yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy Note 4 Themes and Apps] lexbian:
Retail N4, no root, Nova Launcher Prime: 8x6 app grid with subgrid positioning enabled and status bar hidden, and Zooper Widget Pro. I plan on replacing the folder icons with 1x1 widgets made to match the widgets already there.Pretty happy with what Zooper and Nova offer without having root or Xposed.

[IMG="Screenshot - Note 4 - Retail"]http://i461.photobucket.com/albums/qq333/lexbian/a8edba2d-3e98-4d0d-95e9-56ef14e226f3.png[/IMG]
[Verizon Galaxy Note 4 Themes and Apps] goodb0y10:
Bare minimum
[Verizon Galaxy Note 4 Themes and Apps] Reinaldo33897:
Nice lay out what the clock and calender widget your using.
[Verizon Galaxy Note 4 Themes and Apps] BrainSmashR:
Zooper widgets pro.....WELL worth the price, but there is a free version too
[Verizon Galaxy Note 4 Themes and Apps] Reinaldo33897:
Very nice wallpaper.
[Verizon Galaxy Note 4 Themes and Apps] goodb0y10:
Dekk Icon Pack
[Verizon Galaxy Note 4 Themes and Apps] androidlover1977:
Best Spiderman wallpaper I've seen
[Verizon Galaxy Note 4 Themes and Apps] greatdaneduke:
Yesterday's
[Verizon Galaxy Note 4 Themes and Apps] greatdaneduke:
Today's
[Verizon Galaxy Note 4 Themes and Apps] Tyggy:
Mine

Here you go
[Verizon Galaxy Note 4 Themes and Apps] Reinaldo33897:
Nova Launcher, minimalistic clock and calender and Pie in bottom center as my dock icons.
[Verizon Galaxy Note 4 Themes and Apps] androidlover1977:
Using the new Total Launcher
[Verizon Galaxy Note 4 Themes and Apps] Android_is_Awesome:
What theme are you using? Widget?

Thanks :)
[Verizon Galaxy Note 4 Themes and Apps] yamraj:
nice one;););););););)
[Verizon Galaxy Note 4 Themes and Apps] dave30534:
Nova launcher

Nova launcher with simple black wood.
[Verizon Galaxy Note 4 Themes and Apps] Psychotic Penguin:
Nova Beta

Zooper Pro: Mate Widgets

Vnyl Icons
[Verizon Galaxy Note 4 Themes and Apps] jley22:
My setup. I change it around here and there. The hardest part is choosing a proper background! I'm still not convinced this is the one I want to use.
[Verizon Galaxy Note 4 Themes and Apps] goodb0y10:
Nothing special
[Verizon Galaxy Note 4 Themes and Apps] stueycaster:
I've been using this for a long time now. I'd like to come up with a new one but I haven't found a background pic that I like as much.

Update: I guess I could have given some details about it. I copied that background from a UCCW full screen widget. Then I changed the color to blue and changed the size to fit my screen. That's the Holo HD launcher. I still prefer it to Nova and all the others I've tried. It's faster and smoother. It's set to 9x5 grid size. Also Nova Launcher didn't line up right. One screen has folders set up and the other has a few apps that I use a lot. That's the 3K SR Black Icon Pack.

Sent from my SM-N910V Dev Ed using the XDA free app
[Verizon Galaxy Note 4 Themes and Apps] lasoxfan:
Nova launcher w/Metal Pro theme and Transparent Weather Clock
[Verizon Galaxy Note 4 Themes and Apps] Chris Hansen:
Hey all, kind of new here (to the Note anyway).

Here's my setup from last week:

[IMG="Material Overload"]http://i.filmot.org/udX6U8H.gif[/IMG]

Nova Launcher Prime

KLWP

Moonshine + Iride UI Icons

Month Calendar Widget

TeslaUnread Plugin

Working on a new, more AMOLED-friendly setup, but it's taking time.
[Verizon Galaxy Note 4 Themes and Apps] Mibuix0r:
My setup. The left most screen(right most pic) controls both my TV's amps and all my HTPCs. Live swirling wallpaper, go launcher ex
[Verizon Galaxy Note 4 Themes and Apps] stueycaster:
I finally got sick of my old home screen enough to change it. Here's my new one.
[Verizon Galaxy Note 4 Themes and Apps] bdorr1105:
My legit setup
[Verizon Galaxy Note 4 Themes and Apps] zane_xzz:
Actually so cool mobile desktop pic,

Actually so cool mobile desktop pic,
[Verizon Galaxy Note 4 Themes and Apps] stueycaster:
My latest

Sent from my SM-N910V DE w/MoRom
[Verizon Galaxy Note 4 Themes and Apps] kkretch:
My latest home screen

My Note 4 screen, running Nova Launcher Prime and Zooper Widget Pro.

