yashsingh1/xdaforums huggingface dataset:
[Fire TV General] eousphoros:
Not looking for any fancy one click all. Just a method to obtain uid 0. I can handle adb, I have a functioning toolchain and a sys admin level knowledge of Linux. Unfortunately I haven't had any success yet getting root.

My laziness and frustration has won over my cheapness. To that effect I would like to offer a 0.3 BTC bounty for a method to obtain root on this swanky device.

Update: Bounty paid. Received functioning method. Unfortunately I've been asked to not release it which I am happy to comply. Thanks! :)
[Fire TV General] Luxferro:
jcase already rooted his. But I don't think he's shared it publicly yet.
[Fire TV General] eousphoros:
I'll believe it when I see it. The kallsyms dump is pretty convincing but isn't absolute proof. I'll continue beating my firetv up in the meantime I guess. If i root mine first, I'll send myself the BTC. ;)

On that note any one know why adb shell has an LD_PRELOAD library called libnimswrap.. looks like it touches a few interesting calls.
[Fire TV General] MicroMod777:
Root and recovery would be good. I got like 28 days left before I can return my FireTV. Hopefully this will be done before then.
[Fire TV General] Cpasjuste:
If someone have a spare device to donate (France) I'm willing to spent some time on it. I did a few cool things on the fire hdx 7" and could probably do some on this device. I think this device could be great if we get a stock ROM running !
[Fire TV General] TooSlo:
http://xdaforums.com/showpost.php?p=51688189&postcount=105

For those who don't want to click the link. Indeed it was [MENTION=2376614]jcase[/MENTION]. No, it wasn't released.
[Fire TV General] eousphoros:
That is of no use to me or others who are looking/needing a priv esclation method for this device until its released. In the meantime I will continue down my path. If I get it before he releases I plan to do full disclosure. Hope I don't burn his exploits.
[Fire TV General] jcase:
Personally I don't care if anyone believes me or not, any looking back at the history of Android exploits will likely see my work more often than not, especially with the Amazon FireOS. When appropriate, I will release.

Bonus tease for everyone else, modified recovery booting (just edited /res/ images to test booting unsigned code)

[YOUTUBE]xLR8zGhLLb4[/YOUTUBE]
[Fire TV General] jcase:
Why not join me in the process, instead of racing against? I'm looking to find less valuable bugs to use, instead of the more dangerous ones I am currently using. Feel free to ping me on freenode or gtalk.

Full disclosure, is something I do often, I believe I have accounted for the majority of open source android exploits. I really appreciate it when ppl explain what they are doing, love seeing the work of others, and love not having to reverse it.
[Fire TV General] jcase:
Current issues with releasing my work right now:

1) No way to interact with a custom recovery (possibly doable with keyboard) and no way to load files to flash without booting into android (possible to mount usb disk in recovery mode?).

2) Looking for a bug to exploit that is less abusable by others

#1 Someone more versed at recoveries is lookign at

#2 I'm working on currently.
[Fire TV General] mknrls:
From what im reading the only recovery that would would work on this device would be cwm because twrp is fully touch. Right [MENTION=2376614]jcase[/MENTION]
[Fire TV General] jcase:
or another recovery, even standard AOSP recovery would work fine for my needs, but need to have both input, and a way to provide files to it
[Fire TV General] mknrls:
True, i personally have never build a recovery from source but i think cwm would be ours best bet if only could find someone to do it lol

btw i think the odroid u2/u3 (dev board) uses the cwm recovery with the keyboard inputs and is supported by CM if that help man
[Fire TV General] jcase:
Yeah keyboard is no issue, but still need a mountable media to store update.zip on, in the even /system or /userdata gets messed up
[Fire TV General] mknrls:
Wouldn't that be done in the fstab or something like that?
[Fire TV General] jcase:
Sure, probably require usb splitter
[Fire TV General] mknrls:
I see lol now just need a dev to work on the recovery :p
[Fire TV General] robclark:
It's overriding the following symbols:

bind

connect

getaddrinfo

so tampering with network somehow.. if no one knows what it does I'll spend some time reading the disasm and figure out.. first guess is intercepting connections to some address, possibly redirecting elsewhere?
[Fire TV General] jcase:
http://pastebin.com/NAZKjiPu
[Fire TV General] robclark:
ok.. yeah, short version it looks like it is blocking some network connections. For example, the overridden connect() seems to open up a (I think local) socket connection (cached per thread), does some communication on that socket, then based on result fakes an error result (setting errno) or forwards the call to the real connect.

seems to be controlled by:

v0 = isFeatureEnabled(1);
v1 = isFeatureEnabled(3);
v2 = isFeatureEnabled(4);

not sure what those feature constants correspond to.. googling for isFeatureEnabled() just digs up some java crap..
[Fire TV General] krasny2k5:
Hi!

