yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Michajin:
Have you tried "fastboot boot image.img"

image.img being twrp recovery
[Fire TV Original Android Development] 2WhlWzrd:
First, there are no package files to downgrade with, Elias @aftvnews said he would post package download links when the devices had recovery.

Which we do have now, but there have been no links added yet and they will most likely be current versions and newer anyway.

Second, If I remember correctly, since the exploit was patched. The first part, unlocking the bootloader and creating patched images still works.

It's the second part, entering fastboot and flashing the patched recovery and boot images that fails. So I don't think you could downgrade anyway.

I could be wrong. But there was a discussion somewhere in this thread about it, you'll just have to read through it.
[Fire TV Original Android Development] puppinoo:
Yes, I did. But on the stick I cant navigate in it without mouse or keyboard and adb connection doesnt work.

If I try the OTG cable to enable keyboard or mouse fastboot mode cant be enabled (tried different times).

So I'm actually stuck.

Pino.
[Fire TV Original Android Development] Michajin:
I tested this and it worked for me. I booted up into bootloader. i have my OTG connecting the computer to the pendant (using a A-A USB) then ran the fastboot boot C:\Location of TWRP.IMG, then the twrp showed up on the screen i plugged in a mouse (corded) and it worked. When i tried a hub it rebooted?
[Fire TV Original Android Development] vasir13:
Thx Wiz,

I did, was hoping for an update.
[Fire TV Original Android Development] puppinoo:
Thanks for replying,

It's interesting that you can go into fastboot with OTG connected.

With mine I cant cause the AMLogic device gets disconnected immediately.

But if you can, it must be OTG's fault (or mine cause I dont do the procedure properly but I dont see where I could do wrong):

Can you show me which working OTG cable you bought? I could try to get the same one.

Thanks again.
[Fire TV Original Android Development] puppinoo:
I really appreciate your advices.

And you know what? Maybe it really was me failing to use the OTG cause I've never used a USB A to A in the whole process. I simply connected the OTG cable to the Pendant and a microusb to the OTG, the microusb to the PC and tried to fastboot waiting to insert a keyboard or mouse and maybe that was my (stupid?) mistake. I'll retry as soon as I recover the USB A - A cable my sister stole from me.

Thanks.
[Fire TV Original Android Development] Michajin:
If all else fails, if you flashed the replacement TWRP recovery i think you can wipe from fastboot because on update it will just kick you into TWRP instead of amazon recovery.

Does wiping the cache work from fastboot? fastboot erase cache (i can't remember if you tried this)

Replace your recovery-

fastboot flash recovery twrp.img

I can't guarantee this, but i believe it wont update without stock recovery. But i can not confirm this...
[Fire TV Original Android Development] vasir13:
Confirmed that 6.2.6 does not work. I was able to flash back and get back on track.

Would be great to change the script to compare file sizes pre and post process and stop flash back if post file sizes are "different .... ".

Can you guys post your successful pre/post file sizes for me to compare?

Pre-Patch file size:

16777216 Mar 10 20:59 backup_boot.img

16777216 Mar 10 20:59 backup_recovery.img

8388608 Mar 10 20:59 backup_reserved.bin

Post-Patch file size:

9740288 Mar 10 21:43 patched_boot.img

10522624 Mar 10 21:43 patched_recovery.img

3072 Mar 10 21:43 patched_reserved.bin
[Fire TV Original Android Development] puppinoo:
I finally recovered my USB cable and even with it I get my Pendant immediately disconnected.

Process seems simple:

1) Be sure to have Arduino Due and HDMI Breakout correctly configured and powered

2) Connect male HDMI Pendant to female HDMI Breakout

2) Connect OTG female microusb to Pendant

3) Connect Male A to A cable to female USB AND to PC usb

Finally

4) Connect male OTG microusb to the Pendant.

This message always appears so If the procedure is correct I suspect there a problem with my OTG cable.

