yashsingh1/xdaforums huggingface dataset:
[Fire TV General] mastermind278:
Great job with helping root AFTV Stick.

Any method of running this on AFTV1 (Bueller) running on 5.2.1.1? I attempted to modify some of the items you were doing, however it seems that Bueller does not have a /system/bin/watchdogd & /system/bin/vcdbg.

I am able to successfully run dirtycow and reports it was exploited, however the IP method is not giving me permissions for root, so I find the vcdhbg and watchdogd method interesting.
[Fire TV General] emc2cube:
Thanks for this work and tutorial!

I tried this approach yesterday night, unfortunately I don't think it worked, but I may have messed up somewhere (will try again tonight):

- run_me.sh: In my case it takes forever to sync to disk. I had to play quite a few video, skipping back and forth many times to finally have it stick.

- run_me2.sh: went without any problems, correct md5, rebooted... But no TWRP boot menu displayed and when logging back no apparent root access, back as before trying to root.

No error message or anything weird happening, still under the correct software version so I will give it another try tonight and the following nights, but in the mean time if you have any advices on what I should try I'm listening!
[Fire TV General] tehlers:
Hi,

correct md5 would mean, that the file was successfully wrote to "/data/tmp/", readable for root. Could you do:

ls -la /data/tmp/

Last step is to write with "dd" the whole system-Image to system partition. The system partition is normally located under "/dev/block/platform/sdhci.1/by-name/system". Could you also list (this is only readable for root):

vcdbg -c ls -la /dev/block/platform/sdhci.1/by-name/

You say, that you are still on the "correct software version". I assume, that you still can use "vcdbg" as "su" substitute?

Best

Tim
[Fire TV General] emc2cube:
Exactly, everything went well at least until at the "vcdbg -c chmod 777 /data/tmp/system.img" step:

shell@montoya:/ $ ls -la /data/tmp/
-rwxrwxrwx root root 824180736 2017-08-16 20:32 system.img

By correct software version, I was more referring to the fact that I was still on 5.2.1.1, and everything was booting working properly.

I could not use "vcdbg" as "su" substitute after the run_me2.sh reboot, it was back to original pre-dirtycow patched version. Maybe an original system.img and recovery was applied back to the flashed system during first boot?

Spent the evening / night using run_me.sh, skipping around a few videos, rebooting, but for now I only get "Segmentation fault" errors while running "vcdbg -c id". Would be nice to find a trick to speed up this part. Will probably continue this tomorrow evening, until I'm back to a working "su" step, and will run the second command before anything else.
[Fire TV General] tehlers:
Hi,

Ok, this is very interesting and I really don't get it. Sorry, for asking dump questions now, but I really have no clue, since where should be the original system.img come from.

-You don't see any TWRP at the very beginning of booting the stick?

-"su" as command is "not found"?

-If "su" would be found, there should come a popup at the Screen asking you to permit the su.

-"vcdbg" shall not work after finally rooting, "su" instead is then the command for su.

Could you list /system/xbin:

ls -la /system/xbin/

Thanks Tim
[Fire TV General] emc2cube:
Hey no worries, if this can help others I don't mind troubleshooting.

- original system.img (or at least recovery) could be reapplied at boot. I'm quite sure that for the phone rooting either SuperSu when we flash it through TWRP something is patched to prevent the system to restore the original recovery on boot (could be why TWRP is not there at boot)

- correct no TWRP logo / boot menu (I have a rooted FireTV2, so my guess is we should see the same thing that on this one).

- "su" is there, but do not output anything (it may output an error 1)

shell@montoya:/ $ su
1|shell@montoya:/ $

- I may have missed the dialog (computer and Stick are not located in the same room). Is there a way to reset the dialog / removing a file somewhere on /data ?

- Was not working, but trying to dirty cow it again.

shell@montoya:/ $ ls -la /system/xbin/
-rwxr-xr-x root shell 51384 2016-08-05 16:28 bcmdl
lrwxrwxrwx root root 2017-08-05 07:45 daemonsu -> su
-rwxr-xr-x root shell 63880 2016-08-05 16:28 dexdump
-rwxr-xr-x root shell 5340 2016-08-05 16:28 edid_parser
-rwxr-xr-x root shell 139 2016-08-05 16:28 log_bt_config.sh
-rwxr-xr-x root shell 68 2016-08-05 16:28 log_supplicant_conf.sh
-rwxr-xr-x root shell 4806 2016-08-05 16:28 montoya_diag.sh
-rwxr-xr-x root shell 5288 2016-08-05 16:28 onetouchplay
-rwxr-xr-x root shell 49816 2016-08-05 16:28 sqlite3
-rwxr-xr-x root shell 75364 2016-08-05 16:28 su
-rwxr-xr-x root shell 29972 2016-08-05 16:28 supolicy
-rwxr-xr-x root shell 9384 2016-08-05 16:28 trapz
-rwxr-xr-x root shell 17924 2016-08-05 16:28 tvservice
-rwxr-xr-x root shell 46456 2016-08-05 16:28 vitals_collection_agent
-rwxr-xr-x root shell 1857268 2016-08-05 16:28 wl
shell@montoya:/ $ md5 /system/xbin/su
c2d5c3f94c41024eedb4569779597cf6 /system/xbin/su
[Fire TV General] tehlers:
Hi,

