yashsingh1/xdaforums huggingface dataset:
[Fire TV General] Sus_i:
Rooted some bueller and montoya fireTVs via eMMC adapter and something like this should work fine, if you change the path to match your files:

#!/bin/sh

SHARED="/media/ubuntu/D4BC-BAD9/1"
ZIP="${SHARED}/bueller-5.2.7.0-rooted_r1"
DEVDIR="/dev/disk/by-partlabel"
MNT="/mnt/emmc"
SYSTEM=$MNT/system

echo -n "Unmounting system..."
umount $DEVDIR/system
echo "Done."

echo "Mounting system..."
mkdir -p $SYSTEM
mount -o rw $DEVDIR/system $SYSTEM || exit 1
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - mount point correct?"
exit 1
fi

echo "Install TWRP and SuperSu"
cp -r $ZIP/recovery $SYSTEM
rm -f $SYSTEM/recovery/recovery.img
echo "Chmodding and chconing RECOVERY..."
chown -R 0:0 $SYSTEM/recovery
chmod -R 0755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
chcon --reference=$SYSTEM/bin/e2fsck.real -h $SYSTEM/bin/e2fsck
cp -f $ZIP/su/su $ZIP/su/supolicy $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su $SYSTEM/xbin/supolicy
chmod 0755 $SYSTEM/xbin/su $SYSTEM/xbin/supolicy
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su $SYSTEM/xbin/supolicy
ln -sf su $SYSTEM/xbin/daemonsu
chcon --reference=$SYSTEM/xbin/trapz -h $SYSTEM/xbin/daemonsu
cp $ZIP/su/libsupol.so $SYSTEM/lib/
chmod 0644 $SYSTEM/lib/libsupol.so
chown 0:0 $SYSTEM/lib/libsupol.so
chcon --reference=$SYSTEM/lib/libsuspend.so $SYSTEM/lib/libsupol.so
cp -r $ZIP/su/SuperSU $SYSTEM/app/
chown -R 0:0 $SYSTEM/app/SuperSU
chmod -R 0755 $SYSTEM/app/SuperSU
chcon --reference=$SYSTEM/app/Bluetooth -R $SYSTEM/app/SuperSU
umount $SYSTEM
[Fire TV General] navin23:
Sus_i, If i want to run this script from an ubuntu computer what lines do i have to change?

I already soldered the 4 wires to gnd, clk, dat0 and cmd to the firetv box and I can see some of the box partitions.

I was thinking of changing these lines, but wasn't sure. Thanks

SHARED="/media/ubuntu/D4BC-BAD9/1"

ZIP="${SHARED}/bueller-5.2.7.0-rooted_r1"

DEVDIR="/dev/disk/by-partlabel"
[Fire TV General] Sus_i:
Should be enough if you change SHARED, then extract a prerooted rom over there and write the folder name down at ZIP :)
[Fire TV General] navin23:
Okay, I changed the path where the extracted files are and then ran the script, but i'm getting the errors below.

SHARED="~/Desktop/firetvbox1"

ZIP="${SHARED}/fw"

dell@dell-Latitude-E5510:~/Desktop/firetvbox1$ sudo ./flash.sh

Unmounting system...umount: /dev/disk/by-partlabel/system: not mounted.

Done.

Mounting system...

Install TWRP and SuperSu

cp: cannot stat '~/Desktop/firetvbox1/fw/recovery': No such file or directory

Chmodding and chconing RECOVERY...

mv: overwrite '/mnt/emmc/system/bin/e2fsck.real'?

