yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Michajin:
I was on version 6.2.5.8 (latest) and tried the exploit. The script ran fine until the boot into fastboot mode. When it tried flashing the new recovery and boot images, the firetv was giving a access denied error. I had no issues on 6.2.5.5. I had to restore the reserve bin from the backup and it booted back up. I am thinking the exploit is still there, but doesnt work the same on 6.2.5.8.

---------- Post added at 08:50 AM ---------- Previous post was at 08:34 AM ----------

I modified the script to this to restore (created a directory called "patch" in the dist folder and placed the back up backup_reserved.bin in the folder) this is what i used to restore. placing this script in the dist in the Dist folder calling it fix.sh.

#!/bin/sh

AML_USB_TOOL=./aml_usb_mmc

AML_REBOOT_TOOL=./aml_reboot

MAGISK_PATCHER_DIR=./magisk_patcher

FASTBOOT=fastboot

echo ''

echo ' ___ _ ______ / /___ (_) /____ ___ __________'

echo ' / _ \| |/_/ __ \/ / __ \/ / __/ _ \/ _ \ / ___/ ___/'

echo '/ __/> </ /_/ / / /_/ / / /_/ __/ __/ / / (__ ) '

echo '\___/_/|_/ .___/_/\____/_/\__/\___/\___(_)_/ /____/ '

echo ' /_/ '

echo ''

echo 'AFTV Stark/Needle bootloader exploit'

echo ''

case $1 in

stark)

echo 'Platform: AFTV Cube (stark)'

RSV_EXPLOIT=exploit_stark.bin

PLATFORM=stark

;;

needle)

echo 'Platform: AFTV Pendant (needle)'

RSV_EXPLOIT=exploit_needle.bin

PLATFORM=needle

;;

*)

echo "Usage: $0 needle|stark"

echo 'needle - for AFTV Pendant'

echo 'stark - for AFTV Cube'

exit 1

;;

esac

PATCH_DIR="./patch

###############################

# Flash patched rsv block to device

###############################

echo '[-] Flash patched reserved block to device'

wait_enter

$AML_USB_TOOL -p 0 -w -s 0x12000 -c 6 -f "$PATCH_DIR/backup_reserved.bin"

if [ $? -ne 0 ]; then

RET=1

while [ "$(ask_yes_no 'Flash failed. Retry?')" = 'y' ]; do

$AML_USB_TOOL -p 0 -w -s 0x12000 -c 6 -f "$PATCH_DIR/backup_reserved.bin"

RET="$?"

[ $RET -eq 0 ] && break

done

[ $RET -ne 0 ] && abort 'Fail to flash reserved block'

fi

echo 'Flash successful. Please unplug HDMI dongle before continue!'

wait_enter

###############################

# Drop device to fastboot

###############################

echo '[-] Reboot device into fastboot mode'

$AML_REBOOT_TOOL fastboot

###############################

# Fastboot flash

###############################

$FASTBOOT reboot

else

echo '[-] User selected manual flash option. Skipping fastboot flash!'

echo 'Please use fastboot to flash the patched boot + recovery image.'

echo 'Without flashing the patch, your device will not boot.'

echo 'Since we moved the reserved parition table down 3 blocks, '

echo 'the offset in the kernel will be wrong!'

fi

echo '[-] Done!'
[Fire TV Original Android Development] Terrafaux:
I will try it, thanks.
[Fire TV Original Android Development] Terrafaux:
Sorry to say that it doesn't help.

./aml_usb_mmc -p 0 -w -s 0x12000 -c 6 -f patch/backup_reserved.bin

unplugged HDMI

./aml_reboot fastboot

fastboot reboot

So I guess I have an corrupted backup_reserved.bin file.

Any Idea how I can get the Box booting again.

Thanks
[Fire TV Original Android Development] Michajin:
Can i private message you a link to my g-drive with a zip file to run the script with my backup reserved.bin file? It will be the whole folder to run the exploit and i can do this in about 30 minutes if you like... Is it a Cube or Pendant?
[Fire TV Original Android Development] Terrafaux:
Oh yes would be nice.

