yashsingh1/xdaforums huggingface dataset:
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
Thr bootloader does not ever get unlocked in any fashion during updates from android.

It verifies that the package is correctly signed via the zte signature then allows the update to continue.

In reality the updates usually dont ever include bootloader stuff unless its a large update from 4.x to 5.x

---------- Post added at 10:14 AM ---------- Previous post was at 10:12 AM ----------

The OTAs are all in the cache partition which should be able to be read by any file manager.
[ZTE ZMAX Guides, News, & Discussion] sajkodeli:
b22 ??

I just updated MetroPCS

Says build number

Z970_metroPCSV1.0.0B06
[ZTE ZMAX Guides, News, & Discussion] jamesthegreat88:
That's the latest build for metro pcs
[ZTE ZMAX Guides, News, & Discussion] skinlab:
I think that I'm going to hold off on updating. Just in case. Or till I get sick of the update notification..
[ZTE ZMAX Guides, News, & Discussion] Lesharoturbo:
T Mobile dude. T Mobile. That is what the tmo stand for.
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
Has anyone else come across the org.namelessrom.devicecontrol.receivers using dialer codes? Gives Device and sensor info, kernel entropy, read wake-up threshold, write wake-up threshold, performance info, cpu settings, gpu settings, file system, thermal driver, tasker, flasher, app manager, wireless file manager, build.prop editor, and sysctl/vm editor. Very new to all this so I'm not sure about what all of these are but I found the build.prop in the file system through safe mode with all the commands. Also found a emode screen that had a checkbox for "cold start enable" and a dialogue box with lbs.geo.T-Mobile.com in it.
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
Code is?
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
What's the dialer code you're using?
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
The emode guide is "*983*000111#" the other code you have to Download the secret codes app from the play store (has android with magnifying glass on chest showing a lock) and then download the device master app from cm browser. Run the secret codes app. Very last result it comes up with is 13372 = org.nameless.devicecontrol.receivers. code didn't do anything until I downloaded device manager. It's not root but came up with it after reading [MENTION=238589]case[/MENTION]'s hints so hopefully it helps
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
You dont make any sense, secret code has several device manufactures which one did you choose, then you say to download device master from cm browser what is that.

OK I found the right secret code you were talking about, but my last code is 759 and gives me a screen to change from oem on or oem off, i dont have the 3372 one your talking about.
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
For those who use Univision or Walmart family or T-Mobile on metro PCs do you get the 4.4.4 update when you use metro PCs plan, or are you still stuck on 4.4.2
[ZTE ZMAX Guides, News, & Discussion] arampapaz:
I have a univision model on Metro PCS and it is on 4.4.2 with no update available.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
It should stay stuck...even though it's the same phone the build numbers will be different.. Just like when I rooted and unlocked a g2 from Sprint it wouldn't take at&t updates.. Even after I flashed to an at&t Rom
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
Sorry it is device control not device manager, like I said I am a complete nubbie with this kind of thing. But here are screenshots of the apps I was talking about. On cm browser search for device control and it should be first option. Also I'm not sure why the secret code revealed isn't finding the code, maybe if you put it in manually.

---------- Post added at 04:13 PM ---------- Previous post was at 04:08 PM ----------

Sorry guess I can't post screenshots yet
[ZTE ZMAX Guides, News, & Discussion] jcase:
many/most of the dialer codes are disabled, you have to enable the emod persist prop to make many of them usabel, the nagain some are not usable unless you disable it. 101 or so of them are "encrypted" (ok ciphered? wouldnt call that encryption) in the libemode
[ZTE ZMAX Guides, News, & Discussion] doubtingthomas:
Metro update downloaded in NY . Hit or a miss?

First off thanks to all who persevere with the cryptic security of Zmax. JCase that was quite an impressive presentation and hopes that your health and family are doing well.

So any consensus yet on the Metro "ZMAX Software enhancement" package. Just received this today. Voice over LTE should free up more bandwidth so I am hoping maybe Band 12 will be in play. Would be nice to have better indoor coverage though pine barrens are notorious for sucking up 7 and 800 meg signal. Thinking wait is best at this point. Did have one and only freeze last week after months of happy phone. Hard reset on power button and two days later they came out with the battery / reset instructions. Quite a phone . Thanks again all.

Cheers
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
I'm still confused here... I have both cm browser and the secret codes app where do I search for the device control app??
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
It's in the Google play store
[ZTE ZMAX Guides, News, & Discussion] skinlab:
What is the exact name of the app bro?

There is one app called device control. It is for rooted phone.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
I see now it just adds a code entry for the app itself
[ZTE ZMAX Guides, News, & Discussion] skinlab:
I don't understand.
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
If you try the app by itself it says you need #root but through the code a lot of it is unlocked
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Thank you for clearing that up for me.
[ZTE ZMAX Guides, News, & Discussion] fire3element:
I am sorry if this is out of place, but I have a burning question.

