Database Info

[Q] polaroid easy2 hacking

Hi everybody.
I bought recently (mid-November 2012) a Polaroid easy2 tablet. It is an MIDR477 model, made in China by Baolaili and based on a MIPS 74Kc processor. It is the "low-end" resistive model but I cared little for it is supposed to become a "smart terminal" in a data acquisition system. I needed to break into the system (I am a Linux person and prefer to do Perl and C programming) to make it suitable for my application.
It turned out to be easy to get the root shell, I rooted it successfully with the help in this forum, thanks to the contributors.
The file system, accessible through the /dev/block/actX devices is actually easy to mount and modify and after a short while I managed to modify permanently the init scripts. The one of interest was init.rc that changes the path and libraries default. I still have a problem due to the non-standard paths (and my limited knowledge in Linux administration), while changing successfully the paths and other variables, I cannot get any external program to run. As an example, when I try to do a simple 'ln -s /<original path> /<link>', it is never executed from the init.rc. Can someone tell me what I am doing wrong ?
Additionally, if there is in the Android boot sequence a better way to gain control, I would be very grateful to know it (my goal is to be able to set-up the system to run unattended).
Edit: My assumption was that init.rc was a script that executed, it seems to be a file parsed by init. No wonder why it did not work properly. Still looking for an entry point that is not a java component ...
re-Edit: (I'll make a thread on my own ) ... I finally dug the answer in this forum, if anybody is interested in the boot process :
3w.androidenea.com under /search?updated-max=2009-10-16T13:47:00%2B02:00&max-results=7&start=21&by-date=false
sorry for the restriction ...
the answer I was looking for is in the "The init process and init.rc" section.
Best regards.

Hi,
I've got the same tablet, but I can't find a way to root this device.
Can you help me find a thread where this is explained.
Ty,
Dimitri

doorknob314 said:
Hi,
I've got the same tablet, but I can't find a way to root this device.
Can you help me find a thread where this is explained.
Ty,
Dimitri
Click to expand...
Click to collapse
Hi Dimitri.
All this is from memory. I found on this forum a thread about a similar product that actually gives the password for the root shell (something like connect123, can't remember). After installing the adk and the adb shell (took me a while and it was under linux), I uploaded an unlocked busybox (be careful about the proc, it is not the usual type: MIPS 74Kc). I think that at that point the rooting app started functioning. I still have superuser installer but that was not the one originally used. Sorry not to be able to help more but as the tablet is unlocked, I quickly forgot about the process.
Regards.

Thank you, i hope i can find an answer with your information

[Q] Root Vivitar XO (Kids tablet)

Hey guys!
First off, any help or info on this is GREATLY APPRECIATED!!
Just wondering if anyone has any info or knows where I can find, how to root this Vivitar XO, children's tablet?
My daughter just won this at preschool. It's ok, I guess, its similar to the other kids tablets with the "kid UI" and the normal Android UI, we see on our phones and tablets. it does have decent specs (below) for a kids tablet, better than most so far, especially in the $150 range..
Hopefully, some kids with hacker parents/siblings gets one soon, so we can really make this thing cool! :fingers-crossed:
If anyone knows anything now, please share the knowledge, a very generous beer/coffee donation's waiting! :highfive:
THANKS!!!!
Technical Specifications
Size: 7.6" x 4.65" x .39"
Screen Size: 7"
Screen Resolution: 1024 x 600
Storage: 8GB
Processor: 1.6GHz dual core
Operating System Android: 4.2 (Jelly Bean)
RAM: 1GB
Wi-Fi: 802.11 b/g/n
Camera: 1.2MP Front-Facing / 2.0MP Rear-Facing
Battery Life: up to 7.5 hours

I'm interested in this too - I hooked up with USB debugging turned on and tried adb, but it couldn't see the device. I'm guessing this is due to a generic adb driver not working, but I suppose there could be other secret sauce (e.g. adb.ini magic numbers) needed too.
I'm eager to try some scans for e.g. the Master Key vulnerability and point the Impactor to it - if I can just get adb to see the device! Please, anyone, let us know if you have success getting adb working - I can't stand having an un-rooted tablet in the house!

