yashsingh1/xdaforums huggingface dataset:
[Fire TV General] hansrajhr1212:
Amazon Fire Tv Stick 2nd Gen Version 5.2.7.2

Hi my name is hansraj i have amazon (amazon fire tv stick 2nd gen version 5.2.7.2) and its linked with dish set top box id my dth service provide had this offer where if you subscribe for it then you will get this device (amazon fire tv stick 2nd gen version 5.2.7.2) for free but you have to pay monthly rental for to use the device and its also linked with my dish tv so if i want to use this device i also need to recharge the dth set top box + monthly rental for (amazon fire tv stick 2nd gen version 5.2.7.2) my dth service provider changed something in amazon fire tv stick official rom so now no matter how many times i try to hard reset i even tried to root the device but its not working out for me every video which is available for fire tv stick its not working because this is the newer the service they are offering by giving the fire tv stick is (tata sky binge) version so i need help if there is anyone who can help me contact me my email is hansrajhr1212@gmail.com
[Fire TV General] Sus_i:
You may ask [MENTION=7232872]tamojit_ray[/MENTION]

Seems that he has the same dth provider as you, same firestick too.

Since he messed a lot with the stick in order to get rid of the dth provider, just ask him if it worked...
[Fire TV General] tamojit_ray:
[MENTION=7774510]hansrajhr1212[/MENTION] PM me via telegram at [MENTION=7740535]tamojit[/MENTION]ray. I have the same device taken from tatasky.

[MENTION=5213625]Sus_i[/MENTION] thanks for pinging me.
[Fire TV General] clevergirl:
only now i found this thread, sadly this website http://www.aftvnews.com/root/fire-tv-stick-1/

misled me and made me upgrade from 54.1.2.3 to 5.0.5. not sure how the situation is on this version or what's the easiest way to start. i still have adb binary reachable here as 2 years ago i manually rooted another smartphone with dirtycow (as a last resort since that horrible kingroot bloatware did nothing useful apart from showing the pretty timer to 100% and sending all my private data into the internet ;)).

is it generally possible to use the same binaries that i still have from back then? if yes, which suid application should i try to attack on 5.0.5 ? will ip still work, is there some selinux problems yet or did this start later?

sorry for asking if it's already been said, but most stuff seems to be wrong or misleading by now and i already browsed through a lot of old threads :(

edit: i'm on firestick v1, fw 5.0.5
[Fire TV General] Michajin:
AFTVnews is still a good source, if you are on 5.0.5 you still still follow the intructions there. The person who ran AFTVnews used to be very active here, last year he went to work for amazon, but it's still a good source. If you follow the directions at the end you install a custom rom and remove the bloatware. I used that to root mine sticks years ago...
[Fire TV General] clevergirl:
yeah, i tried that. the links were broken, so i'm not sure i've been using the right version of kingroot. in any case apart from rebooting 3 times and showing the pretty animation to 100% kingroot did not succeed.

---------- Post added at 07:56 PM ---------- Previous post was at 07:52 PM ----------

tried to root it with KingRoot-4.1.0.245.apk, but that fails
[Fire TV General] Michajin:
Link work fine for me..

https://xdaforums.com/android/apps-games/one-click-root-tool-android-2-x-5-0-t3107461

try that one.. I will try to help, if it doesn't work i should have the one for the broken mirror (4.1) on my disk somewhere...
[Fire TV General] Gregbmil1:
I hate firesticks. I even hate the FireCube I got. They are all laggy pieces of garbage. ts because of all the crap Amazon has running on it. Imagine if Amazon made a phone, lol.

Root may not be so necessary on phones these days, but it sure is on any Amazon Firestick. I can't root mine but I did learn I can disable anything with adb. For a long time I thought it couldn't be done because

"adb shell disable --user 0 (package) don't work on it. But

adb shell disable-user --user 0 (package) does.

