[Android General] brainvision:
*** Disclamer
* Your warranty is now void.
*
* We are not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at us for messing up your device, we will laugh at you.

Hi guys and girls, as you may know it's pretty easy to find here on xda but on other forums (techablets for example) info and files for rooting this tablet, but who has the TCL variant /which is Dual Boot Type C one) will only find outdates files and complex guides; that's the reason why - after spending a lot of time on bootloops and fails trying to figure how the hell modify the boot.img) I finally decided to share what I found here.

First thing first: this guide collects, improves and updates how-to from Laura of techtablets; I also want to thanks [MENTION=3563432]jetfin[/MENTION] and [MENTION=4678110]master.pumpgun[/MENTION] (aka Tom on techtablets) - they know why! :D

I will basically divide this guide per two: first section is READY TO FLASH, where you'll find my own boot.img (from and ONLY for the latest available stock build); before flashing this image file PLEASE be sure to check if your version is the same I had when preparing the image; also you should absolutely check the MD5 of all the files you will download from here:

check MD5 on any Linux distro by simply typing

md5sum /path/to/file/file

on Windows you could maybe use this tool: WinMD5

The second section is DO IT YOURSELF, and it's for users with a different kernel/build version from mine. I'll try to eventually update the boot.img if we will receive any new OTA, which I think will never happen. I'll write the second section as soon as possible, but I can speed work up if requested and if Cube updates

- - - - - - - - - - -​

---> READY TO FLASH

PLEASE NOTE
While the general procedure here reported remains
always correct, the files provided in this part of the
guide - specially the modified boot.img may not work
into your device is the kernel and build version are different
from the one I had, so please go to Settings, About tablet
and check if your specs meet mine:
[B]Model[/B] i15-TCL
[B]Kernel[/B] 3.14.37-x86_64-L1-R517 softteam@pdd-build #1
Sat May 7 17:02:18 CST 2016
[B]Build[/B] i15-TCL_V1.0_20160507

If you want to root your i15-TCL there's an high chance you would not need nothing more than backup your data, install drivers and adb/fastboot tools and flash file you will download here! BUT you need to have the same kernel and build as I had when prepared the boot.img file, which is the latest at the moment I'm writing. If you know about a newer version lease notify me and I'll try to process it again.

Last but not least, please note that is a pretty long and detailed Guide, I tried to explain and illustrate every single step, also covering some very common issues you may have, so please don't blame on me if it's a long story to read, I'm sure that a few newbies will appreciate :cowboy:

First thing to do is to backup data you want to restore because we need to unlock the bootloader (unfortunately there's no way to achieve the root without that, I tried everything I could but it's not possible). Also a general backup of all your partitions (both Windows both Android) could help and make you feel more comfortable. To backup partition please refer this thread on techtablets: The big threads of how-tos. Windows users could also have to install the proper Intel driver attached to end of the post.

Once you did that install adb/fastboot:

if you use Windows you can use this tool;

if you use a Linux distro please check if the package android-tools (more info here is available for your distro, otherwise you may have to install the official Android SDK (info about that here; no need Android Studio).

Into your tablet go to Settings / About tablet and press 7 times the Build number fields to enable Developer options; now go Back and tap the new voice Developer option: be sure that the main switch is ON and so the OEM unlocking and the USB debugging ones.

Connect your tablet to your PC, open the command prompt or a Linux shell and type

adb devices

you should receive an output like

adb devices
List of devices attached
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
0123456789ABCDEF	device

If not, please please stop and check previous steps, but also:

If you use Linux and you see a udev error about permissions you have two solutions: one is running the adb/fastboot by root/sudo, another one is to let udev correctly recognize your idVendor and so your device (always prefer this last way, if possible!), which you can do by following this great mini tutorial on StackOverflow

If you use Windows 64bit try to install the driver attached below; don't know if they are also available for 32bit.

Now you have the basic stuff prepared and you are ready to go to fastboot/bootloader, so this is the last time you could check if your build is the same I had, so please do it if you missed that step before. Once more, the info you read from Settings / About tablet have to be

[B]Model[/B] i15-TCL
[B]Kernel[/B] 3.14.37-x86_64-L1-R517 softteam@pdd-build #1
Sat May 7 17:02:18 CST 2016
[B]Build[/B] i15-TCL_V1.0_20160507

Into your command prompt or shell type

adb reboot-bootloader

Your device will now go to fastboot mode. You can use your Volume Down / Volume Up to move choose menu commands and Power button to pick one. At the moment you don't need to pick any, so check if you have these two lines in red:

[COLOR="Red"]SECURE BOOT - disabled
LOCK STATE - unlocked[/COLOR]

If you have these exact lines you can jump to step10. My bootloader (and also Tom one) was already unlocked; others people reported it was locked, I guess it depends from where we bought the device. So, if your bootloader has those two red lines (which means the bootloader is already unlocked) go to step 10. If you have similar lines but in white and with different text, go to next step

