yashsingh1/xdaforums huggingface dataset:
[Fire TV General] nufclad:
Can anyone in the UK do this for me? I had it done awhile ago by the guy who first done it anywhere. but I managed to break my fire TV flashing software. Amazon sent a replacement and I can't downgrade anyway. As its the latest. I just want to be able to use the USB port and a proper application for mouse control.

PM me if you're in UK and can do it?

Thanks,

Darryl.
[Fire TV General] adiots123:
my aftv has gone

my aftv has gone.

this working was hard to me but it is my fault.
[Fire TV General] superkoal:
Your wire is like 3 times the size of the pad, the mechanical tension probably was too much.

I can't see it clearly on the picture, but maybe you can try to scratch?
[Fire TV General] adiots123:
I've done as you say.

Is it possible to work in this way?
[Fire TV General] TomParis01:
Did anyone else outside of America order at exploiteers and has the USPS tracking status

"Your item could not be delivered on February 4, 2015 at 12:14 am in CANADA due to not meeting customs requirements. It is being returned to sender."? :(
[Fire TV General] aHcVolle:
mine is still:

January 31, 2015 , 4:34 pm Arrived at USPS Facility CHICAGO, IL 60666

Did you order to Germany?
[Fire TV General] TomParis01:
Yes I did, but seemingly the package got routed to Canada instead oft Chicago for a reason only USPS knows. I got an instant refund from exploiteers although the package is still in its way back to them and ordered again. More waiting for me :( but not exploiteers fault I guess.
[Fire TV General] Zaaap72:
I got mine delivered in germany about a week ago.

Didn't have the time to use it.

Shipment Activity	Location	Date & Time
-------------------------------------------------------------------------------------------------------------------
Arrived at USPS Facility CHICAGO, IL 60666	January 25, 2015 6:40 pm
Departed USPS Facility AUSTIN, TX 78710	January 23, 2015 8:41 pm
Arrived at USPS Origin Facility AUSTIN, TX 78710	January 23, 2015 7:25 pm
Accepted at USPS Origin Sort Facility	CEDAR PARK, TX 78613	January 23, 2015 6:10 pm
Shipping Label Created CEDAR PARK, TX 78613	January 22, 2015 8:00 pm
Pre-Shipment Info Sent to USPS	January 22, 2015
[Fire TV General] aHcVolle:
Thx for your schedule, now I have some idea when mine will arrive ;)
[Fire TV General] jmp:
My order arrived on Thursday from exploiteers to Germany.

Its loook great!
[Fire TV General] babb_z:
Mine arrived last week to UK. Already rooted 6 ftvs, great bit of kit, worth every penny.
[Fire TV General] doblecero:
Mine arrived today to Spain. It was shipped on January 22th
[Fire TV General] raider0:
root aftv

Hi i have an aftv serial no 70900311446600GN sortware version 51.1.4.0 although i think rooting via emmc this is irelivant. is their anyone in the uk who can root this for me i will obviously cover all costs and postage. TIA

Ben
[Fire TV General] dabbler77:
If someone who has succeeded, could you please take a look at the below, i do not know where to take the power from! Does it need power? Thanks very much

FIRETV POINT	eMMC Adaptor POINT

CLK	---->	CLK

DAT0	---->	DAT0

CMD	---->	CMD

GND	---->	GND

VCC?

VCCQ?
[Fire TV General] aHcVolle:
the firetv flash chip gets powered by the firetv and the emmc adapter is powered by usb ... atleast thats how i understood how its working ...
[Fire TV General] gabesir:
Anyone in FL that can do mine :)
[Fire TV General] fabi280:
Correct. You don't need any additional wires. Asked this question a while ago @ IRC
[Fire TV General] dabbler77:
Brilliant, thanks guys ;)
[Fire TV General] andy_mg2000:
I wonder if anyone could help. I have been through the steps to root my fire tv (v51.1.4.0) via e-mmc interface and as far as I am aware I completed all steps correctly. However when booting up the Fire tv, SuperSU is not listed in "System>Apps>Manage my app" list. Also if I connect via adb and run "adb shell su" I get this on my pc command prompt but nothing happens on the fire tv:

C:\Users\Andy\AppData\Local\Android\android-sdk\platform-tools>adb shell su

root@android:/ #​

The steps I followed after connecting up were:

1. Mounted the system partition using "mount /dev/sdg18 /mnt/user/data/sd/"

2. Copied the "su" file I have extracted from "UPDATE-SuperSU-v2.40.zip" (/arm/su) to my "/mnt/user/data/sd/xbin/" folder.

