[General Questions and Answers] Bruno25:
Answering to myself...

##STANDARD DISCLAIMER => No responsibility, blah, blah, :p...##

With KitKat, it is also necessary to have a running "su daemon".

A solution is to create a "install-recovery.sh" file in /system/etc. This script is executed at each boot.

Detailed step by step:

Files: (remove [grr] from ht[grr]tp)

busybox binary, for example from ht[grr]tp://busybox.net/downloads/binaries/latest/busybox-armv7l (to be renamed to busybox)

su binary, Superuser.apk and install-recovery.sh to be extracted from ht[grr]tp://download.clockworkmod.com/superuser/superuser.zip​

Operating system:

Any decent Linux distribution (I'm on Ubuntu since years)​

1/ copy busybox binary to the tablet

user@PC:~$ adb push busybox /data/local/tmp/

user@PC:~$ adb shell

shell@mango:/ $ chmod 755 /data/local/tmp/busybox​

2/ start a telnet daemon on the tablet

install "ExDialer - Dialer & Contacts" on the tablet

Initiate engineering mode: dial *#*#ENGMODE#*#*

Go to the "Log and Debugging" tab

Launch MTKLogger

Go to the settings

Select "Run Command"

Type: /data/local/tmp/busybox telnetd -l /system/bin/sh -p 1234

Press ok. Now a telnet daemon should be running on the tablet with some kind of privileges.
​

3/ connect to the tablet (adb shell + telnet):

user@PC:~$ adb shell

shell@mango:/ $ /data/local/tmp/busybox telnet 127.0.0.1 1234​

4/ Find out the start address and size of the System partition

shell@mango:/ $ cat /proc/dumchar_info​

Part_Name Size StartAddr Type MapTo
preloader 0x0000000000c00000 0x0000000000000000 2 /dev/misc-sd
mbr 0x0000000000080000 0x0000000000000000 2 /dev/block/mmcblk0
ebr1 0x0000000000080000 0x0000000000080000 2 /dev/block/mmcblk0p1
pmt 0x0000000000400000 0x0000000000100000 2 /dev/block/mmcblk0
pro_info 0x0000000000300000 0x0000000000500000 2 /dev/block/mmcblk0
nvram 0x0000000000500000 0x0000000000800000 2 /dev/block/mmcblk0
protect_f 0x0000000000a00000 0x0000000000d00000 2 /dev/block/mmcblk0p2
protect_s 0x0000000000a00000 0x0000000001700000 2 /dev/block/mmcblk0p3
seccfg 0x0000000000020000 0x0000000002100000 2 /dev/block/mmcblk0
uboot 0x0000000000060000 0x0000000002120000 2 /dev/block/mmcblk0
bootimg 0x0000000000600000 0x0000000002180000 2 /dev/block/mmcblk0
recovery 0x0000000000a00000 0x0000000002780000 2 /dev/block/mmcblk0
sec_ro 0x0000000000600000 0x0000000003180000 2 /dev/block/mmcblk0p4
misc 0x0000000000080000 0x0000000003780000 2 /dev/block/mmcblk0
logo 0x0000000000300000 0x0000000003800000 2 /dev/block/mmcblk0
expdb 0x0000000000a00000 0x0000000003b00000 2 /dev/block/mmcblk0
android 0x0000000040000000 0x0000000004500000 2 /dev/block/mmcblk0p5
cache 0x000000002bc00000 0x0000000044500000 2 /dev/block/mmcblk0p6
usrdata 0x0000000332020000 0x0000000070100000 2 /dev/block/mmcblk0p7
bmtpool 0x0000000000000000 0x00000000ff3f00a8 2 /dev/block/mmcblk0
Part_Name:Partition name you should open;
Size:size of partition
StartAddr:Start Address of partition;
Type:Type of partition(MTD=1,EMMC=2)
MapTo:actual device you operate

Look at the line "android". Convert the associated start address and the size in number of 4096 blocks. Considering the values above, I obtained: start adress = 17664x4096, size = 262144x4096.​

5/ dump the content of the android partition (it's there that the su binary will go)

shell@mango:/ $ dd if=/dev/block/mmcblk0 bs=4096 skip=17664 count=262144 | /data/local/tmp/busybox gzip > /data/local/tmp/system.img.gz​

6/ copy that file to the PC and make a copy (who knows... it may be useful)

user@PC:~$ adb pull /data/local/tmp/system.img.gz

user@PC:~$ cp system.img.gz system.img.untouched.gz
​

7/ mount that file (change "user" to your current user name in the following instructions)

user@PC:~$ mkdir /home/user/Iconia_system

user@PC:~$ gunzip system.img.gz

user@PC:~$ sudo mount -o loop system.img /home/user/Iconia_system​

8/ make some change to the android file system (removing old su binary, backing up old install-recovery.sh, installing new su, new install-recovery.sh):

user@PC:~$ sudo rm -f /home/user/Iconia_system/bin/su

user@PC:~$ sudo rm -f home/user/Iconia_system/xbin/su

user@PC:~$ sudo rm -f /system/app/Superuser.*

user@PC:~$ sudo rm -f /system/app/Supersu.*

user@PC:~$ sudo rm -f /system/app/superuser.*

user@PC:~$ sudo rm -f /system/app/supersu.*

user@PC:~$ sudo rm -f /system/app/SuperUser.*

user@PC:~$ sudo rm -f /system/app/SuperSU.*

user@PC:~$ sudo cp /home/user/Iconia_system/etc/install-recovery.sh /home/user/Iconia_system/etc/install-recovery.sh.bak

user@PC:~$ sudo cp su /home/user/Iconia_system/xbin/su

user@PC:~$ sudo chown root.root /home/user/Iconia_system/xbin/su

user@PC:~$ sudo chmod 6755 /home/user/Iconia_system/xbin/su

user@PC:~$ sudo ln -s /system/xbin/su /home/user/Iconia_system/bin/su

user@PC:~$ sudo cp Superuser.apk /home/user/Iconia_system/app

user@PC:~$ sudo chmod 644 /home/user/Iconia_system/app/Superuser.apk

user@PC:~$ sudo cp install-recovery.sh /home/user/Iconia_system/etc/install-recovery.sh

user@PC:~$ sudo chmod 755 /home/user/Iconia_system/etc/install-recovery.sh
​

9 remove some bloatware (optional)

user@PC:~$ sudo rm /home/user/Iconia_system/app/e.g. PlusOne.apk

user@PC:~$ sudo rm /home/user/Iconia_system/priv-app/e.g. AccuWeather.apk
​

10/ unmount the android file system

user@PC:~$ sudo umount /home/user/Iconia_system​

11/ compress the file

user@PC:~$ gzip system.img​

12/ push it back to the tablet

user@PC:~$ adb push system.img.gz /data/local/tmp/​

13/ connect to the tablet and "burn" the modified file system (be patient, will take up to 10 minutes)

user@PC:~$ adb shell

shell@mango:/ $ /data/local/tmp/busybox telnet 127.0.0.1 1234

shell@mango:/ $ /data/local/tmp/busybox zcat /data/local/tmp/system.img.gz | dd of=/dev/block/mmcblk0 bs=4096 seek=17664 count=262144

shell@mango:/ $ exit

shell@mango:/ $ exit
​

14/ restart the tablet