Stark (Cube)

Thank you
[Fire TV Original Android Development] jbeard540:
Is this method still possible on 6.2.5.8, sorry if this has been answered tried searching the thread and couldn't find a straight answer..
[Fire TV Original Android Development] Michajin:
I couldn't get it to work, it modifies the reserve partition in DFU mode, boots into fastboot to write the boot and recovery, but flashing access is denied. I had to restore the reserve partition. I think it might work if someone knows how to update the exploit to allow fastboot flashing.
[Fire TV Original Android Development] Terrafaux:
Hi Together,

I am still have issues to get the Cube booting up again still stuck as an Amlogic Device.

So because I have no idea on which Version I was, my idea is to try with an backup_reserved.bin from any Device with 6.2.5.5.

Might someone support me with his backup bin, that I can try to understand why my backup_reserved.bin is not working.

I took a look in my file and seems not ok, after Offset 417 ist empty (00) till Offset 3145727 then again from 3276800 to end of file.

Thanks in advance.

---------- Post added at 11:52 AM ---------- Previous post was at 11:47 AM ----------

Hi could you please share your backup_reserved.bin with me. I need to understand why my cube is not coming back again so i need the backup from 6.2.5.5 and 6.2.5.8.

Thx
[Fire TV Original Android Development] 2WhlWzrd:
adb shell getprop ro.build.version.name

Will give you the current software version.
[Fire TV Original Android Development] Terrafaux:
Thanks for your post but I have just ./aml_reboot fastboot for booting into Fastboot as a command I don't even have recovery.

Seems bricked and I need from anyone backup_boot.img to try to get my device back.

Thx.
[Fire TV Original Android Development] ldeveraux:
I'm not going to read back multiple pages to try to understand your specific situation, but didn't the script take a backup for you that you can flash back?
[Fire TV Original Android Development] Terrafaux:
May I write you a pm better than I spam this thread.

Thx
[Fire TV Original Android Development] chuandinh:
I looked at the source code these are the current supported devices. Look like we need the payload_address and overwrite_address for the new firmware 6.2.5.8 to work.

exploit_stark.bin: payload.bin gen_exploit

# Tested on FW 6.2.2.4

./gen_exploit payload.bin $@ 0x73e6a228 0x77ed7f70

exploit_needle.bin: payload.bin gen_exploit

# Tested on FW 6.2.5.3

./gen_exploit payload.bin $@ 0x73e6a228 0x77ed7e08

exploit_needle_6213.bin: payload.bin gen_exploit

# Tested on FW 6.2.1.3

./gen_exploit payload.bin $@ 0x73e6a228 0x77ed7de0
[Fire TV Original Android Development] n0ryn:
Interesting

My Pendant is at 6.2.1.0 (Build NS6210/397), any chance get a working payload? I can upload Files if it helps...

sorry for my english... ;)

---------- Post added at 10:43 PM ---------- Previous post was at 10:32 PM ----------

Many times the DFU mode did´nt kick in, than i hooked everything up to my desktop pc to the USB3 ports and it worked at first try...

Unsucessfull tries was with tabletpc and arduino powerd by USB Charger... Thank you for FireFU (maybe sometime it will work for me ;))

I´m wondering if it will be possible to flash an unofficial update per DFU, maybe 6253?
[Fire TV Original Android Development] iptvsubscription:
liked

FireTV Cube and FireTV Pendant.
[Fire TV Original Android Development] chuandinh:
Can somebody PM the backup firmware after successfully rooting your device? I want to figure out why this hack doesn't work on latest 6.2.5.8 firmware. Thank you!

backup_zbootloader.bin

backup_reserved.bin

backup_boot.img

backup_recovery.img
[Fire TV Original Android Development] puppinoo:
Hi,

I was waiting for my HDMI breakout to arrive from China so I blocked Amazon updates on my router once I got version 6.2.5.5 (Build NS6255/1612) flashed successfully on my pendant cause 6.2.5.5 is the version tested witht his exploit. My breakout has finally arrived but I just read here http://www.aftvnews.com/amazon-fire-tv-fire-tv-stick-software-update-history/ that a different 6.2.5.5 build exists: 6.2.5.5 (Build NS6255/1628) discovered a few days later. Can anyone confirm which one is the correct version to flash?

