Develop Bugs

APK root exploit

I tweeted this a couple week ago before the N1 was publicly out but here you go, nothing fancy, no real ui or output.
Thanks to Saurik and Giantpune for contributing (ie its based on their research)
Install apk, run apk wait 1 minute, install supersu app from market then uninstall with this command
adb uninstall com.qualcomm.privinit

Do you have a link to their research or are their findings private?
Regards,

Mr_Bartek said:
Do you have a link to their research or are their findings private?
Regards,
Click to expand...
Click to collapse
saurik - his analysis of the "second master key vuln"
giantpune for his symlnink attack vuln in property space:
Code:
/system/bin/mv /data/property /data/backupprop
/system/bin/mkdir /data/property
/system/bin/ln -s /sys/kernel/uevent_helper /data/property/.temp
/system/bin/setprop persist.sys.fail /data/pwn.sh

jcase said:
I tweeted this a couple week ago before the N1 was publicly out but here you go, nothing fancy, no real ui or output.
Thanks to Saurik and Giantpune for contributing (ie its based on their research)
Install apk, run apk wait 1 minute, install supersu app from market then uninstall with this command
adb uninstall com.qualcomm.privinit
Click to expand...
Click to collapse
Will this exploit work in any other device. when i try to install the play store warns about the vulnerability. Will this vulnerability be gone after uninstalling oppoown.

coolrevi said:
Will this exploit work in any other device. when i try to install the play store warns about the vulnerability. Will this vulnerability be gone after uninstalling oppoown.
Click to expand...
Click to collapse
Possibly other oppo devices
No it doesnt fix the vuln, just becareful where you install apps from

jcase said:
Possibly other oppo devices
No it doesnt fix the vuln, just becareful where you install apps from
Click to expand...
Click to collapse
a second mater key vulnurability? hmm, so this could might not be patched in 4.4?
great job by the way, i dont have the device but this is interesting!

ricky310711 said:
a second mater key vulnurability? hmm, so this could might not be patched in 4.4?
great job by the way, i dont have the device but this is interesting!
Click to expand...
Click to collapse
It should be patched in 4.4.
But some (read most) OEMs still can't manage to patch their devices up to the latest security updates on release.
Anyway, I tested this root method a week or so ago and it works nicely

pulser_g2 said:
It should be patched in 4.4.
But some (read most) OEMs still can't manage to patch their devices up to the latest security updates on release.
Anyway, I tested this root method a week or so ago and it works nicely
Click to expand...
Click to collapse
so your saying in most devices the master key patch could be a possible vulnurabillity still in 4.3?
interesting...

ricky310711 said:
so your saying in most devices the master key patch could be a possible vulnurabillity still in 4.3?
interesting...
Click to expand...
Click to collapse
It depends on if OEMs backported it, depends on which build OEMs used and depends on the bug. Four or five different zip parser bugs with similar results. This one I used was patched in 4.3, but other exist.

Im trying to figure out why oppown apk will not install in my n1. everytime i try it just. Says app not installed. But on the install screen it says something about being an update to an already installed program. Any clues as to what the issue is? all ive done is update to the latest ota software and im currently located in indonesia if that makes a difference.

trickraca said:
Im trying to figure out why oppown apk will not install in my n1. everytime i try it just. Says app not installed. But on the install screen it says something about being an update to an already installed program. Any clues as to what the issue is? all ive done is update to the latest ota software and im currently located in indonesia if that makes a difference.
Click to expand...
Click to collapse
Possible they patched it by now, if you are on cyanogenmod you are certainly patched
Sent from my HTC Two

jcase said:
Possible they patched it by now, if you are on cyanogenmod you are certainly patched
Sent from my HTC Two
Click to expand...
Click to collapse
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..

