Database Info

****ROOT EVO After July 1 OTA Update

I tried every method, read every thread in every forum in an effort to root my EVO. Nothing worked. I was driving myself mad and spending tons of time. I Eventually I came across a post which directed me to XDA Developers Thread ---==={ROOT GUIDE}===--- | 1.47.651.1 ROOT, post 579 by SharkUW . I have used this on my own phone and I don't see a reason why it wouldn't work. I modified some of the instructions to make it clearer. The instructions may not be exact, and there is some seat-of-the-pants involved, but I got it to work. Use it at your own risk.
Prerequisites (follow in order)
Android-SDK developers program. I loaded it to C:
JAVA SE Development (use correct bit – 32 or 64). loaded in C:
Microsoft .NET Framework V 4.0
Reboot your phone and do a factory reset. Erase everything
Set phone to Charge Only and USB debugging
Open the stock browser and sign-in with your PCS phone number. Leave running.
Shutdown the phone, then restart
Make sure ADB is functional on your computer. You should be able to "adb shell" (confirming adb is working, exit shell if you're in it).
Extract the Do_root.zip (link below) and place all these files into the SAME folder as adb.exe. I have not included the appropriate PC36IMG.zip. Get it here. http://forum.xda-developers.com/showthread.php?t=701835 Leave the name as "eng-PC36IMG.zip". Place that in the SAME directory as well as the .zip.
Open a command prompt on your computer. point directory to Android-SDK directory\tools and a list will come up… click on "root.bat” and click RUN.
If it hangs for more than 30 seconds with the browser ****, CTRL+C, yes to kill the bat and just run it again.
Follow the directions. Your phone is going to reboot. It is then going to do a little **** and reboot into the boot loader. Keep track of the Command screen and wait because some steps take a while and there is no way of telling if it’s working. Nothing lasted more than 5 minutes. Eventually it will be in a "bootloader" and ask if you want to reboot. Say Yes with a Volume UP.
The .bat is now done. You have root. (not sure if next part is true) You now need a custom recovery to flash a proper ROM beyond the scope of this guide.
In original instructions but I’ve found the following Recovery step and code is not necessary: Now take the last step and flash the recovery.img that will already be on the root of your sdcard. To do this, after the PC36IMG flash:
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery.img
To check for root do ADB Shell and should get #.
If you're all advancedy you can put on a different recovery image.
IMPORTANT If you get a message here about "not writing bad block", flash it again until you get 0 errors. I don't know how common it is, but personally my recovery has issues with flashing. Do NOT let that be a bad flash.
Attached Files
do_root.zip (4.07 MB, 49 views)
________________________________________
Last edited by SharkUW; 7th July 2010 at 01:06 AM.

Going to try it tomorrow and hope it works. Thanks

Where are the attached files?

Can't find the do_root.zip file. Seems there is no attachment, please re-post. Thanks.

I tried to attach the do_root.zip file and a link to Toast 2 file. If that doesn't work, go to the referenced post #579 here: http://forum.xda-developers.com/showthread.php?t=718889&page=58.

Have you tried this SimpleRoot? I just did it, and it worked flawlessly.

Vivix729 said:
Have you tried this SimpleRoot? I just did it, and it worked flawlessly.
Click to expand...
Click to collapse
Simpleroot ftw.

mattrb said:
Simpleroot ftw.
Click to expand...
Click to collapse
QFT. I did simple root (I still setup adb and ensured it was working first) and then flashed the rooted Stock 1.47 ROM in about 40 min. I think most people that are running into issues with Simpleroot do not have adb setup properly or they did something inadvertently and need to clear out the files/cache and need to start over from scratch.

gmanvbva said:
QFT. I did simple root (I still setup adb and ensured it was working first) and then flashed the rooted Stock 1.47 ROM in about 40 min. I think most people that are running into issues with Simpleroot do not have adb setup properly or they did something inadvertently and need to clear out the files/cache and need to start over from scratch.
Click to expand...
Click to collapse
I did simple root and it worked fine too. I don't think the issue is adb being setup since he has an adb file in his download.

Update from a few days ago.
Just got a new SDHC card and simpleroot worked. The SDHC that came with my phone died. I placed a spare in there that was a 2gd regular micro and Hboot would not ready the IMG for nothing.
If simple root is not working then it's the Sh!tty card acting up.
Happy ending for me.

I just got my phone yesterday did the ota simpleroot and seems like it worked fine
but now i dont know what to do next
to get custom roms or froyo 2.2 or anything lol

Awesome post |OP|.
My desktop is Windows 7 x64 and doesn't play nicely with the standard tools.
I was forced to adapt your root.bat script to an OSX friendly BASH script.
The only requirement is that you download the android SDK from developer.android.com/sdk/index.html (apparently, I'm too new to post links).
The steps I took to get root:
Unzip the android SDK
follow |OP|'s instructions, unzipping the contens of do_root into [sdk-root]/tools/
unzip the attached bash script to the [sdk-root]/tools/
run my bash script from the [sdk-root] folder instead of root.bat - type "./root.sh" without the double-quotes
Grab a copy of Froyo while your phone is being rooted

[Guide] How to gain root on 2.2 for Mac

*******UPDATED 8/31/10 *******
This rooting method was adapted from regaw_leinad's method and toastcfh's method. By following these steps you will successfully downgrade your phone back to android 2.1 in order to gain root.
I don't trust unrevoked as I have had problems with it in the past.