Screen presentation done with Hishoot.

[IMG="Black car"]https://lh5.googleusercontent.com/-RyVCF3W1rfQ/Vyje_ykmjLI/AAAAAAAA7gY/jDyFTgRDzZMvip0wovOUoJS2sUdWaI1uwCL0B/w1184-h830-no/IMG_20160503_113345.jpg[/IMG]
[Verizon Galaxy Note 4 Themes and Apps] InfantryMarc:
That's my setup. Running buzz launcher. The last one, with iron man, is my main.
[Verizon Galaxy Note 4 Themes and Apps] mojoswagger1980:
Lol for those of us who want to use there lock screen as an app drawer
[Verizon Galaxy Note 4 Themes and Apps] denism81:
Nova launcher w/ pixel setup (dark theme)

Iris UI icons

Month - calendar widget
[Verizon Galaxy Note 4 Themes and Apps] jcip17:
Launcher: Apex Pro

Icons: Delta

Wallpaper: Black for battery life but probably looks good with an animal or scenic picture lol.

Swipe up on homescreen for vertical app drawer and swipe down for notification area.
[Verizon Galaxy Note 4 Themes and Apps] DelphinusMinor:
I like that.

---------- Post added at 08:31 AM ---------- Previous post was at 08:28 AM ----------

That's sharp looking. Nice and clean.
[Fire TV General] freezer2k:
Hi,

I stumbled upon this a few days back:

http://bloggingthemonkey.blogspot.de/2014/06/fire-in-root-hole.html

This describes a CVE that Rob Clark discovered earlier this year. He did not create a root method using this as Towelroot was still working back then. He published some proof of concept code though:

https://github.com/robclark/kilroy

Now, Qualcomm created patches to fix this and published them here:

https://www.codeaurora.org/projects...can-change-the-iommu-page-table-cve-2014-0972

It also has been fixed in the official Android source:

https://android.googlesource.com/kernel/msm/+/android-4.4w_r8/drivers/gpu/msm/adreno.c (see Log)

I downloaded the latest source that Amazon provided for the FireTV:

https://kindle-src.s3.amazonaws.com/firetv_src_51.1.3.0_user_513011820.tar.bz2

The Linux kernel sources in there all have a timestamp from June 2014, I assume this is when they created this source bundle.

However, as example adreno.c has still a Copyright notice from only 2013. It looks like Amazon is working with older source code here. I also searched for the added lines of the patch and can not find them in there.

Please note that the latest FireTV firmwares source is not yet published, so there is a possibility that this is fixed in the latest versions. I'm hopeful however, that it might very well not be fixed, as they seem to use some old kernel branch even in mid of 2014.

My FireTV did not arrive yet unfortunately, but I hope this can help to root mine and many others!

Could someone please compile the proof-of-concept code and check it out on a FireTV running a recent version?
[Fire TV General] {ParanoiA}:
Ask geohot maybe he can
[Fire TV General] g4rb4g3:
Wish I could be more helpfull but I tried to compile it and somehow it doesn't work out.

I've built it, pushed it over to /data/local/tmp, chmod 755 but all I get is "not executable: magic 7F45". There seems to be something wrong with my toolchain. Maybe it's because I'm using Windows... Tried to use the NDK and followed the last post over there: http://stackoverflow.com/questions/6745064/how-to-run-arm-binary-on-android-platform

At least there is something I can provide to you, the CONFIG_KGSL_PER_PROCESS_PAGE_TABLE parameter is set to y in the kernel config for version 51.1.3.0_user_513011820.

And I attached the files that are needed to compile kilroy for version 51.1.3.0_user_513011820. Note I have modified the msm_ion.h from #include <ion.h> to #include "ion.h" so it finds the file in the same directory.

Hopefully someone with a bit more knowledge (and the right operating system ;)) could check this out!
[Fire TV General] freezer2k:
Cool, thanks.