I just don't know what and what not to disable. There is so much crap on it from the factory
[Fire TV General] Sus_i:
LOL

FIRE PHONE :D
[Fire TV General] Gregbmil1:
They Do!?.......I never looked into them. I can only imagine the amount of bloatware on them, lol. Its probably a lag fest straight out the box.

Edit: HaHa.....I googled 'Fire Phone' and the very first line says "In defense of the Amazon Fire Phone".......HaHaHa.......And its even in bold lettering......HaHaHaHa.

I hate that i'm basiclly forced to use a FireCube, I'm married, lol. It's why I'm afraid to just start disabling apps on it. If i had to factory reset it, it could possibly be the end of my existence:laugh:

I can't find a debloat list
[Fire TV General] Sus_i:
Take a look here, maybe you find a working version
[Fire TV General] dcarvil:
There is a debloat script at:

https://github.com/esc0rtd3w/firestick-loader/blob/master/scripts/debloat/bloat-disable.sh

It requires root, but you could modify it by replacing all "pm disable" with "adb shell disable-user --user 0 ".

If you are on Windows, remove the lines commented out (#pm disable). I don't believe Windows recognizes # as a comment.
[Fire TV General] clevergirl:
you mean the 5.3.7 version ? can't try, cause it would require me to somehow swipe up.

would be great if you had the one they tried to link. or somehow just an explanation of whatever tactic the kingroot uses (i wished instead of pretty guis they would just share the actual info), so that i can do it manually.

---------- Post added at 10:32 PM ---------- Previous post was at 10:30 PM ----------

yep! that's how i had found KingRoot-4.1.0.245.apk :)
[Fire TV General] Michajin:
Try mouse toggle, gives you a mouse with the remote... It is hard a firestick 1 is really old and likely going to be really slow. What are you trying to do with root? I can still dig my hard drive for the old kingroot if i have it. You are on 5.0.5? i actually think i did mine on kingoroot now thinking of it (it has been a few years...), looking at the old AFTVnews...
[Fire TV General] Gregbmil1:
Thank You so much. I'm about to run it. I will report back
[Fire TV General] Gregbmil1:
I did try it before. Apparently it does not work on the FireCube. Well at least without changing the tv to 50hz from 60hz. I guess it's a because of a known bug in the Firecube. I tried it once but gave up once I switched to 50hz and it didn't work. That's as far as I went, lol
[Fire TV General] Michajin:
You have a firecube? There isn't root available for it. Are we talking stickv1?
[Fire TV General] Gregbmil1:
As far as I know there is no root, I could be wrong. Yes, I have the FireCube, I'm on Fire OS 6.2.7.1. I think to root it I would need to get one of the HDMI cords that will short it out.

I have plenty of HDMI cords I could cut to make one. If I ruin the Firecube, oh well. Goodbye frustration, goodbye lag......Just kidding my wife would kill me, but I'm willing to take the risk, lol. She sees what I put my phones through (never did I hard brick one). She doesn't care to see how much better I get them.
[Fire TV General] Michajin:
There is no root. There was a root exploit about a year ago that was blocked on 6.2.7.0 ish... I tried updating since and it's bricked. The HDMI hack also required another device. It was the same exploit the pendant had. The root access is blocked. There is no shorting method, it's a different cpu...
[Fire TV General] Tomen8r:
I would love to test this out. I don't know anything about compiling but I did download/install 2015 Visual C++ on Win10 so I could learn and compile dirtycow.c. Never done this before so the process is slow as I keep getting error after error. But still carrying on, successfully compiled some samples/examples and am making a little progress each day!

If anyone would like to share the compiled dirtycow that would be awesome. I would love to move along and test it on my FireTV1 and help you guys out where I can.

Thank you!

Sincerely,

Tomen8r
[Fire TV General] Waintly:
I assume there is no working "setenforce" command, right? (that would be too easy)

Other than that I noticed a dirtycow variant which uses ptrace and explicitly does not require suid binaries/should be able to bypass selinux ( can't post links, github.com/scumjr/dirtycow-vdso ). The only downside is that some of the assembler needs to be ported to ARM (see github issues).

