yashsingh1/xdaforums huggingface dataset:
[Fire TV General] Don_Black:
final output

Does this final output mean I am rooted.

Patching patch_4b4ee400.img...

1024+0 records in

1024+0 records out

1024 bytes transferred in 0.001622 secs (631334 bytes/sec)

Addr: 0x50dce400

Addr: 0x50dce600

UCIT-STUDIOS-IMAC-3:aftv2-tools UCIT-STUDIOS$ # last address is 0x50dce600

---------- Post added at 11:28 AM ---------- Previous post was at 11:10 AM ----------

my shell did not change to #, but I got super su installed

Last login: Tue Dec 8 06:14:12 on ttys000

UCIT-STUDIOS-IMAC-3:~ UCIT-STUDIOS$ /Applications/adbFire.app/Contents/MacOS/adbfiles/console.sh ; exit;

shell@sloane:/ $
[Fire TV General] LookAlive:
Root successful! I am unsure when exactly it completed, I wound up heading to be 4 hours after starting it. Should have moved it to the office where the tower was instead of a VM on the laptop.

Anyhoo, thanks for the root! You are amazing!

Next step: SMB USB mount shares.
[Fire TV General] zeroepoch:
After you restarted when it crashed did it finish the second time or did you need to start again? Did root work?
[Fire TV General] reiteravi:
i'm waiting more than 10 min for handshake ftv blinks lazy in white from time to time

is the handshake the longer operation or the patching ?
[Fire TV General] zeroepoch:
It sounds like you missed it. It should take less than 10 seconds if you pair it with adb reboot. It's easier if you start the handshake script first then restart the device.
[Fire TV General] reiteravi:
that is exactly what i did

started ./handshake.py

the connected the usb than power

i have no printout that the handshake is done

firetv windows is opened in file manager
[Fire TV General] playingmax:
since I dont have linux can I just use Cygwin?
[Fire TV General] zeroepoch:
I'm going to need more information. What Linux distribution are you running? Did you run as root? If not do you have access to serial devices? Do you have ModemManager installed or running which other users have noticed causes problems?
[Fire TV General] reiteravi:
don't know how but it started patching now

thanks for your work
[Fire TV General] zeroepoch:
That would be your best chance in Windows. I'm not sure what would change in the pyserial setup. You could try playing with SP Flash Tool which runs in Windows. That can handshake as well but not trivial to setup. I would almost recommend a Linux VM in VirtualBox. The USB passthrough could be tricky to catch the device since it's not around long. Or a Linux live CD. If you do have any success I'm sure others would like to hear how you did it.
[Fire TV General] leohyang:
Dear Zeropoch,

Appreciated a lot of your expertise sharing!

i used Ubuntu 14.04 PC to follow up your instructions, the entire procedure seemed good but the result was still NOT after 3 times.

i.e. after 2 hours flashing was completed, i just powered off/on the device, but 'adb root' '$su' (fall back to $ after a few seconds waiting) are all failed. here's the last patch flashing:

...........

Patching patch_4b4ee400.img...

1024+0 records in

1024+0 records out

1024 bytes (1.0 kB) copied, 0.00124629 s, 822 kB/s

Addr: 0x50dce400

Addr: 0x50dce600

i repeated the entire process 2 times yesterday; today reset the FireTV to factory setting + 3rd flashing ...... all failed strangely.

could you help us out?

thanks a lot! leoh @ 408-5055536

the only change is in handshake.py, 3 lines:

time.sleep(0.001) ==> change from 0.25 to 0.001

st = os.stat(PORT) ==> added these 2 lines to change the permission of /dev/ttyACM0 port

os.chmod(PORT, 664)

A-A USB cable for ttyACM0 is a USB3.0 cable connecting to a PC side blue USB3.0 port as well

142 patch*.img files are generated in the directory ~/aftv2-tools, the first/last/biggest ones are:

-rw-r--r-- 1 root root 512 Nov 12 11:15 patch_00000400.img

-rw-r--r-- 1 root root 512 Nov 12 11:15 patch_00001000.img

-rw-r--r-- 1 root root 512 Nov 12 11:15 patch_00052000.img

..................

-rw-r--r-- 1 root root 2537472 Nov 12 12:26 patch_20537400.img.

..................

