yashsingh1/xdaforums huggingface dataset:
[Blade General] BigCountry907:
Well like the rest of you I want to unlock and root this device.

I'm sure this is going to be a long road for all of us but I really like this device so personally I will do what i can to help figure out how to unlock and root this thing.

As a single soul this could take months or even a year but with combined efforts of this community I think we can pull it off. We all have our strengths and if we combine them with your help and the help of others it might turn out to be quite easy.

Don't be fooled and believe that fastboot is removed from the bootloader. It is there im sure we just need to figure out how to access it.

On a good note I already have a method to overcome update.zip signing that I developed for the alcatel one touch fierce 2. When using the recovery to flash the phone things actually become simpler. I would expect though that the recovery image is signed as well meaning we dont simply have the ability to flash the recovery. Unless we can unlock the boot loader first.

In reality to do any of this we are going to need temp root. At this time i have no idea how were going to get that but if you can get temp root even just enough to pull a backup from the device that will be a huge step forward.

To do anything useful we need a device backup. Or a update.zip.

If you can find a way to copy the update from this device before it is installed that would be wonderful.

My device already updated so if you have a brand new device that is not updated let us know so we can get our hands on the update.

In the meantime ( Until we get some firmware to reverse engineer ) I will document all the data I can get and how to get it.

The very first thing we need is to know all of the partitions on the device. If I can get the full GPT Partition Table that would be best.

So without further adieu I will start this journey.

Some of my post will be fairly basic to some and very complex to others.

I'm going to start by seeing what all boot modes i can get into.

Then see what I can get with ADB without root permissions.

Map out the partition scheme, and see how much of the security scheme I can determine is in place. All the fun stuff like what files are signed, how the boot chain is verified. I have seen it before where overcoming the initial security mechanism opens up a whole world of possibilities.

Programmers get lazy and to save money if they think your blocked out of a vulnerable area period they may lax on harder to bypass security.
[Blade General] BigCountry907:
Ok after a day of research and some gleaning of info from my blade x max I have a direction to move in anyway.

The closest device and one of the only devices zte allowed unlocked is the ZTE axom7.

We can study the Axom7 and get some Ideas on what will work on the BladeXMax.

First fastboot is crippled initially.

But this is easily overcome by swapping a few bytes on the right partition.

Thats my theory anyway. I'm in the process of proving it.

After Fastboot receives its prosthetic Limb oem unlock is as simple as 1 command.

Once the bootloader is unlocked the device will allow for a unsigned TWRP to run.

Now of course we need to compile our own TWRP. And then we can root.

Obviously we need the ability to write to this fastboot partition.

And we need to be able to flash TWRP.

Without Root how???

Just like the axon 7. EDL mode.

ZTE seems EDL Mode Friendly.

And the flash programmer (Firehose) is not signed.

Miflash can write partitions on the zte devices.

The only issue right now is we need the files of of the Blade x max.

And the GPT partition table.

Seeing that axom7tool can backup partitions from the axon7 in edl mode.......

Knowing that miflash works.

One of us that knows the protocol of miflash ( saraha ??? )

Can write a tool for linux that uses the same protocol.

Once this tool exists we can backup all the partitions and the GPT without root.

Once i have the files from the blade it should be possible to edit the fastboot partition and un-cripple the Fastboot.

So if any of you know the guys that wrote the axon 7 tool he can help us with a tool.

Other than that were stuck writing the tool ourself.

On a good not the sahara protocol and other edl protocols are very well documented.

If you seriously want in this Blade this is the way to go.
[Blade General] pauljulian:
Old codehead (emphasis on the "old"), and I have this device... unfortunately, it's been updated, so there's not a whole lot I could offer...

With an at least rudimentary how-to provided, though... as long as I can get the device back to square-one, if things go tits-up and it's necessary... bitter experience... not a few Cricket LG G Stylo paperweights at hand... I'l like to offer myself as an alpha-tester for whatever you find out...

Just bought this lovely new home in Albuquerque, and, until a few things settle down, don't have a lot of cash... but I'll offer mine as a test-bed of sorts...

