yashsingh1/xdaforums huggingface dataset:
[ZTE Z7, Z7 Max, Z7 Mini] rkey1000:
ZTEROOT.apk

I have the apk for the ZTEROOT app that is supossedly made by the ZTE Corp. so that they can gain root access to their devices. (Even shows a disclaimer stating that distribution outside the ZTE Corp. is strictly prohibited) It was leaked durring the quest to gain root access on the Metro PCS ZTE ZMAX, but the app, or as i was lead to belive, is writen to recognise and install and/or work for the device, android version and rom it is signed for, (which the version i have was for the ZMAX on 4.4.4 but was not for the Metro PCS rom and there for would not work,). There were a couple of people who were able to rewrite the app for our version of the device but were having trouble with signature verification durring the install. Then the Kingroot.apk was released on XDA and the work being done on the ZTEROOT app simply faded off into legend as it was no longer needed to gain root access on the ZMAX. I will post a link to the .apk file on here as soon as i get home, as it is on my HDD at the house. Hopefully someone, far more experianced in Linix and app development will be able to crack this %&*$# and make it pass the signature verification to work to gain root on the Maven.

***Also, I would be happy help with any testing for this or any other exploit found which may give us root access for this device. Unfortunatly, since i am not a Dev nor am i versed in android security protocals, my level of participation will be limited to testing and/or support for real the devs who make the magic here at XDA.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
sweet. thanks.

signature verification is going to be the tough part, but having the app should help me in my current work though. i appreciate your willingness to help
[ZTE Z7, Z7 Max, Z7 Mini] rkey1000:
I'm having trouble with uploading the app cause my internet keeps going out but I will keep trying. Here are some picks of the app on the phone. It installs but as you see it will not root due to " product version mismatch"
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
do you have the app to upload or no???
[ZTE Z7, Z7 Max, Z7 Mini] rkey1000:
Sorry for the delay. here is the app as promised.
[ZTE Z7, Z7 Max, Z7 Mini] rkey1000:
Also [MENTION=2376614]jcase[/MENTION] was hinting at possible exploits in the dialer codes as well as the Assist 1.0 app durring the race to root the zmax. Not sure if it will help but i figured the info couldn't hurt. Thanks for the hard work to help us gain root. If there is anything else i can do please dont hesitate to let me know.

:good:

---------- Post added at 07:31 PM ---------- Previous post was at 07:30 PM ----------

Also [MENTION=2376614]jcase[/MENTION] was hinting at possible exploits in the dialer codes as well as the Assist 1.0 app durring the race to root the zmax. Not sure if it will help but i figured the info couldn't hurt. Thanks for the hard work to help us gain root. If there is anything else i can do please dont hesitate to let me know.

:good:
[ZTE Z7, Z7 Max, Z7 Mini] 0134340:
I decompiled the dex file inside the apk and it appears this method is predicated upon calling an existing backdoor; basically the apk is just acting as a frontend switch. I'm guessing it only worked on phones, Z970 in this case, in development and for testing purposes. I wish I could help in other ways but I'm not too familiar with rooting on Android. It's a great phone for the $10 I paid for it.

[IMG="zteroot_decompiled"]https://i.imgur.com/j7MmZ74.jpg[/IMG]
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
this is exactly what i said several pages back--there is a root dialer code in emode, but, deodexing tools do not exist at this point that will successfully deodex emode and the zte dialer app in order for me to pull the code, but i've successfully decompiled what is available without deodexing in the emode app and got it back to original java source using another open source tool. when i get back home i'll post some snippets of what i've deciphered from those sources

also, it looks for zte.root to be present which i couldn't figure out what it was but it may be a similar app to the one you posted just for the maven.
[ZTE Z7, Z7 Max, Z7 Mini] cavalcanti.uy:
Failed to root system. Error

Enviado desde mi Z812 mediante Tapatalk
[ZTE Z7, Z7 Max, Z7 Mini] rkey1000:
Xtream measure got a script that deobsfusticated the codes from [MENTION=2376614]jcase[/MENTION] and used it to get the dialer codes for the ZMax. Maybe it will work for the maven aswell. I will see if he still has some copy of the script.
[ZTE Z7, Z7 Max, Z7 Mini] Jacobw53:
ReRun Root Anyone?

Has anyone looked into ReRun Root on the Maven? This is supposed to work on multiple ZTE devices and it deals with the write protection. Here is the forum I found it on. http://xdaforums.com/android/software/rerun-root-write-protection-removal-t3118019

Here is the readme to ReRun Root from npjohnson.