-rw-r--r-- 1 root root 512 Nov 12 13:13 patch_4ac89400.img

-rw-r--r-- 1 root root 512 Nov 12 13:13 patch_4ac89c00.img

-rw-r--r-- 1 root root 1024 Nov 12 13:13 patch_4b4ee400.img
[Fire TV General] zeroepoch:
That does look like the last address that would be patched so I think patching was OK. When you mentioned a few seconds delay and then returning with the dollar-sign prompt it sounds like you have not accepted the SuperSU grant prompt on the screen. Can you see the HDMI output while you are trying su?
[Fire TV General] leohyang:
yeasss, Zeropoch, you are absolutely right!

i connected the HDMI port to a separate monitor, saw the screen countdown.

THANKS A LOT !!!
[Fire TV General] reiteravi:
when connecting with adbFire it shows updates are on

maybe not recognized correctly yet
[Fire TV General] leohyang:
on this "rooted" FireTV device, i still can not run many applications (installed *.apk, e.g. 3D Mark, GPU Benchmark 3D, Cidadel game), any workaround further?

i used chmod to turn on many files/devices access permision, e.g.

root@sloane:/dev#chmod 666 MTK_SMI (smart multimedia interface device)

.......chmod chown... for various items in different subdirs.........

then according to /data/system/packages.xml content, i manually started the application as a "root" role,

root@slocane:/dev#am start -a android.intent..action.MAIN -n com.epicgames.EpicCitadel/.UE3JavaApp

but it's still failed upon permission, per logcat infor:

11-12 16:15:56.126 E/empty ( 9734): [BWC E](9734): start(): vendor/mediatek/proprietary_mt8173/platform/mt8173/hardware/bwc/bandwidth_control_port.cpp@53: Open SMI(/dev/MTK_SMI) driver file failed.:Permission denied

although it SEEMS the access is open, why am i still denied by that 'MTK_SMI' device:

root@sloane:/dev # ls -l MTK_SMI

crw-rw-rw- system media 250, 0 2015-11-12 15:59 MTK_SMI

-----------------------------

'adb root' 'adb remount' are all failed, so no way to change those "/init*.rc" configuration, headache :eek:
[Fire TV General] fleisch80:
root on firetv gen2

can someone just guide me in the right way, used my linux box with all

software mentioned, downloaded img file and system diff, can see it in download folder,

i just dont understand what to do from there.

thanks in advance for any help you can guide me with

cf
[Fire TV General] bubbanc:
My patch is currently underway; handshake.py didn't work on my RPi running Raspbian GNU/Linux 7. It does appear to work on my Ubuntu 14.04.3 box (I did have to apt-get install python3-pip and pyserial).

Since this appears to be something that can't really be patched, how do we (you) scale this so that individuals can continue to root after 5.0.3.1 isn't currently what Amazon is delivering via updates? Do you plan on continuing to update as new versions come out? Seems like it might be time consuming to do.

Either way, thanks for what I have now. Guess I should get another device while they are still updating to 5.0.3.1.
[Fire TV General] leohyang:
Zeroepoch's first message has all the step-by-step cmds!

Here's only a bit UI level confirmation/operation infor here:

- 1st step "sudo adb reboot ; sudo ./handshake.py" ,

( first use remote control Setting > System > Developer Options > turn on all the 3 button on, for ADB)

( issue the cmd after "adb devices" or "lsusb" sees Lab126 Inc )

"Handshake Complete!" in your PC terminal marks you're good for next step; otherwise redo this step.

- 2nd step "sudo ./patch_mmc.sh 0x00000000058e0000 system.root.img system.diff"

issue the cmd AFTER "lsusb" sees "Mediatek" line; otherwise wait for minutes redo lsusb. you HDMI monitor will show nothing when the port becomes Mediatek.

the rolling text of *.img/address/speed infor is the confirmation... 2 hours flashing/rolling

- 3rd step when the flashing is auto-completed, manually power off/on your device, connect HDMI to a monitor if not yet, after adb shell "$su", remote controller to grant permission ... "#" is up, done.

