ZTE Grand X 4 - Rooting Progress

This thread is made in an effort to root the ZTE Grand X 4 (Z957). At this point I've made some progress by using the Dirty Cow exploit to access a root shell via ADB, but have been unable to install su to the system partition.

Notes: stock rom, no custom recovery.

Exploit method:
Follow the instructions posted by Arinerron on GitHub regarding CVE-2016-5195 (under 10 posts, cannot share direct link)
When successful you will see "root@financier:/ #" as your shell prompt, however the session will hang after any command. That said, /system/run-as is still updated allowing you to do the following:

$ adb shell
shell@financier:/ $ run-as
uid run-as 2000
uid 0
0 u:r:runas:s0
context 0 u:r:shell:s0
shell@financier:/ # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),101 5(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),300 2(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0

you have access to the android system as root within this shell, but this is where I'm getting stuck. I'm not able to find a way to mount the system partition as read/write, and as such unable to install su. Also note that you will need to run the exploit again anytime you reboot the device. I have tried the following methods:

$ adb shell cp /sdcard/Download/su /system/bin/su
cp: /system/bin/su: Read-only file system

shell@financier:/ # mount -o rw,remount /system
mount: Permission denied

adb reboot disemmcwp
#still unable to remount the system partition

At this point I'll share what I've been able to do so far and see if anyone else has ideas for a next step.

Comments

Post a Comment

Popular posts from this blog

Vernee New model-Vernee Mars comes with Helio P20 and 6G RAM!

Image
Vernee Mars-New Model from Vernee powered by Helio P20 and sporting 6GB RAM coming in November told by the Officials After the good start that Vernee made with the Vernee Thor and Apollo Lite, the new manufacturer from China is planning on making another hit. New information has emerged that a brand new device is coming the following months that is going to join the small group of 6GB RAM devices. Its name is rumored to be Vernee Mars and it is coming in November. Currently, the only key details that we know about the smartphone is the fact that it’s going to be powered by a MT6757. The octa-core processor is going to be clocked slightly higher than the one running in Helio P10, although we don’t know the true extent of the first 4 Cortex-A53 cores. We reckon that they will be running at a higher clock frequency than the remaining 4 (running at a speed of 2.3GHz), More detailed information will be updated soon!
Keep reading

Chrome lost shine

Sadly, I've given up using Chrome on my Galaxy tab, which I use with bt mouse and keyboard. It's become a nightmare. First, the mouse clicks no longer works on most links. I can't do without that, especially as I use gmail in html mode (can't stand the app) where list of mails is small print. Second, accessing a map on a website makes me giddy. Moving it around now has to be done with two fingers, but pinching to zoom makes the map swirl around. I end up in another country where north is south, or someting like that. Thank goodness Google maps app doesn't do that. I've resorted to the built-in browser which still behaves normally. But that sadly doesn't sync with my Chrome on the PC. Wonder whether others have found these recent Chrome aberrations - and if so any cures? Tim
Keep reading

Google Phone App bug since update

I have a Google Pixel XL, and am currently running the Android Beta O version OPP2.170420.019. Since the recent update to the Phone app (version 10.1.161735957) approximately 2 weeks ago (7/17/17) any time I receive a phone call the call is not displayed on the screen, nor does the call wake my phone screen. The ringtone will play and/or phone will vibrate to indicate an incoming call. However to see the caller, and to answer the call I must unlock the phone (if it is currently locked), open the phone app, select the keypad as if I want to dial a number, then I will see the options that I normally would if I was already in a call. I then need to select "Return to Call in Progress" at which time the typical incoming call screen is displayed with caller picture and number and I can swipe to answer as I normally would. Also, a missed call does not appear in my notifications bar, but does show in my phone history if I manually check it. AND I am not receiving any voicemails. As ...
Keep reading