yashsingh1/xdaforums huggingface dataset:
[Fire TV General] zeroepoch:
It's been a while since I provided an update because I haven't had much time to work on rooting the Amazon Fire TV Gen 2 and also it took me a while to make some progress. As I mentioned earlier I was able to access the IO memory space using the preloader and looking at the kernel code I was able to write an SDIO driver to read/write the flash using the FIFO registers. I've tried to be careful and test things cautiously to avoid tainting the partitions (strongly suggested by rbox). Due to massive serial debug output (CPU serial not USB serial) when using the preloader commands the transfer speed is very slow, around 1K/s. As you can imagine it took forever to extract the boot partition (~26 MB). Once I had this image I found out that the whole thing is signed by verifying the hash in the signature area. I don't see a way to attack anything there by modifying it or using fastboot.

Using the "filefrag -v" command I'm able to get the physical offset for files I can read on ext4 filesystems. I did some tests first in the userdata area and then after backing up what I changed I modified a service shell script in the system area that runs as root. I'm fighting with SELinux to be able to do anything useful, but I was able to get the dmesg output which I attached. This was not possible from the CPU UART because printk was disabled.

You can use the following rough code below to read, modify, and write back a file once you know it's partition start and offset. The file contents must be exactly the same size as the original. You have a small window (2 to 3 sec) to handshake with the device after rebooting (the script waits for it), but once the handshake is complete it will halt at the preloader indefinitely. I'm trying to find a way to dump the raw partitions through dd to userdata, so I can get inode physical locations and change permissions, but no luck so far. The only other way is for me to get some assistance from other users on the forum to dump the partitions in segments and combine them offline. Otherwise it will take about 2 weeks for the system partition to backup.

adb reboot
./handshake.py
./read_mmc.py $((0x00000000058e0000+(306567*4096))) 4096 file.out
ghex file.out
./write_mmc.py $((0x00000000058e0000+(306567*4096))) file.out
[Fire TV General] zeroepoch:
Amazon Fire TV 2 Rooted!

It's been a while since I've provided an update because I've been busy with work and the kids, but I have been slowly trying different attacks. To give you the most interesting news first I've fully rooted the Amazon Fire TV Gen 2. You can see the screenshots below to see some evidence. I need to clean up/package my code and images and provide an easier method to apply the root modifications before just about anyone technical will be able to do it. It requires USB access BTW nothing can be done remotely using network adb.

The summary is I modified a script (using the flash read/modify/write procedure discussed before) that was running in the init SELinux context which was triggered by a simple property change. After some different approaches I eventually hacked the script to eval a string I provided in another random property. This allowed me to load a kernel module that emulated the way selinux was set to permissive. Once that was done I copied pieces of SuperSU into /data and with the right processes running and permissions set I had root. I finally tonight was able to use unencumbered root to get the full SuperSU system working with the grant prompt. To go into details would take a long time because it took a dozen or so steps where I had to go deeper into SELinux and the kernel source, but once I get a chance to put all the code in a git repo and create a new thread it will be easier to discuss the details. Hopefully I'll have some time tomorrow to package things up and get something posted.

BTW, the changes are very specific to 5.0.3.1. You will need to be running that version first, which is the latest. I think the whole process will need to be reversed and repeated from scratch in order to update the device without breaking it. Although now I have my tools :) I haven't even looked into disabling updates yet or if that varies from the previous device. I've just left the network disconnected for now as I was working on it. Thanks rbox for the tip about incremental updates. I would have probably bricked the device otherwise.
[Fire TV General] AFTVnews.com:
Awesome work! I look forward to the details.
[Fire TV General] roligov:
Congrats zeroepoch, great work! Your perseverance paid off :)
[Fire TV General] playingmax:
Congrats zeroepoch!!!!!! your work is much appreciated!!!! Cant wait for the offical release.
[Fire TV General] zeroepoch:
Quick Guide - Rooting the Amazon Fire TV Gen 2

I got everything mostly ready and I tested rooting again from stock. I'll create a new topic with more details later, but for those who want to try rooting now I'll provide the steps and resources needed. The README file in the aftv2-tools repo provides more lower-level details. You'll need a Linux system with python 3, pyserial installed, and a USB A-to-A cable. You will need read/write access to /dev/ttyACM0 which shows up early in the boot process (for about 3 sec during the preloader). You don't technically need adb enabled but it will make it easier to reboot and handshake. The handshaking script will wait until the device shows up so you can simply run it and then restart from the menu as well.