This is my OTG cable: https://www.amazon.it/KIMILAR-Micro-Samsung-Nexus-Galaxy/dp/B00V9XS4V4/ref=cm_cr_arp_d_product_top?ie=UTF8

P.s.: I can enable fastboot mode easily without OTG cable.

I'll retry better this evening but I guess I'll have to buy a different OTG cable or even, if I dont solve with recovery, wait for a complete image to be available in a fastboot compatible format (single partitions if it will ever happen) so I can reflash a clean image going in fastboot mode from command line.

Regards.
[Fire TV Original Android Development] vasir13:
I was able to get all the partitions saved from a unit that has other mechanical issues with firmware is 6.2.5.1 (old one)

I flashed all the images from the defuc unit onto a good known unit with 6.2.6 firmware but the new device loops at the white amazon logo with 3 dots. Could be a dirty cache issue. (any ideas?)

Question: Technically, can I flash back all the images from one unit to another? like the example mentioned above?

Also, the exploit does not work on 6.2.5.1 and seems to be 6.2.5.8 specific.

I can share the images for debug if requested.
[Fire TV Original Android Development] 2WhlWzrd:
If I am understanding you correctly, you have patched the bootloader and then flashed unpatched images to the device.

If that is correct, then that is why it will not boot. The exploit requires that the bootloader, recovery and boot images all be patched.

If you undo the bootloader patch, the device may then boot with the earlier firmware.

Then with any luck you may get an incremental update that would fall in range of the exploit (around 6.2.5.5).

If you do this and it works, see if you can capture the download address of the ota update while your at it.

Or pull a copy of the update from the device before it reboots. It may be of help to others.

Good luck.
[Fire TV Original Android Development] Michajin:
Well i tried to tinker around and accidently took the upgrade. I was stuck in fastboot mode with no screen (oddly the id of the device was "1234567890") so i used the firefu sctript, changed it around to write everything from my backups in DFU mode. Sucessfully restored Zbootloader.bin, reserved.bin, boot.img and recovery.img. I was hoping this would get me back into TWRP (running the root script), no luck. It is promising that it seems you can write easily, but it seems i need the full 6.2.5.5.bin to restore to at least a working firetv. Not it chimes to the white fire tv logo and never boots. Maybe i will backup one of my updated pendants and use the files from that to restore. i wont have root, but it is better than a brick.
[Fire TV Original Android Development] puppinoo:
Sorry to hear about your issues.

Never modified the original FireFU script so no idea how to fix things.

I keep on telling myself that if I can still go into fastboot the issue is somehow fixable with the right backup files.

We will see.

Cheers.
[Fire TV Original Android Development] Michajin:
I dont have any issues with getting into fastboot. But flashing is blocked. In DFU mode i can read and write. I am wondering if i had the block address' and full 6.2.5.5 bin file, if i could write the whole file from DFU. I dont know what i am doing, but it isn't like i can brick it more. For now i am taking the latest 6.2.6.0 DFU files and backing them up to write them to the bricked ftv3 from DFU.
[Fire TV Original Android Development] vasir13:
I am in the same boat, I accidentally deleted the original restore files. I can try that if you share your .bin file and let you know.
[Fire TV Original Android Development] 2WhlWzrd:
Where did you get the 6.2.6.0 file from? Is it an untouched bin or a TWRP backup?
[Fire TV Original Android Development] vasir13:
Wiz,

How do you get the complete image from a unit using aml_usb. Do you know the start address and total count by any chance?
[Fire TV Original Android Development] Michajin:
i was hoping to use the backup files from 6.2.6.0. I have one pendant that is updated to the latest 6.2.6.0. I used the aml tool to read them to get copies of the zbootloader, boot1, boot2, reserve, recovery.img and boot.img. Thinking that would match my system i wrote them. It didn't work, still booting the amazon logo forever LOL. What got me into this was i downloaded the update and copied the bin file from the cache. i tried to copy it to a computer and my computer via adb and it locked up, i had to reboot. When i rebooted the fire rebooted, went into open-recovery twrp (some reason this time the script from amazon ran). I will try anything, i dont really care if i brink this permanently.
[Fire TV Original Android Development] 2WhlWzrd:
I have no idea about either of those things. But I did find a video that may be helpful.

