yashsingh1/xdaforums huggingface dataset:
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
best not even to entertain those who say they have permanent root--i have reversed everything as far as i can, and i know for a FACT that permanent root is IMPOSSIBLE without a qfuse aboot exploit. for 5.1 and up production devices, at the coercion of Google, most all manufacturers are removing all fastboot commands from their bootloaders and activating dm-verify, which is what zte has done and it's virtually impossible to break this minus the aforementioned exploit.

only other option is to find an aboot for 5.0 from another european z812 clone with the same partition layout--which i have not found--flash it and see if it works or bricks...

you can TAKE THIS TO THE BANK. i've since upgraded to an idol 3 and will probably discontinue all use of ZTE devices because of how they are locking them down after being counter to lockdown tactics in the past.
[ZTE Z7, Z7 Max, Z7 Mini] powbam:
I had a feeling that the outlook was bad when you didn't update from your last posts. Ah well. It is what it is. Luckily I have a Note 2 (no service tho) that I can get my root jollies on with at least.
[ZTE Z7, Z7 Max, Z7 Mini] blackcat1342:
Anyone try the dirty cow exploit? I'm trying to find the bash bin file to use for the adb but no luck.

---------- Post added at 04:24 AM ---------- Previous post was at 03:43 AM ----------

New root solution! Its simple! Works on all builds!

Step 1: use the total file commander app on the Google play store to move all files you wish to keep from /storage/emulation/0

To /storage/sdcard1.

Step 2: power off your ZTE maven z812.

Step 3: carefully remove your sim card and your SD card from the ZTE maven z812.

Step 4: power your ZTE maven z812 on.

Step 5: take a sludge hammer and smash your ZTE maven z812 into the side walk out side. If the ZTE maven is still in one piece and/or powered on, repeat this step.

step 6: buy a new rootable phone.
[ZTE Z7, Z7 Max, Z7 Mini] Jacobw53:
Semi Permanant Root For The ADB Shell

It appears that you can keep some kind of permanent root on the ZTE Maven's ADB Shell. You should follow this link to see how. http://androidforums.com/threads/semi-permanant-root-shell.1039076/

For the ZTE Maven, you will do a temp root with Kingo Root. Then you will go to where you have ADB installed and type:

adb shell
su
setprop persist.sys.k P816A06

If you have issues or anything, make sure that your product name is the same as mine, which is "P816A06". If not, replace mine with yours in this command "setprop persist.sys.k" as I have it listed above.

** You check the product name by entering "getprop ro.product.name" without quotes into ADB.

Then you should be able to reboot and go back into the ADB Shell as root. Keep in mind that you won't be able to use root outside of your ADB Shell, like using apps that use root. The file system is still write protected, so we can't write to system files just yet. This is not really a absolute true root method because of the Super User binary disappearing on reboot, even though you can get into some kind of root ADB Shell. That being said, it is something to play around with.

I hoped this helped out.
[ZTE Z7, Z7 Max, Z7 Mini] jcmolero71:
for today, I had same result as you, making look Srsroot as a optical illusion

its twitter assures that works in B20, I'm in B19...
[ZTE Z7, Z7 Max, Z7 Mini] blackcat1342:
I'm in b 20 and I assure you it soft bricked my phone. Twice to be sure. I've tried every one click solution and the only result others than brick was kingo roots temp root.
[ZTE Z7, Z7 Max, Z7 Mini] jcmolero71:
BTW are you in the AT&T net or you managed another way to update to B20?
[ZTE Z7, Z7 Max, Z7 Mini] blackcat1342:
Serial number:

79f56ac7

Model number:

Z812

Android version:

5.1

Baseband version:

Z812H01

Kernel version:

3.10.49-g3d22cfa-00578-g0c9c305zte- kernel@Zdroid-SMT

Build number:

Z812V1.0.0B20

Hardware version:

wuzA

I bought the phone like this 6 months ago. So I have no idea what you mean by update...
[ZTE Z7, Z7 Max, Z7 Mini] darkensx:
i bought mine like 2 1/2 months ago i had bricked it sent it in for reflash it had B17 when i got it back it has B15 now

Model number:

Z812

Android version:

5.1

Baseband version:

Z812H01

Kernel Version:

3.10.49-g3d22cfa-00461-g2c4085d zte-kernel@Zdroid-SMT

Build Number:

