yashsingh1/xdaforums huggingface dataset:
[ZTE Z7, Z7 Max, Z7 Mini] bullracing:
Hello guys, looks like i've benn lucky with my ZTE maven Z812, I succesfully Rooted with KingoRoot without problems, sim unlocked from at&t working perfectly. I have the Android 5.1, I would like tu support you guys with a system backup of my device. I got another ZTE maven, same android version, same Build Number, but, I face out that I can't ROOT it, so I was wondering if there is a CWM or TWRP for this device for make a backup of my rooted device and share it to you guys, and install it too on my other ZTE.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
okay, do you mind clarifying something?

does your root persist after a reboot--meaning can you open terminal emulator and enter "su" and it succeed after you've rebooted the device after rooting with kingo?

if so,

then,

adb shell

su

dd if=/dev/block/mmcblk0p18 of=/sdcard/aboot.img

dd if=/dev/block/mmcblk0p1 of=/sdcard/sbl.img

dd if=/dev/block/mmcblk0p20 of=/sdcard/boot.img

dd if=/dev/block/mmcblk0p21 of=/sdcard/recovery.img

exit

adb pull /sdcard/aboot.img

adb pull /sdcard/sbl.img

adb pull /sdcard/boot.img

adb pull /sdcard/recovery.img

and then upload each of those files as is to mediafire.com and post the link please.

i'll cross reference those with what i have and see if we can find the difference that makes rooting one possible but not another.
[ZTE Z7, Z7 Max, Z7 Mini] bullracing:
Okay, let me make the Backup I will Upload it ASAP... :)

---------- Post added at 07:25 PM ---------- Previous post was at 06:49 PM ----------

ther you got it... try with this and let me know what happends...

https://drive.google.com/open?id=0B4Ix6N2x2xXxVGRqSUwyVUFPZ3c
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
THANK YOU SO MUCH!!!! your device is definitely different and it looks like your device may actually have come factory unlocked / dm-verity not applied but i'm not completely sure yet

i'm attaching a file, download it and do the following--make sure you have at least 800mb free on your internal storage and delete the other files we dumped

rename "nand-dump.txt" to "nand-dump"

adb push nand-dump /data/local/tmp/

adb shell

su

chmod 777 /data/local/tmp/nand-dump

/data/local/tmp/nand-dump

when it is finished you will have 26 .img files on the root of your internal sdcard--please copy them from your device to your pc and then upload them to your google drive--you can zip or rar them or whatever, i just need them all

the only partitions not included in this dump are your system, data, and cache partitions--so no personal data is included

i'm going to detail which partitions are actually different and which are the same. then i'm probably going to flash them and see what happens.

YOU MAY WELL BE THE REASON THE REST OF US GET A REAL ROOT!!!
[ZTE Z7, Z7 Max, Z7 Mini] bullracing:
OK moving on.....

I unlocked it by requesting a unlock code at AT&T webs site, let me figure out how to make what you are telling me, I will post the files ASAP. :highfive:
[ZTE Z7, Z7 Max, Z7 Mini] ramsesfrt:
Root para Zte Maven 812 Help

Greetings I am very aware of their progress in achieving the root for this team Zte 812. Maven can hope to find the solution to really take advantage of this equipment
[ZTE Z7, Z7 Max, Z7 Mini] raven1090:
you can upload the file ota z812v1.0.0b20
[ZTE Z7, Z7 Max, Z7 Mini] ramsesfrt:
Root para Zte Maven 812 Help

Sorry really I do not understand what it says there is no application or downloads a archiv way in a page or link to root the Maven Zte 812 At & t. a lot of the topics covered and do not speak English very well but I have tratanto months to figure out how to root this phone is not ayudenme
[ZTE Z7, Z7 Max, Z7 Mini] 0134340:
Here's the b20 update direct from att's servers.

Edit: Won't let me link directly since I'm a new user but here: xdmd.sl.attcompute.com/agents/52294/1779/P816A06_B15_TO_B19_FOTA.zip
[ZTE Z7, Z7 Max, Z7 Mini] andresh-5:
you have to edit the link friend?