Symlink e2fsck to 2ndinitstub...

cp: cannot stat '~/Desktop/firetvbox1/fw/su/su': No such file or directory

cp: cannot stat '~/Desktop/firetvbox1/fw/su/supolicy': No such file or directory

cp: cannot stat '~/Desktop/firetvbox1/fw/su/libsupol.so': No such file or directory

cp: cannot stat '~/Desktop/firetvbox1/fw/su/SuperSU': No such file or directory

chown: cannot access '/mnt/emmc/system/app/SuperSU': No such file or directory

chmod: cannot access '/mnt/emmc/system/app/SuperSU': No such file or directory

chcon: cannot access '/mnt/emmc/system/app/SuperSU': No such file or directory

dell@dell-Latitude-E5510:~/Desktop/firetvbox1$
[Fire TV General] navin23:
I updated the path again and this time I get the message below. I added echo "Done !!!" at the end of the script. Can I check If i have root now without remove the wires? Thanks

SHARED="/home/dell/Desktop/firetvbox1"

dell@dell-Latitude-E5510:~/Desktop/firetvbox1$ sudo ./flash.sh

Unmounting system...umount: /dev/disk/by-partlabel/system: not mounted.

Done.

Mounting system...

Install TWRP and SuperSu

Chmodding and chconing RECOVERY...

mv: overwrite '/mnt/emmc/system/bin/e2fsck.real'?

Symlink e2fsck to 2ndinitstub...

Done !!!
[Fire TV General] Sus_i:
I guess the question mv: overwrite '/mnt/emmc/system/bin/e2fsck.real' is because the script ran more than once...

Seems good from here (y)

You can mount system and look for the files but I would just disconnect the wires on your eMMC Adapter, let them on the box for now, add CLK bridge and give it a boot :)
[Fire TV General] navin23:
Thank you, it's rooted now.
[Fire TV General] navin23:
sus_i, I was playing around with my box and i flashed magisk 25.2.zip and now it won't boot only shows a " white Amazon logo" when in connect the power adapter.

I tired to root it again, but it still shows the "Amazon Logo" and doesn't boot any further.

I was looking at the thread below. Can i flash the boot, system and recovery image via emmc? Thanks

https://xdaforums.com/t/firetv-1-bueller-prerooted-stock-images-5-2-7-3_r1.2882337/page-70
[Fire TV General] derpeter:
Oh good you checked again i missed that bit.
[Fire TV General] superkoal:
This is the reason why someone should do a measurement to check how the FireTV handles the emmc chip.

When i get my unit i will hook it up to my oscilloscope to check the initialization phase and i will also try to find out if and which other devices are on the 1.8V rail.
[Fire TV General] derpeter:
So today i opened the fire tv and build a adapter similar to the SD Sniffer

[IMG="adapter open"]http://i.imgur.com/SrjigIL.jpg[/IMG]

After some discussion in our local hackerspace I decidet to try it without the level shifter, power the AFTV via a lab powersupply on the 1,8V pin shown in the gtfv wiki (On the running AFTV i measured 1,65V there).

I connected all pins from the AFTV to the SD-Card adapter except the VCC.

[IMG="AFTV connected"]http://i.imgur.com/FkOW7tT.jpg[/IMG]

sadly nothing happens. I tried 2 USB SD reader and one build in. On one reader i saw the kernel to reset the USB device a few time but nothing more.

Next step will be connecting a logic analzer and see if there is SPI traffik when i boot the AFTV.

In that case i will add the level shifter.

Here are some more pictures http://imgur.com/a/syYkh/all
[Fire TV General] sammy98:
Some readers need a connection to the pin of card detection. Be sure you trigger that, otherwise the reader doesnt even try to read the chip. Everything you tried... I made the same a week ago

Michael

Gesendet von meinem Nexus 7 mit Tapatalk
[Fire TV General] derpeter:
Here http://imgur.com/dndEPKF is a screenshot of the logic analyzer output.

The AFTV was only connected to the logic analyzer not to the SD reader.

clock and cmd are looking good, D0 is very quiet but i assume other data lanes are used in that time.
[Fire TV General] derpeter:
So you also connected Data3 to the reader or do you mean the mechanical card dedection?

Did you get any response from the card?
[Fire TV General] sammy98:
Hi

I have this sniffer or simple pinout adapter

https://www.sparkfun.com/products/11468

To make it more clear what i did:

- external device powered the shown pin with 1.8 v, gnd to usb shield

- clk, cmd, d0 to sd sniffer

first try: i pulled the d3 (of the sniffer) to gnd - this is the card detection

second try: inserted sd card into socket, but disconnected all data lines (except d3), clk and cmd of it - the clk, cmd and d0 came from the emmc of the atv

dmesg showed detected sdc, but shortly after that capacity change to 0 and that was it.