Z812V1.0.0B15

Hardware Version:

wuzA
[ZTE Z7, Z7 Max, Z7 Mini] Jacobw53:
Something to keep in mind

With Kingo Root, we can get root. The only thing is, the file system is write protected. I say this is a feature that is found in the kernel. With root and a kernel module to load on the kernel. We will be able to temporary write to the file system. Keep in mind, it is only temp RW, because the boot loader rewrites the system partition every time it is booted. I will be looking into making a kernel module here soon. I need to take a look at the kernel and see what kind of RW protection needs to be disabled.
[ZTE Z7, Z7 Max, Z7 Mini] darkensx:
is the bootloader locked on this? i assume it is but since we don't have fastboot access that there is no way to find out. and the stock recovery is odd it has a load update.zip from sdcard but its disable somehow and update via adb does not use zip (atleast not standard update.zip) or img idk what kind of file is used some type of propritary format maybe? i have never seen a devices recovery limited as well as fastboot together usually one or the other ive seen. also seems you can flash unsigned aboot.img and updates but it just bricks and i mean hard bricks so any dev working with this use extreme caution.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
you'll never make this happen;

you need to read the thread in totality--you're not even on the right track.

read the last 40+ pages paying special attention to all my posts...

nothing short of an aboot exploit written in pure c that performs a qfuse exploit like in the moto g will permanently

root this device

http://xdaforums.com/showpost.php?p=68986880&postcount=522
[ZTE Z7, Z7 Max, Z7 Mini] darkensx:
who did the qfuse exploit for the moto g? plus the qfuse for moto g exploits a vulnerability in the Motorola TrustZone kernel (sounds moto exclusive) to permanently unlock the bootloaders do we even have such a vulnerability in the maven? also qfuse exploit is based for the Qualcomm MSM8960 chipset do we have this or equal code wise to make an exploit sound like a total rewrite of the qfuse exploit from scratch if its even an option.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
qfuse's are in every tz, not just moto phones

i said an exploit like the qfuse exploit, not it exactly because it is for a different soc than our device, which the maven is msm8916

the tz would have to be decompiled and an entirely new exploit written

or

if anyone can decompile the aboot and write an exploit that will unlock it without building a new one would do the trick

those our your only options, period. there is and will be no other way to root this phone
[ZTE Z7, Z7 Max, Z7 Mini] BTMoneyGang:
ZTE Root .img

Has anyone created a rooted .img to flash on the ZTE Maven 2, Z831 version 6.0.1. If so, could someone please send me the link. I would greatly appreciate it.
[ZTE Z7, Z7 Max, Z7 Mini] BTMoneyGang:
How long does the temp root last???
[ZTE Z7, Z7 Max, Z7 Mini] madmrt:
The temp root only last until you reboot the phone
[ZTE Z7, Z7 Max, Z7 Mini] Jack_Rosen:
How do I get temp root?

Does the temp root allow me to delete system apps?
[ZTE Z7, Z7 Max, Z7 Mini] kill3rshadowz2000:
We stopped using it
[ZTE Z7, Z7 Max, Z7 Mini] ShadowOBS:
well..

i got to root it with kingo one time, but unfortunately my phone reboots due to low battery, but after it it doesnt works, o need an older version of kingo, i need root to erase all of those at&t apps and install a 6.0 rom.... help please..
[ZTE Z7, Z7 Max, Z7 Mini] :
Kingroot says it successfully rooted this phone although I don't own it anymore has anybody tried it
[ZTE Z7, Z7 Max, Z7 Mini] Jacobw53:
Just for reference

It looks like you can get into a Emergency Qualcomm Download Mode on this phone. You can do this by typing this on the adb shell

reboot edl

.

Your top light will turn green and there will be a Qualcomm HS-USB QDLoader 9008 COM Port come up on the PC. I read that there is software to flash firmware like a person would do in Odin on a Samsung device. But who knows if this works on this phone. We know that the bootloader is corrupted and sure it is locked. If you try anything with this, just keep in mind that you may end up bricking your device and you are responsible for anything that happens to it. I would test around more with this. But I want to keep this ZTE Maven for a little longer until I get a new phone.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
i'm coming back to this since i'm going to be immobilized for 3 months due to an accident and i need something to do in my free time. (i've alread upgraded to a much superior device)

to get an easier root, use the apk found in this thread https://xdaforums.com/android/software-hacking/root-tool-dirtycow-apk-adb-t3525120

use the app not the adb method, but make sure superuser is installed first. when the app loads choose "get root" and then "for lollipop (32 bits)" then it will ask you to unmount and remount your sdcard (you must have an external sdcard installed), and afterwards you will have temp root

then do this from adb terminal to gain permanent shell root only

adb shell

su

setprop persist.sys.k P816A06

This is going to be the basis for all other methods working to get permanent root rw access to /system

the apk can be used over and over again to gain root after a reboot--still only temporary

after a permanent rooted shell is achieved, then you can do the second root method in the dirtycow apk and the phone will reboot with temp root and you won't have to unmount and mount your sdcard. but it will still only last til reboot
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
anyone out there have the kernel source downloaded that can upload it somewhere so i can download it???