CAUTION: this will permanently erase your userdata partition, which is where you store the applications and their data; you may also have there downloads, music, videos and photos so BE SURE you updated your relevant stuff!! If want to go further type into your command prompt/shell

fastboot devices

and check if you have the right output, that is

0123456789ABCDEF	fastboot

If so, go on by typing:

fastboot oem unlock

This will erase your data and finally unlock the bootloader. you'll see something like that

...
OKAY
[ 0.162s] finished. total time: 0.162s

Now reboot the bootloader: move between the menu with the Volume rockers and press Power when you selected the Restart bootloader command. Wait for reboot, choose Android and you are on bootloader / fastboot mode again. Now you should absolutely have those two lines in red from step 6.

Download modified boot.img rootboot_mod.img and once finished PLEASE CHECK THE MD5 of the file: it should ABSOLUTELY match this one: 53cc4b08b123489e7c73cb013742f35d

Type on command prompt/shell

fastboot flash boot /path/to/your/file/rootmod_boot.img

Let the magic happen!

Now download the custom TWRP recovery (courtesy of [MENTION=2472806]vampirefo[/MENTION]), check if MD5 is correct (3c05a8704f5a77e20a45364c7a822a2b) and flash it with

fastboot flash recovery /path/to/your/file/i15_recovery.img

Use the Volume rockers to pick the Recovery mode command and press Power to go to recovery. Swipe to allow modification, go to Mount and tap the System checkbox

Download the latest SuperSu recovery flashable version available here, check the MD5 reported in that page and then from your tablet in recovery tap Advanced and then Adb Sideload. Swipe to let sideload mode start and type into your command prompt / shell (and change the path /opt/android-sdk/platform-tools/ with the path where YOU installed adb/fasboot)

adb sideload /path/to/your/file/supersu_file_you_downloaded.zip

If you are on Linux and you have udev permissions issues again when sideloading proceed like that

cd /opt/android-sdk/platform-tools
su
Password:
root@*********:/opt/android-sdk/platform-tools# ./adb kill-server
root@*********:/opt/android-sdk/platform-tools# ./adb start-server
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
root@*********:/opt/android-sdk/platform-tools# ./adb devices
List of devices attached
0123456789ABCDEF	sideload
root@*********:/opt/android-sdk/platform-tools# ./adb sideload /path/to/your/file/supersu_file_you_downloaded.zip

If you have issues on Windows or still having issues on Linux you can always copy the SuperSu zip to a USB Pen and attach the pen to the tablet using the OTG cable or paste the file to a micro SD.

Reboot your device and it's done!

Doing that instead of using the well know root.bat is much better - IMHO - because we don't have to reboot the device two times and we don't have to uninstall SuperSu and flash a new version to update binaries (SuperSu it is not able to update the binaries by itself, nor by recovery nor by app. Also remember that when a new version os SuperSU will be available: Open SuperSu app, go to Settings and tap on Reinstall. Wait for it to finish and shut down the device. Go to bootloader (or use adb when the device is still on), download latest updated flashable SuperSu zip and flash via recovery).

DOWNLOADS SECTION

rootmod_boot.img

i15_recovery.img

- - - - - - - - - - -​

---> DO IT YOURSELF

WARNING: to do that you need a Linux machine / Virtual machine!

First, be sure to have adb and fastboot working; if issues read the first section for common solutions; you should also have already unlocked your bootloader.

If you did not create a dd backup of your partition I recommend once again to do that; you should at least backup android_boot, android_recovery, android_system (but also consider android_bootloader and android_bootloader2). Please note that to check partition in a human readable mode you can use

adb shell
ls -las /dev/boot/by-name/*

Now we should create our working folders environment; you can do that by yourself or follow my suggstions.

Open a terminal as normal user; you

should be in your home folder

; launch the following commands one by one

mkdir -p Android/iWork10/_working/ ; cd Android/iWork10
mkdir _stockimg ; cd _stockimg
adb shell
su
dd if=/dev/block/by-name/android_boot of=/sdcard/boot.img
cd /sdcard/
md5sum boot.img > bootmd5
exit

please note that you could have to execute the exit command 2 times; just be sure to go back to your terminal into your

/home/USER/Android/iWOrk10/_stockimg

if su is still not available try to dd the same; for me the bootloader was already unlocked and I had no issue to create the dd image

Then

adb pull /sdcard/boot.img
adb pull /sdcard/bootmd5

and check if MD5 is OK with

md5sum -c bootmd5

if error recreate the boot image file, if OK go on.