So no luck further - i probably go the complete way and connect d1-d3 too ..

I use the Transcend TS-RDF5K reader as device - that reader had no problems at all other cards / emmc
[Fire TV General] ingrimsch:
I got the SD Sniffer on Saturday and although I'll have to wait a few more weeks for my FTV (just read the expected delivery date :crying:) I had the chance to measure and test the SD Sniffer and the behavior of my SD Cardreaders.

I tried 2 different SDXC Cards in two integrated SD Readers of my Dell Latitude Laptops.

Voltage when SD Card is detected and accessed: 3.3V (not much of a suprise...)

--> although Wikipedia states some SD cards operate on 1.8V, according to https://www.sdcard.org/developers/overview/capacity/ its not the SD Spec

Both of my internal SD Cardreaders struggle to operate on the 1-Bit SD Bus Mode. This was tested by taping over DAT1-3 pins as suggested by zenofex

--> looks like I'll have to use 4-Bit Mode once I get the HW

So I had another look at the GTVHacker pinout and realized they are labeled DAT0, DAT2, DAT4, DAT6 and DAT7. Any Ideas how the 4-Bit connection to the SD Reader would look like?
[Fire TV General] sammy98:
As far as i know, thats not a problem of the reader but the cards or emmc. If they dont support the spi/1bit, it wont work
[Fire TV General] derpeter:
I'm confused. If its a problem of the card why you would connect the D1 from another card to your reader?

I'm also still confused about the anwsers from the gtvh guys and why the don't provide the missing informations if it had worked for them.
[Fire TV General] sammy98:
I connected the other other card to trick the reader into detecting a valid card (before i pulled d3 to gnd) but with the clk, cmd and d0 line of the external powered emmc.

So nothing with d1

Yepp thats the biggest problem here - with the information we just can go and do it.

I know that most of the people wont be able to do that here, but i think those who are crazy enough to open the ftv and solder these tiny pins are aware that the possibility is high enough to brick the device - so no point to hold back the missing information
[Fire TV General] derpeter:
Ok small update. I went to the gtvh irc an got some new ansers http://pastebin.com/1HNvMH1Y

it seems (still dont have the datasheet myself) that the eMMC needs a second VCC with 2.8V which is not marked in the picture. I don't think i can do the measurement today as my aftv is still in the lab where i disasmbled it but tomorrow should be possible.
[Fire TV General] sammy98:
So it is easier to get the board dumping to recovery with the clk grounding... Without the proper pinouts we wont ne able to do anything
[Fire TV General] derpeter:
did you located the cristal yet? or what do you mean by "dumping to recovery"
[Fire TV General] sammy98:
No i didnt search it yet..

[MENTION=2705700]derpeter[/MENTION]: please send me pm i am from Germany too - i think it is easier to write in german - we can post the results after that here.

I cant write you a pm ...

Michael
[Fire TV General] ingrimsch:
I posted a link to the eMMC Datasheet on Page 2 (http://www.magic-sun.com.cn/product/download/pdf/13) ;)

The CLK to GND solution would probably be the easiest way to power up the eMMC... the Y2 Crystal should be located on the lower left of the Qualcomm Chip btw. (near Pin1)
[Fire TV General] derpeter:
Thanks for posting the link. Do i got that rigth that VCC and VCCQ both an can 3.3V ? That would make it a lot easyer to supply the VCC but .... but could kill some other componenents on the 1,8 rail ....
[Fire TV General] ingrimsch:
Power Supply Voltages (from eMMC Datasheet):

Supply Voltage 1: Vcc - 2.7V - 3.6V

Supply Voltage 2: VccQ - 1.7V - 1.95V / 2.7V - 3.6V

Yes, Vcc and VccQ can both take 3.3V according to the Datasheet, but as we dont know how the FTV handles the VccQ rail and what else might be connected to it, you might fry something else connected to the VccQ lane when you apply 3.3V instead of 1.8V. So for now I only see two options:

1. grounding the Y2 clock signal which will keep the FTV from booting but power up the all the internal components (like the eMMC) with the right voltages (so we dont need to worry about Vcc, VccQ, etc.)

