• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[ROOT] How to Root the ZTE ZMAX [KK][ALL VARIANTS]

Search This thread

xtremeasure

Senior Member
Mar 29, 2015
253
143
31
Philadelphia
Someone said they had a vibrate when booting and stuck on the boot img, they said they hit volume up or down like three times and it kept vibrating and finally went into android is, idk if you can't get into ftm with volume down + power and use shell or twrp recovery your probably f*Ed, if you even get normal recovery you might be able to DL an ota and try to flash it that's new territory though this is another reason get twrp don't **** around until you have a backup on it

Sent from my Z970
[email protected]:/ # id
uid=0(root) gid=0(root) context=u:r:init:s0
simple root guide
http://forum.xda-developers.com/showthread.php?t=3110178

I wouldn't flash an ota even after a factory restore.... @fire3element tried that when he couldn't get root after a factory restore and it took out his boot.img.. He hit dfu mode with no shell access and was stuck with a stock recovery

Sent from my Z970 using XDA Free mobile app

---------- Post added at 11:05 PM ---------- Previous post was at 11:03 PM ----------

Best advice to give to those that have bricked is either warranty the phone or sit and wait

Sent from my Z970 using XDA Free mobile app

---------- Post added at 11:09 PM ---------- Previous post was at 11:05 PM ----------

Thank you. You guys are awesome.

And so I may learn a little more.

The only way yo fix a hard brick(which is what i have correct). Is to have access to the bootloader?

No a hard brick is hardware related you are soft bricked...as far as the bootloader unlock goes its going to depend on how the unlock works.... I'm going to grab an external SD tonight and see if I can't pull the files needed to get a flash program working if I do it'll be the answer if I don't we are going to need one that's model specific

Sent from my Z970 using XDA Free mobile app
 

volcomleader

Member
Nov 6, 2013
41
1
Daytona Beach, Fl
You mean when trying to get temp root with kingroot?

If so just download 7 different launchers from the play store and run them all at the same time. Make sure you on the system launcher(will just say "launcher" when you hit the home button) and run kingroot do not leave kingroot will it is trying to root.
 

lacidious

Member
May 24, 2015
36
5
I'm gonna clean up the OP with these various methods so that people have options! Thanks :)


Tried everything. Including the antutu option. Nothing working. The one the mine isn't doing is kingroot is not rebooting my system. It just goes all the way through and fails ...no reboot. Don't know if that has anything to do with it. So I just manually reboot ...but no love.
 

volcomleader

Member
Nov 6, 2013
41
1
Daytona Beach, Fl
I wouldn't flash an ota even after a factory restore.... @fire3element tried that when he couldn't get root after a factory restore and it took out his boot.img.. He hit dfu mode with no shell access and was stuck with a stock recovery

Sent from my Z970 using XDA Free mobile app

---------- Post added at 11:05 PM ---------- Previous post was at 11:03 PM ----------

Best advice to give to those that have bricked is either warranty the phone or sit and wait

Sent from my Z970 using XDA Free mobile app

---------- Post added at 11:09 PM ---------- Previous post was at 11:05 PM ----------



No a hard brick is hardware related you are soft bricked...as far as the bootloader unlock goes its going to depend on how the unlock works.... I'm going to grab an external SD tonight and see if I can't pull the files needed to get a flash program working if I do it'll be the answer if I don't we are going to need one that's model specific

Sent from my Z970 using XDA Free mobile app

Here's my guide on how to fix a brick in case something goes wrong...

http://androidforums.com/threads/guide-how-to-fix-a-softbrick.919712/

I can't seem to get past the part where I have to run a bunch of apps. Anyone have ideas?

Tried everything. Including the antutu option. Nothing working. The one the mine isn't doing is kingroot is not rebooting my system. It just goes all the way through and fails ...no reboot. Don't know if that has anything to do with it. So I just manually reboot ...but no love.

If your talking about temp root. Which in sure you are. The phone doesn't have to reboot to get temp root. Try this even if you already have.

