yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] brick00444:
I don't know about the recovery. It would be nice but I will wait patiently. i'm also hoping for an exploit for the new 4k stick. I check in on here a couple times a day just to see whats new. Thank you to everyone that makes these things possible.
[Fire TV Original Android Development] ali387:
Pendant not going into DFU mode

I have been trying to put my FireTV pendant into DFU mode for last several days but have not been successful. My device has Fire TV OS version 6.2.5.5 (1628).

I have the Arduino DUE and HDMI breakout board mentioned in #18 by retyre.

I have followed the steps exactly as listed by retyre in post #18. Thanks retyre.

After many tries, all I get is lab126, Inc. message in lsusb output.

I am powering Due board with power adapter (9volts, 1 amp output). I have used several other power sources as well but no success ( 9v/0.85 amp power adapter; 5volt/1amp usb phone charger etc)

I have two questions:

1. Does FireFu exploit still work on pendant with 6.2.5.5/1628?

2. How can I confirm that the Wire.OnReceive and Wire.OnRequest events are firing when I connect usb cable to the pendant and PC? ( I initialized serial output and added println statement inside receiverequest function. It appears that onreceive event never occurs in my case; nor does onrequest event fire)

I hope someone on this can help me out. Thanks.
[Fire TV Original Android Development] brick00444:
I can answer the first question. Yes it does work with 6.2.5.5/1628.

Sorry no help on the second question.
[Fire TV Original Android Development] ali387:
Thanks for your response. and confirmation. I do have a request for you: Can you please tell me the power output of the samsung USB wall adapter you connected to your DUE board? Also which USB connector you used (Native one or the programming one). Thanks.

Just to add: I am doing all this on Ubuntu 16.04 and I have programmed Due board using Arduino 1.6.1 IDE. Done all steps multiple times on two different PCs (physical boxes, no VMs). I have also done continuity check from DUE pins to connecting wires to HDMI breakout boards output lines and all is good (0 resistance on ohm meter).
[Fire TV Original Android Development] brick00444:
The output of the usb wall adapter is 9.0V -1.67 A or 5.0V - 2.0A. I used Programming Port and Programmer is Arduino as ISP. Also I flashed the Arduino in Windows 10.
[Fire TV Original Android Development] ali387:
Thanks. Prior to switching to Ubuntu 16.04, I did flash DUE from windows 7 machine. Then I re-flashed DUE from Ubuntu machine.

I will re-check the programmer setting. I do remember that I did not anything for programmer. I only checked Board and Port settings.

I will report back once I retry it with programmer setting you used.

---------- Post added at 06:27 PM ---------- Previous post was at 05:37 PM ----------

I re-programmed my DUE with programmer under tools menu set to "Arduino as ISP". Same result. Showing up as Lab126, Inc. :confused:

Next I will verify that my DUE board has functioning I2C feature. I have a UNO R3 board that I will use in combination with DUE board and verify that I2C functionality is working.

Learning is good but did not think that I will have to put in this much effort to root the pendant. :) (not to mention the cost of the items). It is fun though.
[Fire TV Original Android Development] brick00444:
I agree its fun when your achieve the goal and frustrating when you can't figure out what is stopping you. I'm convinced alot of it is the power supply, because I tried everything you are doing and when I finally switched to the samsung adapter it works everytime. Good luck.
[Fire TV Original Android Development] ali387:
Tested DUE as slave and UNO R3 as master for I2C communication verification. DUE is receiving data sent from uno fine. OnReceive event fires.

I will continue working on it.

I wonder under what condition Pendant device initiates the communication on I2C? I attach the usb to the fire TV device at the very last step as mentioned in the original post.
[Fire TV Original Android Development] ali387:
Eureka !!!!

Finally Amlogic showed up.!!! :)

Maybe it was the timing. Only difference is that I used a shorter USB cable from pendant to the PC. (the cable which came with DUE) Also make sure that wires connecting DUE and HDMI breaker boards are short and not too close to each other.

Any way I am running the .sh script. It is running lets see how long it takes to root it. (it took 40 minutes in my case)

Thanks to everyone who has contributed to this thread. Every experience you entered helps the next person in their rooting effort. Appreciate it.
[Fire TV Original Android Development] PeterLustig:
I used my DUE Clone without a usb wall adapter and it just worked fine.
[Fire TV Original Android Development] ali387:
Awesome!!! Did you attach it to PC USB connector or used a DC power adapter?