zte has hid the download behind a very, very, very, very slow server (13 hour download) so that no one can have easy access to it. and i know why. the power driver holds a flaw that will reveal system rw access. i need this really bad to secure permanent root.

this is serious.
[ZTE Z7, Z7 Max, Z7 Mini] Morris001:
Is this what you're looking for stayboogy?

download.ztedevice.com/device/global/support/opensource/2/1258/P816A06_ZTE_Z812_Lollipop_Kernel(3.10.x).tar.gz
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
So, I found a copy of the kernel source I had downloaded last year, and I fixed the purposeful error zte created in it to keep it from being built.

The kernel source will now build and properly private key sign itself and the modules, however, I am not able to sign the boot properly to be able to boot a new boot.img that will pass tz dm-verity checking.

The "disemmcwp" command that is present in other zte carrier unlocked phones is not present in our kernel, but I have since added it back and built a new successful, signed, kernel. But, until I can properly sign the boot.img to pass tz checking, we are stuck with the temp root I posted a few posts back. At least kingoroot/kingroot are no longer needed with their adware/malware bs

---------- Post added at 03:03 PM ---------- Previous post was at 02:59 PM ----------

No, that is not what I needed. Read my post, it'll take an entire day to download from that link because zte put it on a super slow server. I needed someone to upload the kernel for me to download. Doesn't matter now, I found a copy I had.

If you people would read this thread wouldn't be 60 pages long
[ZTE Z7, Z7 Max, Z7 Mini] equitube:
2 things tell me you're not much of a developer.

You not only use the info stealing malware known as kingoroot but you recommend it. Read this

https://xdaforums.com/general/general/kingo-root-steals-imei-t3268525

And you're using an ipad
[ZTE Z7, Z7 Max, Z7 Mini] Morris001:
I'm not sure who you're ISP is but, it took me about 60 seconds to download using cellular 4G...I will admit compared to the file size the download should be much faster.

I also agree with reading what's already been posted ...as I add probably another page to the thread with this reply...

I have tried your listed root method. With Superuser installed and without any temp root my phone reboots trying to remount the SD card, even after cleaning init.

If I get lucky it won't reboot, but it will within 5 minutes after running method 1, especially if I try to install something.

I used a temp root from Kingo and then ran method 1, which succeeds much more often but still eventually ends up rebooting my device and losing root.

After running method 1 once I quickly connected via ADB and ran the commands you listed. I also ran 'su' and then the 'setprop' line through a local terminal emulator on the device. Both were successful.

From there I rebooted again and ran method 2 which worked like a charm. It actually installed SuperUser and granted root access after a longer reboot. After getting the SuperSu root I uninstalled Kingo.

With root access I viewed default.prop and didn't see the entry ran by the previous setprop command. I'm not sure if that entry is getting wiped with each reboot and/or if it's writing to the default.prop that's written in the boot partition that gets copied to RAM.

I have root privileges, but no full write access to the system files and the bootloader is still locked of course. Better than nothing for now!
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
your post is quite jumbled; you may be on a newer build than me and so it might not work the same, but here's the instructions again exactly as i do them, maybe you need to retrace and verify. the dirty cow app will not install superuser for you so i know you're either purposely misleading or just not paying attention

for my previous root method, it has to be done exactly like i posted.

