yashsingh1/xdaforums huggingface dataset:
[Fire TV Android Development] rbox:
It's nothing to do with the boot or recovery img. When you reboot it never shows the Amazon logo which means it's a bootloader thing. If you want to try something you could try flashing sbl1,sbl2,sbl3,tz,rpm,NON-HLOS(modem partition). I've already done that and nothing worked. But that was after the reboot. You could also flash emmc_appsboot to aboot. But then you'll need to flash boot.img also so it's got a signed kernel.
[Fire TV Android Development] Kramar111:
[MENTION=3991724]rbox[/MENTION]

please take a look http://xdaforums.com/droid-ultra/general/droid-ultra-maxx-brick-recovery-t2830806
[Fire TV Android Development] onlinespending:
hey rbox, just sent you a 10 spot to help with your efforts. Your work is much appreciated. Out of curiosity, I'm assuming these pre-rooted stock images have the auto-update disabled?
[Fire TV Android Development] rbox:
Yeah, I saw a few posts like that last night. I believe those are more for if one of the boot partitions is corrupt. The update didn't touch any of those and in the dload mode I can reflash them all I like. It's still refusing to boot for some reason, which makes me think it's some kind of a fuse setting.

Thanks to you and everyone else. I'm probably going to pick a new one up tomorrow if I can't get anything working tonight. No, auto update isn't disabled per se, but if it downloads and update and reboots into CWM, it'll just sit there and do nothing because I disabled the automatic feature in it.
[Fire TV Android Development] to0:
Just shot you a donation as well to help with the new device. Still hopeful that you can revive the bricked one.

Thanks for all of the hard work you've done on this thing.
[Fire TV Android Development] cd2022:
Sent you few clams to help with the new box. Good luck!
[Fire TV Android Development] drumst1x:
Hey rbox, again thx for all the work on the aftv.

Two questions:

1) if you get a new one, how do u intend to get a rootable one? Arent all the new ones coming already upsated to an unrootable one?

2) not that i would want to try this, but if one were to take an ota update, and it rebootes into cwm, how would one go about flashing it? Install/update and browse to find wherever it downloaded to?

You are awesome. :)
[Fire TV Android Development] rbox:
There are 2 protections in CWM. One is that I disable the auto flashing that they use for OTA. And the other is to make their update zips unusable. They are put in /cache, so you can't navigate there, you can only flash something manually from /sdcard. Second, their updater-script files checks a timestamp to make sure you don't downgrade, and I've modified my properties in a such a way that the check will always fail. If you were to make a stock OTA file, manually download it, remove the assert for the timestamp, and then flash it with CWM, theres a 95% chance it will work and it'll flash the update. Of course it'll blow away your root and you'll never be able to downgrade it. I don't know what would happen with recovery. It would *probably* flash stock recovery on it. But not sure.
[Fire TV Android Development] AQKhanTheOne:
[MENTION=3991724]rbox[/MENTION]

Is it likely that Amazon is putting their foot down and telling those of us who have root, to choose between staying with root and never updating the fw again or to be punished for daring to go against their diktat? Is it possible that they've put code into the new version to essentially make the boxes self-destruct by triggering the efuses if root and or a different recovery is detected?
[Fire TV Android Development] rbox:
Yes, I think it is the fuse, but I don't know what triggered it. It could have been something in /system or it could have been the kernel.
[Fire TV Android Development] mastafunk:
Definitely a sad situation for me.. i really do love my firetv but not enough to shell out $ for it again.. so many other options now in a similar price range. sux cause its running so great and will stop working first time the power flickers :(
[Fire TV Android Development] nhumber:
i hear ya, i think ill be jumping to a rk3288 device, they are pretty high end and should be more fun to mess around with, some linux support and all. so 24p output is possible.. bummer we bricked but what can ya do about it.. not about to risk getting a non rootable fireTV. hopefully we can bring it back to life one day..
[Fire TV Android Development] deepasadish:
If it is indeed a fuse, I guess we just have to stick with this version, or go about having cyanogenmod or something.