2. We need to find spots to inject/measure the eMMCs Vcc and VccQ in a running FTV to find out how the FTV handles these things... it might use 1.8V or 3.3V for VccQ. If we find a spot to inject Vcc and VccQ we might also play it safe and try 1.8V on VccQ first, but finding the right spots will be a lot more difficult than grounding the Y2 clock.

I'm still no real help here as my FTV wont arrive for another month according to Amazon :(
[Fire TV General] derpeter:
I found Y2 but i'm not sure which side of it sould be pulled to GND. As its hard to measure during runtime of the aftv because the pads are fully coverd by Y2 i'm thing of just desoldering it. That should also prevent the board from booting.

I found 2 spots that have ~2.8 V when aftv is powerd by its power supply. I injected 2.8V there and 1,8V on the spot markt in the gtvh wiki. Some current was drained from the power supply so something happend on the board. Sadly i still could not get the emmc dedected.

I'm not 100% sure if my card reader realy works in single wire mod because a taped SD card was dedected but could not be read. I assume the card didnt support it. As se eMMC was not even dedected i think its not a reader problem but i will try other SD card to make sure the reader is not the problem.
[Fire TV General] Luxferro:
If you're going to go through all this trouble with hardware hacking, why not just try using jtag to unlock the bootloader

? It was discussed briefly in a thread somewhere around here towards the launch of Fire TV. I have no experience doing such things though.

I found the thread http://xdaforums.com/showthread.php?t=2734774
[Fire TV General] simondo22:
You dont know what jtag is?

We dont know the points to accses the emmc.

Jtag hack is far away.

After 360, noeone makes a pin out for jtag.

By the way: its another kind if story
[Fire TV General] derpeter:
As you can see in the post you linked many informations are missing. Also JTAG works only if you know some information on the SOC.

eMMC method will work (as soon as we figured out how to power the device) on every device that has an eMMC the same way.

Also JTAG can be locked down (at least on some plattforms) locking down the eMMC is not possible (at least with the eMMC we know at the moment).
[Fire TV General] FireStarterTV:
Power

I figured out a safe way to powersupply the device:

Connect the FireTV to a PC with an A to A USB-Cable during start up -> the FireTV remains at Bootloader.

Also you can now use Linux (fedora 20) and android-tools with "fastboot" to access the device. But because I'm an android-newbee I have no clue, what fastboot can do, I'm not able to say, that fastboot can do something.

Maybe its possible to use it, to flash an older firmware?

(Pls excuse my bad english -> german FireTV-user)
[Fire TV General] rbox:
You can't really do anything with fastboot with a locked bootloader. They block both the flash and boot commands.
[Fire TV General] derpeter:
edit.

rbox was faster. how do i delet this?
[Fire TV General] derpeter:
Just to be sure: By blocked you mean disable the functionality or check the signature?

If its the second case: do the check if the version is signed but older?
[Fire TV General] FireStarterTV:
I think it's the funtionality:

[root@localhost ~]# fastboot flash recovery bueller-ota-51.1.0.2_user_510058520-signed.bin
sending 'recovery' (406207 KB)...
OKAY [ 15.942s]
writing 'recovery'...
FAILED (remote: flashing not allowed for locked hw)
finished. total time: 15.945s
[root@localhost ~]# fastboot flash recovery bueller-ota-51.1.1.0_user_511070220-signed.bin
sending 'recovery' (466847 KB)...
OKAY [ 18.329s]
writing 'recovery'...
FAILED (remote: flashing not allowed for locked hw)
finished. total time: 18.332s
[root@localhost ~]# fastboot flash recovery bueller-ota-51.1.3.0_user_513011820-signed.bin
sending 'recovery' (459812 KB)...
OKAY [ 18.058s]
writing 'recovery'...
FAILED (remote: flashing not allowed for locked hw)
finished. total time: 18.061s
[root@localhost ~]# fastboot oem idme
...
FAILED (remote: oem idme not allowed for locked hw)
finished. total time: 0.002s
[root@localhost ~]# fastboot oem idme bootmode 4000
...
FAILED (remote: oem idme not allowed for locked hw)
finished. total time: 0.004s
[root@localhost ~]# fastboot -i 0x1949 oem idme bootmode 4000
...
FAILED (remote: oem idme not allowed for locked hw)
finished. total time: 0.004s
[root@localhost ~]# fastboot getvar product
product: MSM8960
finished. total time: 0.003s
[root@localhost ~]# fastboot oem get_identifier_token
...

