Anyone know how to Root ASUS Zenpad 10 (Z300C)?

Search This thread


New member
May 26, 2021
Hi everyone, I tried to follow the root procedure but adb always remains with the message Waiting for any devices. Adb driver installer says the drivers are installed. How can I go out of this block?

Top Liked Posts

  • There are no posts matching your filters.
  • 29
    ROOT for all ZenPad based on Intel Atom x3 SoFIA

    I do not own, but have found how to get root for ZenPad C 7.0 (z170c/z170cg), it works on ZenPad 10 (z300c/z300cg).
    I see no reason to write a lot, this method is simple like a log. The script borrowed from casacristo, other changes can be noticed after unpacking using diff, kdiff, meld, etc.
    Russian community is already using root for a week.
    ZenPad C 10:
    ZenPad C 7.0:
    How to install:
    Reboot to fastboot (POWER + VOLUME UP) or adb reboot fastboot and execute commands:
    fastboot oem unlock
    fastboot oem unlock confirm
    fastboot boot root.img
    or (thx @himasura):
    fastboot oem asus-go
    fastboot oem asus-go confirm
    fastboot boot root.img
    Then install SuperSu.
    if there are problems with adb and fastboot, try attached to this post.

    If you do not understand, try to follow the instructions from @reaktor TuT

    Attention: ROOT-script renames /system/bin/app_process32 and puts in its place a symlink. If you do fastboot boot root.img more than once, Android will not be able to boot and will need to restore the firmware. This issue is fixed in root-v2.img
    Attention2: some users instead of ROOT gets corrupted firmware (the reasons are not known to me). Think whether the risk is justified and how you will restore your device?
    Attention3: before installing the OTA-update, you must uninstall the ROOT (SuperSu -> Settings -> Full unroot). Otherwise possible bootloop!
    [/B]Asus Zenpad 10 Z300C Rooting Guide (Windows 10) Try At Your Own Risk

    I am currently running Japanese Firmware V4.6.0.0 (can anyone tell me if WWE firmware will work on Japan model?)

    Step 1: Download root kit from

    Step 2: Open '' and install ADBDriverInstaller.exe
    Plug in Zenpad 10, then go to Device Manager and delete/remove any drivers related to Zenpad 10.
    Unplug Zenpad 10
    Follow instructions in
    First go to Start Menu / Settings / then Update & Security / Recovery and then Advanced Startup / Restart Now. You should then be able to follow the instructions in
    After PC restarts immediately plug in Zenpad 10 then open ADBDriverInstaller.exe. When you can see the device in the main window, click INSTALL in bottom right corner. Follow prompts to install drivers.
    Unplug Zenpad 10.

    Step 3: Restart computer and run 'adb-setup-1.4.3.exe'
    Select YES to install ADB and Fastboot.

    Step 4: Plug in Zenpad 10. Shut down Zenpad 10 after 60 seconds so that Windows sees it correctly.
    Hold down POWER + VOLUME UP to start Zenpad 10 into Fastboot Mode.
    Go to C:\\adb Folder. Hold SHIFT and Right Mouse Click while in adb folder then select 'Open Command Window Here'
    In DOS window you just opened type: fastboot devices. You should see a number followed by 'fastboot'. The number means your tablet can be seen by Fastboot.

    Step 4: Unlock Bootloader
    In DOS window type: fastboot oem unlock
    Then type: fastboot oem unlock confirm

    Step 5: Install New Boot Image
    Make sure to copy 'root-z300c_cg.img' to your ADB folder.
    In your DOS window type: fastboot boot z300c_cg.img
    The new boot image file should be pushed to your Zenpad 10.
    Unplug and Reboot Zenpad 10 normally.

    Step 6: Install SuperSu app from Google Play Store. Follow instructions to install Root.
    You now have root!

    Be aware that this tablet is a bit of a slug. Sometimes it takes a minute or so for apps to ask for Root Permissions. You can alwats go to SuperSU app to hurry the permissions process.

