[Android Q&A, Help & Troubleshooting] falk0069:
I have this locked down tablet that was used for prison use. Once you get out of prison you can keep it, but it has no way to install anything and you have to connect to a kiosk every once in awhile. I'm looking to just install a vanilla / custom ROM f possible.

Using mtkclient I've been able to unlock the bootloader and read/write from/to any partition. The problem is I can't find any custom roms for it. I've tried installing firmwares from other manufacturer (such as Lenovo-Tab-E7, Hometech-Alfa-7M), that also have the MT8167 processor but I end up locking things up or just get into a boot loop. I've learned that lk and lk2 partitions are for the display and I lose display functionality if I overwrite them. And everything goes bad if I try a different preloader. Thankful I can still get into brom mode and reflash the original preloader.

I've also tried flashing TWRP recoveries I found for this processor but then the recovery completely stops working. The default one only has a 'restart' option. Even if I could get TWRP running I still don't know what I could do since I need something to flash.

Using the default recovery I can get adb to 'sort of ' work. Actually I did need to edit it slightly and upload my own adb_keys. Once I got authorized I still couldn''t do much. I could do 'adb ls' and 'adb reboot'. But if I tried 'adb shell' it just reported '/system/bin/sh not found'. But regarding, even if I could get adb to work, I still don't know what good it would do me.

Here is some details from the "python mtk printgpt" command:

Preloader - CPU: MT8167/MT8516/MT8362()

Preloader - HW version: 0x0

Preloader - WDT: 0x10007000

Preloader - Uart: 0x11005000

Preloader - Brom payload addr: 0x100a00

Preloader - DA payload addr: 0x201000

Preloader - CQ_DMA addr: 0x10212c00

Preloader - Var1: 0xcc

Preloader - Disabling Watchdog...

Preloader - HW code: 0x8167

Preloader - Target config: 0xe1

Preloader - SBC enabled: True

Preloader - SLA enabled: False

Preloader - DAA enabled: False

Preloader - SWJTAG enabled: False

Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False

Preloader - Root cert required: False

Preloader - Mem read auth: True

Preloader - Mem write auth: True

Preloader - Cmd 0xC8 blocked: True

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader - HW subcode: 0x8a00

Preloader - HW Ver: 0xcb00

Preloader - SW Ver: 0x1

Preloader - ME_ID: 26EDCB3A569E7AC94C2ADF09677C----

Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000

DAXFlash - EMMC FWVer: 0x0

DAXFlash - EMMC ID: Biwin

DAXFlash - EMMC CID: f40122426977696e201000002653----

DAXFlash - EMMC Boot1 Size: 0x400000

DAXFlash - EMMC Boot2 Size: 0x400000

DAXFlash - EMMC GP1 Size: 0x0

DAXFlash - EMMC GP2 Size: 0x0

DAXFlash - EMMC GP3 Size: 0x0

DAXFlash - EMMC GP4 Size: 0x0

DAXFlash - EMMC RPMB Size: 0x400000

DAXFlash - EMMC USER Size: 0x735000000

DAXFlash - HW-CODE : 0x8167

DAXFlash - HWSUB-CODE : 0x8A00

DAXFlash - HW-VERSION : 0xCB00

DAXFlash - SW-VERSION : 0x1

DAXFlash - CHIP-EVOLUTION : 0x0

DAXFlash - DA-VERSION : 1.0

GPT Table:

-------------

proinfo: Offset 0x0000000000080000, Length 0x0000000000300000, Flags 0x00000000,

nvram: Offset 0x0000000000380000, Length 0x0000000000500000, Flags 0x00000000,

protect1: Offset 0x0000000000880000, Length 0x0000000000a00000, Flags 0x00000000,

protect2: Offset 0x0000000001280000, Length 0x0000000000a00000, Flags 0x00000000,

persist: Offset 0x0000000001c80000, Length 0x0000000003000000, Flags 0x00000000,

seccfg: Offset 0x0000000004c80000, Length 0x0000000000040000, Flags 0x00000000,

items: Offset 0x0000000004cc0000, Length 0x0000000000200000, Flags 0x00000000,

lk: Offset 0x0000000004ec0000, Length 0x0000000000100000, Flags 0x00000004,

lk2: Offset 0x0000000004fc0000, Length 0x0000000000100000, Flags 0x00000000,

boot: Offset 0x00000000050c0000, Length 0x0000000001000000, Flags 0x00000000,

recovery: Offset 0x00000000060c0000, Length 0x0000000001000000, Flags 0x00000000,

para: Offset 0x00000000070c0000, Length 0x0000000000080000, Flags 0x00000000,

logo: Offset 0x0000000007140000, Length 0x0000000000800000, Flags 0x00000000,

odmdtbo: Offset 0x0000000007940000, Length 0x0000000001000000, Flags 0x00000000,

vendor: Offset 0x0000000008940000, Length 0x0000000019000000, Flags 0x00000000,

expdb: Offset 0x0000000021940000, Length 0x0000000000a00000, Flags 0x00000000,

tee1: Offset 0x0000000022340000, Length 0x0000000000500000, Flags 0x00000000,

tee2: Offset 0x0000000022840000, Length 0x0000000000500000, Flags 0x00000000,

kb: Offset 0x0000000022d40000, Length 0x0000000000200000, Flags 0x00000000,

dkb: Offset 0x0000000022f40000, Length 0x0000000000200000, Flags 0x00000000,

metadata: Offset 0x0000000023140000, Length 0x00000000026c0000, Flags 0x00000000,

system: Offset 0x0000000025800000, Length 0x0000000046800000, Flags 0x00000000,

cache: Offset 0x000000006c000000, Length 0x0000000007000000, Flags 0x00000000,

userdata: Offset 0x0000000073000000, Length 0x00000006c0f80000, Flags 0x00000000,

flashinfo: Offset 0x0000000733f80000, Length 0x0000000001000000, Flags 0x00000000,

Total disk size:0x0000000735000000, sectors:0x00000000039a8000

What might be my best options? Assuming I could find a 'compatible' firmware, which partitions would be best to overwrite vs. leave alone? And assuming there isn't a compatible firmware out there, which partitions would be best to edit and re-flash? I really just want to get the playstore installed and disable whatever forces a kiosk visit. Any guidance would be appreciated.