yashsingh1/xdaforums huggingface dataset:
[Fire TV General] derpeter:
I'm note aware of any online available dump but as soon as you are root you see all parititions and the device itself which seems to be identical to what you get by connecting right to the emmc. This is the parition table

recovery filesystem table
=========================
0 /tmp ramdisk (null) (null) 0
1 /modem emmc /dev/block/platform/msm_sdcc.1/by-name/modem (null) 0
2 /sbl1 emmc /dev/block/platform/msm_sdcc.1/by-name/sbl1 (null) 0
3 /sbl2 emmc /dev/block/platform/msm_sdcc.1/by-name/sbl2 (null) 0
4 /sbl3 emmc /dev/block/platform/msm_sdcc.1/by-name/sbl3 (null) 0
5 /tz emmc /dev/block/platform/msm_sdcc.1/by-name/tz (null) 0
6 /rpm emmc /dev/block/platform/msm_sdcc.1/by-name/rpm (null) 0
7 /aboot emmc /dev/block/platform/msm_sdcc.1/by-name/aboot (null) 0
8 /boot emmc /dev/block/platform/msm_sdcc.1/by-name/boot (null) 0
9 /recovery emmc /dev/block/platform/msm_sdcc.1/by-name/recovery (null) 0
10 /splash480p emmc /dev/block/platform/msm_sdcc.1/by-name/splash480p (null) 0
11 /splash720p emmc /dev/block/platform/msm_sdcc.1/by-name/splash720p (null) 0
12 /splash1080p emmc /dev/block/platform/msm_sdcc.1/by-name/splash1080p (null) 0
13 /system ext4 /dev/block/platform/msm_sdcc.1/by-name/system (null) 0
14 /cache ext4 /dev/block/platform/msm_sdcc.1/by-name/cache (null) 0
15 /data ext4 /dev/block/platform/msm_sdcc.1/by-name/userdata (null) -16384
16 /misc emmc /dev/block/platform/msm_sdcc.1/by-name/misc (null) 0
17 /sdcard vfat /dev/block/mmcblk1p1 /dev/block/mmcblk1 0
18 /persist ext4 /dev/block/platform/msm_sdcc.1/by-name/persist (null) 0
19 /goldpersist ext4 /dev/block/platform/msm_sdcc.1/by-name/goldpersist (null) 0

sbl and aboot could be targets to ida pro the rest should also be included in some of the firmware updates.

TZ could be the code running inside the trust zone. In both cases we will probably end up with arm assambler code which is no fun

to read.

Do you got some special things you a looking for?

A much lower hanging fruit could be to get some knowledge of rboxes aftv-unlock. I would love to know what it does and why this not affect new bootloader versions. On other qualcomm platforms we have seen bootloader unlocks that use a efuse that tells the bootloader that the device is oem unlocked or similar. But this should persist a bootloader upgrade so something different seems to be used here.

Assumed that signature checking for all stages is intact we can't alter the binarys. So either code execution in one of the stages or another signature checking bug would be nice. As we are in the lucky position of having full access to the emmc which seems to hold all stages of the secure boot there might be some attack vectors. Simply writing a older version of one the loaders on the other hand is very unlikely to work.
[Fire TV General] rbox:
It's a bug in the older bootloader that was fixed.
[Fire TV General] derpeter:
Are you talking about CVE-2014-0973 ? So we are not talking about a unlock in the normal meaning of the word?

EDIT: i gues its basicly this? http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html
[Fire TV General] rbox:
No, the unlock isn't a CVE. It's just a stupid bug on Amazon's part. The original recovery without unlock was a cve though.
[Fire TV General] raider0:
uk needing root

Hi is there anyone in the uk willing to root my aftv, i will pay all costs asociated with this, if you are up for it can you send p.m. Thank you Ben.
[Fire TV General] derpeter:
Do you mind sharing some details? As the bug is seems to be fixed there should be no reason to hide it anymore.

