[Q] Root ZTE Valet Z665c

Search This thread

poemathesonking

New member
Oct 27, 2013
4
1
Does anyone have any information on how to root this phone?

It is a tracfone running Android 4.1 with 1ghz qualcomm cpu.

Thanks.
 

bummpr

Member
Dec 21, 2008
10
1
I'm also looking for someone who might have some pointers on how to root this phone or install KitKat apps from Nexus 5 dump!!!

I know it is a low end phone but there are lots of people in the Tracfone world who are now able to get Android phones and are NEW to the smartphone universe.

Thanks.
 

karmmisht

Member
Nov 17, 2013
8
4
Tried Bin4ry on ZTE Valet but it failed to root

I've had the phone a couple of days so far and while I'm by no means a qualified reviewer of smartphones, I do like the ZTE Valet. I'm too cheap to pay the $70-100 USD/month for a post-paid service that I don't need.

After searching the forums and seeing that no one reported trying to root the phone, I took a brave pill and tried the Bin4ry method (v31). I got the same message that many users reported - after rebooting, it fails to mount and copy the necessary files. Both the new standard method and the old method failed. It did no apparent harm to the phone - just didn't work. Here's some details on the phone I have:

Android version 4.1.1
Kernel 3.4.0-perf zte-kernel@Zdroid-SMT

Thanks for any ideas or advice.
 

gberpa

Senior Member
Nov 3, 2011
114
8
I just picked one up at Kmart for $80 today and am checking things out, trying to see about rooting it. My Hisense Sero 7 Pro tab is rooted and running great with a DoPa custom ROM.
 
Last edited:

samcoinc

Senior Member
Oct 26, 2012
57
4
I also purchased one of these and am happy so far. I have a question on the magnetic and rotation sensor. They seem to show up as installed as ak8962 devices but apps like 'my android sensors' don't show any data being returned. are they just not actually installed?

thanks
sam

I just picked one up at Kmart for $80 today and am checking things out, trying to see about rooting it. My Hisense Sero 7 Pro tab is rooted and running great with a DoPa custom ROM.
 

gberpa

Senior Member
Nov 3, 2011
114
8
I also purchased one of these and am happy so far. I have a question on the magnetic and rotation sensor. They seem to show up as installed as ak8962 devices but apps like 'my android sensors' don't show any data being returned. are they just not actually installed?

thanks
sam

The rotation of the device changes the screen from portrait to landscape and 'maps', 'Gas Buddy' seems to show the right direction for magnetic north. I haven't had much time to check yet. AAMF, I haven't activated or transferred my number to the 'phone' yet as am deciding if is a 'keeper'. So far, I think it is as I can use WiFi and 'turn off' mobile data by option. Now checking things like battery life in standby.. Haven't found an option to shut WiFi when screen is off like in my JB 4.2.1 and HC 3.1 devices. Only seem to be able to turn WiFi on or off or see an option for airplane mode.
 
Last edited:

samcoinc

Senior Member
Oct 26, 2012
57
4
I agree - the screen rotates (how - I don't know :) ) I would assume gas buddy is using GPS to find north.

sam

The rotation of the device changes the screen from portrait to landscape and 'maps', 'Gas Buddy' seems to show the right direction for magnetic north. I haven't had much time to check yet. AAMF, I haven't activated or transferred my number to the 'phone' yet as am deciding if is a 'keeper'. So far, I think it is as I can use WiFi and 'turn off' mobile data by option. Now checking things like battery life in standby.. Haven't found an option to shut WiFi when screen is off like in my JB 4.2.1 and HC 3.1 devices. Only seem to be able to turn WiFi on or off or see an option for airplane mode.
 

Unkn0wn0ne

Member
Dec 10, 2013
9
4
It isn't looking good so far..

They have tried a bunch of stuff so far.

sam

I'm going to get my hands on the phone soon. I'll proceed to attempt to get a recovery or something compiled for it if I can. First, I'd have to dump the rom and kernel which might require root access, but we will see. Once we have a recovery we can port CyanogenMod over to it.
Also I think I know why it's crashing, but I can't be sure until I can test it out myself.
 

gberpa

Senior Member
Nov 3, 2011
114
8
I'm going to get my hands on the phone soon. I'll proceed to attempt to get a recovery or something compiled for it if I can. First, I'd have to dump the rom and kernel which might require root access, but we will see. Once we have a recovery we can port CyanogenMod over to it.
Also I think I know why it's crashing, but I can't be sure until I can test it out myself.
Wish you luck..just got my replacement unit from TracFone after the first one's screen froze.
 

karmmisht

Member
Nov 17, 2013
8
4
ZTE Valet Z665c - obtaining temporary root

After trying numerous root methods (Bin4ry, Framaroot, ...), I stumbled on a method of getting temporary root using Cydia Impactor. Cydia Impactor appears to be partially successful. First of all, please note that all credit goes to those involved with Cydia Impactor and the discovery of the original exploits (do a search if you want).