I hope for the latter and also to be able to unbrick.
[Fire TV Android Development] mastafunk:
[MENTION=3991724]rbox[/MENTION] what did the partial BL unlock do? Can it be reversed? Want to try to get back to as close to stock as possible before reboot in hopes whatever happens hasn't happened yet and perhaps I can avoid it..
[Fire TV Android Development] to0:
Hey guys, this is getting a bit off topic, but if you paid for your original FTV with a credit card, you might check if you have purchase protection. Most credit cards come with a big list of benefits that most people aren't even aware of--things like you can be reimbursed for an item that was broken or stolen that you purchased within the last X days. Wells Fargo Visas include cell phone insurance up to $600 for any phone on your plan so long as you pay your bill with the card; I used that when my buddy dropped my Nexus 5 and broke it and it was very hassle free. Worth looking into.

rbox, could you see that download mode helping to root newer devices, or does it look like the only way to get into it is to flip the fuse?
[Fire TV Android Development] rbox:
So funny story happened on my way to unbricking it. I managed to unbrick it. Only to brick it harder. It's looking definitely like a fuse. If I put 51.1.4.1's appsboot on it, that made it come alive. Only problem was, I forgot to write a signed kernel to the boot partition, so now it won't boot the kernel.

So for anyone who hasn't rebooted yet, to save it, all you need to do is dd all the mbn and NON-HLOS files from the 51.1.4.1 update onto their appropriate spots. Making sure to also dd a stock recovery image and the boot.img from the update. For anyone that HAS, if you have a USB A to A and a linux box, you can do the same thing.
[Fire TV Android Development] rbox:
My post above this says what to do.

I've talked to some people and no one knows of a way to force it in to that mode.
[Fire TV Android Development] mastafunk:
Could you be a lil more specific with instructions... can we go back to a rootable image this way? Ive never messed with those partitions before..
[Fire TV Android Development] rbox:
You won't lose root, but you'll loose CWM and if you take another update, you'll lose root.

basically you have to copy all those images to the firetv,then su in adb shell and, dd if=sb1.mbn of=/dev/block/platform/something/something/sbl1 for each of the mbn files and then NON-HLOS.bin goes to the modem file. and emmc_appsboot.mbn to aboot, and boot.img to boot
[Fire TV Android Development] nhumber:
ok so im hoping to get to this tomorrow after work, but i need to make sure i do it right, this will put me back at stock firmware and stock recovery?, will i still have root since su is already there?

i can ADB into the box in its current state?
[Fire TV Android Development] mastafunk:
k thats what i figured... Thanks you so much will report back and let ya know how it went...
[Fire TV Android Development] rbox:
Oh I forgot about recovery... you need to download a stock recovery from aftvnews and dd that to the recovery partition. You'll still have root as long as you don't update.
[Fire TV Android Development] mastafunk:
how do i get a list of the by-name partitions want to be sure im doing it right.. are they the same name as xxxx.mbn?

Im guessing we want the newer recovery?

EDIT got the partition list
[Fire TV Android Development] nhumber:
ok stock recovery hasnt changed at all over the updates? ill gather all the files and get the process figured out and then ill post it here and maybe you can give me a yes or no if you think it looks good.

Thanks a bunch Rbox.

Mastafunk, if you can wait i will do it first and if it works then i can walk you through it if you need me to tomorrow night.
[Fire TV Android Development] mastafunk:
If your allready bricked youll need a USB A/A cable and a linux box.
[Fire TV Android Development] nhumber:
ill make a cable and run fedora on a extra drive in my PC..

Rbox, i see recovery had been updated once, which do i use 51.1.3.0_user_513011520 recovery or the first version? or is there a new version in this update we dont know about?

if it would work with the first recovery maybe we could downgrade after this is all said and done.. lol
[Fire TV Android Development] mastafunk:
So i dd'd sbl1,sbl2,sbl3, NON-HLOS.bin to modem, emmc_appsboot.mbn to aboot, boot.img to boot, and a stock recovery to recovery.

Reboot and the box is bricked.. dont have an A/A cable.. is it straight through wired?
[Fire TV Android Development] nhumber:
what about tz.mbn?
[Fire TV Android Development] mastafunk:
doh!
[Fire TV Android Development] rbox:
Are you getting the amazon logo or a black screen? If you get the logo, its dead. If you are getting the black screen, you can usb it. It's a straight A to A. Did you forget tz and rpm? Also, you used the images from 51.1.4.1 right?
[Fire TV Android Development] nhumber:
so you just did this over ethernet? adb pushed and then dd'd im taking it?

and which recovery do i use?
[Fire TV Android Development] rbox:
Yes, if you used the original stock recovery it would allow downgrade, but we would still be back to where we are. Downgrading would flash back the old firmware, and it won't boot with that.