I'm fascinated with the work you are doing, and I really dig this phone for pretty much every reason except Cricket's bullheadedness, and am looking forward to watching you work...

I'm also kinda horrified that, seeing your log dumps upthread, I could actually understand it... can take the boy out of the tech, but some things seem to be stuck in the little grey cells forever.... *chuckle*

My tech chops tended more towards xBASE and Delphi, and still do... was what I learned, along with COBOL and RPig...

Have been trying, over the past few years, to get some C++ and Java under my belt, but it's more important to me to finish my BA in the up coming spring semester, and do UNM School of Law... Renaissance man wanna-be here... *grin*
[Blade General] pauljulian:
Just wondering, good madam or sir, what progress you've been able to do... I don't mean to push, as we all have lives away from this forum (at least I do hope so.. *smile*), but, as I love to learn, and now in my 60's, found my Java, C and C++ texts, have downloaded and installed all my preferred tools, and would just really dig seeing some journaling of your progress on this rather fascinating device... more internal RAM than I would have ever expected on a smart phone, and, as such, space is not at such a premium that I'm required to use Apps2SD Pro (although I paid for it), Titanium (although I paid for it), but just damn...

I'm disgusted that Cricket would be so paranoid against their paying customers that they insist on absolute control... just damn...

Sorry... woolgathering on a Friday afternoon, while installing other dev tools... <smile>
[Blade General] Chevylover496:
Firmware update downloaded

My phone has the firmware downloaded please let me know if there is a way to pull it for R&D

---------- Post added at 03:31 AM ---------- Previous post was at 02:55 AM ----------

This phone just force installed nevermind
[Blade General] Emoticonjon:
Update not installed

I have the update downloaded but not installed. The phone is trying to force update but it can't because my battery is too low, I'll try and leave it that way. Do we have a way to find and extract the update?
[Blade General] Emoticonjon:
Scratch that. Force install starts at 20% battery or so. Accidently over charged haha.
[Blade General] Chevylover496:
We need to post the way to pull the update

We need to post a way to extract the update so that the next person who has it but it is not installed can pull it for us any help from more experienced individuals would be greatly appreciated
[Blade General] Chevylover496:
Update ready to dl

Any ideas how to pull it from the phone
[Blade General] MassExplosion213:
If you have an update.zip signing bypass, I could leverage that to get a dump of the partition table.
[Blade General] dammi.forza0910:
Z983 Root Method Development

Hello world of XDA,

We want to root this device. Yes? Well, as of right now, 01-27-2018, there is no working method available on the internet. We have to do this ourselves. Ive rooted literally hundereds of phones, but this one, Crickets down played version of the Blade Zmax, re-dubbed Blade XMax Z983..

First, we need the boot loader. I am willing to team up with some people, to make this happen. Any takers?
[Blade General] zMILWAUKEE:
Has anyone been able to get the last update files, about a week ago i think, off the phone before applying the update. If anyone has those we may be in business, at least further along than we were. That last update was a decent size update, and if it had anything to do with the spectre/meldown patch, that update would have had the partition layout, how the bootloader has been hidden and so on and so fourth. So if anyone was able to grab the update please post here, as the thread creator and a few others seem to know what to do from there.
[Blade General] dammi.forza0910:
Can I start by modifying tye system UI apk?
[Blade General] trjv:
Hey so I've got this device and it's FRP locked. If anybody is willing to work on this still these days (for root, frp, various unlocks, etc) then let's make it happen. Can't say for sure if I'll have the device for very long, but I'm definitely down to try while I have it. Lmk if there's anything I can do to help the progress.
[Blade General] gio1135:
You know how bad I wish I could take you up on this? I just don't have the experience or the knowledge. I'd love to learn but I don't even know where to start.
[Blade General] dammi.forza0910:
Okay, so I have successfully copied the boot animation.zip and have attatched it as proof. I believe, i can actuall copy the firmware because I found the file locatiom after an exhausting amount of trial and error with different approaches. Usong Debian (wheezy) ,and a combination of file explores, and modifying apk's through luck patcher, I was able to view the device tree and so on. Anybody willing to guide me to the next step?
[Blade General] dammi.forza0910:
Z983 Firmware .img files found and uploaded