1) uninstall any crap from kingoroot or similiar, uninstall any crap root app that might have ever been used

2) install the latest superuser.apk--it won't do anything until the phone actually has pseudo root, but it has to be installed first

3) install linked dirty cow root app

2) open dirty cow app, choose method 1 and nothing else, i said nothing of cleaning init. only choose method 1, then "ok" to the prompt, then when the app tells you to, unmount and remount external sdcard--app will take you directly to settings to do so

3) when this finishes you will have pseudo root that can't do anything but the next step

4) from adb use the setprop commands listed, this provides a rooted shell that persists forever

5) reboot the phone, once rebooted make sure in superuser app that you have "grant" set as the default action to root requests

6) go back to dirty cow app, choose method 2 and nothing else, then "ok" to the prompt--phone will do a systemui reboot only (will not be a longer boot, will not install superuser for you--only crashes systemui by killing init process), now you have a working, read-only root that persists until the phone goes through a real device reboot

7) to root again after an actual device reboot, just use method 2 of the dirty cow app and after systemui crashes and restarts, read-only root exists again

if you don't have the latest superuser installed before any of this, it won't work...

You do not stop at any step, follow the directions sequentially and don't do anything else like installing any other apps or what have you--follow directions.

After method 1 succeeds, setprop must be done immediately, and once this is activated, method 1 never is to be done again, period.

Method 2 will have to be done anytime the phone is rebooted to have the read-only root properly working, but it only works if the setprop commands are done.

the setprop commands won't change **** on the filesystem because you don't have rw root. it never does. the setprop root shell is a backdoor created by zte that exists in the kernel and device framework...

i'm making a new thread for this because obviously it is needed.
[ZTE Z7, Z7 Max, Z7 Mini] THiR$TY:
I successfully rooted a zte maven with software version z812v1.0.0B19 and AT&T is my carrier. I don't have custom recovery installed and need help with that. But what I did to achieve root is first attempt with Kingroot v4.5.2 which first failed but after time began coming back with successful root. However, other apps said there was no root access. Finally I used iRoot v3.2.3

That's the screenshot of root success. And here is the app I used:

Use at your own risk dude.

___________________________________

I can't post links until after 10 posts since I am a new user. But some more info on this is that I never uninstalled kingroot, the iroot app did it for me after a successful root. Also, during root process my phone rebooted and I restarted the iroot app myself and it said failed. I ran the "get root" button or whatever again. This type of **** happened like three times, it did something different happened each time. Just keep approving everything and going forward until root is complete. At one point it downloaded a 3xx MB file and I haven't found it to remove it if possible because I literally just got root a few minutes ago.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
Prove you have root--cause I guarantee you do not...

If you can't delete files in system then you don't have anything the rest of us don't have already.

And my method posted works better than using Chinese spyware anyway
[ZTE Z7, Z7 Max, Z7 Mini] Jack_Rosen:
Will this root method allow me to uninstall system apps (and stay uninstalled after reboot)?
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
You can permanently freeze them with any root app that does such, but not delete them because of read only system access. But about 15 pages back I showed I successfully froze gapps on the system partition permanently wit this read only root.

Use this tutorial https://xdaforums.com/zte-z7/help/zte-maven-z812-how-to-gain-rooted-t3578761

And yes, even after a reboot and the root not reactive they were still froze
[ZTE Z7, Z7 Max, Z7 Mini] Jack_Rosen:
Is this freeze any different then using debloater via pc?
[ZTE Z7, Z7 Max, Z7 Mini] emdavid87:
Buen dia para todos, por favor me pueden indicar si actualmente existe un software o app para poner root al ZTE MAVEN Z812 Android 5.1 ?. Gracias

---------- Post added at 07:01 PM ---------- Previous post was at 06:58 PM ----------

Good day for all, please can you tell me if there is currently a software or app to Root the ZTE MAVEN Z812 Android 5.1? Thank you
[ZTE Z7, Z7 Max, Z7 Mini] KenLucky:
Firstly, I want to extend a sincere thank-you to those that have toiled to discover a viable rooting method for this.....er....phone.

I make no claims to be an expert of any type. However, I was recently in a rather nasty motorcycle accident and now I have about four months of sitting/laying around my house to look forward to.

I have a Maven. I have since moved on to a rootabke device but I still have my old Maven. I would love to be able to make this phone my biatch. However I know better. I am however willing to embarrass myself by trying. I have an old PC an old Maven a basic understanding of the Android OS as well as Linux language. Oh, and I have a personality flaw that prevents me from admitting defeat.

I am limited to Windows XP on my PC as the DVD drive has died and my live CD Linux distros are now useless.

Would someone please suggest a WinXp friendly .exe capable of dumping the firmware etc. From the Maven?

Also, I have previously read that most ZTE devices can not be flashed via standard data cable, but rather must be flashed through the SD card?? Is that true, or just random internet misinformation? Being as there is a ZTE specific flash tool I would personally believe it to be the latter.