Magic numbers for XO Tablet
microwiz said:
I hooked up with USB debugging turned on and tried adb, but it couldn't see the device. I'm guessing this is due to a generic adb driver not working, but I suppose there could be other secret sauce (e.g. adb.ini magic numbers) needed too.
Click to expand...
Click to collapse
Interested too but I found the magic numbers !
If I add following lines to the Google generic USB driver, I could see the XO Tablet from ADB:
;XO Tablet
%SingleAdbInterface% = USB_Install, USB\VID_16D5&PID_8007
%CompositeAdbInterface% = USB_Install, USB\VID_16D5&PID_8007&MI_01
Hope that help and you could find a way to root it
Let us know !

Vivitar Camelio Tablet Root Method (no fastboot or bootloader)
I have a Vivitar Camelio tablet for my kids and I have rooted several tablets and phones and understand as a tech myself what to do in most cases...
I want to root and remove bloatware and test some customized JB roms on this basic tablet.
I can connect and see it using PdaNet drivers and I can only backup/restore via adb but when I try to run any fastboot commands I get errors such as fastboot device not detected.
This vivitar stock tablet has a custom 4.1.1 JB rom on it stock. I cannot boot into download mode. However I can boot into its stock recovery with just a few options available such as sideload, wipe cache, factory reset and also reboot. I can see the device from ADB but cannot use fastboot commands without the no device error.
*****
A way to root this tablet and without the bootloader accessibility I cannot do this. I will pay via paypal 10 whole US dollars for the first person that can successfully walk me through this. We can use gotomypc or to video conference or simply you can draft up the steps I need to perform. I am ok with bricking this toy my kid is 3 and the device is a bit much for her at this point so I'll try anything to unlock the bootloader so I can root and rom it.
I was able to gather tablet information but this is all that was displayed via ADB.
DEVICE INFORMATION:
Product Description: Camelio Family Tablet
Device Product: (Blank)
Device Type: PI070H04CA
Firmware Version: 4.1.1
Firmware Build: JRO03H
Firmware Region Code: (Blank)
Bootloader Version: (Blank)
Boot Image Status: Secure
ANY HELP I S GREATLY APPRECIATED!
This tablet is pretty good for the $99 price tag so this should be a question that will be asked again and again by others in the future. Help me on this one and you can post the Vivitar Camelio Root method update and take all the credit for it
Thanks!!!!!!!
Jason

Problem Solved!
Root your device with Kingo. here is the link! Enjoy!
Google Kingo Root and you will find it quick and easy.
Jason
Rooted Camelio Tablet and S4 Mini with Kingo.

lionel911 said:
Interested too but I found the magic numbers !
If I add following lines to the Google generic USB driver, I could see the XO Tablet from ADB:
;XO Tablet
%SingleAdbInterface% = USB_Install, USB\VID_16D5&PID_8007
%CompositeAdbInterface% = USB_Install, USB\VID_16D5&PID_8007&MI_01
Hope that help and you could find a way to root it
Let us know !
Click to expand...
Click to collapse
I found another way of waking up adb and getting it to see the "XO Learning Tablet" over USB debugging - I kind of cheated by launching Moborobo :/ but at least I got connected.
Anyhow, after that, I checked with the SRT AppScanner and both existing Master Key vulns were still present on the 4.1.1 build of Android that the tablet ships with. I tried the first option in the Cydia Impactor ("# drop SuperSU su to /system/xbin/su") and had immediate success! Both a shell (which allowed me to su) and activating the Root Explorer in ES File Explorer (after installing SuperSU) worked flawlessly.
Hope this is helpful to folks desiring to root their XO Tablet. Please feel free to ask any other questions you may have!

ReaperMMA said:
Root your device with Kingo. here is the link! Enjoy!
Google Kingo Root and you will find it quick and easy.
Jason
Rooted Camelio Tablet and S4 Mini with Kingo.
Click to expand...
Click to collapse
Kingo root does work on the XO Learning tablet. Also the button combo to get into recovery mode is Vol- & Power at the same time. When it starts up release the power button.

SnoopyII said:
Kingo root does work on the XO Learning tablet. Also the button combo to get into recovery mode is Vol- & Power at the same time. When it starts up release the power button.
Click to expand...
Click to collapse
Kingo Root only worked for me after I ran Moborobo. Before that adb would not find the device, moborobo fixed that.

