---

🌐 Languages: English (this file) · 🇹🇷 Türkçe

The Complete Map of a TCL Android TV's Factory Layer — and the Proof of Why Software Root Is Impossible on This Firmware

Eight days, one TCL 65T61C, one Arduino Uno, and hundreds of closed doors. This repo is not a "root guide" — it's a closure report: the TV's factory/service layer was mapped end to end, software root was shown — with evidence — to be unattainable on this firmware, and everything was documented so the next researcher doesn't have to re-walk the graveyard.

The short story: inside the TV runs a root daemon called tclfactoryos, and inside it runs a command processor with a system() call behind it. Three channels lead there: IR, UART, and p2p. We fully reverse-engineered the IR protocol (56 kHz!), disassembled the kernel driver, and proved that the fixed marker bytes of the factory key sequence simply do not exist in the TV's own key table — no valid sequence can ever be transmitted. UART is physical; the p2p thread only ever spawns from a valid IR sequence. The software surface: exhausted. This repo is the whole journey.

A note on languages: this README is in English, and so is the full documentation: the seven phase documents live in docs/en/ (Turkish originals in docs/). Code comments follow English where it matters.

---

The device

Model	TCL 65T61C (65", Android TV 12)
Platform	Realtek RTD2875P / rtd6748
Firmware	V8-R75PT01-LF1V618 (build STT2.230203.001 release-keys)
Kernel	5.4.284+ · security patch 2025-12-05
Remote	RC833A dual-mode (Bluetooth HID + IR)

The real rig that talked to the TV: Arduino Uno + 2N2222A driver + 940 nm IR LED — photographed during the sessions. This circuit raised and lowered the TV's volume, key by key, and carried every factory probe in docs/04.

The research was done on a device owned by the author, strictly inside their own home network. The TV was never opened; no persistent writes, no key/MID/SN tampering; the device was returned to factory state the moment the work ended.

The five findings that matter

1. The IR protocol: a 56 kHz carrier. Every reference says 38 kHz; this receiver wants 56. That single mismatch silently killed every early attempt. Header 4000+4000 µs, 24-bit MSB-first ADDR(4)|CMD(8)|~ADDR(4)|~CMD(8), bit = 500 µs mark
   • 1000/2000 µs space. Full 40-key code table: data/TCL-kumanda-kodlari.md.
2. The kernel IR driver's private language, decoded. Frames are accumulated LSB-first, each byte bitrev8-transformed, into a 32-bit w19; the key table matches these values (VOL+ = 0x0b0f4f00, verified byte-for-byte). Factory keys surface as special type-0x19 input events — and the argument byte comes from the key table, not the frame.
3. The impossibility proof. The daemon's factory sequence demands fixed marker bytes 0x01 and 0x0C; those values must come from the table's digit family ({b2,a3,f7,ac,81,58,92,ef}); they don't exist there. No valid sequence can be constructed. On top of that, the report-mode flag that gates type-0x19 emission lives behind root-only sysfs.
4. The secret birth of the p2p channel. Nothing at daemon startup creates the reverse-connect thread; only a valid IR commit ever spawns it. Which means neither a reboot nor a daemon restart brings p2p back — the finding that killed the "write the IP to the DB and reboot" hope with evidence.
5. A uid-1000 code-exec door. TCL's diagnostics service runs any jar you hand it as system_app, plus a factory socket on 127.0.0.1:27856 (144-byte frames, a property DB with no whitelist). Not root — but fingers on the root surface.

Evidence

Every claim was verified against logs/getevent/disassembly; sample excerpts: data/kanit-ornekleri.md · raw IR measurement log: data/tus_kaydi_ham.log · the kernel key table itself: data/ir_table.bin (+ parser: tools/arduino/ir_tablo_parse.py).

What's in the repo

docs/                            the seven phase documents — Turkish originals
docs/en/                          the same seven documents, fully in English
tools/arduino/fabrika/           the universal IR blaster (fabrika.ino + firing script)
tools/arduino/{kumanda,tus_kaydet,ogren_gonder,ses_ac_oto}/   the IR tool-chain sketches
tools/arduino/rcu_hesap.py       RCU 13-byte + CRC16-CCITT-FALSE generator (note: legacy word format — docs/04)
tools/factorysock.py             client for the 27856 factory socket
tools/p2pclient.py               ts-protocol client skeleton
data/                            key table + kernel ir_table.bin + raw log + evidence excerpts
assets/                          cover GIF + real-rig photo + receiver/TV wiring guide (PDF)

Reading order

1. docs/en/01 — Recon & access doors — firmware acquisition, the uid-1000 door, the M-jar harness family
2. docs/en/02 — Inside the daemon — socket protocol, FCMD, ts/p2p, the root shell points
3. docs/en/03 — The IR war: from 38 to 56 kHz — every death and the breakthrough
4. docs/en/04 — Root phase: kernel proofs — w19, type-0x19, the impossibility proof, p2p's birth
5. docs/en/05 — The dead-end inventory — 20+ closed vectors, with reasons
6. docs/en/06 — Lessons — technical + method + discipline (14 lessons)
7. docs/en/07 — Tools & usage — every tool's recipe

⚡ The one untested path that can still work — physical UART. Try it.

Everything above proves the software doors are shut. Exactly one channel was never tested, and there is no evidence it is closed: the physical UART. The owner of this particular TV couldn't open a family device — but if you can reach the service line on this model or a sibling, this is a genuinely promising path with every piece already prepared: