[Android Q&A, Help & Troubleshooting] Pxoeb6mU:
I've got my two tablets from GearBest yesterday. They are only going to be used by our 4 year old twins to play some learning games, so my requirements aren't that high, but I like to have tight control over the software that's running on them, so root and Xposed is a must.

The tablet didn't want to oem unlock the bootloader to allow either flashing recovery or directly booting with TWRP using fastboot, leaving only rooting the tablet as is and then flashing TWRP from that way.

The current KingRoot works fine to root the tablet (a few other methods I tried failed). It's not the most optimal solution, as KingRoot, once installed, is calling home A LOT and I'm not sure what it's chatting about with their servers.

Once rooted, Flashify can be installed from the play store, which can then be used to first backup the stock recovery, and then flash the TWRP that I linked above already. That version of TWRP seems to work fine with the tablet.

At this point, it *may* be possible to uninstall KingRoot and use TWRP to install some other rooting method, but I decided against it, as I can't guarantee that KingRoot's uninstall function will actually truly remove everything and not leave anything behind, so there isn't much to gain here. If a guaranteed original system image was available (which, as far as I'm aware, it currently isn't, as to read out the system partition with what's currently available, you have no choice but to root first, which already changes it) this would be the right moment to overwrite the system partition from the original image and start from that...

What I did instead is to make sure that I can put a muzzle on KingRoot.

At this point I first booted into TWRP to do a full backup of all partitions. As long as it's still possible to boot into recovery, this backup should allow to recover from anything that makes the system unusable.

I then did a full factory + internal memory wipe (/sdcard/ is redirected to a subdirectory on the /data/ partition, not a separate partition) which made sure to get rid of anything except what the manufacturer (and kingroot) put into the system partition. System is nicely bare with just a minimum of apps and (non-AOSP) software from google limited to just the play store.

Followed this by flashing the XPosed v87 SDK22 arm64 zip (you can transfer it via adb push while in TWRP) and rebooted into system. After some wait (seriously, just give it time, don't panic) the booted into a nicely clean bare bones 5.1(.1?) close, if not identical to AOSP android that pretends to be 6.0 by showing a fake version number and easteregg in settings. Rooted, with active and working XPosed (after using adb install XposedInstaller_3.1.1.apk to add the required UI).

Next step is to muzzle KingRoot (as beside being chatty with their servers, it does the job well enough), my personal preference here is https://play.google.com/store/apps/details?id=de.defim.apk.lightningwall

After a quick reboot to activate the XPosed module, you can mark the whole KingRoot app as untrusted, which will prevent any further network communication.

At this point, if the log from LightningWall is to be believed (it doesn't cover native code, only framework code as long as you don't activate iptables) nothing else in the system seems to try and talk with anyone.

As I considered this a pretty good basic starting point, I made another backup using TWRP.

From here on out it's really up to everyone's preference what else to install.

I found the whole process very straightforward and simple.

EDIT:

There are also 3 processes that start with MTK in their name which may try to send data somewhere. It's not clear what data they send (probably some type of diagnostic information), but there is no need for them to be able to do that, so they can also be marked as not trusted in LightningWall.

And about booting into TWRP in case the main system shouldn't boot, even after flashing TWRP into "recovery" using flashify, holding Vol- + Power still sends you into that "scary" Chinese menu. Probably one of the entries might allow you to go on and boot into TWRP (Vol- to select, Power to confirm), but I haven't bothered to try and translate them, because you can just connect adb via USB while looking at that Chinese menu and send an "adb reboot recovery" which DOES then reboot into TWRP.