Another thing to keep in mind is after after powering DUE wait 5 seconds or more and then power up the Fire TV pendant or Cube. That gives time to DUE board to boot up and initialize.

Before I was powering up the DUE board and immediately powering the Fire TV and that would not go into DFU mode 100% of the time.

Once I delayed powering up the Fire TV by 5 seconds, it goes into DFU mode 100% of the time.
[Fire TV Original Android Development] ldeveraux:
Anyone else randomly stuck on the FireTV boot screen? Checked my Cube this morning, the blue lights are moving on the front and it won't boot. I blocked OTA updates when I initially rooted, any chance it tried to install the new update and failed? How to fix, do I need to go through the procedure again?
[Fire TV Original Android Development] ali387:
I just checked my rooted cube, it is still on 6255/1628 version and working fine.

When I cursor (no click) down to check for update, I see the status for "Last checked date" as "Checking ..."

I am assuming you have already powered it off for a while and then rebooted.

The exploit page does say that we may have to re-do the process if any issues occur after an update.
[Fire TV Original Android Development] ldeveraux:
That's what my pendant says, but the Cube won't get past the FireTV boot screen. Is there a way to factory reset the Cube? Rather than try to root it for the 3rd time, maybe I'll just leave it alone this time...

edit: I can't even boot into safe mode by holding the volume down while powering on.
[Fire TV Original Android Development] ryknow27:
Just curious but, since there is no custom ROM for the cube that I'm aware of, what are some of the advantages of going through this process and rooting the cube?
[Fire TV Original Android Development] Michajin:
ok, i got a used fire tv pendant today. For some odd reason i did't boot it up and update, verify the version it was on. I started the exploit. It got to the unplug HDMI and reboot into fastboot. i unplugged and it just sat there saying waiting for device. I plugged it into to a montor and found it at a recovery screen with "no command" on it. I can not find a way to get it to boot into fastboot mode. i have run the ./aml_reboot fastboot from the amlogic connect, but it boots to recovery not the bootloader. Anyone have any idea how i can get it back into fastboot mode?
[Fire TV Original Android Development] brick00444:
When you get to the part where it is waiting for device open another termnal window and use the commands "sudo fastboot flash boot patched_boot.img" and "sudo fastboot flash recovery patched_recovery.img". I had to do that to one of mine.
[Fire TV Original Android Development] Michajin:
I'll give it a shot, but it wasnt even booting into fastboot. It rebooted into recovery. Running the exploit script now. should have about 20-30 minutes left...
[Fire TV Original Android Development] ldeveraux:
So nobody knows how to return to stock on these devices??
[Fire TV Original Android Development] Michajin:
ok done, <Waiting for device> is all it says. It wont boot into fastboot.

---------- Post added at 04:27 PM ---------- Previous post was at 04:18 PM ----------

from fastboot you flash back the original Boot.img and recovery.img. I just cant get back into fastboot, i think i ran the script on an older version....
[Fire TV Original Android Development] brick00444:
Did you try to open another terminal window and "lsusb" see if it shows "18d1:0d02 Google Inc. Celkon A88". If it does then type "sudo fastboot flash boot patched_boot.img" then "sudo fastboot flash recovery patched_recovery.img". It should work.
[Fire TV Original Android Development] Michajin:
Only Amlogic shows up, if i power cycle nothing shows. If i put the HDMI on a monitor it shows a recovery screen. It wont boot into fastboot for some reason. Keep in mind this was the 5 fire i rooted VIA the exploit. I just didn't let it boot before i tried it, i think i need to use the backs up, but i cant figured out how to put them in VIA the DFU mode.
[Fire TV Original Android Development] brick00444:
As long as you see Amlogic then restart the exploit when it gets to the part where it says "waiting for device" leave that terminal window open and open another terminal window and type "lsusb". If you see "18d1:0d02 Google Inc. Celkon A88" then you should be able to run the commands I showed earlier. Hope this helps.

P.S. Don't plug the hdmi into a monitor anything after unplugging via directions.

