yashsingh1/xdaforums huggingface dataset:
[Fire TV General] RazorX2015:
New Here

hey guys im new here and just ordered a fire tv stick and it arrives on the 9th what i want to know is because ive only bought mine recently do i stand any chance of being able to root it using this method or does it not matter what update it comes on?

if i can root it could someone post the commands i need to enter to root it thanks also a clear good quality top down view picture of where i solder each wire too would be nice :)
[Fire TV General] ldeveraux:
You mean like the thing in the first post?
[Fire TV General] RazorX2015:
what you referring too? also i dont have a fire tv only the fire tv stick which is on its way so i dont want to get things messed up with the fire tv stuff if you could just post a pic of the fire tv stick pinout and the commands that would be great thank you.
[Fire TV General] ingrimsch:
You can find a Pinout and a Video showing the required steps to root the FTV Stick here

Edit: For this method only will need an Adapter to hook up the EMMC to an SD card reader. Find Infos on the Adapter here and I would recommend the Transcend TS-RDF5K as SD card reader as I had trouble with various other SD card readers. The TS-RDF5K is cheap and works flawlessly.
[Fire TV General] RazorX2015:
yeah i knew i needed that adapter and thanks for the info
[Fire TV General] RazorX2015:
since its a hardware mod does that mean you can root it even if the fire tv stick is fully updated.
[Fire TV General] liemadamous:
the answer is yes, I got my AFTV opened yesterday and rooted my AFTV with the latest firmware. Just make sure you follow these requirements below , and I hope you find the information useful.

1. Follow this post very good useful instructions , especially how to open AFTV and purchase what you need to do this.

http://retroconsolecomputer.blogspot.com/2015/02/hardware-root-amazon-firetv.html . Awsome write up !!!

2. use ADBFire application (Windows or Mac), http://www.jocala.com/adbfire.html , click Root AFTV, what this does it it push SuperSU apk to AFTV and TowerRoot (which u dont need u can uninstall TowerRoot because it does not work). Because you will run SuperSU later once you have the SU file copy to Xbin folder

3. Make sure you download the SU file from this video, there is a link in the description https://www.youtube.com/watch?v=IgC4iDzQ8gw. unzip it and the SU file I used is in the arm folder. There are other files in this folder, but you only need to copy the su file to Xbin folder on the correct AFTV partition.

4. Make sure you block the updates after you root your AFTV, to prevent any future updates, i did a router block and adb shell block just to be safe. You can find the instruction, just google it.

Cheers !:D
[Fire TV General] RazorX2015:
thanks for the info but that link is for the fire tv not the fire tv stick
[Fire TV General] liemadamous:
here are info for Fire TV Stick https://www.exploitee.rs .

also i purchase 1 Low Voltage eMMC Adapter (Fully Assembled) from them. It works great. https://shop.exploitee.rs
[Fire TV General] RazorX2015:
says the page your looking for cannot be found for first link
[Fire TV General] liemadamous:
just visit www.exploitee.rs , you can click on Amazon Fire TV Stick on the main page.
[Fire TV General] pauljblo:
Does anyone know when hardware rooting the fire stick if the crystal is just connected to the gnd from the sdadapter or to gnd on the stick as well.

Also does it just use power from the sdcard reader.
[Fire TV General] superkoal:
Haven't seen the stick board, but there's a separate thread for hardware rooting the stick, maybe you should ask there.
[Fire TV General] n2outlaw:
I just ordered the www.exploitee.rs PCB and Modded my first one.

I have a question:

Question #1

After rooting it on the latest firmware. Can you update it in the future/how easy will it be?

Do you have to tear down and redo after you've updated?

Do you have to delete SU, making it back to factory so you won't brick?

After upgrade, is SU still there?

Question #2

Is is better to use the "su" in the ARM folder or the ARMv7 folder from the link?

I only ask because I thought the AFTV was a ARM7 but arm folder one did work. I guess I'll try the ARMv7 on my next one.

