yashsingh1/xdaforums huggingface dataset:
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
OK so now we have a few exploits to try now we just need to test them... I don't mean to come across as an idiot but how.. Do we have to compile then to apks and push them... If they do gain root through the exploit how do we know or how do we delegate that permission to ourselves.. Is it as simple as have our written apks cp the su binary to the system folder???.. This is was I was talking about when I asked j case for direction... After things aren't as busy here I need to take a serious look at learning how to do this.

[MENTION=2614663]shabbypenguin[/MENTION] surely someone with your reputation here could give us a crash course in what to do I don't need specifics just need enough to begin to understand the over all process.. Any info would be much appreciated...

We should add a proposed exploits section somewhere on here to track what is being worked on..
[ZTE ZMAX Guides, News, & Discussion] shabbypenguin:
reputation, but im sorry to say i know nothing of the stuff mentioned here. the asec exploit was one made by jcase, i merely wrote the script to target teh concord 2, previous devices i have rooted have been samsungs where flashing via odin was possible. so i flashed a custom image until i got one that quasi booted and used that to gain root privileges, nothing like what is needed for this device.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
More of what I was getting at is you know the process much better than I. And you have more experience than I do lol...I found a premade jar for the master key exploit but can't make heads or tails of it I can't tell if you need to modify the apk or if the script is modifying it for you...

https://github.com/Fuzion24/AndroidZipArbitrage/blob/master/Readme.md
[ZTE ZMAX Guides, News, & Discussion] shabbypenguin:
Oh my thats an old one, this was patched in 4.2 iirc. anyways you'd need an apk that is capable of rooting once the edits have been made to it, then teh jar modifies it so that it will be escalated and thus run at what your apk can then root with.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
See point proven ;).... So if I posted you a cve code or two could you give input on them.. I just need fresh eyes and a good opinion.. With the experience you have you can provide a decently fresh point of view.. As I said with jcase if you choose not to its fine no arguments I can understand how busy life can get....

And if you wouldn't mind.. I missed the previous conversation on the asec vulnerability.. Was it said that it wouldn't work

---------- Post added at 01:38 PM ---------- Previous post was at 12:45 PM ----------

OK so for the exploits my untrained eye sees as the most likely to work for us ( I very well could be wrong )

Cve-2015-1530 --- this one is the newest just posted in March....

Cve-2015-1474

Cve-2014-7911

Cve-2014-8609

These last two are iffy based off of the build date I pulled from the builb.prop on the phone these were posted way before but I believe we should still try them. I need experienced opinions if there are one clicks using these let me know so we can look into them
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
android / platform/frameworks/native / 38803268570f90e97452cd9a30ac831661829091

https://nvd.nist.gov/cvss.cfm?version=2&name=CVE-2015-1474&vector=(AV:N/AC:L/Au:N/C:C/I:C/A:C)

---------- Post added at 07:07 PM ---------- Previous post was at 07:06 PM ----------
[ZTE ZMAX Guides, News, & Discussion] kardeef:
I would like to apologize for any and all my my post. I will not post again unless I fully discover root and test it on my phone.I did figure out how to unlock the phone for other carriers.Again I was hoping something in there might help...piece :)
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
The first exploit I posted wasn't released into march of 2015 and wasn't patched until 5.1 so I doubt our phones are patched..... Considering the build date listed in the build prop is June 2013.... And it works almost the same way it invokes an integer overflow in an audio manager....

---------- Post added at 05:47 PM ---------- Previous post was at 05:44 PM ----------

Introduction

An Integer overflow in the BnAudioPolicyService::onTransact function in frameworks/av/media/libmedia/IAudioPolicyService.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of count value.

Affected Android version

all versions below Lollipop 5.1

Patches

Android Bug id 18226810

---------- Post added at 05:49 PM ---------- Previous post was at 05:47 PM ----------

That's why I'm looking at that as our best bet.. Can't patch what you didn't know about... But I'm still worried that at most it'll only grab a temp root....

