[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Toor

Your insight and inquiry is more than welcome you all are welcome to the channel @ twitch.tv/sketchscarz. I am 24 7. When im here im in front of the computer developing and ALWAYS doing something interesting involving the community. I appreciate the want to learn from all of you. The process is first come first serve you have to be there to experience the innovation and what is actually happening. To perceive the understanding of what the process is doing and what is has done requires and immense amount of patience and focus.

Please advise, I am only trying to assist and help one another. Be excellent to each other, and party on dude!

But on a serious note, a lot of the developers and I are onto some really neat things. We have since yesterday found new code0 and new interfaces to work within. It takes time to perceive the understanding of what it is doing by researching on google and manually recompiling the code.

The fuse mount is definitely trickery. I believe it is a failsafe raid. Mountpoint tells me this.

while system is mounted, root is not. This is very interesting considering the security of the filesystem.

busybox mountpoint /root

mountpoint: /root/..: Permission denied

1|shell@draconis:/ $ busybox mountpoint /system

busybox mountpoint /system

/system is a mountpoint

shell@draconis:/ $

Stay tuned.

---------- Post added at 04:37 AM ---------- Previous post was at 04:11 AM ----------

I dont know if this will work in a linux distro but go ahead and try it:

1|shell@draconis:/system $ busybox pivot_root / /sdaroot

Assuming ownership is the first instinct kind of thing.. Would it be weird if Linux pulls this off? Or the meterpretor?

---------- Post added at 05:17 AM ---------- Previous post was at 04:37 AM ----------

Use busybox invoke in all instances and lines. try this on different distros, as well as the pivot root in merterpeter. Next step is actually unmounting this mounted virtual drive. it would be nice to know how fuse is mounting this particular image. We have probably passed it up in all our searching. May need extra time to reflect.

$ ls -l /bin/ls

lrwxrwxrwx 1 root root 12 Apr 13 00:46 /bin/ls -> /BusyBox

$ mount /dev/hdc1 /mnt -t minix

$ chroot /mnt

$ ls -l /bin/ls

-rwxr-xr-x 1 root root 40816 Feb 5 07:45 /bin/ls*

---------- Post added at 05:21 AM ---------- Previous post was at 05:17 AM ----------

1|shell@draconis:/ $ busybox mount /dev/hdc1 /mnt -t minix

busybox mount /dev/hdc1 /mnt -t minix

mount: permission denied (are you root?)

This you may try over and over in different distros. You may have to wait until I find the mountpoint which is /system.

---------- Post added at 05:44 AM ---------- Previous post was at 05:21 AM ----------

I am getting EXTREMELY CLOSE to the fuse mounts and how to interface them. Its actually trickery. FUSE provides and interface through busybox to mount your own filesystem. Directories that are read as Permission denied are now reading for some reason through this simple code. The blocks and the main parts of the system are now revealing itself to me. I will probably creating my own adjacent fuse mount and reallocating the permissions by invoking my filesystem as pivoted.

RAD. I hope this works.

1|shell@draconis:/ $ busybox df

busybox df

Filesystem 1K-blocks Used Available Use% Mounted on

tmpfs 952548 132 952416 0% /dev

none 952548 12 952536 0% /sys/fs/cgroup

tmpfs 952548 0 952548 0% /mnt/asec

tmpfs 952548 0 952548 0% /mnt/obb

/dev/block/platform/msm_sdcc.1/by-name/system

1545864 846088 699776 55% /system

/dev/block/platform/msm_sdcc.1/by-name/userdata

12209680 1767624 9820284 15% /data

/dev/block/platform/msm_sdcc.1/by-name/cache

805408 12856 792552 2% /cache

/dev/block/platform/msm_sdcc.1/by-name/persist

40296 4184 36112 10% /persist

/dev/block/platform/msm_sdcc.1/by-name/modem

131008 57952 73056 44% /firmware

/dev/fuse 12209680 1767624 9820284 15% /mnt/shell/emulated

/dev/fuse 12209680 1767624 9820284 15% /storage/emulated/legacy

---------- Post added at 06:20 AM ---------- Previous post was at 05:44 AM ----------

has anyone tried flashing this in recovery? http://download.chainfire.eu/578/SuperSU/UPDATE-SuperSU-v2.14.zip?retrieve_file=1