yashsingh1/xdaforums huggingface dataset:
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Yes but is the pc app more consistent?
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
The pc version of kingroot will not work as kingroot relies android ui restarting and temporarily including the kingoroot file in

/data/local/temp/

In the service list giving temp root in the user level.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
As far as dirty work I'm just trying to learn... I remember when it was asked if a pre-existing root method was found to work that person would receive a portion of the bounty...I'm not going to tell people how to spend their money but if I find a full method hand holding or not [MENTION=5885045]tech_yeet[/MENTION] will be the reason I got there as well as [MENTION=2914935]loonycgb2[/MENTION] and [MENTION=2376614]jcase[/MENTION]... I've been led along those 3 have done the work and found and achieved working temp root just my 2 cents
[ZTE ZMAX Guides, News, & Discussion] Rusell:
Overclock with No-frills CPU Works :p

That's the only thing that has worked for me so far
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Kingroot pc didn't even work for me. I'm on metropcs 4.4.4. I ran it 5 times. USB debug is on. I never took the update also.

Dunno, I keep getting the big ass red X..
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
So is about as consistent as the app good to know
[ZTE ZMAX Guides, News, & Discussion] skinlab:
I vote for xtremeasure to get a chunk of the bounty. He has been kicking ass.
[ZTE ZMAX Guides, News, & Discussion] hroark13:
I want 3 percent of the bounty, if I dont get it, I will cast my magic spells on all of you and you will get explosive diarrhea
[ZTE ZMAX Guides, News, & Discussion] kardeef:
Extremeasure,tech_yeet,loonycgb2 and jcase I want to thank you guys for the work you have done so far . know its appreciated :)
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
Can someone upload the triton symbol APK?

Z999LP-A-LTE
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
So let me get this straight. You believe you get the bounty? Or at least part of it? Because I'm sure that you, jcase, and xtremeasure are part of the kingoroot team. Jcase got the ball rolling faster than anyone else did in terms of us getting root on our own. Tech_yeet showed us the kingoroot app. So I'm trying to figure out where you did the dirty work. See I've already donated to jcase because who couldn't use a beer one in a while and it was also an apology of me acting like a complete utter asshole to him because I wasn't getting what I wanted. Honestly everyone in this thread should get some of the bounty because everyone has contributed in some way. So how about we set this right, right now. Pay your part of the bounty to whoever you believe deserves it.

¯\_(ツ)_/¯
[ZTE ZMAX Guides, News, & Discussion] hroark13:
OK so

Can someone that has successfully gotten temp root using this Kingo 4.0 give some details on their phone

Which Carrier is it

Which Firmware version / Android version is it

Did you disable that LookOut Software

Anything else enabled or disabled that may be related

Did you update all the App in PlayStore

I am not having any luck with this

I Installed KingRoot-4.0.0.233-release-201505071219_105001.apk

I have the Univision Model Android Version 4.4.2

Build B22

I disabled look out

Tried doing factory reset and doing it again

Keep getting the Pink Check Mark screen Which I take to mean it failed
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
The one have the Chinese stuff on it....

Z999LP-A-LTE
[ZTE ZMAX Guides, News, & Discussion] hroark13:
I am donating 20 dollars of the bounty to myself

Can not say, I did not do my part
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
I have the T mobile version running android KitKat 4.4.2 with look out disabled...

Z999LP-A-LTE
[ZTE ZMAX Guides, News, & Discussion] krazyone2006:
The way I have gotten kingroot to work on my updated Metro PCS 4.4.4 version is I uninstall all the kingroot apps, reboot phone install kingroot, plug phone in to charge and have to run it 2-3 times and it roots. Unplugged I can't get it to root. Lookout has been disabled since day one that I got my ZMAX.

It seems to unroot on its own too haven't been doing anything on my phone except posting on here and the root is gone now if I go into root checker and check it it says I don't have root now.
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Kingroot and Kingoroot are 2 totally different apps.
[ZTE ZMAX Guides, News, & Discussion] steventechno:
We got temp root?

WOOT awesome! You guys are slaughtering out there in this battle! I wonder if it's possible to install xposed as it can function without root after installation?

