The device is on the same platform as uz801 - msm8916. Root is locked, no BusyBox, no initmifiservice.sh. Root was enabled by reassembling the bootloader with root unlocking variables and adding the adb binary from uz801 instead of the native one. As a result, I got full root access by default. I also had to upload busybox from uz801. I manually uploaded rayhunter to the device, everything starts up, web interface and logs show no errors. The only thing it doesn’t see is the battery, which it persistently reports. All that’s left is to finish automating the boot process.