----------------------

if your FireTV box is already OTAed to higher version, "Setting>System>Reset to Factory Defaults" to be 5.0.3.1, follow Zeropoch gold guide in the 1st message again.
[Fire TV General] playingmax:
so i could run this from adb on windows 10?
[Fire TV General] rbox:
I just got mine today. I'm going to start poking around on it. Unfortunately, I don't share [MENTION=3411776]zeroepoch[/MENTION]'s optimism. If this is indeed the preloader, that is software and not hardware and part of the update image. So Amazon could patch it.
[Fire TV General] bubbanc:
Root successful! Excellent directions & info.
[Fire TV General] fleisch80:
thank you so much

i needed that help, i dont think i would of ever gotten full python commands

working on my own,

thanks again,

peace
[Fire TV General] leohyang:
unfortunately no, not directly at least, since Zeroepoch's scripts of shell and python used in the handshaking and flashing, are not compatible with Win10. Zeroepoch said in previous message about the possible Windows version in future.
[Fire TV General] xokol2lvox:
Well after possibly just wasting time writing rest of system I started writing at the offset location of the linker file through til the end of img just in case, few hours later I am happy to be booting. Now just need to read up and write partition with root to insure all is well. Can't say it was fun and not frustrating but learned a lot and really starting to like Linux. Maybe not my daily driver but certainly has some good use. Thanks for the assistance.
[Fire TV General] BagiMT:
For anybody messing with system files and getting into trouble: if you can still boot and are rooted you can just overwrite the system partition with the rooted image. This only takes about 10 minutes and you don't need to root again! You will need about 1.3 GB of space in the internal FTV memory though.

wget http://download.zeroepoch.com/aftv2/5.0.3.1/system.root.img.gz
gunzip system.root.img.gz
adb push system.root.img /data/local/tmp
adb shell
su
dd if=/data/local/tmp/system.root.img of=/dev/block/platform/mtk-msdc.0/by-name/system
reboot

I had to do that AND do a factory reset to get everything back up running but it solved my issue with not being able to mount the system partition as rw.
[Fire TV General] zeroepoch:
Yep. This is a great tip. If you are concerned about an unclean rooting procedure (though it should be reasonably safe now if you finish it) this will clean it up.

Also if you append bs=1m to the dd command it takes about half the time to write the compete image.
[Fire TV General] meetkunchok:
Waiting for preloader

I have been trying to root my 2nd Gen FTV on Ubuntu 14.04 using parallel on Mac. After entering the cmd sudo ./handshake.py , my screen stuck on waiting for preloading. I restart manually and change usb port and tried everything. Still giving me same error. Please help me here. Do I have to factory reset FTV? I have lots of apps install in it.
[Fire TV General] :
Looks loke a typo in updater-script: a singel "t" is missing (command name is "mount" - not "moun", the exit code 0 is the returncode of su - not of the command su should issue.
[Fire TV General] zeroepoch:
You probably need to setup a USB filter to pass through the preloader device to the VM. It doesn't show up long enough to manually assign it.
[Fire TV General] qwertytical:
Can anyone tell me what the patch process is doing, why is the patching process of all those addresses necessary. I dont mind the long process - Im just curious what all that address patching is doing vs. an overwrite of a particular section telling it to enable root.
[Fire TV General] ldeveraux:
I could only get it to work by NOT using the sudo before the handshake.
[Fire TV General] zeroepoch:
The patches apply a differential that modifies the system partition from one version (system.orig.img) to another (system.root.img). You need the SuperSU app, the "su" binary, and some SELinux patching processes that run at start-up for root to work. It does this by renaming and replacing a few system daemons. This is part of how SuperSU is normally installed from recovery nothing specific to this device. The patches add all these binaries to the system partition which is most of where the time and size comes from. It also has to modify the filesystem itself to update inode tables and create the inodes for the new files. This is of course not done manually, but all part of modifying the system partition normally and then backing it up with root enabled. It's not as simple as just modifying a single file since it's not designed to be rooted and missing most of the binaries. If you could modify ro.secure I think that might give you root adb access, but that is located in a signed location that can't be modified (otherwise it won't boot).

There is a valid argument to what you're saying which is that there is a more minimal set of patching possible. You can actually patch one of a few system scripts (which amounts to 1 or 2 blocks) and get it to dd the rooted image over the system partition. You need to first load an selinux disable module which to load that requires you to use some tricks to change the selinux context on the module file. This process will of course be much quicker, but it's not straightforward. Even if a guide were written with all the commands the time it takes to copy over the image to the device, hack it, dd the image, with reboots and reconnecting a few times in between might only save a reasonably knowledgeable person an hour, but they'd have to be there the entire time entering commands and watching it. There are some less technical users who are having some trouble already so I'd hate to add a bunch of Linux commands over adb to the process. There is a chance even with the current method that the diff could get smaller and hence quicker if some of the files were hardlinked (not sure yet that it's safe to do), but I'm hoping first to reduce the dependencies (especially on Windows) and reduce the number of commands. There is some work on that when I find time with help from [MENTION=394912]ImCoKeMaN[/MENTION]. Any reduction in diff size would happen on the next release if still rootable. I don't want to mess with the images and patching sequence everyone is already familiar with.