3. Ran: chown 0:0 /mnt/user/data/sd/xbin/su

4. Ran: chmod 4755 /mnt/user/data/sd/xbin/su

If I then run "ls -l" in the xbin folder I get:

root@Tower:/mnt/user/data/sd/xbin# ls -l

total 680

-rwxr-xr-x 1 root 2000 440032 2014-10-14 22:48 alljoyn-daemon*

-rwxr-xr-x 1 root 2000 5396 2014-10-14 22:48 bttest*

-rwxr-xr-x 1 root 2000 59776 2014-10-14 22:48 dexdump*

-rwxr-xr-x 1 root 2000 31328 2014-10-14 22:48 hciattach*

-rwxr-xr-x 1 root 2000 5316 2014-10-14 22:48 onetouchplay*

-rwsr-xr-x 1 root root 129376 2015-02-05 20:45 su*

-rwxr-xr-x 1 root 2000 9464 2014-10-14 22:48 trapz*​

I unmount "/dev/sdg18/", bridge the clk connection and start up the fire tv but no joy.

I have now tried numerous attempts to get su working and I am concerned I will end up damaging the board if I have to solder the points much more. I've already reconnected the e-mmc adapter 3 times without any damage yet!

Following my first failed attempt I have tried:

1. Using "UPDATE-SuperSU-v2.40.zip" instead of "UPDATE-SuperSU-v2.45.zip" to see if that made a difference.

2. Used "chmod 4755 su" instead of "chmod 6775 su" which was the command used on the exploiteers video.

Does anyone have any idea what I might be doing wrong?

Thank you.

---------- Post added at 09:59 PM ---------- Previous post was at 09:47 PM ----------

Am I possibly being really stupid here. If I do the following:

adb shell

su

I get:

root@android:/ #

Does that mean root is working? Why is SuperSU not listed in my apps and why do I not get prompted on my tv when I call su via adb?

I may be looking a little stupid here if I have actually rooted successfully....let's call it practice for the next one.
[Fire TV General] fabi280:
You did nothing wrong! Your commandline shows root.

But you should follow the steps on this HowTo http://solderwiresandplastic.com/20...the-amazon-firetv-to-achieve-root-privileges/

Start with "2. Downgrade stock recovery"

EDIT: By the way, I recommend you to use ADB on Linux and not on your Windows. There's auto-completion on TAB ;)

EDIT2: Longer explanation:

You're logged in as root user, but it doesn't show anything. You normally know those Tools like SuperSU on Android. Those tools are basically like gksudo on Ubuntu - you have to authenticate every root request with a buttonpress with those Applications. But right now you just have the su binary installed which switches to root user, the other part which shows the confirmation dialog isn't installed.

If you'd install RootChecker it would confirm you're rooted.
[Fire TV General] andy_mg2000:
Thank you. So I am being stupid :p Got the hard part done then tripped up on the simple stuff. I was just expecting supersu to be present and prompting for access.

Oh well, my mate has one that needs doing and since in the uk all are on non-software rootable versions this is some good soldering practice.
[Fire TV General] derpeter:
I added installing of the Superuser.apk to the blog post. Sorry that i missed that. You can just instal it with "adb install Superuser.apk" you find the apk in the SuperSu zip in the common folder.
[Fire TV General] andy_mg2000:
Thank you. Your guide was very useful and appreciate the effort you've gone to in pulling it all together. However I did have some feedback which might help others out:

Section 3

If you check the aftvnews source link on which your section is based, there are two additional steps which I had to do:

Had to create /cache/recovery as it didn't exist.

Had to follow the steps in the 'If downgrading fails' section.

I don't think it is clear here you must download to 51.1.0.2 stock to support the installation of cwm and the bootloader unlock. I originally went to 51.1.1.0 stock as this is the file you say to download at the start of your tutorial. You don't actually state that 51.1.0.2 is required to be downloaded. I was confused for a while why CWM wouldn't boot but then realised the issue.

Section 4

Minor, but you do not include aftv-unlock in you files to be downloaded list.

Section 5

I don't think you need the comma on the end of this line (I omitted it as other places do not include this):

dd if=/sdcard/firetv-cwm_recovery-6.0.5.1.4a.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery,
[Fire TV General] derpeter:
Thanks for the comments. The feedback is highly appreciated.