So I root the Vivitar XO but how would i flash a clean version on android on to it or maybe even sugar.

Camelio F.T ROOT
ReaperMMA said:
I have a Vivitar Camelio tablet for my kids and I have rooted several tablets and phones and understand as a tech myself what to do in most cases...
I want to root and remove bloatware and test some customized JB roms on this basic tablet.
I can connect and see it using PdaNet drivers and I can only backup/restore via adb but when I try to run any fastboot commands I get errors such as fastboot device not detected.
This vivitar stock tablet has a custom 4.1.1 JB rom on it stock. I cannot boot into download mode. However I can boot into its stock recovery with just a few options available such as sideload, wipe cache, factory reset and also reboot. I can see the device from ADB but cannot use fastboot commands without the no device error.
*****
A way to root this tablet and without the bootloader accessibility I cannot do this. I will pay via paypal 10 whole US dollars for the first person that can successfully walk me through this. We can use gotomypc or to video conference or simply you can draft up the steps I need to perform. I am ok with bricking this toy my kid is 3 and the device is a bit much for her at this point so I'll try anything to unlock the bootloader so I can root and rom it.
I was able to gather tablet information but this is all that was displayed via ADB.
DEVICE INFORMATION:
Product Description: Camelio Family Tablet
Device Product: (Blank)
Device Type: PI070H04CA
Firmware Version: 4.1.1
Firmware Build: JRO03H
Firmware Region Code: (Blank)
Bootloader Version: (Blank)
Boot Image Status: Secure
ANY HELP I S GREATLY APPRECIATED!
This tablet is pretty good for the $99 price tag so this should be a question that will be asked again and again by others in the future. Help me on this one and you can post the Vivitar Camelio Root method update and take all the credit for it
Thanks!!!!!!!
Jason
Click to expand...
Click to collapse
Hey Jason, I have the same tablet someone gave it to me. So I've been playing with it seeing what happens but an answer to your question is by Geohot at towelroot DL the file and run it the DL busybox and install it and let it run oh, DL superSU after that try Root Checker from play store you should be rooted. Hope this helps.

After We have Root access, is there a rom We can flash to make this a normal
Tablet?
My kid doesnt like the interface at all.
Just a stock jb 4.1.1?
Thanks much.

Thanks in advance
microwiz said:
I found another way of waking up adb and getting it to see the "XO Learning Tablet" over USB debugging - I kind of cheated by launching Moborobo :/ but at least I got connected.
Anyhow, after that, I checked with the SRT AppScanner and both existing Master Key vulns were still present on the 4.1.1 build of Android that the tablet ships with. I tried the first option in the Cydia Impactor ("# drop SuperSU su to /system/xbin/su") and had immediate success! Both a shell (which allowed me to su) and activating the Root Explorer in ES File Explorer (after installing SuperSU) worked flawlessly.
Hope this is helpful to folks desiring to root their XO Tablet. Please feel free to ask any other questions you may have!
Click to expand...
Click to collapse
...i am very new to android mods.. ive modded xbox1 ,360 ,ps3, jb ipods n iphones but never anything android .. kids got xo tablet for Christmas ..2 kids 2 tablets 1 of which .. my oldest daughter .. 7 .. insist her dad can modify anything lol .. i dont want to brick it and a detailed tutorial or at least point me in the right direction would be greatfully appreciated .. ive looked into it with not many results..if u could walk me through the proper procedure on backing up and reinstalling stock im up to try anything and post results

r2161984 said:
...i am very new to android mods.. ive modded xbox1 ,360 ,ps3, jb ipods n iphones but never anything android .. kids got xo tablet for Christmas ..2 kids 2 tablets 1 of which .. my oldest daughter .. 7 .. insist her dad can modify anything lol .. i dont want to brick it and a detailed tutorial or at least point me in the right direction would be greatfully appreciated .. ive looked into it with not many results..if u could walk me through the proper procedure on backing up and reinstalling stock im up to try anything and post results
Click to expand...
Click to collapse
Did you ever find anything about this? I'm killing myself trying to install cyanogenmod on this tablet after I rooted it.

I'm a little unclear on the appropriate rom to install over the old one. I assume Cyanogenmod, but I can't find the correct version. Any help?

This really needs a root or firmware if you ever intend on repurposing it. Will have to experiment with ADB and see if I can at least clear out the excess media files. My middle-schooler could probably still make use of it as it is (having a restricted "child" mode might still be a good idea), but would like to clean up the cruft that's not needed (like a lot of undeletable sample files). But yes, if it could also be permanently set to "parent" mode, and I could put MS Launcher on it, that would be nice too.
I actually ended up with 4 of them, two or three that aren't charging. I'm going to open the two that don't charge and see if I can fix that, at which point they could be available for dev work. (now that I re-located my bricked Nabi2, I should send that one out for dev work too).

If it's of any use, when it's attached to my Linux box, "lsusb" will report it as this:
Bus 001 Device 013: ID 0bb4:0c02 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo (Debug)
"adb devices" shows:
XO8801114002af6
as the device name.
Since I can connect it and am able to navigate through the directories on internal storage, I could pull system information if you tell me what you need.

For something that was supposedly an open-specification device, this tablet is sorely lacking in documentation and other critical information. Wasn't the who purpose of the OLPC project (which was selling this tablet) that it was supposed to be open and customizable? Or was Nicholas Negroponte lying to us?
---------- Post added at 10:29 PM ---------- Previous post was at 09:50 PM ----------
Actually, at this point the tablet is garbage. I can't even force it into a factory reset, because I can't get to the bootloader menu. And somehow it has decided to add a secondary password (after the parental password), so there is ***NO*** way to get into a system menu to do a reset from the settings screen. Short of finding a way to short something on the system board, the only thing to do with this thing is to take a sledgehammer to it.
(yeah, it failed just as harshly as the entire OLPC project did, I guess).

So I still haven't found an answer to what the deal *IS* with the XO Tablet. It has all the pretensions of being part of the OLPC Project, but unlike the laptop itself, which was an OPEN design, fully specced, available for experimentation and customization, this tablet seems to be much the OPPOSITE of that, being pretty-much undocumented, and no one wants to touch the things.
I mean seriously, I'd be willing to pull an image from a fresh factory-reset system so that someone could experiment with it. I'd send it to someone to hack themselves, but really, the device doesn't exude any noxious odors, it doesn't spontaneously spring out poison-laced spikes, at worst it looks kind-of 'meh' as far as design goes. So you don't have to be afraid to touch one.
(for that matter, I'd also send someone my bricked Nabi 2S (was that the name for the later revision?); it does nothing for me sitting unused in a closet)

From what I was able to get from someone who had worked/still works for the OLPC project, this tablet was something some execttive had pushed through without Engineering's knowledge, and therefore it was little more than a sugar UI slapped on top of a proprietary device. Released under their name, but that's about it.
System information from the "Hardware Info" tool shows:
System (Android 4.1.1)
Model XO Learning tablet
Manufacturer XiangDe
Device PI070H08XO
Product PI070H08XO
Brand Vivitar
Android Version 4.1.1 (Jelly Bean)
API Level 16
Build ID JRO03H
Fingerprint Vivitar/PI070H08XO/PI070H08XO:4.1.1/JRO03H/XD-XO-BN-29052013.V010:user/release-keys
Although it will prove to be about as useful as anything else, since the configuration files for it haven't magically sprung out of netherspace.

Yes, you can "root" this tablet (it's pretty much open anyway), but even if you leave it at it's default Android version, the UI is still a serious problem. If you want to repurpose it as a normal tablet and not the dumbed-down kids version, you need to get rid of the built-in launcher. I had thought I found how to disable the launcher in ADB, but it only made it not boot, and I had to wipe to the factory image again. How do you even figure out what it's running for it's launcher so you can disable/remove it at the system level?
I know it must be possible to edit the system image itself (that reloads when you do a factory wipe) because I had at some point managed to delete the on-screen keyboard app (when you factory wipe, you have to plug in a USB keyboard with OTG and eventually re-load a KB device). But Android seems intent upon making the internals of the device incomprehensible. Even with all the cruft Microsoft forces on you with their systems, I'd still think the Windows Mobile devices were probably MORE open than Android.
Since I have two of these (the other is stock) I could factory wipe the other one and pull an image, if there were actually some documentation on how to do that. But with Android, you can never do something for the first time unless you've already done it 10 times previously.