giuliano rigon said:
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..
Click to expand...
Click to collapse
It should not come rooted, if it comes rooted then no way did it pass CTS. I'm guessing unlocking the bootloader and flashing a recovery? I don't know, I dont have one

giuliano rigon said:
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..
Click to expand...
Click to collapse
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk

noobish doubts..
Harfainx said:
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk
Click to expand...
Click to collapse
Please i ne ed a walthrough..
1) download twrp
2) put it in root of the telephone robot
3) flash it in recovery?
4) reboot recovery wipe cache and dalvik flash omnirom..
Please correct me..
Thank you

giuliano rigon said:
1) download twrp Yes
2) put it in root of the telephone Yes
Make sure to copy Omnirom to your phone at some point
3) flash it in recovery? No - Flash TWRP in Fastboot if you haven't flashed the recovery already. Use the official Teamwin site for guidance
4) reboot recovery wipe cache and dalvik flash omnirom.. Wipe Cache, Dalvik, System, and Data
Click to expand...
Click to collapse
Updates in Red
This is off-topic for this thread though. Questions/Info for flashing Omnirom should be addressed in the Omnirom thread.

Harfainx said:
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk
Click to expand...
Click to collapse
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks

nowy57 said:
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks
Click to expand...
Click to collapse
That does work. You're likely not removing root, but rather just uninstalling SuperSU.
I answered you in your Q&A thread on root.

not rooted.. confirm i can flash
nowy57 said:
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks
Click to expand...
Click to collapse
I nave tried my damnedest to root .. Fastboot flashing supersu flashing from recovery Direct install from google play complete unroots and reflash letting recovery do it .. No way..
So now i need a last confirmation.. Can i flash omnirom after wipes even if i am unrooted.. And has anyone rooted omnirom or does it come unrooted.. Thanks for the info .. Another idea.. Flashing color OS footing and then flashing omni.. Or is this a late night bad Dream..
---------- Post added at 01:17 AM ---------- Previous post was at 01:05 AM ----------
Harfainx said:
That does work. You're likely not removing root, but rather just uninstalling SuperSU.
I answered you in your Q&A thread on root.
Click to expand...
Click to collapse
Sorry now i got it.. It was in the forums.. Just unchecking the respect cyanogen settings in the super su menu got me roooted and happy.. Sorry for your time.. I flashed super su zip from recovery rebooted and unchecked .. Now i am set..

I were rooted myN1 in yesterday, its really good . thankss
Sent from my N1 using XDA Premium 4 mobile app

Unlocking & Root N7 (2013) on Kit Kat?

Hey everyone, Im new here, just got the Nexus 7 2013 Asus.
I updated to Kit Kat right away, I tried using that root toolkit thing or whatever... it got my tablet unlocked but it would stay stuck on a message that it was trying to boot some .img file when I clicked root...
Long story short, I restored 2 times and I guess that doesnt work with Kit Kat yet... and I relocked my tablet. Anyway know how I can correctly unlock and root my new Nexus 7 on Kit Kat?

After an unlock you can manually flash the recovery IMG then just flash the super su zip for root.
Adb fastboot recoveryimage.IMG
Then the super su zip can be flashed once in a custom recovery.
If needed I can do a team viewer with you and get you all set up.
prshosting.org

ta_help said:
Hey everyone, Im new here, just got the Nexus 7 2013 Asus.
I updated to Kit Kat right away, I tried using that root toolkit thing or whatever... it got my tablet unlocked but it would stay stuck on a message that it was trying to boot some .img file when I clicked root...
Long story short, I restored 2 times and I guess that doesnt work with Kit Kat yet... and I relocked my tablet. Anyway know how I can correctly unlock and root my new Nexus 7 on Kit Kat?
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=2536420
Make sure you download the correct custom recovery for your device (prerequisite 3).
Sent from my Nexus 6 using Tapatalk 4