You can go on the stick to "Settings", "Apps", "Manage installed Apps", "SuperSU" and there "Delete Data", "Delete Cache". With the listing above, it's clear that the modified system.img is active. The question is now, why it is not working. Could you give the output of these commands:

ls -la /system/bin/e2fsck*
ls -la /system/recovery/

And then could you recheck the start in the way, that you go to the TV, switch to the HDMI of the stick, pull out power and plug it back? If you don't see a dialog for recovery, the e2fsck is not stared at boot (or something is wrong with the files, I would like to see above, but we see that when you list them)... That's really weird...

Thanks Tim

---------- Post added at 10:58 ---------- Previous post was at 10:55 ----------

And could you do "ps | grep daemon"?
[Fire TV General] emc2cube:
Ah you may be onto something. I tried to look for some cache settings... but SuperSu is not listed as an installed app. Any apk that I can install via adb?

shell@montoya:/ $ ls -la /system/bin/e2fsck*
lrwxrwxrwx root root 2017-08-13 09:33 e2fsck -> ../recovery/2ndinitstub
-rwxr-xr-x root shell 150428 2016-08-05 16:28 e2fsck.real
shell@montoya:/ $ ls -la /system/recovery/
/system/recovery/: No such file or directory
1|shell@montoya:/ $

No TWRP logo after a full power cycle / unplug
[Fire TV General] tehlers:
Hi,

Ok, that does not look too good. So e2fsck is exchanged, but /system/recovery is not there... The only thing I could imagine is, that we need to sleep some seconds after "dd" and "sync" in the "run_me2.sh" script. This should normally not be needed but it looks like your new system partition is not fully written.

Please try to exchange the files with "run_me.sh" again. I'll include the sleep into the script and posting.

I think "SuperSU" must be installed as system-app, can't be installed as user. So hopefully we can repair it with another try of "run_me.sh".

Best Tim
[Fire TV General] emc2cube:
Back in business

shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $ vcdbg -c id
uid=0(root) gid=0(root) context=u:r:init:s0

I assume I can directly, and manually, start from "vcdbg -c dd if=/data/tmp/system.img of=/dev/block/platform/sdhci.1/by-name/system"

and follow the steps from the script (see the 30s sleep update). Ideally checking things before rebooting?

---------- Post added at 02:23 ---------- Previous post was at 02:20 ----------

As I have "su" back:

cdbg -c ls -la /dev/block/platform/sdhci.1/by-name/ <
lrwxrwxrwx root root 1970-01-01 16:00 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-01-01 16:00 cache -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-01-01 16:00 custom-cert -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-01-01 16:00 diag -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-01-01 16:00 dt-blob -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-01-01 16:00 fbi -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-01-01 16:00 goldpersist -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-01-01 16:00 gpt -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-01-01 16:00 loader -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-01-01 16:00 misc -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-01-01 16:00 mobicore -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-01-01 16:00 persist -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-01-01 16:00 recovery -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-01-01 16:00 system -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-01-01 16:00 u-boot -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-01-01 16:00 u-boot-env -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-01-01 16:00 userdata -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-01-01 16:00 vc-firmware -> /dev/block/mmcblk0p14
[Fire TV General] tehlers:
Hi,

That's good, I'm happy that you finally got root again! I was in fear that the other files like supolicy forbid now a direct su.

But anyway, yes: Do the "vcdbg -c dd if=/data/tmp/system.img of=/dev/block/platform/sdhci.1/by-name/system" manually, wait for 30 seconds and then reboot.

Thanks Tim

---------- Post added at 11:39 ---------- Previous post was at 11:26 ----------

Forgot to mention: You can't check anything, since the kernel still uses old structures from /system and you will see the new content only after reboot.
[Fire TV General] emc2cube:
Seems it did the trick.

Just rebooted, TWRP boot menu was there. It's now optimising for ~10mins but I bet everything will be fine and I will be able to update with the last prerooted image.