I'd try it myself but right now my USB cord is being used by my external had doing a "full" format which has been going at it for 4 hours now. Blah!

Anyways keep it up! You're doing great.! Lotsa Hugs. :victory:
[ZTE ZMAX Guides, News, & Discussion] 13roomshh:
I still new..but..do u think that the dialer codes could be used to disable a feature that keeps

Checking for root..maybe that why it keeps unrooting

If not..just a thought...
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Will a logcat tell us what is interfering with the temp root? I acquired temp root with the apk. There is some sort of time interval check for code.. I didn't do anything and after about 15 minutes, root said seeya....

Temp root that is....
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
You may wanna go back thru the thread and find out where i asked for part of the bounty if i remember i said i wanted none of the bounty.

No offense to jcase, but everyone thinks what jcase shared was a huge map to root. He gave you a clue where to look since emode does have multiple vaulnerabilities, but since most here posting barely know how to read java then it would have been 1:100000 for anyone to exploit the holes.

When i say this to you and i mean only "you", if you feel im after the bounty then its cool. Ill just stay out of this entirely and allow you guys to keep going. As it is the ones who are trying to learn are close.

Take a look at /data/local/temp/ after rooting with kingroot.
[ZTE ZMAX Guides, News, & Discussion] SweepTheLeg13:
Should we copy files out of temp location
[ZTE ZMAX Guides, News, & Discussion] xIP-:
Did i just brick my phone?

Ive been trying the kingroot app over and over again. Restarted more than once, and so this is the second time upon reboot i got the "android is upgrading" notifacation before i was taken into the launcher.

Only this time, once i ran kingroot, around 30 something percent my phone freaked out and all the apps said they stopped.

then the phone rebooted, and the metropcs boot animation cameup, the metropcs boot animation finished, but its still there.

it will not go past the damn boot animation.

Im really upset, isnt this phone one where you cant remove the battery? what the hell do i do now?!
[ZTE ZMAX Guides, News, & Discussion] Xt51:
Dang! The great Hroark jumped in on this train :D

Nice seeing you here :thumbup::)
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
The boot froze, just hold power button till it restarts.
[ZTE ZMAX Guides, News, & Discussion] krazyone2006:
Just hold the power button down should reboot it have had that happen several times today. LoL
[ZTE ZMAX Guides, News, & Discussion] steventechno:
That's not good.

You should be able to power it off by holding the power button for a long time, but if it doesn't come back to life you may have to take or to the store and say it happened randomly while on charge and it your kitty knocked your water bottle onto the phone.
[ZTE ZMAX Guides, News, & Discussion] SweepTheLeg13:
So are you guys using king.. Or kingo?? And the file called "encrypt" in the previous screen shot is a red flag.. Imo
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
LOL..ok I started working with sketch skarz and was working side by side with him looking at exploiuts that fell after the build date of the phone... that post is there in the beggining of the thread.. plus all of the work i did through meterpreter.... then im the one who compiled jcase's script and sat for a few hours going through the libemode_jni.so de-obfuscating all of the ussd keys. then i went through and tried everyone and posted the results in two list.. since then i was running through logcat looking at things as each of those services started and stopped trying to find something tht jumps out at me in a language i dont understand.... now im doing the same but trying to get some of the things that dead ended and didnt make sense to make sense and monitoring different output while im tmp rooted..... not to mention working over 40 hours a week and taking care of a new born and a girlfriend who just gave birth... If you look i wasnt asking for ANY part of that bounty myself i was making a case for tech_yeet who may have paved the way for a full root... but yeah no dirty work here......

Now as far as what kingroot drops in the data/tmp.... think you can yank copies of those files for me [MENTION=2914935]loonycgb2[/MENTION]
[ZTE ZMAX Guides, News, & Discussion] fire3element:
EVERYONE NEEDS TO CUT IT OUT WITH THE BOUNTY B.S. LIKE NOW!

Tech_Yeet: Thank you for the find

Extremeasure: Thanks for digging through the dialer codes

Jcase: Repected Dev. Thank you for the hints.

Loonycgb2: Thank you for your input

DroididLINUX: Thank you for your input

If you feel any one of these is worthy of the bounty, vote with your wallet. I think the bounty need be put aside now.