Unlocked & Rooted N7 on 4.3.1 will it stay so after update to 4.4 ?
prsterero said:
After an unlock you can manually flash the recovery IMG then just flash the super su zip for root.
Adb fastboot recoveryimage.IMG
Then the super su zip can be flashed once in a custom recovery.
If needed I can do a team viewer with you and get you all set up.
prshosting.org
Click to expand...
Click to collapse
Dear Experts,
I'm still new at this game, so bear with me please.
I have a LTE N7 on 4.3.1 (JLS361) that is unlocked & rooted.
Now I get tho OTA Update to 4.4 (KRT16S) downloaded & ready to install.
Aside from all those bad things that don't work anymore in 4.4 (eg. FLASH), what will happen ?
Will my N7 revert to a locked & unrooted device ? or will it stay unlocked & rooted ?
Or will it stay unlocked, but unrooted, and I only need to flash the SuperSU ZIP again ?
Thanks for enlightening me.
JMF

fiechterjm said:
Dear Experts,
I'm still new at this game, so bear with me please.
I have a LTE N7 on 4.3.1 (JLS361) that is unlocked & rooted.
Now I get tho OTA Update to 4.4 (KRT16S) downloaded & ready to install.
Aside from all those bad things that don't work anymore in 4.4 (eg. FLASH), what will happen ?
Will my N7 revert to a locked & unrooted device ? or will it stay unlocked & rooted ?
Or will it stay unlocked, but unrooted, and I only need to flash the SuperSU ZIP again ?
Thanks for enlightening me.
JMF
Click to expand...
Click to collapse
It will stay unlocked, but unrooted, and you only need to flash the supersu zip again.
Sent from my Nexus 6 using Tapatalk 4

xdhall said:
It will stay unlocked, but unrooted, and you only need to flash the supersu zip again.
Sent from my Nexus 6 using Tapatalk 4
Click to expand...
Click to collapse
Mine is also unlocked and rooted and want to upgrade to KK.
When you said flash, you meant I had to install TWRP first then flash SU again?
I am curious because when I first rooted my N7, I used the Nexus 7 Toolkit and did not install TWRP. Can't I just use the toolkit again to re-root?

lanwarrior said:
Mine is also unlocked and rooted and want to upgrade to KK.
When you said flash, you meant I had to install TWRP first then flash SU again?
I am curious because when I first rooted my N7, I used the Nexus 7 Toolkit and did not install TWRP. Can't I just use the toolkit again to re-root?
Click to expand...
Click to collapse
If you had a TWRP installed and downloaded the superuser binaries when you rooted initially, all you need to do is flash them again by pressing the "install" button in recovery. Based on the way he asked it, I believe that was the context of the question.
If you don't, you should install a custom recovery:
Wi-Fi only: http://techerrata.com/browse/twrp2/flo
LTE: http://techerrata.com/browse/twrp2/deb
Then download the superuser binaries to your N7:
http://download.chainfire.eu/370/SuperSU/UPDATE-SuperSU-v1.80.zip
And flash them by pressing the "install" button in recovery.
Your toolkit might work, but why not just do it yourself?
Full instructions (skip unlocking the bootloader):
http://forum.xda-developers.com/showthread.php?t=2536420
Sent from my Nexus 6 using Tapatalk 4

xdhall said:
If you had a TWRP installed and downloaded the superuser binaries when you rooted initially, all you need to do is flash them again by pressing the "install" button in recovery. Based on the way he asked it, I believe that was the context of the question.
If you don't, you should install a custom recovery.
Click to expand...
Click to collapse
I assume there's no other way to re-root other than installing TWRP?

lanwarrior said:
I assume there's no other way to re-root other than installing TWRP?
Click to expand...
Click to collapse
You can install another custom recovery, e.g., clockworkmod.
Some toolkits reflash stock recovery after rooting, but that could only useful if you have something like a Samsung or HTC. Absolutely no point on a nexus device.
Sent from my Nexus 6 using Tapatalk 4

xdhall said:
You can install another custom recovery, e.g., clockworkmod.
Some toolkits reflash stock recovery after rooting, but that could only useful if you have something like a Samsung or HTC. Absolutely no point on a nexus device.
Sent from my Nexus 6 using Tapatalk 4
Click to expand...
Click to collapse
Thanks again for the help, xdhall. Sorry if I sound like a newbie, but I had the Note 8.0, I rooted and I could never get it back to stock. The original stock image for the US Note 8.0 was not available so I was stuck.
Didn't want the same thing happened with the N7, but you brought up a good point... this IS a Nexus device!