Sorry didn't read your last post thoroughly, I don't have any idea how to recover without having fastboot.
[Fire TV Original Android Development] xXhighpowerXx:
Since the exploit changed the reserved partition table, you need to flash the patched boot image to able to boot successfully. Otherwise it will just hung at splash screen. But there was a recent FW update roll out for the cube. I'm not sure if this got patch or not. If you can open it up and connect UART to the board we can debug it easily. There is 3 pin unpopulated header on the board, it is TX, RX, GND

If you want to go back to stock, you need to use fast boot to flash the original boot.img and recovery.img. Then enter DFU and flash back the original reserved partition table.
[Fire TV Original Android Development] ldeveraux:
I think the bigger issue is that disabling OTA didn't appear to work! It still checked, downloaded, then tried to apply it, causing the stick. So I need to try to get back to fastboot and flash boot.img? Or the recovery?
[Fire TV Original Android Development] Michajin:
My others fireTV's blocked the updates just fine. I don't understand why you had issues, i couldn't check for updates and even tried to update, it jsut errors because the programs fro checking are disabled on mine. maybe something didn't quite disable on yours...

---------- Post added at 08:14 AM ---------- Previous post was at 08:06 AM ----------

I cant get into Fastboot to flash. I am using the pendant, i suspect it was on an older OS because i didn't update.

Just to clarify, The OTA is blocked, i have tested and just get errors when looking for the updates and The Exploit works on the newest OTA. I had 2 pendants i was updating yesterday. The first one i registered, updated everything to the latest ran the exploit and everything went normal. The 2nd one i made a mistake and didn't update. Ran the exploit, when it got to the point of remove HDMI for it to reboot into fastboot, it just says waiting for device. I tested the device and no drivers show up for it (no amlogic or Fastboot), i plugged it into a monitor and it shows a amazon fire screen with <no command> on the screen. I suspect this is a recovery screen.

I have no idea on how to use UART or the board as a debugging tool. I am also completely new to Ubuntu. I mean if you can help great, but i dont want to bother you (i caused this issue and the exploit is awesome)

I think i need to enter DFU and flash back the original reserved partition table first to maybe give me access to fastboot again? The exploit stopped when running the aml reboot fastboot and just hung on <waiting for device>. I would think my boot and recovery are still the original because i never made it into fastboot.
[Fire TV Original Android Development] ldeveraux:
That's exactly what it was. I went through the rooting process again and I got back to the main screen, I think it actually updated though. I'm on 6.2.5.7/1658, which is the newest? I made sure to use a rooted ADB this time to disable OTAs and they all disabled. Checking for update gives me an error, so it looks like it worked. I'm back online!

You should be able to DFU and run the root process again which would get you back online. I'm not sure you need to go so far as flashing the original boot.img and recovery.img, assuming you can still get in through the HDMI?
[Fire TV Original Android Development] Michajin:
i would flash the original .img's if i could get into fastboot. I can get into DFU, it tries to reset to fastboot, but goes into recovery. Nothing will connect in that mode... I think i need to flash back the original reserved partition table to get back online. Without fastboot I'm screwed and don't know enough about DFU flashing to restore...
[Fire TV Original Android Development] brick00444:
My first try at rooting the pendant ended after I unplugged the hdmi then "waiting for device". I couldn't get it into DFU mode either. When I would try to boot it would freeze at Amazon logo and go no further. I tried many times and it would not get passed the amazon logo. Then I switched power adapters and went with a shorter usb to the pendant and it would show up again as "Amlogic" and was able to flash. I guess what I'm saying is try every power adapter and usb cord you might have. Nothing lost except time. Seems like they can be finicky.
[Fire TV Original Android Development] Michajin:
i can get into DFU mode all day long... i have tried different USB cables to the pendant, it is booting to a recovery partition with "no command" on the screen. It will not boot into fastboot mode. This is the 6th device i am rooting, the only variable was i forgot to update to current Fire OS (I'm dumb, lol). it cant get into fastboot...
[Fire TV Original Android Development] brick00444:
Understood, Just trying to throw something out to try because so many people helped me on here. I've done dumber things, lol. Good Luck
[Fire TV Original Android Development] Michajin:
Thank you for trying, I am looking for someone to help to fix the partition from DFU mode. This was an extra pendant so i dont really care if i brick it, i enjoy the challenge... Been trying exploring this weekend with another one trying to get Gapps installed, and recovery stuff without any luck.....
[Fire TV Original Android Development] brick00444:
I enjoy just trying to achive what people say can be done. Once I figure out how to do it (with alot of direction lol) I get bored with it. I try just about everything on here.
[Fire TV Original Android Development] PeterLustig:
Does anyone know how to upgrade Magisk properly on the needle?
[Fire TV Original Android Development] Michajin:
i can get into DFU mode all day long... i have tried different USB cables to the pendant, it is booting to a recovery partition with "no command" on the screen. It will not boot into fastboot mode. This is the 6th device i am rooting, the only variable was i forgot to update to current Fire OS (I'm dumb, lol). it cant get into fastboot... The script never send the command, but fastboot never happened.

