[Fire TV General] tgellen:
[UPDATE #1] I've added a zip file with the 2 scripts, with UNIX line endings :), as suggested below by [MENTION=6927761]aftv[/MENTION]News . Cheers.

[UPDATE #2] I've added a zip file with the 2 extra scripts to go into /etc/init.d, as requested by [MENTION=3549022]Axecaster[/MENTION] . These will need the same ownership and permissions as enableotg. They disable SELinux and set the permissions on the recovery directories. Cheers.

Having had a look around the android image on my Fire TV Stick (v1) [ FireOS 5.2.1.1 [MENTION=3991724]rbox[/MENTION] ] I found that a script, which doesn't exist, called /system/bin/factoryadb.sh was being run by /init.build.rc on boot.

I was able to create a simple script to run scripts in /etc/init.d on boot.

UPDATE (05/04/19): Now I've got root access on my FireTV Gen 2 [ FireOS 5.2.6.9 ] I can see the see these instructions will also work, although the OTG enabling is not needed ;)

NOTE: I've only tested this on a 1st generation Fire TV Stick but may work on Fire TV boxes if they also call /system/bin/factoryadb.sh from /init.build.rc

Before you do this please make sure factoryadb.sh is

NOT

on your FireTV and that it is called from /init.build.rc by connecting to your FireTV via adb and running the following commands

adb shell
su
grep factoryadb /init.build.rc && ls -l /system/bin/factoryadb.sh

Hopefully this will return

service factoryadb /system/bin/factoryadb.sh
/system/bin/factoryadb.sh: No such file or directory

Now continue ...

My factoryadb.sh script

#!/system/bin/sh
#
# Execute all scripts in /etc/init.d

if [ -d /etc/init.d ]
then
for f in `ls /etc/init.d/* 2>/dev/null`
do
if [ -s ${f} ]
then
echo Executing ${f} ... >/dev/kmsg
/system/bin/sh ${f}
fi
done
fi

NOTE: Make sure this file has UNIX line endings only. Notepad++ has an option to specify UNIX line endings.

I also have a simple script to enable OTG which I called enableotg, again MUST have UNIX line endings.

#!/system/bin/sh
echo 1 > /sys/devices/platform/bcmpmu_otg_xceiv/host

Connect to the Fire TV Stick via adb and run the following commands

adb push factoryadb.sh /sdcard/
adb push enableotg /sdcard/
adb shell

su
mount -o remount,rw /system

mkdir /etc/init.d

cp /sdcard/factoryadb.sh /system/bin/
cp /sdcard/enableotg /etc/init.d/

chown 0:0 /system/bin/factoryadb.sh /etc/init.d /etc/init.d/enableotg
chmod 755 /system/bin/factoryadb.sh /etc/init.d /etc/init.d/enableotg

mount -o remount,ro /system
reboot

When the FireTV Stick has rebooted then reconnect via adb and run the following commands

adb shell
su
dmesg | grep -e factoryadb -e Executing -e bcmpmu

You should see something similar to

<6>[ 3.005279] bcmpmu_otg_xceiv bcmpmu_otg_xceiv: Probing started...
<6>[ 3.007690] bcmpmu_otg_xceiv bcmpmu_otg_xceiv: Probing successful
<3>[ 4.998016] init: Warning! Service factoryadb needs a SELinux domain defined; please fix!
<4>[ 5.573242] Executing /etc/init.d/enableotg ...
<6>[ 5.579040] bcmpmu_otg_xceiv bcmpmu_otg_xceiv: Switching to Host

All is working and OTG should be working about 5 seconds after leaving the TWRP screen and long before Android has finished booting.

If you have an ethernet dongle attached it should have an IP address before the launcher starts :)

NOTE: The SELinux warning can be safely ignored.

Hope this helps.