Messing around with some "fastboot oem" leads to "..." and a hanging prompt.
[Fire TV General] Riffer:
No progress since a week. Anything going behind drawn curtains or given up?
[Fire TV General] sammy98:
Nothing happening here.

As is said in some previous posts - the pinout is not complete and i personnally doubt at that point that the other team successfully read and wrote a emmc chip on a FireTV that still worked after that.

If they managed, they did not put all information about it online and that makes the whole page about the ftv worthless.

Gesendet von meinem Nexus 7 mit Tapatalk
[Fire TV General] superkoal:
I agree with you that the gtv hacker team probably has not successfully managed to write to the chip, otherwise they would have provided more details.

But I think that there are quite a few options that were not tried yet.
[Fire TV General] nebulink:
I think I will probably be holding out on the new Android TV set-top-box in hope that it is more flexible.
[Fire TV General] Zumpel42:
I would suggest to sniff the EMMC traffic during stock update to analyse what to do.
[Fire TV General] sammy98:
Fyi. Just sold my second spare atv, so i am out here.

Gesendet von meinem Nexus 7 mit Tapatalk
[Fire TV General] derpeter:
Quick update:

i went to the clock ground method and it looks promissing. I got two of my card reader to at least give me some output.

next step will be to check with different reader or use a raspberry pi with spi_emmc module. Maybe also the wirring is not optimal anymore because of the testing.

And the good news .... fire tv is still working :p
[Fire TV General] simondo22:
SCSI is a Protokoll that is still in use? For emmc?

I know SCSl as an old hdd Server interface
[Fire TV General] rbox:
All modern hard disk (flash, emmc, ide, sata, etc) drivers in Linux use the "SCSI Subsystem". It originally was just for SCSI, but now everything uses it.
[Fire TV General] derpeter:
I start to think that we still miss some information. I did another try with PCB as connector ( https://imgur.com/zNsFtO0 ) but still no reading is possible.

Logic analyzer shows that the SD reader tries to communicate but somethin is still wrong.

Last to things to try are connection a SPI capable device like the raspberry pi with SPI_MMC module and / or connect a fast oszyloscope.

More suggestions are appriciated.
[Fire TV General] freezer2k:
Nice work,

did you connect a wire to DAT0, like in this picture?

http://gtvhacker.com/index.php/File:FireTV_EMMC_Pinout.jpg

Can't see it on the pic you just posted?
[Fire TV General] superkoal:
Did you try to sniff the traffic during normal operation (startup)?

Did you try and connect all 8 data lines?

Otherwise I can also only think about an SPI capable device, the RaspPi is probably the best solution, as it already comes with linux and ext4 support.
[Fire TV General] derpeter:
Yes D0 was connected its hard to see in the picture

---------- Post added at 09:30 PM ---------- Previous post was at 09:28 PM ----------

During normal opertion a see the clock and traffik on CMD but nearly no traffik on D0.

As we don't know all data lines from the GHTV picture i couln't try that. Also the SD card interface has only D0-D2.
[Fire TV General] superkoal:
The ftv might use the chip in parallel data lines mode, but anyway you should be seeing quite some traffic on D0 during startup.