Are you running v5.1.1.3.0 on your FireTV? If yours is newer I could imagine that you need to compile the binary statically. This way it should no longer depend on the library versions currently installed.
[Fire TV General] g4rb4g3:
Yes my FTV is running on this version. I compiled it static already but it doesn't work...
[Fire TV General] g4rb4g3:
Finaly I was able to compile it, I used the Terminal IDE and compiled it on the FTV.

But I don't know if it works the right way... when I execute it suddenly every connection breaks down and the FTV restarts after a few seconds. I don't know how to proof that it worked out the way we want it to...

I had to make the following changes to the source files to compile it:

kilroy.h:

change line 24 from

#include <sys/unistd.h>

to

#include <unistd.h>

add

#define NEW_ION

kilroy.c

change line 350 from

CHK((ion_fd = open("/dev/ion", O_RDONLY|O_DSYNC, 0)) < 0);

to

CHK((ion_fd = open("/dev/ion", O_RDONLY|O_SYNC, 0)) < 0);

commands used to compile it (start Terminal IDE app and launch telnetd to connect from your pc):

terminal-gcc -c ./ion.c -o ./ion.o
terminal-gcc -c ./kgsl.c -o ./kgsl.o
terminal-gcc -c ./kilroy.c -o ./kilroy.o
terminal-gcc -o ./kilroy ./ion.o ./kgsl.o ./kilroy.o

I have attachted the compiled file, extract it push it to /data/local/tmp, chmod 755 it and start it.

Maybe someone can find out if this is helpfull for us or not.
[Fire TV General] freezer2k:
Did you had adb debug output running during execution? Anything you can see there?
[Fire TV General] freezer2k:
I couldn't resist and just picked up a FireTV @ MediaMarkt in Berlin.

Successfully blocked any updates during the inital setup and my version is now 51.1.3.0_user_513010720 -- so looks like it's even older than 51.1.3.0_user_513011820.
[Fire TV General] freezer2k:
Okay,

just tried running the kilroy binary you provided.

Exactly the same thing happens, the FireTV reboots immediatly.

I had adb logcat running in a second window, but no output there.

On a 2nd try I had another shell open writing dmesg to /data/local/tmp/dmesg in a loop every 200ms, but it did not capture anything.

In another local shell window, i ran ping -i 0.1 <FireTV> to ping it every 100ms, the FireTV stopped responding immediatly after ./kilroy was started.

Not sure what it is doing, but it seems to manage to crash the box hard ;) Not sure what this means exactly, should a faulty binary cause a reboot like this? Maybe it did manage to corrupt the memory in some way, causing a system crash?

Will try to compile this on my own, though I'm not an expert on Android. Maybe someone else could give this a shot!
[Fire TV General] g4rb4g3:
I've written a comment on Robs blog, maybe he can held us.

http://bloggingthemonkey.blogspot.c...omment=1414359782492&m=1#c4713581984059861436
[Fire TV General] Y314K:
Try rooting it with one of the apps on that FW just for kicks... Since is not on the list of FW's. You never know..
[Fire TV General] freezer2k:
I just installed Towelroot v3 and it just says 'This phone isn't currently supported' when i click on the 'make it ra1n' button.
[Fire TV General] Y314K:
Ahh.. Was worth a shot. Guess any 51.1.3.0 FW is out of reach. Thanks for trying.
[Fire TV General] freezer2k:
I tried to use the default modstring, this is the ADB output:

I/towelroot( 7479): ************************

I/towelroot( 7479): native towelroot running with pid 7479 params 1337 0 1 0 4 0

I/towelroot( 7479): CPU affinity was 1

I/towelroot( 7479): set CPU affinity 0

I/towelroot( 7479): parsing modstring

I/towelroot( 7479): modstring is valid 0 1 0 4 0

I/towelroot( 7479): i have a client like hookers

But it seems to hang after that, root button stays greyed out and after clicking a bit the app just closes.

SuperSU 2.4.0 won't open at all and 1.9.4 says it can't install the su binary.
[Fire TV General] sammy98:
What do you want to see in the logcat? The program accesses memory and writes a string into it.

As it crashes and reboots the device, i assume that it did not got there and crashed the gpu/cpu before that and so there is no system log as the cpu resets and not the system. Even if it worked, you wont have seen anything in the logcat - that would be the point where somebody would need to inject proper shellcode into the exploit to use it.
[Fire TV General] g4rb4g3:
Thats what we want to see, so we can be sure that it worked out the way we want it to.