Ok looks like the script is mainly for the ZTE Majesty. But the method that is in the number list, should work with any ZTE device. I would try this myself. But I don't plan on ZTE Mavens being a part of my budget, if anything goes wrong with this.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
this doesn't work on the Maven--when the boot is written to the recovery and the phone booted using that method it just hangs at the bootloader and reboots and then the stock recovery is rewritten and then system boots as normal
[ZTE Z7, Z7 Max, Z7 Mini] LonerDarke:
Hi, somebody has already updated to the new B20 version? Seems like it's just security enhancements, but anyway I don't see no one talking about it
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
i'm curious about the updates as well.

i'm still on wuzA, B15.

the reason i put the hardware version is because according to the sbl there are four versions wuzA-D
[ZTE Z7, Z7 Max, Z7 Mini] yuhas92:
ill download the b20 update using logcat over adb to get the download link to see if i can see what changes have been made
[ZTE Z7, Z7 Max, Z7 Mini] hroark13:
do this to remove write protection

http://androidforums.com/threads/zte-write-protection-for-zmax-and-other-zte-phones.1040331/
[ZTE Z7, Z7 Max, Z7 Mini] Hurrian:
Doesn't work on wuzA B15, even with SELinux set to permissive.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
i'd like to know how he found this...

there must be something similar on this device though...

---------- Post added at 10:30 AM ---------- Previous post was at 09:58 AM ----------

how did you find this? old friend lol

the reason i ask is because maybe there is something similar on this device that can be found
[ZTE Z7, Z7 Max, Z7 Mini] decayingxapple:
What about the 'System Updates' button located in "About Phone?" Could we use this to copy "update packages" on the storage card? I'm no genius, so I don't know if we can make use of this, or not.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
just something cool that i found, kingoroot will root the device in one try while in ftm.

i've tried some other exploits this way and have gotten interesting results. this may be a way to bypass rw barrier if the proper exploit is found
[ZTE Z7, Z7 Max, Z7 Mini] jdrbrn:
Confirmation that Kingoroot (Windows Version) will work in FTM mode(hold vol down while booting)

Edit: It's still temporary, but the system isn't in normal mode(none of the /storage paths are mounted as an obvious difference) so it may provide some advantage over getting temp root when fully booted
[ZTE Z7, Z7 Max, Z7 Mini] 10252:
Root wont matter phone has a NAND lock. plain and simple.
[ZTE Z7, Z7 Max, Z7 Mini] Rotpot09:
No Trolling. Help or LEAVE. Just like when the mods warned last time false claims get you removed.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
(1) you never offer proof for this statement. not once. just saying it doesn't prove it or make it true.

(2) the only security preventing our attempts so far are (a) dm verify aka dm_verity, (b) a locked and fastboot crippled bootloader, and (c) zte's special way of building busybox and sh. that's it

prove your statement with some actual technical information, diagrams, whatever. just prove it.

and prove you've found a way around it. here's your video https://www.youtube.com/watch?v=A7uqTjZ4sHA&feature=youtu.be for everyone to see and judge for themselves what's going on as it has obviously been spliced after the splash screen...
[ZTE Z7, Z7 Max, Z7 Mini] jdrbrn:
Not sure if this proves or disproves any of the nand lock claims, but I did manage to (mostly) brick my phone by overwriting /dev/block/platform/by-name/aboot. It can only get to Download/DFU mode now. If anyone knows how to flash anything in this mode, it'd be great if you could share.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
why did you overwrite the aboot? were you trying to flash a custom one or something???

anyway, you might try using qpst with the fota package and see if you can upgrade that way--this has worked many times for me with other devices to de-brick them.

i personally have not tried qpst with this phone however, so my suggestion may be useless idk
[ZTE Z7, Z7 Max, Z7 Mini] jdrbrn:
I overwrote it because it's not my main phone, and read something (very quickly) about it being related to fastboot, so I overwrote it to see if it'd unlock true fastboot. I have no clue what it does, and was just fooling around trying something. Thanks for the advice though, I'll try it out.

EDIT: Nothing actually shows up in Windows at all (no com port or anything), but the phone does reboot(led blinks to blank and then red, and vibrates) so I think it's just dead.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
well, i've soft-bricked one of my three mavens;

development is not stopping...

i need some IDA reverse engineering pros to take a look at ztelk, aboot, and sbl1 to see if unlocking the bootloader is even possible; the unlocked bootloader confirmation string is present in the aboot, which means it must be able to be unlocked, i just can't figure out how.
[ZTE Z7, Z7 Max, Z7 Mini] Ouya-XD:
Unfortunately, being here and having done some work, it's the same way.

