yashsingh1/xdaforums huggingface dataset:
[Fire TV General] mastalee:
yes i saw this, but the gerber files are only the files needed for production. i want to change the pcb files thats why i was asking for the source files (eagle, kicad)
[Fire TV General] dropcheck:
I would be very much interested in one too.

Hope to see the url soon. Save one for me. :)
[Fire TV General] freezer2k:
Had a little accident while doing the eMMC hardware root,

soldered all the eMMC connections with no problem and hardware rooted it.

While bridging the clock resistor connection (to make the FireTV boot normal again), I had some contact with a capacitor:

See picture, marked it with a blue circle, next to the CLK resistor.

It went a little dark, at first I thought it will be okay, but the FireTV had troubles booting up.

As it was behaving a bit random, failing at various stages (staying off, solid Amazon logo or blue-screen), I suspected some hardware fault.

Removed the capacitor and cleaned up the board. Not bridging the connection. It also looks like one of the pads came off a bit, making it even harder to solder a replacement part.

The FireTV is now booting normally and seems to operate fine.

I played some trailers and also the screensaver looks fine.

Root is working.

Can you guys please give me some feedback on this?

- Is it harmful for the unit to work without that capacitor?

- As it boots and works it looks like its somehow redundant or not essential for the FireTV to work!?

- Any idea what capacity, size group these are?
[Fire TV General] bula1ca:
That is a 0 ohm resistor. Unit should not boot up without it however you most probably have a short at that is the reason for booting up.
[Fire TV General] freezer2k:
Did you read my full post?

The 0-Ohm resistor is bridged, there's a capacitor next to it that I marked with a blue circle. Thats the one!
[Fire TV General] -BioHaZard-:
Awesome, just ordered my Low Voltage eMMC Adapter (Fully Assembled). :D
[Fire TV General] mcdinner:
where did you order it ?

nevermind... found it
[Fire TV General] -BioHaZard-:
Yep, in case anyone doesn't know the web store is now online :)
[Fire TV General] doblecero:
I ordered one more to be shipped to Spain! The store says units will be shipped on 15th... Let's see how soon arrives!

Thanks Maximus64
[Fire TV General] d1dd1:
Where can I order one ?

edit: found it: https://shop.exploitee.rs/
[Fire TV General] SuperBilleN:
How to use the preasambled unit? Really love to root my device
[Fire TV General] doblecero:
Don't be lazy and read. :)

The procces still require soldering knowledge and I guess the guarantee will be lost since the box needs to be opened.
[Fire TV General] derpeter:
So finally my adapter is working too :) http://i.imgur.com/04KkFhC.jpg It is based on maximus desigen but also allows 4-data lanes and has the voltage IC from the beta version so it can produce 1.8 and 2.5 Volt. I will put the egle files on github as soon as some cleanup is done.

I wondering why the exploiters still generate the 1.8 v in the new cheap version. 1.8v is available on the firetv so in theory we only need the TI chip and two capacitors (which may also be not that critical). So you should be able to just open a SD card reader, solder GND, CMD, D0, CLK, VCC to it do the same 2 times with the TI IC plus 1.8v from the firetv. If you only need this once this would be possible without a special PCB.

By the way i tried to use the same card reader (as it was already here) which the exploiters used but it seems my device is not able to speak to the emmc. A cheap one from SanDisk which has printed "20-90-03123 AA0805GLCF" on the bag worked for me.
[Fire TV General] papars:
Is it possible for somebody to dump and upload the contents of a rooted emmc? e.g. using diskimager
[Fire TV General] cyablo:
Also ordered one Adapter. Lets see when ist arrives in good old Germany. Would be nice to be able to finally unblock the Update-Servers, install a prerooted Rom and use the Amazon Services and not only XBMC. In this state this cute little Box is kinda castrated with only XBMC :(
[Fire TV General] rbox:
Probably because it's supposed to be a universal solution for other devices.
[Fire TV General] derpeter:
In that case the old regulator would be more helpfull as you have 2.5, 3.3 and 1,8 Volt right on the PCB. Also connecting the other datalanes would allow you to speak to 4-wire emmcs.

But its good that somebody is selling the adapters (and the price is also fair) so we will have more people working on the aftv.
[Fire TV General] derpeter:
Soooo its done, german firetv rootet via emmc, bootloader unlocked, newest CWM, newest firmware, 32GB USB storage to mounted to data.

thx to rbox and maximus !!
[Fire TV General] doblecero:
Good stuff!
[Fire TV General] papars:
Which firmware had before rooting?