Have a 4gLTE HP chromebook, comes with the free 200mb month deal. I put my sim from the HP in the Zmax. It shows 4g but will not allow any data transfer.

Before anyone jumps down my throat that the 200mb offer is only for tablets, it works just fine in my Lumia 521. If you try to browse the internet on the Zmax, it just redirects you to the Tmo Connect Me page. Clicked on get started, next page shows my account info and amount of data left. I can't really go anywhere from here, all dead ends.

Question is, why does it work on the Lumia? Is there an app on the phone (probably system level) that keeps Android from activating on this plan? Plan is already active of course.

And I suppose if it is something embedded in the Tmo ROM, I am going to need root to turn that off. Shouldn't be APN settings I don't think?
[ZTE ZMAX Guides, News, & Discussion] imattmodz:
It could most definitely be an apn issue. It may not be routing you to the correct proxy and port.
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
Usually the reason for that is because you have to have T-Mobile put the IMEI of the device in their system. Which technically means a new phone and that would break your contract if you have one.
[ZTE ZMAX Guides, News, & Discussion] fire3element:
Mind giving me a direction to look? I have used an app before on a Sprint Galaxy S3 to backup and restore APN settings, but it requires root. Do not remember the name of the app right now.

Wonder if it is possible to get the APN setting from the Lumia, enter them manually on the Zmax.

I will not dismiss that as a possibility. However, I have been moving the sim back and forth and it continues to work. Worst case they close the account. No tears shed :)
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
It dose not look like any of that stuff sticks when I try to play around with them....
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
Some phones which mainly are then newer ones have tethering settings embeded in the android database and proxies.

Change your user agent to blank and it will work fine.
[ZTE ZMAX Guides, News, & Discussion] fire3element:
Just did some internet research. Seems in order to change the user agent, you will need root. Unless there is another way?

Dont want to keep cluttering up this thread. Please PM me if there is any other way to do this. Thank you!

Back on track, where are we trying to go? I don't think I understand the purpose of the dialer codes. Are we looking for information on a particular security exploit, or just attempting to gain general knowledge where ZTE has placed things? Sorry if that is to broad of a question. Tried to word it plainly.
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
There is a load of dialer codes, but some "give" better debugging/development settings.

Some can open access to system and give you more access.
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
I'm thinking maybe the dialer codes may be the back door to r/w. I'm totally new at all this so I might be completely off but I'm Trying to figure out how to enable emode persist prop and find the emode library. Then need to de-obfuscate or something like that to get full code list.
[ZTE ZMAX Guides, News, & Discussion] fire3element:
So the hope here is that one of dialer codes for a debug type menu will have an option to enable r/w to system? Or are we hoping that once a particular dial code is entered, while the menu is open we will be able to write to system?

How do you go about checking to see if you can write to system if you suspect it is open? If you were to try to use an app like Root Explorer or another file browser (I personally really like Xplore), they normally ask for ROOT.

Are you supposed to try to write a file to system via ADB? I dont guess that the Terminal Emulator app would work in this instance being that the menu from the dialer code might need to be open during this time to keep the system writable.

Want to help, just need a nudge in the right direction :)
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
Something like that. All I'm sure of is that in the short time I've been following the xda forums one of the main names that seems to always pop up is [MENTION=2376614]jcase[/MENTION], especially when the topic is about root. He is one of the only people who has successfully rooted the zmax and I don't see him posting the info he did for no reason. He gave us the key we just have to be diligent and persistent enough to figure it out.
[ZTE ZMAX Guides, News, & Discussion] fire3element:
Is this the reason emode always pops up as "Unfortunately, Emode has stopped". Shows up when you go into the *987*0# > Produce Information > Fuse Information. I know that is probably not important info. Just want to now it the message is popping up because Emode is disabled.
[ZTE ZMAX Guides, News, & Discussion] fire3element:
Is this of any use at all?
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
I know where the emode library is I've pulled it /system/lib/libemode_jni.So problem is my knowledge of what to do with it is non existent.... I know a .So is a c library set as a shared object... One we can view everything we need to tear it apart and look at all 110 dialer codes... In the pdf [MENTION=2376614]jcase[/MENTION] posted he said there was no known exploits so I don't think the one he used is listed but he gave us a place to look in a later post when he mentioned libemode

---------- Post added at 04:41 AM ---------- Previous post was at 04:37 AM ----------

Not to mention every time he talks about the dialer codes he mentions all 110 of them... Couple that with the fact that he said emode makes done work and some stop working and I think it means keep digging
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
I read that if you can open the file using Google chrome on your pc you may be able to decode it . It said hit F12, go to scripts tab, right click on the obfuscated code and click de-obfuscate. Should give us all dialer codes if we can figure it out.