In summary while this seems not very streamlined it's relatively simple given the effort so far devoted to automating the rooting process and time allowed to work on it. If you become more familiar with the process I'd gladly welcome guides that optimize the patching time by moving more of the work to adb commands.
[Fire TV General] qwertytical:
Much appreciate the explanation and the time taken to work on this root. A token of appreciation will be at your pp account shortly. Thanks!
[Fire TV General] Lol.:
Sorry I've been busy with work the past few days, I'm only getting round to testing now. It completed the successfully the second time (unsure how long it took, I went to bed!)

I'm not entirely sure if I've done it right (I'm new to both android and rooting.) I get a superuser permission denied message when I try to disable or enable OTA updates, is this normal behaviour? Or have I screwed up?

Edit:

Connected adb via the network instead, got in and accepted the SuperSu prompt this time, I think it's done! Adbfire on OSX still shows "Amazon updates on" though - is this normal? I did run the command to disable it successfully.
[Fire TV General] Jay794:
Has there been any progress with a Windows tool? Is anyone even working on one?
[Fire TV General] ImCoKeMaN:
The process has been ported to work on windows successfully and the process has been improved some since, here's the link to the GIT wiki for the windows instructions: https://gitlab.com/zeroepoch/aftv2-tools/wikis/windows

This isn't a 1 click or full GUI process, but it's very doable for anyone that should have a "real" need for root. There is also a video guide for how to do it from windows using a Linux VM.
[Fire TV General] Darkestred:
I am on the last step of this guide. When i run patch_mmc_win i receive this error:

Traceback (most recent call last):

File "C:\Users\Darkestred\AppData\Local\Programs\Python\Python35\changed_blks.py", line 16, in <module>

with open(sys.argv[1], 'r') as input:

PermissionError: [Errno 13] Permission denied: 'system.diff'

Done!

Press any key to continue . . .
[Fire TV General] zeroepoch:
The error here is "PermissionError: [Errno 13] Permission denied: 'system.diff'". You must have downloaded the file as a different user than the one running the script. That would be my best guess. I'm not quite sure how that would happen.
[Fire TV General] Darkestred:
Thank you for the response. I only have one user on my computer and that is me. I've had these files for awhile now as i was waiting for a usb a-a cable. I never turn the computer off and do not have seperate virtual/window sessions. If i can't figure this out, i'll just throw it on my linux box and hope something similar doesnt happen.
[Fire TV General] stangri:
My FTV2 auto-updated before I could receive the USB cable. Any chance you can post the files for the updated software? Thanks!
[Fire TV General] memman:
Thanks to the developers and authors of the various guides. I have successfully rooted my AFTV using the Windows approach, but am now wondering how I will be able to update the software with the upcoming releases without losing root. In the past, sites like AFTVNews had posted the pre-rooted ROMs that allowed Gen1 AFTVs to update to the latest releases and still maintain root. With the soon-to-be-released 5.0.4 that should continue to fix bugs and improve perfromance, I don't want to lose the ability to have greater stability.
[Fire TV General] ImCoKeMaN:
check the version I don't know that the 5.0.4 is pushing just yet. Also, we can't just send the files if we don't have the files to work with, does anyone have the OTA link?

Actually please run the handshake.py and the checkver.py to see what it says about the version. Do not try to update if it's 5.0.4, but please let us know the results of the first steps.

Thanks!
[Fire TV General] ultimate_spy_binns:
I've got 2 more boxes arriving tomorrow, so I'll let you know what firmware version is running on it.
[Fire TV General] donpr:
r/w problem

Thanks BAGIMT,that solved my r/w problem.
[Fire TV General] Darkestred:
Well, i ran into a slight snag on my linux box. I'll go back to that if need be. I decided to try this VM option and my vm just says waiting for preloader. I've tried different ports, nothing. If i run the handshake script on the pc, it does find the port on the VM but doesnt do anything else.

*edit - got it.

Thanks.
[Fire TV General] tigerbalm76:
I screwed up and didn't read the detail about the box needing to be 5.0.3.1. I ran the scripts on a virgin box that hadn't even been powered up before. All scripts appeared to have finished successfully but when I try to start up, the white Amazon splash screen comes up then reboots after ~15sec, then I get hung up on this Amazon System Recovery screen below and freezes. Looks like my box is bjorked...any hope I can recover from this? Once on this screen the box doesn't respond to anything.