I got one from Germany and it has 51.1.4.2 and I wonder if is possible to unlock boot and install CWM etc after rooting.
[Fire TV General] derpeter:
I'm not 100% sure 4.0 or 4.1 . You should also be able to 51.1.4.2 at least if the temporary recovery downgrade still works.

If not this should also be possible by just dd'ing the old stock recovery to the emmc parition while its connected to the emmc adapter.

I'm still not sure why this temp downgrade works maybe rbox can say something on this. (I'm referring to the step of dd'ing old stock recovery before

the FW downgrade to be able to install CWM and to the unlock).

[MENTION=3991724]rbox[/MENTION] can you point me to so information on a) it looks like we can write /recovery from current firmware but its gone after reboot b) what is different in old stock fw? Is there real write access to /recovery and /boot and they put some kind of overlay in later firmwares?

As /proc/mtd and some other things are missing on the firetv i was not able to find a answer to that.
[Fire TV General] freezer2k:
I tried this once, but it's not working.

The information in the net about this is a bit confusing.

Once a FireTV ever boots one of the stock firmwares containing the eFuse code, the eFuse will ALWAYS be blown, it does not matter if you have any custom CWM, kernel etc installed or not. And this will block you forever to install old recovery, install CWM or any custom kernels.
[Fire TV General] papars:
That is quite bad. But I read posts that is possible to bypass this limitation. Is there a tool that can check the eFuse setting?

Right now I use fire tv soley for KODI and I have 3 problems:

a. I can't set the correct time (my timezone is not supported).

b. I would like to get a better laucher.

c. I would like to use external storage. (and cifs mount).

I hope these can be fixed by simple rooting.

In the meantime is it possible to R/W the emmc partitions in windows? (not at file system level but at byte level). So to make cloning / rooting easier for non linux users?
[Fire TV General] rbox:
To use recovery, you need the 51.1.0.2 bootloader. Once it has booted with 51.1.4.1 or newer it blows the fuse and you can never boot the 51.1.0.2 bootloader.
[Fire TV General] papars:
So all EU owners are out of luck in this matter.
[Fire TV General] rbox:
No, because a lot of them didn't ship with 51.1.4.1. So if they blocked updates, they are good. If not, then correct, they can't unlock.
[Fire TV General] derpeter:
I can confirm now that both of my EU firetvs where 4.0 when i did the downgrade. So i was lucky to avoid the updates.

[MENTION=3991724]rbox[/MENTION] can you tell us what "features" of the old bootloader we need? If we are already connected to the emmc we can write the recovery partition so a firmware downgrade

should not be necessary to install a recovery. This should allow us install any rom we want.

That means we can have root, custom recovery and custom rom but only stock kernel on EU firetvs.

We still cant execute the unsigned kernel so we need to run your unlock tool.

So the real question is what do we need to run that unlock tool? Can we just run it from the adb inside the custom recovery?

Or can we just write a unlocked bootloader to the boot partition via emmc access?

I could not find the source for the unlock tool on your github page so i can only gues what it does.

A frind of mine has a 5.1 EU firetv so i will have a test device as soon as we have answered these questions.
[Fire TV General] rbox:
As long as you aren't on 51.1.4.1 or newer, you should be able to dd all the mbn, bin, and img files from 51.1.0.2, and then that's basically your downgrade. You might be able to get away with just dding the recovery.img and emmc_appsboot, but I think it's safer to just do it all from 51.1.0.2.
[Fire TV General] derpeter:
Yes thats clear, my firetvs are now rootet and unlocked. I was talking about a possible solution for people on 51.1.4.1 and newer.

EDIT:

I think i got my mistake. You unlock the old bootloader which we can't run on device with a blown fuse right?

We can't unlock the new one even with emmc access, right?
[Fire TV General] rbox:
The 51.1.0.2 bootloader has a bug that lets you load unsigned code. That's what allows CWM and bootmenu to load. Without that, there is no CWM and no bootmenu.
[Fire TV General] tomgreendennis:
Deine gerooteten FireTVs

this should go pm
[Fire TV General] papars:
The info I'm missing is why we can't downgrade the bootloader since the old bootloader is signed.
[Fire TV General] derpeter:
The old bootloader will not boot with a blown efuse.

But i'm wondering (under assumption that the boodloader is on the emmc) if we could just replace the bootloader or is the qualcom soc verifing the bootloader?
[Fire TV General] cyablo:
This eFuse Thing called QFPROM / QFuse is included into Qualcomm Chips since Years and there is an Hardware-Booting-Stage inside the Chip, preventingthe boot of older bootloaders if eFuses are set, as far as i know. So wiriting the Bootloader surely will not work because the SoC will not execute it.
[Fire TV General] derpeter:
Do got details on how boot-rom knows what an old bootloader is? Normaly the bootloader should look after the efuse and the soc needs to make sure that only signied bootloaders a started. But i cant find details how this works on the firetv.