EDIT: I did and no difference.
[Fire TV General] CivilE:
Thanks to all of the great information here, I was able to root my Fire TV stick!

:cheers:

CivilE
[Fire TV General] CuBz90:
Is there an easy to follow step by step guide for rooting the Fire TV STICK?

I have all equipment ready to do but the "guide" and video on the exploitee website is no help whatsoever and everyone seems to be giving guide for the main Fire TV box.
[Fire TV General] ldeveraux:
Yeah, it's called reading the entire thread.
[Fire TV General] n2outlaw:
I found a AFTV on FW 51.1.3.0 and tried to downgrade it using AFTVnews guide here but forgot to install Busybox.

I wanted to downgrade it so I could unlock the bootloader, install Custom Roms and Boot Menu.

The eFuse is not blown because it was never on FW 51.1.4.1 or higher.

Steps I did:

Opened up the FTV and soldered the 4 wires to exploitee.rs board

Copied over the SU and was rooted :)

downgraded Stock Recovery

Uploaded update.zip and then rebooted to recovery (no Busybox installed)

It started updating and then everything went black. And now its no lights coming on the front of box. (brick dead :( )

Is thier away to reflash FW in linux or a Recovery (stock or custom) connected to the eMMC using the exploitee.rs board?

Or something I can copy over to get it to boot so I can install FW?

Also, for future, can you downgrade FW 51.1.2.0 through 51.1.4.0 if you hardware root it first and then follow the downgrade guide here?

Or is their a easier way and if so. Can you send link on how?
[Fire TV General] zayden:
I have an AFTV which may have been killed by a power outage during a software update. It power cycles itself after reaching "The software update was unsuccessful"

If my unit is soft-bricked I suspect this hack will help me recover it. But how exactly ?
[Fire TV General] freezer2k:
You could reflash complete images if required, but if you can still reach update unsuccessful, there might be ways to unbrick it without using this method/soldering?

E.g. entering recovery via this Alt+R+PrintScreen (i think) and relfash?
[Fire TV General] zayden:
I can and have entered Recovery successfully. However doing a Factory Reset didn't fix it, nor did Wiping Cache.

"Apply update from ADB" is useless as I can't connect to the aftv via usb or ethernet. If I'm doing something wrong I would of course love to hear it but from what I've read ADB is disabled in the stock recovery.
[Fire TV General] ThauExodus:
Why can't you connect it via USB?
[Fire TV General] zayden:
Of course I can connect it physically but I can't adb connect. Are you saying I should be able to ?
[Fire TV General] Calibaan:
The "adb connect xxx.xxx.xxx.xxx" command is only needed for an ADB connection via network. Directly attached to the PC and with an appropriate driver installed the stick should run as ADB device via USB and should be accessible via adb without extra "adb connect" command, try for e.g. "adb shell".

Probably also this older topic may help you:

http://xdaforums.com/fire-tv/general/adb-usb-fire-tv-stick-t2952214
[Fire TV General] zayden:
Interesting thread. Truth is I know very little about adb only what I've been reading lately. I installed the google usb drivers and the device is recognized as Fire TV for about 15 seconds and then disappears when it reboots on its own. Is there any way to tell where the problem lies, the bootloader, the kernel or the system software ?
[Fire TV General] Calibaan:
Try another USB Port or an active USB hub. At first sight I would say the power supply via the chosen USB port is too weak.
[Fire TV General] zayden:
It coincides with the reboot sequence of the device when plugged in but I will try your suggestion.

---------- Post added at 05:00 AM ---------- Previous post was at 04:59 AM ----------

The device IS supposed to be powered, is it not ?
[Fire TV General] Calibaan:
The device must be powered externally because regular USB 2.0 ports are specified only to deliver 5V/500mA which is the total power of 2.5W and that might be not enough to fully boot up the stick. So I assume the boot looping is due to starting until a certain point until there isn´t enought power anymore which results in a reset which results in booting up again and so on.

