yashsingh1/xdaforums huggingface dataset:
[Fire TV General] zeroepoch:
You can build a kernel and modules but not load your own kernel, but you can load modules. Until we get kexec working you'll be stuck only loading modules into the stock kernel. I have the latest sources with a few build fixes here:

https://gitlab.com/zeroepoch/android_kernel_amazon_sloane
[Fire TV General] roligov:
Thanks for this, my 3 devices arrived in South Africa today. I successfully rooted 1 of 3 devices so far on windows. Only thing not mentioned in the guide is having to disable driver signature verification in windows 10 to install the legacy usb driver. Other than that it worked great. Surprisingly I had the option to install 5.0.4 in the system menu. I looked in the cache directory after rooting and the OTA of 30mb was there. I backed it up to my machine and deleted it from the device.

FreedomRunner what version of windows are you running? 8 or 10? Maybe you need to Google disable driver verification in windows.
[Fire TV General] spotmark:
It tells you to read the Windows 10 guide, which tells you to disable signature verification, right before the first step.
[Fire TV General] xokol2lvox:
I had no luck with handshake in Windows 10. Driver appeared to work fine but script give error about port error. Com port selected fine, but I am assuming driver related access issue. Driving atm so can't check. Have a buddy trying to help do out of state . Linux was easy enough and reliable for me.
[Fire TV General] ImCoKeMaN:
Can you post that OTA somewhere? It might be something we can use to help create a root for 5.0.4
[Fire TV General] TROJAN4EVR:
Please look at the video posted by ultimate_spy_binns:

https://www.youtube.com/watch?v=CZQqLoO6ojM

and this post by gazdaman:

http://xdaforums.com/showpost.php?p=64285297&postcount=50

I rooted 8 units on a 3yr old dell windows 7 laptop using ultimate_spy_binns's instructions and video. All you have to do is download the virtual machine file(almost 3gb zip and make sure it extracts to over 8gb) and install VMware. Then just follow his video. Only one out of 3 usb ports allowed the fire tv to connect to VMware. Had to unplug the fire tv and entered the "sudo ./handshake.py" command again after "waiting for preloader". On my terminal when prompted for the sudo password...all I saw was a green box when typing the password. But it worked. The video guide is great as it lets you know what to expect...Then its a long process of 2.5hrs. I changed my power settings on my laptop to not sleep or turn off and just turned off the screen(dell laptop has a button to turn off screen). It all worked like a charm....
[Fire TV General] ultimate_spy_binns:
hi guys just thought I would share my findings regarding bypassing Amazon's update on the first boot.

now I have had one success with using this method, so far and will need to do further testing to make sure it works properly every time. but next time I get the shipment of box's in I will make sure this is working correctly.

not sure if anybody else sore a post I posted on this website recently about the DeviceSoftwareOTA.apk Source Code.

but anyways after digging into the Source Code a little bit, really you only need to be blocking 2 Domain names On your router, And then you are still able to login and then complete the setup, Without doing any updates.

but if you like me and don't have a capable router to block Domain names, I worked out a method of using your Windows computer as a wireless receiver all you have to do is add the Domain names into your Windows hosts file, to block updates.

this will require you to not be using your wireless card on your computer you must be connected by ethernet cable to the Internet, And connect the fire TV to the wireless receiver on your computer.

and those unlucky people who are running an older firmware on the box and need to update to 5.0.3.1 to root

but can't because it's trying to install the new version of the firmware, I've worked out a method to force it to install that specific version, again need to be further tested for I even bother writing tutorials etc.

anyways just thought I'd let people know there might be Hope on the way.

PS if anybody's wondering how I forced it to install the specific version i use packet manipulation, again this does require Your Fire TV box to be connected to your wireless card on your computer.
[Fire TV General] gafaschoco:
Yes I'm 100% sure I was on 5.0.4, I think I my firetv2 was the first one to get it, lol, you confirmed my feelings about what is going on after I flashed it, in the mean time I will use my firetv1 , and will keep testing with the firetv2, thanks for sharing your knowledge.
[Fire TV General] d0ubl3_d1zzl3:
Crap...! I think this is exactly what happened to me today... I didn't even bother checking the firmware on my FTV2 before running the root exploit and now it looks like I have a soft-bricked AFTV device... Dammit... (I should have read the other threads on this forum)

I was able to get it to handshake successfully also... But once it was done patching and I power cycled, it got stuck on the 'amazon' logo startup screen...