EDIT:

here are some details http://xdaforums.com/showpost.php?p=31622172&postcount=9
[Fire TV General] derpeter:
I'm not able to play prime videos anymore on both firetvs. Does anyboady else have this problem after rooting?

Two error messages are popping up "Unkown_error" and "License_Error".

Fixt it. First i tried to unroot the aftv but that didn't solved to problem. A simple factory reset did the trick.
[Fire TV General] smuurfi:
I'm on 51.1.4.0 right now. The E-Fuse shouldn't be blown and I'd be able to use this method, right?
[Fire TV General] -BioHaZard-:
According to the AFTV website the e-Fuse code wasn't added till version "51.1.4.1_user_514013920". So you should be fine.
[Fire TV General] doblecero:
Had troubles with my main router and while I restored it and block the urls again (not more than 10 minutes) my aftv updated to 51.1.4.2 :(

I should have turned the unit off...

Now I won't be able to install CWM, but, at least I can root it.

Still waiting to receive the adapter. Anyone in Europe has already received it? I know maybe is too soon...
[Fire TV General] adiots123:
I purchased the emmc adaptor because my AFTV is bricked.

i ordered on last 15th , but I do not know that shipping state.

Additional costs apply for delivery tracking service is too expensive, so I just request usps default service.

but expolitee not yet feedback.

I just want to know whether the ship begins
[Fire TV General] doblecero:
Hopefully yes. They say the units would be shipped 15th January onwards.
[Fire TV General] m-Duke:
I'm not able to play prime videos anymore on both firetvs. Does anyboady else have this problem after rooting?

Two error messages are popping up "Unkown_error" and "License_Error".

I had the same issue .... you have to only logout with your amazon axx and login again......that fixed all problems for me
[Fire TV General] iff10:
root/adaptor

thanks for reply
[Fire TV General] rubinho:
[MENTION=5373704]m-Duke[/MENTION]

DerPeter has the problem solved by a factory reset

Von meinem LG G3 getippelt
[Fire TV General] doblecero:
Just received an email from PayPal saying the item has been shipped. There is a tracking number on the email too, though no info is available yet at U.S. Postal Service
[Fire TV General] mcdinner:
I ordered the unassembled version and also got the shipping confirmation few minutes ago. I don't think the tracking number is worth anything for international shipping. (Germany here)

Let's see how long it takes.
[Fire TV General] derpeter:
I wrote a blog post about the emmc root and the steps for EU firetv owner to root/unlock/mod .

Maybe it will help some people as finding all information to start was (at least back in 2014) not easy.

Some information on the unlock are still missing. I hope this will help some people.

I will also translate that to german asap as some people asked for it.
[Fire TV General] mcdinner:
Nice work, thank you.
[Fire TV General] adiots123:
I ordered assembled version to US address. but it doesn't confirmed
[Fire TV General] mcdinner:
I checked again today and the status was updated to "got pre-shipping information" or something like that.

So I guess I'm on todays shipping turn.
[Fire TV General] adiots123:
Did you have to pay the additional costs associated with tracking service?
[Fire TV General] mcdinner:
Nope, normal 4$ international shipping. Maybe your board will be shipped next Monday :)
[Fire TV General] adiots123:
Paypal send the tracking number.

Currently shipping tracking is possible.
[Fire TV General] GStar01:
Is login blocked from these 3 blocked adresses, which? Login, Logging in, Logged in, after that i come back to Login or New Account
[Fire TV General] Zaaap72:
Mine is on its way, too
[Fire TV General] -=Nils=-:
I have 10 PCB from this Post in Germany for sell

hi, i have 6/10 eMMC Adapter PCB without any of the board components attached for sell.

i am sending from germany. 1pcb 2€ + shipping (in germany 0,62€ ).

i used pcb from http://xdaforums.com/showpost.php?p=57185075&postcount=133

when you intresstet send me a pm
[Fire TV General] sebr:
My order arrived today from exploiteers - pretty fast! :)

How did you guys solder U1 ? Reflow or with the iron?
[Fire TV General] stormking80:
Is there anybody in Germany who would be willing to root my FireTV? I would, of course, pay you for your time. I just have ZERO practice in soldering.