Before:

[ 11.974607] ###### victim=c11ac000 (813ac000): ""

After:

[ 33.401709] ###### victim=c11ac000 (813ac000): "Kilroy was here"
[Fire TV General] sammy98:
Yeah but it crashed before that and resets the cpu. So no cookies here
[Fire TV General] nhumber:
since no exploit was ever really made from his findings, its very possible that it could still be used. its not known if the fix was patched by amazon.
[Fire TV General] freezer2k:
I catched this yesterday doing a 'while true; do dmesg; done' via ADB and then running ./kilroy:

<6>[ 699.556243] binder: release 5006:5006 transaction 124685 out, still active

<6>[ 699.559326] binder: 639:951 transaction failed 29189, size 4-0

<6>[ 699.559326] binder: send failed reply for transaction 124685, target dead

Also, while streaming a video, kilroy does not kill the box, and this shows up in dmesg:

<3>[ 144.678894] ion_mmap: failure mapping buffer to userspace

Only seems to happen when streaming video, box does crash immediately while the screensaver is running, a game is running etc.

I had a chat with Rob, summing up:

<robclark> ... but basically what you want to do is figure out some kernel fxn to overwrite w/ your own code to give you root.. or maybe some data structure to overwrite... find it's virtual address.. find the offset between some lowmem virtual address and phys address so you can convert the virtual address you want to smash to a phys address to smash..

<robclark> I guess the interrupt vector table is always at a well defined virtual address.. that might be something to attack.. although that might be more tricky because your shell code would have to somehow restore it again at the end..

We tried to check out the physical addresses from /proc/kallsyms ; but as non-root all addresses are 0x0, could someone with a similar kernel and root do this and paste it here? Dmesg prints the virtual memory layout, so we have that.

At least on my non-rooted box there is no /proc/last_kmsg, so a dmesg from the previous boot that could contain the dmesg of the crash. Anyone knows how to enable this or something similar?

Hopefully Rob will have some time to help us with this :)

I will proceed now and set up my own Android build environment.
[Fire TV General] sammy98:
I ran the binary on my ftv - same software as you linked.

<2>[ 331.262329] kgsl kgsl-3d0: |a3xx_err_callback| CP | Protected mode error| WRITE | addr=1ec
<3>[ 331.407867] kgsl kgsl-3d0: |adreno_ft_detect| Proc kilroy, ctxt_id 7 ts 1 triggered fault tolerance on global ts 134739
<3>[ 331.410247] kgsl kgsl-3d0: RBBM STATUS 80004001 | IB1:10009000/00000000 | IB2: C000B000/00000033 | RPTR: 0C40 | WPTR: 0DDB
<3>[ 331.412292] kgsl kgsl-3d0: |push_object| snapshot: Can't find GPU address for 10009000
<3>[ 331.412475] kgsl kgsl-3d0: |kgsl_snapshot_get_object| Unable to find GPU buffer C000B500
<3>[ 331.427642] kgsl kgsl-3d0: |kgsl_device_snapshot| snapshot created at pa adf00000 size 136060
<3>[ 331.428039] kgsl kgsl-3d0: |kgsl_iommu_clk_disable_event| IOMMU disable clock event being cancelled, iommu_last_cmd_ts: 20e55, retired ts: 20e52
<2>[ 331.438812] kgsl kgsl-3d0: |a3xx_err_callback| CP | Protected mode error| WRITE | addr=1ec
<3>[ 331.607757] kgsl kgsl-3d0: |adreno_ft_detect| Proc kilroy, ctxt_id 7 ts 1 triggered fault tolerance on global ts 134739
<3>[ 331.607757] kgsl kgsl-3d0: |adreno_idle| spun too long waiting for RB to idle
<3>[ 331.607788] kgsl kgsl-3d0: |_adreno_ft| Replay unsuccessful
<3>[ 331.626068] kgsl kgsl-3d0: |adreno_ft| policy 0x6 status 0x0

Did not work - same problem with cant find gpu adress so nothing to inject

Sammy98
[Fire TV General] freezer2k:
Thanks,

according to Rob, this line here:

<2>[ 331.262329] kgsl kgsl-3d0: |a3xx_err_callback| CP | Protected mode error| WRITE | addr=1ec

means that the binary successfully tries to access the register 1ec, which seems to be protected though.