1. Uninstall kingroot
2. turn off phone, then turn back on. (Do not reboot)
3. download and install kingroot 4.1 (the English version)
4. download several launchers from the plays store.
5. run all launchers at same time. (Just keep pressing home and switch from launcher to launcher)
6. Switch to system launcher.
7. Run kingroot do not close the app or let the screen timeout.(make sure its set to never in display settings)
8.it should go something like this after you press root.
0%-16% in 3 seconds
16%-70% 5 minutes( % can slightly vary on this part)
70%-100% 3 seconds.
9. Download rootchecker to check root
Your Phone may or may not reboot.
 

web3221

Senior Member
Apr 17, 2010
53
2
thank-you and tmobile business LOGIC,do not get it

:confused:I appreciate all you folks all you are doing to achieve unlocking boot loader for permanent root to the z970, well, PLEASEEEE, keep up the good work, I pray for this every day, and am willing to pay for the permanent root. as I do not even come close to understanding the codes you are sharing, sorry I am a bit ignorant in these areas, I LOOK forward to a solution, thanks for your diligent work to solve all our needs for this great phone.

FYI: read yesterday tmo pulled the phone from the shelves, because of a manufacturing infringement, with another company, I know no details, and yet, I have a direct contact with tmo corporate, and maybe he can enlighten me on this problem, also will discuss with him, the boot loader unlock problem, zmax told me it could be done, however, tmobile was the problem and would allow it. since I have been with tmobile for 15 years, I am looking for a more caring provider, I love them and hate them, there customer service used to be the best on the planet, but not any more......SUCH A SHAMEFUL ATTITUDE FROM US THAT MADE THEM WHERE THEY ARE TODAY, customer service is not about Tmobile, it is about THERE CUSTOMERS. why do you think all there competitors are attacking them for business, please grow up tmobile, keep the prices low, and caress your customers, instead of trying to running over them, trust me the business will come, so get over yourselves, and take over the wireless market
take care
web and bm2

---------- Post added at 09:17 PM ---------- Previous post was at 09:11 PM ----------

:confused:I appreciate all you folks all you are doing to achieve unlocking boot loader for permanent root to the z970, well, PLEASEEEE, keep up the good work, I pray for this every day, and am willing to pay for the permanent root. as I do not even come close to understanding the codes you are sharing, sorry I am a bit ignorant in these areas, I LOOK forward to a solution, thanks for your diligent work to solve all our needs for this great phone.

FYI: read yesterday tmo pulled the phone from the shelves, because of a manufacturing infringement, with another company, I know no details, and yet, I have a direct contact with tmo corporate, and maybe he can enlighten me on this problem, also will discuss with him, the boot loader unlock problem, zmax told me it could be done, however, tmobile was the problem and would allow it. since I have been with tmobile for 15 years, I am looking for a more caring provider, I love them and hate them, there customer service used to be the best on the planet, but not any more......SUCH A SHAMEFUL ATTITUDE FROM them, when we are the people, THAT MADE THEM WHERE THEY ARE TODAY, customer services @ Tmobile, it not about THERE CUSTOMERS. why do you think all their competitors are attacking them for business, please grow up tmobile, keep the prices low, and caress your customers, instead of trying to running over them, trust me the business will come, so get over yourselves, and take over the wireless market
take care
web and bm2
not sure this makes sense, I am old and not as bright as I was in my youth, I did try though :p

---------- Post added at 09:19 PM ---------- Previous post was at 09:17 PM ----------

well I edited the post above cause it made no sense, bear with me please, I am not good at posting on forums, sorry, and take care
 

LochRaven

New member
Jun 3, 2015
1
1
Here's my guide on how to fix a brick in case something goes wrong...

Link to Android Forums

Thank you so much! I recently rooted my device following your instructions and everything went well until I tried installed the Xposed framework using the recovery method. :eek:

I'm having a bit of a hard time following the instructions, however; where can I find the TWRP recovery image?

Nevermind, I see that you linked to it in one of your posts. Thanks, again! I didn't need it though. I went into FTM mode, then held the power button and my phone rebooted normally. Before it kept rebooting.
 
Last edited:
  • Like
Reactions: mingolianbeef

mcandre

Member
May 31, 2007
43
6
Zmax on T-mobile 4.4.2.
Succeeded once, but couldn't install TWRP.
Then always failed to obtain TempRoot with latest Kingroot.
Says that no root strategies available.
As you understand, can't install TWRP.
 

qwikphix

Member
Dec 31, 2010
8
6
got root

thanks for writing this up.

I used this method, but instead of running a crazy amount of apps, i just ran one other besides kingroot, antutu benchmark....it stressed the cpu enough for the exploit to take.
i had to do it about 7 times, but it worked.
 