>figure out you can't really help

>steps away

I guess it's the forfeit of not wanting to let down brothers fighting for a goal.:(

---------- Post added at 09:34 AM ---------- Previous post was at 09:23 AM ----------
[ZTE Z7, Z7 Max, Z7 Mini] Ouya-XD:
Gonna be honest, this looks like something I've seen before.

And since he won't post sources I'll expose this breakthrough.

It's a pushed bootsplash until he provides further info.

Also, looking at the constant G-Access Pool as soon as he loaded the phone, it's extremely close to something I've seen before.

Either it's the manufacturer app which allows for a completely insecure boot up temporarily that doesn't allow you to do much, and doesn't prove his Nand theory, or it's ZTE's Log Boot Tool which I've seen twice that's only compatible with a few models dating from 013-015 that basically allowed import files to the System Tray but no further, but the phone basically behaved like a Display Model with lesser security.

We've seen no proof, and nothing has been done, so until he can cough up his process he's a huge red flag avoid to this thread.
[ZTE Z7, Z7 Max, Z7 Mini] JB3783:
OK guys I have been working on this for a LONG time and I got temp root without all the complicated BS.

Step 1: Put your phone in FTM(Vol Down + Power) & run the latest kingoroot. Let it finish.

Step 2:reboot

Step 3:run kingoroot AGAIN & let it finish.

Step 4: uninstall kingoroot SU application.

There you go!!!

Can't upload screens right now because xda mobile isn't working right. But try it and let me know. I'll update you with weather its temp or permanent in a little bit.

Enjoy :)

Edit: its just temporoot looks like the boot loader is locked and we have no way to unlock it without ZTEs official tools :(
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
are you saying that temp root persists after reboot when doing this?

this is exactly how we all have been getting temp root so i don't know what you're saying is new about this...
[ZTE Z7, Z7 Max, Z7 Mini] JB3783:
My bad I thought I had found something >:(

As far as I knew nobody had any success with anything other than booting a modified android off of an SD card. Either way I've modded the bootloader to remove write protection & am in the process of implementing that and working around the OEM partition, at least modifying it with SU & busybox should keep the root persistent. I've been trying and trying with this phone but its a PITA.
[ZTE Z7, Z7 Max, Z7 Mini] pantherlily6:
Any luck so far? I've been trying everything so far, and nothing's worked at all
[ZTE Z7, Z7 Max, Z7 Mini] bob24260:
Does anyone have a copy of super root?All I get is redirects and ads like crazy when I try to download it. I appreciate it!
[ZTE Z7, Z7 Max, Z7 Mini] ErevosMoonbeam:
Rooting solution needed :(

Hello all.

First post on xda and it is just to add to the testimonials of people here.

I have tried all the apps and programs mentioned in this thread so far, even downloaded from sketchy sites with the result of having to restore my z812 to its factory settings , but to no avail ! This phone just won't root >.<

And imo , it is imperative to do so cause the amount of bloatware is ridiculous , not to mention that the "Move to SD card" setting for apps is working as a joke and i have no access to my pictures through ES File Explorer !

Sb plz find a way to root this :(
[ZTE Z7, Z7 Max, Z7 Mini] edelschaap:
Hello all,

I bought the ZTE 812 Maven from AT&T as an affordable back up smartphone today and I found the same issues with rooting the phone like posted here, but I found a way around it! I remembered a similar issue with the Nexus phones I'd seen before. The only thing is your phone will be factory reset so PLEASE MAKE A BACKUP BEFORE PROCEEDING if you want to keep your settings.

Hopefully these steps will help you out:

1. Activate developer options menu by going to the settings, choose 'About phone' menu and click about ten times on Build number.

2. Now you'll find the Developer options in the settings screen of your phone. Click on it and look for the option 'Enable OEM Unlock', make sure you mark the checkbox, leave the settings screen and restart your phone. THIS OPTION IS THE FIRST STEP IN GRANTING ACCESS TO ROOT, BOOT AND FLASHING ROM'S TO YOUR PHONE!