(I'm not sure if I should try to root my FireTV with FireOS 5 - in the end it would be mostly useful to run some kind of Fedora but unfortunately I upgraded to FireOS 5 so I guess the bootloader is locked/efuse is active.)
[Fire TV General] Kramar111:
[MENTION=6046805]Waintly[/MENTION]

FireTV 2Gen Fire OS 5.2.1.1 (551203220) Pre-Rooted

View attachment 3933763

w/o root:

shell@sloane:/ $ setenforce 0

setenforce: Could not set enforcing status: Permission denied
[Fire TV General] kobayashimaru:
I would also appreciate it, if someone could provide the compiled dirtycow before i start messing with something i have no experience with ;)

Patience finally pays off. i'm on 51.1.4.0_user_514006420 as well :D

Edit: pointing us to the right cross platform or Android native compiler should also do the trick :)
[Fire TV General] Prowler_gr:
Same here I'm still on 51.1.3.0. [MENTION=6430510]christofsteel[/MENTION] are you able to share your compiled binary?

(you can use dummy link hxxp:\\..... if you're still not allowed to post proper links)
[Fire TV General] Prowler_gr:
I managed to get the exploit running, but after changing the ip I still do not have root.

Any ideas?
[Fire TV General] YellowSnowman23:
How did you manage to compile it? I keep getting unsigned errors.
[Fire TV General] YellowSnowman23:
Figured it out. I think... Now I'm getting Permission denied when I try to run. Could it be Selinux that is stopping it from happening?

EDIT: DUHHH FORGOT TO DO CHMOD 755
[Fire TV General] YellowSnowman23:
Ok... I've been pulling my hair out for the past 24Hrs. trying to figure out how to compile dirtycow.c as ARM. I can't get anything to work... Can someone please share their compiled version please???
[Fire TV General] YellowSnowman23:
UPDATE: GOT THE SCRIPT TO RUN!!!

I'm on a

Fire Stick

, Fire OS 5.2.1.1

Still kind of stuck. There is no option to choose Static IP. If I go to advanced then input my ip as usual to make it static. reconnect to adb shell and type su, nothing... su not found.
[Fire TV General] Prowler_gr:
Has anybody else apart from the OP had success with rooting by this method?
[Fire TV General] ElTentakel:
For all hackers, that missed the most important point of this tutorial: you have to set the IP to manual, which does all the magic.

The problem is: this is not possible on the FireTV Stick .. is there any other binary that could be started in root context after the system has started already? I tried different files (kill, rm, reboot, dnsmasq ...) but nothing worked.

PS: Everyone who is interested how dirtycow works should read this:

http://xdaforums.com/general/security/dirty-cow-t3484879/page6
[Fire TV General] AquaSize:
Please share it with us. (The Script)
[Fire TV General] YellowSnowman23:
First, Ill show how I managed to fix the problems I was having, and how simple it was to get dirtycow compiled.

1. Make sure you are on a Linux OS (I used a Ubuntu VM)

2. The command 'make root' will NOT work unless you have Android Studio with NDK installed.

3. For some reason you will always get a error saying that it cannot find dirtycow or run-as in libs folder. Thats because it did NOT compile. If you try to manual compile dirtycow and/or run-as, you'll get a error "ndk-build: command not found"

3a. To fix this, open makefile in a txt editor, under build (line 5) will read: ndk-build NDK_PROJECT_PATH=..........

put "./" (without quotes) in front of ndk-build NDK......

The entire line should look like this:

./ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_PLATFORM=android-21

4. SAVE!

5. Try the command "make root" (without quotes).

6. It'll spawn a shell without su. su still doesn't work.

7. In shell cd to /data/local/tmp you should see the compiled dirtycow in there and permissions are already set.

KEEP IN MIND IF YOU COMPILE YOURSELF IN A COMPILER MAKE SURE TO SET -fPie -pie flags. or else youll get an error: "error: only position independent executables (PIE) are supported."