git clone https://gitlab.com/zeroepoch/aftv2-tools.git
cd aftv2-tools
wget http://download.zeroepoch.com/aftv2/5.0.3.1/system.root.img.gz
wget http://download.zeroepoch.com/aftv2/5.0.3.1/system.diff.gz
gunzip system.root.img.gz
gunzip system.diff.gz
adb reboot ; ./handshake.py
./patch_mmc.sh 0x00000000058e0000 system.root.img system.diff

The last step will take about 2 hours since it has to write the differences to the flash over a very slow serial link. This is due to debug output on the CPU UART (~1 KB/s) not on the link used to send the data. You will not see the output because it's flooding the CPU UART but it rate limits the ttyACM device. Otherwise I bet it would run a few MB/s. Make very sure you have ZERO changes to the system partition (true for most unless you attempted to root on your own) and you are running 5.0.3.1. If either of these conditions are untrue it's likely you'll prevent the system from booting Android and restoring will take a very long time. In the event that it fails or hangs during the writing process just power off the device, reboot your computer, handshake during device boot, and start again. There is no harm doing it twice. There are ways to greatly accelerate the last step, but you would need to go through a number of steps to be able to dd to the system partition which is not straightforward. The next step after rooting will be to disable updates so it doesn't corrupt the system partition during the update process. Might be the same procedure as the first version. I just haven't looked into it yet. I've been doing all my work with the device offline so it hasn't been an issue so far. To go back to stock simply copy the original system image to an SD card and dd or cat the image to /dev/block/platform/mtk-msdc.0/by-name/system.
[Fire TV General] rbox:
You don't need to worry about updates. They'll fail because /system has been modified.
[Fire TV General] zeroepoch:
Nice! I figured you would know more about the update process than I would ever hope to. I used "pm disable com.amazon.dcp" as suggested by [MENTION=5957312]AFTVnews.com[/MENTION] but I didn't know of a way to test it since there are no further updates yet.
[Fire TV General] rbox:
Yeah, it's the reason having a pristine image of /system is so important. The first thing the update script does is check the hash of the system partition, and if it's wrong it'll stop. It's also the key to prerooted roms. I just need to take the pristine image, apply the update ontop of it, and there is a flashable image for recovery.
[Fire TV General] kibmikey1:
I'm trying this, but at the adb reboot handshake, it keeps showing the error:

Traceback (most recent call last):

File "./handshake.py", line 5, in <module>

import serial

Importerror: No module named 'serial'

Any advice?
[Fire TV General] zeroepoch:
Not a problem :)

My scripts require the python3 pyserial module. Use the following commands to install it.

Debian/Ubuntu = apt-get install python3-serial

RedHat/Fedora = yum/dnf install python3-pyserial
[Fire TV General] kibmikey1:
Worked like a charm! Now just waiting on it to finish!
[Fire TV General] zeroepoch:
Glad to hear it's working! It takes about 2 hours for the last step :( 119m according to the time output when I tested it from scratch. Best to wait over night I guess. There is a faster way but you need to semi-root it first so you can dd to the device which is not a few simple steps like this procedure. Please report back on your success. I tried to test it myself the best I could and error check in many places within my scripts but I haven't heard of anyone else trying it yet.
[Fire TV General] rbox:
I'll see if I can come up with something a little more streamlined. In reality, all that needs to be written is enough to get Safestrap recovery loading, which is pretty minimal. Once that works, we can boot in to recovery and just flash a prerooted rom. If I'm lucky it might just wind up being 1 block.
[Fire TV General] kibmikey1:
OK, so I think I'm having an issue with the handshake. It never comes up with a handshake created or anything. Also, how do I gain r/w access to dev/ttyACM0 without root?

Edit: Everything works up to the handshake. Then it stops. If I attempt to run the final command, I get the following:

Patching patch_00000400.img...

512+0 records in

512+0 records out

512 bytes transferred in 0.002506 secs (204308 bytes/sec)

Traceback (most recent call last):

File "/Library/Frameworks/Python.framework/Versions/3.5/lib/python3.5/site-packages/serial/serialposix.py", line 289, in open

self.fd = os.open(self.portstr, os.O_RDWR|os.O_NOCTTY|os.O_NONBLOCK)

FileNotFoundError: [Errno 2] No such file or directory: '/dev/ttyACM0'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "./write_mmc.py", line 13, in <module>

dev = serial.Serial(PORT, BAUD)

File "/Library/Frameworks/Python.framework/Versions/3.5/lib/python3.5/site-packages/serial/serialutil.py", line 282, in __init__

self.open()