I was looking for the aboot source but amazon seems not to provide it (which they don't need to as its not GPL).

The best source i found is https://www.codeaurora.org/cgit/quic/la/kernel/lk/tree/app/aboot/aboot.c?id=refs/heads/eclair .

I'm not sure how close the is to the qualcomm / amazon aboot but it maybe a start to search for another bug.
[Fire TV General] dabbler77:
I hope some one can help please, I have soldered and triple checked all connections between the firetv and emac adaptor. Ive shortened the wire to maybe 4-5cm's, here is what happens:

Im using the internal SD Reader on a MAC, booting into ubuntu via USB stick.

1 - Plug in adaptor, connect firetv power supply

2 - Blue light on adaptor comes on

3 - Do a dmesg | tail

4 - No ext4 partitions are listed (none from the SD Card)

I get mmc0: Timeout waiting for hardware interrupt.

Using an external SD Reader, I the SD Interface is listed, but when typing mount I see no ext4 partitions.

Doing the above but from OS X, the blue light blinks rapidly on the adaptor and then goes off.

My linux skills are rather lacking, i hope its my lack of knowledge, can any one help point me in the right direction please? Could it be the SD Card reader?

Many thanks in advance
[Fire TV General] aHcVolle:
Since the sdcard reader has to be able to use a special protocol and the guys from gtvhacks explicit say that they had the best results with a certain sdcard reader I ordered exactly this reader and it was working fine.

Maybe you should order this reader too...

Chris
[Fire TV General] dabbler77:
Ive ordered the recommended Transcend one, fingers crossed this will resolve the issue. Im in the "have i broken it panic stage!)
[Fire TV General] papars:
Are there any window tools for this purpose?

Or perhaps OSX?

Any simple way to determine of the SD card reader can support the correct protocol?
[Fire TV General] YourNameInHere:
you need to be able to read and write to a EXT4-partition - so if there a drivers/software for Windows/OSX it should work.

Testing if your reader is able to speak 1-Bit-Mode (http://en.wikipedia.org/wiki/Secure_Digital#Transfer_modes) can be done

by using a normal sd-card and tape off the pin 1, 8 and 9 (so only pin 2 to 7 are connected).
[Fire TV General] derpeter:
I would recomment to NOT TRY IT with some ext driver on osx. You have already a flaky connection to the storage, you need all partition intact after you place the binary.

Any incompatibility in the driver on OSX or even Windows or other thinks these strange OSses do to to your storage like placing useless files in the Root of ever external storage

you connect can brik you firetv. I hardly recomment to make your self familliar with linux if plan to thinker on the AFTV.

I also test some reader in for 1bit mode with tapd SDcard (even MMC cards) which works, but than it didn't work with the AFTV. I also hab an optical identical trancend reader like

the gtvhackers but i dont work. I used a cheep reader sold bei HAMA in the end.
[Fire TV General] YourNameInHere:
totally agree - using non-native-supported filesystems by a OS can damage or corrupt it (yes i should write this warning next time - sorry :()!

Easiest way should be using a a live-cd/usb.

i got also very strange results while testing/rooting (no connection, read-only mode, etc). Looks like there is no guarantee but it's the only way i know to test it before soldering.
[Fire TV General] papars:
Thanks for the info.

Is there any linux live CD with all the tools needed to get this going? Unfortunately at home and office we use either windows or OSX.

How about an android phone/tablet? Would using the microSD slot work?
[Fire TV General] rubinho:
Pretty much all Linux versions have all the required tools included

Ubuntu, Debian, Fedora, Opensuse ......
[Fire TV General] superkoal:
Use your computer with ubuntu live on a usb drive, it event auto-mounts all partitions for you so you can easily find the system partition with the xbin folder. All necessary steps are listed on the ubuntu homepage.

Test your card reader with a taped sdcard first, my macbook pro didn't support 1-bit spi mode, so i had to use an older machine.

I don't recommend using an android device as file handling is quite complicated that way...