Is there a way to do a reset to factory via hardware buttons or something?? I haven't looked into that yet... :(
[Fire TV General] roligov:
Here is the OTA that was in my cache folder: https://goo.gl/RB3sMy

MD5: EA3C0279DC65EC5F8ADC8DA4CD2E29EA

You can rename it to .zip and extract it's contents.
[Fire TV General] jbombs16:
If anyone is having difficulty running the windows bat file, try disabling your virus software. I was sitting at step 2. Once I turned off virus scanner, it went to step 3 (waiting for preloader) and started the process.
[Fire TV General] roligov:
All 3 devices rooted and updates blocked! Thanks again :D
[Fire TV General] bash-ninja:
kernel module support

Thank you for letting me know that! I didn't even think to check if the kernel had been build with module support. All my android phones had that disabled by default. It was very kind of amazon to build it that way.

Your kernel source was very nice. Thanks.

I was able to get my module built and now have support for the Xbox One Controller on the FireTV2. I think that's a first. Give me a bit to post some instructions and I'll share it with everyone. Here's a video showing it works: youtube.com/watch?v=upDnlH8XJeY
[Fire TV General] jbombs16:
try disabling your virus scanner

---------- Post added at 03:27 AM ---------- Previous post was at 02:56 AM ----------

---------- Post added at 03:29 AM ---------- Previous post was at 03:27 AM ----------

[MENTION=3411776]zeroepoch[/MENTION] So I successful finished the windows bat script. When it told me that root was successful and to power cycle, I powered cycled and it just sits at the amazon splash/boot screen (black screen that says amazon fire and has a slight loading animation). What is the problem? Did I soft brick? I thought the script was supposed to verify the version before proceeding.

What can I do?
[Fire TV General] zeroepoch:
Did you run the older method batch script (patch_mmc.bat/patch_mmc_win.bat) or the newer one (root_aftv2.bat) that includes the exe and patch files? You're right about it checking the version in the newer one. It's pretty picky in that the flash contents extracted have to look like build.prop type content and then it has to find an exact property and the value must match. Any other case should error out. You might need to do a factory reset because maybe some setting is messed up but that's not going to be easy without getting to the menu. Although very unlikely, but since this is the first update post root something might be wrong in the version check.
[Fire TV General] jbombs16:
I used the newer one. What about deleting the last address file and running the script again?
[Fire TV General] zeroepoch:
It wouldn't hurt to try. It should just overwrite the changed blocks with the same data.
[Fire TV General] zeroepoch:
Thanks for posting the OTA. From a quick peak it does appear that they update the preloader. Although from reports we're seeing in previous posts the handshaking procedure and API to read/write memory hasn't changed or else rooting wouldn't have bricked those devices. It doesn't look straightforward from first glance how to easily apply this to the original image. From what I can tell system, boot, lk, and preloader were updated. Maybe I can use the preloader to hack it enough to get the original image. Then we'll have a way to verify if an update procedure we come up with works.
[Fire TV General] zeroepoch:
I tried to revert to the stock system image and factory reset my device and I'm still getting 5.0.3.1. I wonder how they are choosing to push out 5.0.4. Maybe random selection? Has anyone run the checkver.py script or the all in one script seen it fail after checking the version?

For others following this thread I tested the newer method with the single script and included patch files on Mac OS X El Capitan 10.11.1 with python 3.5 installed from python.org and it went through the entire rooting process without any problems the very first time. This was on a 2012 Mac Mini that a friend had. I previously had problems with it hanging after reopening the serial device in follow up scripts after handshaking until I replugged the USB cable. Now that it's a single session that seems to have fixed the problem. So for anyone on a Mac you shouldn't need to downgrade anymore.
[Fire TV General] roligov:
Here is the OTA for 5.0.4 directly from Amazon: http://amzdigitaldownloads.edgesuit...sloane_full_sloane-534011720-to-536116920.bin
[Fire TV General] TROJAN4EVR:
I'd appreciate it if you can let us know the 2 Domains to block? Looking forward to you replicating your force install via packet manipulation and sharing it with us.
[Fire TV General] FreedomRunner:
I am running windows 7!