AFTV has a serial port, label as UART1, and as stated here: http://xdaforums.com/showthread.php?t=2734774&page=2 you can see kenel boot messages, but nothing more, maybe you can get info there about what's happening with HDD. We don't have a pinout, but it should be easy identify ground, and TX and TX can be identified with trial/error. If you use a TTL-USB adaptator DON'T connect any power pin, only TX,RX and GND.

What do you mean with "double ended cable"?
[Fire TV General] tarvoke:
I think - some weeks ago, 1 person mentioned about making a "wrong" usb (i.e. USB-A to USB-A) cable and got access to fastboot/recovery. I think jcase later mentioned something similar?

so, this is only anecdotes, I haven't tried myself - but maybe the usb port is not only host, but host+guest (in certain states anyway)
[Fire TV General] alwaysbless:
I think you are the first person with a fire tv to successfully install the services framework. Would you mind posting how this was accomplished and sharing the link to the gapps youre using? Have you tried to install the playstore apk?
[Fire TV General] roustabout:
Playstore is in, but reports "no network available" when launched. My guess is that /system/framework/framework-res.apk needs to be able to be installed, and it currently cannot be.

I am using the system app stack from an HP Slate 8 pro to install from. The full firmware update is available at http://h10025.www1.hp.com/ewfrf/wc/...dlc=en&lc=en&os=4153&product=6608624&sw_lang= and you'd need to unpack it to pull out the bits you want.

I tried using gapps for 4.2.2 and got signature errors. So I tried installing the stack that I pulled off the HP box and all was good. (Mostly good.)

I had Google Earth loading this morning also.

I'll do a pm list installed packages when I get a chance.

The reference to double ended USB: the device halts when it has a big harddrive attached to it and powered on at boot time. I think it's reading something from USB at that time, and want to try using an A male to A male connector to see what's what at boot time. I don't know if it'll work; I will also try a powered hub, powered harddrive, and A to A if it doesn't, to see if I can get the no boot state to persist once there's a harddrive in play :)
[Fire TV General] alwaysbless:
I was coming back to post that I got services framework installed (had to sign it) but im getting the same error with the playstore as you. This is nice though now I can get a real version of youtube running on this thing at least! I tried installing settings apk also but was getting an error INSTALL_FAILED_SHARED_USER_IMCOMPATIBLE
[Fire TV General] roustabout:
that shared user incompatible is one that I was getting from (I think) the backup transport app. Not having the network access working is annoying but I was pleased just to get enough installed that I could get full youtube - that's actually how I started down the path last night, also.
[Fire TV General] tarvoke:
(and yeah g framework w/o root such an underlying part of things needing to work - nice probably farther than the rest of us got so far, tho!)
[Fire TV General] MicroMod777:
Just checking thread to see any progress here. Maybe Google's Android TV box will be easier.
[Fire TV General] roustabout:
It'll be easier to root, but I'll be very surprised if it can stream Prime video.

I don't necessarily mind not having root or the play store, but I'm very comfortable with commandline installs.

I think a wireless keyboard with integrated mouse, like this one

http://www.logitech.com/en-us/product/living-room-keyboard-k830

is going to be more valuable to me than root, long term. Has anyone tried a bluetooth keyboard with this yet? Since I only have the one USB directly on the box, I'd rather not tie it up with a keyboard if I don't need to...

My end goal is Amazon vid, Netflix and local media playback without swapping between input sources. And I'm actually there already with xbmc, and with real Youtube, into bonus territory.

I would love to see what it's saying via ADB at startup time, though!
[Fire TV General] robclark:
The usb on the firetv is the otg usb so usb-a to usb-a sort of works. But only for fastboot (which is locked down). Not sure offhand if they tie the host/slave pin to a gpio or just override it in sw but once linux is running usb is in host mode so a-a cable won't do much of anything.
[Fire TV General] roustabout:
Great to know. I want to try the effect of asking for bootloader and recovery also - I'm sure someone's already tried both, but I'm new to the box so I'm curious to see what it'll let me do.

I'm also curious to see what happens if it's presented with a bootable disk via the OTG. That may ultimately be more useful than a USB connection. It stopped and was wondering about something when I had the powered disk available at boot time.
[Fire TV General] eliassaba:
If you weren't aware already, you can plug a USB hub into the Fire TV to get more USB ports.
[Fire TV General] roustabout:
So, using the "rotate screen orientation" app to lock rotation in landscape and only permit landscape improves things on those apps that tended to rotate the screen. (youtube and maps are working now. Both basically require a mouse.)