And you REALLY need to know what you are doing when soldering with such small smd components and pads.

I recommend a soldering tip of at most(!!!) 0.4 mm, very thin wires and calm hands...
[Fire TV General] papars:
I'm a capable technician, working on a repair shop. The hardware part is no problem. I'm bit worried about the software part.
[Fire TV General] superkoal:
The software part is the easy one. Just follow derPeter's blog post (see OP for link), then everything's fine!
[Fire TV General] dabbler77:
I am happy to report that it was the SD Reader causing all my problems :)

The Transcend one (recommended on the eMMC page) works fine, all EXT4 partitions are mounted. Thanks to all for the help and advice.

---------- Post added at 10:08 AM ---------- Previous post was at 09:24 AM ----------

When copying SU over to xbin, I get permission denied, as if its not mounted RW. Does any one have any tips please? Thanks!

---------- Post added at 10:13 AM ---------- Previous post was at 10:08 AM ----------

My silly mistake, all copied over, time to re-assemble and test :)

Edit: Root done, nice :)
[Fire TV General] TomParis01:
Do you have any tipps about how to desolder the 0-ohm-resistor? Probably I am too careful but I cannot remove it from the board :(
[Fire TV General] rubinho:
You have Post !
[Fire TV General] tolipwen:
OK so I'm trying to salvage my non-booting AFTV.

I'm suspecting that I may have damaged the R89 reisitor during re-/desoldering the CMD connection to the emm-reader.

[IMG="emmc-pinout"]https://www.exploitee.rs/images/e/e0/FireTVEMMCPinout.png[/IMG]

I'm measuring ~69kOhm. Can anyone confirm if this is correct or not? And if not, what is the correct value of the R89 resistor? Thanks!
[Fire TV General] derpeter:
Use a solder iron with a normal tip (not to small), hold it to the long side of the resistor, add solder until the resistor is covert.

The resistor will stick to the solder iron and you get a nice blob that you can toss into the cleaning sponge.

---------- Post added at 11:05 PM ---------- Previous post was at 11:04 PM ----------

EDIT: UPS wrong resistor
[Fire TV General] aHcVolle:
Wait he is talking about R89, that's not the 0ohm, that's besides the cmd line.

I have no idea where r89 is (I think on the other side of the board?) nor do I know it's value... But it's not the 0ohm you had to remove!
[Fire TV General] TomParis01:
Okay I got the 0-ohm-resistor desoldered. Now I face the problem that when I fire up the Fire TV and connect the reader, the blue light from the emmc-reader flashes shortly and stays off after that. I experience the same behaviour when no wire is connected to the reader but everything seems connected. Is there anything I can read out of that emmc-reader behaviour? Maybe a loose connection?

Is it right that when I fire up the Fire TV I see no reaction? The FireTV's LED does nothing? I got the SDDR-113 card reader and tomorrow I will try it with the Transcendent one but I have the feeling that it may be my soldering which is not quite perfect.
[Fire TV General] superkoal:
1st: yes, the firetv led won't light up as it doesn't boot

2nd: are you sure that your card reader supports 1bit SPI mode? because the one in my macbook doesn't and the behaviour was about what you described when i tried.
[Fire TV General] tolipwen:
Yes it's the resistor from the CMD-Line. Can someone who is in the process of rooting the AFTV measure the resistor? ...pretty please? :p
[Fire TV General] Zer0Blad3:
Is there anyone in the UK that would reflash a bricked FireTV at all? Thanks
[Fire TV General] :
Has anyone thought of trying a xecuter corona rw kit? I use it to rgh 360's with the emmc.
[Fire TV General] derpeter:
I only found this picture as far as i can tell from this picture it has only one transistor on it.