There may be USB 2.0 ports which deliver more power but it is not guaranteed that they´ll do it. You could also try wether an USB 3.0 port which should deliver 5V/900mA (=4.5W) or an active USB hub which are powered externally by wall plugs with around 1-2A.
[Fire TV General] zayden:
This is not the stick, it's the Fire TV box and it was powered the whole time by the wall plug so power is not the issue.

It could be restarting due to some other hardware fault but my gut tells me it's software related. Tried with another power adapter btw with same results.
[Fire TV General] Calibaan:
Ah OK, my fault. Thought it was regarding the stick.
[Fire TV General] zayden:
What typical fault occurs when power is interrupted at the "wrong time" during a software update ? I mean, what is the most likely scenario here ?
[Fire TV General] superkoal:
If it happens during download you are fine.

If it's during the write process of the system image the unit most likely won't boot afterwards (hang at Amazon logo or similar behaviour).

If it's during the setup process afterwards all kinds of strange things could happen (or nothing at all if it happens at a point where the ftv just picks up at next boot)
[Fire TV General] zayden:
Can a full image be written using the tool used here to interface the eMMC ?
[Fire TV General] superkoal:
Yes, you should be able to do that. Don't know if anyone has done that before?

Maybe you could also just put the files from the latest amazon update in the right location.
[Fire TV General] zayden:
Ok I suppose it's worth a try. Do these adapters ship from the US ? Or does anyone have one they would like to sell ?
[Fire TV General] n2outlaw:
Does anyone know if it's possible to Hardware Root the New 2015 2nd Gen Fire TV?
[Fire TV General] xenoglyph:
i'm 100% certain it's vulnerable to known software exploits, but i do have a level shifter and if i can't figure out something soon i'll be cracking it open to take a look inside.
[Fire TV General] aHcVolle:
Honestly i don't think so ...

1) They secured the aftv & aftvs so good that there's no exploit yet. Why should they leave a vulnerability in the new firmware?

2) I bet they've learned from the first atfv(s) and won't give us access to those pins again.

Maybe there will be an exploit in the future but i don't think known ones will work and i bet this device will, if ever, be "drive-by-rooted"... Its not popular so there's almost no development going on...
[Fire TV General] xenoglyph:
just a little FTV2 update.

cat /sys/block/mmcblk0/device/csd = d02701320f5903fff6dbffef8e40400d
[Fire TV General] zeroepoch:
Amazon Fire TV 2 UART

For anyone interested I took apart the Amazon Fire TV 2 and attached a TTY UART device. See the attached image for the pinout. Sorry for the crappy picture. I'll try to take a better front and back picture of the whole board when I get a chance. One thing we found interesting was that the pins inside the silk screen box didn't appear to be connected, but the test points near by were. I originally tried to connect my Bus Pirate in Hi-Z mode and use a 1.8 V source, but in the process of soldering a wire to the 1.8V source I killed it. I figured that might happen so I actually had another device I could use. The second time I simply had a friend hold the leads to the test points so I could get the output trace during boot. The full UART output is attached for reference.

Anyone attempting to interface with the UART needs to be aware of the usual configuration. Prior to the boot loader the UART is running at 115200 baud. Once the boot loader starts it actually switches to 921600 baud. We had to use an oscope and a bit of simple math to figure this out. It was confirmed once we saw the kernel command line. I have no idea why they used such a high baud rate except maybe to speed up all the memory testing output that it spews, which could speed up the boot. This was a problem because the Bus Pirate can not reach this exact baud rate. Using the BGR trick you actually get exactly 1 Mbaud and it produces junk from the Fire TV. I had to instead use my 3.3V FT232RL breakout and a slightly modified version of GNU screen in order to connect, from here. Since I was only receiving this second time, just to see if a prompt or anything useful would show up, I didn't need to worry about the driving voltage. FYI, both the Bus Pirate and the FT232RL handled the 1.8V logic fine. Unfortunately near the bottom of the UART output kernel printk is disabled so you see nothing once the kernel starts to boot. This wouldn't normally be a problem if dmesg worked, but it doesn't work over adb due to permissions. Not sure that would really lead to any sort of hack anyways.