Okay, I found the firmware files and when I moved them to my external SD card, they combined automatically and was labled update.zip. This is it guys, help me!
[Blade General] dammi.forza0910:
Device Tree

Can anyone let me know if this is helping, or if everyone gave up....?
[Blade General] zMILWAUKEE:
Downloading the files when I get off work and will look at them as best I can, maybe we can get the bootloader to show up in the recovery, Cricket did something to the flags that bypasses the bootloader, maybe we can reflag and get it to show up again. Good work, hopefully some progress can be made now.
[Blade General] zMILWAUKEE:
Those linked files are not the full update. They are way too small, the update file should be zipped and at least 450 mbs in size and for the full firmware it would be around 1.5 gigs in size. Try to upload the actual update.zip and we will see what we can do.
[Blade General] Drotimes:
I have the ZTE x max I stop all my updates I turn my updates off completely if I can help in anyway please let me know
[Blade General] dammi.forza0910:
check this out

OmaDm update..

So after you open the zip file you'll notice an apk....

Note** the script can be changed before installed
[Blade General] dammi.forza0910:
If you look into the combined zip that was auto downloaded when combined.. To do so, I opened and terminal, issued the command: Bmgr enable, and that gave me the option to create a backup in system settings, about, additional system updates... I then compressed both files, and the most recent post of mine, is the result.. Which now mysteriously contains an all with a text file with interesting information, along with a root text file. Have you heard of bootstrap? An RCS module?

---------- Post added at 01:18 AM ---------- Previous post was at 01:16 AM ----------

Also, I noticed a scripts in Tue recovery script, mentioning a "dailybuild", uploaded in the boot process libbootart.so, and it says something about a Cable connection, as in Satellite boot.img uploaded every powerOn...?? Indicating root is at a cloud based system?
[Blade General] phonecapone:
bump.. how is the progress going on this? I have a FRP'd handset right now. Currently trying to remove it with Miracle Box but need root access. ADB is enabled in FTM mode so that is a start.
[Blade General] Thisguyahstyloguy:
Just wanted to throw some encouragement out here. There is no knot that cant be untangled.

I am eagerly waiting.

I can't do this myself, the people here trying to overcome the z983 are the only hope I (and many others) have.

The best to you.
[Blade General] Docmodie:
Would love to be able to root my phone at some point wish I could help other than offer my daily z983 a computer and any thing I can give for files if needed. Just need instructions

Forgot to mention that I've got emails enabled so shouldn't take long g to get back to someone e should they need anything.
[Blade General] Dualthoughts:
A couple Interesting observations ive noticed.

First off let me say keep up the good work on this project. and second let me say to anyone reading this that keep in mind what I may say may have been discussed already or have obstacles of there own to overcome and may not be a option, first off im not a programmer just a automechanic that has fiddled with computers and electronics since the msdos days, I can barely compile a script at times but i do know my way around a linux terminal and OS a little bit and I have done a few hardware firmware flashes in my time and a couple rasberry pi builds and overclocking. Anyway here goes Ive noticed a couple things on a few of these phones coming out of china they seem to look like they are mix and match cookie cutter rebadges between chinese companys, for example this phone the z983 seems to be almost a exact match hardware wise to the tmobile revvl plus made by coolpad/yulong. Now as far as i know nobody has had any luck on rooting it either but maybe in some of the forums sombody has found a exploit that could be useful on this project or maybe there is a way to do a cross firmware flash from the firmware code of other phones with a simular hardware platform to this one, a example of what i mean is how a xross platform flash can be done on the lg v20 by patching the lg upp application. Now i may be out of the loop and out of touch on this subject but damn there has got to be a easier way to get root access on some of these phones. Hardware wise they look about as cookiecutter/interchangeable as GM cars and the chinese are not known for proprietary hardware and software on there devices in fact looking at this it reminded me of how japanese car comanys traded parts ewith eachother and how there R&D departments worked together. Also this phone was released by us cellular which if im mistaken is in bed with tmobile who released the revvl plus thats made by coolpad/yulong maybe somebody that has some experience rooting coolpad devices has figured out a weakness or exploit that could be useful?
[Blade General] zMILWAUKEE:
You my friend are 100% right on the money with the assumption that almost all the Chinese brands are rebrands and the guts are exactly the same, the downside is the carrier limitations. For instance, Cricket had ZTE bypass the bootloader in userspace from boot in the kernel on the Blade X Max, although the bootloader and its partition are there the user has no way to access it. And the way the china companies refuse to release the source code, or when they do they make sure that there is no way you can properly build a bootable kernel, we can only get so far and then that brick wall shows up and we get stuck. The only way in on these phones is the EDL mode ( weird form of fastboot ) that no one I have seen so far has been able to take advantage of. And with these phones not selling by the 10s of millions no devs are willing to take the time to crack them open and work on them.
[Blade General] Dualthoughts:
You made a good point