Is there a known method of JTAG/UART or similar for this phone?

Sorry for all of the questions, but I actually like these phones and bought five of them last year. I would like to be able to root them all and install a custom ROM so I can give them to my kids.

Thank you in advance.
[ZTE Z7, Z7 Max, Z7 Mini] boogerman42083:
zte maven z812

i also have this phone and i tried kingoroot.apk 4.3.2 didnt work so i use the computer app kingoroot 1.5.4.3126 threw wifi it said root succeeded so i tried root checker pro 2.0 says "congratulations you have successfully rooted your phone" also says "busybox has been installed correctly" so i tried a few root apps it does ask for permissions (allow or deny) its just temporary root because when your phone restarts root is gone but can be rooted again with the same method i mentioned above i hope this helps my name is Dave
[ZTE Z7, Z7 Max, Z7 Mini] eduardvi995:
Mistakenly flashed a corrupted Boot.img

Before someone says i have to read all the 60 pages before jumping to say something, I DID. I noticed stayboogy was the "main" developer of the thread, because all the other guys just posted statements saying they had permanent r/w root and it wasnt.

Anyway. i also noticed that nobody mentioned the posibility to patch the boot partition with the Magisk exploit. Everyone was trying to root the system partition al usual root methods do. I realize that stayboogy said that aboot and recovery were protecting the device from writing om them. but i see that is posible to flash the boot partition. Im talking about the Systemless root method made here in XDA, which patchs the boot.img file with the su binaries just like the system on xbin.

The fact is, that i got a boot file which i wrongly dumped from the phone (something im very regretful about) and patched it with magisk manager right on the phone. As you guys may know, there is no access to the fastboot wich is the main way to flash any partitions on android. but reading more i saw the stayboogy's thread of the permanent root method with dirty cow root. i downloaded the app and noticed that it has a flashing boot tool on it. i successfuly flashed the boot img, for the changes to take effect i rebooted phone.

but when i tryed to boot the phone didn't. it just shuts off immediatly after turn on. i can only access the the recovery. im still able to see

the DFU port on the pc when i plug in the phone with LED on red, but dont know which flashtool works with this and where to get at least a working boot.img for flash it back.

So i was hoping someone of the devs had found a way to flash partitions to the phone just as download mode. if you did, please feel free to PM me of answer this post. I'll be aware on the notifications for a fast reply.
[ZTE Z7, Z7 Max, Z7 Mini] Rotpot09:
Anybody else getting a "dangerous file" message from mediafire when trying to download the dirtycow .apk? Is there another download location of the apk? Would be nice to freeze some this buggy bloatware. Thanks in advance

Edit:found a working link. So nevermind I jumped the gun. Would post a link but can't yet.?
[ZTE Z7, Z7 Max, Z7 Mini] ilya980:
I tried to use QFIL in the download mode (Vol Up+Vol Down+Power), not in the FTL mode, and was able to dump the following files:

03/03/2021 11:49 AM 131,072 CODERAM.BIN

03/03/2021 11:49 AM 65,536 DATARAM.BIN

03/03/2021 11:49 AM 536,870,912 DDRCS0.BIN

03/03/2021 11:49 AM 536,870,912 DDRCS1.BIN

03/03/2021 11:49 AM 828 load.cmm

03/03/2021 11:49 AM 20,480 MSGRAM.BIN

03/03/2021 11:49 AM 16,384 OCIMEM.BIN

03/03/2021 11:49 AM 8 PMIC_PON.BIN

03/03/2021 11:49 AM 4 PMIC_RTC.BIN

03/03/2021 11:49 AM 1,048,576 RAMCON.BIN

03/03/2021 11:49 AM 4 RST_STAT.BIN

The two large files look like DRAM dumps. The RAMCON.BIN is some log, which mentions fastboot in a couple of places.

I also looked at the /aboot partition dump with IDA. It looks like fasboot is there, maybe it is just disabled somehow. If so, I am wondering if it is possible to simulate what a "fastboot oem unlock" command would have done to the partition if fastboot was enabled. Then, maybe, the partition dump could be modified and reflashed back. Does anyone have experience with disassembling /aboot or looking at the dumps above? I am happy to share them.
[ZTE Z7, Z7 Max, Z7 Mini] Skorpion96:
I was thinking that virtualxposed could be used to trick zteroot app, the problem now is the android version because it gives version mismatch if am I not wrong