[MENTION=2376614]jcase[/MENTION] also mentioned that some codes only work with emode persist prop enabled and others only with it disabled. Again I'm seeing the bread crumbs.....

---------- Post added at 04:59 AM ---------- Previous post was at 04:57 AM ----------

What did you use to pull this up?
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
.rodata = source file(s) rodata directory

Hex edit rodata finding obfuscated text

Use simple decompiler script made by jcase and seperate each obfuscated text then run script to de-obfuscate text to plain text.

The dialer codes shown by jcase were examples of the many dialer codes located on the zmax.

None of the dialer codes shown have any exploits.

---------- Post added at 11:10 PM ---------- Previous post was at 11:08 PM ----------

:D
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
Also he showed the codes to enable the emode utility just not sure how they work. Looks like they all need to be entered at once maybe?

---------- Post added at 05:22 AM ---------- Previous post was at 05:12 AM ----------

This might be a big help as it looks like it might allow higher permissions through adb. What is the code you used to get to this?
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
I think we should focus on getting all of the dialer codes... Then break them down label each one and figure out what they do or don't do.. Once we have that done I have a feeling well know where to go from that point

---------- Post added at 05:37 AM ---------- Previous post was at 05:34 AM ----------

You made my point for me.. Jcase is leading us without doing it for us... Another question is how to hex edit the rodata.. Can you link a step by step or give a decent explanation
[ZTE ZMAX Guides, News, & Discussion] fire3element:
*983*87274#	USBSI	USB Switch Test

Dont have a lot of time to test though. Got a boat load of stuff to do in the next 4 days. Supposed to be leaving to go out of state for possibly a few months.

Need to be 1000 miles away from here on Mothers day.

I will do what I can.
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
Just open the file with a hex editor program. Dig out the obfuscated code
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Yeah I'm looking at it now.. I'll drop a paste bin with what looks like the start.. Someone else will have to use the script though I'm doing this from my phone haha
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
I tried this and it didn't work for me on the dialer. Maybe I need an app or to change a setting?
[ZTE ZMAX Guides, News, & Discussion] fire3element:
I did not change anything I do not think. Back out of the dialer and try it again.

*983*87274#

If it does not work that time, try to reboot. My device is the Univision variant. Do not know if that has any bearing on the results.
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
Still nothing. Maybe something I changed.
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
The code jcase pointed to in his PDF shows us exactly what needs to be done he just gave us directions that were still encrypted, because he didn't want to do the work for us because of flammers, he pretty much showed us that code is the emode code then you need to use that structure to call other codes naitivley meaning threw an app run on the device and use adb most likely to push a su binary and busybox when the code is run naitivley. Basically all we need is someones time that can write what jcase put in his PDF in an app that can root a device, still beyond me but I understand what needs to be there.
[ZTE ZMAX Guides, News, & Discussion] rkey1000:
There should still be a way to do it without it having to be written in an apk. I'm betting the oem didn't have to have an apk to run the code (it surely would have leaked by now if they did) and I'm pretty sure [MENTION=2376614]jcase[/MENTION] didn't need an apk to do it. Just gotta keep trudging and someone will break it.................. eventually.

---------- Post added at 01:45 PM ---------- Previous post was at 01:09 PM ----------

Also I think when he was talking about running codes locally he was referring to using the dialer instead of java or and or something
[ZTE ZMAX Guides, News, & Discussion] ghet2rockuu:
not mines
[ZTE ZMAX Guides, News, & Discussion] TJay99:
Just following up on this. Have you continued to watch your MetroPCS account page to see if the hotspot data usage is now being tracked accurately (i.e., MetroPCS has plugged the APN exploit)? Has it changed?
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
This might help some how to run naitivley binary on android

http://kevinboone.net/android_native.html

Can google it too, google is your friend.

Just keep reading

http://stackoverflow.com/questions/21406328/run-native-code-in-background

http://www.gamasutra.com/view/news/128642/InDepth_Running_Native_Code_On_Android__Part_1.php
[ZTE ZMAX Guides, News, & Discussion] Lesharoturbo:
Do you have before and after speeds? I would like to know more empirical data which had before speeds, update, then after speeds. Connected to the same tower and preferably with little to no time between actions. That is the only easy to know for sure.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
ascii of libemode_jni.so

ok so i i took today off to take the baby to the doctors which also means ive had time to sit down at my laptop and work on some things.......... ive converted the whole lib to ascii... for now im focusing on the section [MENTION=2376614]jcase[/MENTION] posted in the pdf... it doesnt look like all 110 dialer codes are in that section.. im going to start trying to un-obfuscate them so we can see the codes in plain text..... if we dont have all 110 ill run the entire lib through and see what we come up with.. my goal is by the end of the day to have a list of dialer codes so that we can start trying and labeling them no promises though.... i wish i knew what [MENTION=2376614]jcase[/MENTION] used to separate the ro.data from the the lib itself it seems like it would streamline this process a little because right now im dealing with one lump of obfuscated ascii with no separation or breaks..... im posting the section so other people can take a crack at it as well... as i said before this is new ground for me so itll take a while im hoping someone with a bit more knowledge in this are will step up and give me a hand.

