[General Questions and Answers] shodanx:
Hi,

I'm not sure, but as a regular linux user, I feel that a temporary root access to just run setprop once might do the trick

I've asked an AI for leads on exploits for Android 9, here is what I got out of it.

(See AI response below)

Candidate exploits that I found are

I found the following information about this phone from firmware.mobi

As for attacking the bootloader, I'm not well versed in the actual android bootloader jargon beyond the google tools. I will now do some research ...

About EDL HWID for Motorola Z3

Found this, but wrong phone

(Dev) Motorola unbrick tool

Hello guys presenting all New Motorola unbrick tool which can restore bootloader on any hard bricked Motorola Phone through EDL Mod.. How to use: Install qcom or mtk driver according your device run tool, select model, click unbrick button Now...

xdaforums.com

Found this about EDL testing

EDL test points and blank-flash boost mobile

Here are the edl (emergency download mode) test points for Motorola Moto G Stylus 5G XT2131.

xdaforums.com

Found blankflash for Moto Z3

blankflash for Moto Z4

These will be deleted soon

More about EDL booting

Jargon discovery

RSD Lite v6.2.4

QPST/QFIL

EDL mode

firehouse programmer

crappy, restricted Firehose loaders

The "Sahara" protocol

"protected by AVB and vbmeta"

TWRP (Team Win Recovery Project)

Magisk 2018-2021 looks still active ?

towelroot

ClockworkMod Recovery

Sunshine S-Off 2017 (Motorola Moto Z3 not supported)

Firewater 2017 (Motorola Moto Z3 not supported)

weaksauce exploit (Motorola Moto Z3 not supported)

Rumrunner S-Off 2014 (Motorola Moto Z3 not supported)

CF-Auto-Root 2010-2016 (Motorola Moto Z3 not supported)

Kingroot 2013-2018

framaroot 2013-2015 (Motorola Moto Z3 not supported)

Moonshine S-OFF 2013 (Motorola Moto Z3 not supported)

Tacoroot 2012 (Motorola Moto Z3 not supported)

GitHub - CunningLogic/TacoRoot: Universal HTC Root as of 1/1/2011

Universal HTC Root as of 1/1/2011. Contribute to CunningLogic/TacoRoot development by creating an account on GitHub.

github.com

Root and downgrade for Android 2.3.4 {Script included - ShiftySonofA script dl added)

Well, I'm writing this thread because I happily have a root method that doesn't require HTC unlock and you can downgrade to 2.2. Let's get into the information about it: Required: ADB PG06IMG.zip {Downgraded version} misc.img * {md5sum =...

xdaforums.com

BurritoRoot 1/2/3 2010-2012 (Motorola Moto Z3 not supported)

z4root

bunch more, probably all dead or obsolete

KingoRoot

iRoot APK

Baidu Root

rootmasterapk

vroot

CF-Root

AI generated response

To provide a more comprehensive evaluation of the additional CVEs you've listed, let's assess their potential applicability to your goal of enabling adb tcpip 5555 at reboot on an Android device, specifically focusing on local privilege escalation, remote code execution, and other relevant impacts. Below, I’ll expand the table to include a brief explanation of each CVE, focusing on how they might be leveraged for your purpose:

Local Privilege Escalation: CVEs such as CVE-2021-0434, CVE-2021-0308, CVE-2019-1996, and CVE-2021-0305 are strong candidates due to their direct relevance to gaining higher privileges locally.

Remote Code Execution: While less directly useful in a controlled environment without Internet, CVEs like CVE-2020-0256 and CVE-2021-0302 can be adapted for local use to achieve similar goals if the environment allows for their exploitation.

Specific Components: Pay attention to vulnerabilities that affect specific device components like NFC, USB, or WLAN (e.g., CVE-2019-2023, CVE-2019-2011). Their utility might depend on whether those components are active or relevant to your device setup.