Any recovery should work I think.
[Fire TV Android Development] nhumber:
ok right, fuse is flipped.. we f'd for now.. lol

ok im going to give er a go give me 5 minutes.. any last things to remember?
[Fire TV Android Development] mastafunk:
Yes forgot tz and rpm, no logo shows up in dmesg i built a cable...

usb 1-1: new high-speed USB device number 8 using ehci-pci

[112175.357504] usb 1-1: New USB device found, idVendor=05c6, idProduct=9008

[112175.357515] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0

[112175.357522] usb 1-1: Product: QHSUSB_DLOAD

[112175.357528] usb 1-1: Manufacturer: Qualcomm CDMA Technologies MSM

[112175.357970] qcserial 1-1:1.0: Qualcomm USB modem converter detected

[112175.358138] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB0

How do i flash the last two from linux?

---------- Post added at 12:07 AM ---------- Previous post was at 12:06 AM ----------

Yes i was still running never did the reboot, pushed the files over adb and dd'd..
[Fire TV Android Development] rbox:
It should show up as a /dev/sd something device. For me it was /dev/sdb. https://github.com/freedreno/freedreno/wiki/FireTV has the partition numbers. You should have seen a ton of extra stuff more than that. Although it looks like qcserial is claiming the device. For me usb mass storage was claiming it. A quick and drity is to unplug it, rmmod qcserial, delete the qcserial.ko from /lib/modules and plug it back in. mass storage should claim it then.
[Fire TV Android Development] mastafunk:
Still not getting a disk from it.. :(

removed the qcserial module then it detected as zte_ev, removed that and i just get..

[113796.146782] usb 1-1: new high-speed USB device number 11 using ehci-pci

[113796.279627] usb 1-1: New USB device found, idVendor=05c6, idProduct=9008

[113796.279638] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0

[113796.279645] usb 1-1: Product: QHSUSB_DLOAD

[113796.279651] usb 1-1: Manufacturer: Qualcomm CDMA Technologies MSM
[Fire TV Android Development] rbox:
What if you manually run modprobe usb-storage.

Also, if you do finally get it mounting, I forget if I said this. Make sure you unmount everythign and run sync like 3 times before unplugging it.
[Fire TV Android Development] mastafunk:
Still a no go.. i think its in a different mode.. or my cable is crap.. Good news is there are lots of tools for interfacing with qcserial so that may be a route.. im gonna have to get unlazy on this.
[Fire TV Android Development] rbox:
Yeah, I dunno. I would get this:

usb 2-1.3: config 1 has no interface number 1

usb 2-1.3: New USB device found, idVendor=05c6, idProduct=9006

usb 2-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3

usb 2-1.3: Product: QHSUSB_DLOAD

usb 2-1.3: Manufacturer: Qualcomm CDMA Technologies MSM

usb 2-1.3: SerialNumber: 1234567890ABCDEF

usb-storage 2-1.3:1.20: USB Mass Storage device detected

And then it would enumerate the drive. Although if you notice my idProduct is 9006 and yous is 9008.
[Fire TV Android Development] mastafunk:
Im close to figuring out how to repair it in modem mode.. Two things are needed, a MPRG and a partition offset file.

I need a pt.bin file with offsets the instructions are saying to get the source file like this...

adb shell dd if=/dev/block/mmcblk0 of=/sdcard/pt.bin bs=1024 count=10

then run it through a script to format it for my purposes.. any chance anyone with a working unit could do that? I need the resulting pt.bin from the above command..

EDIT

PLEASE CAN SOMEONE HELP ME !!!
[Fire TV Android Development] Kramar111:
[MENTION=4240355]mastafunk[/MENTION]

Thanks to Billard from 4pda.ru

(dd if=/dev/block/mmcblk0 of=/sdcard/pt.bin bs=1024 count=17)
[Fire TV Android Development] mastafunk:
Thanks!
[Fire TV Android Development] nhumber:
Going to be hard to get a dd of that from the current firmware isn't it? Dd only runs under root iirc.

The old firmware tho.. I can do it from another box I can go borrow, tonight if I have time or Monday when I'm off work again.

So no luck with getting tz and rpm in there?
[Fire TV Android Development] deepasadish:
damn it amazon - you are supposed to release all sources and keep it open. not lock it down! LOL!

btw, since rbox's bootmenu allows to get into recovery under any circumstance, amazon must be doing something to prevent from getting into that menu? unbelievable! will amazon really go to that extent? or is this just a simple bug/oversight. i hope it is the latter and and especially one that can be fixed.
[Fire TV Android Development] rbox:
He needs just the partition layout. That never changes. So all boxes are the same.

No, not really. All they have to do is provide sources for GPL things, like the kernel. Unfortunately, it looks like even there they don't fully comply.

