[Fire TV General] bibikalka:
The device came with the original version of Fire OS 5.2.2.0 (555164120) - (ro.build.date=Fri Aug 19 06:41:23 UTC 2016 --- DirtyCow potential ???). The device demands network immediately, no way to bypass (some discussion on bypassing here). Then, after this Amazon connection it immediately checks for updates. Mine did so, and started to download the update.

After that comes Amazon account sign in, and finally one can turn on ADB. The way to avoid the FireOS update & buy time is to limit the bandwidth for the stick & the router, I've limited mine to 40 kbit/s. It complained that Home could not be loaded, and other screens are blank as well. But I got a bit of time to play with it via wireless ADB.

Wireless ADB allows reboot to recovery, but there are no options there at all. It states that the device will soon reboot.

Later on I used the Fire 2015 adb drivers, and was able to run wired ADB from a laptop while having stick2 hooked up to a TV for display.

DirtyCow

With DirtyCow, I attempted to replace /system/build.prop with the edited version that would at least prevent the updates as per this link. Unfortunately, none of the dirtycow executables that I found in misc XDA threads seems to work, and the device immediately crashes, and reboots.

shell@tank:/data/local/tmp $ ./dirtycow3 /system/build.prop ./build.prop_mod
./dirtycow3 /system/build.prop ./build.prop_mod
WARNING: linker: ./dirtycow3: unused DT entry: type 0x6ffffffe arg 0x600
WARNING: linker: ./dirtycow3: unused DT entry: type 0x6fffffff arg 0x1
size 6130

[] mmap 0xb6e62000
[] exploit (patch)
[] currently 0xb6e62000=6220230a
[] madvise = 0xb6e62000 6130
[] madvise = 0 1048576
[COLOR="Red"]And crash ...[/COLOR]

Kingroot

I've installed the latest Kingroot (NewKingrootV5.0.0_C161_B367_xda_release_2016_11_23_20161123203507_105243.apk) via "adb install kingroot.apk", and managed to run it by doing adb swipes and tabs, and then doing remote click for enter:

adb shell input touchscreen swipe 50 500 50 100 (swipe up)
adb shell input keyevent 61 (tab)

Kingroot reports rooting successfully, however RootChecker indicates that no SU binaries are installed :( No root access in shell either.

Kingoroot

I've tried V3.8, again using adb input commands to navigate the lack of touchscreen. Multiple attempts generate "Download error". So no go ...

I feel that there is still potential with DirtyCow and this FireOS build, but it's not clear on how to proceed. For reference, here is the build.prop file :

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=LVY48F
ro.build.display.id=LVY48F
ro.build.version.incremental=288.5.5.5_user_555164120
ro.build.version.number=555164120
ro.build.version.name=Fire OS 5.2.2.0 (555164120)
ro.build.version.fireos=5.2.2.0
ro.build.version.fireos.sdk=4
ro.build.version.fireos=5.2.2.0
ro.build.version.fireos.sdk=4
ro.build.version.sdk=22
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=5.1.1
ro.build.version.security_patch=2016-06-01
ro.build.version.base_os=
ro.build.date=Fri Aug 19 06:41:23 UTC 2016
ro.build.date.utc=1471588883
ro.build.type=user
ro.build.lab126.sign.type=release
ro.build.user=build
ro.build.host=ip-10-11-3-123
ro.build.tags=release-keys
ro.build.flavor=full_tank-user
ro.build.platform.version=
ro.build.configuration=tv
ro.fireos.target.extension=default
ro.fireos.target.product=full_tank

ro.product.brand=Amazon
ro.product.name=full_tank
ro.product.device=tank
ro.product.package_name=com.amazon.tank.android.os
ro.product.board=tank
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.cpu.abilist=armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=
ro.product.manufacturer=Amazon
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=mt8127
# ro.build.product is obsolete; use ro.product.device
ro.build.product=tank
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=full_tank-user 5.1.1 LVY48F 288.5.5.5_user_555164120 release-keys
ro.build.fingerprint=Amazon/full_tank/tank:5.1.1/LVY48F/288.5.5.5_user_555164120:user/release-keys
ro.build.characteristics=tv
# end build properties
#
# from device/amazon/tank/system.prop
#
#
# system.prop for generic sdk
#

ro.sf.lcd_density=320

#support opengles 2.0 3.0 is 196608
ro.opengles.version=131072

ro.audio.silent=0
#ACOS_MOD_BEGIN {amazon_audio}
media.aac_51_output_enabled=true
#ACOS_MOD_END {amazon_audio}

# MTK, Infinity, 20090720 {
wifi.interface=wlan0
# MTK, Infinity, 20090720 }

# MTK, mtk03034, 20101210 {
ro.mediatek.wlan.wsc=1
# MTK, mtk03034 20101210}
# MTK, mtk03034, 20110318 {
ro.mediatek.wlan.p2p=1
# MTK, mtk03034 20110318}

# MTK, mtk03034, 20101213 {
mediatek.wlan.ctia=0
# MTK, mtk03034 20101213}

#
wifi.tethering.interface=ap0
#

wifi.direct.interface=p2p0

log.tag.ControllerManagerLogs=DEBUG

# Switching Menu of Mass storage and MTP
ro.sys.usb.storage.type=mtp,mass_storage

# USB BICR function
ro.sys.usb.bicr=yes

# USB Charge only function
ro.sys.usb.charging.only=yes

#smartvolume
ro.smartvolume.config=/system/vendor/smartvolume/tank/
ro.config.notification_sound=Verso.ogg

persist.panel.orientation=0

# maximum backup size for factory reset whitelist in kB
ro.recovery.wl.maxstore=524288

#uart kernel log
persist.sys.uart.klog.enable=n

# wifi rssi->bar thresholds
persist.wifi.rssi.thresholds=-86,-79,-68,-62

# Audio Rotation
ro.audio.monitorRotation=true

#add for 8127 stick as cec playback device type
ro.hdmi.device_type=4

# btremoted control properties
btremoted.decode.enabled=1
btremoted.plc.enabled=1
btremoted.trim_length=40
btremoted.socket=btsco_audiohal
#debug.ignore.search_intent=true