This method might seem a little convoluted, but it works reliably for me. Note that I use a Linux machine so you might have to adapt the steps to work on another platform.

Prerequisites:

1. Menu -> System settings -> Developer options -> USB debugging ->Enabled.
2. Menu -> System settings -> Developer options -> Stay awake ->Enabled (to keep the telnet session from going to sleep).
3. telnet (I am running on Ubuntu, but some sort of telnet program is needed).
4. Cydia Impactor
5. phone is connected to your wifi.

Steps:

1. Run the "Cydia Impactor" to "# drop SuperSU to /system/xbin/su". See what happens.

2. It failed for me giving an error related to not being able to remount /system or not being able to create /system/xbin/su.

3. In Cydia Impactor, run "# start telnetd as system on port 2222". You don't need to bother to telnet in. Just let it finish and then proceed to the next step.

4. In Cydia Impactor, run "# start telnetd as root on port 22". Let it finish.

5. Telnet into your phone from a terminal on your computer: "telnet 192.168.1.117 -l root 22". Note that the ip address is likely different on your network, e.g., 192.168.1.xxx.

6. If everything worked OK, you should be presented with a root prompt ("~ #"). I have busybox (obtained from the Bin4ry exploit download) that I adb pushed to /data/local/tmp. The command "/data/local/tmp/busybox whoami" tells me I am indeed root.

OK - now the bad news for me. I proceed to try to install su but remount fails. If I issue the command:

~ # mount -o rw,remount /system
~ #

A root prompt is returned with no error message suggesting that it successfully remounted /system. Woohoo! But a "mount" command (or cat /proc/mounts) says it is still "ro" or read only. Darn. Does it appear that ZTE has crippled the mount command in some way? Now the question is how to permanently install root? I have poked around and at least was able to make a backup to my sdcard using bzip2

This should at least help as a first step. Others including myself have posted elsewhere on this phone. At this point, I'm not willing to risk flashing anything. I'm a noob so I'm hoping someone who is more familiar with the permissions and that sort of thing can complete the root and post a solution.

Thanks.
 

Unkn0wn0ne

Member
Dec 10, 2013
9
4
Awesome!

These findings are great, I'd be willing to check this out soon. (Linux box is down do to hardware issue. :( ).
If we can obtain root the remounting issue can definitely be fixed. Also, does busybox have the premissions to run?
Try this:
Code:
 mount | grep system
That will give you somewhere within the text the partition that is registered as /system . Then:
Code:
mount -o rw,remount [PARTITION-THAT-COMMAND-RETURNED-HERE-MINUS-BRACKETS]  /system
See if that works. But anyways, if it doesn't it can still be rooted! (just temporarily, but it is no longer an 'unrootable' device)

Note: I am not responsible for what happens using those commands.
 
Last edited:

karmmisht

Member
Nov 17, 2013
8
4
a little more info in response to your questions

Dear Unkn0wn0ne,

I had messed around with it and also tried something like you suggested, e.g.:

mount -o rw,remount,relatime,data=ordered -t ext4 /dev/block/mmcblk0p19 /system

Also tried it with the "-n" option to avoid a write to mtab although I don't remember seeing mtab while purusing the file system.

Hadn't noticed that busybox was available under /system/bin:

~ # ls -al /system/bin/busybox
-rwxr-xr-x 1 root shell 1075144 Jul 19 11:20 /system/bin/busybox
~ #

Could be that it has a more limited command set than the one I put in /data/local/tmp. A lot of the commands under /system/bin have a symbolic link to toolbox.

Note that the telnet connection needs to be made over wifi and not the one available over usb. I got the ip address from my router's client list.

Oh yes - thanks for the reminder. Forgot to include the disclaimer about harming the phone or voiding the warranty.

Hope it works out well for you. Glad to hear your encouraging remarks.
 

Unkn0wn0ne

Member
Dec 10, 2013
9
4
Awesome!

Alright so that didn't work. This guy over here has a suggestion (he has scene your thread): - I can't publish links so I'll pm the link to you.

Also if busybox is symbolically linked you'd have to tell it specifically to call to the busybox pushed over via adb to: /data/local/tmp/busybox and not the stock.

In this case: /data/loocal/tmp/busybox/mount

Also the disclaimer is a must. There will always be that person that tries to blame it on someone else.
Note: I am not responsible for whatever happens using the information provided in this post.
 
  • Like
Reactions: karmmisht

Ph0enix_216

Senior Member
After trying numerous root methods (Bin4ry, Framaroot, ...), I stumbled on a method of getting temporary root using Cydia Impactor. Cydia Impactor appears to be partially successful. First of all, please note that all credit goes to those involved with Cydia Impactor and the discovery of the original exploits (do a search if you want).

This method might seem a little convoluted, but it works reliably for me. Note that I use a Linux machine so you might have to adapt the steps to work on another platform.

