[A2017G]Finally! Disable System Write Protection in Oreo B02

[GodOfPsychos]

Disclaimer: Untested on the following devices:
-A2017U on Oreo B20
-A2017 (chinese version) Oreo B18
-A2017G B03
If you want to test, do so at your own risk!
If it does or does not work, please report back on this thread so i can edit the OP

Yes you read right, finally we can get rid of that nonsense system write protection and get system write permissions on Oreo back!


For those that are eager to know how to do it before i go on mumbling a story about the technical details yada yada yada:
Download this TWRP flashable zip by @raystef66 and flash it: https://androidfilehost.com/?fid=11410963190603874735
Now you have disabled ZTE's protection and got system write permissions (if you are rooted of course, if not then there is still androids native protection; more info on that matter below)
Huge thanks to @raystef66 for creating the zip.

Now to the technical stuff:
As you probably know, since Oreo we can't use "reboot disemmcwp" anymore. Thats because ZTE removed this option.
Why did they do this?
I don't have any idea

Does it make sense?
No, not at all. It doesn't even make sense for ZTE having this write protection implemented in the first place. Why not you ask? Because android itself already has its own native system write protection. If you are not rooted, system is write protected, it's as simple as that. After all, the whole point of rooting your device is to get system access so you can make all kinds of modifciations to your device that wouldn't otherwise be possible without root. Be it simple file edits (build.prop), xposed/magisk modules or any app that requires root and so on.

So what does the zip above do to disable system write protection and give write permissions to system?
To put it simply. The file inside it (emmc_appsboot.mbn) contains various lines regarding system write protection, fastboot etc. Some of those lines are for disabling system write protection. If you flash the zip, it gets disabled.
The original emmc_appsboot.mbn file that comes with the Oreo OTA, doesn't contain these lines. Instead it makes sure that system write protection is intact. Therefore, even if you are rooted, you won't be able to do any modifciations to system (they revert back after reboot).

Can you re-enable ZTE's system write protection?
Nope. Why would you even wanna do that?! Again, android has it's own system write protection (see "Does it make sense?" above). If you want that back, simply unroot.

Wait, you mentioned there are also lines for fastboot in that emmc_appsboot.mbn file, what about that?
Well yes, as mentioned earlier there are some lines regarding fastboot. But i'm unsure of one thing as of now. Was fastboot unavailable in Oreo B02 to any of you guys? If yes, then you should get also fastboot back after having flashed the zip. I could enter fastboot mode when selecting it in the unlocked bootloader warning screen. I forgot test it before disabling system write protection so i am not sure if it already was accessible or got enabled after flashing the zip.

 

[raystef66]

@GodOfPsychos Thanks for your perseverance :good:

 

[Rennert]

Thanks, I will test it on B02. I had install an old Bootstack for write permissions on B02.
On B03 can't flash a working TWRP

 

[totmakina]

I can not install the b03 by edl adding it to the TWRP file for oreo. When trying to restart in twrp the phone turns off. I can not find the solution Therefore I can not flash anything else either.
I'm going to try the Chinese rom Oreo B19.
Thanks for everything! I hope that in the B19 we have good results

In the B19 for the a2017 after starting in EDL the system and rebooting in TWRP installing magisk 16.7 and after the zip I have found that the system only starts in fastboot.
I will continue testing

 

[blackpac]

@GodOfPsychos @raystef66 On the assumption it does not work on B03/B18/B19/B20, can it be implemented on their original emmc_appsboot.mbn?

 

[Rennert]

have tested on Oreo B03 and works. on B03 can only use TWRP 3.2.1-7NFound, but have no access to internal memory.

on B02 and B03 in system/priv-app i can´t delete top folder, inside folder have fully access. in system/app no problems.

 

[GodOfPsychos]

@GodOfPsychos @raystef66 On the assumption it does not work on B03/B18/B19/B20, can it be implemented on their original emmc_appsboot.mbn?

That depends. The file itself is not 100% readable via simple notepads (i looked into it with notepadd++ for example). It has a bunch of strange characters besides the bit of clear text. I don't know how or which lines need to put where and how etc. I know i said there are lines regarding disabling write protection in there etc. But the main issue is that not all of the file is fully readable. So there could be even more "unreadable" stuff (weird characters) that need to be taken into consideration besides the readable ones.
See attachment to see what it looks like when you open one of them with notepad++

But yes in theory it is possible if ZTE doesn't change the implementation of their protection.
I hope that anyone who is more of an expert for this sort of stuff can help with this.

 

[GodOfPsychos]

have tested on Oreo B03 and works. on B03 can only use TWRP 3.2.1-7NFound, but have no access to internal memory.

on B02 and B03 in system/priv-app i can´t delete top folder, inside folder have fully access. in system/app no problems.

which top folder do you mean? inside system/priv-app i can delete folders without a problem (using root explorer for example).

