TCL 50C721 rooting toolkit

Full root exploit chain and post-root toolkit for tethered root, SELinux Permissive, ad blocking, debloat and automated backup on one TCL Android TV firmware. This is firmware-specific research and tooling, not a universal TCL root tool or a supported installer.

Tested scope

Item	Recorded test unit
TV	TCL QLED 50C721 / BeyondTV6
Firmware	V8-R51MT02-LF1V903, build AR10
Android / kernel	Android 11 / 4.14.198+
SoC / GPU	Realtek RTD1319 / Mali-G31 (Bifrost, kbase r28p0)
Userspace	32-bit ARMv7
Reported security patch	2024-03-05
Historical result	ADB shell with uid=0; SELinux Permissive

Only this model/firmware combination has a recorded successful result. Exact SoC identification and Mali driver revision are inconsistent across the original records; see compatibility limits. No fresh rooting test was performed while preparing this source release.

What it does

Exploit chain (auto_root)

The autonomous root binary (auto_root.c) achieves uid=0 from an unprivileged app context in under 2 seconds:

1. Phase 1 — CVE-2022-22706 (Mali GPU page-cache write): Imports a MAP_SHARED mapping of libc.so's __cxa_atexit page as a GPU user buffer via KBASE_IOCTL_MEM_IMPORT. Uses mremap(MREMAP_FIXED) to replace the file mapping. Writes 112-byte Thumb-2 shellcode over __cxa_atexit in the page cache (on-disk file unmodified — dm-verity protected).

2. Phase 3 — Natural trigger: Every new C++ process calls __cxa_atexit() during CRT init, executing the shellcode. A privileged domain (audioserver, rtkm_scene) maps physical page 0x1DE7000 via /dev/rtkmem and writes selinux_state.enforcing = 0.

3. Phase 4a — Direct credential modification: With SELinux Permissive, walks the kernel task_struct linked list via physical memory reads through /dev/rtkmem. Finds our process by matching comm[], overwrites cred struct with uid=0 and full capabilities from init_cred. Clears TIF_SECCOMP to bypass the zygote's BPF seccomp filter.

4. Phase 4b — System hardening: Bind-mounts ad-blocking hosts, drops iptables rules blocking telemetry IPs, disables 28 bloatware packages, grants APP_AUTO_START for boot persistence, deactivates shellcode, re-enforces SELinux to Enforcing.

Standalone stages

The two standalone programs (root_cve22706.c, libc_rtkmem_patch2.c) implement the same CVE-2022-22706 page-cache write primitive as separate tethered-root stages, useful for manual ADB rooting and understanding the exploit primitively.

Scripts

• scripts/root.sh — ADB automation: connects to TV, runs both standalone stages, verifies root + SELinux state.
• scripts/post_root.sh — Post-root hook called by auto_root after hardening. Creates full device backups: sideloaded APKs, app data, WiFi config, all settings, package lists. Auto-prunes to 5 most recent backups.

Included

• Technical summary: chain, side effects and evidence limits.
• Native source and build notes: autonomous root + two standalone stages; no prebuilt executables.
• Compatibility limits: what must be established before considering another device.
• Recovery notes: model-specific historical USB recovery and warnings.
• Kernel source excerpt: supporting analysis, not a build dependency.

No APK or reproducible APK application project is included; there is no install-once automatic-boot release here. The autonomous root binary is designed to be called from an APK's native code, but the APK wrapper is not part of this release.

Quick start

# Build (requires Android NDK)
cd exploit && make

# Push to TV
adb connect <TV_IP>:5555
adb push bin/auto_root /data/local/tmp/
adb push bin/root_cve22706 /data/local/tmp/
adb push bin/libc_rtkmem_patch2 /data/local/tmp/

# Option A: Run the autonomous chain (includes hardening + backup)
adb shell /data/local/tmp/auto_root

# Option B: Manual two-stage root via script
bash scripts/root.sh <TV_IP>

Before considering use

Use only on hardware you own or are explicitly authorized to assess. Review all C files and every firmware-specific assumption first. Preserve data and obtain a known matching recovery image and procedure independently. Do not expose ADB to an untrusted network. Rebooting removes the volatile patches (page-cache, bind mounts, iptables), but package disables and APP_AUTO_START persist.

Do not flash patched boot or vbmeta images based on this project. Two historical attempts bootlooped; neither a persistent-root method nor a universal recovery guarantee was established.

License

MIT for all original code. The kernel excerpt (kernel/mem.c) retains its GPL-2.0 license and copyright notices. See LICENSE and provenance for attribution and upstream references.