Created
February 11, 2014 00:20
-
-
Save lloyd/8926984 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1. put <file> on sdcard | |
2. put sdcard in device | |
3. reboot and hold down up arrow and power for 10s. | |
4. "apply update from external storage" - select <file> | |
5. "wipe data/factory reset" | |
6. reboot | |
Now you've got an unrooted phone. Let's install a su binary that gives us root. | |
1. download root-zte-open.zip (md5 cecc15bd0cc315633d066d81b44d7732) | |
2. enable remote debugging (device information -> more information -> Developer) | |
-> then check "Remote Debugging" | |
3. ./run.sh | |
Now we can get root on the device! Nice. How about we pull the boot image off | |
of the device? | |
1. mkdir boot && cd boot | |
2. adb shell | |
3. su | |
4. cat /dev/mtd/mtd1 > /sdcard/boot.img | |
5. exit; exit | |
Ok! We've pulled the boot image off the device. Now let's unpack it and | |
set the device to give us root by default, and enable debugging at startup. | |
First, you need to be able to extract this thing. abootimg can do this for you. | |
Find it! (hint: https://github.com/coruus/abootimg) | |
1. abootimg -x boot.img | |
2. mkdir initrd;cd initrd | |
3. mv ../initrd.img initrd.gz | |
4. gunzip initrd.gz; cpio -id < initrd | |
Now let's hack default.prop - the properties that controls the state in which the | |
devices starts. Make them look like this: | |
ro.secure=0 | |
ro.allow.mock.location=1 | |
ro.debuggable=1 | |
persist.usb.serialno=full_inari | |
persist.sys.usb.config=adb | |
Now we have to acquire a tool to create a boot file system. google mkbootfs. | |
Now let's make a new boot image which includes these properties, and push | |
it to the device: | |
1. mkbootfs . | gzip > ../newinitramfs.cpio.gz | |
2. cd .. | |
3. mkbootimg --kernel zImage --ramdisk newinitramfs.cpio.gz --base 0x200000 --cmdline 'androidboot.hardware=roamer2' -o newboot.img | |
4. adb push ./newboot.img /sdcard/ | |
Now let's flash the device with the new boot image: | |
1. adb shell | |
2. su | |
3. flash_image boot /sdcard/newboot.img | |
4. restart the device via the interface | |
As the phone reboots, adb devices will show you the device. adb shell in | |
and notice /default.prop is updated with your new settings. also, upon adb shell, | |
you'll notice a '#' command prompt - you're root by default. w00t. | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
hi please how can i root zte n9560
can u help me