Do i have to run windows 8 or windows 10 or should it also work on windows 7?
[Fire TV General] roligov:
It will work on 7 but you still need to disable driver verification signing: Watch this: https://www.youtube.com/watch?v=k4RwaI4mn6Y
[Fire TV General] fourlans:
Another satisfied customer

I disabled my virus scanner as suggested and finally, after several attempts with both the Anthony Binns' method and the zeroepoch's batch file method it finally worked using the batch file method.:D
[Fire TV General] :
Propably selinux. But witout audit suppprt in the kernel and without auditd to write this to some logging facility, it's hardly debuggable. And even if you find the denials, your only chance is to compile a new sepolicy file and put in in rootfs, which is not writable for root, either - so you have to patch it via mediatek preloader...

What you can do, is setting the box from sepolicy enforcing mode permissive (without audit support this means off, you won't see any audit logging for sepolicy). I use adb via network dirctly from my cm-12.1 tab:

/ #
/ # adb connect 192.168.2.103
connected to 192.168.2.103:5555
/ # adb shell
shell@sloane:/ $ su
root@sloane:/ # setenforce 0
root@sloane:/ # getenforce
Permissive

If you want to see the selinux context of a file in the fs, use -Z as option to ls:

root@sloane:/ # ls -Z /dev/MTK_SMI
crw-rw---- system media u:object_r:MTK_SMI_device:s0 MTK_SMI
[Fire TV General] jbombs16:
I re-ran the script. It completed successfully, but I'm still stuck at the amazon fire splash/boot screen after I power cycle. More specifically, it passes the white amazon screen then just sits at the black screen with the amazon fire animation.

Any suggestions on how to fix this? Or should I just try to return to amazon?
[Fire TV General] dk1keith:
I also used ultimate_spy_binns method and video. It was the only thing that worked for me and really is quite simple once you get Vmware installed. Had to do the handshake twice but even that was mentioned in the video.
[Fire TV General] TROJAN4EVR:
That's Great!!! Good Job!!! Thx for letting us know...
[Fire TV General] Don_Black:
El Capitan

[MENTION=3411776]zeroepoch[/MENTION]- I was able to successfully root two devices on the Mac, using mavericks. If the patched update script will work now with El capitan. I will test this update and let you know. has this update been added to your repo.
[Fire TV General] zeroepoch:
It's in the windows branch. Since it seems to be working I'll move it to master. The zip file a few posts back is the way to go since it has the patches already as well.
[Fire TV General] z_thompsonpa:
I know you're still working on a guide, but I was just curious if you had to use any userspace apps to make this work, or did the kernel module alone provide enough support?

I am tempted to try the same thing with hid-sony and hid-wiimote modules, as I only have ps3 and wiimote controllers to test. My buddy at work is the maintainer of the liquorix kernel, so I figured he'd be able to help me out with the process of cross-compiling the modules.
[Fire TV General] Xedos9er:
Good work guys, hope to see root on 5.0.4 soon.

What will be the procedure to update a rooted 5.0.3 FTV 2 to 5.0.4? OTA Update to 5.0.4, then root again via USB??

Also, is there anybody who testet DTS and DD on a 5.0.4 firm with a 4k HDCP 2.2 capable AV Receiver in kodi ??
[Fire TV General] kayiman74:
are we able to root 5.04 already?

I'm currently on 5.0.3.1 rooted
[Fire TV General] zeroepoch:
That may be one approach but I hope we can come up with something faster.
[Fire TV General] Xedos9er:
Custom Recovery + prerootet OTA Update *love*
[Fire TV General] bash-ninja:
I didn't need to use any apps to make it work. I did need to add a .kl file for the device, as the generic layout gets the triggers and right stick switched up. (The Xbox 360 had the same 'camera spin' issue) I may consider using an app, though, to handle the module loading at boot as right now I have to reload the modules every reboot via a shell. Does someone know a way around that? Can we edit the init.d scripts in the ramdisk?

I did need to modify the module a bit though, as the XPAD module was already built into the kernel as an older version without XBOX One Support.

