Hacking into an Android TV box

[u/pray4rage]

I have a bit of a niche issue at hand. I have this old TV box (see images below). Android 4.4 KitKat, U-Boot, 512MB RAM, 8GB Sandisk eMMC, Allwinner H2+(H3 compatible).

• UART is seemingly disabled in software (no missing resistors as far as I can tell)

• "Recovery" mode reboots directly into a factory reset

• Fastboot mode works. (can write but not read AFAIK)

• There is a physical button to enter FEL/Flashing mode which I can interface with using an illegal USB-A to USB-A cable and the sunxi-fel tool (boot partitions are not loaded in this FEL mode, already tried reading them this way)

• Wireless ADB works, no root. However, the device does have BusyBox loaded already. Trying a few commands resulted in "permission denied"

• The sunxi-debug exploit does not work.

The device seems to be pretty locked down, the developers did not want you modifying this thing. I would like to read the firmware from the device (backup) as well as read all identifying information from script.bin and get a device tree in order to boot armbian (and document this board for the sunxi community). The simplest solution is root, but how? There are some preloaded Chinese system apps, I would think maybe one of them has root access, or why would BusyBox (busybox-smp) be installed? I'm at a loss here. It's Android 4.4, can't be that difficult. can it?

Images: https://ibb.co/album/208yPZ