Thanks
xdhall said:
It will stay unlocked, but unrooted, and you only need to flash the supersu zip again.
Sent from my Nexus 6 using Tapatalk 4
Click to expand...
Click to collapse
Thanks xdhall.
That makes it much easier to get back to ROOT then.
Just having to reboot in Recovery Mode and install the latest superSU.zip will be a breeze.
I'll probably wait a few weeks/months to upgrade to 4.4 though, as the comments on the 4.4 release are not that good, and I have several very important (for me) sites that still use Adobe Flash.
Anyway, I'm glad I haven't to start from scratch (backup, unlock, restore, flash recovery, flash superSU), as this is extremely time-consuming and tedious.
Again Thanks & have a nice WE.

ROOT for Droid Razr M XT907- 183.46.15

All credits goes to Hydrogen and serg_gangubas from 4pda.ru community.
All you have to do, is download package, run the bat file and follow the instructions.
New updated version: fixed minor bugs, now should everything work.
Source: https://docs.google.com/file/d/0B3_Ur7BD0bFZdmlMNEdxM0ltN2M/edit?usp=docslist_api
1. Enable Developer Settings;
2. In Developer Settings, enable "Allow Mock Locations" and "Usb Debugging";
3. Unarchive root.zip;
4. Start install_root.bat;
5. Follow Instructions;
6. After text "please open towelroot" go into launcher and open "towelroot" app, do what need then press any button to continue
then follow instructions;
P.S. After all process, if there will be no SuperSU application in you'r device, please install supersu.apk from: "\root\Hydrogen PEROXIDE\files".
Enjoy!
Drivers: https://motorola-global-portal.custhelp.com/app/answers/detail/a_id/88481

Perhaps even more important than achieving root is whether the BL can be unlocked afterwards - so can it? Has anyone attempted?
Sent from Google Nexus 4 @ CM12
[WARNING: XDA Premium 4.0.13+ lacks Signature function - do not update]

They cannot root my droid razr m 182.46.15 only installed superSu now how to update the binary
I think it works only with kernal before 29 july 2014

hrrhacker said:
They cannot root my droid razr m 182.46.15 only installed superSu now how to update the binary
I think it works only with kernal before 29 july 2014
Click to expand...
Click to collapse
you are wrong.
so.
enable dev settings and mock location + usb debugging in it.
unarchive .zip somewhere
start install_root.bat
follow instructions
after text "please open towelroot" go into launcher and open towelroot app, do what need then press any button to continue
then follow instructions
zip will be updated next few days, but it definitely works even now.

i got the root access and the Motopocalypse is also getting superuser permission but it can not unlock the bootloader can you please tell me why ????

This script only root the phone, bootloader is still locked.

shah321 said:
i got the root access and the Motopocalypse is also getting superuser permission but it can not unlock the bootloader can you please tell me why ????
Click to expand...
Click to collapse
For now, be careful with unlocking bootloader. There is a good chance to get a brick your phone (already have a case of getting a brick using Motopocalypse).
Work on unlocking boot are conducted on 183.46.15, be patient

Ortli or kkruglov can you please post a screenshot showing your system version? There has been some testing of this on another forum and it didn't work.
Shmaks how did you manage to brick with Motopocalypse? Either it works or it doesn't.
I'm sorry, but this whole thread smacks of BS. First clue? This exploit still uses Towel Root, which has long been proven not to work on .15.
Sent from my HTC6525LVW using Tapatalk

RikRong said:
This exploit still uses Towel Root, which has long been proven not to work on .15.
Click to expand...
Click to collapse
Version of Motorola update doesn't matter, because we are dealing with kernel. Towelroot doesn't work on fresh kernels, but it does on old ones. Exploit simply has to interchange them artfully, then return back as they were. Look at the picture:
P.S. New, more convenient version of main script was published by one of exploit authors, so I think OP will be updated soon with new link. And yes, it works. No doubt!
UPDATE: exploit layout, more detailed.
Here's what I got about script's algorithm at 4pda.ru community discussion, in general:
1) Script crashes moto_crypto.
2) Factory recovery gets replaced by May 1 kernel.
3) Reboot to recovery, but there is kernel instead - it gets booted, and we got vulnerable to Towelroot system under May 1 kernel.
4) We do root job, then quit.
5) Factory recovery returned back.
6) Script starts moto_crypto.
7) Normal system start, as if nothing happened.
W/o moto_crypto crash trick the kernel isn't stable + has no rw rights. Also there are few lines changed in giefroot's *.sh + custom install script. What exactly changed, and what for - I don't know, being not dev )