Before rebooting I checked 2 things:

shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $ sync
shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $ sleep 30
s -la /system/recovery/ <
-rwxr-xr-x root root 121204 2017-08-05 07:48 2ndinit
-rwxr-xr-x root root 9488 2017-08-05 07:48 2ndinitstub
-rwxr-xr-x root root 2410171 2017-08-05 07:48 ramdisk-recovery.cpio.lzma
d5 /system/recovery/ramdisk-recovery.cpio.lzma <
3dcb1af64bd7d2e7aed616e4a5328497 /system/recovery/ramdisk-recovery.cpio.lzma

It may be interesting to add a md5 check of the recovery before triggering the reboot, allowing to escape the script as is and hopefully use "vcdbg" to fix/reflash and avoiding the need to reswap the files?

Thanks for your help!

I think I will be off for the night, but I think I have a second stick in 5.2.1.1 somewhere, I can try the updated script from scratch on this one. Will also flash the last prerooted image.
[Fire TV General] tehlers:
Hi,

congrats, the problem with the check is (I think / guess / am pretty sure), that you normally will not be able to see the new files. In your case this might be different, because you already had parts of the new ext4 filesystem using before the reboot, since you already flashed (parts of) it. This is something you could maybe check when you have a second stick on that version.

I'm happy that we did not brick your stick! :good: :)

Best Tim
[Fire TV General] emc2cube:
Did not forget about trying on my second unit, but spent the last 3 days trying to have the new vcdbg stick to flash, no luck so far...

Any other things on top of "playing a video and skipping around" that could help by chance?
[Fire TV General] tehlers:
not really. I don't remember having so much trouble syncing the changes to flash. I know that it did not work always, but keeping the stick busy for a couple of minutes did the trick relatively reliably. You could also try to push a large file to the stick...
[Fire TV General] Spider1996:
This was the same problem for me. I had to play a really long video to get this change written to the stick. For me it was working while playing a video from different Sources for 2-3 hours. (South Park App and ARD Mediathek) Before that nothing. (30 minutes are not enough)
[Fire TV General] WheelchairArtist:
First things first: Thank you tehlers for this rooting guide!

@emc2cube

I had the same problem like you with changes not getting synced to flash, i solved it by letting dirtycow run in an endless loop.

while true; do ./dirtycow vcdbg_new.txt /system/bin/vcdbg; done

For the first time i did this for vcdbg: started loop, went to sleep, woke up with rebooted stick waiting and hanging at the optimizing screen with sticked changes (maybe rebooted because oom). For watchdogd i did nearly the same: started endless loop, waited for screensaver to kick in and waited another 20 minutes or so and changes sticked. rooted again :) From there on i used run_me2.sh and everything worked like expected.

On my first try i started run_me.sh over and over again and all the time it told me changes were done successfully but i kept running it to make sure it does its thing, but e.g. cat /system/bin/watchdogd showed me nothing, also vcdbg got replaced but vcdbg -c id gave me no output (i think because of missing privileges since vcdbg -c gave me expected output like ./vcdbg_new.txt -c?!).

And after about 2 hours youtube i rebooted the stick but changes didn't stick, except for both binaries not beeing the original ones anymore.

I also created both files on my own on my second try, that maybe could've also done the trick for me. After running dirtycow for some seconds a cat of watchdogd gave me expected output, which was not the case on the first try.

Maybe it helps.
[Fire TV General] emc2cube:
Finally got it to work. This stick was brand new, nothing really installed on it, so a lot of free space on /sdcard. Not sure if matters.

Here is what I did to have it stick on flash. Keep in mind I have no idea if any of these actually helped, or if it was pure luck.

- Using "df" I checked how much free space I had on /sdcard (last line of df, with emulated in the path name). In my case I had ~2.2G of free space. I shrank it down to ~600M free (if <500M the Stick will start complaining and asking you to delete apps) using dd to create a 1.6G file (you can customize the size by changing block size or number of blocks, here 16 * 100M blocks):

dd if=/dev/zero of=/sdcard/stuff.txt bs=100m count=16

- launched "./run_me.sh"

- Launched a video, skipped a few times while loading, for 1-2minutes. Repeated with 5-6 different videos.

- rebooted, changes in flash!

Then:

- "rm /sdcard/stuff.txt" to free up space again

- "./run_me2.sh"

- I did some modifications on the original run_me2.sh to see if we can check if everything was successful, and avoid the problem I had the first time. After the 30s wait it was listing the contents of /system/recovery/ and looking for md5 checksum of /system/recovery/ramdisk-recovery.cpio.lzma
[MENTION=6874029]tehlers[/MENTION] I can confirm you that after the 30s wait all changes were correctly made, and that you can check them if you want to update your script to prevent a reboot if the recovery is not installed properly to avoid doing step 1 again.