Hopefully this information is useful to someone. I bricked a device in the process due to my poor soldering job so I figured I should at least get this info out there to avoid any other sacrifices. I didn't try to go any further with JTAG or an eMMC hack because I don't have the tools or time to go that far. Hopefully someone else will.
[Fire TV General] ulises.rodriguez:
As this post is talking about the hardware of the Fire-TV Sticks...

I would like to ask if anyone knows how to fix problems with wifi access, of the first released Fire-TV Stick, that it was initially introduced by Amazon last year?

I'm asking because I have a Fire-TV Stick that works perfectly fine, except that sometimes do not connect or constantly loses the Bluetooth and WIFI Connections, and therefore I can not use anymore the Bluetooth-Remote and the WIFI!...

Since it looks like it is a hardware problem, I think it maybe having problems with the internal WIFI/Bluetoth Antenna signal reception.

I would appreciate if anyone here, have some information or a photo of the internal antenna, or perhaps knows if there is a hardware fix for all this connection problems?

I currently have 2 Fire-TV BOX units (1st and 2nd Gen), and also 2 Fire-TV Sticks, but only one of the Fire-TV Stick that was bought when amazon released it, is always having this connection issues.

Thanks in advance for your help!

P.D. Please excuse me for posting my request in this thread...
[Fire TV General] zeroepoch:
I made some progress rooting the Amazon Fire TV Gen 2 that doesn't require any special HW mods except connecting the UART. I found a TTY USB device laying around that happen to use 1.8V already, but I haven't found a reason yet to attempt typing, at least until I get a prompt or something. I found that using "adb reboot bootloader" and then "fastboot boot Image.gz" I can boot a custom kernel. You need to provide the address to load the kernel, which is 0x40080000. Don't get too excited because I can't see the kernel output once the kernel boots and it crashes and reboots shortly after I start booting the kernel. If someone could extract the current boot.img file that would help since the kernel I built I had to hack the source code to get it to compile. I'm wondering if the source is really the one they used. Also I don't have the stock initramfs. Probably can't get the boot.img file with root though. I don't have much else to report yet and short on time to report detailed specifics, but I wanted to let people know that the bootloader is unlocked to extent that you can boot a custom kernel and change the kernel command lines options that are prepended. At least we don't have to go the extent of trying to read or write the eMMC. Also I think I know where the JTAG is but the pin pitch is so small I'm not even going to try that until this path leads to no end. Once we can boot a kernel successfully to init it shouldn't be too hard to mount /system and inject the su binary. I think it's technically possible just need to get the pieces working.
[Fire TV General] rbox:
That's interesting... screw up or on purpose... But it looks like the OTA updates are patch updates and the kernel file is a patch also. So someone will need to extract the image from the actual device. Although it's curious that you feed it image.gz. I would imagine it'd need a regular ANDROID! image style file. Either way, once you do have a bootable kernel, all you need to do is replace adbd with one that can start as root.

But I must caution. Whatever you do, DO NOT MODIFY /system before making a FULL image with dd and VERIFYING it is 100% perfect. Because the updates are patch updates, there is no way to apply the updates without a pristine version of the /system. And there is no way to fix /system with an OTA once it's been modified.
[Fire TV General] zeroepoch:
Interesting I didn't know they were patched updates. If I get that far I'll be sure to make a full backup first. In fact if I can backup all partitions dd style we can maybe do a full factory restore like a nexus using fastboot. Again assuming you can get to that point using this approach. BTW, it does also accept an uncompressed kernel image as well and in fact the normal (continue) output shows it's uncompressed but the compressed one is easier to move around and you can append a dtb. I did finally figure out there was a missing option in the .config file which was causing the link error I hacked around. It's pretty major because a syscall is unimplemented without enabling the missing option for both release and debug builds. It really makes me wonder if this is the true source. Won't get a chance to try the new kernel until tomorrow. Now I only have to update the include paths in a few Makefiles to get it to compile. Everything seems pretty safe I'll throw the modified sources up somewhere in git when I get a chance. Another interesting point is I noticed there is a USB device that shows up for about 3 sec before the bootloader is started with is a MT65xx preloader. No idea if that will be of any use since I have little experience with mediatek devices.
[Fire TV General] rbox:
It might be the on chip boot rom and there might be some kind of a way to trigger it to boot off of usb instead of the mmc. But if you can play around with fastboot, it doesn't really matter.
[Fire TV General] zeroepoch:
I put together a quick kernel source repo at https://gitlab.com/zeroepoch/android_kernel_amazon_sloane