I am not responsible for any damages to your phone.
special thanks to:
regaw_leinad
Sebastian Krahmer
Toastcfh
amon_ra
FILES YOU WILL NEED:
copy and paste into browser
Code:
sdx-downloads.com/sdx/evo/troot/eng-PC36IMG.zip
evo4g.me/downloads//count.php?target=evo-root.zip
files.androidspin.com/downloads.php?dir=amon_ra/RECOVERY/&file=recovery-RA-evo-v1.8.0.img
developer.android.com/sdk/index.html
You will need the Android SDK in order to communicate between your computer and your phone. Download it (last link above) and follow the setup instructions that it comes with.
Unzip the contents of the evo-root.zip and put all the files from it into the tools folder located in the android sdk folder.
Rename the eng-PC36IMG.zip to PC36IMG.zip and then put it the tools folder located in the android sdk folder. DO NOT UNZIP IT!

******* PC36IMG.zip md5sum~ fe8aba99893c766b8c4fd0a2734e4738 *******
Move the recovery-RA-evo-v1.8.0.img into the android sdk folder as well.
Make sure usb debugging is enabled on your device. To do so go to Settings > Applications > Development > and make sure the check box is checked.
Plug your phone into the computer. Select "Charge Only" from the notifications bar.
Open up terminal and navigate your way into the android sdk folder.
Code:
cd /
cd asdk
Push all the files onto your phone.
Code:
tools/adb push /asdk/tools/flash_image /sdcard/
tools/adb push /asdk/tools/rageagainstthecage-arm5.bin /data/local/tmp/
tools/adb push /asdk/tools/mtd-eng.img /sdcard/
tools/adb push /asdk/tools/PC36IMG.zip /sdcard/
tools/adb push /asdk/tools/recovery-RA-evo-v1.8.0.img /sdcard/
Note that the PC36IMG.zip will take longer than the other files to transfer to the sdcard because it is a large file.

Now we will make rageagainstthecage.bin executable.
Code:
tools/adb shell
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
You should see this (below) after it has made the change.
Code:
$
Now to use the rooted shell.
Code:
cd /data/local/tmp
./rageagainstthecage-arm5.bin
You will now see some text on your terminal screen describing the exploit. 

Wait for the adb shell to finish the process. At this point it may or may not terminate the current shell session in terminal. If it does then it should look like this:
Code:
users-iMac:asdk user$
If it doesn't it will return to
Code:
$
in that case you need to exit the current session. To do so type
Code:
exit

Now we need initiate a new shell which should now have root permissions.
Enter the following:
Code:
tools/adb shell
and you will see you now have a
Code:
#
instead of
Code:
$
Now we need to flash the mdt-eng.img in order for it to let us install a custom recovery
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img
That will flash your misc partition with Toast's mtd-eng.img


This should return you to
Code:
#
Now boot into hBoot
Code:
reboot bootloader
This will reboot your phone into hBoot. It will scan for the PC36IMG.img. When it asks yes or no, select yes.
It should then reflash your phone into the engineering build.
When it asks to reboot select yes.
You will need to flash custom recovery in order to be able to flash other custom roms or modifications. I use Amon_RA's recovery because it works great and has NEVER caused me any problems.
Now, open up terminal and get back into the android sdk folder
Code:
cd /
cd asdk
Since we have already pushed the recovery onto the sdcard we only need to flash the recovery onto the phone so that we can use it
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery-RA-evo-v1.8.0.img
Now lets rename that PC36IMG.zip file again
Code:
mv /sdcard/PC36IMG.zip /sdcard/eng-PC36IMG.zip
that way your phone doesn't try to flash it when you go into recovery each time
And last but not least we need to boot into it to flash a custom rom
Code:
reboot recovery
Your phone should then reboot into Amon_RA's recovery and you may now head over to the dev forum to find your new favorite custom rom.

very nice! can anyone confirm this? my buddy wants me to root his 2.2 and i would like to try this.

To make life easier for some people add this to your post mate, and apply it yourself if you would like.
Here is how to add your sdk/tools directory to your .bash_profile file so you won't have to navigate to the folder each time.
Download this so you'll be able to see your hidden files http://www.mediafire.com/?diimft1ninn Run it, check "Show Hidden Files" then click Restart finder. Now, navigate to your home folder (/Users/UserName/) and see if there's a .bash_profile already there. If not, create with textedit.
Now add this to the file: export PATH=${PATH}:/Path/Of/Your/Sdk/Tools/Folder
Mine is /Users/bmxrider4444/Documents/Android/SDK/tools
Now do not save it as rich text. If yours is in rich text, click on "Format" in the menu bar, and click "make plain text". Now save it as .bash_profile and uncheck "if no extension is provided, use .txt".
Now you can go back to Ghost and uncheck "Show all hidden files" and restart finder again (special thanks to ajones7279 for these steps)
Enjoy!
Just as clarification as to what this does, it enables you to run adb commands and other commands without having to navigate to the /android/tools/ folder every time you want to run adb or whatever.

does this work?

seekis said:
At this point we need to push the recovery onto the sdcard
Code:
tools/adb push "location of recovery-RA-evo-v1.8.0.img" /sdcard/
Click to expand...
Click to collapse
This is great! Thanks for the guide - I am planning on rooting my Wife's EVO but have been waiting for an easier method than the other one posted. Question on the above where we write "location of recovery-ra-evo-v1.8.0.img". Is that the exact code, or should we be adding a directory or folder location into this line? I rooted my 2.1 EVO on my Mac a couple months ago and don't remember this step. Once again - very much appreciate the help.
One last question - would it make more sense to have a custom ROM already on your SD Card prior to rooting, so that you can flash it right after you flash AMON-RA for the first time? Probably doesn't matter but thought i'd ask.

^^ same question as above, plus one other n00b question - does this method unlock NAND?
[edit] I was not insinuating that randymac88 is a n00b; I, however, am

seekis said:
I don't trust unrevoked as I have had problems with it in the past.