File "/Library/Frameworks/Python.framework/Versions/3.5/lib/python3.5/site-packages/serial/serialposix.py", line 292, in open

raise SerialException(msg.errno, "could not open port %s: %s" % (self._port, msg))

serial.serialutil.SerialException: [Errno 2] could not open port /dev/ttyACM0: [Errno 2] No such file or directory: '/dev/ttyACM0'

I'm not sure where I went wrong, but I'll have to wait until something more streamlined comes along.
[Fire TV General] rbox:
/dev/ttyACM0 probably has group writes for a certain group. If you add your user to that group you should be able to do it.
[Fire TV General] kibmikey1:
How do I change that without root though?
[Fire TV General] rbox:
There's nothing to change... ls -l on the device. See the group. Add your user to the group. Obviously you need to use root to add the user to the group though...
[Fire TV General] kibmikey1:
I'll restate. How do I access that folder and that file on the device and in a way to change the permissions on it?
[Fire TV General] NaturalBornHaxor:
It looks like you're using a Mac. The device isn't /dev/ttyACM0 on OS X. I believe it will be /dev/cu.usbmodemXXXX for some consistent XXXX. You'll need update the code with the proper device name. You may need to "sudo chmod 666 /dev/cu.usbmodemXXXX" on your Mac to gain access to that device for your local user.
[Fire TV General] zeroepoch:
Based on the paths to the python libraries I would have guessed he is on a Mac as well. Since I don't have a Mac (well I do at work, but haven't tried this) I have no idea what the device path would be so you're guess is definitely better than mine.

Doing a quick check a standard Mac should have all the tools required for this to work minus python3+pyserial and of course the device path is different. I think everything else should work. The device only shows up for about 3 seconds early in the boot so you'll need to constantly "ls -l /dev/" to catch it. If it's something predictable I can add an if/else to the scripts to detect if it's a Mac.
[Fire TV General] skyball2:
Thank you for your great effort!

Do you (or rbox) expect any problems trying the rooting-scripts on a non US (european) Fire TV 2?

Christian
[Fire TV General] zeroepoch:
That's a good question. I have no idea. If it uses the EXACT same system partition then no problems, but if it's different than we'll need a different pre-rooted image. Maybe rbox knows if the non US models are different. There really isn't an easy way to check that I know of besides MD5SUM the partition which requires at least restricted root access.
[Fire TV General] skyball2:
Thanks again! So I hope that rbox will know an answer to that. I'll receive my Fire TV today and I'd be willing to experiment a bit but wouldn't want to take the risk of bricking my device.

Greets, Christian
[Fire TV General] Calibaan:
For the 1st gen FireTV there were no differences between US or EU/UK/GER devices despite the power supply adaptor. So identically hardware and software. It´s very likely that´s still the same for the 2nd gen aTV.
[Fire TV General] zeroepoch:
I've attached the /system/build.prop file from my device. If there was some sort of difference it would probably need to be in that file since that defines a lot of version and device name variables. If you can attach yours or just diff the two that would give some strong confidence in them being the same or not.
[Fire TV General] zeroepoch:
I've finally had some time to put together a new thread for rooting here, http://xdaforums.com/fire-tv/general/root-amazon-fire-tv-gen-2-4k-t3245407. Please move any further discussions regarding rooting the amazon fire tv 2 to that thread. It will make it easier to track and collaborate :)
[Fire TV General] kilumnati:
hey guys i recently bricked my firetv1 using KINGROOT, then using super sume, and now firetv is stuck on boot color logo, i ordered the E-MMC chip, waiting for it in the mail, want to ask is how do i get it back to rooted or even non rooted as i just want it to boot again. what do i flash to it. it was on frimware 5.0.5 and its non rooted now as i still can ADB to it for a while before it reboots after like 5 min. please help thanks..
[Fire TV General] superkoal:
Tried this?

http://www.aftvnews.com/how-to-unbrick-by-entering-recovery-mode-and-factory-reset-the-amazon-fire-tv/
[Fire TV General] kilumnati:
yes i have i get to this screen thats it..

http://imgur.com/xsPvta0
[Fire TV General] papars:
Does this method works with 5.0.5?

Any suggestion of a linux LiveCD I can use, since all my PCs run windows?
[Fire TV General] superkoal:
You can use kingroot for 5.0.5.

I booted Ubuntu from a Flash drive.
[Fire TV General] papars:
I hate kingroot and what it does to the system files. I have bad experience with this and some mobile phones. It does root but ...

Unless there is another way, say to root by kingroot and then flash an image with supersu ...