    Don't hesitate to ask if you get stuck or if you want to suggest any changes to these instructions.

    Thanks to the Russians who worked this out.
    How to restore Z300C/Z380C firmware

    How to restore Z300C/Z380C firmware

    Supported only WW SKY version!
    See experience: @reaktor TuT installed WW SKY firmware on the Japanese version of the tablet.

    Available original firmware for Z300C / Z300CG / Z300CL / Z380C models. It is easier to recover than the method described below.

    Keep in mind that the recovery is done with the ADB. During mod-recovery on the tablet screen will bootlogo. But I created a few scripts to ease the process. At the command of adb shell info you will see a mini-help.

    1. Boot the device in fastboot mode hot keys (POWER + VOLUME UP) or:
    adb reboot fastboot
    Make sure that the device can be seen in the list:
    fastboot devices
    In severe cases, you may need to hard reset (contents of internal storage will be lost). To do this, you can go into stock recovery (POWER + VOLUME DOWN) and select wipe data/cache, or perform it in fastboot mode:
    fastboot format cache
    fastboot format userdata

    2. Flash mod-recovery-z300c.img
    fastboot boot "C:\adb\mod-recovery-z300c.img"
    after about ~10 seconds will access via adb shell, but after about ~30-40 seconds adb shell disappear and the device reboots or freezes. During this time you should have time to enter three commands:
    adb push "C:\adb\mod-recovery-z300c.img" /
    adb shell flashrecovery mod-recovery-z300c.img
    adb reboot recovery
    If you do not have time, try again (you can copy and paste from the forum on the command line). I have no way to solve this problem, so if you do not have time to conduct all of the commands for ~30 seconds, just create a BAT/CMD/sh-script and run it.
    If your device is frozen, it can be turn off by holding the power button for more than 10 seconds

    3. Now, with mod-recovery is possible to install the firmware as from the official site ASUS (tested 4.6 и 4.7 for Z300C, with later versions can be a problem).
    Sign in mod-recovery: adb reboot recovery or hot keys (POWER + VOLUME DOWN).
    Put the file to SD-card via a card reader. Or in any other place via adb push:
    eg internal storage:
    adb push "C:\adb\" /data/media/0/
    or external storage:
    adb push "C:\adb\" /sdcard/
    "adb push" copies the for about ~ 10 minutes.

    4. You can then start the installation of the update, eg:
    adb shell updatezip /data/media/0/
    adb shell updatezip /sdcard/
    The progress bar is absent and you will see something like this:
    The update takes about 10 minutes, then a notice of completion of the installation appears.
    The firmware will be fully restored, including the stock recovery.

    5. If you want, you can immediately install ROOT, but for some users the firmware again breaks (the reason is not clear to me), so I recommend to install ROOT after booting in Android.
    adb shell root

    Reboot in ANDROID:
    adb reboot
    adb shell reboot

    @jphi35 said that everything would be fine if you before adb shell root first make a hard reset (the contents of the internal memory will be deleted):
    fastboot format cache
    fastboot format userdata

    If you do not need to restore the firmware and you want only ROOT . . .

    Linux-users might have to run commands with elevated privileges:
    sudo adb kill-server
    sudo adb shell
    sudo fastboot devices

    Perhaps you have a question: Why is everything so difficult? Maybe it is easier to make TWRP?
    Answer: The Russian community 4pda several developers have compiled several options TWRP, but so far no one has managed to make it work.

    If something does not work then useful to get acquainted with the experience to restore of @Emil Borconi

    How to restore other ZenPad model (based on Intel Atom x3 SoFIA):
    Following the instruction of url:// I managed to achieve a root account in an adb shell. However, it was quite an effort to achieve this. If somebody is interested I try to summarize what I did. Of course, this is a starting point only to finally root this tablet.