 

[Rennert]

which top folder do you mean? inside system/priv-app i can delete folders without a problem (using root explorer for example).

Yes top folder inside System/priv-app, example calendar_stock, can't delete it, but apk and subfolder inside this folder can delete without problems. It's only on priv-app folder, all other folders no problem.

 

[GodOfPsychos]

Hmm. Are you trying to delete them via twrp file manager or an app like i mentioned previously?

 

[alwynjoshy]

Noob question whay you guys are booting to reboot disemmcwp,could anyone explain this method usage

 

[Rennert]

Hmm. Are you trying to delete them via twrp file manager or an app like i mentioned previously?

I use Root Explorer, can create new folder and delete this in priv-app. in TWRP file manager I can't delete folders, only files.

 

[raystef66]

@GodOfPsychos @raystef66 On the assumption it does not work on B03/B18/B19/B20, can it be implemented on their original emmc_appsboot.mbn?

First off, anyone on Oreo U and Oreo CN have to flash the zip and see if he/her can change f.e. build.prop (add a character), save and reboot and see if change has applied. Also test if system folder can be deleted, reboot and see if things boot. If not working i'll take a look into the changes ZTE made and see if I can change some lines into the aboot file. So let me know

have tested on Oreo B03 and works. on B03 can only use TWRP 3.2.1-7NFound, but have no access to internal memory.

on B02 and B03 in system/priv-app i can´t delete top folder, inside folder have fully access. in system/app no problems.

3217 will do. Have you tested the 3218 too?

Yes top folder inside System/priv-app, example calendar_stock, can't delete it, but apk and subfolder inside this folder can delete without problems. It's only on priv-app folder, all other folders no problem.

Normaly you should be able to delete a system folder. It's been tested. Use a Root explorer like Solid and it should work. On B02 it was.

 

[Rennert]

Normaly you should be able to delete a system folder. It's been tested. Use a Root explorer like Solid and it should work. On B02 it was.

I can delete all folders in system, but can't delete the top folders in priv-app. Tested on B02 and B03. Have removed in TWRP terminal with rmdir and works

 

[klałn]

I can delete all folders in system, but can't delete the top folders in priv-app. Tested on B02 and B03. Have removed in TWRP terminal with rmdir and works

I haven't any problems with deleting folder under /system/priv-app using MiXplorer on B03.
I tested A2017G.B03 and A2017.B19. Both of them were flashed using EDL full packages by djkuz.
Tested with b20 modified kernel (by Asderdd), Disable_Dm-Verity_ForceEncrypt_12.08.2018 (by zackptg5) and Magisk 18.0.
Haven't any issues. /system is writable and Magisk is working.
Thank you raystef66.
Does that mean we may expect SL!M 7?

 

[Rennert]

Magisk 18 doesn't work on A2017GB02 and B03.
Yes system is writable except system/priv-app/ top folder, it's funny that I can create new folder and delete this and
existing top folders are fails.

 

[klałn]

Magisk 18 doesn't work on A2017GB02 and B03.
Yes system is writable except system/priv-app/ top folder, it's funny that I can create new folder and delete this and
existing top folders are fails.

Just tried and deleted every folder in /system/priv-app/. Couldn't take a screenshot after that. :cyclops:
What kind of root do you have?

 

[raystef66]

I haven't any problems with deleting folder under /system/priv-app using MiXplorer on B03.
I tested A2017G.B03 and A2017.B19. Both of them were flashed using EDL full packages by djkuz.
Tested with b20 modified kernel (by Asderdd), Disable_Dm-Verity_ForceEncrypt_12.08.2018 (by zackptg5) and Magisk 18.0.
Haven't any issues. /system is writable and Magisk is working.
Thank you raystef66.
Does that mean we may expect SL!M 7?

The one that had close contact with ZTE was @GodOfPsychos . All credits go to him
Thnx for reporting also thnx @Rennert

That would be the idea of making a Sl!M one even for U and CN, yes. Hope to find some time free :highfive:

 

[Rennert]

Just tried and deleted every folder in /system/priv-app/. Couldn't take a screenshot after that. :cyclops:
What kind of root do you have?

have Magisk 16.7. if i flash Magisk18 it only boot in Bootloader. Flash 16.7 now system boots.

issue on priv-app folder solved. i had install Viper4AndroidFX in Magisk, deinstall and can delete top folder. new install and delete are fail.

 

[totmakina]

have Magisk 16.7. if i flash Magisk18 it only boot in Bootloader. Flash 16.7 now system boots.

issue on priv-app folder solved. i had install Viper4AndroidFX in Magisk, deinstall and can delete top folder. new install and delete are fail.

I've tried several things in Chinese b19: flashing rom by edl and booting with recovery twrp 3.2.1.7. then flashing dm_verity and your zio. In no case I succeed. maximum achievement that I boot in fastboot I do not achieve that. I started flashing magisk. Always in bootloop