HARDWARE HACK/MOD/ROOT - Biglots D2 Platinum 751G_MZ Tablet rooting method with pics.

Hello everyone,
I purchased one of the latest revisions of the D2 Tablet Platinum (model# 751G_MZ) and tried every single rooting method I could find, not a single one worked on this tablet, even tried paid version of super-oneclick root and it says wait for new version! I ran out of software options to root the tablet. I WAS able to manually push su binary into the /data/local/tmp folder that is used to root the older 751G but it did not correct the permissions or put the su binary into /system/bin and /system/xbin.
I figured I was out of software methods so I took the best route and now have a completely hacked and 100% brickproof tablet. even tablets that are completely wiped out and appear to be off are recoverable now. this includes the "M6 USB" mode that means no bootloader is installed. What I did is outlined below, bear with me as I am not good with explaining things but the pictures should speak for themselves. after pushing the files into the /data/local/tmp folder I needed a way to move them and correct the permissions. knowing that recovery mode is able to flash and change things with root privs on almost all tablets.
After I added a Serial UART port to my tablet(see pictures) I booted into recovery mode and opened a serial console, I am able to modify u-boot parameters as well as debug and change just about everything. I mounted the /system partition from the root shell in serial terminal and moved the files using busybox cp, then chmod 06755 su to correct permissions. I then rebooted into android and installed superuser and sucess. I have root and much much more! I am gonna work on finding a way to do this using software but I could use some help with this. If anyone has questions please don't hesitate to ask.
Their are many pictures that would be very interesting to tablet users in general, please click the link below to see the full album to see my modifications.
http://s281.photobucket.com/user/UR2EZ4ME/slideshow/D2-Tablet
BinaryDroid
Michael Pizzileo

Now that I have a brick-proof AML8726MXS based Tablet, I am going to be porting CM10 to the device. I ran into an issue with unpacking the non-standard boot images but i'm writing a script right now that will handle the new format used since no tool exists for this platform, only the older AML8726MX and AML8726M1/M3. if anyone knows of any unpack tools for this platform it would save me time later on when it comes time to build CWM for the Digital2 Platinum Tab. after that i should be all ready to do a test build using source tree from older platform as a base.
BinaryDroid
Michael Pizzileo

I have just ported Clockworkmod to the tablet as well as created a software rooting method that anyone can do. I am doing some final bugfixes to the CWM so it mounts the Internal flash as well and then post a full guide on how to root the tablet. I am hoping others with the tablet or pick up this great $89 1024x600 Dual core A9 1.5GHZ 1GM Ram tablet so others can help with developing better ROMS for it. its a slow process doing the full CM10 port myself lol. I'll keep everyone posted and look forward to any questions or comments.
Binarydroid.

Double post..

awesome work! do you think a similiar method could work on newer fire tablets? i

Old but firmware still available in case someone needs it. Was already when this thread was written.
Now at http://web.archive.org/web/20150402...on=com_content&view=article&id=237&Itemid=423
Rooting should have been easy enough. Just keys file needed to be changed
to a test version... in the recovery file that is....

[Q] Root ZTE Valet Z665c

Does anyone have any information on how to root this phone?
It is a tracfone running Android 4.1 with 1ghz qualcomm cpu.
Thanks.

I'm also looking for someone who might have some pointers on how to root this phone or install KitKat apps from Nexus 5 dump!!!
I know it is a low end phone but there are lots of people in the Tracfone world who are now able to get Android phones and are NEW to the smartphone universe.
Thanks.

I'm thinking of buying this phone. As a low end Android, how does it hold up? And if you want to root it, try Bin4ry's root method here. Just be careful.

Tried Bin4ry on ZTE Valet but it failed to root
I've had the phone a couple of days so far and while I'm by no means a qualified reviewer of smartphones, I do like the ZTE Valet. I'm too cheap to pay the $70-100 USD/month for a post-paid service that I don't need.
After searching the forums and seeing that no one reported trying to root the phone, I took a brave pill and tried the Bin4ry method (v31). I got the same message that many users reported - after rebooting, it fails to mount and copy the necessary files. Both the new standard method and the old method failed. It did no apparent harm to the phone - just didn't work. Here's some details on the phone I have:
Android version 4.1.1
Kernel 3.4.0-perf [email protected]
Thanks for any ideas or advice.