In this patch: https://www.codeaurora.org/cgit/qui.../?id=7613c9d520ee4d227e635f6db0270d4cf26102bc

+ adreno_set_protected_registers(device, &index, 0x1EC, 1);

was added to protect against this attack.

Even though this can't be found in the source provided by Amazon, it looks a lot like the source does not represent what is actually running on the FireTV :(
[Fire TV General] g4rb4g3:
Tried it, this is the result:

shell@android:/data/local/tmp $ ./kilroy
main:362: ttbr0=a000006a
add_large_mapping:232: pa=a0000000, va=10000000, len=1000000, cached=0
add_large_mapping:232: pa=81000000, va=81000000, len=1000000, cached=1
add_small_mapping:271: pa=07c00000, va=c000c000, len=1000, cached=0
add_small_mapping:271: pa=07d00000, va=c010c000, len=1000, cached=0
add_small_mapping:271: pa=a0008000, va=c000b000, len=1000, cached=0
main:403: cs[0]: 10008000/c000b000 (115 dwords) (limit: c000b1cc)
main:444: buf: 0x40387000 / 10000000
main:448: ibaddrs[0]: 0x40390000 / 10009000 (152 dwords)
00000000: c0733d00 c000b000 000001ec 00000020 c0002600 00000000 c0001300 00000000
00000020: c0013d00 c000b500 000000a0 c0002600 00000000 c0043c00 00000013 c000b500
00000040: 000000a0 ffffffff ffffffff c0023d00 c000c010 a000006a a000006a c0013d00
00000060: c000b500 000000a7 c0002600 00000000 c0043c00 00000013 c000b500 000000a7
00000080: ffffffff ffffffff c0023d00 c010c010 a000006a a000006a c0013d00 c000b500
000000A0: 000000ae c0002600 00000000 c0043c00 00000013 c000b500 000000ae ffffffff
000000C0: ffffffff c0013d00 c000c000 00000003 c0002600 00000000 c0043c00 00000013
000000E0: c000c000 00000003 ffffffff ffffffff c0013d00 c010c000 00000003 c0002600
00000100: 00000000 c0043c00 00000013 c010c000 00000003 ffffffff ffffffff c0013d00
00000120: c000c800 00000001 c0002600 00000000 c0013d00 c010c800 00000001 c0002600
00000140: 00000000 c0013d00 c000b500 000000b9 c0002600 00000000 c0043c00 00000013
00000160: c000b500 000000b9 ffffffff ffffffff c0002600 00000000 c0001300 00000000
00000180: 000001ec 00000000 c0002600 00000000 c0001300 00000000 c0013d00 c000b500
000001A0: 000000cb c0002600 00000000 c0043c00 00000013 c000b500 000000cb ffffffff
000001C0: ffffffff c0002600 00000000 c0001300 00000000 c0002600 00000000 c0013700
000001E0: c000b000 00000073 c0002600 00000000 c0013700 c000b000 00000073 c0002600
00000200: 00000000 c0002600 00000000 c0004600 00000006 c0043d00 813ac000 726c694b
00000220: 7720796f 68207361 00657265 c0002600 00000000 c0013d00 c000b500 cafebabe
00000240: c0002600 00000000 c0043c00 00000013 c000b500 deadbeef ffffffff ffffffff

Could you try to compile it without the NEW_ION define? When I tried it without it the binary crashed with an error like the one posted here: http://bloggingthemonkey.blogspot.c...howComment=1405512070692#c8925820875440593289

But the NEW_ION define wasn't needed by kilroy originally...
[Fire TV General] freezer2k:
Just did, getting the same error like in the link.
[Fire TV General] g4rb4g3:
Bad news... seems that this is fixed already on the ftv... Even if the sources seem to tell us something different.
[Fire TV General] freezer2k:
Yes looks very much like Amazon is not only not uploading the latest source, but no correct source either :p
[Fire TV General] retroben:
If it is,does this mean you can call them out on it for fraudulent source code?
[Fire TV General] rbox:
They are required by the GPL to release the source code to the kernel. They are releasing code, it's just not the right one. It might be intentional, it might be on accident. I'm sure it's just an oversight on their part. But someone would need to contact them and tell them the source code posted here (http://www.amazon.com/gp/help/customer/display.html?nodeId=201452680) does not match what's shipping in the software. Of course, proving that you would have to show that you are actively trying to exploit it, which is how you know it's wrong. Or someone could be like "I read here (and give a link to xda) that the source code doesn't match. Therefore you're not actually admitting you're doing anything "wrong".
[Fire TV General] retroben:
I guess it is because someone could take the legit source and remove the fix then compile the source code for installing on Fire TV and then using the regained exploit to obtain root.