I've been trying to get an android bluetooth keyboard with trackpad to pair, and had no luck at all. It looks as if Amazon's not supporting keyboard devices out of the box. I'm not sure why - the keyboard/trackpad pairs easily with other devices, but the Fire tv doesn't respond even with an error message, either in the gui or (as far as I can see) in logcat output.

Some of the discussion here https://developer.amazon.com/public/solutions/devices/fire-tv/docs/identifying-controllers

seems to imply that keyboard devices are not only not supported but not being listened for at all.

I have a PS3 bluetooth keyboard coming later in the week which I hope will work.

If I have to eat the USB port on the box with a K400 or similar, I'm concerned that I won't be able to use mass storage at the same time, since in my hands the USB port treats hub connected devices very differently from directly connected ones.

I remember one of the Clockwork recoveries supports ADB connections for file loading and minimal commands, but I don't remember any of them supporting adb over a network. I suppose it's not impossible to have it, but I'm sure it'd be a TON of work to do it.
[Fire TV General] jrgx19:
I have been trying to get the Logitech Y-X5A77, which i got for my PS3 to work. No luck so far. it is bluetooth, and it should connect, but nothing. It doesn't show up on the FTV's devices
[Fire TV General] meadtj:
Please stop posting everything <but> root info in this thread, its getting really annoying.
[Fire TV General] MadFlava:
You mean like you just did?
[Fire TV General] kairnage:
You are the first person to post "everything <but> root" in the whole thread.
[Fire TV General] mastafunk:
This thread should be closed.. Started off as a bounty.. bounty was paid and root was received..

A different thread should be started if we are still looking for root. Very inconvenient for people to have to read the headlines on the internet that this device was rooted on the release day, then to have to read this whole thread to discover we still dont have root.
[Fire TV General] krasny2k5:
Agree with that.

another way of make this thread useful is organize a new bounty for root. I was thinking that i'll gladly donate to who make a root for Amazon TV. I think that two tiers is the best option, one for root and another to unlock bootloader. The problem is that as jcase stated on his twitter, community bountys doesn't work, developer don't get the founds after release the root, so anyone knows if there is a way to do it more officially, a webpage or similar that holds the money until someone claims it?

It's only an idea to motivate developers to work in this device.
[Fire TV General] alwaysbless:
Ill put 25 funkies towards a root but only for myself lol. Like mentioned above community bounties never work and without knowing how well a rooted FTV will even function I cannot justify paying more. Any takes on my offer can send me a pm!
[Fire TV General] robclark:
Keep in mind, for an embargoed exploits, the (responsible) developer's hands are tied until updates are pushed out, etc. Some of these jailbreaks are things that could be used for considerable harm in the wrong hands.
[Fire TV General] iRet:
Rooting and jailbreak was always dangerous. As soon as it will be released it will be fixed by amazon. Don't feel yourself safe with hole by now, it'a wrong feeling.
[Fire TV General] rumblpak:
Someone may want to try the vroot exploit that was recently found to be vulnerable to the most recent kindle fire hdx base code. I don't actually own a fire tv so it may not work but its worth a look.
[Fire TV General] jamesrascal:
Maybe there is hope? http://xdaforums.com/showthread.php?t=2783157
[Fire TV General] iRet:
It looks like vroot require a adb usb connection.

(Also unlocked bootloader mentioned on russian forums)

Can't connect for me via network adb.

If we could find exploit details, what exactly it does we can try.
[Fire TV General] FISKER_Q:
Appears to work, just gonna try installing some root apps, but adb shell gets root

Edit: Installed SuperSU 1.99r4 without issues, tested Root Explorer, which also works.
[Fire TV General] iRet:
Yay!, it works!!! We've got it!
[Fire TV General] simonsickle:
Now for the bootloader unlock
[Fire TV General] deanemj:
Oh, sweet Jesus thank you!!!!! Can't wait to give it a go on my box.
[Fire TV General] iRet:
Tried reboot recovery. Get 'System update unsuccessful' flickering. After reboot all ok.

Don't have a working OTG cable to check what is happening.

What we need to unlock bootloader. Get to fastboot?