I just picked one up at Kmart for $80 today and am checking things out, trying to see about rooting it. My Hisense Sero 7 Pro tab is rooted and running great with a DoPa custom ROM.

I also purchased one of these and am happy so far. I have a question on the magnetic and rotation sensor. They seem to show up as installed as ak8962 devices but apps like 'my android sensors' don't show any data being returned. are they just not actually installed?
thanks
sam
gberpa said:
I just picked one up at Kmart for $80 today and am checking things out, trying to see about rooting it. My Hisense Sero 7 Pro tab is rooted and running great with a DoPa custom ROM.
Click to expand...
Click to collapse

samcoinc said:
I also purchased one of these and am happy so far. I have a question on the magnetic and rotation sensor. They seem to show up as installed as ak8962 devices but apps like 'my android sensors' don't show any data being returned. are they just not actually installed?
thanks
sam
Click to expand...
Click to collapse
The rotation of the device changes the screen from portrait to landscape and 'maps', 'Gas Buddy' seems to show the right direction for magnetic north. I haven't had much time to check yet. AAMF, I haven't activated or transferred my number to the 'phone' yet as am deciding if is a 'keeper'. So far, I think it is as I can use WiFi and 'turn off' mobile data by option. Now checking things like battery life in standby.. Haven't found an option to shut WiFi when screen is off like in my JB 4.2.1 and HC 3.1 devices. Only seem to be able to turn WiFi on or off or see an option for airplane mode.

I agree - the screen rotates (how - I don't know ) I would assume gas buddy is using GPS to find north.
sam
gberpa said:
The rotation of the device changes the screen from portrait to landscape and 'maps', 'Gas Buddy' seems to show the right direction for magnetic north. I haven't had much time to check yet. AAMF, I haven't activated or transferred my number to the 'phone' yet as am deciding if is a 'keeper'. So far, I think it is as I can use WiFi and 'turn off' mobile data by option. Now checking things like battery life in standby.. Haven't found an option to shut WiFi when screen is off like in my JB 4.2.1 and HC 3.1 devices. Only seem to be able to turn WiFi on or off or see an option for airplane mode.
Click to expand...
Click to collapse

Any update on this?

It isn't looking good so far..
http://androidforums.com/zte-valet/799676-ill-help-find-root-method-if.html
They have tried a bunch of stuff so far.
sam
Unkn0wn0ne said:
Any update on this?
Click to expand...
Click to collapse

samcoinc said:
It isn't looking good so far..
They have tried a bunch of stuff so far.
sam
Click to expand...
Click to collapse
I'm going to get my hands on the phone soon. I'll proceed to attempt to get a recovery or something compiled for it if I can. First, I'd have to dump the rom and kernel which might require root access, but we will see. Once we have a recovery we can port CyanogenMod over to it.
Also I think I know why it's crashing, but I can't be sure until I can test it out myself.

Unkn0wn0ne said:
I'm going to get my hands on the phone soon. I'll proceed to attempt to get a recovery or something compiled for it if I can. First, I'd have to dump the rom and kernel which might require root access, but we will see. Once we have a recovery we can port CyanogenMod over to it.
Also I think I know why it's crashing, but I can't be sure until I can test it out myself.
Click to expand...
Click to collapse
Wish you luck..just got my replacement unit from TracFone after the first one's screen froze.

oooops. Sorry posted in wrong thread.