---------- Post added at 05:50 PM ---------- Previous post was at 05:49 PM ----------

That and this is going to take a while I'm learning java from the ground up
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
I have extensive java knowledge however I can conceptualize it or teach it to someone better than write it, however I can write very well if I have someone to teach ;)

---------- Post added at 07:55 PM ---------- Previous post was at 07:54 PM ----------

It goes hand in hand because your insight and knowledge is vastly important as well, as well your learning process is vital to the development process.

\When you have time come to the twitch we will start researching on how to capitalize the integer overflows

---------- Post added at 08:01 PM ---------- Previous post was at 07:55 PM ----------

Here are the CWE's. If we can get a terminal virtual emulator environment to test these on that would be ideal.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
You are absolutely correct the patches for 4.4.4 did not work to negate exploitation. 5.1 Lollipop has definitely been compromised however. Don't update.

The gaining of privledges will stick because it is written to the tombstones file, and that is exported.

---------- Post added at 10:02 PM ---------- Previous post was at 09:09 PM ----------

with the Java Development kit, Expand/unflatten the graphics buffer to analyze the threads so at the same time and will also be analyzing integers to encapsulate the integers on unflattening threshold, and the take corruption and put it back into the thread process, vectoring the tombstone file. At that point you will stop the process and export the tombstones. It could be that you need to write permissions at the threshold of integer corruption.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
See that's my worry when we reboot isn't everything just going to remount (including the su.bin) without permissions I'm all for working toward temp root I'm just trying to figure out what we are going to get...
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Ive already explained, respectively. If you look through the documentation of the google coder, the tombstones was exported to his dropbox. Its a definite exploitation however, I can write this Its just going to take time within a virtual terminal so the output can be analyzed.
[ZTE ZMAX Guides, News, & Discussion] Ra.burt86:
BIG thanks to the DPI changing tip!!!!
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
Nexus tools changes DPI so you can get better density and a couple other tweaks
[ZTE ZMAX Guides, News, & Discussion] therealduckie:
For clarification...

I did not add the DPI change to the main post because it can be found elsewhere on the site and it is not specific to this phone. Same goes for any tweak that is not phone specific. Otherwise, if I added every single possibility, app, tweak, etc - the first post would be miles long.

This site is a great resource if you do a bit of searching.
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
You don't even need the Nexus Toolkit. You can do it via ADB.. Just type "adb wm density <value>" and if you want to change it.. Type "adb wm density reset"

The toolkit just maps adb commands to buttons on a GUI.
[ZTE ZMAX Guides, News, & Discussion] kardeef:
I am learning java myself now because it seems like you need to know to make apps for the droid. Most of the java I know if from writing Tradewars scripts. I'm proficient in C/CPP and java to me is about 90% the same as CPP if that helps . Besides trying to root this phone , I'm also reading up on building apps. It seems like I keep being pulled from C/CPP . I was wondering what the consensus is on writing apps ...language ... environment and platform. you can message me or email me at kardeef@yahoo.com. Thanks in advance, and I would apologize for getting off topic.

---------- Post added at 05:52 PM ---------- Previous post was at 05:41 PM ----------

aye its like buried treasure.. a pain to find ,but I usually find twenty awesome things before I find the mediocre thing I was looking for. 90% of the time I end upon finding gold that has absolutely nothing to do with what I started for.
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Has this already been posted? Seems familiar but, What is the CVE number?

www.packetstormsecurity.com/files/129170/Android-Privilege-Escalation.html
[ZTE ZMAX Guides, News, & Discussion] Planterz:
[MENTION=4610662]therealduckie[/MENTION] It had been a while since I actually looked at the first page of this thread, and I have to compliment you on your OP. Attractive and well arranged, and you've compiled a wealth of relevant info and links. I'm glad this device has you to look after it. Well done.:good:
[ZTE ZMAX Guides, News, & Discussion] kardeef:
If we can make it call a object with no methods, I know for a fact in CPP the constructor of that object is called technically before the object is instantiated. we could make a generic object and put all of our relevant code in its constructor. I might be talking out my a$$....just throwing in w cents there.. don't know if it furthers along. My java is weak to put it mildly,lol
[ZTE ZMAX Guides, News, & Discussion] klobster:
Changing the radio preferences to LTE only seems to persist even after a hardware reset. No idea where that info is stored, though.
[ZTE ZMAX Guides, News, & Discussion] therealduckie:
Glad you like it. I just wish it looked as good in the mobile app.