As we need to level shift 4 signals this will probably not work. I'm not in the 360 scene so i can only gues what it does. Can you provide some more details on this device?
[Fire TV General] :
I'm not to familiar with it and what all the components do. i know it has a pnp transistor. Its made to be a quick solder boars to read the emmc on a corona motherboard. I haven't ordered my aft yet. I checked the output last night and got 3.28v. The emmc on the Xbox will run off 1.8v or 3.3v. It seems like a cheap solution if it will work. Is there any way for me to test if it will work before receiving my aft?
[Fire TV General] tomatos666:
Hello,

i bougth it the Low Voltage eMMC Adapter.

Where i can visit the schematic from the Adapter?

What are with the connections VCC & VCCQ?
[Fire TV General] tolipwen:
You only need to connect CMD, GND, CLK and DAT0. The red ones in this image...

[IMG="Pinout"]https://www.exploitee.rs/images/e/e0/FireTVEMMCPinout.png[/IMG]

While you're at it. Could you maybe measure the R89 resistor (the one at the CMD solder point)
[Fire TV General] tomatos666:
Thanks for your answer!

But it´s possible to recieve the schematic. Becouse i will use the adapter for a other emmc.
[Fire TV General] TomParis01:
Just a short status update from my side:

I managed to gain root access thanks to you guys and the exploitee.rs Low Voltage Adaptor! Especially the blog post from derpeter was very detailed and useful :)

My main problem was in fact that my SDDR-113 card reader wasn't compatible to the adaptor. The Transcendent one worked like a charm :)

[MENTION=2705700]derpeter[/MENTION]: A few improvements for your blog:

1) Your guide links to the partial bootloader unlock file but there is already a full bootloader unlock. Maybe you want to include that one instead?

2) For the firetv boot menu, the linked file is named "firetv-bootmenu-1.0.img" but your guide points to /sdcard/bootmenu.img which is the wring filename.

3) At subpoint 3 ("Downgrade to stock firmware") you tell us to "rename the .img file you downloaded to update.zip". The stock firmware files are delivered as .bin files, not .img files. Renaming the downloaded .img file (namely the "firetv-bootmenu-1.0.img") would not be good ;)

Still thank you very much for your guide, derpeter, it as been a great help! Will there be another one when the FTV Stick comes out?

Beste Grüße aus dem Ruhrgebiet,

PatZy
[Fire TV General] aHcVolle:
I get a bunch of firetvs next week, I can measure the resistor for you. I think I should have the value by Tuesday.
[Fire TV General] superkoal:
If you want to get its real value you need to desolder it.
[Fire TV General] aHcVolle:
That's true but irrelevant... He wants to know what the value of the in system resistor to check if his resistor is still ok or burnt...
[Fire TV General] superkoal:
But the measured value in this case depends on the measuring instrument's voltage and impedance...

If you want to measure in-circuit anyways make sure that the aftv is not powered.
[Fire TV General] tolipwen:
That would be super awesome of you :p

Probably my last chance of turning that brick into a working piece of equipment...
[Fire TV General] aHcVolle:
9.6k in both directions
[Fire TV General] derpeter:
THX i was busy the last weeks and will update the blog as soon a have time to also do the full unlock my self.
[Fire TV General] I_did_it_just_tmrrow:
Is there anybody in germany or neighbor countrys who need "1 Low Voltage eMMC Adapter PCB with BOM components for the board. This item does not come assembled"?

One is untocuhed the other not but very good condition. I order 2 pc but I did not get the IC on the board :( No way for me, it too small.

Untouched exatcly like this one here:

[IMG="1 Low Voltage eMMC Adapter PCB with BOM components for the board. This item does not come assembled."]https://shop.exploitee.rs/images/LV_eMMC_PCB_Bare_With_BoM.jpg[/IMG]

The other one:

You got a picture if you need. But there is only some "lötzinn" on the pins for the IC-chip.

The plus for you:

The shipment is really fast from Germany to Germany or DACH/NL/CZ/FR.

I would be very happy if I can make another user here happy who is able to get the IC on that board. Write me a pm.

