Need help rooting coolpad legacy 3705A. Can't find any info anywhere. - Android Q&A, Help & Troubleshooting

It is a fairly new device so I haven't seen anything on it but I'm hoping someone could point my in the right direction. Any info would be helpful. Thanks!

---

Same here, looking for root!

---

Coolpad root
Good luck on this to you I am working as well and will post what I find

---

Picked up one of these today, we just started working on it a few minutes ago, I'll post the method once done. This could be hours, days, months, who knows, We do have fastboot and the Coolpad Kit from elsewhere on the forums so it shouldn't be hard. But we are working on it.

---

Same here I really want root, oddly for fastboot oem unlock it doesn't unlock , I have oem unlock enabled in developer options but when I run the command fastboot flashing unlock or fastboot oem unlock or pretty much any command besides fastboot getvar all it comes back with something like FAILED remote unknown command and I have no idea why I have the cool pad legacy/lithium cp3705a if anyone can lend me some knowledge on why the fastboot commands don't work that would be nice I was going to flash a gsi and try to patch a stock boot image via magisk but I can do anything without unlocking the bootloader first, I'm hoping it's not a kernel related issue

---

sawclan22 said:
Same here I really want root, oddly for fastboot oem unlock it doesn't unlock , I have oem unlock enabled in developer options but when I run the command fastboot flashing unlock or fastboot oem unlock or pretty much any command besides fastboot getvar all it comes back with something like FAILED remote unknown command and I have no idea why I have the cool pad legacy/lithium cp3705a if anyone can lend me some knowledge on why the fastboot commands don't work that would be nice I was going to flash a gsi and try to patch a stock boot image via magisk but I can do anything without unlocking the bootloader first, I'm hoping it's not a kernel related issue
Click to expand...
Click to collapse
Yeah still working on it, waiting for some pie PoCs to come out. But fastboot is borked. I've requested the source code from them we'll see how that goes, doubt it will go anywhere. Can't even find the proper drivers for it. MTKTool is outdated so it can't even get a read on the FS to make a scatter file. All one click apps I tried didn't work so I wouldn't recommend those. OneClickRoot said it could root it but I'm not about to pay them to find out.
I did find a binary(locksettings) in system that allows you to set and remove passwords via command line which seems a bit insecure, but possibly exploitable, and an empty "cdrom_install.iso" in /system/etc But It just says:
"This directory contains the raw data that OEMs want to expose
to end-users.
Due to the limitation of mass storage. The cdrom ISO file should
be larger than 600KBytes.
If you put less files into this directory. Then it will create
a dummy file to fill the gap."
With a nice 616KB pad file.
That's all I've been able to get so far.

---

Thanks for the update that sums up what I've got as well although i didn't see that system img
---------- Post added at 03:51 AM ---------- Previous post was at 03:47 AM ----------
Oddly my device seems to be having some sort of bug. The touchscreen will just randomly lock up , I've reset the device , I realized it doesn't so it in safe mode , so I tried deleted apps from adb shell that did nothing , but since it works in safe mode and the device has project treble support I feel as though flashing a gsi would fix the problem , but I can't so that with a locked bootloader

---

sawclan22 said:
Thanks for the update that sums up what I've got as well although i didn't see that system img
---------- Post added at 03:51 AM ---------- Previous post was at 03:47 AM ----------
Oddly my device seems to be having some sort of bug. The touchscreen will just randomly lock up , I've reset the device , I realized it doesn't so it in safe mode , so I tried deleted apps from adb shell that did nothing , but since it works in safe mode and the device has project treble support I feel as though flashing a gsi would fix the problem , but I can't so that with a locked bootloader
Click to expand...
Click to collapse
You might want to go through your apps and disable a bunch of the bloat. They had like 3 facebook managers, installers and stuff in there. That could be doing it. I haven't had any such issues but i've only had the phone a few hours and have been in a shell exploring it most of that time.
Update: EDL Mode is accessible. We haven't been able to successfully do anything with it yet due to lack of a firehose, but 9008 mode does work with EDL Cable. If anyone has a SDM450 firehose around that would be ideal.