As for what they did... I'm not sure where it was, either in the new kernel or something in /system, but when it booted the build, it caused it to blow an efuse in the processor. That made it so the old bootloader wouldn't boot anymore. Since the bootloader wasn't loading, it wasn't even starting bootmenu. They went out of their way to blow the fuse. And upon inspection of the sbl3 from 51.1.4.1, they included anti-rollback code in it to prevent you from doing downgrades as well.
[Fire TV Android Development] rbox:
So to keep everyone updated... I just got back from Staples and I'm about to set it up and (hopefully) root it. Before I got started I took another look at the 51.1.4.1 software and I found exactly how they bricked it, and as I suspected, they blew a fuse. I guess I have to examine the kernel every time now. The good news is I'm sure once I remove the new addition, 51.1.4.1 will work like a champ. As a sidenote. If anyone has a box that is not rooted and has been updated to 51.1.4.1, can you please PM. I would like you to run some commands for me. Thanks.
[Fire TV Android Development] nhumber:
So basically they won? Every box is stuck on old firmware or stock. or do u think whatever they did is circumventable. Or is it too risky to even test now? If I can get unbricked at least we'll have a risky option to fix. I hope we don't see a required firmware version for amazon core apps to function next.. Is that even possible?

Nm your above post explains it all. Thanks
[Fire TV Android Development] deepasadish:
this is great news rbox. this is one of the reasons why I want to completely ditch amazon software and go with open source alternatives like cyanogenmod (if available/possible ofcourse).

even a old 4.2 android that boots and connects to playstore is >>>>(million times)>>>> amazon OS.
[Fire TV Android Development] rbox:
I think I'm going to have some time off work in December, so I may try getting an AOSP build going again.
[Fire TV Android Development] rbox:
So yeah, looks like this unit was so old it shipped with the original firmware. It did the forced update to 51.1.0.2 and now that's where it's at. I don't even have to downgrade or anything, haha.
[Fire TV Android Development] mastafunk:
So just a quick update. It is possible to write partitions while the device is in "radio" mode. Several phones that use similar chipsets and even a few devices with the same chip.. "APQ8064T" have been unbricked this way. You need two things a MPRGxxxx.bin and a partitions.txt from your device. Well Ive got an MPRG8064.bin and a partitions.txt now but i am still unable to proceed.

From my limited reading the MPRG.bin file is a modem programming "payload" which is signed and device specific . This payload when send with the partitions.txt tells the device you want to expect a payload and to write the various partitions outlined in the .txt file. This .bin file for other devices has been sourced from official/Leaked "fastboot restore images" .

So if anyone has any clue how to go about finding this for our device It would be very usefull..

Was there a JTAG thread.. the only one i found here did not show any success.. Going to look into that as well..
[Fire TV Android Development] Skater4599:
That's great news rbox, I'm glad you were able to get another rootable device, going to donate for your efforts ASAP as well... you deserve it.

On a side note, i just went to staples and two extra fire TV's. Both rootable same exact thing! :D
[Fire TV Android Development] rbox:
I just updated the OP with a fixed 51.1.4.1. I've been using it for about an hour and have rebooted many times and everything seems fine. Now that I know what they did, I will know what to look for in the future.

Make sure you read the OP with the extra notes on bootmenu and making sure you have 51.1.4.0 beforehand.

I would like to also give a big thanks to everyone who has donated to me. Very thankful.
[Fire TV Android Development] t3ch42:
I didn't update to the previous image that was taken down, but had a question regarding the firetv you had trouble with.

Were you able to fix that one to get it out of the limbo it was in or is that to be continued at a later date?

Thanks again for the hard work. Your setbacks help us all out. I hope that we can all help you out with some pizza/beer/device money;) to help offset your time involved.
[Fire TV Android Development] kbrabble:
Thanks for getting this all figured out. I installed the update, and have rebooted several times. Everything works great.
[Fire TV Android Development] AQKhanTheOne:
It's great that rbox has figured out what to do to get around this spiteful attack by Amazon to punish those who dared to root and use the box for things outside of its ecosystem, but the writing is on the wall. They will continue doing this. Who knows what landmines the next update might include?