Forbidden

You don't have permission to access /agents/52294/1779/P816A06_B19_TO_B20_FOTA.zip on this server.

if you can download upload it to a cloud for example mediafire and we share the link friend :) the update is not as heavy a 40mb :)
[ZTE Z7, Z7 Max, Z7 Mini] ramsesfrt:
Update At&T Zte Maven 812

This update allows me to do the Root on the phone ? Please help me
[ZTE Z7, Z7 Max, Z7 Mini] 0134340:
Sorry, I edited it. It's just b19. That was just a copy/paste from some manual url fuzzing to find the b20 update. Still, maybe someone can make use of it.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
bullracing informed me via pm that his root does not persist after reboot, so...

i'll continue trying to find a root / unlock method through other avenues
[ZTE Z7, Z7 Max, Z7 Mini] andresh-5:
to be continued xD

to be continued xD
[ZTE Z7, Z7 Max, Z7 Mini] wcat33:
Looks like a few people are rooting for you guys...
[ZTE Z7, Z7 Max, Z7 Mini] raven1090:
bad links :(

---------- Post added at 08:35 AM ---------- Previous post was at 08:27 AM ----------

i need the file FOTA B20. the link you added i cant download anything:(
[ZTE Z7, Z7 Max, Z7 Mini] 0134340:
Add https:// to it. Are the otacert and other certification files in it of no use? I figured something might be.
[ZTE Z7, Z7 Max, Z7 Mini] raven1090:
and adds the http and nothing I apologize for my ignorance if that were the case but I can place the link right or tell me where did you get
[ZTE Z7, Z7 Max, Z7 Mini] 0134340:
Add https, not http. It works for me every time on a different browser. Edit: See here: http://xdaforums.com/zte-z7/help/xte-maven-z812-t3155895/page16

Apparently someone's already been down this road. But I found the same link via youtube comments. I was thinking maybe we could modify the certs and update to install a compatible firmware from a slightly different phone that already has root capabilities or at least get a more vanilla and updated android. But I don't really have the time and experience to bother with it.
[ZTE Z7, Z7 Max, Z7 Mini] raven1090:
This link is the FOTA b19. I need the FOTA FILE b20 the last update of at&t software for this Phone
[ZTE Z7, Z7 Max, Z7 Mini] 0134340:
Are you just wanting it to update your phone? If for inspecting it or reverse engineering, then B19 would likely have just as much interesting data as B20. Just unzipping it and checking things out with a hex editor or notepad++, it reveals some interesting stuff. Nothing with my limited experience that I could plan to exploit but I could see how it'd be useful to someone with more software/reverse engineering background. I also found a B14 update on the server and doing some comparisons.

By the way, anyone else annoyed at that stupidly loud bootup screen? I can't turn the damn thing on anywhere in semi-quiet public without being stared at.
[ZTE Z7, Z7 Max, Z7 Mini] Synisterhippie:
Got an idea.

Sooo... Has anybody tried using developer settings to use the OEM unlocked option before root method?
[ZTE Z7, Z7 Max, Z7 Mini] 0134340:
You mean all this time that's all we had to do? :o
[ZTE Z7, Z7 Max, Z7 Mini] Synisterhippie:
Really I'm a bit of a noob, just an idea. Its what I had to do with my ATT Go Prime SM-G530A.

I just bought the maven, and can't wait to try it out!
[ZTE Z7, Z7 Max, Z7 Mini] 0134340:
I don't think you'd be impressed with it coming from that phone or like me, paid ~$10 for it straight up. If we had someone in the rooting community involved who has the experience, I think it'd be rooted by now but it's just not that popular of a phone, I guess, so very few experienced people involved with it.
[ZTE Z7, Z7 Max, Z7 Mini] bullracing:
I found that my root "expires" when I reboot my devices, so I don't think this will work out :confused:

However I rooted it again and when I make what you told me I got this at in CMD

adb server is out of date. killing...
* daemon started successfully *
0 KB/s (1290 bytes in 5.081s)

C:\Users\Franco\AppData\Local\Android\sdk\platform-tools>adb shell
shell@xuantan:/ $ su
root@xuantan:/ # chmod 777 /data/local/tmp/nand-dump
root@xuantan:/ # /data/local/tmp/nand-dump
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.153 secs (3896241 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.558 secs (3279362 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.296 secs (3653574 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.303 secs (3642469 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.584 secs (3246365 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.280 secs (3679214 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.398 secs (3498168 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.636 secs (3182324 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.277 secs (3684061 bytes/sec)
32768+0 records in
32768+0 records out
16777216 bytes transferred in 4.902 secs (3422524 bytes/sec)
dd: /dev/blcok/mmcblk0p11: No such file or directory
32768+0 records in
32768+0 records out
16777216 bytes transferred in 4.918 secs (3411389 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.545 secs (3296113 bytes/sec)
98304+0 records in
98304+0 records out
50331648 bytes transferred in 14.747 secs (3413009 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.394 secs (3504013 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.546 secs (3294818 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.055 secs (4082047 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.000 secs (4194304 bytes/sec)
180224+0 records in
180224+0 records out
92274688 bytes transferred in 28.854 secs (3197985 bytes/sec)
98304+0 records in
98304+0 records out
50331648 bytes transferred in 13.731 secs (3665548 bytes/sec)
98304+0 records in
98304+0 records out
50331648 bytes transferred in 16.431 secs (3063212 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 3.041 secs (2758503 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 3.243 secs (2586681 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.236 secs (3751613 bytes/sec)
16384+0 records in
16384+0 records out
8388608 bytes transferred in 2.474 secs (3390706 bytes/sec)
1024+0 records in
1024+0 records out
524288 bytes transferred in 0.152 secs (3449263 bytes/sec)
root@xuantan:/ #