ZTE Valet Z665c - obtaining temporary root
After trying numerous root methods (Bin4ry, Framaroot, ...), I stumbled on a method of getting temporary root using Cydia Impactor. Cydia Impactor appears to be partially successful. First of all, please note that all credit goes to those involved with Cydia Impactor and the discovery of the original exploits (do a search if you want).
This method might seem a little convoluted, but it works reliably for me. Note that I use a Linux machine so you might have to adapt the steps to work on another platform.
Prerequisites:
1. Menu -> System settings -> Developer options -> USB debugging ->Enabled.
2. Menu -> System settings -> Developer options -> Stay awake ->Enabled (to keep the telnet session from going to sleep).
3. telnet (I am running on Ubuntu, but some sort of telnet program is needed).
4. Cydia Impactor
5. phone is connected to your wifi.
Steps:
1. Run the "Cydia Impactor" to "# drop SuperSU to /system/xbin/su". See what happens.
2. It failed for me giving an error related to not being able to remount /system or not being able to create /system/xbin/su.
3. In Cydia Impactor, run "# start telnetd as system on port 2222". You don't need to bother to telnet in. Just let it finish and then proceed to the next step.
4. In Cydia Impactor, run "# start telnetd as root on port 22". Let it finish.
5. Telnet into your phone from a terminal on your computer: "telnet 192.168.1.117 -l root 22". Note that the ip address is likely different on your network, e.g., 192.168.1.xxx.
6. If everything worked OK, you should be presented with a root prompt ("~ #"). I have busybox (obtained from the Bin4ry exploit download) that I adb pushed to /data/local/tmp. The command "/data/local/tmp/busybox whoami" tells me I am indeed root.
OK - now the bad news for me. I proceed to try to install su but remount fails. If I issue the command:
~ # mount -o rw,remount /system
~ #
A root prompt is returned with no error message suggesting that it successfully remounted /system. Woohoo! But a "mount" command (or cat /proc/mounts) says it is still "ro" or read only. Darn. Does it appear that ZTE has crippled the mount command in some way? Now the question is how to permanently install root? I have poked around and at least was able to make a backup to my sdcard using bzip2
This should at least help as a first step. Others including myself have posted elsewhere on this phone. At this point, I'm not willing to risk flashing anything. I'm a noob so I'm hoping someone who is more familiar with the permissions and that sort of thing can complete the root and post a solution.
Thanks.

Awesome!
These findings are great, I'd be willing to check this out soon. (Linux box is down do to hardware issue. ).
If we can obtain root the remounting issue can definitely be fixed. Also, does busybox have the premissions to run?
Try this:
Code:
mount | grep system
That will give you somewhere within the text the partition that is registered as /system . Then:
Code:
mount -o rw,remount [PARTITION-THAT-COMMAND-RETURNED-HERE-MINUS-BRACKETS] /system
See if that works. But anyways, if it doesn't it can still be rooted! (just temporarily, but it is no longer an 'unrootable' device)
Note: I am not responsible for what happens using those commands.

a little more info in response to your questions
Dear Unkn0wn0ne,
I had messed around with it and also tried something like you suggested, e.g.:
mount -o rw,remount,relatime,data=ordered -t ext4 /dev/block/mmcblk0p19 /system
Also tried it with the "-n" option to avoid a write to mtab although I don't remember seeing mtab while purusing the file system.
Hadn't noticed that busybox was available under /system/bin:
~ # ls -al /system/bin/busybox
-rwxr-xr-x 1 root shell 1075144 Jul 19 11:20 /system/bin/busybox
~ #
Could be that it has a more limited command set than the one I put in /data/local/tmp. A lot of the commands under /system/bin have a symbolic link to toolbox.
Note that the telnet connection needs to be made over wifi and not the one available over usb. I got the ip address from my router's client list.
Oh yes - thanks for the reminder. Forgot to include the disclaimer about harming the phone or voiding the warranty.
Hope it works out well for you. Glad to hear your encouraging remarks.

Awesome!
Alright so that didn't work. This guy over here has a suggestion (he has scene your thread): - I can't publish links so I'll pm the link to you.
Also if busybox is symbolically linked you'd have to tell it specifically to call to the busybox pushed over via adb to: /data/local/tmp/busybox and not the stock.
In this case: /data/loocal/tmp/busybox/mount
Also the disclaimer is a must. There will always be that person that tries to blame it on someone else.
Note: I am not responsible for whatever happens using the information provided in this post.

karmmisht said:
After trying numerous root methods (Bin4ry, Framaroot, ...), I stumbled on a method of getting temporary root using Cydia Impactor. Cydia Impactor appears to be partially successful. First of all, please note that all credit goes to those involved with Cydia Impactor and the discovery of the original exploits (do a search if you want).
This method might seem a little convoluted, but it works reliably for me. Note that I use a Linux machine so you might have to adapt the steps to work on another platform.
This should at least help as a first step. Others including myself have posted elsewhere on this phone. At this point, I'm not willing to risk flashing anything. I'm a noob so I'm hoping someone who is more familiar with the permissions and that sort of thing can complete the root and post a solution.
Thanks.
Click to expand...
Click to collapse
I attempted this myself on my Windows 8 machine. I had to enable telnet, but that was easy. I had to reararange the command to "telnet root 192.168.x.xxx:22" (xxx is my IP). It keeps giving me the error "Connect failed."
Any thoughts out there?