Took me almost 24+ hours to figure out this simple fix...
[Fire TV General] YellowSnowman23:
So all dirty really does is go through a backdoor and is able to overwrite files? based on reading in the post you linked.
[Fire TV General] YellowSnowman23:
No idea... I've been trying everything.

So far I have tried sleep and ip.

When you tried this did you remember to change the last line in the "ip_script" that the OP made for us, to whatever binary you choose (ex. kill, ip, sleep etc...)
[Fire TV General] ElTentakel:
I try to clarify some points

1. Use the right binaries. For FireTV and FireTV Stick you have to use armv7a

2. yes, the trick is to replace a system file (temporary), so you can replace the a binary of the system with your own script or binary. This will mount /system with rw and copies su to /system/bin

3. To execute this file with root permissions, the it has to be called from a thread that has root permissions. So you can type in what you want, it will not work. The FireOS itself has to call the replaced file, so we have to find a way to provoke FireOS to execute the binary with root permissions. In the guide this was ip (by setting the ip manually). But some versions of FireOS doesn't support this - it looks like they implemented this in the last minute
[Fire TV General] slater_g:
I thought the S4 Pro in the Fire TV (1. Gen Box) was also armv7a.
[Fire TV General] ElTentakel:
Ok, i think i mixed up arm A9 and arm9.
[Fire TV General] santamanga:
suggestions: maybe replace kill and then kill an app via app menu? or factory_provision_tool (if that is possible) and then factory reset?
[Fire TV General] ElTentakel:
I tried the first suggestion yesterday, without success. I thing apps are killed in app context. I could try the second one ... but I would have only one chance?
[Fire TV General] santamanga:
:) yes, the 2nd one might be fun.

hey, but I have no idea if the binary is actually the one responsible for factory reset. I have just checked what binaries there are in my aftv1.

But there must be some occasion, that kill is called as root.
[Fire TV General] AquaSize:
When i execute the command "mount -o remount,rw /system" it's says i don't have the Permission? How can i fix it?
[Fire TV General] ElTentakel:
I tried it with my FireTV 5.2.1.1 and it didn't work. I assume that they now use the Android API to change the IP address, so it will not work with ip. The only (known) way is do upgrade / downgrade the device to and try again.

My FireTV Stick has an older Version, without static ip setting. Thus this might really be a last minute static ip feature implementation in version 51.1.4.0.
[Fire TV General] Prowler_gr:
SUCCESS!!!!

I managed to root 2 AFTV1's on firmware 51.1.3.0 using this method.

The thing I was doing wrong was changing the ip of the wifi connection.

As soon as I used a wired connection, & changed to a static ip everything worked flawlessly...
[Fire TV General] slater_g:
Also succeeded with a Fire TV Box Gen 1 on 51.1.4.0.

Can post the binaries and longer tutorial if needed.

Also downgraded to 51.1.0.2, rooted with TowelRoot and did a full bootloader unlock.
[Fire TV General] $t0Rm:
I am on the same software version if you don't mind posting the binaries and your tutorial please.

Thank you.
[Fire TV General] YellowSnowman23:
You are correct! My version was compiled as ARM. I was told to use ARM for the Fire Stick in a different thread. I have not been able to try out the ARM on a Fire TV.
[Fire TV General] Tomen8r:
First, thanks to all for taking the time to put this together!! Please see screenshot at https://www.dropbox.com/s/t4kix2g8ejkj5v9/DirtyCowADB.PNG?dl=0

I am on AFTV1 ver 5.2.11. I pushed the files over and starting executing the adb shell commands. ./dirtycow couldn’t be found. I thought maybe it was a typo so I tried variations of the command to no avail. (used dirtycow_firetv1_bueller). So I cd down to data. I couldn’t not list the directory contents using ls command (permission denied). Cd again down to local. Same thing. Cd again down to tmp. Using ls I could see the contents. The files are there. When I tried to execute the script I started receiving permission denied.

Any ideas? Run-as perhaps? I’ve tried several times to no avail. My steps are listed in the attached screenshot.