Regards.

Puppinoo.
[Fire TV Original Android Development] 2WhlWzrd:
I have successfully rooted Build NS6255/1612 on my pendants. But I believe, from other posts on this thread, both versions are root-able.
[Fire TV Original Android Development] puppinoo:
Great to know.

I wonder if there's any chance there will be pre-rooted updates for the future so you can keep root but also get updates. Unfortunately the root process is so niche basically nobody will be interested in.

Regards. and thanks for info.
[Fire TV Original Android Development] puppinoo:
Hi all,

Just to confirm I successfully rooted my pendant using this procedure (Arduino Due + https://www.amazon.it/Adattatore-Breakout-Terminale-Coperchio-Connettore/dp/B01CR53EP8 + https://www.amazon.it/Cablesson-Adattatore-Angolo-Gradi-Accoppiatore/dp/B002MG01UY ).

Thanks a lot for this amazing procedure and to everybody who helped me.

regards.

Pino.

P.s.: The procedure installed Magisk 17.2 but now Magisk manager asks me to upgrade to 18.1. I guess it's not safe?
[Fire TV Original Android Development] ldeveraux:
18.1 is the latest version of Magisk. You can just update manually?:confused:
[Fire TV Original Android Development] puppinoo:
I meant to ask if it's safe to upgrade magisk on a rooted pendant or if the version embedded in the firmware is mandatory and cannot be changed.
[Fire TV Original Android Development] ldeveraux:
I think you're safe. Don't quote me on that.:p
[Fire TV Original Android Development] puppinoo:
Since I actually dunno how to recover if something bad happens I guess I'll stay with 17.2 version. It works fine. I'd really wish to see pre-rooted roms though or at least a tested custom recovery. This procedure is too niche.
[Fire TV Original Android Development] liolka:
---------------------------------------

sending 'boot' (16384 KB)...

OKAY [ 1.844s]

writing 'boot'...

FAILED (remote: blocked command)

----------------------------------

please help, why blocked command? locked bootloader? now my firetv 3 always starting in fastboot mode :( can't write recovery and boot.. i run script, succesfuly backuped, but when start write i got this error.
[Fire TV Original Android Development] ldeveraux:
Buy a known good USB cable:good:
[Fire TV Original Android Development] liolka:
i try already 3 random cable, same results. :(

Fire OS 6.2.5.8 (NS6258/1607)

Fire TV Home version

6.1.2.0-261
[Fire TV Original Android Development] ldeveraux:
Which Arduino are you using? More people have had success with the Due than another or generic board. How is your board identified with lsusb? Amlogic?
[Fire TV Original Android Development] liolka:
Yes, Arduino DUE, identified Amlogic, when script run, all backup successful, patching success, then promt remove hdmi, then rebooting to fastboot mode, (checked with lsusb in other terminal window), then script try write from fastboot patched_boot.img then i got this error. ubuntu 16.04.

after this fail, atv not booting, runing in fastboot mode.

then i boot to Amlogic mode, and manualy write backuped reserved.bin file

./aml_usb_mmc -p 0 -w -s 0x12000 -c 6 -f backup_reserved.bin

after that ATV starting.

I think patch dont work in latest version NS6258/1607 :(
[Fire TV Original Android Development] Michajin:
I had this when i ran the script on the updated OS, it does not work on that. I had to restore my backup reserved-bin file.
[Fire TV Original Android Development] puppinoo:
EDIT: I confirm I still can go into fastboot mode:

aml_reboot recovery doesn't seem to work:

sudo ./aml_reboot recovery

unknow reboot mode

but after:

sudo ./aml_reboot fastboot

I get:

sudo fastboot devices

G070NR0874150UEP	fastboot

So it seems to work but I just dunno what/if I can I erase / format without screwing up even worse. Maybe I can erase or format userdata? I don't care if I lose my data if I can recover the device.