I am not responsible for any damages to your phone.
Click to expand...
Click to collapse
Don't trust us with the unrevoked 3.x/unrevoked forever application combo that's worked for thousands of users without sideeffects on regaw's post?
You should note to everyone that your method will screw up their PRI, reverting it back to 1.34. By using unrevoked and unrevoked forever, you can keep 1.40.

randymac88 said:
This is great! Thanks for the guide - I am planning on rooting my Wife's EVO but have been waiting for an easier method than the other one posted. Question on the above where we write "location of recovery-ra-evo-v1.8.0.img". Is that the exact code, or should we be adding a directory or folder location into this line? I rooted my 2.1 EVO on my Mac a couple months ago and don't remember this step. Once again - very much appreciate the help.
One last question - would it make more sense to have a custom ROM already on your SD Card prior to rooting, so that you can flash it right after you flash AMON-RA for the first time? Probably doesn't matter but thought i'd ask.
Click to expand...
Click to collapse
Thats not the exact code no. I just put that as a place holder you are suppose to put in the location of where you have the recovery.img. For example, the exact command for me would be:
Code:
/Users/seekis/Downloads/recovery-ra-evo-v1.8.0.img
Don't trust us with the unrevoked 3.x/unrevoked forever application combo that's worked for thousands of users without sideeffects on regaw's post?
You should note to everyone that your method will screw up their PRI, reverting it back to 1.34. By using unrevoked and unrevoked forever, you can keep 1.40.
Click to expand...
Click to collapse
As far as using unrevoked, I stated that I, ME, MYSELF, has had issues with it. not that anybody else has. By all means go and use it if you would like. I will not. It is true that you will loose PRI 1.40, but seeing as how even after installing the OTA from HTC my phone still didn't update it to 1.40, I don't see the issue.

rsage said:
^^ same question as above, plus one other n00b question - does this method unlock NAND?
[edit] I was not insinuating that randymac88 is a n00b; I, however, am
Click to expand...
Click to collapse
i believe it does unlock nand seeing as how i adapted it from toasts method

Hey Seekis - question, I'm stuck here. I keep getting "permission denied", or "operation not permitted" when trying to make the exploit executable at this step:
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
Am I missing something? I've tried a million times and can't seem to get past this. I've successfully pushed all the files onto the sdcard.
I've also have had some trouble finding the exact root path to these files. I've been able to navigate, but I would think a lot of users would have some trouble.
Regardless, many thanks for getting this posted...
EDIT: I pushed the rageagainstthecage file to the sdcard by mistake. Will try again tomorrow.

ok i got rid of that step by moving the file into the android sdk and pushing it with all the other files

Okay now I appear to be in big trouble as I've just messed up my wife's phone, and its probably going to be unusable for a while until I get this figured out (assuming I do!).
I got through most of the process. I flashed the PC36IMG.zip file; however when it asked to reboot, it just dumped me back into the bootloader. Whenever I say reboot, it just takes me back to the bootloader. Pull the battery, same thing - bootloader. Yikes.
I don't know how to get to the next step because I can't get into a booted rom in order to flash the amon-ra recovery. Am I totally effed? Can anyone help me here?
EDIT: Okay reflashed the PC36IMG.zip file, and it rebooted into the stock ROM. Onward! Phew!!

The wife's EVO is now fully rooted running Baked Snack 1.5 w/Netarchy's kernel. Touch and go there for a minute, but it all worked out. No 1.40 PRI, but I don't really care about that right now.
Woot! Thanks Seekis!!

do u have to push the pc36img with adb every time or will drag and drop work or copy and paste work?

FoxHound630 said:
do u have to push the pc36img with adb every time or will drag and drop work or copy and paste work?
Click to expand...
Click to collapse
You can mount the card on your system and copy paste it over as well, yes.

randymac88 said:
Okay now I appear to be in big trouble as I've just messed up my wife's phone, and its probably going to be unusable for a while until I get this figured out (assuming I do!).
I got through most of the process. I flashed the PC36IMG.zip file; however when it asked to reboot, it just dumped me back into the bootloader. Whenever I say reboot, it just takes me back to the bootloader. Pull the battery, same thing - bootloader. Yikes.
I don't know how to get to the next step because I can't get into a booted rom in order to flash the amon-ra recovery. Am I totally effed? Can anyone help me here?
EDIT: Okay reflashed the PC36IMG.zip file, and it rebooted into the stock ROM. Onward! Phew!!
Click to expand...
Click to collapse
Had the same issue. When i first booked into the bootloader i had to select recovery then flash PC36IMG.zip. Then boot loop. Then i went back into the bootloader and it automagically read in the PC36IMG.zip and flashed it, then i got stock 2.1 root. Just a few minutes of "oh crap"

I'm stuck. I got as far as flashing PC36IMG.zip, which was successful, as my phone now runs 2.1, but it doesn't appear I'm rooted. When I go back into the adb shell, I'm getting the $ prompt, and running
Code:
cat /sdcard/flash_image > /data/flash_image
gives me a permission denied error. Help!

atom_jack said:
I'm stuck. I got as far as flashing PC36IMG.zip, which was successful, as my phone now runs 2.1, but it doesn't appear I'm rooted. When I go back into the adb shell, I'm getting the $ prompt, and running
Code:
cat /sdcard/flash_image > /data/flash_image
gives me a permission denied error. Help!
Click to expand...
Click to collapse
i dont know what to tell you other than try again. this happened to me the first time through as well. i dont know why. i just started from the top and it worked the second time through.

seekis said:
i dont know what to tell you other than try again.
Click to expand...
Click to collapse
So after you flash PC36IMG.zip you should automatically get a root (#) prompt when going into the shell? ie, I'll have rooted 2.1 yes?
seekis said:
this happened to me the first time through as well. i dont know why. i just started from the top and it worked the second time through.
Click to expand...
Click to collapse
Aha. Ok, I will keep trying til it gives me a root shell, I guess. I also tried unrevoked3 but that didn't seem to work.