Sincerely,

T
[Fire TV General] t3ch42:
Thanks for the exercise to get a working exploit. Any idea on the likelihood of this working for the firetv2?
[Fire TV General] JeffDC:
Have you given those files execute

permissions?
[Fire TV General] Ultraschorsch:
After entering #11 on your list I get this:

shell@bueller:/data/local/tmp $ ./dirtycow /system/bin/ip ip_script
WARNING: linker: ./dirtycow: unused DT entry: type 0x6ffffffe arg 0x600
WARNING: linker: ./dirtycow: unused DT entry: type 0x6fffffff arg 0x1
warning: new file size (135) and file old size (165484) differ

size 165484

[*] mmap 0xb6df1000
[*] exploit (patch)
[*] currently 0xb6df1000=464c457f
[*] madvise = 0xb6df1000 165484
[*] madvise = 0 1048576
[*] /proc/self/mem 1723858944 1048576
[*] exploited 0xb6df1000=732f2123
shell@bueller:/data/local/tmp $ cat /system/bin/ip
#!/system/bin/sh
mount -o remount,rw /system
cp /data/local/tmp/su /system/xbin
chmod 4755 /system/xbin/su
/data/local/tmp/ip "$@"
shell@bueller:/data/local/tmp $ exit
jan@jan-P560 ~ $ adb shell
shell@bueller:/ $ su
/system/bin/sh: su: not found
127|shell@bueller:/ $ cd data
shell@bueller:/data $ cd local
shell@bueller:/data/local $ cd tmp
shell@bueller:/data/local/tmp $ ls
adblink
dirtycow
ip
ip_script
server.apk
su

Do you get that warning as well? After waiting for this to finish and re-newing the IP etc. su can't be found even though it is there when I cd to data/local/tmp

Any ideas are welcome!
[Fire TV General] sparkd:
thank you for the exploit -

working root on 51.1.50_user_515012720

ro.build.version.number=515012720

Would I gain any benefit updating to the latest "rootable" firmware 51.1.63 and then re-rooting the device with this method?
[Fire TV General] Prowler_gr:
Why don't you just download & flash a pre-rooted image?

http://xdaforums.com/fire-tv/development/prerooted-stock-images-t2882337/
[Fire TV General] sparkd:
From AFTVNEWS, if you’re Fire TV 1 is on 51.1.4.1 thru 51.1.6.3, ...... but you will not be able to downgrade and unlock your bootloader due to the eFuse.
[Fire TV General] Prowler_gr:
what output do you get when you run

cat /system/bin/ip

?

---------- Post added at 05:09 PM ---------- Previous post was at 04:47 PM ----------

What output do you get when you run?

cat /system/bin/ip
[Fire TV General] YellowSnowman23:
ip never changes for me either. Like you said it looks like it succeeded, but it never does. Everyone has been saying it usually takes a few minutes, but when I do it, it completes within 3-5 seconds.
[Fire TV General] mitchie_moe:
it's a binary file... "cat" just gives you scrambled output.

here is the hexdump of the file (just beginning)