# Netflix
ro.nrdp.modelgroup=FIRETVSTICK2016

#resolution setting is AUTO (1 | 0) == (true | false)
persist.sys.resolution.auto=1

# Performance - Disable dirty region for Mali which improves fluidity
debug.hwui.render_dirty_regions=false

# Disable the shimmer on the left menu and in the 1D lists
# This flag needs to be set in addition to the low performing device setting within the Launcher apk
launcher.focusAnimationEnable=false

# Dalivik flags which optimize the memory for a low Ram device
dalvik.vm.dexopt-flags=v=n,o=v,m=y
dalvik.vm.dex2oat-filter=space
dalvik.vm.image-dex2oat-filter=speed

# HWUI flags which optimize the memory usage for a 1080p low ram devices
ro.hwui.texture_cache_size=45
ro.hwui.layer_cache_size=31
ro.hwui.r_buffer_cache_size=8
ro.hwui.dt_cache_size=200

# Disable the BackupManagerService
# disabling this in addition to taking android.software.backup out of the build is needed to stop BackupManagerService from running
ro.backup.disable=true

# Disable lockscreen by default
ro.lockscreen.disable.default=1

# Skinny process. Saves Dalvik heap space for smaller processes.
# Can save up to 20 MB
dalvik.vm.skpheapgrowthlimit=20m
dalvik.vm.skpheapmaxfree=512k
dalvik.vm.skpheapminfree=128k
dalvik.vm.skpheapstartsize=2m
dalvik.vm.skpheaptargetutil=0.95

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.com.android.dateformat=MM-dd-yyyy
ro.config.ringtone=Ring_Synth_04.ogg
ro.config.notification_sound=Verso.ogg
ro.carrier=unknown
ro.config.alarm_alert=Alarm_Classic.ogg
ro.build.lab126.buildtype=Nightly
ro.build.lab126.project=full_tank_ship_5220
ro.build.lab126.build=1641
drm.service.enabled=true
mtk_in_house_tee_support=true
ro.mediatek.platform=MT8127
persist.radio.combo.chipid=-1
ro.btstack=default
dalvik.vm.heapstartsize=5m
dalvik.vm.heapgrowthlimit=96m
dalvik.vm.heapsize=256m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=512k
dalvik.vm.heapmaxfree=2m
ro.mediatek.chip_ver=S01
ro.mediatek.version.release=ALPS.W10.24.p0
ro.textview.marqueedelay=20
debug.log.base.path=/data/debug_service
debug.log.battery.enable=n
debug.log.battery.sleep=60
debug.log.temperature.enable=n
debug.log.temperature.sleep=10
debug.log.thermal_qa.enable=n
debug.log.dmesg.enable=n
debug.log.dmesg.wakeup=0
debug.log.logcat.enable=n
debug.log.coredump.enable=n
persist.debug.wfd.enable=1
ro.mtk_wfd_support=1
ro.mtk_wfd_sink_support=1
ro.mtk_wfd_hdcp_rx_support=1
ro.sf.hwrotation=0
ro.smartvolume.config=/system/vendor/smartvolume/tank/
persist.sys.dalvik.vm.lib.2=libart.so
persist.sys.recovery.batt_level=0
ro.amazon.fosflags=1
persist.sys.ota.verified=unverified
persist.sys.last_verified_build=none
ro.logd.size.vitals=128000
ro.logd.size.metrics=128000
dalvik.vm.isa.arm.features=div
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt

And fastboot variables :

C:\Program Files\Minimal ADB and Fastboot>fastboot getvar all
(bootloader) max-download-size: 134217728
(bootloader) partition-size:userdata: 18869be00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-size:system: 35c00000
(bootloader) partition-type:system: unknown
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-size:LOGO: 380000
(bootloader) partition-type:LOGO: unknown
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-size:boot: 1000000
(bootloader) partition-type:boot: unknown
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-size:EXPDB: 1160000
(bootloader) partition-type:EXPDB: unknown
(bootloader) partition-size:DKB: 100000
(bootloader) partition-type:DKB: unknown
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: TANK
(bootloader) version: 0.5
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0x0f9ec595f8011b35
(bootloader) prod: 1
all: Done!!
finished. total time: 0.094s

And fastboot output:

C:\Program Files\Minimal ADB and Fastboot>fastboot oem get_unlock_data
...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.016s

C:\Program Files\Minimal ADB and Fastboot>fastboot oem unlock
...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.000s

C:\Program Files\Minimal ADB and Fastboot>fastboot boot TWRP_Fire5_2.8.7.0.img
downloading 'boot.img'...
OKAY [ 0.266s]
booting...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.281s

C:\Program Files\Minimal ADB and Fastboot>fastboot oem append-cmdline "androidboot.unlocked_kernel=true"
...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.016s

C:\Program Files\Minimal ADB and Fastboot>fastboot -i 0x1949 flash unlock unlock_ftv.img
target reported max download size of 134217728 bytes
sending 'unlock' (0 KB)...
OKAY [ 0.016s]
writing 'unlock'...
FAILED (remote: unlock code error)
finished. total time: 0.031s

The unlocking thread for older Fires :

http://xdaforums.com/fire-hd/development/bootloader-unlock-t3129630