Success!! So, I stupidly assumed that all PC36IMG.zip's were the same, and was using the one from the original 2.2 PC thread. Once I got the correct one, voila!
You might want to post the md5 of the one you are using, so there's no confusion for others. Also, you missed a tiny step when you first start up hboot - you have to select fastboot for it to start scanning for PC36IMG.zip.
Thanks!

[ROOT] ZTE z990g Merit (An avail variant?)

Root for ZTE z990g aka ZTE Merit
by jcase - [email protected] - http://twitter.com/TeamAndIRC
June 16 2012 - Copyright 2012 CunningLogic
Do Not Distribute or republish without permission. (Sad that this is needed, but people/blogs like to profit off the work of others without credit)
Want to support my work? Donations are always appreciated, but never required:
Paypal: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=LZ62YFU3XCEK8
Amazon Giftcards: [email protected]
Required files:
http://dl.dropbox.com/u/8699733/chainsdd-su.zip
Unzip chaindsdd-su.zip and then get a shell with adb
Code:
adb shell
Set up the dirs, so shell owns them prior to logging. If shell does not own them then we can not control them. If the logs dir already exists, you may have to do a factory reset to remove them. They should not exist unless someone attempted this previously.
Code:
mkdir /data/local/logs
mkdir /data/local/logs/kernel
Open emode's logset activity. First button should be for enabling log set, enable it. Do not exit the activity, but if you do just repeat the below command.
Code:
am start -a android.intent.action.MAIN -n com.zte.emode/.logset
Confirm the log_kernel.txt file exists, if it does not wait a minute and check again.
Code:
ls -l /data/local/logs/kernel/log_kernel.txt
If it exists, delete it and immediately symlink it to /data/local.prop, logset may recreate it, if it does delete and try symlinking again.
Code:
rm /data/local/logs/kernel/log_kernel.txt
ln -s /data/local.prop /data/local/logs/kernel/log_kernel.txt
Now we want to wait for /data/local.prop to be created, it may take a minute or two. Keep checking until it exists.
Code:
ls -l /data/local.prop
Now once /data/local.prop exists, go back to the logset activity and disable logset. If you don't disable it, it will slowly eat away at all the disk space, and possibly overwrite the local.prop before you get root. Now lets set qemu=1 then reboot.
Code:
echo 'ro.kernel.qemu=1' > /data/local.prop
exit
adb reboot
Once you have rebooted, remount, install su.
Code:
adb remount
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbin/su
Clean up your mess!
Code:
adb shell rm /data/local.prop
adb shell rm -r /data/local/logs
Reboot, install the Superuser app from the market and enjoy
Code:
adb reboot

Might Not Work As Expected
I just tried this procedure from JCase at the RootzWiki dot com site with mixed results. The phone is a ZTE Merit Z990G from Straight Talk.
I went through all the steps and everything performed as expected. When I start start an app that requires superuser permissions, the app reports that the device has not been properly rooted. I have repeated the process as outlined four times, including downloading the SU file, and have the same results. Titanium Plus, Busy Box Pro and Root Check Basic report that the device is not rooted.
However, a couple of the Google apps - music, movies and reader seem to think the phone is rooted. Any ideas or suggestions will be very appreciated.

bitshifter52 said:
I just tried this procedure from JCase at the RootzWiki dot com site with mixed results. The phone is a ZTE Merit Z990G from Straight Talk.
I went through all the steps and everything performed as expected. When I start start an app that requires superuser permissions, the app reports that the device has not been properly rooted. I have repeated the process as outlined four times, including downloading the SU file, and have the same results. Titanium Plus, Busy Box Pro and Root Check Basic report that the device is not rooted.
However, a couple of the Google apps - music, movies and reader seem to think the phone is rooted. Any ideas or suggestions will be very appreciated.
Click to expand...
Click to collapse
Sounds like band permissions on su, try
adb shell ls -l /system/xbin/su
if the permissions come out as "-rwsr-sr-x" then you are rooted, try updating su with the suepruser app, or finding a different copy of su.
If the permissions are different or it says it doesnt exist, then you need to repeat the instructions as you missed one or two

jcase said:
Sounds like band permissions on su, try
adb shell ls -l /system/xbin/su
if the permissions come out as "-rwsr-sr-x" then you are rooted, try updating su with the suepruser app, or finding a different copy of su.
If the permissions are different or it says it doesnt exist, then you need to repeat the instructions as you missed one or two
Click to expand...
Click to collapse
Thank you for the fast response. Here are the permissions for the SU file and based on what you are saying they look good:
C:\SDK>adb shell ls -l /system/xbin/su
-rwsr-sr-x root root 22364 2012-06-17 12:47 su
I have located and downloaded a couple of "su" files from XDA and similar sites and the files are identical. I will continue searching for a different "su" file and see if that makes a difference.
---------- Post added at 06:15 PM ---------- Previous post was at 05:43 PM ----------
bitshifter52 said:
Thank you for the fast response. Here are the permissions for the SU file and based on what you are saying they look good:
C:\SDK>adb shell ls -l /system/xbin/su
-rwsr-sr-x root root 22364 2012-06-17 12:47 su
I have located and downloaded a couple of "su" files from XDA and similar sites and the files are identical. I will continue searching for a different "su" file and see if that makes a difference.
Click to expand...
Click to collapse
I looked around and did not find any "su" files that were different than what I downloaded according to the root process. Just for grins I copied the "su" file from my Noot Tablet which is rooted and tried that file. Sadly, it did not make a difference.
Please let me know if there is any other information I can provide or if you would like me to try something else.

