[Asus Zenpad 8.0 Guides, News, & Discussion] yamada_2501:
This procedure supplements what was posted on 2ch.

this procedure is for firmware v3.3.18 or less.

If your firmware is v3.3.20, you may be able to downgrade to v3.3.18 with the procedure described at the end of this post.

for necessary files, download from the follwoing URL.

hZtZtpsZ://wZwZwZ.axfc.net/u/3777377

Z←remove

(PASS Z581KL)　(差分＝Difference，キーワード＝KEYWORD，ダウンロード＝Download，こちら＝HERE，cacheに置くもの＝Things to put in the cache)

1.extract boot image

turn on debug mode.

then, reboot recovery mode.

$ adb reboot recovery

after that, mount the system using the terminal volume button and the power button.

$ adb push dirtycow /tmp/
$ adb push run-as /tmp/
$ adb shell
shell@P008_1:/ $ cd /tmp
shell@P008_1:/tmp $ chmod 777 dirtycow
shell@P008_1:/tmp $ chmod 777 run-as
shell@P008_1:/tmp $ ./dirtycow ./run-as /system/bin/run-as
shell@P008_1:/tmp $ run-as

shell@P008_1:/tmp # dd if=/dev/block/mmcblk0p41 of=/tmp/boot.img
shell@P008_1:/tmp # chmod 777 /tmp/boot.img
shell@P008_1:/tmp # exit
shell@P008_1:/tmp $ exit

transfer boot.img to PC.

$ adb pull /tmp/boot.img ./

2.unpacking the boot.img

"mkbootimg_tools-master" is useful because it outputs log of ramdisk size.

(However, binary "mkbootfs" and "mkbootimg" are 32-bit versions.

if your environment is 64-bit, you need to bring 64-bit binaries from CarlivImageKitchen64 etc)

for example, using mkbootimg_tools-master looks like this:

$ ./mkboot bootimg_source/boot.img bootimg_output

Unpack & decompress bootimg_source/boot.img to bootimg_output
kernel : kernel
ramdisk : ramdisk
page size : 2048
kernel size : 29041019
[COLOR="Red"]ramdisk size : 2924316 <- refer to this value later[/COLOR]
base : 0x80000000
kernel offset : 0x00008000
ramdisk offset : 0x01000000
tags offset : 0x00000100
cmd line : console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlyprintk vmalloc=256M build_version=3
ramdisk is gzip format.
Unpack completed.

directories after unpacking boot.img looks like this:

bootimg_output

|--ramdisk

|--kernel

`--others(img_info,ramdisk.packed,etc)

3.install SuperSU manually

overwrite the contents of "initrd差分.7z" under directory "ramdisk".

("su" is an empty directory, but also to put it under "ramdisk")

(for "sbin", you only need to add launch_daemon.sh without deleting the existing files)

(permissions on files/directories should be the same as original or other file/directories)

4.repacking the boot.img

for example, using mkbootimg_tools-master looks like this:

$ ./mkboot bootimg_output boot_patched.img

mkbootimg from bootimg_output/img_info.
kernel : kernel
ramdisk : new_ramdisk
page size : 2048
kernel size : 29041019
ramdisk size : 2924316
base : 0x80000000
kernel offset : 0x00008000
ramdisk offset : 0x01000000
tags offset : 0x00000100
cmd line : console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlyprintk vmalloc=256M build_version=3
ramdisk is gzip format.
Repack image utility by carliv@xda

Check and add the kernel
Check and add the ramdisk
Build the new image

'boot_patched.img' successfully repacked
Kernel size: 29041019, [COLOR="Magenta"][COLOR="Red"]new ramdisk size: 2924316[/COLOR][/COLOR], test_patched.img: 31969280.
test_patched.img has been created.
...

at this time, it is necessary to adjust so that the value of "new ramdisk size" becomes

the same value as "ramdisk size" when unpack.

if the size of "ramdisk" is different from when unpacked, Z581KL will not start.

therefore, deleting unnnecessary files stored under ramdisk/res/images/charger and adding dummy files.

(the difference of about several bytes seems to be no problem)

(once wrong boot.img is written, Z581KL will no start until you write the original boot.img)

however, the size of the original boot.img and the modified boot.img can be different.

(in my environment, the original boot.img was about 67MB, while the modifyed boot.img was

about 32MB)

5.insert modified boot.img

using dirtycow, adb push, and dd, insert the modified boot.img into the /dev/block/mmcblk0p41

also, put "su.img" and "SuperSU.apk" in /cache

then,reboot Z581KL.

"Verification Error" is always displayed when starting up, but if you wait for a while

it will start normally.

that's all.

**********************

Firmware downgrade procedure

1. your firmware is v3.3.20.0

2. download firmware from asus's support page. (UL-P008-WW-3.3.18.0-user.zip)

3. rename the zip file ( UL-P008-WW-3.3.18.0-user.zip -> UL-P008-WW-5.3.9.0-user.zip )

4. Place the zip file in an arbitrary directory on the SD card and insert this SD card into Z581KL

5. The update dialog is displayed as it is ( or it is displayed when restarted )

If the firmware is v 5 or higher (currently v 5.3.9.0 is published),

this procedure may indicate an error and the downgrade may fail.

In that case, for now I have no choice but to give up ...