[IMG="Amazon System Recovery 3e"]http://konabeachvilla.com/misc/FireTV_3e.jpg[/IMG]
[Fire TV General] stangri:
It (5.0.4) is here and if I had a cable (so I could run handshake.py and checkver.py) I would have rooted it before the update. ;)

If the rooting tool is not updated before I receive a cable I'll try the scripts mentioned above from available version when the cable arrives, of course.
[Fire TV General] zeroepoch:
Are you saying since you didn't get a chance to check before it's now already on 5.0.4? It's too bad you don't have a cable to see if the preloader still works.
[Fire TV General] zeroepoch:
It's likely that you have an older version than 5.0.3.1 if you never powered it on before. I don't have images for older releases unfortunately otherwise we could recover with just different patches. If you see some sort of amazon screen we might be able to hack something to dd the image. Without knowing script offsets it could be hard. It's not going to be straightforward at all. The only other option is to flash the full root image which takes weeks.
[Fire TV General] ultimate_spy_binns:
Panics over!!!

I just received my boxes, off Argos in the UK, off Topic did anyone know Argos deliver at 7 o'clock in the morning and on a Sunday, I didn't until now. lol

anyways, since I heard the door I got up, remember this is 7 a clock in the morning, ran downstairs open the door signed for the package, as quickly as possible.

Ripped the packaging off, and unplugged my existing fire TV box, and then Plugged in the new one, logged in with my Amazon account there was no new update, not sure if this is a false negative report from somebody else.

but you can clearly see from the screenshot there isn't an update, just yet in the uk.

but its probably a good idea to get them rooted now since Christmas is only 2 weeks away and I'm sure Amazon will release the update after then.

Please bear in mind, this might be a tip for other people, as soon as I was logged in to my Amazon account I did rip out the Ethernet cable just to make sure
[Fire TV General] zeroepoch:
You can actually use the checkver.py script to check if it's 5.0.3.1 before the very first boot. No need for network at all. In fact you can even root it completely before logging into your Amazon account.
[Fire TV General] ultimate_spy_binns:
Didn't realise that, thanks for the tip I'll do that one next time.

Edit you should add that into your main Post, About you can root without logging in.
[Fire TV General] D-an-W:
Good to see Argos are trying to compete with Amazon 9.30pm on a Sunday evening deliveries!

Other than blocking updates what is everyone else using root capabilities for currently?
[Fire TV General] ultimate_spy_binns:
I'm using it for lightpack it requires root. But it's a great addition to my TV.

Demo

https://www.youtube.com/watch?v=snOec9PntGc

Where to buy

http://www.ebay.co.uk/itm/251610905189?_trksid=p2060353.m1438.l2649&ssPageName=STRK%3AMEBIDX%3AIT
[Fire TV General] TROJAN4EVR:
If you don't log in, how are you turning on developer options (usb/adb debugging) in order to connect to the fire tv to root? Sorry for the noob question?

Thanks zeroepoch for sharing with us your success in rooting the 2nd gen fire tv and thanks to ultimate_spy_binns for your video. I was able to root my fire tv!!! Took a little over 2hrs30min...but well worth it.
[Fire TV General] finndo:
I couldn't without enabling dev opts, scared the crap out of me too I thought for sure it would update or something and I'd miss my op.

Any way, I was posting this morning, as I got a scare yesterday. during root I did the disable command on the OTA. But yesterday in the middle of my daughter watching Tumble Leaf (an amazon original show, great for kids 18 months - 5 years, not sure about older though...) and the system locked up, nothing worked. I pulled the power cable, waited 30 secs, plugged it back in, it booted to the animated amazon logo and just sat there. I waited 20 minutes, nothing. So I pulled the power cable again, this time it came up to the "updating applications" message and finished booting...

looks like everything is working, I have not plugged the USB cable back in to verify ADB, but tasker launched, and I updated Kodi to beta4 from firestarter, so it seem alright. no idea what happened. It still shows 5.0.31 as the version in settings.

The system has been powered on for at least a week, no reboots, and she had been watching the show for about an hour...
[Fire TV General] zeroepoch:
Sometimes if it crashes, or you frequently unplug it during boot :), it will do that but there has also never been the opportunity to update so no idea what it truely dues. I usually have it offline for testing.
[Fire TV General] zeroepoch:
The root doesn't use adb other than convenience. The preloader is always on regardless of dev opts.