My intention was to keep the howto as short as possible because i usually get inattentive when a tutorial lists every tiny step that should be known by a user who thinks that he should to such tasks himself ;) But of course it should not miss important information i will update the post asap. And of course errors like the wrong version number should not happen at all ;)

EDIT: update is done. thanks again.
[Fire TV General] aHcVolle:
hey guys, im just in the middle of following derpeters guide and now i'm stuck.

root is working, i flashed the older stock recovery and now wanted to proceeed to step 3.

i downloaded stock firmware before but now i realized that the files provided by http://www.aftvnews.com/software/

are .img files, but the guide tells me to copy the update.zip to the cache partition.

where do i get this update.zip ?

greets

Chris

[edi]

ok i got it

you have to dl the img and rename it to update.zip

another hint:

there is a - missing in the recovery command:

echo –update_package=/cache/update.zip > command

should be

echo –-update_package=/cache/update.zip > command
[Fire TV General] ingrimsch:
I left a message in #gtvhacker pointing here, maybe we get a reply or some help.

[19:51] <ingrimsch> hey guys, do you still have the FireTV with removed EMMC available? there are a few guys on xda-dev who want to recreate your work on the EMMC/SD adapter to get root access, but stumble on supplying vcc to the EMMC

[19:52] <ingrimsch> maybe you can help us out with a pin / spot to supply power to the EMMC or give us a hint how you connected EMMC--SD Sniffer--PC to power it

[19:53] <ingrimsch> here is the thread on xda: http://xdaforums.com/fire-tv/general/hardware-root-via-emmc-chip-t2885344/page2

[19:53] <ingrimsch> thanks in advance for any help you can supply :)
[Fire TV General] ingrimsch:
Just re-read your post... why 1.7V instead of 1.8V? I´ll try to gather some more infos and post them here when I get some :good:
[Fire TV General] sammy98:
Sorry meant 1.8

Gesendet von meinem Nexus 7 mit Tapatalk
[Fire TV General] simondo22:
Can someone told this in a short way.

My english isn't very well :confused:
[Fire TV General] rbox:
If you think about doing this, be prepared for a 75% chance you'll brick your device. :)
[Fire TV General] sammy98:
Should be the board clk to gnd only on then time, when plugging in the ftv?

Ifs the same clk like the emmc, it has to be that way. If not - where is the clk pin for the board/cpu?

Sammy98
[Fire TV General] ingrimsch:
another log to keep you guys up to date. grounding the Y2 crystal instead of the emmc clk seems to be the right way, but maybe we can find a point to input vcc by measuring a running ftv instead. I´m still out of hardware, but willing to gather more info if needed.

cant post the log here as the system flags me... "We are sorry, your post was flagged by our system and was blocked from submitting. If you believe this was in error, please contact an admin to report this."

i uploaded the log to pastebin, so the infos dont get lost:

h tt p : // pastebin.com/VFCeMF6N
[Fire TV General] sammy98:
Alright jsut read it.

So we have to gnd the Y2 or wait for the correnct pinout of the + line for the emmc if they can trace it on the board with the removed emmc.

I will wait for some days if that happens ... if they wont get the + line, i need a level converter for the reader as far i jsut unterstood- sigh

Sammy98
[Fire TV General] ingrimsch:
You will need a logic level converter (or "pegelwandler" ;) ) anyway to step down the 3.3V of the SD Sniffer logic (? I´m not 100% sure if the Sniffer works on 3.3V btw. if it works on 1.8V this step will be obsolete) to the 1.8V of the FTVs DAT0 and CMD lanes... or at least it sounded like a pretty good idea talking to the #gtvhacker guys who bricked a few devices trying to glitch emmc devices and found this to be "best practice"... better be safe than sorry before taking any risk of an unwanted brick.