try putty
Ph0enix_216,
I tried to connect from a Windows 7 machine and it works using putty for telnet (www.putty.org, a great program). Be sure to set the Connection->Data->Auto-login name to root.

well the guy in the other thread bricked his it sounds like...
http://androidforums.com/zte-valet/799676-ill-help-find-root-method-if-3.html
They tried to modify the mmcblk0p16 boot image and re-copy it back. It seemed to re-copy but then didn't boot with a verify error.. (I am paraphrasing - and don't really understand what they where doing )
sam
Ph0enix_216 said:
I attempted this myself on my Windows 8 machine. I had to enable telnet, but that was easy. I had to reararange the command to "telnet root 192.168.x.xxx:22" (xxx is my IP). It keeps giving me the error "Connect failed."
Any thoughts out there?
Click to expand...
Click to collapse

AT&T H10 20N Android 6.0 - Temp Root request

Hello everyone,
I would really like to achieve a temporary root on my device. I am running the stock version, recently it updated to 20N for the Android 6.0 MM update.
I am very comfortable with adb and other command line interfaces (I primarily work on Linux servers remotely for my day job).
Are there any good resources for achieving a manual temporary root from adb on this device (or any Android device in general?). I find my Google-Fu searching has been lacking, I haven't found any reliable information on this in general for Android. Ideally, I would like to achieve a temporary root without having to wipe my device or install a new ROM. Am I correct in thinking that some sort of temporary root must be achieved before installing a custom ROM? I am wary of most "One Click" packages out there.... I prefer to do the grunt work and understand why/how something works.
In short, I yearn to see a '#' instead of '$' over an abd connection, specifically for an LG G4 H810 20N, but any general Android process is welcomed! Even being able to mount the filesystem as root (possibly from a bootloader or recovery mode) and access the internal filesystem as root via command line would be considered a success. I primarily want to be able to read/write files that are normally blocked from the standard user.
Thanks in advance!

MisterMagicFingers said:
Hello everyone,
I would really like to achieve a temporary root on my device. I am running the stock version, recently it updated to 20N for the Android 6.0 MM update.
I am very comfortable with adb and other command line interfaces (I primarily work on Linux servers remotely for my day job).
Are there any good resources for achieving a manual temporary root from adb on this device (or any Android device in general?). I find my Google-Fu searching has been lacking, I haven't found any reliable information on this in general for Android. Ideally, I would like to achieve a temporary root without having to wipe my device or install a new ROM. Am I correct in thinking that some sort of temporary root must be achieved before installing a custom ROM? I am wary of most "One Click" packages out there.... I prefer to do the grunt work and understand why/how something works.
In short, I yearn to see a '#' instead of '$' over an abd connection, specifically for an LG G4 H810 20N, but any general Android process is welcomed! Even being able to mount the filesystem as root (possibly from a bootloader or recovery mode) and access the internal filesystem as root via command line would be considered a success. I primarily want to be able to read/write files that are normally blocked from the standard user.
Thanks in advance!
Click to expand...
Click to collapse
Bad news: at this point it's not going to happen. With 6.x you have to have a modified kernel to get root and the locked bootloader on your phone will not allow that kernel to boot. In short: don't expect to see root on Marshmallow on this phone anytime soon and it will probably never happen.
I'm not saying that it's impossible, but it's almost certainly not going to happen.
http://www.xda-developers.com/a-look-at-marshmallow-root-verity-complications/

fatbas202 said:
http://www.xda-developers.com/a-look-at-marshmallow-root-verity-complications/
Click to expand...
Click to collapse
Thanks for the information! I have several 4.x and 5.x devices around and am still hoping to find some general information on manually achieving temp root access of the filesystems.

MisterMagicFingers said:
Thanks for the information! I have several 4.x and 5.x devices around and am still hoping to find some general information on manually achieving temp root access of the filesystems.
Click to expand...
Click to collapse
We are all hoping that you find something that someone else has overlooked! Good luck!