Pull your own stock Android firmware

What's interesting about process is, once in fastboot mode you run recovery for the device from the PC.

Then he explains (at bout 6 minutes) that running adb shell will give you root access. Hmm... the possibilities.

The Android_Device_System_Information.zip doesn't seem to work on Fire TV devices though, because the directory is different.

But here is the information as best as I could get it. Unless someone knows a better way.

I then used the info from the 2 tables to write the commands at the bottom like he did.

needle:/ # ls -l /dev/block/platform/d0074000.emmc/by-num/
lrwxrwxrwx 1 root root 21 2014-12-31 18:00 p1 -> /dev/block/bootloader
lrwxrwxrwx 1 root root 19 2014-12-31 18:00 p2 -> /dev/block/reserved
lrwxrwxrwx 1 root root 15 2014-12-31 18:00 p3 -> /dev/block/boot
lrwxrwxrwx 1 root root 19 2014-12-31 18:00 p4 -> /dev/block/recovery
lrwxrwxrwx 1 root root 15 2014-12-31 18:00 p5 -> /dev/block/logo
lrwxrwxrwx 1 root root 14 2014-12-31 18:00 p6 -> /dev/block/tee
lrwxrwxrwx 1 root root 17 2014-12-31 18:00 p7 -> /dev/block/system
lrwxrwxrwx 1 root root 15 2014-12-31 18:00 p8 -> /dev/block/misc
lrwxrwxrwx 1 root root 16 2014-12-31 18:00 p9 -> /dev/block/cache
lrwxrwxrwx 1 root root 15 2014-12-31 18:00 p10 -> /dev/block/data

needle:/ $ cat /proc/partitions
major minor #blocks name

7 0 10240 loop0
253 0 512000 zram0
179 0 7634944 mmcblk0
179 1 4096 mmcblk0p1
179 2 8192 mmcblk0p2
179 3 16384 mmcblk0p3
179 4 16384 mmcblk0p4
179 5 4096 mmcblk0p5
179 6 8192 mmcblk0p6
179 7 1228800 mmcblk0p7
179 8 1024 mmcblk0p8
179 9 524288 mmcblk0p9
179 10 5782528 mmcblk0p10
179 96 4096 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 4096 mmcblk0boot0
7 64 65536 loop64

# dd if=/dev/block/mmcblk0p3 of=/sdcard/boot.img
# dd if=/dev/block/mmcblk0p4 of=/sdcard/recovery.img
# dd if=/dev/block/mmcblk0p7 of=/sdcard/system.img

$ adb pull /sdcard/boot.img
$ adb pull /sdcard/recovery.img
$ adb pull /sdcard/system.img

As soon as the download completed, you should have immediately disabled com.amazon.device.software.ota. That is where the code that initiates the software install resides.

Can you still communicate with the device through usb? Since the device has not fully booted, the bin may still be there.
[Fire TV Original Android Development] vasir13:
Thank you wiz for your reply.

That is all good if the unit is already rooted. I got a refurbished unit @ 6.2.1.0, updated to 6.2.1.2 which after the update -> it wanted to go straight to 6.2.6 and I stopped it. I was hoping for 6.2.1.3 which the exploit still works.

Right now I have opened the unit and have to say that it was a pain in the ***. The unit is functional with all the heatsink(s) out and looking for the UART pins/location.

Seems like 6.2.1.2 (new rev) is patched.

If you guys want pictures of PCB let me know. I do question the technical ability of the resource who designed the HDMI dongle connecting to main board. What a design flaw.