This should at least help as a first step. Others including myself have posted elsewhere on this phone. At this point, I'm not willing to risk flashing anything. I'm a noob so I'm hoping someone who is more familiar with the permissions and that sort of thing can complete the root and post a solution.

Thanks.

I attempted this myself on my Windows 8 machine. I had to enable telnet, but that was easy. I had to reararange the command to "telnet root 192.168.x.xxx:22" (xxx is my IP). It keeps giving me the error "Connect failed."

Any thoughts out there?
 

samcoinc

Senior Member
Oct 26, 2012
57
4
well the guy in the other thread bricked his it sounds like...

http://androidforums.com/zte-valet/799676-ill-help-find-root-method-if-3.html

They tried to modify the mmcblk0p16 boot image and re-copy it back. It seemed to re-copy but then didn't boot with a verify error.. (I am paraphrasing - and don't really understand what they where doing ;) )

sam


I attempted this myself on my Windows 8 machine. I had to enable telnet, but that was easy. I had to reararange the command to "telnet root 192.168.x.xxx:22" (xxx is my IP). It keeps giving me the error "Connect failed."

Any thoughts out there?
 
  • Like
Reactions: Ph0enix_216

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    ZTE Valet Z665c - obtaining temporary root

    After trying numerous root methods (Bin4ry, Framaroot, ...), I stumbled on a method of getting temporary root using Cydia Impactor. Cydia Impactor appears to be partially successful. First of all, please note that all credit goes to those involved with Cydia Impactor and the discovery of the original exploits (do a search if you want).

    This method might seem a little convoluted, but it works reliably for me. Note that I use a Linux machine so you might have to adapt the steps to work on another platform.

    Prerequisites:

    1. Menu -> System settings -> Developer options -> USB debugging ->Enabled.
    2. Menu -> System settings -> Developer options -> Stay awake ->Enabled (to keep the telnet session from going to sleep).
    3. telnet (I am running on Ubuntu, but some sort of telnet program is needed).
    4. Cydia Impactor
    5. phone is connected to your wifi.

    Steps:

    1. Run the "Cydia Impactor" to "# drop SuperSU to /system/xbin/su". See what happens.

    2. It failed for me giving an error related to not being able to remount /system or not being able to create /system/xbin/su.

    3. In Cydia Impactor, run "# start telnetd as system on port 2222". You don't need to bother to telnet in. Just let it finish and then proceed to the next step.

    4. In Cydia Impactor, run "# start telnetd as root on port 22". Let it finish.

    5. Telnet into your phone from a terminal on your computer: "telnet 192.168.1.117 -l root 22". Note that the ip address is likely different on your network, e.g., 192.168.1.xxx.

    6. If everything worked OK, you should be presented with a root prompt ("~ #"). I have busybox (obtained from the Bin4ry exploit download) that I adb pushed to /data/local/tmp. The command "/data/local/tmp/busybox whoami" tells me I am indeed root.

    OK - now the bad news for me. I proceed to try to install su but remount fails. If I issue the command:

    ~ # mount -o rw,remount /system
    ~ #

    A root prompt is returned with no error message suggesting that it successfully remounted /system. Woohoo! But a "mount" command (or cat /proc/mounts) says it is still "ro" or read only. Darn. Does it appear that ZTE has crippled the mount command in some way? Now the question is how to permanently install root? I have poked around and at least was able to make a backup to my sdcard using bzip2

    This should at least help as a first step. Others including myself have posted elsewhere on this phone. At this point, I'm not willing to risk flashing anything. I'm a noob so I'm hoping someone who is more familiar with the permissions and that sort of thing can complete the root and post a solution.

    Thanks.
    1
    Awesome!

    Alright so that didn't work. This guy over here has a suggestion (he has scene your thread): - I can't publish links so I'll pm the link to you.

    Also if busybox is symbolically linked you'd have to tell it specifically to call to the busybox pushed over via adb to: /data/local/tmp/busybox and not the stock.

    In this case: /data/loocal/tmp/busybox/mount

    Also the disclaimer is a must. There will always be that person that tries to blame it on someone else.
    Note: I am not responsible for whatever happens using the information provided in this post.
    1
    try putty

    Ph0enix_216,

    I tried to connect from a Windows 7 machine and it works using putty for telnet (www.putty.org, a great program). Be sure to set the Connection->Data->Auto-login name to root.
    1
    well the guy in the other thread bricked his it sounds like...

    http://androidforums.com/zte-valet/799676-ill-help-find-root-method-if-3.html

    They tried to modify the mmcblk0p16 boot image and re-copy it back. It seemed to re-copy but then didn't boot with a verify error.. (I am paraphrasing - and don't really understand what they where doing ;) )

    sam


    I attempted this myself on my Windows 8 machine. I had to enable telnet, but that was easy. I had to reararange the command to "telnet root 192.168.x.xxx:22" (xxx is my IP). It keeps giving me the error "Connect failed."

    Any thoughts out there?