How is it possible to change the kernel with a locked boot loader? Has anyone actually got this to work? One person tried and it didn't work.
Sent from my HTC6525LVW using Tapatalk

When I try to download, Google Drive shows an error, then finally downloads a .bin file .... Then of course cannot be used.....
And when I try to download from the other posted link.... I get 404 (file not found).......

I tried 3 times, no root, same kernel
Sent from my XT907 using Tapatalk

sd_shadow said:
I tried 3 times, no root, same kernel
Sent from my XT907 using Tapatalk
Click to expand...
Click to collapse
They have to be doing this on an unlocked phone. Then, why would they even be using an exploit?
Sent from my HTC6525LVW using Tapatalk

1. Enable Developer Settings;
2. In Developer Settings, enable "Allow Mock Locations" and "Usb Debugging";
3. Unarchive root.zip;
4. Start install_root.bat;
5. Follow Instructions;
6. After text "please open towelroot" go into launcher and open "towelroot" app, do what need then press any button to continue
then follow instructions;
P.S. After all process, if there will be no SuperSU application in you'r device, please install supersu.apk from: "\root\Hydrogen PEROXIDE\files".
Enjoy!
Download: https://drive.google.com/file/d/0B3_Ur7BD0bFZLWlEQzdiVnJXc1U/view?usp=sharing

RikRong said:
How is it possible to change the kernel with a locked boot loader?
Click to expand...
Click to collapse
You would name me a Cap, but - via exploit )
I can't translate all that was written at 4pda, where exploit has appeared, but here is in general. HydrogenXS: "The method, I would name it Hydrogen peroxide, is based on giefroot utility. Thanks to zxz0O0 for his hard work, and also to all authors of applications that use giefroot developments."
Has anyone actually got this to work?
Click to expand...
Click to collapse
Yep. Their names are HydrogenXS and serg_gangubas, both are from Ukraine

rooted
I confirm root getted! Want add - all operations need to do on clear stock 183.46.15 (no wipe, only fresh RSDLite flashing)

I can't get root access when opened towel root my phone is not supported yet what's wrong with kernal that's the screenshot..

hrrhacker said:
I can't get root access when opened towel root my phone is not supported yet what's wrong with kernal that's the screenshot..
Click to expand...
Click to collapse
Try again several times.

Can someone - who ran this program and it worked - pull this log and post it here, please.
Code:
adb shell "cat /data/local/tmp/giefrootlog"

ATTACK said:
Can someone - who ran this program - pull this log and post it here, please.
Code:
adb shell "cat /data/local/tmp/giefrootlog"
Click to expand...
Click to collapse
you mean someone who ran this, and it worked, right?
because you can't get adb shell # without some kind of root access?
---------- Post added at 09:34 AM ---------- Previous post was at 09:31 AM ----------
McCormick88 said:
I confirm root getted! Want add - all operations need to do on clear stock 183.46.15 (no wipe, only fresh RSDLite flashing)
Click to expand...
Click to collapse
which FXZ file
VZW_XT907_4.4.2-KDA20.62-15.1_1FF.xml.zip or VZW_XT907_4.4.2-KDA20.62-15.1_CFC_1FF.xml.zip or other
what kernel version did you have?

