clockwork-6.0.3.3-roamer2.img

Movistar - OPEN_FFOS_V1.0.0B04_TME

EU_DEV_FFOS_V1.0.0B02_USER_SD2.zip (official rom from ZTE for the UK version)

Many many thanks to my sources:

http://pof.eslack.org/2013/07/05/zte-open-firefoxos-phone-root-and-first-impressions/

https://groups.google.com/forum/#!msg/mozilla.dev.b2g/dvXr_Us0HHc/E9U87zK-lUMJ