[Fire TV General] tehlers:
Dear all,

upon request, I tried to make things easier with a bundle of files and scripts you can run on the Fire TV Stick 5.2.1.1. I will take no responsibility if your stick bricks! I have prepared the system.img with TWRP and su.

Here are the following files:

Archive: auto-root-fireos-5.2.1.1.zip
Length Date Time Name
--------- ---------- ----- ----
0 2017-08-23 15:25 auto-root-fireos-5.2.1.1/
1565 2017-08-23 15:15 auto-root-fireos-5.2.1.1/run_me2.sh
5288 2017-08-13 19:09 auto-root-fireos-5.2.1.1/watchdogd_new.txt
370380 2017-08-05 14:57 auto-root-fireos-5.2.1.1/vcdbg_new.txt
5400 2017-07-31 22:30 auto-root-fireos-5.2.1.1/dirtycow
1351 2017-08-14 20:25 auto-root-fireos-5.2.1.1/run_me.sh
824180736 2017-08-13 20:31 auto-root-fireos-5.2.1.1/system-5.2.1.1-root-recovery.img
1838 2017-08-23 15:25 auto-root-fireos-5.2.1.1/run_me3.sh
--------- -------
824566558 8 files

https://www.androidfilehost.com/?fid=673368273298980527

At first you put the whole directory into /data/local/tmp:

> adb push auto-root-fireos-5.2.1.1 /data/local/tmp/auto-root-fireos-5.2.1.1

Then you go into this directory and make sure the permissions are right:

> adb shell
shell@montoya:/ $ cd /data/local/tmp/auto-root-fireos-5.2.1.1
shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $ chmod 755 dirtycow run_me.sh run_me2.sh

You start "./run_me.sh":

#!/system/bin/sh

echo "Please only run on FireTV Stick 1 (montoya), otherwise you will brick the device."
echo "Press enter to continue, or ctrl+c to cancel."
read

if [ "$(grep '^ro.build.version.fireos=5.2.1.1' /system/build.prop)" = "" ]; then
echo "Please run only on FireOS 5.2.1.1"
exit 1
fi

if [ "$(pwd)" != "/data/local/tmp/auto-root-fireos-5.2.1.1" ]; then
echo "Please put everything from zip-file to /data/local/tmp/auto-root-fireos-5.2.1.1 and run script there"
exit 1
fi

echo "Saving watchdogd to /data/local/tmp/."
cp -a /system/bin/watchdogd /data/local/tmp/

echo "Saving vcdbg to /data/local/tmp/."
cp -a /system/bin/vcdbg /data/local/tmp/

echo "Now exchanging content of /system/bin/watchdogd"
exit=1; while [ "$exit" != "0" ]; do ./dirtycow /data/local/tmp/auto-root-fireos-5.2.1.1/watchdogd_new.txt /system/bin/watchdogd; exit=$?; echo $exit; done
echo "Successful."

echo "Now exchanging content of /system/bin/vcdbg"
exit=1; while [ "$exit" != "0" ]; do ./dirtycow /data/local/tmp/auto-root-fireos-5.2.1.1/vcdbg_new.txt /system/bin/vcdbg; exit=$?; echo $exit; done
echo "Successful."

echo "Now play a video on Amazon Prime Video and skip a bit around to make changes persistent"
echo "Then press enter"
read

echo "Now we reboot, afterwards please run run_me2.sh in /data/local/tmp/auto-root-fireos-5.2.1.1."
reboot

for the first part, exchanging the binaries and becoming root. The more dangerous part is "./run_me2.sh" which exchanges the whole /system with my prepared version:

#!/system/bin/sh

echo "Please only run on FireTV Stick 1 (montoya), otherwise you will brick the device."
echo "Press enter to continue, or ctrl+c to cancel."
read

if [ "$(grep '^ro.build.version.fireos=5.2.1.1' /system/build.prop)" = "" ]; then
echo "Please run only on FireOS 5.2.1.1"
exit 1
fi

if [ "$(pwd)" != "/data/local/tmp/auto-root-fireos-5.2.1.1" ]; then
echo "Please put everything from zip-file to /data/local/tmp/auto-root-fireos-5.2.1.1 and run script there"
exit 1
fi