Greetings by I_did_it_just_tmrrow
[Fire TV General] boldfilter:
Any chance of these guys starting a service where one could send said unrooted unit to someone with the skills, tools, and know how for x amount of dollars and sending your rooted unit back?
[Fire TV General] Aquifel:
Seconded, i would be down with that. Although, i need it for the fire tv stick and, as far as i'm aware, i don't think even this method works (NOTE: I did not read the entire thread).
[Fire TV General] aHcVolle:
a few people did send me their units and i rooted them for them.

but i'm living in germany so i dont think i'm that much of a help for you 2 guys...
[Fire TV General] ingrimsch:
It works on the FireTV Stick too according to the Exploitee.rs Wiki :good::fingers-crossed:
[Fire TV General] Aquifel:
Hey now, if it works on the firetv stick, i got 2 sticks ready to be rooted! Anyone know if the 'efuse' is a concern with this exploit method? (my stick is definitely updated) Is there a place that details this method more extensively? The wiki page looks useful for actually doing it but, doesn't have a lot of info beyond that. Just watching the video, i know my soldering skills are not up to part to do anything that meticulous.
[Fire TV General] freezer2k:
eFuse will be the same issue as with the FireTV Box, you can still hardware root it, but you cant downgrade anymore.
[Fire TV General] navigates:
Where can I buy the Kit for rooting? in the old days xecuter used to sell mod chips for the xbox.
[Fire TV General] I_did_it_just_tmrrow:
https://shop.exploitee.rs/Here but comes from us and take some days.

Greetings by Idijt
[Fire TV General] navigates:
Great thanks so much . Which one should I get the 17 dollar one? Is there anything else require to buy hardware wise ?
[Fire TV General] I_did_it_just_tmrrow:
Yes, I would say take the ready one for 21 bugs (17 + post).

You have to open your fire TV. Open toolkit is good for that. And you have to wire 4 connections. Some Basic Windows cmd or Linux Terminal skills would be usefull. But I will guess that you can read.

Greetings by Idijt
[Fire TV General] aHcVolle:
and you may need a new sd card reader (my old one didn't work).

If you need to get a new one then order this one: Transcend TS-RDF5K its working perfectly.

[MENTION=3729682]I_did_it_just_tmrrow[/MENTION]: I haven't had a rooting request in the last days, if you still need an emmc adapter let me know, i'll borrow you mine.
[Fire TV General] I_did_it_just_tmrrow:
There is a way you can test your reader before you buy a new one.

You just need "tesa" / tape.

[MENTION=3137372]aHcVolle[/MENTION]

A big big thx, but my adapter arived yesterday

Greetings by Idijt
[Fire TV General] navigates:
Great. Thanks so much for the information. I don't need to root but I love to learn these things. I have always modded the xbox etc in the olden days and the rooting these days via software isin't much of a learn. I have an extra rooted on in my bunker. I may pick up a cheap one on ebay to play around with for rooting.

Also My PC has an SD Card Reader. I think. I'll have to check. If it does, do I need the SD Card reader ? I'll pick it up anyways.

With the hardware method is the bootloader unlocked?
[Fire TV General] RootedBox:
Exploitees e-mmc adapter: 1.8V?

Hi, my e-mmc adapter arrived today from exploitees. Is the adapter already set @ 1.8V, or are the 2 extra vias on the board for a jumper to set it, or what are they for?

Thanks.
[Fire TV General] aHcVolle:
Your card reader needs to support a special mode. You can check if it does by using some tape to disable some pins of a sdcard. You've got to look up howto check this.

You have to unlock your bootloader on your own after you rooted your ftv.

I don't know what they are for but the adapter works out of the box.
[Fire TV General] navigates:
great. I'll just simply buy the SD card reader that has been recommended here. :)
[Fire TV General] papars:
Does this method works with the latest version?