Private donations are the way this needs to be handled. END.OF.STORY

I also tried to help, with what limited knowledge and theories I have. I translated many of the screens and text from the app. Do I also deserve part of the bounty? Absolutely not.

We are a COMMUNITY, and I request that all of you grow up and act as such.

Was trying to be nice before. Looks like a good stern stance is the only thing people pay attenetion to.

NO MORE BICKERING. I MEAN IT.

Let's stick to the subject and get this thing done.

Alright everyone? Only relevant info from here on till we attain the goal.
[ZTE ZMAX Guides, News, & Discussion] hroark13:
Mind if I pick your brain a little, I dont want a hand out or to be spoon fed, just some advice.

So there seems to be 3 root methods mentioned in this thread.

Jcase method that he refers to in his pdf with emode commands

Your method, which I think your may be doing threw download mode

And this KingRoot method, which I am not sure which vuln it is using

I would like to ask a few questions about your method is that is OK with you.

Have you been able to get the phone the Qcom qusb streaming mode, where the nand is in SD card mode, and can be accessed from a Linux computer as /dev/sd?

The only way I could get into something similar, is to hold power up and down while I power on the phone and you get the red LED, but it was not in streaming mode, there may be some commands that you need to send to it to do so, or you may need the msimage files to get it into that mode, been looking for stuff like that, but have not had any luck.

So since you can write to the recovery partition in download mode, have you tried writing an unsigned recovery (repacked) to see if it would boot the un-signed recovery

I am kind of guessing that you got the phone into streaming mode, did a DD of the system partition, mounted it oon your Linux computer and added the SU binary to it, unmounted it, and used DD to flash back to the phone

Am I close at all on any of this ?

If you would like to share any info privately because you do not want it released to the public, I can keep a secret.

If you search around for my name you will find that I contribute a lot to recoveries and ROMs and such, I am just not good at this exploiting part yet, I want to learn though

any way thanks in advanced for any info you share with me
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
Anyone having issues with kingroot follow this to get root everytime.

1. Make sure either your wifi or 4g lte is constant and fast. Any type of slow connection will fail the root.

2. Before trying to re-root after a failed try go into the app info of kingroot and clear data then remove kinguser.

3. Before running kingroot connect your phone to a pc and start a adb shell connection and run the command

adb logcat kingroot-sdk:I *:D *:S

This will force android to constantly trace kingroot making freezes and such happen less. (this step is not needed but helps)

4. When rooted do not run any apps that continues to try and make /system or any files writable or else it causes a buffer overflow and clears memory making you lose root and the phone reboot.

I have been testing kingroot to see what exploit they are using and i have managed to stay rooted this way all day.

---------- Post added at 06:34 PM ---------- Previous post was at 06:16 PM ----------

jcase did not root using emode dialer codes, as to now he has not mentioned what he has used, but he has shown he has more access then normal.

As for download mode i tried to copy another zte method by using download mode to upload signed versions of there update style, but i could not.

The way i rooted was by exploiting the zte qualcomm modem and sending calls to the modem to get the system user to create a symlink to xbin from a su binary located in the temp partition. I ended up with permission issues not allowing me access to any other partition except android partition.

As far as the "streaming mode" it is called the zte diagnostic interface which is the same interface started when in download mode. This interface can be started using the emode dialer code to get to the usb test menu where you can enable all interfaces. This also is a vulnerability as you can upload unsigned files with the same firmware file names, but if the file is incorrectly made then it will cause the system to brick.

There is maybe 2 other emode vulnerabilities that i "think" may work, but i have not tried exploiting them.

Kingroot as far as i can see is using a random buffer overflow using the system ui which causes the system to become writable for a couple of seconds. If you watch the actions it does it in logcat it will constantly check for system writable to get shell access and change su id and group to 0 making kinguser one of the system users by adding a shadow file including kinguser.
[ZTE ZMAX Guides, News, & Discussion] hroark13:
wow, OK so I was way off

Thank you for the reply and all that info, I am gonna re-read a few times, and see I can figure out what you did.

The KingRoot method does not seem to work at all for me.
[ZTE ZMAX Guides, News, & Discussion] jcase:
Bounty needs to go to Idler Fang and his co-researchers (from keenteam), or needs to not be rewarded at all.