What happens when you open the Superuser app (note this is not supersu) and go to settings/options and attempt to update su?
bitshifter52 said:
Thank you for the fast response. Here are the permissions for the SU file and based on what you are saying they look good:
C:\SDK>adb shell ls -l /system/xbin/su
-rwsr-sr-x root root 22364 2012-06-17 12:47 su
I have located and downloaded a couple of "su" files from XDA and similar sites and the files are identical. I will continue searching for a different "su" file and see if that makes a difference.
---------- Post added at 06:15 PM ---------- Previous post was at 05:43 PM ----------
I looked around and did not find any "su" files that were different than what I downloaded according to the root process. Just for grins I copied the "su" file from my Noot Tablet which is rooted and tried that file. Sadly, it did not make a difference.
Please let me know if there is any other information I can provide or if you would like me to try something else.
Click to expand...
Click to collapse

It Worked - But Don't Know Why...
jcase said:
What happens when you open the Superuser app (note this is not supersu) and go to settings/options and attempt to update su?
Click to expand...
Click to collapse
I re-installed Superuser and Superuser Elite and now the phone says it's rooted. I've been in IT for over 35 years and it makes me nervous when software "magically" fixes itself. But now that it's working I won't question it and proceed from here. I appreciate your help and your effort.
Cheers

bitshifter52 said:
I re-installed Superuser and Superuser Elite and now the phone says it's rooted. I've been in IT for over 35 years and it makes me nervous when software "magically" fixes itself. But now that it's working I won't question it and proceed from here. I appreciate your help and your effort.
Cheers
Click to expand...
Click to collapse
Generally you have to run superuser once to get it to work I've found, at least recent builds (or maybe its recent android builds)

Problem.
Hello, i have followed this entirely but at parts it says "Access denied" when im on certain parts when i tryed to check if the Kernel log was there it said "access denied" same with some folders.

root or no root
followed steps, ended up with this...
$ ls -l /system/xbin/su
ls -l /system/xbin/su
-rw-rw-rw- root root 22364 2012-07-15 09:25 su
the superuser app shows all blank under apps and logs, when i try to update it, it says "checking" for a few secs and then nothing... also wondering how to do a factory reset cuz if i didn't screw the phone up yet, i will thx in advance

Has you can see I'm new here. I'm old and retired I would love to root my ZTE Merit 2.3.5 but this is over my head.
I was wondering if there's any accomplished phone rooters in the NC area that would be willing to walk me through this or do this for me
I'd be more than willing to make a donation to make this happen,

custom recovery
I was wondering if someone would make q custom recovery for this phone because the stock recovery is really bad

Not working
I can't even get past step 2, I have the file installed and unzipped on both my computer and my smart phone. The only thing I can find to put in the codes is command prompt which says "error: device not found" when I type in adb shell. My ZTE Merit phone has very low internal memory due to all the retarded system apps that came on the phone, I would very much like some assistance removing them from my phone. I also downloaded superuser elite onto my phone and it doesn't show up with ANYTHING. The first page says
superuse v3.1.3(46)
tap to display changelog
elite installed
su binary not found
a check in the box "outdated binary notification
unchecked box, temp unroot (When tapped it does nothing)
unchecked box ota survival (Again when tapped it does nothing)
I scroll over to the apps section of the program and it says "No apps in list"
What am I doing wrong? This lack of space is quite irritating

Worked!
omg I've wanted to root my phone. Thank you thank you! I thought I would brick my phone at first.

SIM Carrier unlock a ZTE Merit Z990G Straight Talk
I'm currently a T mobile prepaid customer and received the Merit from a friend of mine for doing some painting. I have looked for a month now and had a few unlock websites fail at attempting to unlock the phone via the IMEI (which the phone does have ). I have attempted to put my tmobile sim in the Merit but there is NO place to enter an unlock code. I really DONT wanna change my service to straight talk and would be willing to pay a decent amount to anyone that is capable of unlocking this phone for use with tmobile. If you think you have what it takes PM me and i will give you the IMEI and we can work out a deal. I challenge ANYONE achieve the impossible and get me the unlock code and a way to input it into the phone.

Cannot get local.prop
I have waited 20 minutes after trying to create the local.prop file and it simply won't create it. Any suggestions?

Can't get SU to upload
Hey I'm new to rooting android. I get to the point of installing SU but windows keeps telling me file not found. Would really like some help in fixing this issue. I have installed SU file to C:\Android\android-sdk\SU. Up to this point everything works fine.
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbin/su
Any help would be really appreciated.
Thnks

Help getting Started
Hey Anyone and everyone that may be online, I have a real quick and probably REALLY EASY question for ya... I'm trying to get started Rooting my ZTE Merit and I need to find out how to get to or where to find the screen where I type in the commands. I already downloaded the chainsdd zip file. So now I'm supposed to get shell with adb. If someone would be so kind and put me in the right general direction, I sure would
be grateful.
Thanks in advance,
Jason

Not a Damn thing...
Rather sad....I have everything going as it should....all input correct...still no root after final reboot...I followed every step to a T several times -rw-rw-rw- grrr...ive rooted many devices none this big of a pain in tha butt!
Used updated su binary on root just for fun...same result