Maybe the GTV hacker guys marked a wrong pin on their image? It should be easy to verify the clk line. I think the most telling thing would be a logic analyzer record of all dat lines + clk and cmd when you power up the ftv in normal mode. Then you can tell the operation mode of the chip and check for special handshake procedures.
[Fire TV General] derpeter:
CLK is definitv correkt but checkig the other data lines is a good idea. Any hint how to determin from the traffik which one is D0 ?
[Fire TV General] tonyv2:
Hi All

If D0 has so little activity implies that its not a data line at all( or its measurement problem ) seeing activity on other supposed data lines would be interesting.Maybe its a sampling problem with logic analyzer from pic seems to be 4mhz (derpeter's image http://imgur.com/dndEPKF) according to datasheet for flash it can run at 200mhz . Though this should apply to clk line as well solid patch.A guess could be that sample window (ie time over which it takes sample) averages voltage over time. For clk line in solid area of pic its on 50% of time and average voltage is more than threshold voltage for logical 1 but in data line its on for less and averages less than threshold for most of time .But why doesn't this apply to cmd line.

A idea to find D0 would be find area of flash ( from update binary or from somebody who has rooted the ftv and dumped the flash ) that seems likely to be loaded contiguously and look for that bit pattern on whatever lines you are recording in ref to clock.Could record section of data on line of interest and look for that in flash dump

in 1st bit of every 8 bit word or rather look for parts of that in it (flash dump) .Similar to dna sequence searches probably libraries to to do that efficiently.

Couple questions

derpeter Does your mmc readers work in purely spi mode (sorry if this seems obvious just checking could not find in thread if you had checked this with mask line 1-3 test).

derpeter in last pic of your pcb connection can't see clk wire in pic from gtvhackers seems to be under metal cover above the flash is there another location ?

Could you take another pic of clk grounding location bit hard to see exactly where to solder wire to gnd.

I assume the two wires to shields are for ground connection is that the case.

General

How easy would it be to put ftv back together is the heat pad (pink stuff) destoyed if so have people

found a replacement.

Cheers

Tonyv2
[Fire TV General] derpeter:
Yes i tried it with an old MMC card with all data 1-3 masked

No i put the clock wire trough the small hole in the edge of the shilding and closed the shilding again to habe at least a litte head spreader for the cpu.

do we speak of the Y2 christal clock oder SPI clock ? i get a litte confused

The Y2 is next to the power IC, i can take a picture later when i get to the lab.

I used a head pad to remove the top and the pink stuff looks still ok. I assume putting it back together will bring the pinkstuff back to its place.

Also the firetv is not getting veryhot (not like chromecast) so i expect not demage from a slightly less working pink stuff.

cheers derpeter
[Fire TV General] derpeter:
[MENTION=2846293]tonyv2[/MENTION] here you go http://imgur.com/V7yNPhq pic of Y2 with a rot connected
[Fire TV General] ingrimsch:
I finally got my Hardware delivered a few days ago and had the time to take it apart today. While inspecting the board I found my eMMC being a different one than the FTVs used before. According to iFixit they found a Toshiba THGBM5G6A2JBAIR 8 GB eMMC NAND in their device, which I posted a datasheet for a few pages ago.

Now my device seems to use a SanDisk iNAND : SanDisk SDIN8DE2-8G

I have not been able to locate a Datasheet yet, but maybe [MENTION=2705700]derpeter[/MENTION] could take a closer look which eMMC type his FTV uses.
[Fire TV General] DOCa Cola:
This could help: http://bit.ly/ZZPgFK

The SDIN8DE2 seems to be the one in the 153 pin (ball) configuration.

edit:

if i understood it right, it doesn't really matter which emmc chip is in the firetv, as those emmc chip interface seem standardized? Various emmc to mmc adapters do exist
[Fire TV General] ingrimsch:
Found this Datasheet too, but it seems to belong to an older Version of the iNAND SDIN5XX-XX.

You are right, it should not matter at all, but this difference might be a reason why the recreation of the eMMC hack fails or shows a different behavior than the GTVHacker guys. Maybe the SanDisk eMMC behaves differently compared to the Toshiba. I have yet to try a few things myself, but I saw this while I inspected my FTV after taking it apart. When I find the time I´ll connect the SD Sniffer to the FTV and probably get the same results as sammy98 and derpeter, but I´ll try it anyway.