TCL Android TV Root Attempts

The TCL 65T61C (Android TV 12, Realtek platform) sitting in our living room became a project with one question: “what runs inside this thing, and can it be rooted?” The goal was ownership, not intrusion — it’s our device, so its software deserves to be understood. Rules were set up front: the TV would never be opened, the family would never be affected, every step would stay reversible.

Eight days of paper-first, then hardware: the full firmware package (~2 GB) was pulled from TCL’s servers and the daemon, HAL services, even the kernel image were solved statically. The live TV was only used for verification. A door in TCL’s diagnostics service was found: running arbitrary code as uid-1000 (system_app). On the IR side, a custom transmitter circuit was built to learn the remote’s language.

Inside the TV runs a root daemon called tclfactoryos, containing a command processor with a system() call behind it. Exactly 3 channels lead there: the factory remote sequence (IR), a physical UART, and a p2p TCP channel the TV dials out itself. Root was a corridor with three doors — this project documented the locks on all of them.

The IR protocol was solved by measurement: references say 38 kHz, but this receiver wants 56 kHz — the silent killer of every early attempt. The full 40-key code table was extracted and the TV was controlled key-by-key from our own circuit. Disassembling the kernel driver revealed that factory keys surface as special type-0x19 events, and that the sequence’s digit values come from the key table itself. The last step was arithmetic: the sequence’s fixed 0x01/0x0C marker bytes simply don’t exist in the table — no valid sequence can ever be constructed.

Three turns changed the project: (1) measuring the remote with a cheap receiver module exposed the 56 kHz truth; (2) it was proven that the p2p channel is born only from a valid IR sequence — the finding that killed the “just reboot it” hope; (3) the transistor pinout in the setup guides turned out to be wrong (C–B–E). And one accident: a reboot fired with factory mode on locked the TV into a pixel-test screen for 40 minutes — the project’s most valuable rule (reboots only with approval) was born from that.

Root was not achieved — but it was closed with proof: on this firmware, software root cannot be constructed, because the factory’s own key table lacks the sequence’s fixed bytes. 20+ closed attack vectors were inventoried with reasons. At the end the TV was scrubbed clean: the daemon was shut off from ever starting again, tools were removed, Bluetooth restored. Everything — documentation, tools, evidence — is open source: github.com/4onurdemir/tcl-androidtv-root-attempts

The photo above is the real rig that talked to the TV: Arduino Uno + 2N2222A driver + 940nm IR LED. It raised and lowered the volume and carried every factory probe. Log excerpts, raw IR measurements and the kernel key table live in the repo: github.com/4onurdemir/tcl-androidtv-root-attempts

The big one: don’t trust, measure. Neither databases nor kernel sources stated this receiver’s real carrier. Second: the bar for every claim is “observed effect on the TV + a log line”, never “the LED lit up”. Third: impossibility is a result too — a proven closure beats an abandoned attempt. And fourth: kill dead ends by documenting them; a project without memory lifts the same stone twice.