---

I already noticed edl mode was there was planning on finding out what to do today , I have a firehouse for the board which is prog_emmc_firehose_8953_ddr.mbn , but I wasn't sure how that worked I'm not to familiar with edl mode or what it can do , also I'm not a dev just an experienced Android / Linux user
---------- Post added at 01:32 PM ---------- Previous post was at 01:30 PM ----------
What would u even use to flash in edl mode? Say a gsi , because there's no stock firmware we can extract , but we can always get a rooted gsi if I'm not mistaken because the device does have project treble support

---

Sapphiress said:
You might want to go through your apps and disable a bunch of the bloat. They had like 3 facebook managers, installers and stuff in there. That could be doing it. I haven't had any such issues but i've only had the phone a few hours and have been in a shell exploring it most of that time.
Update: EDL Mode is accessible. We haven't been able to successfully do anything with it yet due to lack of a firehose, but 9008 mode does work with EDL Cable. If anyone has a SDM450 firehose around that would be ideal.
Click to expand...
Click to collapse
The firehouse for the oppo a71 has same specs board RAM and soc would that work

---

sawclan22 said:
The firehouse for the oppo a71 has same specs board RAM and soc would that work
Click to expand...
Click to collapse
I'll see if I can find one. They have the board incorrectly listed as both an MTK board and as an msm8953 even though from what I've been able to find msm8953 is strictly the snapdragon625. And Snapdragon 450 doesn't have an msm designation. This thing is a mess inside.
It's been awhile since I've done this mind you. Android has changed a bunch since the 2.X and 4.X days. I've been on a Nexus 6P for years which is open by default.
Wish it was as easy as installing gingerbreak and tapping root like the old days. Lol
---------- Post added at 03:14 PM ---------- Previous post was at 03:03 PM ----------
sawclan22 said:
What would u even use to flash in edl mode? Say a gsi , because there's no stock firmware we can extract , but we can always get a rooted gsi if I'm not mistaken because the device does have project treble support
Click to expand...
Click to collapse
I would get temp root via a RCE or EoP pull the boot image, modify it and flash it in EDL therefore enabling fastboot and making the phone ready for TWRP. After that it's just a matter of writing a program that does this for you and the phone would be ready for development.

---

Well I've done all I know how to do I'll just leave it to you guys and keep an eye on this forum

---

Hey Sapphires,
Have you generated the root process for the Coolpad Legacy yet?
[email protected]

---

manoftech said:
Hey Sapphires,
Have you generated the root process for the Coolpad Legacy yet?
[email protected]
Click to expand...
Click to collapse
Waiting for a poc or a firehouse to surface. Android 9 doesn't have many exploits available yet.

---

Device Unlocking Process Status?
Have we got anywhere with the device unlocking and rooting procedure with this device.
djdruin said:
It is a fairly new device so I haven't seen anything on it but I'm hoping someone could point my in the right direction. Any info would be helpful. Thanks!
Click to expand...
Click to collapse

---

dravenz7 said:
Have we got anywhere with the device unlocking and rooting procedure with this device.
Click to expand...
Click to collapse
Nope. we are also NOT vulnerable to CVE-2019-2215 at least on my device with the June Patch. Just waiting for a valid exploit.
This is as far as it gets.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

---

You guys suck

---

diag port
I don't know if you guys figured this part out yet or not but I was able to open the engineering menu and turn on the diagnostics port and modem. I'm not very familiar with using it to my advantage but I used quick shortcut maker to open it. It was under yulong labtest I believe. One of the menus are all in chinese so I'm not real sure what else it would let you access.

---

TreyVega said:
You guys suck
Click to expand...
Click to collapse
Well let's see you do something there buddy, obviously you're the expert on the subject.
Cracking enterprise level security isn't just clicking a button. and you ain't paying me. I have a stack of phones and other devices to work on and other more pressing things to do with my life. So, kindly, take your opinion and shove it, root will be released when it's released.

---

m3nty said:
I don't know if you guys figured this part out yet or not but I was able to open the engineering menu and turn on the diagnostics port and modem. I'm not very familiar with using it to my advantage but I used quick shortcut maker to open it. It was under yulong labtest I believe. One of the menus are all in chinese so I'm not real sure what else it would let you access.
Click to expand...
Click to collapse
EDL mode won't help without the proper mbn, none of which that are publicly available work. Or if you're talking about the hidden flasher activity we found that awhile ago but I haven't really looked too far into it as i don't have a USB-C OTG drive.