Any change in the method?
[Fire TV General] freezer2k:
No,

But downgrading, installing Boot Menu etc. will brick your device, you can however still copy the SU binary to gain root in the latest version.
[Fire TV General] papars:
I've seen somewhere around here that is possible to flash a kernel in recovery partition and boot from this. Would that work?
[Fire TV General] freezer2k:
Once you are on the latest stock it will blow a softFuse in the Qualcomm chip that will prevent booting older/custom kernels, since you cant unlock/downgrade the bootloader (at least not at this point).
[Fire TV General] danknasty:
So using this method I can root on latest firmware I just can't install the bootloader? Can I install custom recovery?

Also where can I get the sniffer board? I figured I'd try this out since there seems to be no more availability of rootable units anywhere.
[Fire TV General] superkoal:
No, you can't.

Things you can do:

You can copy the superuser apk and gain root for apps and adb.

This enables you to mount usb storage via stickmount,

install xposed and rbox's module enables you to run a custom launcher.

Also another module allows you to enable wallpapers (see my signature) if you want to run nova launcher or similar.

Things you can't do:

Downgrade bootloader

Unlock bootloader

Install custom recovery

Install pre-rooted firmwares
[Fire TV General] danknasty:
Sorry to keep hounding this thread but where can I get the device they make to do the hardware root? I don't see it on any of the links.
[Fire TV General] aHcVolle:
first link in OP

- e-MMC HW Root

-> Interfacing with e-MMC Storage Devices

- Exploitee.rs e-MMC Adapter

- Ordering
[Fire TV General] I_did_it_just_tmrrow:
Please please please please tell me that there is an alternative solder point for DAT0.

This f**king wire was to thick!!!

Ahhhhh!

Hope for an answear!

Greetings by Idijt
[Fire TV General] moeduss:
Do you by any chance have pictures of the other wire connections, I will be attempting this in a couple days and that would be helpful. Thanks in advance.
[Fire TV General] I_did_it_just_tmrrow:
You want a detailed picture of my connected wires?

I can post it if I found an alternative solid point for DAT0.

Anybody an idea?

Gretings by Idijt
[Fire TV General] freezer2k:
Yes it looks like your wire is way too thick. Never had this issue.

I used 0.2mm enamelled wire which worked quite well.

Not sure about another DAT0 connection, wonder if you could use DAT1-x instead?

If not, you could try to very carefully scratch the PCB to get access to the DAT0 line, not sure if this works though, as it is likely multilayer and you might end up destroying other connections.
[Fire TV General] moeduss:
Yes if you wouldn't mind, I was planning on using solid stran telephone wire for this, connections are my only real issue with doing this, the videos are vague as far as some of the connections go. Thanks in advance.
[Fire TV General] freezer2k:
See link in first post:

https://www.exploitee.rs/index.php/Amazon_FireTV

Contains eMMC pinout.
[Fire TV General] superkoal:
I took a 1.5 mm2 flex wire, cut off 10cm and used a single litz for every connection.
[Fire TV General] hajoG:
Unfortunately I bricked my device by trying to install rBox Bootmenu. I had a rooted AFTV with an open bootloader. But somehow it went to a locked state again.

I don't now how. But now it is bricked. Is it possible to unbrick it with the hardware methode and install whatever SW on the device.

My last firmware was rbox 51.1.4.0_514006420 rooted.

Thanks
[Fire TV General] dvazriel:
Is the fully assembled adapter the one that is needed?
[Fire TV General] aHcVolle:
Excatly. If you buy the other one you'll have to solder those things yourself to the adapter which is a major pita. (one of the IC's is a bga package which is very hard to solder by hand).

Go for the fully assemled one.
[Fire TV General] dvazriel:
So basically solder 3 wires (gnd, data0, cmd - the red dots in the picture ) on the fire then solder / connect them to their corresponding point on the adapter.
[Fire TV General] aHcVolle:
you forgot about the clk wire (that makes it 4 wires) but basically yes.

Tip:

Solder the wires to the adapter first and then to the firetv.

Cut your wires to a length were you can easily solder them to the firetv but keep them as short as possible.

You dont want to mechanically stress your soldering points on the firetv at all.

Some people have ripped off the pads on the firetv!

Chris