Edit:

I just posted the modules for those who want it:

http://xdaforums.com/fire-tv/development/ftv2-kernel-module-xbox-one-controller-t3272578
[Fire TV General] zeta054:
awesome work guys
[Fire TV General] teame06:
Thanks for the instructions. It work but for some reason it took way ~4 hours to finish. Not sure if it had to do with VMware Fusion 7 on Macbook Pro 2011 on el captain. Now I have two more to do.
[Fire TV General] jbombs16:
[MENTION=3411776]zeroepoch[/MENTION] I was never able to get mine past the boot screen after running the new single script. I have ordered a new one from Amazon.

When I get my new aftv, Should I turn it on this time to verify the software (with my router having the blocked downloads) first? This past time, I did the script right out of the box.

Should I just use the original way and verify the version after handshake?
[Fire TV General] zeroepoch:
5.0.4 Preloader Still Usable

I finally got the 5.0.4 update. I took a chance based on other users comments and decide to revert to stock and take the update. Good news is that 5.0.4 still has all the functionality needed in the preloader to root. I was able to read out a file change a byte and write it back as kind of test of the interface. Next step is to hack it enough to dump the original image file and then prepare a rooted image file. No promises on ETA but I wanted to at least let people know it should be possible to root 5.0.4 if it has that version out of the box.
[Fire TV General] kayiman74:
that is great news!!!!!!!!!

please keep us posted of any success.

Thank you
[Fire TV General] zeroepoch:
To be sure you should clone the latest repo and run handshake then checkver. I did a test with 5.0.4 and it fails with both old and new properly. It crashed with the old method originally, which is still a fail, due to it parsing binary junk but I fixed that now in master.
[Fire TV General] FreedomRunner:
I tried to disable driver verification signing. I used the methode that is mentioned in the video.

Then i installed the driver - but i still get an exclamation mark on the driver in Windows Control Panel!

Maybe it's a problem with my windows version (windows 7 home edition)!

Any other suggestions?
[Fire TV General] zeroepoch:
Non-rooted (original images) for 5.0.4 have been dumped:

http://download.zeroepoch.com/aftv2/5.0.4/

Creating a rooted image and a single zip rooting package like the new method for 5.0.3.1 shouldn't be difficult but it will take some more free time. Now that I have the original images I (or maybe [MENTION=3991724]rbox[/MENTION]) can later play with applying the OTA and having a way to verify it.
[Fire TV General] Xedos9er:
[MENTION=3411776]zeroepoch[/MENTION]

i just reverted to stock via adb dd operation.

I want do update to 5.0.4, but don´t get the update notification. Should i have enabled again the ota service, before i revertet to stock??
[Fire TV General] zeroepoch:
Nope, enabling OTA updates after reverting is fine. You could try a factory reset. It does an initial update during the setup which sometimes helps. For me I just had to wait even after doing both of those.
[Fire TV General] Xedos9er:
I can't enable now since i have no root.

Do have to factory reset :(

That's not good, don't want to install everything again :(
[Fire TV General] zeroepoch:
You'll have to root so you can enable it again if you have too much setup to factory reset. Think of it as 2 hours computer time vs your time.

EDIT: Sorry about suggesting to enable it after. I was thinking a factory reset was an option.
[Fire TV General] Patrick_445:
I would have made the same mistake as [MENTION=1164016]Xedos9er[/MENTION]. [MENTION=3411776]zeroepoch[/MENTION] I think it would be a good idea to add instructions to enable OTA in your opening post, where you provide directions for how to revert back to stock.
[Fire TV General] Xedos9er:
I think i will factory reset it today after work. it´s 30min setup everything vs. 2 hours root.

But yeah, it´s a good point to add it to the instructions :)
[Fire TV General] d0ubl3_d1zzl3:
So, just to clarify for those of us that have softbricked their devices because we tried to root while on 5.0.4...

I'm assuming there is no fix yet, correct? We can't we use the revert to stock via adb instructions in the OP because the AFTV2 doesn't allow firmware downgrading, I'm assuming? And if we use the 5.0.4 image that [MENTION=3411776]zeroepoch[/MENTION] posted instead it won't work as well? Figured I'd ask before I make it worse to recover my device...
[Fire TV General] zeroepoch:
I just added it to post #1. Thanks for the suggestion.
[Fire TV General] zeroepoch:
Now that I have the original image for 5.0.4 you can un-softbrick using the new original image.