[ROOT][Video] Droid Razr M XT907- 183.46.15 w/Kernel newer than June 3, 2014

First On Phone: Go To Settings>about phone>Kernel Version
If kernel is before June 3, 2014 (like May X 2014) root with Towel Root
If kernel is after June 3, 2014 (like 29 July 2014) root with Hydrogen Peroxide (this method)
Short Instructions: Download Hydrogen_PEROXIDE_1_0_0_5.rar, unzip, run install_root.bat, follow on screen prompts
Long Instructions
Troubleshooting
Flashing Firmware
Root Info
Changelog
Note: If your device has 182.45.15, you likely need to flash 183.45.15 firmware with rsd lite.
Root Info
This method was created by HydrogenXS and posted @ http://4pda.ru/
It Uses combination of several hacks giefroot, Towelroot, flashing an older Kernel over the Stock recovery...
This does not unlock the bootloader,
there is no practical way to unlock the bootloader once the kernel /bootloader is newer than June 3, 2014 (July 29)
There is no custom Recovery without an Unlocked Bootloader, no custom Recovery, no Custom Roms
So stop asking
If you have a XT926 see ROOT for Droid Razr HD XT926- 183.46.15 w/Kernel newer than June 3, 2014
Changelog
15 March 2015; Added: If you have a XT926 on 183.46.15 see Post #80
and Only Flash XT907 firmware on a XT907
23 March 2015: added ROOT for Droid Razr HD XT926- 183.46.15 w/Kernel newer than June 3, 2014
30 March 2015; Added: (Old Kernel is flashed over Stock Recovery, Recovery will no longer work until last step) and
If Rooting fails try flashing firmware with RSD Lite and/or Perform a Factory Data Reset (Device Powered Off) - DROID RAZR M by MOTOROLA
31 March 2015: Added: There is no custom Recovery without an Unlocked Bootloader, no custom Recovery, no Custom Roms
06 April 2015: Added download Mirrors
22 May 2015: Edited Download Mirrors
28 May 2015: Added list tags to Mirror links
17 June 2015: Created new thread

Long Instructions
(Watch) [Video] ROOT for Droid Razr M XT907- 183.46.15
(PC)-Download, Install, and verify Install Moto drivers (Motorola_End_User_Driver_Installation...)
(PC)-Download Hydrogen_PEROXIDE_1_0_0_5.rar Mirrors:
Original OP
Mega
AFH
XDA
(PC)-Optional verify MD5:716F4A4D6F47BDDBCDBD1076965F9233 https://sites.google.com/site/sdshadowscollection/home/hash-checksums
(PC)-Extract files from .rar with 7zip, Winrar, or other File Compression Utility
Connect Phone to PC
(Phone)-Enable Airplane Mode
(Phone)-Enable Developer Options
Settings/about phone/tap on Build number several times till you see developer options enabled​(Phone) Open Developer Options (Settings/ just above About Phone)
(Phone)-Enable USB Debugging
(Phone)-Enable Allow Mock Locations
(PC)-run install_root.bat
If root stops at waiting for device: try Toggling Usb Debugging OFF/ON, or try a different usb port
Some files will be pushed and installed
You may get a popup on Phone, select allow
Phone will reboot
Phone will reboot to AP Fastboot
File will be flashed to phone (Old Kernel is flashed over Stock Recovery, Recovery will no longer work until last step)
Phone will reboot
Phone will reboot
Note: If it reboots to Recovery (No Command screen) Flash failed and there is no point continuing, so close root tool on PC,
press both volume buttons and power to continue to recovery, release power buttons, select reboot with power button
Likely need to Flash Firmware with RSD Lite and/or Factory Reset​(Phone)-When prompted to open towelroot, connect to WiFi or Data (3G/LTE)
(Phone)-Open towelroot, select Make it Rain
towelroot will say device is rooted
Note; if it says device not supported, root failed, but you should continue with steps to reflash recovery​(Phone)-Close towelroot
(PC)-press any key to continue
Phone will reboot, and flash recovery.img in AP Fastboot mode
phone will reboot
Root apps will be removed from Phone
(PC)-press any key to continue
Root Tool will close
Done.
Note. I left out some of the (PC)-press any key to continue​
during every reboot I disconnected USB cable from PC (may not matter)
kept in Airplane mode till i used towelroot app, turned on wifi just before using towelroot.