    1. Download and extract the firmware from the ASUS site
    I used the WW variant: url://

    2. Extract boot.img from fmu_image.bin
    To find the offset of the boot image inside fmu_image.bin I used
    strings -a -t d fwu_image.bin | grep ANDROID!
    The line number is then the offset (bs) for dd
    dd if=fwu_image.bin of=boot.img bs=14995456 skip=1

    3. Unpack boot.img
    unmkbootimage boot.img
    unmkbootimage reports the memory addresses
    *** WARNING ****
    This image is built using NON-standard mkbootimg!
    OFF_KERNEL_ADDR is 0x00800000
    OFF_RAMDISK_ADDR is 0x00400000
    OFF_SECOND_ADDR is 0x00700000
    Please modify mkbootimg.c using the above values to build your image.
    and the recompile instructions
    To recompile this image, use:
    mkbootimg --kernel zImage --ramdisk initramfs.cpio.gz --base 0x0 --cmdline 'idle=halt androidboot.hardware=sofia3g nolapic_pm firmware_class.path=/system/vendor/firmware nolapic_timer x86_intel_xgold_timer=soctimer_only vmalloc=256M slub_max_order=0 build_version=3 debug notsc' --pagesize 4096 -o new_boot.img

    4. Add rootsh and pack insecure_initramfs.cpio.gz
    By the instructions in the reference posted in the introduction create insecure_initramfs.cpio.gz

    5. Repack by mkbootimage
    Before mkbootimage can be started its source code must be patched as indicated by unmkbootimage. I changed the following lines in mkbootimg.c to
    uint32_t base = 0x10000000U;
    uint32_t kernel_offset = 0x00800000U;
    uint32_t ramdisk_offset = 0x00400000U;
    uint32_t second_offset = 0x00700000U;
    After compiling mkbootimage the new image file can be created as suggested
    mkbootimg --kernel zImage --ramdisk insecure_initramfs.cpio.gz --base 0x0 --cmdline 'idle=halt androidboot.hardware=sofia3g nolapic_pm firmware_class.path=/system/vendor/firmware nolapic_timer x86_intel_xgold_timer=soctimer_only vmalloc=256M slub_max_order=0 build_version=3 debug notsc' --pagesize 4096 -o insecure_boot_su.img

    6. Load the image and disable SELinux
    In fastboot mode the new image could be transferred by
    fastboot boot insecure_boot_su.img
    However, it seems that SELinux prevents running rootsh. Thus I disabled SELinux by androidboot.selinux=disabled using the -c flag of fastboot.
    fastboot boot insecure_boot_su.img  -c 'idle=halt androidboot.hardware=sofia3g nolapic_pm firmware_class.path=/system/vendor/firmware nolapic_timer x86_intel_xgold_timer=soctimer_only vmalloc=256M slub_max_order=0 build_version=3 debug notsc androidboot.selinux=disabled'

    After starting and
    adb shell
    I got root by running
    /sbin/rootsh +p

    7. Placing files in /system/bin
    I was not able to remount /system in rw-mode, even with root. So i modified the entries for /system in the fstab files in rootfs from ro to rw and generated a new boot image. So I was able place su in /system/bin by the help of rootsh and even could run it. However, the supersu app always wanted to update the su file and was not able to successfully run this app.

    Note on fastboot on Linux
    fastboot on Linux did not recognize the tablet (adb did). To fix this I had to recompile the fastboot source using the usb_driver.c from urls:// Additionally, I modifed the udev rules to
    ACTION=="add|change", SUBSYSTEM=="usb", \
      ATTRS{idVendor}=="18d1|8087", ATTRS{idProduct}=="4e30|4e40|4ee0|0912", \

    Final remarks
    This is just an illustrative approach which could be used a starting point to finally root the tablet. I am not sure how to deal with SELinux in a nice way and even have no idea to get the supersu app running.
    Hi all,

    I just rooted my Zenpad 10 on Windows 10 :D
    I'll write a guide shortly, just waiting for a file hosting account to become available.