I'll keep my firetv for now just because I'm a longtime Prime member and happen to like some of the offerings, but I do like the ability to do other stuff with the box as well. However, it's clear that Amazon wants to deny this to me, and so at some point I'll be looking at something else and maybe in the process look for an alternative to Amazon itself.
[Fire TV Android Development] deepasadish:
rbox: can you provide a brief summary of what evil amazon did. i really want to post something on amazon's facebook page.

it is one thing to simply not provide warranty (after all we knew that), but is a completely evil matter to deliberately brick a device just because we found another use for it!
[Fire TV Android Development] Y314K:
If this ever happens to me.. I hope Amazon/Staples/BestBuy enjoys getting returns of Bricked devices... I would buy one cash & as long as they are not tracking serial numbers or even if they are. I would just return the brick device as a defective unit. You just have to keep all the packaging for the return on the old units. For a long time... THAT IS MY eFUSE!!!
[Fire TV Android Development] rbox:
Yes and no. I was able to get it to start booting, but unfortunately I had forgotten to copy a signed kernel, so it is bricked pretty hard now. Maybe one day someone will figure out how to write the mmc, and then i'll be able to write a good kernel to it. But unfortunately, it will never be able to get updated.

That's why I got it... for prime.

From what I can tell, they did 2 things. First, they added an extra service to the kernel ramdisk that blows an efuse which prevents the old bootloader from working. Second, they modified the bootchain to use that fuse (or maybe a second, I'm not sure) to prevent downgrades. So once a box gets 51.1.4.1 stock, it can never be downgraded. But it's going to be tricky from now on. So I'll have to be more careful.
[Fire TV Android Development] dillfever:
so will your 51.1.4.1-fixed rom still be able to downgrade if needed?? dill
[Fire TV Android Development] rbox:
Yes. Only stock 51.1.4.1 has the protections. My rooted roms don't.
[Fire TV Android Development] Kramar111:
Please help with bricked FireTV

[MENTION=3991724]rbox[/MENTION]

I have bueller-51.1.4.1_514013920-rooted (+ Partial Bootloader Unlock + Boot Menu 1.0 + CWM Recovery 6.0.5.1.4a)

in QHSUSB_DLOAD 9006 state

USB A-A cable

Windows 8.1 with installed QHSUSB_DLOAD driver

Ubuntu 14.10

Also have:

FireTV_bricked.img (win32diskimager) 7 818 182 656 b

CWM recovery backup (51.1.3.0 092714)

pt.bin -> partitions.txt

MPRG8064.bin (not sure about it's for FireTV)

Can i flash bueller-ota-51.1.0.2_user_510058520-signed + recovery-stock-51.1.0.img or bueller-ota-51.1.4.1_user_514013920-signed + recovery-stock-51.1.3.0.img

accordingly to PARTITION-MAP

like this

dd if=boot.img of=/dev/sdc10
dd if=sbl3.mbn of=/dev/sdc6
dd if=sbl2.mbn of=/dev/sdc5
dd if=sbl1.mbn of=/dev/sdc4
dd if=tz.mbn of=/dev/sdc7
dd if=splash480p.img of=/dev/sdc13
dd if=splash1080p.img of=/dev/sdc15
dd if=emmc_appsboot.mbn of=/dev/sdc9
dd if=splash720p.img of=/dev/sdc14
dd if=NON-HLOS.bin of=/dev/sdc3
dd if=rpm.mbn of=/dev/sdc8
dd if=recovery-stock-51.1.0.img of=/dev/sdc11
or
dd if=recovery-stock-51.1.3.0.img of=/dev/sdc11

Do i need automount off in Ubuntu or just unmount?

If something goes wrong :) can i restore FireTV to current state thru FireTV_bricked.img (win32diskimager)?

Or i will brick it completely?

Thanks
[Fire TV Android Development] nhumber:
Your steps are exactly what I'm going to do to try and save it but I was going to skip the splaah screen partitions. According to rbox you look like u have it all.. Just run sync to make sure all the data is transfered and then unmount. Hopefully it works.. His booted but to a non signed kernel so it's bricked harder now. I think it'll work, rbox sounded confident. I was going to use the newer recovery also 5.1.1.3.0.good luck
[Fire TV Android Development] drumst1x:
Rbox, very impressed with your skill and perserverence! Thanks for keeping us updated to the latest version :). I havent updated yet, but will soon. Do we even know what is new in this version? I guess i can always check aftvnews for that.

Quick (slightly off topic) question - you mentioned a forced update to a (still rootable) firmware. How was it forced? My cousin loves my aftv setup but i keep saying he wont have usb hd support if he gets one now (comes unrootable). From what you are saying, sounds like staples may still have older stock, so i might still be able to hook him up. If i am blocking domains on my router, is that sufficient to keep the aftv rootable (assuming i am able to get a rootable version in the first place)?

Thanks!!!