I hope anyone could help.

Since I'm an idiot I decided to test many different Google apps versions on my rooted Pendant. Unfortunately one of these combinations caused a bootloop. Now basically the device never passes the white screen with orange arrow and reload it again and again. Is there a way to solve this? I think I just need to remove the google services apk. Or maybe even remove the data partition. Now it's late so I cant test but I guess I can go back in DFU mode and I still have all the backupped binaries created by this procedure but not sure if they can be reflased and if so they can be of any use.

Thanks for any advice.

Pino.
[Fire TV Original Android Development] Michajin:
All i can think of is a factory wipe cache from fastboot ( fastboot erase cache) if you can get into it (i believe should be able to get into fastboot with some modifying of the exploit script) if this doesnt work then a full data wipe. ( fastboot erase data). Upon start up you might be forced into upgrading with the data wipe (if it lets you).
[Fire TV Original Android Development] puppinoo:
Thanks for replying me.

I confirm I can get into fastboot so I'd really like to recover without losing root if possible.

I'll try the "erase cache" option. Maybe first I could try the fastboot boot patched_recovery.img? Is that recovery functional? What I just need is to enable adb server so I can unistall the offending apk. I'm not in a hurry so since I'd really wish to save root I want to be sure not to get things worse. If adb is not possible I'll try to erase /data but if as you say I'll have to factory reset it will be my last resort.
[Fire TV Original Android Development] Michajin:
If you have to wipe the Data, then what i would do is connect to a really slow network (i use my tethered cellular network) register it, once it gets to home, kill power before the update is downloaded or shut off the hotspot. Turn on adb then reboot, run the exploit script complete. THen reboot and block updates with the ADB commands to uninstall or disable. If you uninstalled these with root then they should still be gone, but if you disabled, i believe they will re-enable on data wipe.

---------- Post added at 03:49 PM ---------- Previous post was at 03:37 PM ----------

You can try to boot into recovery, but im not sure how to use commands in it. I couldn't do anything from recovery. I don't think your recovery or boot images are corrupt.
[Fire TV Original Android Development] puppinoo:
Thanks a lot for advices.

i've just been able to "fastboot boot recovery.img" where recovery.img is TWRP for S905x cpus. So I'm into TWRP. Unfortunately I need a mouse to navigate. Not sure if using this TWRP can solve (I could maybe use integrated File explorer to delete /app/* apks and /data/data/* data folders). I probably need a OTG Adapter Cable to be able to connect mouse and keyboard but I'm really not sure. I'll make some test tomorrow.
[Fire TV Original Android Development] Michajin:
interesting. Where did you download it from? i have a OTG cable and would like to check it out some.
[Fire TV Original Android Development] puppinoo:
I found it here:

If you decide to test it please let me know if you can use it with a mouse and if so if you can remove apk using integrated File explorer.

I didnt flash it. I just booted from it. It could brick stuff if used improperly so be very careful.

Regards.

https://xdaforums.com/android-stick--console-computers/amlogic/amlogic-s905x-s912x-faq-backup-switch-t3752897

Exact link should be https://xdaforums.com/attachment.php?attachmentid=4426811&d=1519210044
[Fire TV Original Android Development] Michajin:
Well i flashed it to get access to it. I couldn't ADB/fastboot with OTG. I tried the mouse function in shell and couldn't get it to work (mouse in shell is what is used on the firestick1). I flashed it over my recovery and while it worked, the TWRP doesn't do anything, just errors on trying to backup or wipe caches. But on the bright side i we can flash a replacement recovery without bricking, i just don't know much about how to make it work. Maybe someone someday will make a functional recovery, but since so few of us are rooted, who knows....
[Fire TV Original Android Development] retyre:
TWRP

If you're looking for TWRP (for needle and, possibly, stark) look at the new thread in the forum.
[Fire TV Original Android Development] Michajin:
post #173

it is a good TWRP and backed up everything. Seems very promising....!
[Fire TV Original Android Development] puppinoo:
Thanks both. Great news. I'm waiting for the OTG cable to be delivered. In the meantime I just have to understand how this could solve my specific bootlop issue. The options I could think of:

1) Find a way to make adb work and uninstall offending apk.