The work continues.
[Fire TV Original Android Development] 2WhlWzrd:
That's what I was pointing out, the device is not rooted.

But he gains root access by using fastboot and running recovery from a PC.

Can you not get into fastboot mode with the exploit on 6.2.1.2?

Michajin confirmed in an earlier post, that you can run recovery that way.

I just didn't know that you could gain root access from it.
[Fire TV Original Android Development] vasir13:
It does drop to fastboot, however after writing patched reserved @ (6) and dropping to fastboot and trying to flash the rest ... I get blocked command error msg.

I did try to fastboot boot twrp.img and still get blocked writes.
[Fire TV Original Android Development] vasir13:
I have the firmware 6.2.1.2 and the patch does not work. I enter recovery just fine but the exploit "seems" not to work ( even tried the 6.2.1.3 one) . I get the blocked command deal when I try to write back, I wonder if I am doing anything wrong (following the guide exactly).

downloading 'boot.img'...

OKAY [ 0.895s]

booting...

FAILED (remote: blocked command)

finished. total time: 0.900s

-A
[Fire TV Original Android Development] Michajin:
I had to be on 6.2.5.5 to get the expoit to work.
[Fire TV Original Android Development] vasir13:
I tried to incremental update but it jumps from 6.2.1.2 to 6.2.6.0 ...

I was hoping that I would get as close as 2.5.5 as possible.
[Fire TV Original Android Development] vasir13:
Mich,

Quick question. Would it work if I get the reserved, and boot images from someone else who already has root and write it to the unit to be able to bypass, or it is device specific?

-a
[Fire TV Original Android Development] Michajin:
I tried that with mine and it didn't work, saving all the files from the script and then writing those back on a updated one. With the effort and what it is, i would wait until the firestick 4k is rooted and unlocked. There is a donation going on to get it rooted. Root and unlocking is possible on that, the pendant has so few of us rooted, we are likely to have very little support. I will likely dump root, update and sell my pendants for the more powerful firestick 4k. Just my opinion....
[Fire TV Original Android Development] 2WhlWzrd:
Please clairify

When you say "all the files from the script and then writing those back on a updated one". Which file exactly, and were you mixing files from different versions?

i.e. taking just the scripted files from a rooted device with firmware 6.2.5.5 and flashing them to a device with 6.2.5.8?

I think he is referring to more of a clone.

As for the 4k stick, it may be more powerful, and Amazon may not be able to block root. But it is a MediaTek based device.
[Fire TV Original Android Development] Michajin:
I'm referring to the backup files the exploit takes , reserved, recovery, etc... . Then writing them all back through the script modified to write the bin and Img files. I tried multiple ways without any luck. I don't have any idea what I'm doing. I don't know how you can "clone". I also tried a magisk modified boot.img. The files did not allow fastboot flash no matter how i tried. I'm just giving up on the pendant because so few have root and the device is done. I guess I don't understand why the 4k is bad because it's a mediatek? There may be options with the pendant and if someone wants to test something I'll try it because I don't care if I brick it, I have a few... I'm just thinking the 4k has better long term support options...
[Fire TV Original Android Development] vasir13:
Do you know the UART pinout or schematic? I have tried everything but still unable to find the RX/TX pins .

Thanks,

-a
[Fire TV Original Android Development] vasir13:
for needle:

Found the UART, it is @ P2 and pinout looks exactly like like the picture below BUT that is from a different ATV2 board.

https://www.exploitee.rs/index.php/File:FireTV_Uart_Pinout.jpg @ P23

fyi.
[Fire TV Original Android Development] 2WhlWzrd:
Can you post some photos of the actual device, for future reference?
[Fire TV Original Android Development] Michajin:
Here is a picture of the board, top right looks like where it would be to me...
[Fire TV Original Android Development] Michajin:
If anyone is interested in updating the pendant (needle) see this thread....

