ZTE Zmax Pro Forum

Root ZTE Zmax Pro Official Root Discussion

This thread is all about rooting the ZTE Zmax Pro and will be updated with the newest information related to rooting the device.

As of now, there is no way to root the Zmax Pro yet.

Right now Messi2050 is working on root and is very close to having it. He needs beta testers. If you don't care about bricking your device PM him and ask to join the hangouts.



#1 anubis2048, Jan 14, 2017 Last edited: Feb 9, 2017
Thanks for this;)
Stuck this thread, and here is a link to the old thread for a lengthy read.

To all members who post here, please keep it civil and ON TOPIC!

If you want to discuss an off topic root discussion, post here:

Off topic posts here will be moved, or deleted without notification.

Thanks :)
#2 Mikestony, Jan 14, 2017
Thanks for the sticky.
Moderators have my full permission to update the original post if new information becomes available about root and I do not update it within 24 hours. The goal of this new rooting thread is to stay organized and on-topic. Hopefully things will go much better this time around.
#3 anubis2048, Jan 14, 2017
Thank you for this @Mikestony and @anubis2048 :).

Much, much appreciated (and long overdue) :).
#4 scary alien, Jan 14, 2017
I should have suggested this sooner... But at least we have this now.

Anyway, I applied for the beta program. I really hope they add me. I use my phone for internet so I have to jump through loops and bounds to get tethering un-detected since my Zmax isn't rooted. @messi2050 Do you know how to work on ROMS? Perhaps we could look into porting CM to the Zmax if these beta updates have Fastboot access.

I really hope we can get a port of CM on 6.0 and not Nougat. No Xposed on 7 yet?!?! Disgusting!
#5 anubis2048, Jan 14, 2017 Last edited: Jan 14, 2017
Couple other things I noticed and remember you guys trying:

1. Settings -> Developer options -> OEM unlocking (Allow bootloader to be unlocked) has NO (apparent) effect on unlocking the bootloader or accessing it via the fastboot utility

2. Access to the bootloader via the fastboot utility does NOT appear to work (it looks like this device has DFU or FTM mode?)

3. @hroark13's "reboot disemmcwp" command does NOT appear to be fruitful

That's all I have for now...
#6 scary alien, Jan 14, 2017
AFAIK OEM Unlocking just disables certain security measures in the event that you do flash a custom recovery. My Galaxy S4 had this issue, if you did not enable OEM Unlock then it would either brick the phone when flashing or just fail to flash. I think that is there to prevent people from flashing stolen phones that have a passcode.

I updated the original post to reflect this information. Thanks for telling me, I forgot all about it.

Yes, it does have FTM mode. There is no official flashing software that I know of. I wouldn't trust the same utility that is used on the Axon 7. We have no idea how different these phones are and I would not risk bricking it.
#7 anubis2048, Jan 14, 2017 Last edited: Jan 14, 2017
Yeah, I'm sure the reason for this is exactly that.

On the Nexus (and Pixel) devices, you can't use fastboot oem unlock (or the other command/syntax variations) if you don't enable that toggle in the Settings -> Developer options menu despite the fact that the device itself that the devices are inherently unlockable (a lot of folks didn't / don't know about the tie-in and dependency with this).
#8 scary alien, Jan 14, 2017
Yeah, Apple and many popular Android phone manufacturers are taking measures to stop theft. With Android 6.0 and up you can even lock the phone at the bootloader with a password. I don't even think you could get into FTM if you don't have the password. Android 7.0 actually encrypts a ton of files on the fly and uses a different partition scheme, which is why Xposed isn't ported to it yet.

Let's stop here though, we need to keep this about root hahaha
#9 anubis2048, Jan 14, 2017
Yes, indeed--my apologies.

Back on-topic: There was also a lot of discussion about replacing signing keys in an OTA .zip or otherwise flashable .zip and trying to get the (stock) recovery to be tricked. This is highly unlikely to work unless you can actually sign the .zip with the manufacturer's keys.
#10 scary alien, Jan 14, 2017
Master Signing keys are obtained, but will not do us ANY good. TLDR; ZTE uses a cell on the mobo to hold a 2048 bit key.

Source: original root thread page 69 top post
#11 GrifterGrifts, Jan 14, 2017
Hmm, well if the manufacturers keys were available and you could sign a .zip file, it should flash / install from an adb sideload and you'd have total access to the device.

I see the post you referenced but I'm a bit skeptical that the keys mentioned were the true master ones.

Has anyone actually tried to sign a .zip file with said keys and flash through an adb sideload?
#12 scary alien, Jan 14, 2017
Are you familiar with pgp keys there is a public and private key the public key encrypts it and the private key reads it unless we could get that private key we have nothing IF I've read into that correctly
#13 GrifterGrifts, Jan 14, 2017
Yes, to both :).
#14 scary alien, Jan 14, 2017
Does anyone have an update on the build 15 testing? I believe its nougat but I think you would need mode than bootloader access to root it due to Android N encryption.
#15 jdoggthemaster4089, Jan 14, 2017
Yea so unless Jon is making shit up and I trust him I've talked to him he knows his stuff very well beleive that so to pull myself back on topic here we need to look at other areas outside of using signing keys to gain root access
#16 GrifterGrifts, Jan 14, 2017
i worked before on cm for j700h/f/m & j320p & huawei g6 but i wasn't able to deliver stable builds , there were always some bugs left...
#17 messi2050, Jan 14, 2017
I can help build and debug
#18 GrifterGrifts, Jan 14, 2017
I twitted jcase and he sent me this https://twitter.com/jcase/status/820346383232155648
#19 JIMMYHENDRIX, Jan 14, 2017
That doesn't surprise me...he has no interest in wasting his time with non mainstream phones
#20 Vyrus69, Jan 14, 2017
Nice work too everyone here , been reading nd checking since day one ,
I'm no techie , jus a little Linux experience, but delt with Samsung,HTC,apple, windows , etc etc ,
Probably way behind just some basics about ZTE there setup is backwards , as. Too other manufacturers to get to the recovery options it's power down,but ZTE max pro takes you to FTM , OK I'm boring but bare witness , OK power ,up gets you into recovery, backwards, OK now here's where I help my gentleman and ladies , power plus up and down nothing a black screen? Yes? OK this download mode on some phones same as fastboot? In this mode connect to adb , I'll make a video , this gonna take seeing than telling .....
#21 reeka, Jan 14, 2017
ADB shell runs in usermode and not kernel mode. We can't flash anything using it.
#22 anubis2048, Jan 14, 2017
You're getting into DFU mode which still requires signed zips + we need the software made to flash for the Zmax Pro.
#23 anubis2048, Jan 14, 2017
True indeed Linux is your friend my friend , all my setup in the video is based on Linux give me a few please ,will post the video , no games no gimicks

Will have links to the tools that will allow flashing , it's a Linux Odin but it's universal
#24 reeka, Jan 14, 2017
Odin is for Samsung devices only. I just hope you're using that as a generic term for flashing utility. The only tool I could think of that might work on the ZTE Zmax Pro would be the same one used for the Axon 7. Do you have the encryption keys used to sign the zips? If so please share them and I can put it in the original post for everyone to see.
#25 anubis2048, Jan 14, 2017
Can we please get back on-topic? :)

This thread should be about ways / methods / strategies / ideas for (actually) rooting this device.

Everything else is basically off-topic...

Just saying--otherwise, it'll (continue to) turn into the original thread this was spawned from...

#78 scary alien, Jan 19, 2017