---------- Post added at 01:40 AM ---------- Previous post was at 01:31 AM ----------

Installed busybox manually, much better now :) feel home

root@android:/system/xbin # df

Filesystem Size Used Free Blksize

/dev 974M 48K 974M 4096

/mnt/secure 974M 0K 974M 4096

/mnt/asec 974M 0K 974M 4096

/mnt/obb 974M 0K 974M 4096

/storage/usb 974M 0K 974M 4096

/system 756M 651M 105M 4096

/data 5G 894M 4G 4096

/persist 7M 4M 3M 4096

/cache 756M 13M 743M 4096

/firmware 63M 7M 56M 16384

/mnt/shell/emulated 5G 894M 4G 4096

/storage/emulated/legacy 5G 894M 4G 4096

root@android:/system/xbin # uname -a

Linux localhost 3.4.0-perf-g6050c7d-00001-g74c30a8 #1 SMP PREEMPT Tue Apr 15 22:10:26 UTC 2014 armv7l GNU/Linux
[Fire TV General] {ParanoiA}:
I wonder if towelroot is the same exploit jcase used to root this device.
[Fire TV General] iRet:
It doesn't matter now :)

---------- Post added at 02:37 AM ---------- Previous post was at 01:48 AM ----------

Downloaded /dev/block/mmcblk0boot0 partiton and examine.

Look like it store constants such as modes MACs, serials.

Found one names unlock_code with zeroes.

I'm not so familiar in android internals.

But maybe it means we could unlock it with just fastboot unlock.
[Fire TV General] Esso1001:
Is this working on the firetv?
[Fire TV General] retroben:
Yes.

Seeder is now allowing lag reduction.

Really need to set the OTA block on the HOSTS file.

How am I supposed to do that?
[Fire TV General] Esso1001:
[MENTION=5869292]retroben[/MENTION] did you root the firetv?
[Fire TV General] rontonomo:
can someone who now has root please try and use a paragon usb mount and see if we have usb access now?
[Fire TV General] wavrunrx:
root it; install root explorer,

browse to /etc/hosts

in the upper left hand corner of root explorer, set it to "system r/w"

scroll down to 'hosts'

press and hold the hosts file with the large circle button on the remote controll untill a menu pops up

scroll down to "open in text editor"

:cool:
[Fire TV General] ahoslc:
Does seeder do much on the firetv?
[Fire TV General] LiquidXed:
What ver of supersu to use?
[Fire TV General] Esso1001:
Any luck on storage??
[Fire TV General] retroben:
Just do what I did, grab the 1.99.4 zip and get the apk out of common and install via sideloading.

Also,a tip and the ip addresses for the OTA blocking.

Place the IP address of localhost first and then space it out six times like localhost is then place the site there.

Edit:Cleaning off my stupidity.

Hosts editor easily makes things right for blocking the OTA.
[Fire TV General] jamesrascal:
Now we just need to replace the stock launcher with a different one and block updates from happening.
[Fire TV General] :
Nice it root works.. Gonna try some sd ext apps

Es file explorer works with root
[Fire TV General] :
tried paragon to mount usb. It was able to get permissions and mount, but when trying to look in the usb it was empty. Think we still need some file to make it work? Maybe a kernel module?
[Fire TV General] :
I still can't edit the damn hosts file!

I touched the corner to allow r/w,and I even set the file permissions to rwx on all fields.

It still does not save what I put into it!

I also even set the main system folder to r/w,and it STILL trolls me!

What am I doing wrong with the hosts file?
[Fire TV General] :
Chainfire stick mount works

\sdcard\usbStorage
[Fire TV General] :
Sweet
[Fire TV General] :
All i need now is xbmc on my home screen...
[Fire TV General] :
I managed to edit the hosts file using an evozi'd hosts editor app from Google Play.

It added hashtags/pound signs when I "toggled" the addresses.

I went back to check the hosts file in ES File Explorer's text editor,and it was successfully changed.

Are they supposed to be toggled when blocking the OTA,or just pasted there as is?
[Fire TV General] :
Just played a movie from usb with es internal player and it plays smooth with 1080p.. Tryed to launch it with xbmc through es but it wont work... Buttttt,,, xbmc will play just fine, just not if u launch it through es
[Fire TV General] :
Oh damn **** just got real !
[Fire TV General] :
JCase,or anyone else capable,can you help us get Android KitKat 4.4.3 installed on Fire TV?

Also,can somebody give us a guide for putting the Linux distro on Fire TV?