Help plz!
im a noob to this but have been messing around with ubuntu for some time now can someone show me step by step on how to root my zte merit plz? is there a video tut on how? i tried all the quick methods but they don't work, this one obviously does on this page, can someone help start me out plz, im learning still and love to learn more!
---------- Post added at 08:59 AM ---------- Previous post was at 08:45 AM ----------
Univarseman said:
I can't even get past step 2, I have the file installed and unzipped on both my computer and my smart phone. The only thing I can find to put in the codes is command prompt which says "error: device not found" when I type in adb shell. My ZTE Merit phone has very low internal memory due to all the retarded system apps that came on the phone, I would very much like some assistance removing them from my phone. I also downloaded superuser elite onto my phone and it doesn't show up with ANYTHING. The first page says
superuse v3.1.3(46)
tap to display changelog
elite installed
su binary not found
a check in the box "outdated binary notification
unchecked box, temp unroot (When tapped it does nothing)
unchecked box ota survival (Again when tapped it does nothing)
I scroll over to the apps section of the program and it says "No apps in list"
What am I doing wrong? This lack of space is quite irritating
Click to expand...
Click to collapse
help me, whats the first step then i can get the gearz in motion, i have not a clue on how to start this but if i do i can usually figure it out from them sometimes

Start menu
jjflappy said:
Hey Anyone and everyone that may be online, I have a real quick and probably REALLY EASY question for ya... I'm trying to get started Rooting my ZTE Merit and I need to find out how to get to or where to find the screen where I type in the commands. I already downloaded the chainsdd zip file. So now I'm supposed to get shell with adb. If someone would be so kind and put me in the right general direction, I sure would
be grateful.
Thanks in advance,
Jason
Click to expand...
Click to collapse
Start menu then type CMD hit enter

[Q] Im missing a crucial step in PIE Help

So I have setup adb by following a video another user posted to an earlier question of mine that being said adb is setup correctly my phone is recognized it is online I can reboot the phone along with other adb actions. the problem Im having is where do i put the pie.jar and root.sh files i have put them in platform tools and it says cannot stat no such file or directory i moved them to sdk folder and still getting the same message please help i have been trying to root for over a week now im not stupid im just doing something wrong im close to just giving up any feedback is greatly appreciated

I posted a vid in other thread that may help not sure exacly what you are doing.

mrwinkle said:
I posted a vid in other thread that may help not sure exactly what you are doing.
Click to expand...
Click to collapse
Yeah I followed that video got adb setup got all the expected output except for the last two I get
C:\Android-SDK\sdk>adb shell /data/local/atvc/root.sh
rm failed for /data/local/atvc/blop.asec, No such file or directory
rm failed for /data/local/atvc/blop, No such file or directory
pie by jcase
want to buy me pie? paypal-> [email protected]
And my device does not reboot but it acts like it reboots on my pc it discovers it again like I unplugged it then plugged it back in and when I install super su it says no binaries are installed what should I do This process is the bane of my exscitence but I will get it

ojodetigre said:
Yeah I followed that video got adb setup got all the expected output except for the last two I get
C:\Android-SDK\sdk>adb shell /data/local/atvc/root.sh
rm failed for /data/local/atvc/blop.asec, No such file or directory
rm failed for /data/local/atvc/blop, No such file or directory
pie by jcase
want to buy me pie? paypal-> [email protected]
And my device does not reboot but it acts like it reboots on my pc it discovers it again like I unplugged it then plugged it back in and when I install super su it says no binaries are installed what should I do This process is the bane of my exscitence but I will get it
Click to expand...
Click to collapse
those are okay just ignore your phone should be rooted now but will unroot if you reboot b/c write protection is still on. to be completely rooted (non-tethered) follow steps HERE.

mrwinkle said:
those are okay just ignore your phone should be rooted now but will unroot if you reboot b/c write protection is still on. to be completely rooted (non-tethered) follow steps HERE.
Click to expand...
Click to collapse
but its not as soon as that happens i try to install super su and it says no binaries are installed i installed root checker and it says my device is not rooted i read whhere it says to ignore those messages i guess i should just keep trying until i get root but do i have to start back with the push commands or just the shell commands and i have evrything else ready for perma root just need to get root first

ZTE Maven root (Z831)