In any case I have the emmc adaptor so I can hardware root, thus I wonder if there is a change in the procedure in the latest s/w versions.
[Fire TV General] CrashInc:
Can anyone help??

Hi can anyone confirm if this still works on AFTV 5.0.5.1?

I only ask as I have done this before on an older firmware however when trying to gain root access on newer FW I have no luck?

The SU file is in the xbin folder and can even be seen from es file explorer but still no root?

I have tried this about 9 times today following different guides, different versions of SU and it still just doesn't work.

Any help from anyone would be greatly appreciated.
[Fire TV General] xafsinut:
Still works ?

Hi,

Also interested in knowing if still works ?

Thanks,

Xafs
[Fire TV General] pwntrik:
Will this work...

dd if=/dev/sdb20 of=system.img

Then later do the inverse?

About to solder again. I'd love to just take my TWRP backup or at least your prerooted image and use dd, rather than deal with setting up a custom recovery.
[Fire TV General] walkabouts:
Does anyone know if its possible to reflash the emmc, in order to recover a bricked fire TV 1, that is in Qualcomm qdloader 9008 state (in this state I have no access to fastboot, recovery, adb, or even the partitions). Thanks!
[Fire TV General] maleclub:
i am sure that the electrical current wich comes from the reader (pc) is to low
[Fire TV General] fifo209:
So I just opened my fire TV 4K and my chips look different then the one in the guid. Any idea where to solder wires for the 4K version? The one I have has the MediaTek chip along side 2 Elpida RAM chips under the main shield and my eMMC has a diff "R" arey between it and the main shield :confused: Anyone know where to solder the wires on this?

https://ibb.co/bsW3Sa
[Fire TV General] elektrinis:
Anyone tried to get away without level converter? I mean add a series resistor, like 1k, on all data lines? This is sometimes used as lever converter, as 3.3V receiver will still accept 1.8V as logic one, and 1.8V receiver will clamp 3.3V signal on internal diode.

Would this work?
[Fire TV General] unforsaken:
I'll keep watching this topic for the answer to this as well. I'm also interested in doing to this to my FTV2.

Let me know if you found any information.

Thanks
[Fire TV General] rdpdo:
Hello all,

I am from France and I use a Fire TV Basic edition.

I will unsolder the BGA eMMC to get pinout and do a hardware rooting.

Can I use the root files for v1 or v2 on the FireTV bsic edition ?

Thanks !
[Fire TV General] iLLNiSS:
Did you ever lift the BGA to check pinout? I have a post with what I believe to be are the schematics of the chip (https://xdaforums.com/showpost.php?p=74681052&postcount=5) if you were looking to find the CMD/CLK/RST/DAT[0-7]/VCC/VSS pads elsewhere on the board.
[Fire TV General] dzebrys:
this emmc chip support both 3.3v and 1.8v on vccq so this should be doable. probably the 1.8v rail on MB is the problem and one need to find out how to disconnect chip from it without desoldering it. anybody tried to desolder also single resistor connecting CMD with vccq? btw. TP105 (on the other side of mb) is another point with emmc CLK out.
[Fire TV General] dreamdealer:
found this linkhttps://shop.exploitee.rs but few years old now, anyone know how I can get a Low Voltage eMMC Adapter (Fully Assembled) or something similar as I want to have a crack at rooting my amazon fire tv stick gen 1 for fun.. thanks
[Fire TV General] MasterCATZ:
anyone know of a way to access galaxy note 4 emmc ? or know how to force it to boot from sdcard

---------- Post added at 05:51 PM ---------- Previous post was at 05:41 PM ----------

https://youtu.be/l-6Oo5bDJ4M?t=193

interesting pinout for a galaxy note 4 emmc
[Fire TV General] snebojsa:
Hello,

my AFTV is bricked and I was trying to revive it with this hardware method.

Soldered everything like it should but have errors.

I was trying to find help in this thread: https://xdaforums.com/fire-tv/development/prerooted-stock-images-t2882337/page138

but we are stuck at

dd: failed to open '/dev/disk/by-partlabel/system': Read-only file system

I managed to backup the system but the file system is R/O and cannot write anything so can't write new files to revive the box.

Is anybody can try to help me with this?

Much more details is in that thread I mentioned.

Thanks.
[Fire TV General] K5MOB:
Is this still a valid method?

I have purchased two Gen2 boxes from eBay and both have issues, one just has a black screen and the other boots to the amazon colorful logo then gets stuck. If you put a SD card in the second one it will come up to a scree that has configuring then when it reboots it hangs at the colorful amazon logo again. I told the seller about it and they just refunded my money and said keep the boxes..