Although there is still the random new person straying off topic, it has generally been a pleasure. Especially with the latest developments.
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
So close but so far away ugh I bet it's getting irritating. Just updated my LG G2 to lollipop and enjoying root!!! Miss this phone it just sits in my drawer. Can't wait for root tho should be one hell of a phone to tinker with!!
[ZTE ZMAX Guides, News, & Discussion] Vee63b:
Ok. So I'm calling it quits for a bit; been trying for 2 days to go via ASEC. Its a no-go, I'm sure I'm missing something, I know 4.4.2 isn't patched. Between Med school and this ZMAX, my brain is fried. Lol, it's time for a bit of recover time to clear my mind and see if I missed anything.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
I believe that is one of the cves I posted the other day.. I still think the most recent exploit found is our best bet.. I've had to put my java exercises aside.. [MENTION=6416282]kardeef[/MENTION] couldn't you code one of the exploits through the NDK ??

---------- Post added at 07:41 AM ---------- Previous post was at 07:39 AM ----------

I was pretty sure the NDK was out in place to accommodate c/cpp I could be wrong though
[ZTE ZMAX Guides, News, & Discussion] djc7980:
T-Mobile Lollipop Update

I wanted to check to see if this was true. So i chatted with T-Mobile support. See below

T-Mobile: We have received your information and will connect you with a T-Mobile Chat Specialist soon.

Danilo B: Hi Daniel!

You: hello

Danilo B: Thank you for bringing this to our attention, i will have this checked so that we can provide you the information that you need.

Danilo B: I am checking on the device specification as of the moment.

You: ok

Danilo B: Please allow me a moment, thanks.

You: sure

Danilo B: Awesome!

Danilo B:

Thank you for waiting, I did check on the ZTE max and it shows that the 5.0 Android is not yet available for your type of device, the most updated one will be Android 4.4 (Kitkat), you will be notified once the update is avalable for the ZTE max.

Danilo B: Do you have any further request for me that I can address as of the moment?

You: are you saying that we will be getting the update at some point in the future?

Danilo B: Yes, you will be notified once the update is available for the ZTE device.

You: ok that wall all I need to know

Danilo B: I appreciate you taking the time to chat with us, may you have an awesome day!

Danilo B: Take it easy, bye!

You: you too thank you

The agent has exited the chat. Thank you for chatting with us today.
[ZTE ZMAX Guides, News, & Discussion] kardeef:
I'am really busy till Monday evening. During that time when I get a chance I will fully read up on the NDK and the exploit, after that I should be able to put forth 8 to 10 hours a day on that exploit ... PS I think with all of us going at this problem from different directions we will find one or more ways to get PITA([P]ain n [T]he [A]$$) Zmax Rooted. I will post updates on this angle of attack per success or failures.. Good luck on all you ;)
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
BIG NEWS EVERY Body with OVER HEATING ISSUES FROM CHARGEING WORRIE NO LONGER I FOUND OUT THAT THE HEATING WSS CAUSED BY AN APP CALLED "Z activities DEMO" or something like that go to your app manager and delete that bull"""""!!!!! I played 5 races of airbone 8 my ZTE is still not hot!!!!! And there is no CPU throttling!!!!
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Only time mine got hot was when I was really hammering it with terminal sessions searching for fines pertaining to root
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
Just got my leather phone case that doubles as a wallet and stand, works great
[ZTE ZMAX Guides, News, & Discussion] mingolianbeef:
Just throwing a bone out, I read on one of those posts in this thread:

http://xdaforums.com/showthread.php?t=2478426&page=3

That they signed the zip using a test key and achieved root. Stock recovery hasn't changed all that much over the years, can we use this info to create a spoof recovery zip and send root to the /system?

Edit: Send SU binary and superuser.apk I mean
[ZTE ZMAX Guides, News, & Discussion] ghet2rockuu:
i dont have that app in my phone ...,. and i never deleted it . is yors from tmobile or metro
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
T mobile.
[ZTE ZMAX Guides, News, & Discussion] valve timing:
Yeah mine either I'm on metro
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Aosp may not be patched but zte may have patched it themselves you have to count on any exploits found before release to be patched...