  • Like
Reactions: psyfer5

Fortis4Eva

New member
Feb 23, 2008
2
0
Hi I'm new to most of this but am technically competent :) I have root on my ZTE ZMAX I have ZTE ZMAX TWRP NEW VERSION 2.8.6.0 installed but I can't get SUPERSU to work I have KINGUSER instead. What can I do to get SUPERSU to work and also can I flash roms with it as is? Oh and I flashed SUPERSU
 

shadow775

Member
May 29, 2015
29
3
Can't write to Sd card

I need some help, I rooted my ZTE Z max but I can't transfer apps/games to the card the move to Sd card option is not there? I used the SD fix but it failed unable to change xml file please help
 

countryboy092782

Senior Member
Aug 3, 2012
56
7
San Marcos, Tx
Rooted Without Issue

Achieved temp. root through Kingroot long enough to install TWRP. After rebooting root was lost. Flashed Chainfire's 2.49 update and had perma-root. Downloaded the restore and switcher .zip files from (I apologize for forgetting the dev. who made those .zip files) androidforums.com and have had zero problems modding my system.
 
  • Like
Reactions: Masterchief87

Masterchief87

Senior Member
Oct 26, 2014
415
256
Fort Myers, Florida
Achieved temp. root through Kingroot long enough to install TWRP. After rebooting root was lost. Flashed Chainfire's 2.49 update and had perma-root. Downloaded the restore and switcher .zip files from (I apologize for forgetting the dev. who made those .zip files) androidforums.com and have had zero problems modding my system.

Lol I made em(I'm no dev though)?
I'm glad it all is going well for you.
 

countryboy092782

Senior Member
Aug 3, 2012
56
7
San Marcos, Tx
Yeah, SLIGHTLY different from the norm of things I've played around with but, nevertheless everything was going great... That is until I managed to delete the os off the phone... right along with the nandroid I had on there as well. Anyone know where to get the stock ROM from? lol!
 

Masterchief87

Senior Member
Oct 26, 2014
415
256
Fort Myers, Florida
Yeah, SLIGHTLY different from the norm of things I've played around with but, nevertheless everything was going great... That is until I managed to delete the os off the phone... right along with the nandroid I had on there as well. Anyone know where to get the stock ROM from? lol!

How did you delete the os? If you have the boot.img and twrp switched out for system rw, twrp will give you a "no os installed" warning. This is a false alarm. Unless you actually remember deleting the os. Try booting your phone both normally and with the power & volume up combo and see if you can get into android.

---------- Post added at 03:12 AM ---------- Previous post was at 02:51 AM ----------

If you really do need a stock rom I got you though. http://androidforums.com/index.php?threads/921272/
 

countryboy092782

Senior Member
Aug 3, 2012
56
7
San Marcos, Tx
Alright the truth is, it is my ex-girlfriend's phone. While trying to teach this woman the slightly different operations to modding her system, she managed to place an "X" in the box next to System when wiping Dalvik, Cache, etc... even though I clearly instructed her not to do so. Thank you for the download. I guess the old saying still goes... "You can't fix stupid", can ya?! lol!
 
  • Like
Reactions: Masterchief87

Top Liked Posts

  • There are no posts matching your filters.
  • 26
    Yep, you read that right and I'm not trolling. THE ZMAX IS ROOTED!!

    Discaimer and N00Bproof warning:

    We have root, yes, but that doesn't mean get hasty. At the moment, there are partition images (system, boot and recovery) in my and other users' possession (free of access to all), but we don't have a working recovery at the moment and this process involves deleting the stock recovery (it will make sense later). So, if you screw up and get root-happy, there's no way to recover until we get a recovery and a custom rom, and even then you might be screwed because we don't have access to the bootloader to use fastboot. Things may change, but root-use with caution.

    Also, once you root, DO NOT TAKE ETAs from T-Mo and ZTE!!!!!!! Now that we have root, we can capture the OTA and make it root-friendly. To make a long story short, the updater-script (thing that tells your recovery where and how to flash stuff) has a list of stuff it has to... well... flash. If you, for example, delete the stock ZTE Music app, and the ETA replaces the app with a new version, it's going to stop (because the script requires a REPLACEMENT and not a PLACEMENT, computers don't have the best common sense), then it will interrupt and you will likely be bricked. This shouldn't be a problem because you don't have a recovery to begin with, but I'm not taking chances here.

    NOW! Let's Root. This is a long process, so don't expect to do anything for a good 10-20 minutes.