Does anyone now how to "flash back the original reserved partition table" from DFU mode?

Thanks,
[Fire TV Original Android Development] Michajin:
I am hoping the OP makes a restore script. I tried to update another on the newest version to test, but this one doesn't work with the exploit, but lets you change the reserve partition....
[Fire TV Original Android Development] Michajin:
Anyone know how to restore the backups and un-root in DFU mode?
[Fire TV Original Android Development] Michajin:
Anyone?
[Fire TV Original Android Development] retyre:
Have you looked at the exploit script (install_exploit.sh)? For example, here's how boot is being backed up:

$AML_USB_TOOL -p 0 -r -s 0x16800 -c 0x8000 -f "$BACKUP_DIR/backup_boot.img"

Next, here's how the patch is being written back to the device:

$AML_USB_TOOL -p 0 -w -s 0x12000 -c 6 -f "$PATCH_DIR/patched_reserved.bin"

With the above in mind, have you tried writing back the backed-up boot.img (by repeating the command with a -w instead of -r)?

./aml_usb_mmc -p 0 -w -s 0x16800 -c 0x8000 -f backup_boot.img
[Fire TV Original Android Development] Michajin:
Thanks for the help, rewriting the exploit to look at the right directory and flash the backup-reserve.bin did the trick. I deleted most the script to only basically what i needed and 2 minutes they are both back online. It looks like the exploit still works for the newest version because i can still get into DFU mode and still write to the reserve bin, but this script doesn't work right anymore. Thanks for you help! The part i missed was the location of the .bin file because of the date/timestamp dir in the code. I made it look at the directory "patch" and look for the backup.bin.
[Fire TV Original Android Development] Jaredsk74:
Considering trying this on a TV with an Amlogic T950Y although I only have an Uno
[Fire TV Original Android Development] 2WhlWzrd:
For the record, what version of the firmware is on this device? So it may be confirmed the ability to fastboot was patched.
[Fire TV Original Android Development] Michajin:
version 6.2.5.8

When booting into fastboot from DFU mode durign the expoit script, it has flash access denied. But the reserve partition can still be modified. It reads the boot.img and recovery.img and patches them, but without fastboot flash access it doesnt work.
[Fire TV Original Android Development] retyre:
The exploit uses aml_usb_mmc (not fastboot) to patch the reserved block. Are you saying the ability to write back boot and recovery _using aml_usb_mmc_ has been patched?
[Fire TV Original Android Development] Michajin:
Once the tool is complete (copying and modifying the boot and recovery saving to the patched folder, then modifying the reserve block, it sends a command to boot into fastboot to flash the boot and recovery. It says all successful at this point. Then boots into fastboot to flash the images, then it errors saying access-denied. The patching of reserve is available but fastboot is blocking flashing at this point. You can still patch the reserve and restore your backups it DFU mode. I'm pretty new to this, i hope this makes sense.

###############################

# Drop device to fastboot

###############################

echo '[-] Reboot device into fastboot mode'

$AML_REBOOT_TOOL fastboot

###############################

# Fastboot flash

###############################

if [ "$FASTBOOT_FLASH" = 'y' ]; then

echo '[-] Fastboot flash patched boot image'

wait_enter

$FASTBOOT flash boot "$PATCH_DIR/patched_boot.img"

[ $? -eq 0 ] || abort 'Fail to flash boot image'

echo '[-] Fastboot flash patched recover image'

wait_enter

$FASTBOOT flash recovery "$PATCH_DIR/patched_recovery.img"

[ $? -eq 0 ] || abort 'Failed to flash recovery image'

echo '[-] Reboot...'