but I don't see the 26.img files that you told me to send you in my phone's card
[ZTE Z7, Z7 Max, Z7 Mini] Synisterhippie:
So far I like it, I think I'm going to copy the stock firmware and edit it. Then reflash with Odin. Just need find all the security checks , among other things, and tweak 'em with pastings from other root sources. Anyone know any good file extension editors that support multiple extensions? Or file viewers?
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
odin is utterly useless here. this isn't a samsung device
[ZTE Z7, Z7 Max, Z7 Mini] bullracing:
i guess we will need to wait for a TWRP or CWM to root our device....
[ZTE Z7, Z7 Max, Z7 Mini] ssenemosewa:
Absolutely, but going into Settings, Sound & notifications, Silent power-on/off solved that particular problem for me.
[ZTE Z7, Z7 Max, Z7 Mini] 10252:
This phone does not have DM VERIFY for the 100th time.. IT has a NAND lock on it. Root is useless unless you can bypass that part.
[ZTE Z7, Z7 Max, Z7 Mini] ramsesfrt:
Tell me something if they are so friendly phone has no solution can not be it spin ?? Beyond this is an excellent team marrow that can do nothing more Unfortunate ..That ...

---------- Post added at 08:49 PM ---------- Previous post was at 08:48 PM ----------

I hope your comments to know if there is any hope or if you give closed the subject without solution possible
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
HOW DENSE ARE YOU EXACTLY???

no one is paying you any attention because YOU DON'T KNOW WHAT YOU'RE TALKING ABOUT--for the 100th time

1) verity_key files are present in the ramdisk of both the recovery.img and boot.img

2) /sys/module/dm_verity is present in the filesystem meaning the kernel is using the dm-verify kernel driver

3) and for more proof, notice "CONFIG_DM_VERITY=y" is present in the xuantan kernel config in the zte source--the file is attached just in case you're so dense as to argue some more about something you're totally ignorant about .

now, quit bringing up nonsense
[ZTE Z7, Z7 Max, Z7 Mini] ssenemosewa:
That, and also because we added him to our ignore lists ages ago when that first became apparent.
[ZTE Z7, Z7 Max, Z7 Mini] Synisterhippie:
Hey this is what I found, hope it helps guys!

?*The only thing is your phone?*will be factory reset so PLEASE MAKE A BACKUP BEFORE PROCEEDING if you want to keep your settings.

Hopefully these steps will help you out:

1. Activate developer options menu by going to the settings, choose 'About?*phone' menu and click about ten times on Build number.?*

2. Now you'll find the Developer options in the settings screen of your?*phone. Click on it and look for the option 'Enable OEM Unlock', make sure you mark the checkbox, leave the settings screen and restart your?*phone. THIS OPTION IS THE FIRST STEP IN GRANTING ACCESS TO ROOT, BOOT AND FLASHING ROM'S TO YOUR?*PHONE!

3. Download and install the latest?*Android?*SDK from Google on your computer (just google).?*

4. Go back to the settings of your?*phone?*and go back to Developer options, and activate the USB debugging mode.

5. Connect your?*phone?*with a USB cable to your computer. (make sure?*Android?*SDK is installed at this point)

6. Your?*phone?*ask to trust the computer with Allow USB Debugging? Press Yes twice.

7. Now enter this command on the computer: adb reboot bootloader

Note: If you're using a Mac, it’s: ./adb reboot bootloader or ./fastboot -insert command-

8. A bootloader unlock confirmation page will appear. Tap Volume Up to highlight “Yes,” and Power to select it.

9. Your?*phone?*will then be erased and the bootloader unlocked. It won't take more than a minute or two.

10. Your bootloader is now unlocked and ready for root, ROMs, recovery, etc. Press the Power button to reboot your?*phone?*and a factory reset will be applied.?*