We could try finding the 1.8V VCC(q) rail that powers the eMMC and the other ICs by observing a running FTV with a multimeter/multitester, but I cant yet and don´t know if you are willing to and have the proper tools and knowledge (dont want to step on your toes, just want to make sure you know what youre dealing with) ;) :D

Not directed to Sammy98, but rather to the rest of the readers:

I cant stress this enough - There is a SERIOUS risk of bricking the FTV, so please read, understand whats going on here and dont try any of this without proper knowledge of what you are doing. I just want to make sure you know you are poking at low level hardware here. At least dont tell me I bricked your FTV after you tried anything written in this thread! :eek:

If there are readers from germany with a broken/bricked FTV in here who are willing to donate their broken devices for researching purposes I´d be happy to try a few things myself. Doesnt really matter if the devices are US imports or genuine German/Europe FTVs, it´s about getting to know the hardware. So if you have an FTV paperweight :silly: just contact me if youre interested and we´ll work out the rest.
[Fire TV General] derpeter:
Let me get that strait. I think two approaches are mixed up here.

One is powering the chip from power supply of the FTV which requires to hold the FTV in reset to prevent accessing the chip / mixing the SPI clocks from FTV and attacker. In this case a level shifter should only be neccessary if you SD card interface don't support 1.8 volt. As far as i understand the the SD card specs every reader should support 1.8 volt as many cards use that (correct?).

The other option would be to power the eMMC (and the parts of the board that are connected to the same 1,8V rail). In that case we need to find a place to feed the 1,8V in and provide enough current to make the components work. Here a level shifter could be used to convert i.e. 3.3 V from the card reader to 1.8v for the eMMC. The only problem is that we don't know where to feed the 1,8 V, right?

If you not jet found them here are some good pictures from ifixit

[IMG="top layer aftv"]https://d3nevzfk7ii3be.cloudfront.net/igi/34OAJmxtAhMOgFDZ[/IMG]

[IMG="aftv bottom"]https://d3nevzfk7ii3be.cloudfront.net/igi/eLJCXWQxVZauAOVp[/IMG]

I read the chatlogs twice but couln't figure out which method the gtv hacker have used but it sounds like they used the second one and missed to mark VCC in the image.

Edit:

This http://pdf1.alldatasheet.com/datasheet-pdf/view/553778/MPS/MP28257.html seems to be one of the step downs which you can see on the right of the board. It could be the 1.8V source which should be easy to measure

Do i got that right?
[Fire TV General] ingrimsch:
hi peter (oh, ein Namensvetter :D),

yes, there are a few things mixed up here... or at least confusing maybe. there is 2 things that need to be done here to follow the work of the gtvhacker guys:

- Power up the eMMC and connect it to a linux pc by using the SD Sniffer (without powering the whole FTV so the OS wont interfere) to gain access to the ext4 filesystem on the eMMC via linux

- Make sure we use the right logic voltages when the eMMC is attached to the pc to avoid frying it, this is where the level shifter might be useful, but i dont know the voltages on which the SD Sniffer operates as i dont have any hardware available yet

Feeding power to the eMMC can be done by powering the Vcc/VccQ of the eMMC directly, by finding a spot to inject 1.8V (this is where the MP28257 you posted might come in handy) or by hooking the Y2 crystal to GND and powering the FTV with the regular Power Supply.

Whats yet unclear to me is the voltage on which the SD Sniffer operates. This could easily be measured with a multitester/multimeter from VCC to GND (and maybe CMD/DAT0 too, but they should operate on the same logic level). If its 1.8V we should be good to go, if its 3.3V we need a level shifter to avoid any damage to the eMMC. I'm still waiting for my FTV and Sniffer, so I'm no help in terms of measuring. I was not able to talk to CJ_000 and maximus64 who seem to have done the FTV hack, but was able to talk to zenofex who at least worked with other eMMC devices and maybe talked to the other two guys in the proccess of the FTV hack. Until I get my hardware I'm grounded on collecting infos and helping other people who want to try this method or want to find the right way to re-do the gtvhackers work.
[Fire TV General] superkoal:
First case: firetv not powered.

You cannot use the SD card sniffer as a power source if your card reader outputs more than 1,8vdc (do measurements!). In that case a logic level shifter will NOT do the job alone, as it will usually not supply enough power for the whole 1,8 vcc line. You need an additional external power supply for 1,8vdc. Make sure to connect all 3 ground lines (pc, power supply, ftv).

Second case: firetv powered:

Make sure to hold the ftv in reset mode by grounding the above mentioned crystal BEFORE powering on. Safe way is to use a logic level shifter for dat and clk, might work without thing but is a bit risky if your pc card reader works at higher voltages. Connect ftv and pc grounds.
[Fire TV General] sammy98:
I know both ways. I prefer the first one - the second (eg. is used with the german RWE Smarthome central to get into the resque mode and dump the chips)

Both need the correct pinout.