2) use the integrated File explorer to manually remove the /data/app/ offending apk and the /data/data/ apk folder.

3) (extreme and risky measure#1): Use fastboot to overwrite userdata and maybe cache partition with working ones (hoping to find any since I don't actually have one) hoping it then boots?

4) (extreme and risky measure#2): Simply erase or format /data and /cache partition hoping it then boot.

P.s.: I'd really wish NOT to lose root. I can buy another working Pendant but I need magisk on it.

Thanks for any help.
[Fire TV Original Android Development] smashedpumpkins:
Has anyone performed this on an Insignia NS-24DF310NA19 24-Inch 720p HD Smart LED TV- Fire TV Edition with Fire OS 6.2.5.0 (NS6250/1209)? It doesn't appear so but the version is prior to the 6.2.5.5 others have used.

Amlogic-T950Y - https://developer.amazon.com/fr/docs/fire-tv/device-specifications.html?v=ftveditioninsigniahd
[Fire TV Original Android Development] puppinoo:
Hi again,

Just received my OTG cable but when I try to use it to enable the fastboot exploit the procedure fails cause the usb hub gets immediately disconnected. My Pendant bootloops so I cant use the adb to reboot in recovery. I used fastboot to flash the twrp provided by retyre. Any idea how to force the pendant into that recovery without adb and without using exploit to go into fastboot mode? Tried suggestions on this (very old) guide http://www.aftvnews.com/how-to-unbrick-and-prevent-bricking-an-amazon-fire-tv/#toc3.1 . Keyboard and remote methods. None worked.

[149433.866586] usb 2-1.6: Manufacturer: Amlogic

[149453.031554] usb 2-1.6: USB disconnect, device number 37

Ps.: Could anyone be so kind to provide an empty "userdata" and "cache" partitions I could flash using fastboot?

Thanks for any help / advice.

Pino.
[Fire TV Original Android Development] vasir13:
Thank you guys for all the hard work. Quick question. Does this process work with:

adb shell getprop ro.build.version.name

Fire OS 6.2.6.0 (NS6260/1840)

Should I even try it?

Thanks in advance!
[Fire TV Original Android Development] 2WhlWzrd:
I think the exploit was patched about version 6.2.5.8
[Fire TV Original Android Development] vasir13:
Thx wiz. In this case is there a way to "downgrade" in fastboot mode?
[Pixel C Q&A, Help & Troubleshooting] fschlage:
Hi

My good old Pixel C stopped working (display not working anymore) so i'm looking for advise on what to buy instead ..... 95% of my tablet use is Clash of Clans, 5% web surfing and small apps.

Have been looking at the new Pixel Slate, but its running Chrome OS, and as far i have found, it is not always easy to have android apps running on Chrome OS. (SuperCell, producer of Clash of Clans, is also restricting user to run Clash of Clans on emulates and other devices than Non rooted android / IOS)

So i'm looking for a tablet with minimum 10" display, and have the power to run Clash of Clans. I have been looking at Samsung, and Huawei, but i'm actually considering buying a used Pixel C, for about 350 USD , is this totally crazy ?
[Pixel C Q&A, Help & Troubleshooting] locuturus:
I will happily opine that all these years later there isn't an overall clearly better tablet out there in Android land so far. There are tablets which do certain things better but none are obviously faster to the user, none are more premium in build, only a few have a better display, few or none have better battery, few or none have functional Pie roms, and if I'm not mistaken any new tablet that could compete on the main features will cost more than a used Pixel C.

I don't think you are crazy to consider it :)
[Pixel C Q&A, Help & Troubleshooting] badwiring:
At this point 350 seems a little steep.