the ascii dump of the libemode_jni.so in ascii.. i can provide the hex dumps as well....

http://pastebin.com/20a2YZVB

---------- Post added at 07:43 PM ---------- Previous post was at 07:38 PM ----------

http://pastebin.com/FyQCtaMS

theres the ascii dump for the whole lib just in case any one wanted to see the contents..... not all of it looks relevant but it might be.....
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Woah bro. Did that say z970???!!?

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] Vyrus69:
I'm going back to bombarding ZTE on Facebook regarding a bootloader unlock tool. Every time they post something about the phone I'm replying with Bootloader unlock please!!
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
yeah but its not real, this app will say the some thing for any other phone as will....
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Well. They are Chinese.

They are so stubborn... Well. I'll email them also.

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
Which email address should we bombard
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
I'll see. But if someone finds one before I do plz let me know.

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] jjrx3:
just bought this phone yesterday and im loving it. But i wish there was a root method available.

BTW: does your phone wake/show lockscreen when you get a text? IDK if there is a setting to turn this off.
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Devicesupport@zteusa.com is the email. We all send a variation of one email about the boot loader?

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
john.legere@t-mobile.com and...devicesupport@zteusa.com
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Yes mine does and it locks out my phone when I get bombarded. But what should we send?

Sent from my Z970

---------- Post added at 08:32 PM ---------- Previous post was at 07:57 PM ----------

Also. I tweeted the CEO of zte zmax Lixin Cheng

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] brandonlee96:
i sent these emails to zte support and tmobile support?
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
Being that rude might not help as much as you'd think
[ZTE ZMAX Guides, News, & Discussion] Mizoah24:
No that is a lollipop update. You can download a custom lockscreen. I use ZUI lockscreen. Best custom lockscreen I've ever used.
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
So he still hasn't replied. I wonder why... I politely asked and everything.

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
Just sent my email to Mr. John I'm hoping we can get him to just do this and make us happy to shut us up
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Yeah. I wish that we can just get it so we can go to square three. Ughh life of a blocked dev haha

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
He will respond you dose have to little longer I recently emailed him about throttleing and data plans and the next day one of his reps talked to me about them and he took it seriously and sent what I had said over to the marketing team and next thing I know T-Mobile says there are going to be releasing a piece of art on the 18th of this month...
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Also PS I have a question. Once we get the unlocked boot loader... Then we can work on getting root true?

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
I think once we get bootloader unlocked you can just change the permission of the system file and then throw SU in the xbin I think...
[ZTE ZMAX Guides, News, & Discussion] Lesharoturbo:
There are lots of colons and semi colons. Try uploading in excel as a .CSV file?
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
problem there is how do we know that the colons and semi colons are place holders and line breaks??? they may be placed as a character in the cypher.... like i said im not up on any coding language and i am messing with Jcase's ztedecoder in eclipse trying to get it to work but im dead in the water... if i had more knowledge of java this may be done already..... i have enough experience to know that the syntax is right but i fall short on knowing how to use it...

---------- Post added at 08:44 PM ---------- Previous post was at 08:24 PM ----------

I am going to try your idea though..... i wasnt trying to down it because as far as i know everything is relevant to what we are trying to do so until someone with more know how comes along and tell me other wise im open for all input on the situation... any head way i make will be posted here and im going to quote myself to try to keep everything relevant together so everyone can check my work and make sure ive made no mistakes....
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
Ztedecoder.class

java -cp . Echo "Ztedecoder"

-cp = class path

. = current path

In terminal or command prompt the current path is the folder you are in on the terminal/command prompt.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
still confused on that.. does this mean i need to move the ascii libemode to the same directory as the the built decoder to gain a list of all the dialer codes... i have it written up and running without errors in eclipse.. i know it sound stupid but im new to this and im the only undertaking this part so id like to fully understand what im doing for most of this is about the knowledge....
[ZTE ZMAX Guides, News, & Discussion] Lesharoturbo:
No problem. I was just throwing out some ideas. Believe it or not, I have found stuff to be that simple in some cases. I hope it works.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
im throwing an error through my terminal saying that it cant load or find the main class.... im specifying the classpath directory should i be pointing it to the actual ztedecoder.class file ??