I personally drive the power with an external device where i can choose what i want as power.

I am now out until monday - i am not at home the next few days.
[Fire TV General] derpeter:
I'm not sure this is true. The reader need be able to talk to cards with different voltages. Therefore it should be able to adapt the voltage.

The results of the guys that tried it on the first page of this thread sound like thats true because otherwise they would have briked there device. I think (hopefully will find the time to test this tomorrow) the problem is that a card reader can't provide enough current to power the eMMC and the other devices on the 1.8V rail.

Again this sounds strange to me if you have a look at http://en.wikipedia.org/wiki/Secure_Digital it clearly says that 3.3V is normal for older SD cards and that new cards (SDHC) use 1.8V so every SDHC ready reader has to support 1.8V . But a level converter can't hurt so you may also add one.

By the way, does anybody find some information on the USB port? As mentioned in a different post multiple pressing of ALT+Print+I results brings you to a stock recovery where you can press home to get the recovery menue. There you can select to load firmware by ADB. I havent yet tried it (have to build a cable first) but if the USB port acts like on phones this could be a way to load an old (but signed) firmware which still is explotable by towelroot (implied that we can prevent the update process).
[Fire TV General] rbox:
The firetv's USB port is in USB HOST mode while in recovery and booted into the OS. In theory, it's actually in OTG mode and controlled by the PMIC. There might be some way to force it in to usb peripheral mode, but I have no clue how. If someone were to figure out how to force it in to usb peripheral mode, then yes, you would be able to sideload 51.1.1.0 or whatever.
[Fire TV General] superkoal:
From Wikipedia:

As the flash memory of the firetv is not an sdcard it does not need to be fully compliant to the sd standard and might as well not be "3.3V proof" (If you exactly know the type of memory you don't need that intialization protocol where the card tells the reader which voltage, operating mode and speed it supports). So if your SD-Standard compliant card reader initially powers the whole 1.8V rail with 3.3V you might kill something along the way (if it has enough power and voltage won't crash immediately).
[Fire TV General] no_spam_for_me:
I know it's a little bit OT:

If I do

adb reboot recovery

I got a screen with:

"The System Update was not successful. Your Amazon Fire TV will restart in a few minutes and should resume normal operation."

Means this the moment I should press [Home] to get into the recovery menu?

Because with my wireless keyboard nothings happens at that moment I press [Home], or do I have to use a wired keyboard?

... ?

BTW:

adb reboot bootloader

also works
[Fire TV General] rbox:
Wireless as in bluetooth? Bluetooth doesn't work. If it's wireless with a USB dongle it should work. But if you are using a hub, it probably won't work.
[Fire TV General] no_spam_for_me:
No, USB dongle without HUB, doesn't work (but it needs FN at the keyboard to "enter" the [Home] function and never tested if it really works but the home (another one), menu, back etc. at andorid (also via FN) works ...)
[Fire TV General] derpeter:
thanks i will add the comment regarding the update.zip. Fun fact in the "--" is korrekt in the backend of wordpress and seems to get lost by rendering the page. I have not jet a clue whats causes that.
[Fire TV General] aHcVolle:
while you're at it, change the stock firmware version to the .2er one .. there is no inofficial mirror to the .img and normally you should have blocked the official firmware download locations :>

Chris
[Fire TV General] papars:
I have an EU version which means no way to use custom recovery / firmware.

Maybe a stupid question...

Would it be possible to use a bootloader from another device and burn it using the emmc interface ?
[Fire TV General] derpeter:
EU versions are shipped (at least some) with a firmware that is downgradable. Change the bootloader only helps if the efuse is not blown yet.

Check your firmware version (but block updates before you power connect the device to the network)
[Fire TV General] andy_mg2000:
Mine was from Amazon uk, ordered 27th December 2014. It came with v51.1.4.0. I blocked updates and only just rooted yesterday. Are they now shipping with v51.1.4.1 or greater? If so, that's no good. I am considering buying another, so maybe worth going to a shop instead (Argos) as they are more likely to have older stock.
[Fire TV General] papars:
I got mine from amazon.de around Xmas.

It had 51.1.4.1 unfortunately I was unaware of the talk in this site and it got updated to 51.1.4.2.

Is there a complete (binary) dump of the emmc somewhere? (or partition dumps?)