That "someone" could also compare older version source code so they could make sure they take out the fix without messing up the resulting compiled firmware.

Edit:I just got an idea for taking the normal mouse from the initial FTV firmware and placing it in a copy of the latest pre-rooted firmware.
[Fire TV General] nhumber:
doesnt work like that, the ftv will only flash signed files, if we could do this the device would be unlocked.. cwm can flash unsigned code.. but you need root to get cwm on the ftv... someone has to find a new exploit to gain root.
[Fire TV General] freezer2k:
Just checked the latest source https://kindle-src.s3.amazonaws.com/firetv_src_51.1.4.0_user_514006420.tar.bz2

Source in kernel/drivers/gpu/msm seems to be exactly the same as in 51.1.3.0, timestamp still 6/13/2014. No indication that this source has been patched to protect against the exploit described in the first post.

We should bother Amazon to publish the correct source.
[Fire TV General] rbox:
You'll also notice the towelroot exploit doesn't show up as patched in the source either.
[Fire TV General] D0ubl3_X:
Hello guys,

today I've read on reddit about Privilege Escalation Hole CVE-2014-7911.

You can find a description here:

http://seclists.org/fulldisclosure/2014/Nov/51

As I'm not into android security I'll post it in this Thread.

Maybe somene could test it. A proof of concept can be found on seclists.

Is the FireTV affected by this security hole?

Could it be used to gain root again?

EDIT:

From my understanding using this exploit and then patching the system_service should enable us to run our own code and maybe install SU?
[Fire TV General] doblecero:
Sounds promising! Happy to test any sort of thing on my box!
[Fire TV General] bigwillie1:
I sideloaded an APK with the PoC code (credits to r3pwn). After running BadSerial.apk on the FireTV nothing happens. I'm on the latest firmware 51.1.4.1_user_514013920.

I also tested it on an older Galaxy S2 and my HTC One M8 and both rebooted in a couple of seconds.

Does that mean the exploit doesn't work on the FireTV?
[Fire TV General] nufclad:
Just restarts my oneplus.
[Fire TV General] D0ubl3_X:
This means the exploit works on your device (it should work on all Android 4.X Devices)

So has the Fire TV been patched?

The Fix has been applied on AOSP on the 3rd of Nov.... maybe Amazon synched it already.
[Fire TV General] freezer2k:
514006420 has been built before that though!?
[Fire TV General] nufclad:
I just ran it on this fw too, just a quick flash of the white screen on the app, and it auto closes.
[Fire TV General] nufclad:
Well, hopefully more emphasis is probably put on the fire tv sticks. If a solution is found to route that, id be hopeful the same can be used on the fire tv.
[Fire TV General] OskarW:
Deleted
[Fire TV General] samitro:
Root?

Hello, anybody tested this? is this a real root? the buyer claims it is for all version and I can see positive feedback from users who bought it. Thanks.
[Fire TV General] Phil402:
What are you talking about?
[Fire TV General] samitro:
Sorry, not able to edit the post for some reason and forgot to inset the link http://www.ebay.co.uk/itm/Amazon-Fire-Tv-Jailbreak-Service-/111496285372?
[Fire TV General] Phil402:
Hmm, it doesn't say "unlock" or something.

I am afraid it's just some guide how to sideload apk's via adb or something.

edit: I received this answer:
[Fire TV General] wqwrqrfq:
Thanks for asking Phil. I like how you wrote "I dont know what jailbreaking for an android box means."... seems like a pretty innocent way to get a honest answer. ;)
[Fire TV General] TylerDurdenK:
I asked about rooting the latest firmware and he responded saying what we all know to be true. It's not possible.
[Fire TV General] Phil402:
yeah, I asked some german sellers about their "jailbreaking service/devices".

And acutally all of them try to sell "sideloading via adb" as "jailbreaking".