Alcatel Pop35 Notes

Stock kernel output

Here is dmesg collected with TCLFeedback util http://pastebin.com/yWe0CRCi

---

Vendor kernel source

Alcatel released GPL sources for device https://sourceforge.net/projects/alcatel/files/?source=navbar
Filename OT_5065_20160506.tar.xz

---

Parse vendor kernel source for device traces

Vendor sources contain configs for alot of devices.
Quick grep sources to find how vendor calls device, using some names from stock dmesg:

grep "PM8909 SMB1360 1GB MTP"
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:       model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi355/msm8909-mtp-smb1360.dts:      model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi37/msm8909-mtp-smb1360.dts:       model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi384g/msm8909-mtp-smb1360.dts:     model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi445_tf/msm8909-mtp-smb1360.dts:   model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/qcom/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";

grep "HX8379C TDT fwvga video"
arch/arm/boot/dts/pixi35/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:                qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi355/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:               qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi37/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:                qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi384g/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:              qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi445_tf/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:            qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";

grep "TLi020A1-1956265-2000mAh"
arch/arm/boot/dts/pixi35/TCL_TLi020A1_1956265_2000mAh_3p4COV_VBMS_Final-0729.dtsi: qcom,TCL-TLi020A1-1956265-2000mAh-VBMS-data {
arch/arm/boot/dts/pixi35/TCL_TLi020A1_1956265_2000mAh_3p4COV_VBMS_Final-0729.dtsi:      qcom,battery-type = "TLi020A1-1956265-2000mAh";

grep -sni board-id arch/arm/boot/dts/pixi35/msm8909*.dts
arch/arm/boot/dts/pixi35/msm8909-1gb-cdp.dts:22:        qcom,board-id= <1 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-mtp.dts:22:        qcom,board-id= <8 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skua.dts:20:   qcom,board-id= <0x1000b 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skuc.dts:18:   qcom,board-id= <0x1000b 0x8>, <0x11000b 0x8>, <0x21000b 0x8>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skue.dts:18:   qcom,board-id= <0x1000b 0x9>;
arch/arm/boot/dts/pixi35/msm8909-1gb-rcm.dts:23:        qcom,board-id= <21 0x0>;
arch/arm/boot/dts/pixi35/msm8909-512mb-mtp-smb1360.dts:25:      qcom,board-id= <8 0x103>;
arch/arm/boot/dts/pixi35/msm8909-cdp.dts:23:    qcom,board-id= <1 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp.dts:23:    qcom,board-id= <8 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:24:    qcom,board-id= <8 0x3>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-1gb-qhd-rcm.dts:23:     qcom,board-id= <21 0x1001>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-1gb-rcm.dts:22: qcom,board-id= <21 0x1>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-cdp.dts:24:     qcom,board-id= <1 0x2>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-mtp.dts:23:     qcom,board-id= <8 0x2>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-mtp-smb1360.dts:23:     qcom,board-id= <8 0x4>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-qhd-rcm.dts:24: qcom,board-id= <21 0x1101>;
arch/arm/boot/dts/pixi35/msm8909-qhd-cdp.dts:25:        qcom,board-id= <1 0x1100>;
arch/arm/boot/dts/pixi35/msm8909-qhd-rcm.dts:25:        qcom,board-id= <21 0x1100>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skua.dts:19:       qcom,board-id= <0x1000b 0x100>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skuc.dts:19:       qcom,board-id= <0x1000b 0x108>, <0x11000b 0x108>, <0x21000b 0x108>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skue.dts:19:       qcom,board-id= <0x1000b 0x109>;
arch/arm/boot/dts/pixi35/msm8909-rumi.dts:22:   qcom,board-id= <15 0>;
arch/arm/boot/dts/pixi35/msm8909-sim.dts:22:    qcom,board-id= <16 0>;

It seems Pop3 (5) name in vendor kernel sources is pixi35. This 3 seems to be our targets:

arch/arm/boot/dts/pixi35/msm8909-1gb-mtp.dts:22:        qcom,board-id= <8 0>;
arch/arm/boot/dts/pixi35/msm8909-mtp.dts:23:            qcom,board-id= <8 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:24:    qcom,board-id= <8 0x3>;

Bootloader

It is usual for qcom LK but with disabled fastboot mode.
Stock firmware 01002 contain Developer options->Enable OEM unlock switch, but
it has no visible effect.
4PDA recomends suspicious KingRoot v.4.0.0.233 app.
It realy installs su somehow, but also place alot of strange files into
all places of system including read-only recovery areas.

Need to check iovyroot or rowhammer exploits, maybe it is possible to use them.

---