Yes I know how Kingroot roots the phone, its abusing the ping use after free vulnerability (I'm not actually sure how its doing this on 32bit devices at this point).

As far as I'm aware, no one posted any original research or fruits of research except for them (in the form of the exploit that KingRoot uses), or I with some insignificant analysis of emode's library, how the zteroot.apk worked and some code for decrypting some dialer codes.
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
I did not include full detail due to the fact i wanna keep anonymity to my work till i can fix my own root issues.

Also not sure if you remember me from the lg optimus f6 as i worked in the background getting the F6 & F3 loki patched.

I helped out on unleash prepaid testing and sending codes to get the secondary recovery working on the f6.
[ZTE ZMAX Guides, News, & Discussion] hroark13:
What I would like to try to do, is get write access to the recovery partition

Test a repacked recovery that has adb enabled

If that works, make a TWRP or CWM for it

Than at least people can have R/W access to /system while in recovery, similar to how the ZTE Concord 2 was done

---------- Post added at 07:47 PM ---------- Previous post was at 07:45 PM ----------

oh yeah, I did some work on the F6 and none of it would have been possible with out the 2nd init recovery or the LOKI

so thank you for that
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Same happened to me. Hold the power button in and reboot...
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
So your still lurking haha.

Anyway thats what i was trying to say, developers come and go due to people becoming arrogant when it is not needed.

The ping exploit is not used on this phone.

;) i helped, but i loki patch and 2nd init was not my work. It just required extra brains.

---------- Post added at 07:06 PM ---------- Previous post was at 06:53 PM ----------

Do you have a kitkat cwm source available at this moment?

I have posted the stock recovery, but dont have a linux os to get the sources downloaded.
[ZTE ZMAX Guides, News, & Discussion] jcase:
The ping UAF is certainly used on it, ZTE zMax was the second device I tested it on. I dumped the exploit from memory. Without a doubt, that is what it is.
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
What is causing the sudden drop rate of actual root success then?

The research ive seen on the Ping UAF has always been acurate allowing root everytime.
[ZTE ZMAX Guides, News, & Discussion] brandonlee96:
http://www.mediafire.com/download/i19hzvucexyreex/净化大师_1.1.1.apk
[ZTE ZMAX Guides, News, & Discussion] jcase:
Would love to see this research, as I've not seen any public. I would also love to hear what you believe it is exploiting.

Kingroot dynamically downloads what exploit their servers thinks is best for you. The current ping exploits are far from golden, especially on ARM64 systems and systems with PAX. It is also very often kernel specific, so lets say we have two devices, identical hardware, slightly different kernels, both still vulnerable, but it will fail on some and not on others. It can also be run specific, depending on where in memory things fall.
[ZTE ZMAX Guides, News, & Discussion] skinlab:
I like the first part..
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
The ping exploit im refering to is the same used to cause a buffer overflow by attacking the local network causing the driver software to fail and restart. Same process used on linux.

I have been following every log that i could get during the root process and noticed it is causing the services to stop and attempts checks for temp su shell and loading kinguser su, if it does not load it sends and exit exception and restarts the process.
[ZTE ZMAX Guides, News, & Discussion] hroark13:
oops

did not see this part of your message earlier

I have cm11 source, I have not synced in a long time, but my build system is up

what I would suggest before trying to build a recovery from source, is to unpack the stock recovery with abootimg on a linux computer, edit the default.prop and make it debuggable and ro.secure=0

then repack it with abootimage, and try to flash it, if flashing is possible

this will let you know if the boot loader requires a signed recovery image

it may boot the modded recovery

it may give a security error

or it may brick the phone, an example of this is the ZTE Valet, if you boot a recovery image that is not signed you get a security error, the phone turns off, and will not turn back on again, I think it blows a qfuse or something

if the modded recovery boots, then TWRP or CWM is next

anyway, if you would like to try some stuff, I can work with you, and do things on my Linux box and such, just let me know
[ZTE ZMAX Guides, News, & Discussion] jcase:
What driver? What are you referring to? Can you please be specific.