I've noticed. Nothing really gets attention unless it has Samsung or motorolla written on it. Yeah and it's a shame how nowdays most comanys do everything possible to lock you out of the bootloader and how dialer codes and adb/fastboot commands are getting locked up and removed every day, it's really a damn shame because most these company's making Android devices made there millions off of using open source/free bsd Linux source codes and programmers work for hardly no cost then they have the nerve to try locking down and regulating the Android kernel which is basically a Linux kernel it's a damn shame. But you made a valid point on your comment about how down to the hardware there exactly the same. If someone can come up with a decent hardware exploit and possibly gain root several of these phones could be rooted. And it would be on a possible size scale of what rowhammer affected. I'm sure you have had the thought of this 50 thousand times but maybe a "Steve Wozniak" approach could make some progress there is always a weakness in the armor somewhere. Ah that reminded me of the old days phreaking coke Machines for free sodas. Its suprising what can be found out when beta testing or screwing around with stuff. Back in 1999 me and my brother were screwing around with redhat 5.2 or 5.0 I think he accidently fried and set his crt monitor on fire from setting the refresh rates to high on install we sat and thought about it and came up with the conclusion that in theory you could set a whole computer lab on fire by doing a mass network install. Good thing redhat patched that glitch with redhat 6
[Blade General] rootquest:
Any Hope?

It seems as though there are quite a few people who want to see this happen, but few who have the resources are interested. A shame, as this phone has some decent specs for the price -- if it could be rooted, it would be ideal.

My 983 came with 7.1.1 on it and to my knowledge has received no system updates of any kind since new (except bloatware updates, of course). Could it possibly be so locked down that OTA system updates are not possible? That's the only explanation I can think of for leaving "Unlock Bootloader" and "Boot to Recovery" in place, yet useless -- kind of like being given the combination to an empty safe.

There is always the brute-force method: find the ROM on the mainboard and replace it with something flashable, although that would have to be pre-loaded with at least an unlocked bootloader, which kind of begs the question. Pin compatibility might be an issue; it is also quite likely that the chips are either house-marked or have had their marking covered or removed -- Cricket (and other carriers?) seem *very* invested in locking this thing down every way they can. Maybe they decided to make it a field tester for new security measures; they would need something with enough features to spark some interest while not having a lot of $$ tied up in it.
[Blade General] Dualthoughts:
that has been a thought that has been on my mind also.

That has been a thought that has been on my mind also and I dont even have a zte phone I have a yulong/coolpad revvl plus and I stumbled on this thread trying to find a root solution for my phone.

looking at the designs and specs of both these phones they look like a exact match on hardware specs it would be nice to get some pictures of both phones circuit boards and chipsets and layout to see what differences there are between the two phones. hopefully if a root solution is found for one it could be used for the other device somehow from doing a firmware flash. If it makes any difference I was messing around with my revvl plus in edl mode last week to see how restricted it was and command wise every command I used worked on my phone I only used 4 or 5 of them though stopped after the last one I typed my phone went blank and would not turn on for about 5 minutes startled me I thought I made a paperweight. The only reason I got brave enough to screw around in edl mode is its not my main phone I use anymore I ended up getting a lg v20 that was screen damaged for hardly nothing and I ended up repairing it. got dirty Santa with it so I was not really worried being stuck without a phone.
[Blade General] zMILWAUKEE:
I just happen to have a tore down Z983 and also a XMAX Pro torn down will take pics and submit them in a little bit
[Blade General] Ieudum11:
Maybe a interesting find