$FASTBOOT reboot
[Fire TV Original Android Development] retyre:
As I wrote earlier, read the exploit script, try to understand the commands, and execute them manually. The patched boot and recovery images are located in the patch-* directory. Just like you patched the reserved block, try to write back the boot and recovery blocks:

./aml_usb_mmc -p 0 -w -s 0x16800 -c 0x8000 -f /path/to/patched_boot.img

./aml_usb_mmc -p 0 -w -s 0x1F000 -c 0x8000 -f /path/to/patched_recovery.img

If it works, there's no need for fastboot.
[Fire TV Original Android Development] Michajin:
I will give it a try, I dont understand why the script would use fastboot if you can just write from DFU mode. I thought the modifying reserve block gave access to fastboot flashing. All exploitee script refers to modifying the reserve block and then going into fastboot. I am just worried that now i have recovered both of my firetv3's to work again, this would risk a hard brick. I have a couple that are fully rooted to play with. Maybe i will play around with it and see if i can root the version 6.2.5.8 with your suggestions, i am pretty sure i can fix them if somethings goes wrong with them.
[Fire TV Original Android Development] 2WhlWzrd:
To be clear, after connecting the device and checking with:

lsusb

and the device shows up as Lab126, you then ran:

fastboot reboot-bootloader

and then checked again with:

lsusb

and the device then shows up as Amlogic?

The first couple of these devices I did, rooted without issue. But I have another one that is being stubborn and won't go into DFU.

Also did you have to run the command as root (with sudo)? I just want to make sure I am understanding correctly what you did.
[Fire TV Original Android Development] Michajin:
My issue wasn't DFU mode, i was on different OS versions. On version version 6.2.5.8 it would see Amlogic run the script then reboot into fastboot (lab126), but had fastboot flash access denied. The other one was an older version of the OS (unknown version but i didn't update it and it was off a fresh factory reset from ebay, this one would read amlogic run the script and not be recognized by lsusb (nothing there). It was in android recovery, with the dead droid and "no command"

Both units i restored the backup reserve.bin and both are working again.

I never had to run any script with sudo, but i seen another user did in fastboot to flash. Are you on version 6.2.5.3? This is the only version i have got root to work on. I had issues originally with DFU mode, but swithed power supplys and ports on the arduino then every time i got into DFU. If you are seeing Amlogic, you are in DFU mode.
[Fire TV Original Android Development] 2WhlWzrd:
All of the devices I have rooted so far, and the one I am having issues with, have firmware 6.2.5.5 (NS6255/1612). Which is the version the exploit was first used on.

But this one shows up as Lab126 instead of Amlogic as the others have, so no DFU. Repeatedly connecting and powering the device in an attempt to root is not very efficient.

My power supply is fine. I have been using the programming port and running commands as root as recommended in the guide, but I will look into giving the native port a try later.
[Fire TV Original Android Development] Michajin:
Just a thought, maybe try one of the ones you have rooted before and see they they still go right into DFU mode. The first one i rooted wouldn't go into DFU mode then finally did when it did a reboot from fastboot. I ran a ADB reboot bootloader from the OS, then ran fastboot reboot-bootloader from fastboot, then after that i was in DFU mode. After the Fastboot reboot bootloader i never had any more issues with that one. I did switch ports, try different cable, etc... but it seems the reboot from bootload finally kicked it into DFU mode...
[Fire TV Original Android Development] Terrafaux:
Hi Together,

I don't know what I did wrong but I've follwed exactly every step for running

install_exploit.sh

but it still stuck at Bootlogo.

Also tried

FASTBOOT flash recovery patched_recovery.img

No luck

./aml_usb_mmc -p 0 -w -s 0x16800 -c 0x8000 -f backup_boot.img

No luck

The device boots as Amlogic and have no issues there but something is totally wrong and I have no further idea.

I can't check the Backup Hash if it is inconsitent because there is no reference Hash for proof.

Is it possible to use any Stock Boot//Recovery Image for Cube if yes is there any chance to get this somewhere?

My Setup:

Cube stock firmware version unknown.

Ubuntu 16.04

Arduino Due 7.5 Volt powered

HDMI breakout board "Amazon"

I appreciate any hint or help.