Now we need to download and extract the Android Bootimg Tools; click this link and save it into the

/home/USER/Android/

folder; once downloaded (the file it's less than 8 kB) we'll extract the two file in the _working dir so to have all the stuff organized; please note that it's important to keep files organized because we'll decompress and re-compress the boot partition and the kernel it contains; if we don't move files appropriately unneeded stuff could go into the kernel! So please try to understand the process or to follow my steps

cd ../_working/
tar -zxvf ../../android_bootimg_tools.tar.gz
mkdir bootimg
./unpackbootimg -i ../_stockimg/boot.img -o bootimg/

As you can see we unpacked the stock boot.img to the folder bootimg we just created..

Now let's extract the ramdisk, that is where we were pointing from the start..

cd bootimg ; mkdir ramdisk ; cd ramdisk
gunzip -c ../boot.img-ramdisk.gz | cpio -i

Now if you are familiar with nano or pico terminal continue on terminal to apply the following mods, otherwise open your file manager to the ramdisk folder, then open the

default.prop

file and change

ro.secure=1

to

ro.secure=0

Save and close the editor.

Open the

init.rc

file and change

service media /system/bin/mediaserver
class main
user [COLOR="Red"]media[/COLOR]

to

service media /system/bin/mediaserver
class main
user [COLOR="Red"]root[/COLOR]

Please note here that if your bootloader was unlocked without your intervention you could have already user root (I had). In that case just leave as it is and close, otherwise save and close.

Go back to your terminal, you should still be into the ramdisk folder, if not navigate with cd to go to that folder and then

find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz

Now we have our new ramdisk; at this point we need to open the

boot.img-cmdline

file that is located into the bootimg folder and copy its content, then go back to the terminal; the terminal should be still in ramdisk folder, so

cd ..\..\

and we are into the _working folder.

Now the

last command, that you CANNOT simply copy and paste

. The command is something like that (hold on, don't execute it)

./mkbootimg --kernel bootimg/boot.img-zImage --ramdisk bootimg/newramdisk.cpio.gz --cmdline 'CONTENT OF YOUR boot.img-cmdline CONTENT HERE; PUT IT BETWEEN SINGLE ' BOTH AT THE START BOTH AT THE END' -o root_boot.img

Please note the double -- for kernel, ramdisk and cmdline options (while single - for -o that stays for output) and also note the single ' peaks that contain the boot.img-cmdline content.. So in my case it will be:

./mkbootimg --kernel bootimg/boot.img-zImage --ramdisk bootimg/newramdisk.cpio.gz --cmdline 'loglevel=5 androidboot.hardware=cht_cr_mrd_w firmware_class.path=/system/etc/firmware i915.fastboot=1 memmap=4M$0x5c400000 vga=current i915.modeset=1 drm.vblankoffdelay=1 enforcing=0 androidboot.selinux=permissive console=ttyS0,115200n8 bootboost=1 pm_suspend_debug=1 pstore.backend=ramoops' -o ../root_boot.img

BUT PLEASE DON'T COPY AND PASTE THIS ONE; JUST USE YOUR

boot.img-cmdline

FILE (I'm pretty sure they are identical but cannot be sure, SO USE YOURS)

If the command doesn't give errors or the standard output that describe the usage of a linux command (so like usage: mkbootimg --kernel <filename> --ramdisk <filename> - this means you missed something) we are done, we just need to flash it and root. So we now have our modified boot image which will let the tablet boot a rooted OS without bootloop.

If you haven't do it already go to download latest Recovery Flashable zip of SuperSU from SuperSu webpage and the custom TWRP recovery for this device that you find in the first section (also check MD5) and copy both to your internal of external sdcard (if you are not familiar with sideload)

Reboot your device to bootloader with

adb reboot-bootloader

Once it's there,

fastboot flash boot /home/USER/Android/iWork10/root_boot.img
fastboot flash recovery /path/where/you/downloaded/recovery.img

Now use the volume rockers to pick RECOVERY MODE option and press the Power button. The device will boot the TWRP recovery; allow system modifications when asked and finally flash the SuperSu zip file you downloaded and copied to the tablet (or use adb sideload /path/to/supersu/into/your/pc/supersufile.zip)

You may need to adjust settings in TWRP (timezone and language), then reboot the system and you should have rooted your i15-TCL!

It's easy, isn't it?

PLEASE NOTE: If you have errors like adb, fastboot not recognizing your device, don't ask but read the other section where I explain the most common solution for Windows and Linux; same if you don't find links for recovery, SuperSU or other read the first section, thanks!

- - - - - - - - - - -​

THANKS

[MENTION=3563432]jetfin[/MENTION] for providing a lot of goodies that saved my ****** last month :o (wish you all the best for the next future mate!)

[MENTION=4678110]master.pumpgun[/MENTION] (aka Tom on techtablets - amazing guy! :good:)

[MENTION=2472806]vampirefo[/MENTION] for custom TWRP for this device

Laura - for all the info she's made available for this device