Now dd into real device, please do not interrupt
Success
Now we wait for 30 seconds to be sure that everything is written to flash
Checking if recovery is there
-rwxr-xr-x root root 121204 2017-08-05 07:48 2ndinit
-rwxr-xr-x root root 9488 2017-08-05 07:48 2ndinitstub
-rwxr-xr-x root root 2410171 2017-08-05 07:48 ramdisk-recovery.cpio.lzma
3dcb1af64bd7d2e7aed616e4a5328497 /system/recovery/ramdisk-recovery.cpio.lzma
Press enter to reboot, afterwards you should have TWRP and full root.

Already updated with the latest prerooted image, everything working nicely.

Once again, big thanks to [MENTION=6874029]tehlers[/MENTION] and [MENTION=4398758]Spider1996[/MENTION] for setting this up!
[Fire TV General] tehlers:
Hi,

I have updated the posting. We have now "run_me3.sh" to check the 3 files. Thanks for finding this out!
[Fire TV General] santamanga:
Thanks for being a test user!

Hey, I had tried the fritz box guest network "Kindersicherung" with the right domains blocked a while back and it updated nevertheless, I guess because of https not being blocked propperly with fritzbox.

Maybe sth has changed in the recent avm software updates. But I would under no circumstances recommend internet access to a stick which is still on 5.2.1.1. to make sure it doesn't update.

Maybe playing a video from a LOCAL samba/nfs share, e.g. via kodi is enough, too. :silly:
[Fire TV General] santamanga:
Can´t get this to work. I played and skipped a couple of times through a file from a samba mount in kodi, but I can´t get the cache to be written.

Please, is there any other way to trigger the cache?

Would an app like this do the trick?

https://play.google.com/store/apps/details?id=me.empirical.android.application.fillmemory
[Fire TV General] tehlers:
I can only say: Be patient, maybe play something for a few hours. You can of course also try the memory filling app. If that works, please report back here.

Best and good luck

Tim
[Fire TV General] kremo:
[MENTION=6874029]tehlers[/MENTION] : big thanks to you! I had a fire tv stick 1 with OS 5.2.1.1 and I needed to make it work with ethernet cable, so I decided to go for root.

However after running the first shell script, the changes were not saved to the flash. Regardless how many hours I watched videos, or played on the fire tv or did whatever...

What worked: I run the memory filling app from post #157, I let it fill up the full memory until the app was closed by the system to save memory. I made this 3 times, and after reboot the changes are saved.

All 3 shell script worked perfect BTW... so good job! and again, big thanks!
[Fire TV General] tehlers:
Hi,

nice to hear that everything worked as expected. Thanks for reporting the success with the memory filling-App!
[Fire TV General] mrvogel:
Worked for me as well

Easily fill ram! worked for me as well. Thanks a bunch for the scripts and the guide, appreciate it.
[Fire TV General] JeffDC:
With this process, what is the highest version of Fire TV 2 that can be rooted?
[Fire TV General] santamanga:
The app and scripts worked for me like a charm, too! Finally root on the stick with 5.2.1.1 !

Thanks [MENTION=6874029]tehlers[/MENTION] for your work. :) Maybe replace the advise to skip through a video with the advise to run the app 3 times, in your post 109.

https://xdaforums.com/showpost.php?p=73390569&postcount=109.

Available to sideload from here: http://www.apkmonk.com/app/me.empirical.android.application.fillmemory/

---------- Post added at 04:06 PM ---------- Previous post was at 03:09 PM ----------

5.2.1.1 - http://www.aftvnews.com/root/fire-tv-2/
[Fire TV General] jegavelan:
I tried all the method so far posted in this thread , still unable to write it , it still struck at the below warning. RAM fill app goes up-to 80 % and crashes out. Any advice

WARNING: linker: ./dirtycow: unused DT entry: type 0x6ffffffe arg 0x4c0

WARNING: linker: ./dirtycow: unused DT entry: type 0x6fffffff arg 0x1

I am trying this in fire tv 1 with 5.2.1.1
[Fire TV General] santamanga:
Hi [MENTION=4317058]jegavelan[/MENTION],

the warnings are normal, they pop up while dirty cow progresses. Also, that easy fill RAM force closes at some point is normal.

BUT your are not supposed to use this method on the aftv device since it might brick it for good. The files in this thread are only for the old AFTV STICK.

