[Asus ZenPad 10 Questions & Answers] Stifi0815:
Following the instruction of url://whiteboard.ping.se/Android/Rooting I managed to achieve a root account in an adb shell. However, it was quite an effort to achieve this. If somebody is interested I try to summarize what I did. Of course, this is a starting point only to finally root this tablet.

1. Download and extract the firmware from the ASUS site

I used the WW variant: url://dlcdnet.asus.com/pub/ASUS/EeePAD/Zenpad/Z300C/UL-P023-WW-4.6.0.0-user.zip

2. Extract boot.img from fmu_image.bin

To find the offset of the boot image inside fmu_image.bin I used

strings -a -t d fwu_image.bin | grep ANDROID!

The line number is then the offset (bs) for dd

dd if=fwu_image.bin of=boot.img bs=14995456 skip=1

3. Unpack boot.img

unmkbootimage boot.img

unmkbootimage reports the memory addresses

*** WARNING ****

This image is built using NON-standard mkbootimg!

OFF_KERNEL_ADDR is 0x00800000

OFF_RAMDISK_ADDR is 0x00400000

OFF_SECOND_ADDR is 0x00700000

Please modify mkbootimg.c using the above values to build your image.

****************​

and the recompile instructions

---------------

To recompile this image, use:

mkbootimg --kernel zImage --ramdisk initramfs.cpio.gz --base 0x0 --cmdline 'idle=halt androidboot.hardware=sofia3g nolapic_pm firmware_class.path=/system/vendor/firmware nolapic_timer x86_intel_xgold_timer=soctimer_only vmalloc=256M slub_max_order=0 build_version=3 debug notsc' --pagesize 4096 -o new_boot.img

---------------​

4. Add rootsh and pack insecure_initramfs.cpio.gz

By the instructions in the reference posted in the introduction create insecure_initramfs.cpio.gz

5. Repack by mkbootimage

Before mkbootimage can be started its source code must be patched as indicated by unmkbootimage. I changed the following lines in mkbootimg.c to

uint32_t base = 0x10000000U;

uint32_t kernel_offset = 0x00800000U;

uint32_t ramdisk_offset = 0x00400000U;

uint32_t second_offset = 0x00700000U;

​

After compiling mkbootimage the new image file can be created as suggested

mkbootimg --kernel zImage --ramdisk insecure_initramfs.cpio.gz --base 0x0 --cmdline 'idle=halt androidboot.hardware=sofia3g nolapic_pm firmware_class.path=/system/vendor/firmware nolapic_timer x86_intel_xgold_timer=soctimer_only vmalloc=256M slub_max_order=0 build_version=3 debug notsc' --pagesize 4096 -o insecure_boot_su.img

6. Load the image and disable SELinux

In fastboot mode the new image could be transferred by

fastboot boot insecure_boot_su.img

However, it seems that SELinux prevents running rootsh. Thus I disabled SELinux by androidboot.selinux=disabled using the -c flag of fastboot.

fastboot boot insecure_boot_su.img -c 'idle=halt androidboot.hardware=sofia3g nolapic_pm firmware_class.path=/system/vendor/firmware nolapic_timer x86_intel_xgold_timer=soctimer_only vmalloc=256M slub_max_order=0 build_version=3 debug notsc androidboot.selinux=disabled'

After starting and

adb shell

I got root by running

/sbin/rootsh +p

7. Placing files in /system/bin

I was not able to remount /system in rw-mode, even with root. So i modified the entries for /system in the fstab files in rootfs from ro to rw and generated a new boot image. So I was able place su in /system/bin by the help of rootsh and even could run it. However, the supersu app always wanted to update the su file and was not able to successfully run this app.

Note on fastboot on Linux

fastboot on Linux did not recognize the tablet (adb did). To fix this I had to recompile the fastboot source using the usb_driver.c from urls://raw.githubusercontent.com/kangkai/prekit/master/usb_linux.c. Additionally, I modifed the udev rules to

ACTION=="add|change", SUBSYSTEM=="usb", \
ATTRS{idVendor}=="18d1|8087", ATTRS{idProduct}=="4e30|4e40|4ee0|0912", \
TAG+="uaccess"

Final remarks

This is just an illustrative approach which could be used a starting point to finally root the tablet. I am not sure how to deal with SELinux in a nice way and even have no idea to get the supersu app running.