---------- Post added at 01:43 AM ---------- Previous post was at 01:42 AM ----------

The problem is if it doesn't work your running a big chance of bricking your phone
[ZTE ZMAX Guides, News, & Discussion] Vyrus69:
Can someone give me a quick step by step on how I'm able to push the SU files onto this phone via ADB, I think I may have found a way to root, and its something completely different from what anyone is trying here, its actually something I shouldn't be sharing but you know what.. F it. I just need a way to install the binaries to make sure it works since I can't flash the binaries via recovery.

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] skinlab:
$ adb push busybox /system/bin

$ adb push su /system/bin

$ adb install Superuser.apk

$ adb shell

# chmod 4755 /system/bin/busybox

# chmod 4755 /system/bin/su
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
https://plus.google.com/105855773732882713268/posts/MKgqJSxfSP7 lollipop baby!!!!!! https://31.media.tumblr.com/2e7ef022bf282e47c3704b7d1b53715b/tumblr_inline_ne6mwmwmU21qkt4ti.png
[ZTE ZMAX Guides, News, & Discussion] ghet2rockuu:
why not share ? maybe other devs can help smh owell goodluck
[ZTE ZMAX Guides, News, & Discussion] Vyrus69:
Isn't there a special mode I need to be into in order to write to the system partition?

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] mingolianbeef:
He makes getting root sound like an illuminati initiation lmao
[ZTE ZMAX Guides, News, & Discussion] Vyrus69:
Lol yea I gotta be incredibly vague about it.

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] therealduckie:
No, you don't. Do you even know where you are?

Also, how do you plan on rooting when you do not even know the baby basics of adb?
[ZTE ZMAX Guides, News, & Discussion] Vyrus69:
I know how to use adb, I'm not an idiot, I was asking about the way someone was able to push the files onto THIS phone.

This isn't using any exploit, but its something I can get in trouble for if I don't do this the right way.

I'll share more details IF it works.

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] lkchrono:
Upstate NY
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
Kansas City MO. With only 3 bars of 4G LTE :) download speeds are wicked. Upload not so much but that doesn't bother me.
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
I've never had a phone download at 60+ Mbps wtf are you guys on
[ZTE ZMAX Guides, News, & Discussion] ubigred:
Not the phone. It's the network
[ZTE ZMAX Guides, News, & Discussion] Reallionare:


Tried to upload my speeds 85/downloads 25/uploads on wifi 5g.

Will not let me upload results....

T-Mobile is my carrier..
[ZTE ZMAX Guides, News, & Discussion] biledigger:
Do that with and old fashioned gingerbread 2.3.6 huawei that is on the lte band and only pull off 3-4 mbps download speed caps and tell yourself its just the network. Your phone hardware makes a massive difference as well alone with what software is eating up your idle background bandwidth. I have compared this phone with my friends iphone. Same network. Both lte. Mine capped at 61.30 mbps while his capped at 23.76 mbps. Multiple tests ran. The zmax was consistently in the 50-60's while the iphone was in the 20's. There are multiple bandwidth spectrums and multiple ways to configure them.
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
Well what network are you guys on
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
My download speed is 66.65 mb/s and upload is 22.04 mb/s pretty fast for MetroPCS

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] biledigger:
I am connected through a series of networks starting in Oklahoma leading to the host t-mobile tower in Houston Texas. My service provider is MetroPCS.
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
I have metro to. What the hell man lol
[ZTE ZMAX Guides, News, & Discussion] valve timing:
Anyone have any issues with ubersync for fb still can't get it to sync properly
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
Have you tried shutting off your sync in your settings under accounts. Than turn them back on
[ZTE ZMAX Guides, News, & Discussion] valve timing:
Yeah I'm in the process of doing that now I removed Facebook and Google to completely re sync all contact's
[ZTE ZMAX Guides, News, & Discussion] rfunderburk39:
I've followed and read the majority of the closed thread and read I believe all of this thread. I do not remember anyone using Towelroot with modstrings. Has that been attempting? I've tried with the original 3 and the ones suggested for the ZTE Concord 2. If this has been covered I do apologize.
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
http://blog.cassidiancybersecurity.com/post/2014/06/Android-4.4.3,-or-fixing-an-old-local-root

This could work for the T-Mobile version.

