Skip to content

Instantly share code, notes, and snippets.

@lloyd lloyd/zte-closed.txt
Created Feb 11, 2014

Embed
What would you like to do?
1. put <file> on sdcard
2. put sdcard in device
3. reboot and hold down up arrow and power for 10s.
4. "apply update from external storage" - select <file>
5. "wipe data/factory reset"
6. reboot
Now you've got an unrooted phone. Let's install a su binary that gives us root.
1. download root-zte-open.zip (md5 cecc15bd0cc315633d066d81b44d7732)
2. enable remote debugging (device information -> more information -> Developer)
-> then check "Remote Debugging"
3. ./run.sh
Now we can get root on the device! Nice. How about we pull the boot image off
of the device?
1. mkdir boot && cd boot
2. adb shell
3. su
4. cat /dev/mtd/mtd1 > /sdcard/boot.img
5. exit; exit
Ok! We've pulled the boot image off the device. Now let's unpack it and
set the device to give us root by default, and enable debugging at startup.
First, you need to be able to extract this thing. abootimg can do this for you.
Find it! (hint: https://github.com/coruus/abootimg)
1. abootimg -x boot.img
2. mkdir initrd;cd initrd
3. mv ../initrd.img initrd.gz
4. gunzip initrd.gz; cpio -id < initrd
Now let's hack default.prop - the properties that controls the state in which the
devices starts. Make them look like this:
ro.secure=0
ro.allow.mock.location=1
ro.debuggable=1
persist.usb.serialno=full_inari
persist.sys.usb.config=adb
Now we have to acquire a tool to create a boot file system. google mkbootfs.
Now let's make a new boot image which includes these properties, and push
it to the device:
1. mkbootfs . | gzip > ../newinitramfs.cpio.gz
2. cd ..
3. mkbootimg --kernel zImage --ramdisk newinitramfs.cpio.gz --base 0x200000 --cmdline 'androidboot.hardware=roamer2' -o newboot.img
4. adb push ./newboot.img /sdcard/
Now let's flash the device with the new boot image:
1. adb shell
2. su
3. flash_image boot /sdcard/newboot.img
4. restart the device via the interface
As the phone reboots, adb devices will show you the device. adb shell in
and notice /default.prop is updated with your new settings. also, upon adb shell,
you'll notice a '#' command prompt - you're root by default. w00t.
@modhas

This comment has been minimized.

Copy link

modhas commented Mar 15, 2018

hi please how can i root zte n9560
can u help me

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.