Unfortunately, no one has adapted the dirty cow mehod for the stick with 5.2.1.1 to the aftv1 yet. Although I believe it should work as well and the same way.

http://www.aftvnews.com/root/fire-tv-1/
[Fire TV General] Tomen8r:
Has anyone successfully rooted aftv1 (5.2.1.1} using this exploit? Looking to root.

Thank you.
[Fire TV General] trasher73:
How were you able to do it? I followed [MENTION=6874029]tehlers[/MENTION] instructions to the letter, including setting the proper permissions but I get a "no such file or directory" error when I run "run_me.sh". I even resaved the sh files as Unix script using Notepad ++.
[Fire TV General] Raiyzo:
Is it possible to downgrade a Fire TV Stick 1 with 5.2.4.1 to 5.2.1.1?
[Fire TV General] JeffDC:
Not that I've heard. I'm in-line for that.
[Fire TV General] santamanga:
and if you run the script with sh run_me.sh instead of ./ ?

Also, I haven´t used adb connect in such a long time. I always open the adb shell from within adbFire/adbLink.
[Fire TV General] trasher73:
This is what I get when I do that: (I ran ls -l first to show permissions.):

shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $ ls -l

-rwxr-xr-x shell shell 5421 2017-08-31 06:44 dirtycow

-rwxr-xr-x shell shell 1387 2017-10-29 06:08 run_me.sh

-rwxr-xr-x shell shell 1611 2017-10-29 06:08 run_me2.sh

-rwxr-xr-x shell shell 1888 2017-10-29 06:09 run_me3.sh

-rwxr-xr-x shell shell 824180736 2017-08-31 06:55 system-5.2.1.1-root-recovery.img

-rwxr-xr-x shell shell 607969 2017-08-31 06:45 vcdbg_new.txt

-rwxr-xr-x shell shell 10539 2017-10-29 06:35 watchdogd_new.txt

shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $ ./run_me.sh

/system/bin/sh: ./run_me.sh: No such file or directory

1|shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $ sh run_me.sh

: not found]:

Please only run on FireTV Stick 1 (montoya), otherwise you will brick the device.

Press enter to continue, or ctrl+c to cancel.

: not found]: read

: not found]:

run_me.sh[28]: syntax error: 'while' unmatched

1|shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $

Same result with adb shell from adblink.
[Fire TV General] santamanga:
Sorry, I really don´t see where the errors come from. Maybe check the shellscripts if they have a problem with capitals or linefeed instead of CR? Probably [MENTION=6874029]tehlers[/MENTION] knows best where the problem lies.
[Fire TV General] tehlers:
Hi,

sorry, I also don't see from these information where the errors come from. As a guess, I would also assume, that it has to do with line ending. Please don't open the scripts in windows editors and save them before uploading to the stick...
[Fire TV General] codebot:
I don't know about other people but I hate installing random "weird" apps like "memory fillers". Especially when you have to manually download an apk from some unknown source.

I found simply cat'ing a large file is enough to clear all the disk buffers. eg:

cat system-5.2.1.1-root-recovery.img > /dev/null

That seems to be enough on its own but I've only tested once.

If you want to actually fill all the RAM from the command line then use dd (warning, this is likely to crash and reboot the stick; seems to work though):

dd if=/dev/zero bs=1000000k count=1

This also works in one test (or use both methods). Or you could set a lower block size and only partially fill RAM without crashing the stick.
[Fire TV General] Fischfuss:
Hello, many thanks for this tutorial, now I have a rooted FireTV stick1 with 5.2.1.1 :cool:

Is it now possible for me to flash prerooted Firmware 5.2.6.2 from the German aftvhacks side?

Thanks for a short answer

regards
[Fire TV General] santamanga:
First you flash the recovery, then the latest image.

https://xdaforums.com/fire-tv/development/firetv-stick-sloane-prerooted-stock-t3521806
[Fire TV General] RagManX:
The 'dd' command here finally got me rooted. I have had my FTVs1 on 5.2.1.1 for a long time and never had time to fiddle with it and root it. Finally did it last night and couldn't get root to stick across a reboot until I did 'dd' to fill memory. Now I've updated to the latest rooted ROM and gotten the stick back online. Working great. Thanks to [MENTION=6874029]tehlers[/MENTION] and everyone else who offered helpful advice on getting root.
[Fire TV General] Trainer_H:
Hello,

my firetvstick has the version FireOS 5.2.6.6.

i can't change the permission because i have no su permission.

so i can't execute the run_me.sh file.

How can i root my FireTV stick?
[Fire TV General] Spider1996:
[MENTION=528728]Trainer_H[/MENTION]

Unfortunately not possible atm to root 5.2.6.6