On the other hand, my Galaxy Tab S3 will only charge when it's turned off because of supposed moisture in the port that apparently lasts forever. So the Pixel C has been my primary tablet. Although I like the S3s haptic feedback and GPS the Pixel C is still awesome.

I also wonder if it will be the last great tablet with a headphone jack.
[Pixel C Q&A, Help & Troubleshooting] Create God:
You may not know that its price in China is only 850 yuan, equivalent to 122USD, of course, this is second-hand price.
[Pixel C Q&A, Help & Troubleshooting] 4everAnoob:
Go even crazier, get a Nexus 9 like I did!
[Asus ZenFone Max Pro M1  Questions & Answers] manas4938:
After the latest ota update I tried to enable camera2api in my device but when I enter the command it shows some error. Here is the screenshot.
[Asus ZenFone Max Pro M1  Questions & Answers] Anirudh Kartik:
Uninstall and reinstall fastboot drivers.
[Asus ZenFone Max Pro M1  Questions & Answers] manas4938:
Thanks man!! It works!!
[Asus ZenFone Max Pro M1  Questions & Answers] Anirudh Kartik:
Welcome, hit thanks instead of saying it next time ?
[Samsung Gear S2] JoshSnitz:
I'm getting daily notifications with the weather for the day that I want to turn off. The watch is not connected to a phone. Any idea what's going on?
[Nexus 6P Q&A, Help & Troubleshooting] Dallas64au:
Hello old friends,

I would love some help. My beloved Nexus 6p has a broken screen. I think it's still accepting touch input, but I cannot see anything.

Everything else works. I'm trying to connect via ADB so I can get some control, but it says the device is unauthorized. I've been googling trying to solve the issue for a few hours, but even following guides and a otg-usb keyboard I cannot enable usb-debugging as the menus seem to be different.

The phone is running a stock android 8.0 (or 8.1 maybe) but is rooted.

Could someone either a) tell me exactly what to press on the usb keyboard once I've unlocked the phone via fingerprint or

b) suggest a better idea

Thanks very much!
[Xiaomi Mi A2 Lite Questions & Answers] HoangP05:
I randomly go through the setting today and i found setting for gesture including double tap to check phone, swipe fingerprint for notification, lift to check phone beside the old double press power button to launch camera. This is the first time I see these gesture appear, but none of them working
[Xiaomi Mi A2 Lite Questions & Answers] mytowyn:
October update ?
[Xiaomi Mi A2 Lite Questions & Answers] aasiaasi:
This Option Doesn't Appear In My "MI Xiaomi A2 Lite" As It Is Already Updated On October Patch.
[Xiaomi Mi A2 Lite Questions & Answers] Bokoko006:
I dont see this in my settings too:(. I think it has to do with where your country is
[Xiaomi Mi A2 Lite Questions & Answers] HoangP05:
Im still on September update with magisk installed, but i have no module related to this. I'm currently in the US
[Xiaomi Mi A2 Lite Questions & Answers] thorin0815:
No new gestures in Germany with October patch.
[Xiaomi Mi A2 Lite Questions & Answers] p3108:
Got swipe fingerprint in UK but not others. I have an imported device that has double tap to wake screen hardware which by default is switched on and can't be turned off (yet here). Not complaining, I like the feature.
[Xiaomi Mi A2 Lite Questions & Answers] katoda_ltd:
Gesture with fingerprint reader appears after second November update (~50MB size). Lift to check and double tap to check - never seen them. BTW I have the device with double tap to wake which could not be switched off, the same situation as [MENTION=8330199]p3108[/MENTION]
[Xiaomi Mi A2 Lite Questions & Answers] S.S.Gohan:
By chance what's the build number you have? I have two Lites on different builds, both on the November patch, only one has the options for swipe and jump to camera. The other only jump to to camera
[Xiaomi Mi A2 Lite Questions & Answers] mikomut:
you need have OPM1.171019.019.V9.6.11.0.ODLMIFF which is 2nd november patch, with lower version there is no option for finger print gestures.