3. Download and install the latest Android SDK from Google on your computer (just google).

4. Go back to the settings of your phone and go back to Developer options, and activate the USB debugging mode.

5. Connect your phone with a USB cable to your computer. (make sure Android SDK is installed at this point)

6. Your phone ask to trust the computer with Allow USB Debugging? Press Yes twice.

7. Now enter this command on the computer: adb reboot bootloader

Note: If you're using a Mac, it’s: ./adb reboot bootloader or ./fastboot -insert command-

8. A bootloader unlock confirmation page will appear. Tap Volume Up to highlight “Yes,” and Power to select it.

9. Your phone will then be erased and the bootloader unlocked. It won't take more than a minute or two.

10. Your bootloader is now unlocked and ready for root, ROMs, recovery, etc. Press the Power button to reboot your phone and a factory reset will be applied.

11. After your phone is ready, install one of the root apps as mentioned in the posts, I used Super Root Master apk and it worked right away. I'm sure the other methods works too, but I did not test it.

Let me know if you have any trouble!

Good Luck!
[ZTE Z7, Z7 Max, Z7 Mini] Shuavigintitres:
I've been waiting so long, I'm going to try your method, sir! What can I expect to see after wiping my phone, a factory reset? Am I going to have to use a room? I'll let you know if I totally destroy my phone, and I promise I won't be mad

Update

I can't figure this sdk thing out at all! I've got Android studio all installed but I can't for the life of me figure out where to put this command in!

Update

I think I figured out the adb command prompt thing, tried adb reboot bootloader

My phone rebooted, with all the same settings

Every adb command thus far is failing, I tried adb reboot download, adb reboot bootloader, adb reboot-bootloader, every time it just reboots with no changes.
[ZTE Z7, Z7 Max, Z7 Mini] dakilaledesma:
Can confirm that on OSX this command isn't working, phone doesn't reboot to bootloader despite using adb reboot bootloader or adb reboot-bootloader. It just boots like normal. This command works on my other phone so the problem is stemming from the phone.

I've also tried to boot to bootloader using recovery (Power + Volume Up) through the menu option reboot to bootloader, with the same result.
[ZTE Z7, Z7 Max, Z7 Mini] Shuavigintitres:
Wish I knew how to delete a post..
[ZTE Z7, Z7 Max, Z7 Mini] xx_iamxanderman_xx:
Hey, I have been working with this phone a lot lately. My operating systems are Kali Linux 2.0 and Windows 10, I may try with Mac OS X soon. This phone's bootloader does not seem to have a fastboot mode. I have managed to get the phone into Android System Recovery by rebooting the phone while holding the Volume + (up) button. I have tried flashing custom roms via Android System Recovery but ran into issues with signing. I also have found an FTM mode on the device and I have done research on it and FTM stands for File Transfer Mode, you can boot into FTM by rebooting the phone while holding down the Volume - (down) button. To exit FTM, hold down the power button until the phone reboots. FTM has allowed me to transfer files via ADB and use a read-only ADB shell, however I can do the same things while fully booted into Android. While booted into Android and FTM, I tried following this guide: http://xdaforums.com/showthread.php?t=2684210 but could not copy any files to /system/bin because the file system is mounted as read-only, I also followed the psneuter method but got an nmap error. This phone is definitely a tough one, I hope my findings here will help other developers and inspire new ones, meanwhile I will continue to work with it.
[ZTE Z7, Z7 Max, Z7 Mini] Saintlyy:
Any solution so far ?
[ZTE Z7, Z7 Max, Z7 Mini] razrlokote:
same here ive been checking this forum every other day to see if anything new has been discovered for this phone. :p
[ZTE Z7, Z7 Max, Z7 Mini] Shuavigintitres:
As am I
[ZTE Z7, Z7 Max, Z7 Mini] Clearchaos:
Mine just reboots as normal when I try this as well.
[ZTE Z7, Z7 Max, Z7 Mini] bngo16:
I tried the same thing and mine also just rebooted like normal and can't be rooted. :(
[ZTE Z7, Z7 Max, Z7 Mini] Saintlyy:
UP :( Anybody to help?
[ZTE Z7, Z7 Max, Z7 Mini] snocat_trf:
i wish someone would find a solution to root this phone....
[ZTE Z7, Z7 Max, Z7 Mini] godkillerz223:
This is my first zte phone ever and it does appear to have no bootloader even within recovery mode, theres an options to reboot to bootloader but it just boots normal.
[ZTE Z7, Z7 Max, Z7 Mini] cbaxterm:
Where Super Root Master?