I do board level electronics work so the soldering is no issue.. I just want to be sure nothing has killed this processes.
[Fire TV General] dzebrys:
have u done basic

>mount -o rw,remount /system

?
[Fire TV General] stehohrhase:
Hi Guys,

I found this all threat and I tried to root my FireTV1 without luck.

Software-Version: Fire OS 5.2.7.3 (652613820)

Fire TV-Start: 6200199.1

What I did:

All in the tutorial I did with success:

Also the ls -l !$ is I red, like shown in the video.

""

We now mount the volume as read/write, copy the SU binary to the XBIN folder and set the correct permissions. Run from terminal.

dmesg | tail

mount

sudo su

cp /pathtosu/su //xbinvolumename/xbin/su

chown 0:0 /xbinvolumename/xbin/su

chmod 6755 !$

ls -l !$ (Check result)

exit

exit

The SU binary is now on the XBIN folder. De-solder your wires from the FireTV. Replace the resistor you removed with a piece of wire (easy) or the actual resistor if you prefer. Reassemble the FireTV and plug her in!

Your FireTV is now rooted.

""

SU i have used armv7. Is this correct ?

When I start the SuperSU (installed APK) nothing happened. Only short flashing of the icon in the gui.

Connect with ADB Shell, says unknown command.

ls shows:

shell@bueller:/system/xbin $ ls

dexdump

sqlite3

su

tcpdump

trapz

vitals_collection_agent

ls -l shows :

shell@bueller:/system/xbin $ ls -l

-rwxr-xr-x root shell 63880 2020-04-07 01:39 dexdump

-rwxr-xr-x root shell 49816 2020-04-07 01:39 sqlite3

lstat './su' failed: Permission denied

-rwxr-xr-x root shell 813248 2020-04-07 01:39 tcpdump

-rwxr-xr-x root shell 9384 2020-04-07 01:39 trapz

-rwxr-xr-x root shell 50580 2020-04-07 01:39 vitals_collection_agent

What I did wrong ? Somebody can help please ?

BR

stehohrhase
[Fire TV General] Sus_i:
The guide is outdated. It isn't enough to copy su over to xbin, since you need to deal with selinux...

Take a look into the update-script of a prerooted rom, there you can see what you need to do:

ui_print("Installing recovery...");
package_extract_dir("recovery", "/system/recovery");
set_metadata_recursive("/system/recovery", "uid", 0, "gid", 0, "dmode", 0755, "fmode", 0755, "capabilities", 0x0);
rename("/system/bin/e2fsck", "/system/bin/e2fsck.real");
symlink("../recovery/2ndinitstub", "/system/bin/e2fsck");
delete("/system/recovery/recovery.img");
package_extract_file("recovery/recovery.img", "/dev/block/platform/msm_sdcc.1/by-name/recovery");
ui_print("Installing SuperSU...");
package_extract_file("su/su", "/system/xbin/su");
set_metadata("/system/xbin/su", "uid", 0, "gid", 0, "mode", 0755, "capabilities", 0x0);
symlink("su", "/system/xbin/daemonsu");
package_extract_file("su/supolicy", "/system/xbin/supolicy");
set_metadata("/system/xbin/supolicy", "uid", 0, "gid", 0, "mode", 0755, "capabilities", 0x0);
package_extract_file("su/libsupol.so", "/system/lib/libsupol.so");
set_metadata("/system/lib/libsupol.so", "uid", 0, "gid", 0, "mode", 0644, "capabilities", 0x0);
package_extract_dir("su/SuperSU", "/system/app");
set_metadata("/system/app/SuperSU.apk", "uid", 0, "gid", 0, "mode", 0755, "capabilities", 0x0);
unmount("/system");

It installs a ramdisk with twrp, the other stuff is necessary to get su working... You find all files in a prerooted rom from here:

https://xdaforums.com/t/firetv-1-bueller-prerooted-stock-images-5-2-7-3_r1.2882337/

I hope the cables are still on the box ;) Good luck :)
[Fire TV General] stehohrhase:
thx, i will try and give feedback...
[Fire TV General] Antelope8811:
I have just tried @Sus_i ’s method with my FireTV Stick (montoya) with the files from here, but unfortunately it doesn’t seem to work.

I get the same issues as @stehohrhase, however not only with su, but also with daemonsu and supolicy.

If I understood this correctly, some additional change is necessary such that daemonsu is started as root during bootup, which is probably the missing part.

For now I am trying to work around this issue by proxying /system/bin/btremoted such that it first sets SELinux to permissive, then starts daemonsu and finally the real btremoted …