wget http://download.zeroepoch.com/aftv2/5.0.4/system.orig.img.gz
wget http://download.zeroepoch.com/aftv2/5.0.3.1/system.diff.gz
gunzip system.orig.img.gz
gunzip system.diff.gz
./handshake.py
# power cycle device
./patch_mmc.sh 0x00000000058e0000 system.orig.img system.diff

Pay close attention to the difference in paths above. You will see I'm mixing the patch list from 5.0.3.1 but the contents from 5.0.4 to reverse the damage.
[Fire TV General] fldash:
zeroepoch, I'm already fully rooted on 5.0.3, but I have a question about how this is being rooted. How is it that when I was running the diff and it stopped after a few steps, I was able to reboot and use my FireTV normally? Was it just luck. Is this actively patching the image as it goes in which case once you start patching, you must finish?
[Fire TV General] zeroepoch:
You got lucky. The patches are related to each other. An example would be the directory is updated to say a files exists at location X, but if that location is zero'd or uninitialized the new file will be junk. Once you start you either have to apply the procedure with the original image up to the same point or finish it. It's just chance that you were able to boot it.
[Fire TV General] fldash:
That's what I thought, I finished patched it the next day, but I was always curious about how in the hell it worked...

Would it not be possible to build an image with Xposed installed and use this same method?
[Fire TV General] zeroepoch:
Yeah, except it would be faster to install it post root, assuming we had a way to install it cleanly without recovery. You can use the tools I have to create a new super root image and then create a new diff from that.
[Fire TV General] BagiMT:
Fastest would probably be to root without Xposed and once rooted to copy an image with Xposed installed using the adb dd method. How hard would it be to create a rooted image with Xposed installed? Could that method also work to upgrade from 5.0.3 to 5.0.4?
[Fire TV General] KainanMaki:
Bricked?

Zeroepoch, first wanted to thank you cause' I applied the root succesfully.

I have another 2nd Gen Fire TV with the following problem:

While using it for the first time, amazon tried to update it (as usual) to 5.0.3.1). During such process the Fire TV lost power (blackout-should buy a lotto ticket). And now I'm stuck at the Amazon coloured logo boot.

There's anyway to flash 5.0.4 (or any version) using your method during handshake to unbrick-it? (even if it takes two weeks to flash).

Thanks!
[Fire TV General] zeroepoch:
If I had to take a guess it probably only partially updated the system partition. It would have a similar effect to only applying part of the patches for rooting. I'd apply the root or stock image for the same version first before doing anything else. That would be the 2 week+ process. Not sure if changes in the kernel are required that match other changes in 5.0.4.
[Fire TV General] KainanMaki:
I'm not sure at which version it was sitting. I know it was trying to update to 5.0.3.1

Guess I'll try to apply the root method, maybe it saves it. In case it doesn't, how could I apply the same process for the stock image?

Thanks again.
[Fire TV General] zeroepoch:
Take whatever version/image you want and after stand-alone handshake do:

./write_mmc.py 0x00000000058e0000 <img>
[Fire TV General] qquickname:
So now that I have root, is there a way to fix how KODI maps to the wifi remote network instead of the wired network, if you go under system settings/info under kodi it says the ip address is 192.168.49.1 instead of the actual ip of 192.168.1.x .

so what happends is I cant use the Kodi remote apps available to control it from my phone or tablet.

another note, i installed autopilot and first time i rebooted it worked properly, and since then it doesn't do anything.. anyone else have issues with it?
[Fire TV General] zeroepoch:
I now have the pre-rooted system image uploaded as well (same location):

http://download.zeroepoch.com/aftv2/5.0.4/

The next step of course will be to get the differences and turn that into a series of patches and then release a new zip file.
[Fire TV General] Pat1981:
so we can install it over current version? (flash new firmware and than reset firetv?)
[Fire TV General] zeroepoch:
In theory yes... It's not ideal to update that way, but it would work. Recovery would be the best option since system is not mounted, but that is not possible right now. Although you need to update more than just system. You also need to update boot and maybe some other partitions. I'll need to compare the md5sums from both versions to see what needs to be updated. If I can get at least 2 or more people who are rooted on 5.0.3.1 to run the following command and paste the output in this forum that would be helpful to double check things:

md5 /dev/block/mmcblk0?*
[Fire TV General] Xedos9er:
Did amazon stopped rolling out the update?

Done factory reset yesterday in the evening. Still no update notification, even if i check for updates in the system info :(