Dear edelschaap:

You wrote "I used Super Root Master apk and it worked right away." I have Googled for this and found no clear answer for where to obtain the "Super Root Master apk" you mention. Root Master yes, but Super Root Master no. Could you possibly provide a link or otherwise let us know where this may be obtained?

Thanks!
[ZTE Z7, Z7 Max, Z7 Mini] jdrbrn:
If you have the phone connected to a computer, power off and then hold Power, VolUP, VolDown and release when the LED turns red the phone is put into download mode. What we can do from here I don't know.

Edit: Additionally if you hold VolDown during power on you get put into Field Test Mode, which has an ADB accessible shell, but is not root as far as I could tell.

Edit 2: Shell seem to still be in the default shell user, so I'm not sure what the usefulness of this mode is

Edit 3: There is an open serial communications port in this mode, but I have no clue what to do other than connect to it. This also holds true for the other diagnostic mode initially mentioned

Edit 4: The first diagnostic mode(I'll call it DFU since that's what Windows calls it) responds with the same data whenever a keystroke is sent to it at baud 115200, so it is receiving
[ZTE Z7, Z7 Max, Z7 Mini] johntom2000:
This is my first android phone

I been keeping up this thread and still nothing. The phone itself isn't that old. It came out in July of this year. I am hoping someone finds a root as I run a 8GB phone and would love to download apps to my 32GB micro SD card. I love this phone.
[ZTE Z7, Z7 Max, Z7 Mini] jdrbrn:
ZTE has modified Android so that (some) apps can be moved to the SD Card. Go to apps in settings, then click on an app, and if available click move to sd. Apps that are pre-installed or system level can't be moved however.
[ZTE Z7, Z7 Max, Z7 Mini] stayboogy:
anything you want to share would be great...

how exactly did you modify the bootloader? just curious because i've been trying the same thing

glad to have another dev in the mix, thanks
[ZTE Z7, Z7 Max, Z7 Mini] rgill420:
Has anybody had issues with the phone loosing signal randomly. I unlocked this phone from ATT and took it overseas to India. When i used a local sim, the phone would work fine for about a day and then just start to loose signal. This happened on the 3 ZTE MAVENs that I took over there. Did anyone else face this issue? I also tried to go into the network settings using the network app and change the data to GSM only, LTE only but still no luck.
[ZTE Z7, Z7 Max, Z7 Mini] Ouya-XD:
Using most phones in GSM Mode depends on the location of where your signal is coming from.

I'd manually put in the APNs before assuming anything is wrong as this is extremely common in any phone you just jam a SIM Card into.

Using GSM only is a safer option, but still manually putting those APNs in for the Network you're using would connect you directly to the networks servers and you wouldn't drop bars as much.

I feel confident in saying that most GSM phones I've had in the past had the same issues.

GSM phones in general are going to have a bouncy connection unless you directly connect to servers. I used a Samsung Galaxy Nexus GSM on ATT for a good three years, along with other project phones.

I can tell you that using the phone in generic GSM mode I would constantly bounce from having two bars to three throughout a day, my messages came in slower, and I kinda had to grow used to it.

After I manually put in the APNs of my carrier, I did notice a change. I could hold a steady three to four bars all day, and in non heavy areas I'd run a complete full bars.

Try that and see if it helps, I figured it was only wise to address that I had the same issues just so you have a small example on how things went for other people.
[ZTE Z7, Z7 Max, Z7 Mini] rgill420:
thank you for your response. I had a few follow up questions also. Should this still be the case when I turn the data off. I thought that the APN settings needed to be configured for data and mms. I had tried to turn the data off and the issue was still there. It's weird because it's never happened to me before with any other GSM phones. I will try to set the APN settings tonight and let you know of the results. Maybe the phone is missing some bands for the Indian carriers.
[ZTE Z7, Z7 Max, Z7 Mini] LgnVcell:
So I just want to make a note of this on how we even have temp root in the first place:

"I lost some conversations, and I use Dr Fone to recover them. Reading through the instructions, it utilises a one-click temp root to attempt the recovery."

So I think ZTE purposely added the temp-root "feature" because of problems like message recovery where apps like Dr Fone use the root to their advantage. The question is, is the temp-root secure enough to block any hackers to full root the Maven, or will it be ZTE's downfall?

All I wanted to say is that we're lucky enough to have the temp-root in the first place.
[ZTE Z7, Z7 Max, Z7 Mini] Ouya-XD:
Essentially yes!

They open up data and all of that, but it also makes it easier for your phone to contact the servers of the card you're using if it's GSM.