hexdump -C /system/bin/ip | head -20
00000000 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
00000010 03 00 28 00 01 00 00 00 4c 46 00 00 34 00 00 00 |..(.....LF..4...|
00000020 5c 82 02 00 00 00 00 05 34 00 20 00 08 00 28 00 |\.......4. ...(.|
00000030 1a 00 19 00 06 00 00 00 34 00 00 00 34 00 00 00 |........4...4...|
00000040 34 00 00 00 00 01 00 00 00 01 00 00 04 00 00 00 |4...............|
00000050 04 00 00 00 03 00 00 00 34 01 00 00 34 01 00 00 |........4...4...|
00000060 34 01 00 00 13 00 00 00 13 00 00 00 04 00 00 00 |4...............|
00000070 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 |................|
00000080 00 00 00 00 d8 72 02 00 d8 72 02 00 05 00 00 00 |.....r...r......|
00000090 00 10 00 00 01 00 00 00 94 7a 02 00 94 8a 02 00 |.........z......|
000000a0 94 8a 02 00 5c 06 00 00 34 10 00 00 06 00 00 00 |....\...4.......|
000000b0 00 10 00 00 02 00 00 00 3c 7c 02 00 3c 8c 02 00 |........<|..<...|
000000c0 3c 8c 02 00 10 01 00 00 10 01 00 00 06 00 00 00 |<...............|
000000d0 04 00 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 |....Q.td........|
000000e0 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 |................|
000000f0 00 00 00 00 01 00 00 70 24 e7 01 00 24 e7 01 00 |.......p$...$...|
00000100 24 e7 01 00 58 06 00 00 58 06 00 00 04 00 00 00 |$...X...X.......|
00000110 04 00 00 00 52 e5 74 64 94 7a 02 00 94 8a 02 00 |....R.td.z......|
00000120 94 8a 02 00 6c 05 00 00 6c 05 00 00 06 00 00 00 |....l...l.......|
00000130 04 00 00 00 2f 73 79 73 74 65 6d 2f 62 69 6e 2f |..../system/bin/|
[Fire TV General] YellowSnowman23:
No success for me. I've been trying everything. If I had to guess it would be a SELinux issue. No idea how to bypass it because I'm new to this.
[Fire TV General] mitchie_moe:
same here. i will try some of the other dirtycow-binarys later. i still didn't try all of them :D
[Fire TV General] YellowSnowman23:
You are correct, but if dirtycow succeeds you should be able to use cat to see the ip_script.

#!/system/bin/sh
mount -o remount,rw /system
cp /data/local/tmp/su /system/xbin
chmod 4755 /system/xbin/su
/data/local/tmp/ip "$@"

---------- Post added at 10:28 AM ---------- Previous post was at 10:22 AM ----------

x86 obviously will not work. But it is an armv7, to save you time.

shell@montoya:/ $ cat /proc/cpuinfo
Processor : ARMv7 Processor rev 0 (v7l)
processor : 0
BogoMIPS : 2400.25

processor : 1
BogoMIPS : 2400.25

Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : CAPRI_AZ_MP
Revision : 0000
Serial : 0000000000000000
[Fire TV General] Prowler_gr:
The binary doesn't work then.

Hint: the reported size of the exploited /system/bin/ip file won't change when running

ls -l

even if dirtycow is succesful

The only way you can confirm it has worked is through

cat /system/bin/ip

Keep testing the other binaries you compiled.
[Fire TV General] YellowSnowman23:
File size would change, and probably md5.
[Fire TV General] Prowler_gr:
I'll re-phrase: I can't say that there isn't another way to confirm the exploit worked, but I can say that the reported size you get after a ls -l, will still be 165484 even after a successful exploit (that's what I experienced while rooting two aftv1 boxes)
[Fire TV General] Passi0509:
No root for 5.2.1.1 right?
[Fire TV General] slater_g:
Done. Sorry I forgot. Did the tutorial all from my memory.
[Fire TV General] Ultraschorsch:
I still did not get root. I am on 5.0.5.1 and did all the steps including the chmod part you added. Everything seems to work fine but still su can't be found even though I can see it in tmp. Here's what I get if I enter

cat /system/bin/ip

#!/system/bin/sh
mount -o remount,rw /system
cp /data/local/tmp/su /system/xbin
chmod 4755 /system/xbin/su
/data/local/tmp/ip "$@"
[Fire TV General] Prowler_gr:
Have tried using a wired connection to set a static ip?
[Fire TV General] Ultraschorsch:
No, I used WiFi. Should I use a wired connection? Did I miss that part?
[Fire TV General] Prowler_gr:
That's what worked for me...

I was too having trouble, when trying to root by wifi.

http://xdaforums.com/showpost.php?p=69655695&postcount=45
[Fire TV General] Ultraschorsch:
Thanks a lot for your input! Will try and report! :)
[Fire TV General] slater_g:
WiFi worked for me. But try wired anyway. Which firmware are you currently on?
[Fire TV General] Ultraschorsch:
5.0.5.1