Here's how I got my zte maven 2 (ATT) rooted.
Disclaimer: This method worked for me but may not work for others, I am not responsible if your device is bricked as a result of this. Also, this method does seem to be a bit finicky and inconsistent.
I rooted this phone twice, and it took about 15-20 tries each time for it to finally work. This is not a root you can do in 5 minutes (unless you are extremely lucky) Plan to set aside an hour or two, and a lot of patience, if you want this to work.
Credit to @madvane20 his post here helped me get root for this phone. He also got his phone rooted before I did, be sure to give him thanks.
Credit to @ZTE Girl for finding a way to remove ads from King root and keeping perm root.
With KingRoot you can get perm root, but personally I hate KingRoot, so at the end there is a method to replace KingRoot with SuperSu. Unfortunately SuperSu root resets on reboot, but a quick, 10 second adb command will reroot your phone with SuperSu
Edit: @ZTE Girl found that using lucky patcher to remove ads from King root worked for her and kept permroot.
Step 1: Enable USB debugging on your phone, and download adb and ZTE drivers to your PC.
2: Download KingRoot from KingRoot.net (download the apk for android)
3: Connect your phone to ADB, and run this command in terminal adb shell make sure you get no errors and accept any USB debugging requests.
4: Now type reboot disemmcwp This will reboot your phone without write protection.
5: When your phone reboots, run adb shell again, and install the kingroot APK. Google will give you a warning about this app being unsafe, install it anyways.
6: Now, here's the finicky part, sometimes KingRoot works, sometimes it doesn't, you just have to keep trying. Make sure your phone is still connected to the computer through adb shell, and then click try root in KingRoot. While KingRoot is attempting to get root: in adb shell keep typing su and pressing enter. Just spam this, It will keep giving errors, but eventually it (should) work. Make sure to accept any prompts on your device while you do this.
7: When you are able to successfully get into su, wait a bit, just to make sure your device doesn't restart
8: Now type getprop ro.product.name, the response should be Z831
9: Now type setprop persist.sys.k Z831, then type getprop persist.sys.k It should say Z831
10: Now type cd /dev/block/platform/soc.0/7824900.sdhci/by-name/
11: Then type dd if=recovery of=/sdcard/recovery.img This will backup your recovery, I highly recommend that you copy the backup to your computer in case something goes wrong.
12: Now type dd if=boot of=recovery, this will write boot to recovery. This part can be risky, it worked for me, but if it bricks your device, you can't say I didn't warn you with that said, don't let that scare you away from finally rooting this device and getting all the advantages that come with it
13: Now type this reboot recovery Your device my blackscreen and not boot after this, personally mine did, and I fixed it by removing the battery, and after puttting it back in, it booted normally.
14: When your phone boots up, type adb shell again, and then type su
15: Type id response should be "uid=0(root) gid=0(root) context=u:r:shell:s0" Note: I don't think my uid showed when I did this, if yours doesn't show, don't worry, it should work fine.
16: Now type setenforce 0
17: After that, type getenforce, it should respond back with "permissive"
18: To test if system is writable, type mount -o remount,rw /system, if you get no errors, everything is working , if you get an error, type reboot disemmcwp, and then try to mount system RW again.
19: I would recommend removing the update service now, so an update doesn't come and screw up your root.
20: Read this: Now you should have permroot with kingroot, however, as you will soon find, kingroot has a ton of ads, and can get very annoying. So, if you want SuperSu and no kingroot, keep reading. If you want to keep KingRoot, then you are done, have fun with your rooted Maven 2
Edit: @ZTE Girl found that you can use lucky patcher to remove ads from Kingroot while still keeping permroot.
21: Download the KingToSuperSu zip in attachments, I have modified it slightly from the original zip so it works better. You will see a folder inside the zip named "mrw" copy this folder to the root of your /sdcard (must be copied to the root of /sdcard)
22: Now go into adb shell again, and then type su
23: Type mount -o remount,rw /system
24: If you get no errors, simply type sh /sdcard/mrw/root.sh, you will see a lot of errors in the script, no need to worry, now you should have SuperSu. Note: sometimes you get a notification saying "com.eu.chainfireSuperSu has stopped" or something like that, run the command again, and it should work.
25: SuperSu will say binary needs to be updated, but the update always fails, however you can click no thanks, and it will work fine.
26: SuperSu root will go away after you reboot, however, to get root back, simply type adb shell (while connected to your computer of course) then su and then sh /sdcard/mrw/root.sh and just like that, you're rooted again. Note: I couldn't get this to work in a terminal emulator, and it would only work in adb shell for me.
Edit: If you want stock recovery back, run this command in adb shell with su dd of=recovery if=/sdcard/recovery.img. I haven't tested this, and it might unroot/brick your device. This is at your own risk.
This guide was long and complicated, sorry for that, if you need any help, just ask me and I will try to help the best I can.
If this guide helped, please clicks thanks, it means a lot to me
Proof: http://imgur.com/a/zecyU

btw easy way to get rid of ads diasbale the charging thing in king settings and adaway its what i did on the warp 7

carrier iq
this phone has carrier iq, i was able to get temp root without write using kingroot, so i was able to delete, disable apps, and also, remove carrier iq with the quide you can find on the: androidexplained website. i could not actually delete the files in the last two steps but it seemed to work anyway. this is my first post so i can't put links.
Question1: i don't like typing cause i make stupid mistakes, but im assuming i could put all your command in individual batch files ending with a pause on each, and prefixing all you commands with "adb.exe shell su". that way i could stop and see what happened and then continue.
Question2:
dd if=recovery of=/sdcard/recovery.img
seems to mean copy the boot partion to an image file on the internal sd card. am i correct?
and
dd if=boot of=recovery
seems to mean overwrite the boot partition with an image- (file)?
if so what image file?
sorry, im new to all this, i guess i probably don't have enough confidence to do this, my z831 works very well without all the bloat anyway. and yes i understand the risks if i do decide to proceed, anyway. i have 3 $10 and $20 phones that are not bricked but i forgot to reenable the system apps before i removed root and reset, so they might as well be bricked cause they cant do anything after they boot.
btw, you mentioned in one step to wait, to see if it reboots, to see if it is stable before continuing:
for me i remember that either having too many apps running or stopping too many system apps, seemed to make this z831 unstable and reboot, while it had temp root.
Question last: do i need to start the process as you said while kingroot is in the process of rooting, or can i wait till it is finished getting it's root?