Ciao, Stormking
[Fire TV General] aHcVolle:
sure,

my board got shipped yesterday so it will take a while until it arrives here. When i have it and rooted mine i can root it for you.

where are you living ? (drop me a pm)
[Fire TV General] Spence1115:
Anyone in the UK capable of doing this for me? I would pay, obviously, I just can't solder for ****, and buying the tools then learning etc is probably gonna cost me more than paying someone else to do it!
[Fire TV General] dabbler77:
My board arrived today, nice and quick, hopefully ill root it this weekend, however I'm short of time - fence to errect.
[Fire TV General] tolipwen:
Hey,

so I ordered and received the emmc-reader. I hooked it up to the AFTV and tried mounting partition 18. Unfortunately I was unable to get it to mount RW. I played around a little with remounting it RW but to no avail. After rebooting my machine I now get this when I connect the adapter

[ 47.465189] sd 3:0:0:0: [sdb] 15269888 512-byte logical blocks: (7.81 GB/7.28 GiB)
[ 47.481933] sd 3:0:0:0: [sdb] Write Protect is on
[ 47.481950] sd 3:0:0:0: [sdb] Mode Sense: 03 00 80 00
[ 47.495779] sd 3:0:0:0: [sdb] No Caching mode page found
[ 47.495786] sd 3:0:0:0: [sdb] Assuming drive cache: write through
[ 47.566298] sd 3:0:0:0: [sdb] No Caching mode page found
[ 47.566304] sd 3:0:0:0: [sdb] Assuming drive cache: write through
[ 47.679358] sdb: sdb1 sdb2 sdb3 sdb4 sdb5 sdb6 sdb7 sdb8 sdb9 sdb10 sdb11 sdb12 sdb13 sdb14 sdb15 sdb16 sdb17 sdb18 sdb19 sdb20
[ 47.740718] sd 3:0:0:0: [sdb] No Caching mode page found
[ 47.740725] sd 3:0:0:0: [sdb] Assuming drive cache: write through
[ 47.740729] sd 3:0:0:0: [sdb] Attached SCSI removable disk
[ 51.900333] EXT4-fs (sdb1): INFO: recovery required on readonly filesystem
[ 51.900338] EXT4-fs (sdb1): write access unavailable, cannot proceed
[ 52.297833] EXT4-fs (sdb2): INFO: recovery required on readonly filesystem
[ 52.297838] EXT4-fs (sdb2): write access unavailable, cannot proceed

I'm pretty sure sdb1 and sdb2 didn't show the recovery info before. And I'm still unable to mount the partition writable..

Any ideas if I soldered something wrong (i triple checked) or how I should proceed from here? Thanks in advance :)
[Fire TV General] -BioHaZard-:
Check your wire, my eMMC partitions wouldn't show at all until I used Kynar wire at about 5cm long.
[Fire TV General] dabbler77:
Just making sure I have all the parts i need before i disassemble the firetv.

I have a couple of questions:

1 - For the emmc, probably best i add a pin header - although i refer to the posts in this thread, wire length seems important so the addition of a header will affect this - what have people done? Header or not?

2 - Wire, what is recommended, solid core, but thin and shielded or the extra thin wire thats "painted" - I can't remember what its called, does any one have any links please?

TIA
[Fire TV General] tolipwen:
Phew! Cutting the wire-length in half did the trick! Thank you so much...I thought I screwed it up :)

Still can't believe I was able to solder/de-solder at that level!
[Fire TV General] -BioHaZard-:
Personally, I used pin headers, doesn't really make a difference. You could just solder straight to the board, which is what I was going to do before I found some spare headers (forgot to order them earlier ;)). For the wire, I originally used breadboard jumper wires, however it didn't work (eMMC partitions wouldn't show in Terminal). So I switched to standard Kanye wire (which is solid core), I cut the 4 lengths to 5cm.
[Fire TV General] derpeter:
My first try was a hot air solder station but some of the pins where not connecte so i fixt it with a solder iron.

---------- Post added at 01:58 PM ---------- Previous post was at 01:55 PM ----------

Could be an issue with the SDcard reader. maybe the whiteprotect dedection does not work with the PCB.

You may should open it and have a look.
[Fire TV General] fabi280:
I've been using 0.1mm thick enamelled copper wire I bought on Aliexpress a while ago.

I cut the 4 wires at around 8cm (did choose the length by eye, so the wires are +/- 1 cm). I soldered a Male Pin Header to the Adapter, but then I noticed that I don't have a spare female header anymore. So I soldered it to the "backside" of the male headers.