    FIRST: KINGROOT​

    This is one of those things where your mileage may very, there have been many different ways to get KingRoot (not King"O"Root, two different apps) to work, but this one was the one that worked for me. I'll also place alternate KingRoot methods in the second post if you wanna try those. Just for the sake of knowledge, this was run on a T-Mobile ZTE ZMAX, Android 4.4.2, build 22. I don't know if it makes a difference that I factor reset my phone before doing another round of root attempts (not this one specifically, maybe a couple hours worth of attempts).

    Credits to @fire3element for this method.

    1) Download KingRoot APK from here (the first one with the image of the phone if you are on the desktop site).

    2) Install KingRoot and run it. It will restart the phone, and it will fail (or, if you have some Android God luck, it may succeed), this is supposed to happen.

    3) Clear KingRoots cache and data (in that order) and power off the phone (not reboot). Then, power it back on again.

    4) Now this is where things get... well complicated for this part. You are going to need to load your RAM with a bunch of processor heavy stuff. The person that made this method used CounterSpy and Final Fantasy Type-0 in the PPSSPP v1.0.1-411 emulator, but for those of you that don't have access to that, get creative and load up. Here is what I had running (all at the same time, mind you).

    Note: Force Stop Task Manager in the app settings first or it will purge to free memory automatically and this won't work.

    1. Next Launcher Lite
    2. Apex Launcher
    3. Nova Launcher
    4. Cheetah Launcher
    5. CM Launcher
    6. Mi Launcher
    7. 25 tabs on Google Chrome (No joke)
    8. Both Temple Runs
    9. Fruit Ninja
    10. Google Play Store
    11. Google Now
    12. Google Play
    13. Amazon
    14. Google Play Music

    Mine was definitely a bit extreme but I knew all of this stuff would guarantee a good memory hogging.

    5) Run all of your apps at the same time. The TL;DR for this is that apparently it's some exploit that the app uses as a buffer overflow. Now, go to settings and Force Stop KingRoot. Then Run it again. If it works, you should go from 0 to 100 real quick (no pun intended). It shouldn't progess slowly or reboot the phone to do this, but your journey does not stop here.

    If you did it correctly, the screen from a successful root will have a green checkmark. Run RootChecker to verify root status.

    SECOND: PERMA-ROOT

    Now you need to permanently root the phone. This method was all @jcase, and simplified by another user. I encourage you to read JCase's original G+ post to learn something, as this guy is the master of exploits, and we are on XDA to learn.

    Credits to @xtremeasure for the simplification of JCase's process.

    1) Plug phone into computer...

    2) Open cmd type "adb shell" (without quotes, moving forward, type all commands without quotes). This will open a terminal for the phone.

    3) While in ADB Shell, type "su" to gain root shell privileges


    4) Type "getprop ro.build.fingerprint"

    Output for that command should be...
    zte/P892T57/draconis:4.4.2/KVT49L/20140804.141306.18686:user/release-keys (the part with P892T57 may be different depending on what model ZMAX You have). If you haven't updated that number will be different, this ok, just replace the number in the next command with whatever your output is.

    5) type "setprop persist.sys.k P892T57"

    6) type "getprop persist.sys.k" and your output should be your build number

    7) type "cd /dev/block/platform/msm_sdcc.1/by-name/" to change directories so that we can back up your recovery image (remember I said something about that?) and set the boot to our recovery partition.

    8) type "dd if=recovery of=/sdcard/recovery.img" to backup the recovery image.

    9) type "dd if=boot of=recovery" to set recovery as boot. Another TL;DR is that this disables the write protection set by the stock recovery, allowing you to write to the system. It will mount the /system partition upon boot.

    DELETE KINGUSER NOW

    10) type "reboot recovery" and restart your phone. YOU MUST RESTART WITH THIS COMMAND!!!!! It will boot straight into Android, this is good, that means you haven't screwed up anything.

    11) Reopene the adb shell (using "adb shell") in your command prompt or terminal (for OSX and Linux) and type "Id". If your output is "uid=0(root) gid=0(root) context=u:r:shell:s0" then It worked...

    12) Remount system as writable "mount -o rw,remount /system"

    13) Manual install for supersu you can get that here: http://download.chainfire.eu/supersu

    14) Type "exit" into the terminal/command and it should drop you back to your normal cmd...unzip the su zip anywhere you want in your cmd switch to that directory...