Toubleshooting
rooting Error:If you see this error
"error more than one device and emulator found"
"-waiting for your device-"
"error: protocol fault (status read)"
try on PC
adb kill-server
adb devices
or
on device toggle ADB debugging OFF/ON
--------------------------------------
If you see errors at the beginning
like apk already installed
that is fine.
if root stops at or just after
" "Starting: Intent { cmp=org.keenteam/.ServiceExploitActivity } "
Disconnect USB cable, Power off Phone, Hold Volume Down Button, Press Power for ~5 secs, Release Power button, then release Volume Button.
When you see AP Fastboot Mode, reconnect usb cable
if it fails to continue within a min or so, restart Phone and Root.bat
----------------------------------------
If Rooting fails try
Perform a Factory Data Reset (Device Powered Off) - DROID RAZR M by MOTOROLA - Verizon page
or
Flashing Firmware
There are several options for flashing Firmware/FXZ
See Unbricking/Flashing Stock Firmware methods in Index

saved

sd_shadow said:
Just in case
Click to expand...
Click to collapse
The link in "Using RSD Lite: motofirmware.center/topic/6-h...k-your-device/" is broken.
Managed to root successfully one of my phones, but not the other :/ It goes to NO Command Screen.
So after factory reset several times, now will try to flash but does not look too easy.

pianistat said:
The link in "Using RSD Lite: motofirmware.center/topic/6-h...k-your-device/" is broken.
Managed to root successfully one of my phones, but not the other :/ It goes to NO Command Screen.
So after factory reset several times, now will try to flash but does not look too easy.
Click to expand...
Click to collapse
Thanks, Fixed. http://motofirmware.center/topic/22-how-to-restore-your-device-with-motorola-firmware-plus-unbrick/

Thank you! All worked finally. Both phones rooted after needing the flash one of them. Total 6-7 hours of work

so using this firmware: VZW_XT907_4.4.2-KDA20.62-15.1_1FF.xml will work with luge to downgrade it shadow?
sd_shadow said:
Thanks, Fixed. http://motofirmware.center/topic/22-how-to-restore-your-device-with-motorola-firmware-plus-unbrick/
Click to expand...
Click to collapse

patt2k said:
so using this firmware: VZW_XT907_4.4.2-KDA20.62-15.1_1FF.xml will work with luge to downgrade it shadow?
Click to expand...
Click to collapse
I would try rooting with current version first
Sent from my XT907 using Tapatalk

sd_shadow said:
I would try rooting with current version first
Sent from my XT907 using Tapatalk
Click to expand...
Click to collapse
This was the first thing I tried was towelroot ,should I try hydrogen first? if it will fail can you recommend which firmware file to download?
Firmware:185.46.10.XT907
Kernel:Mon Aug 25 12:54:12 PDT 2014

patt2k said:
This was the first thing I tried,could you recommend which firmware will be safe for Luge?
Firmware:185.46.10.XT907
Kernel:Mon Aug 25 12:54:12 PDT 2014
Click to expand...
Click to collapse
I believe others have flashed 183.46.15 success fully, but I would have to go back and search...
Sent from my XT907 using Tapatalk

sd_shadow said:
I believe others have flashed 183.46.15 success fully, but I would have to go back and search...
Sent from my XT907 using Tapatalk
Click to expand...
Click to collapse
Alright when you have done just tag me or something would apperciate it need to root 2 of these bad boyz.

I would factory reset first, and retry root
Sent from my XT907 using Tapatalk

sd_shadow said:
I would factory reset first, and retry root
Sent from my XT907 using Tapatalk
Click to expand...
Click to collapse
Sorry forgot to mention I first tried towelroot then your app,after rebooting the phone it did not load adb again to continue the script I meant the script was running but the phone didn't get detected again in your app.
I will do factory reset in few minutes like you suggested.
@sd_shadow this from your site is good for flashing to luge? VZW_XT907_4.4.2-KDA20.62-15.1_1FF.xml