---------- Post added at 08:24 PM ---------- Previous post was at 07:48 PM ----------

That is patched!
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Why did the T-Mobile version come with 4.4.2? Other than MetroPCS version being 4.4.4

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
Yes it did and its still stuck on android KitKat 4.4.2.
[ZTE ZMAX Guides, News, & Discussion] mingolianbeef:
Send it to me in a PM, and I'll give the creds to the root Gods lol. We'll have the mods wipe the thread of our exchange to clean up the papertrail, BOOM!

Seriously though, I mean like considering the fact that Android is open sourced, unless you are using tools from an OEM or ZTE themselves that is closed sourced and not publically accessible, then you shouldn't have issues releasing. If you just wanna release and not get any repercussions, release it on one of those russian forums like 4PDA under a different handle. I'm just throwing out extreme ideas here.

---------- Post added at 10:55 PM ---------- Previous post was at 10:18 PM ----------

Okay so just throwing another bone out there, this guy used a modified version of the Xperia exploit (which had a locked bootloader as well) to cook up a root for the ZTE Valet. I'm not saying use this file, but he did put his source stuff out there WITH the apk on github if there are any devs that wanna look at it and toy with it. It may or may not be of help, just figured it was better to say something and it not work than to say nothing at all :)

https://github.com/Unkn0wn-0nes/RootMyValet
[ZTE ZMAX Guides, News, & Discussion] klobster:
That rootmyvalet guy is using the gliefroot method which uses the qualcomm exploit which is a nogo for this device.
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
This isn't flashed using recovery, its run using adb, and is a exploit it might work, or could be used as a template to write one of the other exploits we think might work, just need someone to try it, and or start to code the other exploits posted that we think might work. Good find this is very good.

---------- Post added at 07:21 AM ---------- Previous post was at 07:18 AM ----------

---------- Post added at 07:24 AM ---------- Previous post was at 07:21 AM ----------

This could also be used as a template, if you run a fresh build it needs a some editing most likely to work for our device, but another good template to show us how to use an exploit

If someone wants to try this it doesn't look like it could hurt. Might work need a tester to use the rootmyvalet.apk

Push the su binary to /data/local/tmp using adb push su /data/local/tmp

Push the roothandler binary to /data/local/tmp using adb push roothandler /data/local/tmp

Set the roothandler binary permission using adb shell chmod 0755 /data/local/tmp/roothandler

Push the installsu.sh script to /data/local/tmp using adb push installsu.sh /data/local/tmp

Set the installsu.sh script the execution permission using adb shell chmod 0755 /data/local/tmp/installsu.sh

Install the APK using adb install RootMyValet.apk. If that does not work then type the full path to the apk. E.G. adb install /path/to/apk/app.apk

Start the app on the device, hit the button that says "Push SU Binary"

Wait about a minute

Make sure you follow all the adb push and set permissions from the post, then use the root my valet and it might work again I don't have a working computer or I would try this right away.
[ZTE ZMAX Guides, News, & Discussion] Rusell:
Soo my ZTE Zmax is somehow messed up. I havent rooted, or even attempted root. I have reset 2 times but nothing, and no insurance gotten ?.
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
https://www.dropbox.com/sh/5grssxig4pn7ceo/AABpaiNHjkTd--yxp6Ax_Lq-a?dl=0 been playing dead trigger for an hour on the charger no lag!!!! And its not heating its CPU to 190F° ( yes 190F°) again delete the app called Z activities demo or something along the lines of that!
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
Clear cache or data a couple times from recovery might fix your phone, maybe a new Sim card from your carrier
[ZTE ZMAX Guides, News, & Discussion] Rusell:
Well it took about 5 wipes till it started to work again... Thanks, i was about to give my hopes up.

---------- Post added at 01:56 AM ---------- Previous post was at 01:56 AM ----------

Can you locate us were you will find this app?? Maybe screenshot?
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
To late I deleted it but you should be able to seen it when you go through the all part of the app manger...