    14B) I advise taking the "su" binary and "install-recovery.sh" file from the superSU folder you downloaded and putting them in the same place (on the desktop or wherever your adb.exe is if you didn't set $PATH on your computer). su can be found in the "arm" folder and install-recovery.sh can be found in the "common" folder. It is important to note that where ever your files are, you will have to type that path (if it isn't in the same directory as your adb). So, as an example, I put mine on the desktop, so I have to type "adb push ~/Desktop/su /data/local/tmp/su". If you do not know how to do that, then stop what you are doing and research it, as that's just too much to explain.

    15) "adb push su /data/local/tmp/su"

    16) "adb push install-recovery.sh /data/local/tmp"

    17) Reenter adb shell with "adb shell"

    18) Make sure system is mounted writable with "mount -o remount,rw /system"

    19) Move the so files into place with these commands

    "cat /data/local/tmp/su > /system/xbin/su"

    "cat /data/local/tmp/su > /system/xbin/daemonsu"

    "cat /data/local/tmp/install-recovery.sh > /system/etc/install-recovery.sh"

    20) Give them all permissions

    "chmod 755 /system/xbin/su"

    "chmod 755 /system/xbin/daemonsu"

    "chmod 755 /system/etc/install-recovery.sh"

    21) Reboot your phone to complete install with "reboot"

    22) After rebooting go into the play store and install the supersu app. It's going to tell you the su binary is out of date to fix that we need to open the adb shell on our pc again with "adb shell"

    23) Reboot into recovery (you're really rebooting the system with r/w privileges) using "reboot recovery"

    24) Once rebooted open the app and update your binaries one finished reboot add your done 100% perm rooted

    Now, you are rooted! If you did everything right, you should be good. Now people are going to ask, "Is there a script for this?" The short answer is No, don't hold your breath for something immediate. There was a user that said he would be happy to make one for the second half, but the writing, testing and verification of success alone on that will take some time, as the wrong line of code can make you end up with a good old fashioned paperweight. I can verify Xposed works fine, Viper4Android works fine, and if you try to delete system apps, they will just reinstall themselves (I recommend using "System App Remover (ROOT)" on the play store, as it will actually tell you which apps are and aren't safe to install. If you have any questions, after searching of course, feel free to ask. If I can't answer, some freaking body can lol.

    CREDITS:
    @tech_yeet for showing us the KingRoot
    @jcase for his amazing work
    @xtremeasure for his method
    @fire3element for his method
    @the zMAX Community for staying dedicated when the going got tough, it's been a long road. Here's to custom roms and a TWRP recovery!

    Please share this with others, as there is a big community of people begging for this info, let's share the love :). If I forgot to credit you, let me know and I'll fix that!

    ADDITIONAL INFORMATION
    If you by some chance flash the TWRP Recovery Image (found in post 2), and would like to revert back to root ability (being able to write to system). Please follow the steps below:

    1. cd /dev/block/platform/msm_sdcc.1/by-name
    2. su
    3. dd if=/sdcard/recovery.img of=recovery
    4. reboot recovery

    Please make sure you have the recovery in your sdcard root folder.
    9
    Alternate Root Methods and ZTE Custom ROMs/Kernels/etc

    If the above first part doesn't work for you, you can find alternative root methods

    Alternate Method 1 HERE

    Alternate Method 2 HERE

    As I see more added, I'll add them here.

    CUSTOM STUFF

    TWRP Image for ZTE ZMAX
    6
    That's a whole lot to swallow but I'm glad to see y'all can finally get rooted. Definitely not a method for noobs or the faint of heart but its a HUUUGE step in the right direction. Thanks to everyone responsible for this.
    5
    Q&A/Other [UDPATED MAY 13, 2015 @ 5:45PM]

    If A question is asked and you feel like it needs to be here, please tag or DM me with the Q AND THE A so that I can do so.


    OTHER:

    Original Discussion Thread for the ZTE ZMAX

    Please see fire3element's post on what each screen in the KingRoot app means

    WHAT THE SCREENS MEAN IN THE APP
    3
    I am stuck on step 15 I put all folders from the zip file onto the desk top and in the cmd I put this adb push ~/Desktop/su /data/local/tmp/su but ti says there is not such directory ?

    Use this method instead. This root guide says for the z987 but it is the same exact method as the z970.
    http://androidforums.com/index.php?posts/7037139