04.

09 update:
I thought the whole OK, the root of the matter is not over. Had to update the next,
see back.

04.02 Summary:
Root succeeds and sshd is installed. I feel there is no need to brush the firmware. To
make a summary of it.
From the old with you, JZJ7979 post a lot of secondary school. The still water flow
jsls provides the key help. In this thanks to the help of predecessors.
Our society impetuous and quick success, numerous white people want to rice to
mouth, do not know to enjoy the knowledge to explore the success of a sense of
accomplishment.
Although this, or made a lazy package, to download it. But the password can only
reply to the visible. Will no longer provide answers, there are problems, carefully
posted it.
If you want to know how not only know why, in fact, do not have to download,
because all of the information and discussion of the paste below, as long as take
some time.

2015.03.10 Origin:
Mobile broadband IPTV with the set-top box, also found with USB port, the idea that
you can put high-definition external hard drive it, the results can not find how the
menu. Internet search to know the depth of castration. Obviously to their own
equipment, small pheasant grips the hands of others, the more power the more
hateful. So determined to break this, the Internet search tutorial found is not easy.
While doing it, this article for a record, to facilitate later.
Because I did not play the white line brush, the process will be wordy, master
forgive do not Fan Fan.
Machine Type: Intelligent Set-Top Box (Wi-Fi) ZTE ZXV10 B760E (H)
Because before the knowledge of the interests of castration, the basic confirmation
must go adb crack approach.
E-market to buy USB-TTL connector, (BTW, physical store to 20, etc., or online
shopping from it) is not with DuPont line. No line of hard to find me, find the root of
the old CD-ROM audio cable, kitchen knife split, dry bar.
1) check the USB-TTL connector chip, PL2303HX, the next driver installed, OK
2) My computer system WIN7 64, Rapidtest.exe not easy to use (prompt Unable to
open port), then download ACCESS PORT1.37. ACCESS PORT Win7 available, but to

manually set the COM port, in the Device Manager, you can find the COM port
information.
3) USB-TTL header short RX TX, ACCESS PORT test, the code has been received, OK
4) demolition of the box, I heard that the goods did not screw, screwdriver flat on
the mouth directly to the other open.
5) Remove the three screws to turn the board over
Locate the six-pin connector next to the USB connector.
6) estimated to be connected to try. ACCESS PORT test, open the B760E, a carriage
return, received:
Root @ android: / #
A successful ah? I can not believe it. Quickly record the pin sequence: X1 as
the base

(5) (6)
(3) (4)
(X1) (2)
6 = GND
2 = TX
X1 = RX
Here we must pay attention to both ends RX TX to cross-connect. Usually the
voltage does not exceed 5V, wrong to reverse it, not a problem.
7) Start adbd on the B760E. This requires issuing a command to the B760E. Taking
into account the ACCESS PORT has been a command line prompt "root @ android: /
#", I tried to use ACCESS PORT can.
That is, when the B760E prompts "root @ android: / #", issue:
Adbd & Enter
Adbd service is running in the background waiting for the connection.
8) test adb, download good adb software, into the C: root directory.
Open the windows command line cmd.exe, in the C: root directory to run adb
connect xxx.xxx.xxx.xxx:5555
TIP: Connect to xxx.xxx.xxx.xxx:5555
OK
9) adb install xxx.apk, test installed a ES browser, suggesting SUCCESS.

10) However, the apk installed in the B760E can not be found. And so far, I still can
not find any of the original interface software. I even reset the IPTV box factory
settings 10086, still can not skip.
11) It seems that the mobile company is castration manager B760E firmware, so
toss here for a long time.
In fact, no experience, because JZJ7979 prompts very clear: Goku assistant
Download Goku assistant installed, set the PC and B760E IP network with the
network segment, set the box to find the IP, OK /
Here to ensure that the set-top box to ensure that the adbd is running, because the
Goku assistant is actually the same operation with the adb mechanism. :
12) Now the key is to have a desktop launcher replaced B760E built-in:
When the shell desktop, download apk, dragged into the Goku assistant
automatically installed.
Installed, B760E has been prompted in the TV interface, select the desktop
when the shell, DONE!

Summary:
A) Thanks again JZJ7979, prompt every step is critical, I took a detour because of
lack of experience.
B) I know that the old mainframe era serial terminal, USB-TTL connector is a
continuation of the serial terminal, with the PC driver and terminal software, the PC
virtual into a
Terminal. Because it is a local terminal, the system gives root privileges. So start
adbd, installed apk, this is not a thing.
C) back to study the next brush firmware, machine recovery do not have to start all
over again.
2015.03.30 update:
- Pin diagram on the sixth floor:
- Descriptions of the desktop. Only for my own B760E (Shandong Mobile)
I did not break before the boot automatically log into IPTV, can not cancel, IPTV
interface without a browser, can not install any application. The settings page is
also castrated and solidified.
With Goku assistant installation when the shell desktop, B760E prompt
immediately select the TV on the desktop or when the mobile IPTV, with the remote
control when the desktop is selected OK.

With the desktop when the shell can install new applications, how are easy to
handle.
After use, as long as the remote control application keys, there will be desktop
options.
It should be noted that the message is to start using adb install return SUCCESS, but
can not find the installation of the software box. While the use of Goku assistant
installation of the desktop when the success of shell.
Therefore, Goku assistant installation is necessary. The key is immediately after the
installation of Goku assistant prompt and start when the shell desktop. Why, I do not
know.
Follow-up other software installation, with the desktop when the shell, commonly
used can be installed. Some niche software, such as quicksshd, download APK,
Adb push quicksshd.apk / tmp
And then install the browser on the box es.

2014.04.02 Updated:
Root,
I thought with #, root is very easy. Did not expect quite strenuous. Su copy
countless times, a background daemon process. But also thanks to static water jsls
pointing deep.
Then su Superuser.apk with and can not work with you in the old adb package tried,
no.
Later tried supersuer 3.2 version, OK. download link:
Http: //downloads.noshufou.netdna ... -RC3-arm-signed.zip
1) Back to the dos command line, extract Superuser-3.2-RC3-arm-signed \ system \
2 files: app \ Superuser.apk and bin \ su
Adb push su / tmp
Adb push Superuser.apk / tmp
2) kill stbmc process. This should be ZTE own engage in the start through zte_init.rc
loading. The purpose is to monitor and delete / system / bin and xbin under the su
Adb shell connected to the B760E,
Ps | grep stbmc Get stbmc's PID
Kill PID Stbmc kill the corresponding process

Mv / system / bin / stbmc / system / bin / stbmc.bak This restart stbmc also can not
start. Do not know if there are other effects, temporarily changed the name of a
good.
3) No root, the first chicken or the first egg? It is unrealistic to expect Superuser to
install su. You must adb shell
Cp / tmp / su / system / bin / su
Cp / tmp / su / system / xbin / su, S H (? 8 z (s3 Q2 u;
Chmod 4755 / system / bin / su # M0 a6 ^ (} 9 I: e5 [
Chmod 4755 / system / xbin / su
4) Then, in the box TV interface, start ES file browser, to / tmp folder, start and
install Superuser.apk
5) This root is good, and then need to root APP, Superuser will automatically
play tips, point to allow it.
Create sshd '
USB-TTL is directly connected to the terminal does not matter, but a root adbd
open, not even the password authentication and WIFI can be connected, the
security risk is too great.
So it is best to open sshd, usually turn off the adbd, when needed to open. In fact, is
to replace the adb shell with SSH connection mechanism

1) Download quicksshd APK,

Adb push quicksshd.apk / tmp!
2) with the es browser installation, and set the password to start sshd service.
Quicksshd acquiescence of the user name is root, casually set up. After setting to
ensure that sshd in the background to ensure that wait.
3) Start the putty on the PC, set the box IP, select SSH, port 2222. I used to save the
connection shortcuts as IPTV SSH. Point open
4) Enter the login name root and password. Login to the box.
5) test / system / xbin / su, TV interface prompts to apply for root privileges, point to
allow. Get the # prompt, ok. This will allow you to upgrade the root privileges of the
ssh shell
6) ps | grep adbd Then kill the PID of adbd.
Need adb connection in the future, start quicksshd, PC-putty login, su and then
adbd & can

04.09 update: # {% F; q0} # w;

I thought the whole OK, but there is a reflection of the root after the remote control
shutdown and set the key effect of the problem. I tested really.
The main reason is to stop the stbmc root, stbmc stbmc also renamed stbmc.bak. It
seems stbmc there are other functions, can not simply stop trouble.
I think the next, the stbmc is a compiled executable program, generally no need to
encrypt, on which the operation should be able to see su.
Then ssh login, search the next look:
Root @ android: / system / bin # cat stbmc.bak | grep \ / system \ / bin \ / su
/ System / bin / su!
@@@@@ ======> / system / bin / su exist, delete it.
Root @ android: / system / bin # cat stbmc.bak | grep \ / system \ / xbin \ / su
/ System / xbin / su
@@@@@ ======> / system / xbin / su exist, delete it.
Rm -r / system / xbin / su
'\' Is an escape character, found stbmc really built a delete su command. But the
order is a clear shell, then such a direct change should be able to?

Sed '/ ^ rm -r \ / system \ / bin \ / su / s / ^ rm / # m /' stbmc.bak> stbmc.tmp

Sed '/ ^ rm -r \ / system \ / xbin \ / su / s / ^ rm / # m /' stbmc.tmp> stbmc #
Sed order error-prone, I was into the actual operation of the experimental OK.
Explain:
1) '\' is an escape character, '\ /' is actually interpreted as '/'
2) So the first half of the sed command is to search for the line containing 'rm -r /
system / bin / su'
3) 's / ^ rm / # m /' is the first line of the 'rm' replaced by '# m', bash will be
considered to start the # comment line and ignore the follow-up
The above command is the essence of the sed command line to the rm shell
comment out.
Note that because stbmc is compiled executable file, I am afraid there is an
absolute address reference, modify the file as far as possible not to affect other
parts, including file size, so only changed the first line of a # make this line delete
command failure is enough.
Upon completion, test the following:

Root @ android: / system / bin # ls -l stb

-rwxr-xr-x root shell 68292 2008-08-01 20:00 stbcfg
-rw-rw-rw- root root 304660 2015-04-09 23:11 stbmc
-rwxr-xr-x root shell 304660 2008-08-01 20:00 stbmc.bak
-rw-rw-rw- root root 304660 2015-04-09 23:10 stbmc.tmp
Root @ android: / system / bin # cat stbmc | grep \ / system \ / bin \ / su
/ System / bin / su
@@@@@ ======> / system / bin / su exist, delete it.
#m -r / system / bin / su
Root @ android: / system / bin # cat stbmc | grep \ / system \ / xbin \ / su
/ System / xbin / su
@@@@@ ======> / system / xbin / su exist, delete it.
#m -r / system / xbin /
You can see the file size remains unchanged, and stbmc delete the original su
command effect.
Then restore the file.
Rm /system/bin/stbmc.tmp
Chgrp shell stbmc
Chmod 755 stbmc

Restart the box, because stbmc is back, zte_init.rc starts loading as a background
process.
But the order has been effective rm su, su will not be automatically deleted.
Test root, still normal. Remote control off, normal!