11. After your?*phone?*is ready, install one of the root apps as mentioned in the posts, I used Super Root Master apk and it worked right away.
[ZTE Z7, Z7 Max, Z7 Mini] chewbapoclypse:
Hi, guys I am interested to know how are you flashing the img files to the phone? I see that you are using su from the adb shell but dosen't that require the binary in the /system/bin. I would love to work with you guys on trying to get this MF'er locked down. :highfive:
[ZTE Z7, Z7 Max, Z7 Mini] ramsesfrt:
Help me please Root Zte Maven 812 At&T

Good day please confirm whether this method really works with maven Zte 812 and if I could explain jor steps to use the Android SDK install them but so is like from there to restart gestures boot d emi equipment. Please help me to be superuser this phone .
[ZTE Z7, Z7 Max, Z7 Mini] andresh-5:
friend hears good news and your you tested your maven?:eek:
[ZTE Z7, Z7 Max, Z7 Mini] ramsesfrt:
Please help to complete this process

'm no expert but I need to be superuser this team maven Zte 812 by fvaor could explain in more detail and simple as completing each d elos steps I quote . this is my private mail : ramsesruiz@gmail.com speak little English
[ZTE Z7, Z7 Max, Z7 Mini] Synisterhippie:
I'm still a rookie yo, however I've been scouring pages for days lol I'm going to test this myself today, ill let you know.
[ZTE Z7, Z7 Max, Z7 Mini] andresh-5:
good luck :guay:
[ZTE Z7, Z7 Max, Z7 Mini] ramsesfrt:
May I then pending. Thank you

---------- Post added at 02:48 PM ---------- Previous post was at 02:47 PM ----------

May I then pending. Thank you
[ZTE Z7, Z7 Max, Z7 Mini] ssenemosewa:
This method has already been mentioned, tried, and shot down way back in the beginning of this very thread!

Unless something has radically changed as a result of an OTA update, it still won't work. Sorry.
[ZTE Z7, Z7 Max, Z7 Mini] kill3rshadowz2000:
My mom's phone broke and she couldn't afford a T-Mobile phone (she's on the lifeline Budget Mobile carrier which uses tmobile Sims and towers) so she got a $40 AT&T z812 and unlocked it and put her card in... everything was fine... now every 2-3days have to go into mobile settings and change network type back to WCDMA/GSM AUTO because it auto changes to WCDMA/GSM/LTE and since her provider only has 2g where she lives she can't use lte and it will reset the network every 3 seconds so it goes from Budget 2g to no service and back to 2g back and forth...

You have to click net type then WCDMA only then gsm/wdcma or it won't change...

Any way to lock it on GSM/WCDMA so it won't keep changing
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
we are using a temp root through the kingoroot desktop app.

it uses an exploit that allows it to run an .sh file that installs su to the /dev partition and symlinks it to /sbin somehow. i haven't quite full figured out how it does it so that it can be duplicated from the terminal but i have all the files that the app pushes to the device to do it.

anyway, temp root is how we are flashing img files, but, if you flash an unsecure boot.img and try to boot you will hard brick the device. flashing a custom recovery works, but it won't boot it and will instead start a normal boot and rewrite the oem recovery.

i've practically done everything i know to do at this point and can't figure it out.

what we need is someone who is great with ida disassembler and decompiler who can find out what unlocks the bootloader since it is fastboot disabled and write an exploit that can be run from temp root terminal. this will be the only way unless something major changes in 5.1.1 rooting techniques.

an exploit that blows the qfuses like in moto devices that exploits trusted zone kernel would work if it was developed for this device and not made to be a kernel module since we can't run unsecure .img files.
[ZTE Z7, Z7 Max, Z7 Mini] kill3rshadowz2000:
Forgot I'd already posted it here... can't remove it
[ZTE Z7, Z7 Max, Z7 Mini] Hurrian:
I'm now looking at this method for unlocking the device - since even a root exploit and loaded kernel module to send CMD29 (eMMC write un-protect) to the right regions would b0rk the device since the kernel's got dm-verity, and loading a custom kernel without dm-verity would only happen without an unlocked bootloader.