I also wanna see if I can get PJ64 running on Fire TV through Wine or some other Windows runner,if there is even enough space for those.
[Fire TV General] :
link for host editor?
[Fire TV General] retroben:
Here is the link. (if I can even post it)

https://play.google.com/store/apps/details?id=com.nilhcem.hostseditor
[Fire TV General] meadtj:
So basically we are installing Towell Root? http://towelroot.com/

Install chainfire superuser: http://apps.evozi.com/apk-downloader/?id=eu.chainfire.supersu

Then using Stickmount to mount USBs - http://apps.evozi.com/apk-downloader/?id=eu.chainfire.stickmount

Block Amazon updates using Host Editor: http://apps.evozi.com/apk-downloader/?id=com.nilhcem.hostseditor

127.0.0.1 firs-ta-g7g.amazon.com

127.0.0.1 amzdigitaldownloads.edgesuite.net

Edit: Then wait for bottloader to load up kitkat?
[Fire TV General] ahoslc:
Well we need a bootloader unlock and then Kitkat :)
[Fire TV General] LiquidXed:
If u want to reboot https://play.google.com/store/apps/details?id=simple.reboot.com works
[Fire TV General] retroben:
There is the standard linuxforandroid,and there is also robolinux which has access to Windows VM.

How do I get one of these up and running on Fire TV?

Sorry if I am being spammy with my needy questions.

I just really want some form of Windows on my Fire TV for running stuff like PJ64 as seen in several videos of Linux itself "running" PJ64.

I forgot to mention,but,I have a 32GB USB stick that I can store loads of stuff on if needed by the Distro and/or Windows programs.
[Fire TV General] ahoslc:
You need to be patient that sort of stuff has not been possible yet.
[Fire TV General] jamesrascal:
Now that we have root what are the steps to change the default applications?
[Fire TV General] LiquidXed:
edit: im not 100% sure if it is really the bootloader cuz it just sits @ amazon screen. but u can use apex to reboot into bootloader. maybe someone with a male to male usb cable can test some fastboot commands

---------- Post added at 04:08 PM ---------- Previous post was at 04:04 PM ----------

Found a male to male and it works... Aleast fastboot reboot command does
[Fire TV General] ahoslc:
Try Fastboot oem unlock
[Fire TV General] wunderdrug:
Cifs/smb/samba

Anyone have any luck trying to mount CIFS/SMB/SAMBA shares on the filesystem? Tried various things and no go.
[Fire TV General] LiquidXed:
just did.. nothin happened.. all other commands seem to be working..

is there a command to check the lock status?

Fastboot devices works with a return

But

Fastboot oem ? It just sits there
[Fire TV General] Esso1001:
Anybody got superuser to work?
[Fire TV General] LiquidXed:
Works fine here

---------- Post added at 05:04 PM ---------- Previous post was at 05:03 PM ----------

Rom toolbox pro works too
[Fire TV General] Esso1001:
Which one did you use? Can you share the apk please
[Fire TV General] LiquidXed:
http://download.chainfire.eu/447/SuperSU/UPDATE-SuperSU-v1.99r4.zip
[Fire TV General] retroben:
If anyone is ballzy enough to change the clocking speed of any given app by using something like SetCPU,can you do various Reicast tests with Sonic Adventure 1 and/or 2 with an underclocked rate like 1.2Ghz or maybe even insanely lower like 0.8Ghz?

I may try myself after putting my SA2 copy back on my Fire TV.

Another thing to get working is optimizing the quad cores to greatly boost overall performance if possible.

I neglected to mention that seeder has increased my performance quite a bit since rebooting after enabling lag reduction.

Sites even load faster.

I wonder if Dolphin Browser can now be installed somehow?
[Fire TV General] Esso1001:
Can someone explain what are the advantages of using superuser?
[Fire TV General] retroben:
SuperUser is the only way for apps to access root easily.

I already tried just underclocking with SetCPU from none other than xda itself.

Reicast still flipped out though,but at least setting the mode to performance and the minimum to 486Mhz gives me a nice speed boost.
[Fire TV General] bradr00lzd00d1:
I wonder if anyone can get the ouya launcher on here. It would be a nice alternative launcher.
[Fire TV General] LiquidXed:
http://xdaforums.com/showthread.php?t=2347214

Unzip maybe launcher is in there.. Im not at my pc right now
[Fire TV General] jamesrascal:
Attached the APK. Installs but crashes on load
[Fire TV General] Tomsgt:
I pulled supersu app from newest supersu.zip and have it linked here this will fix the updating binary error everyone is getting after using Towelroot

Working Supersu app
[Fire TV General] retroben:
Strange.

I did not get an error on SuperSU.

I installed both APKs in the same ADB session via terminal app,then got root from opening tr.

Then I opened SuperUser and updated it successfully,and I set it to automatically grant access.

All is working for me.
[Fire TV General] Deimozzz:
still needed ouya-framework.apk

http://www.youtube.com/watch?v=mwAegN5nUMA
[Fire TV General] fireTVnews.com:
framework install fails with error message: [INSTALL_PARSE_FAILED_NO_CERTIFICATES]