I tried to keep my bug fixes to a minimum number of changes. I was able to get the kernel to compile with both the Linaro compiler and the Android compiler (although they are mostly the same) by only changing some include paths in a few Makefiles and adding one config option. We'll see how it goes when I try the kernel tomorrow with some cleaner compile fixes this time.
[Fire TV General] zeroepoch:
I ran into another road block. Even though I was able to get a clean kernel compile and hacked out the UART disable, I was not able to get any kernel output to troubleshoot the problem. A bit more experimenting discovered that I needed to create a boot.img file for more control instead of just using the on-demand boot.img creator built into fastboot. I tried many variants of the two, but the closest I got was an abort on the very first instruction which is a simple branch. I tried to create a fake kernel full of random data as an experiment with the same result. I really think it was not loading correctly before and when it is loaded correctly the kernel is not allowed to run, maybe signing is involved. So my efforts to enable the UART output from the kernel were pointless. I think we'll need a backup of boot.img to get any further or at least make additional attempts. Going to explore the MT preloader a bit and see where that goes.
[Fire TV General] ThauExodus:
Do you know if fastboot is available on firetv stick too? I only noticed , that adb access is possible via USB.
[Fire TV General] zeroepoch:
Another update on the rooting effort for the Amazon Fire TV Gen 2. I looked into the MediaTek tool SP Flash Tool, which happens to have a version for Linux. Using this tool and some trial and error I got the phone to halt at the preloader, but it would not download any data because the included download agent is not authenticated and I have no certificate. I learned the basics on how to use the tool for ROM backup from here. Digging a bit deeper trying to figure out what would work I case across this article. It explains a bit how the MT preloader works. It was missing a few pieces of information about the pre-handshake, but looking at the referenced sources and some more trial and error I came up with a quick shell/python script combo that could trigger the halt. Then I was able to write scripts to read and write data. I first thought this was not working since the flash addresses I got from /proc/emmc kept giving an error and rebooting. Then I noticed paying more attention to the error and looking at the code it's limited to the AMBA/IO addresses. Looking at the DTS file in the kernel source tree the first MMC device is at 0x11230000 which I could read and also write (those addresses). Although now I need to figure out how to manually setup DMA and read out the contents a page at a time. The good news is the kernel source has the information I need, but I'd basically be writing a flash driver in userspace. I've attached the debug scripts I wrote so far to initiate the MT preload handshake (connect USB, run shell script, reboot), and read/write IO memory. It will be very helpful for anyone trying this to at least connect the UART TX otherwise you have no idea what the preloader is doing.
[Fire TV General] I_did_it_just_tmrrow:
Can somebody help me to block updates per default with emmc access:

http://xdaforums.com/fire-tv/general/emmc-hack-to-enable-adb-connect-adapter-t3228090

Would be very thankfull.

Greetings by Idijt
[Fire TV General] NaturalBornHaxor:
Alternatives to Exploitee.rs e-MMC Adapter?

Is the Exploitee.rs e-MMC adapter the only game in town? It's been sold out every time I've checked in the last couple weeks.
[Fire TV General] FunThomas76:
i would also be interested in an alternative to exploitee.rs Low Voltage eMMC Adapter its sold out :(

Is there some possibility to buy it somewhere ?