https://xdaforums.com/fire-tv/general/fire-tv-3-needle-twrp-t3903578/page3#post79287666

Thanks to [MENTION=3497316]retyre[/MENTION]
[Fire TV Original Android Development] vasir13:
That is good news. But for the rooted devices. By the way, I am now reading UART .... so hopefully I will know why I cant root.
[Fire TV Original Android Development] Michajin:
If you come up with anything great, i have a bricked needle that i could use again... It still boots to fastboot and the i can get into DFU mode also. If you want any testing with a partially upgraded needle let me know, if i can get into TWRP i can restore my backup.
[Fire TV Original Android Development] vasir13:
Well seems like that there are some valid data @ start in UART but data becomes junk. GLX is the controller, after the READ ,,,,, data is encrypted or format changes?

////////////////

Welcome to minicom 2.7.1

OPTIONS: I18n

Compiled on May 3 2018, 15:20:11.

Port /dev/ttyUSB0, 16:10:16

Press CTRL-A Z for help on special keys

GXL:BL1:9ac50e:bb16dc;FEAT:BFFF39BC:0;POC:3;RCY:0;EMMC:0;READ:0;0.0;0.0;�� _

cVBC̱̄4

---------- Post added at 04:26 PM ---------- Previous post was at 04:18 PM ----------

Got it ... full boot read out.

USB RESET

SPEED ENUM

cmd is download:00000c00

Starting download of 3072 bytes

downloading of 3072 bytes finished

ERROR: I'm sorry, but command flash is blocked at fastboot

at /mnt/build/workspace/wsn0/bootable/bootloader/uboot-amlogic/drivers/usb/gadg)

cmd is download:00000c00

Starting download of 3072 bytes

downloading of 3072 bytes finished

ERROR: I'm sorry, but command flash is blocked at fastboot

at /mnt/build/workspace/wsn0/bootable/bootloader/uboot-amlogic/drivers/usb/gadg)

Seems like the old 6.2.1.0 is patched to bridge old devices to 6.2.6.8/
[Fire TV Original Android Development] Michajin:
See post 147 - I dont know if anyone have looked into current payload address, it does have the payload address for 6.2.1.3

https://xdaforums.com/fire-tv/general/root-rooting-firetv-cube-pendant-firefu-t3861272/page15
[Fire TV Original Android Development] vasir13:
Looking into how to find the payload offset. So far no luck.

For people who want the UART read.

As shared before, the TX/RX are known and you can get the ground from the shield.

Initially the speed is 115200 and then jumps to 460800 8N1.
[Fire TV Original Android Development] Michajin:
if it helps, here is something i found in the update 6.2.6.0.bin. target.blocklist
[Fire TV Original Android Development] vasir13:
I have automated the exploit search basically hammering the device.

So far no luck finding the correct offset with few offset address searches per minute for 6.2.1.0.
[Fire TV Original Android Development] Michajin:
I don't know how to read UART. Based off what i have seen in this thread the exploit could still be present in 6.2.6.0. I am hoping to use it to get back into unlocked fastboot to run TWRP recovery and restore my backup on my bricked needle. I am mostly a windows user with no Linux experience. Has anyone really verified that it doesn't work on 6.2.1.0 if the payload are correct?
[Fire TV Original Android Development] vasir13:
6.2.6 is still open to exploit? where does it say?

for 6.2.1.0 I am using the provided exploit which needs to be recompiled for each presented offset. Some people said that they devices comes in and out of fastboot. that is because of :