duane2064 said:
this phone has carrier iq, i was able to get temp root without write using kingroot, so i was able to delete, disable apps, and also, remove carrier iq with the quide you can find on the: androidexplained website. i could not actually delete the files in the last two steps but it seemed to work anyway. this is my first post so i can't put links.
Question1: i don't like typing cause i make stupid mistakes, but im assuming i could put all your command in individual batch files ending with a pause on each, and prefixing all you commands with "adb.exe shell su". that way i could stop and see what happened and then continue.
Question2:
dd if=recovery of=/sdcard/recovery.img
seems to mean copy the boot partion to an image file on the internal sd card. am i correct?
and
dd if=boot of=recovery
seems to mean overwrite the boot partition with an image- (file)?
if so what image file?
sorry, im new to all this, i guess i probably don't have enough confidence to do this, my z831 works very well without all the bloat anyway. and yes i understand the risks if i do decide to proceed, anyway. i have 3 $10 and $20 phones that are not bricked but i forgot to reenable the system apps before i removed root and reset, so they might as well be bricked cause they cant do anything after they boot.
btw, you mentioned in one step to wait, to see if it reboots, to see if it is stable before continuing:
for me i remember that either having too many apps running or stopping too many system apps, seemed to make this z831 unstable and reboot, while it had temp root.
Question last: do i need to start the process as you said while kingroot is in the process of rooting, or can i wait till it is finished getting it's root?
Click to expand...
Click to collapse
i have a batch script i made for the warp 7 that i think will work for this phone but i never posted any of it cause he released the guide first so i told him to keep it and no the boot to recovery overwrites recovery with boot image from boot then after everything has perm root u can flash the recovery back to recovery. do we need a batch script no do we need to mess with other files risking a brick no kingroot is fine til we can find a way to get access to bootloader for fastboot as well as get a twrp built for the phone. theres ways to make kingroot not as annoying ad blocker disable notifications from kingroot and disable fastcharging lock screen. but u more than welcome to tamper just be aware u brick ur phone in the process theres no fix. as well if it makes it easier for people i will write a batch script that walks them through the process with the pauses shows them what it does so they can learn for future purpose but i m0ean the guides pretty simple
---------- Post added at 01:55 PM ---------- Previous post was at 01:51 PM ----------
wait is this thread maven or maven 2?

step 9 is different than yours, why?
Question for madvane20
XCnathan32's step 9: "Now type
setprop persist.sys.k Z831
BUT in your bat file:
adb.exe shell su
setprop ro.product.name Z831
of course swaping out ZTE_BEAM for Z831
is one better than the other or should they both be done?

yea i think i need to maybe fix the bat but im working on stuff atm got rl stuff im busy with but once im done i will finish a bat for the warp 7 and one for this phone. but yes u swap the name of the phone out for what phone u have.
---------- Post added at 03:26 PM ---------- Previous post was at 03:25 PM ----------
the warp 7 has different name etc so yea the warp 7 post is different im trying to work on everything as well keep working on my huawei ascend xt as well real life stuff

Question for madvane20, im sorry, i meant persist.sys.k OR setprop ro.product.name, this is the discrepancy in the two instructions.

did u read the guide for the zte maven 2 and also look at the guide for the warp 7 u will see the difference it just takes u to read them then u shouldnt have any questions

is this syntax correct, before i try it?
batch.txt:
https://dl.xda-developers.com/4/2/2/0/4/0/3/batchfiles.txt?key=NgPk58hMrJO5QXnvDcnCPw&ts=1500762566

if anyone wants to ask me questions just pm me or get ahole of me on hangouts im listed as dav ril or madvane20

I have used Wugfresh's NRT with my previous Nexus devices with stellar results and I downloaded ADB to try your guys method with a Z831 however, I need ti know if this guide is Android version specific? I recently went from 5.1.1 to 7.1.1 in like 3 OTA AT&T updates, so this device is running Nougat. Also, is PIE something new to 7.0 ? I read somewhere this affects the root process. Why do they have "Unlock bootloader" option in Dev settings ? Can I just run an ADB command to enable Write permission to delete 40-50 #/System/App .apk's?

Yo OP, I genuinely appreciate you sharing this. I found that everything has worked perfectly. I managed to get perm root and I just tried to install SU, gonna see if it worked. Thanks bro
Sent from my N9519 using Tapatalk

So, is it working? please let me know because i also want to root it.
---------- Post added at 04:36 AM ---------- Previous post was at 04:27 AM ----------
How to install adb and Zte drivers on your computer? please reply

379068 said:
So, is it working? please let me know because i also want to root it.
---------- Post added at 04:36 AM ---------- Previous post was at 04:27 AM ----------
How to install adb and Zte drivers on your computer? please reply
Click to expand...
Click to collapse
The ZTE drivers should be on your phone. One of the mount options, when you plug in your phone is to install drivers.

This method really works. You can copy your recovery back after, you do not loose root. You are also able to re-root and make it permanent again after a factory reset, it is just takes many more exploit attempts. You can also install Xposed through Xposed Installer.
Anybody bought and tried Super-Sume Pro with this phone yet?

can thsi be done on other mavens?
Can you do this on a Maven 3 running nougat?

Is the root method working with ZTE Maven 3?
Anyone tried this on ZTE Maven 3? Got 2 from Bestbuy, would like to have them rooted.
Thanks.
Logos Ascetic said:
Can you do this on a Maven 3 running nougat?
Click to expand...
Click to collapse

I recently dissected the partition index and firmware structure of the ZTE Maven 3, in hopes of discovering a viable root exploit. Because it ships with stock Android Nougat, systemless root via patched boot image would be preferable. But, because the bootloader does not appear to be unlockable by any known method or exploit, systemless root is not currently an option. Accordingly, I focused on the less desirable method of system-mode rooting, which injects the SU daemon and corresponding root binaries to the Android OS by way of the /system partition directly. Again, an obstacle ensued: the stock kernel of the ZTE Maven 3 is secured by AVB 2.0/dm-verity (device mapping), which checks the /system partition for any modifications whatsoever prior to allowing the OS to boot. So, if /system is modified in any way, or so much as mounted r/w, a perpetual boot loop will commence via dm-verity.
So, in short, due to the locked bootloader state and verified boot/device mapping, safely & effectively rooting the stock Android Nougat OS of the ZTE Maven 3 doesn't presently appear to be feasible.
Note: I realize that the OP designated this as a ZTE Maven 2 thread, and I apologize to the OP if I'm off topic. I only addressed the Maven 3 because of the number of questions in the thread.

I have the z831 through at&t. I'm pretty sure I unlocked the bootloader in developer options as nothing would root the phone until I turned it on. Everything worked, but is there a custom recovery or rom?

kingroot.net even if you choose english gives you a chinese app