Not sure.
Sent from my XT907 using Tapatalk

sd_shadow said:
Not sure.
Sent from my XT907 using Tapatalk
Click to expand...
Click to collapse
it looks like downgrade went fine however for some reason I can't get it to roam with my sim card from Poland it either roams on AT&T or T-Mobile I saw some people saying they unlocked it as well for USE here in US what are the steps towards it do you know? sry for bothering you so much lol
I also saw your script trying to write recovery with locked bootloader this should fail.. weird

patt2k said:
it looks like downgrade went fine however for some reason I can't get it to roam with my sim card from Poland it either roams on AT&T or T-Mobile I saw some people saying they unlocked it as well for USE here in US what are the steps towards it do you know? sry for bothering you so much lol
Click to expand...
Click to collapse
I think the usual option is to use this
[PATCH][GUIDE] Patch to fully enable GSM on Verizon CDMA Android phones by Mentor.37
But you need a custom Recovery to install
There is a custom Recovery that can be installed but it's not fully compatible, not sure if the patch will install correctly or not.
Sent from my XT907 using Tapatalk

sd_shadow said:
I think the usual option is to use this
[PATCH][GUIDE] Patch to fully enable GSM on Verizon CDMA Android phones by Mentor.37
But you need a custom Recovery to install
There is a custom Recovery that can be installed but it's not fully compatible, not sure if the patch will install correctly or not.
Sent from my XT907 using Tapatalk
Click to expand...
Click to collapse
Root worked! I got towelroot to work awesome. So how are these other people getting this to work without custom recovery.. I owe you a beer sir.. for your time seriously. What I meant is how they did the sim unlock without custom recovery.. or I should not worry about it not picking up roaming because it is supposed to be sim unlocked so in Europe it should be ok?

patt2k said:
Root worked! I got towelroot to work awesome. So how are these other people getting this to work without custom recovery.. I owe you a beer sir.. for your time seriously. What I meant is how they did the sim unlock without custom recovery.. or I should not worry about it not picking up roaming because it is supposed to be sim unlocked so in Europe it should be ok?
Click to expand...
Click to collapse
Try
http://forum.xda-developers.com/showthread.php?t=3070499
Working CWM Recovery for LOCKED 183.46.15 + Deodex and more
Sent from my XT907 using Tapatalk

sd_shadow said:
Try
http://forum.xda-developers.com/showthread.php?t=3070499
Working CWM Recovery for LOCKED 183.46.15 + Deodex and more
Sent from my XT907 using Tapatalk
Click to expand...
Click to collapse
it appears to be installed,installed recovery,selected reboot to recovery but after few seconds it just reboots and android starts booting. Well at least I have root.
the phone has the global/lte-cdma/gsm menu but it will not pull up roaming this way I could know for sure everything works fine.
EDIT: after re-installing weird looking recovery loaded!

Installing update once rooted and running TWRP recovery.

Good afternoon all. Sorry if this has been answered but I couldnt find exactly what I was looking for in a search.
I am running .59 on my 4GB 64GB Zenfone 2. Last time I just removed xposed framework and root and applied the update as normal. Then rooted and added back xposed.
This time I have TWRP installed. I dont think there is a way to install the update with TWRP installed.
If this cant be done, what is the quickest and easiest route to get the update installed?. Is it to go back to stock recovery?. If so, what is the best way to get there?.
If there is a better alternative then that would be great. Any detailed instructions or a link to them greatly appreciated.
Thanks in advance.
MAtt

Just did this recently so let me share what I did.
OTA update wont work unless stock recovery is installed and you will be stuck in a bootloop if root is kept.
- restore stock recovery (use method 1 for untethered from here but replace twrp.img with recovery.img from here)
- unroot (uninstall from within the superSU app is sufficient)
- apply OTA manually (follow steps from here under "Steps to Apply OTA manually")
- OTA should install at next boot in recovery
Once the system is updated, intall TWRP and use it to easily root your phone again.
Worked for me so I figure it should work for you

Thanks for the support!. I will try today.
Matt
Sent from my ASUS_Z00AD using Tapatalk

Looks like this was exactly what I was looking for from a missing link point of view. Thanks again.

I ended up using a terminal emulator on the phone. All is good.
If anyone needs a hand with this, please let me know.

MATTHEWLONG said:
I ended up using a terminal emulator on the phone. All is good.
If anyone needs a hand with this, please let me know.
Click to expand...
Click to collapse
So you have bootloader unlock right? And update goes fine without any problems?
Inviato dal mio Zenfone 2 ZE551ML

Yes and yes

Then Root and put xposed back on.