I'm referring to http://git.kernel.org/cgit/linux/ke.../?id=a134f083e79fb4c3d0a925691e732c56911b4326, which I know for a fact is what is being exploited.
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
Dont have a research link to it, but its a ping sploit found in redhat not long ago that attacks the static buffer "buf".

:) jcase is on my ass today haha
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
Yup why this is scary but dd works if temp rooted, so if we get a legit cwm someone has to try it. I think anyone with bounty posted, I am one of them should give to a person who tests the first cwm recovery if it bricks your phone. If it works then I will donate to builder of cwm
[ZTE ZMAX Guides, News, & Discussion] krazyone2006:
Kingroot is not perfect in a Longshot I have been trying to reroot for 3 hours now with perfect LTE signal no other apps running and it fails everytime at 61% now. Uninstalled rebooted retried, cleared cache, ect. With no luck as I said. :(
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
Hell yeah it's like winning the damn lottery and when you do get it it dose not last long at!!!

Z999LP-A-LTE
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
I have a friend who said he'll try and build a TWRP recovery. Haven't heard back from him but yet again this is on the bottom of his priority list. He's trying to get a LG camera to work on unofficial lollipop.

¯\_(ツ)_/¯
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
Oh yeah think you man?

Z999LP-A-LTE
[ZTE ZMAX Guides, News, & Discussion] hroark13:
I am pretty sure while you are booted in android, partition write protection is enabled, which would prevent you from writing to the system, boot, recovery, and boot loader partitions

if you see something like this in the last_kmsg

[540] mmc_wp_test()::start_setcor=0,size=98304

[570] mmc_wp_test()::start_setcor=294912,size=393216

[690] mmc_wp_test()::start_setcor=1753088,size=2523136

it is the case

but there may be a way to flash it from download mode, but I dont know hot to get to that mode. loonycgb2 seems to know (I think)
[ZTE ZMAX Guides, News, & Discussion] jcase:
https://plus.google.com/+JustinCaseAndroid/posts/SBsui8XnE2b
[ZTE ZMAX Guides, News, & Discussion] 1haplo:
Same here, I just uninstalled and I will wait until better option arrives. The people here are doing a lot of work on this and I want to say thanks.
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
I cannot do it thru download mode. I asked jcase if he had any idea of how, but he ignored my question.

I rather not risk sending a bad file and bricking this phone.
[ZTE ZMAX Guides, News, & Discussion] hroark13:
I am willing to risk it on mine, I only paid 50 dollars for it
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
I love your sig it gose with pretty much every thing you post????

Z999LP-A-LTE
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
Part of the reason I made it my signature.

¯\_(ツ)_/¯
[ZTE ZMAX Guides, News, & Discussion] nobreak1970:
You are a very nice dude! ?
[ZTE ZMAX Guides, News, & Discussion] jcase:
Hell while were dropping ZTE things, lets go ahead and get rid of that pesky write protection, and install supersu.

https://plus.google.com/+JustinCaseAndroid/posts/KzgyHLgVhwo
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Giggity..
[ZTE ZMAX Guides, News, & Discussion] jcase:
There, dropped an attack on write protection, wanna join in on the fun?

Come drop some of your ZTE toys

https://plus.google.com/communities/118124907618051049043

I'll continue to drop 1 for 1 (various OEMs) for anyone that posts vulns until I leave my office tonight
[ZTE ZMAX Guides, News, & Discussion] hroark13:
has anyone with the Univision Model had any luck getting Kingroot to work ?

---------- Post added at 11:03 PM ---------- Previous post was at 11:00 PM ----------

did anyone capture the update, that updates the phone from 4.4.2 to 4.4.4

I am thinking maybe Kingroot would work if I updated to 4.4.4
[ZTE ZMAX Guides, News, & Discussion] loonycgb2:
:/ haha good one. I didnt think we could set selinux that way
[ZTE ZMAX Guides, News, & Discussion] krazyone2006:
Jcase you are awesome I thank you so much for everything you have shared
[ZTE ZMAX Guides, News, & Discussion] mingolianbeef:
Okay. So that i understand correctly, in order to write to /system we have to reboot recover and CANNOT write while booted into Android? Like i cant just drag and drop system files, i have to flash them?
[ZTE ZMAX Guides, News, & Discussion] StonerSteve420:
No issues on my device