"Synchronous Abort" handler, esr 0x96000004

ELR: 77f0baa0

LR: 77edb3fc

x0 : 0000000073e76cf0 x1 : 4444444444444444

x2 : 0000000aaaaaaaa0 x3 : 0000000000000000

x4 : 0000000073e76cf0 x5 : 0000000000000000

x6 : 0000000077f42308 x7 : 0000000077f42318

x8 : 0000000000000000 x9 : 0000000000000000

x10: 0000000000000000 x11: 0000000000000000

x12: 0000000000000000 x13: 0000000000000000

x14: 0000000000000000 x15: 0000000000000000

x16: 0000000000000000 x17: 0000000000000000

x18: 0000000073e61e28 x19: 0000000073e77730

x20: 0000000000000000 x21: 0000000073e769e0

x22: 0000000000000000 x23: 0000000077fbb000

x24: 0000000073e77710 x25: 0000000073e76a70

x26: 0000000073e77748 x27: 0000000000000000

x28: 0000000077f36000 x29: 0000000073e61c90

Reesetting CPU ...

resetting ...

/////////

You said that you have a rooted device. Can I get your complete binaries to compare with unrooted? I am set to read the UART.
[Fire TV Original Android Development] Michajin:
I have about 5 of these needles. I have (2) that are rooted on 6.2.6.0 ( i updated them, they were rooted on 6.2.5.5) i have a bricked 6.2.5.8 (was rooted and took an update through open recovery). I have (1) updated non-rooted on 6.2.6.0 and (1) non-rooted on 6.2.5.8. When i tried to root 6.2.5.8 or higher it has fastboot flash blocked after running the exploit (i had to restore the files from the exploit to get it to boot). I have posted the full .bin updates in the TWRP thread. I am not really sure how to do what you are asking for and how to get you that information? When i tried rooting a older OS than 6.2.5.5 version it kicked me into recovery (FIREOS recovery) and bricked. I restored the files through the DFU mode and tried to update, i tool the update and it blew through 6.2.5.5 to 6.2.5.8. if you can tell me how to get the information you are seeking, i can try to get it for you later today or tomorrow. I hope any of this information is helpful to you...
[Fire TV Original Android Development] vasir13:
What I need is basically dumps of the rooted device.

rooted_boot1.bin rooted_boot.img rooted_reserved.bin

rooted_boot2.bin rooted_recovery.img rooted_zbootloader.bin

Then I can do some searches and hopefully get some positive results.

If you want msg me and I can give you the UART dump. So you know how it is.

I hope I am doing this right ..... looked at their exploit source code and extrapolated. if anyone can confirm?
[Fire TV Original Android Development] Michajin:
I have the original ones the exploit did on my needles. The only file it writes back to the needle is the reserved.bin in DFU mode, it reads the recovery and boot images then after modifying them it boots into fastboot, somehow the modification of the reserved makes the fastboot able to flash files. I have the original files and the (3) files it changes. i have been able to write img's in DFU mode. Let me know how to get the files you want or if these are the ones you are asking for? I am considering trying to write the system.img in DFU mode and see if it matters (its already bricked).
[Fire TV Original Android Development] vasir13:
yes, Got it ... that can get me started.
[Fire TV Original Android Development] vasir13:
What I have done so far:

1) Using your backup files I restored them to my needle.

2) Patched the 6 c to reserved

3) System was up and I was able to flash boot and recovery ( I was unable to do so before without your patched files)

4) System rebooted in normal mode, logs show successful boot

5) SU at times would not work and I needed to restart

6) Because of #5 I erased cache partition and then it never booted correctly again.

7) Thinking that maybe I also needed to erase user data I performed fastboot -w which basically resets the system to default

8) System boots, how ever does nor complete the boot cycle and I have no visibility to where it does crash boot information after [

---- 1.466704@0] bootconsole [earlycon0] disabled

9) flashed your system.img to needle and that was the thing that broke camels back. Somehow I did not read that your image was for Cube. So do not flash it to needle.

I guess I need system/userdata ( I know what you think) , and cache partition. System was complaining about bit miss-alignments but that was too late. So

- Notes:

Erasing cache,userdata basically made my device unusable but it still boots ok to fastboot and able to flash whatever I want but no cigar. So dont do it yet.