The partitions had the same id as in maximus64's video, okay at least they started with 57f8f and ended with f25b*. But on my fireTV the xbin folder wasn't on *f25b5, it was on another one. But as derpeter said in his blogpost (which is really helpful for the procedure with bootloader unlocking, CWM and bootmenu installation) "you have to look for the system partition which holds the xbin folder".

Was pretty easy - thought I'd get problems because of my visual judgement of the wires. My biggest problem was to bridge the resistors pins so the fireTV boots up again. Putting solder over those 2 points didn't work, so I soldered a really small cable between those points.

By the way, which soldering stations / irons are you guys using? I'm looking for a new one (using some cheap crap right now, it works, but it could be better)?
[Fire TV General] tolipwen:
Well of course I spoke to soon. After bridging the resistor I tried booting up the AFTV but it wouldn't come on. I checked for shorts but couldn't find any. So I re-soldered the emmc-reader. I was getting a bunch of read-errors and couldn't mount any partition at all. While re-soldering all the wires again I finally managed to rip off CLK-solder pad.

So i guess this is it, right? No way to recover the AFTV, or is there?
[Fire TV General] -BioHaZard-:
Providing your very careful you could scrape away the trace leading to the pad. If you can't bridge with solder use a small piece of wire.
[Fire TV General] derpeter:
Which of the pads? If its the one an which you connect the wire to the emmc you probably can get the clock from somewhere on the board i.e. right from the oszilator. If its the other pad you will need to scratch ....
[Fire TV General] tolipwen:
It's the pad used to connect the emmc reader to. And I just checked...the holes on the side of the cpu-cover are just big enough for enamelled wire...so going for the oszilator seems the best way, as the trace of the pad doesn't seem to be on the top layer of the PCB.

So now to find the oszilator...any ideas? I looked all over the board but I couldn't find it.

Also, I'm still sort of puzzled why the damn thing didn't just boot up, as copying the su binary worked like a charm and I'm pretty sure I didn't destroy anything on the pcb. Provided I can get the clock reconnected, the only way to debug this would through uart, right?
[Fire TV General] YourNameInHere:
sorry to hear that - same happen to me while resoldering the bridge with a wire (killed the pad to the emmc, not the cpu side). I think the CLK-pin is going straight to the eMMc itslef - so it looks like there is no other point where you can resolder it.

The line is at the second layer (i think the aftv-pcb is a four layer board - two at every side). I tried to get it back with a small dremel and yes i was able to see the line again.

But at the end i have given up. The board is still here and maybe if i have some time i will try to get it working ....
[Fire TV General] tolipwen:
OK, so the clock is generated by the CPU and then outputted to the emmc. So scratching/drilling is the only option. Do you think a scalpel would do the trick or do I really have to drill? Also is the trace/line straight down (from the cpu to the emmc)?
[Fire TV General] YourNameInHere:
well ... i haven't done such a thing before. So i don't know what's the best way to go (googleing should give us more ways/information).

I think the line is not going down straight. You can look at the gtvhacker/Exploitee pinout - the CLK-Pin should be in the line of DAT5 (hope this is understandable), but it's at the line of CMD. Somewhere it must go a little bit to the left (one pin/line).
[Fire TV General] tolipwen:
Well that's more or less straight :)

Guess I'll have a go at it tomorrow and see if I actually manage to reach something to solder to. I have not done anything like this before, so chances are I come out the other side of the pcb :p

EDIT: Couldn't resist scratching my itch so to speak. Used a small screwdriver and to my surprise after a few gentle scratches I found "gold". I'll try soldering something to the trace tomorrow (If that is what I'm seeing there).
[Fire TV General] tolipwen:
I soldered a wire to the trace. 'But I can't get the emmc to be recognised by the sd-card reader. The only thing that happens once I power up the AFTV is that the blue light of the maximus-adapter flickers for a bit an then turns of. Anyone know what this means?

I see two possible reasons:

1) There is no connection to the CLK-trace / or I it's the wrong trace.

2) The AFTB PCB got somehow damaged (though I'm not sure how this could have happened)
[Fire TV General] superkoal:
ESD is always a possibility if you don't ground yourself properly.
[Fire TV General] tolipwen:
Could very well be the case. Anyhow....can't seem to get this to work and I'll have given up on the damn thing. Seems like this is the first device I bricked since forever (or ever). Luckily it was only 50 bucks :)
[Fire TV General] YourNameInHere:
killed two devices while testing :silly:

Did you check if the CLK-line is now shorted with ground (multimeter to ground and CLK-pin)?
[Fire TV General] tolipwen:
I get 5.17 M Ohm between CLK and ground and 46.6 kOhm between CMD/DAT0 and ground