if [ "$(vcdbg -c id | grep 'uid=0(root) gid=0(root) context=u:r:init_shell:s0')" = "" ]; then
echo "Step 1 (run_me.sh) went wrong, please try again"
exit 1
fi

echo "Now copying system.img to /data/tmp"
vcdbg -c mkdir /data/tmp
vcdbg -c chmod 777 /data
vcdbg -c chmod 777 /data/tmp
cat /data/local/tmp/auto-root-fireos-5.2.1.1/system-5.2.1.1-root-recovery.img | vcdbg -c 'dd of=/data/tmp/system.img'
vcdbg -c chmod 777 /data/tmp/system.img

echo "Checking md5sum, please be patient."
if [ "`md5 /data/tmp/system.img | (read a b; echo $a)`" != "7f487939edb80ec87c4784943d6154fe" ]; then
echo "system.img could not be fully copied, exiting"
exit 1
fi
echo "Success"

echo "Now dd into real device, please do not interrupt"
vcdbg -c dd if=/data/tmp/system.img of=/dev/block/platform/sdhci.1/by-name/system
sync
echo "Success"

echo "Now we wait for 30 seconds to be sure that everything is written to flash"
sleep 30

#echo "Now we reboot, afterwards you should have TWRP and full root."
#reboot
echo "Now run run_me3.sh to check md5 of new files, or just reboot."

For security, check md5sums of files before reboot:

#!/system/bin/sh

echo "Please only run on FireTV Stick 1 (montoya), otherwise you will brick the device."
echo "Press enter to continue, or ctrl+c to cancel."
read

if [ "$(grep '^ro.build.version.fireos=5.2.1.1' /system/build.prop)" = "" ]; then
echo "Please run only on FireOS 5.2.1.1"
exit 1
fi

if [ "$(pwd)" != "/data/local/tmp/auto-root-fireos-5.2.1.1" ]; then
echo "Please put everything from zip-file to /data/local/tmp/auto-root-fireos-5.2.1.1 and run script there"
exit 1
fi

if [ "$(vcdbg -c id | grep 'uid=0(root) gid=0(root) context=u:r:init_shell:s0')" = "" ]; then
echo "Step 1 (run_me.sh) went wrong, please try again"
exit 1
fi

if [ ! -d /system/recovery ]; then
echo "/system/recovery does not exist, exiting"
exit 1
fi

echo "Checking md5sum of /system/recovery/2ndinit, please be patient."
if [ "`md5 /system/recovery/2ndinit | (read a b; echo $a)`" != "2dae0315ee0b7704215d8d538c168a58" ]; then
echo "/system/recovery/2ndinit is not fully ok, exiting"
exit 1
fi
echo "Success, /system/recovery/2ndinit is ok."

echo "Checking md5sum of /system/recovery/2ndinitstub, please be patient."
if [ "`md5 /system/recovery/2ndinitstub | (read a b; echo $a)`" != "43069eea7d009c0a86b87ceef60116fd" ]; then
echo "/system/recovery/2ndinitstub is not fully ok, exiting"
exit 1
fi
echo "Success, /system/recovery/2ndinitstub is ok."

echo "Checking md5sum of /system/recovery/ramdisk-recovery.cpio.lzma, please be patient."
if [ "`md5 /system/recovery/ramdisk-recovery.cpio.lzma | (read a b; echo $a)`" != "3dcb1af64bd7d2e7aed616e4a5328497" ]; then
echo "/system/recovery/ramdisk-recovery.cpio.lzma is not fully ok, exiting"
exit 1
fi
echo "Success, /system/recovery/ramdisk-recovery.cpio.lzma is ok."

sync

echo "Now you can reboot, TWRP files are all ok."

Again: I'll take no responsibility for any damage caused. I have prepared everything to the best of my knowledge. If you use it and succeed (or fail), please report back here.

Best

Tim

EDIT: Updated to newest version, if you have problems with copying data to /data/tmp (in run_me2.sh), it might be worthwhile to test over network (not via USB) and use adb from a linux system.

EDIT2: Upon request the hint from the later pages: Instead of playing a video to sync changes to flash (short before the first script finishes, it seems to be more effective to fill the memory with artificial content until completely full. This can be done with a memory filling App, see https://xdaforums.com/showpost.php?p=73766497&postcount=157 and https://xdaforums.com/showpost.php?p=73838299&postcount=163.