I've been playing around with the samples on GitHub and the Qualcomm TrustZone exploits really do work on our device - only tested on wuzA B15 though ;)

https://bits-please.blogspot.com/2016/06/trustzone-kernel-privilege-escalation.html

I've got an internship to attend to five out of seven days in the week though, so I don't have much time to dig around. I'd recommend looking in IDA at where aboot prints out the strings "Device is unlocked! Skipping verification..." and "Device unlocked: %s" - maybe they can give us an idea of what qfuses to blow to get an unlock.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
i've already been through IDA, but, i'm not really skilled in reading what it is telling me. i can easily find the functions that pertain to unlocking the device but reading the data the way it is in IDA is something else entirely, especially since all my reverse engineering and programming languages knowledge is totally self learned and therefore incomplete...

i have built and edited for our device many exploits however that others have written from cve's that pertain to our msm kernel and have come up with nothing useful. i really am at a loss. dm-verity is only a small problem as it should not prevent the device from booting but instead only provide a tamper warning if /system is modified AFTER a unsecure image is booted AFTER the bootloader is unlocked. dm-verity being a kernel module means it only pertains to the boot process after the bootloader, lk, and the kernel have been loaded, which are last in the boot process.
[ZTE Z7, Z7 Max, Z7 Mini] mikeyhubb:
Hi, do you have any first hand experience with SRSroot on the Maven, what was you exprience?
[ZTE Z7, Z7 Max, Z7 Mini] fireman1374:
ADB

Just a thought. With the SDK versions of ADB, you can turn off verity with the command "adb disable-verity" but only on development builds. Most of the time it is done through ftm mode. There is much information on the net for verified boot. My thought, there is source code available for adb. It should be a fairly simple task to modify adb to bypass the check to see whether the phone is loaded with a development or production build, possibly allowing us to turn off verified boot. Once it's off, fastboot would be available and I do believe that the bootloader is already unlocked. That should allow us to root, then possibly a recovery could be developed or modified for our use.
[ZTE Z7, Z7 Max, Z7 Mini] huggybear2496:
zte maven

so the phone when through a update and failed when it came back on the wifi wont work i have tried factory reset through settings and android recovery so not im looking for a custom software i can put on there or a actual zte maven software that will work need the wifi back its eating data.
[ZTE Z7, Z7 Max, Z7 Mini] Rotpot09:
Someone else posted elsewhere that the update changed the SD card capacity. Had a 64gig in it but suddenly said capacity not supported. So do not update the maven would be my advice to anybody.
[ZTE Z7, Z7 Max, Z7 Mini] Rotpot09:
Anybody else noticed a battery capacity way below the stated 2100mah? DUbayterysaver lists my capacity at just 1390mah and I've only had this phone since black Friday 2015.. Anyone with similar results or recommend different app to get stats with? Thx
[ZTE Z7, Z7 Max, Z7 Mini] Zankaru:
Using DU battery saver, it shows the max capacity being 2000 mAh (current capacity is at 1880 mAh). Though I do see the voltage changes every now and then for some odd reason.
[ZTE Z7, Z7 Max, Z7 Mini] Rotpot09:
Well zte replied on twitter that the battery is 'supposed' to be 2100mah. tweeted them again but haven't back how they want to 'resolve' this. Battery is sealed in so not much can be done.
[ZTE Z7, Z7 Max, Z7 Mini] bethnesbitt:
Sometime ago I unlocked the ZTE merit from here.

http://elizabethswikis.blogspot.com/2014/09/how-to-unbrick-and-unlock-zte-mert.html?m=1

Wondering if a factory reset then using the ZTE update tool for window will work on the MAVEN. When updating a bin file is downloaded but has to be copied before the update completes and deletes the bin. Next there is a tool that splits the bin into separate files, recovery, system, etc. From there one can play then merge back into a bin. Last copy to SDcard in a folder called image and TPT FLASH.

Not sure if the Maven supports any of the above but if someone wants to play, it's worth a shot.

Plan on doing so myself on my next day off.
[ZTE Z7, Z7 Max, Z7 Mini] lauraaurich:
Somebody Root zte maven z812?
[ZTE Z7, Z7 Max, Z7 Mini] Paulshew88:
KingRoot. (Success) rooted my ZTE Maven. It was a lot of tinkering an hour's but I di

OK So after constantly getting frustrated with every failed attempt and installing countless apks I finally did it. Ive rooted my ZTE maven. And it was with king root not Kingo. King root was the first one I've tried. And had many temp. Root that wouldn't stick or partial root I should say but I did it. OK so as everyone knows download All KingRoot.net version 4.9.3 mark unknown sources. Go to about phone tap on build really fast unlock developer options enable OEM unlock. Go to device admin activate KingRoot. Go to accessibility turn on KingRoot. Don't know if you have to but I did. And here was the kicker open dialer type *#*#759#*#" to open Rlz debugger and turn on OEM unlockode. Then proceed to king root. It took two attempts after reboot by itself it's been two days. Root held after several reboots. I pray everyone else has the same luck
[ZTE Z7, Z7 Max, Z7 Mini] LonerDarke:
Thanks, I hope this work. But first I want to be sure whats is the OEM unlock

Edit: Well, I'm still getting no root strategy message in kingroot. But superuser from kingoroot now can give the root permissions