I'm not sure if this has been pointed out before or not but after my last cricket update for this phone I notice now in the dev options there's a OEM unlock to unlock the bootloader
[Blade General] e1software:
I could see it, as I also noticed that the phone is encrypted from factory. I already did a hard reset and it does not change that state. I've tried all the possible root tools, and nothing.

[IMG="OEM Unlocked"]https://imgur.com/a/szFeaPv[/IMG]

And "Encrypted" parameter in Security

[IMG="Encrypted"]https://imgur.com/a/v7ff1WI[/IMG]
[Blade General] Moonwalker89:
Did progress die for this phone? I have this phone and will gladly do whatever is needed to root this sucker finally
[Blade General] Moonwalker89:
I don't know for sure if this is exactly what we're lookin for but I worked my eyes and fingers to death reading my eyes out of pocket to figure out how to do this which is probably pitiful considerin I've been doin this for 4 years now lol. Im not sure where to go from here cuz don't wanna kill my phone and put us back further lol. I hope this can get us closer where we wanna be, crap load of great info in there for sure and I changed it to an img file so as to make it that much easier to manipulate for the next one of us. Hope to hear from you guys soon im still all ears and will give whatever a shot if need be! Sorry I'm tryin to upload the file but it's not doin it for some reason fellas. What can I do to get this to yall?
[Blade General] ahmedgamer:
halo
[Blade General] zMILWAUKEE:
how large is the file, xda has a cap on how large the file can be. try mediafire, its free to set and is what ive been using for the past 4 years or more. upload it there and post the download link here.
[Blade General] ThoDin0fth3OstrOlbPaiR:
I wasn't certain what it was about, but I just sim unlocked my z983 so as to use my "Obama phone " sim. The procedure required that this option in the debug menu be disabled.
[Blade General] assdsiwi:
game over my frind go here :p

https://xdaforums.com/zte-blade/general/guide-root-zte-mtk-android-t3890689
[Blade General] zMILWAUKEE:
That link is for a tool that's for the Mediatek chipsets, this thread is for the Z983 that runs a cheap Qualcomm chip, auto brick if someone follows that, and the software that was linked was pirated anyways. What has XDA become....
[Blade General] _-Guÿ:
I have a 7.1.1 blade x max that could be tested
[Blade General] javaboy1123:
Are you guys still looking for firmware for this device?
[Blade General] Msg808:
I have a Blade x max to use for any testing.

I have a zte blade x max that I can donate to the cause. Security patch level is Dec. 1, 2017 . Let me know if you need.
[Blade General] Abbygirl2020:
Can you help me?

Please help!! My sim card is fully active and been working in my phone perfectly until... someone snatched it from my hand & basically tried to break it by throwing it to the floor. Unfortunately for them they did not succeed completely...that's what I thought until I picked it up and I can't get any service. In settings under service status it's saying radio off. Despite that, believe it or not I had a glass screen protector so that was the ONLY cosmetic damage done to my phone.. thank goodness! so I took that off and my phone is looking like the day it came new out the box .. anyway, ive tried a couple tactics offline but still nothing is working. I'm really desperate!!! Please help, if you can. I have a Zte Blade Z max , originally with metro pcs but I unlocked it using the device unlock app a few months ago.
[Blade General] A6uh:
So i'm sure research around this device has died off a bit, but I've picked it back up out of spite for this model. For the longest time, I couldn't get a working firehose to actually get into this phone, so i've attached the one that I actually got working. If anyone is still interested in this device, let me know! (I had to zip it for xda)
[Xiaomi Redmi 3s Guides, News, & Discussion] abhayv21:
Rom review video with download links

just android

subscribe to my channel ! Like ! Share !

Its going to be lit :)