yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] k4y0z:
So I just checked and it does have the verify flag set in fstab:

Did you check in the boot.img initramfs?
[Fire TV Original Android Development] Pretoriano80:
Yeah, here it has "ro, wait, check", but no verify. Maybe because the image i used was already patched by Magisk, so it removed the verify flag? Or "check" means the same in this case?
[Fire TV Original Android Development] aasoror:
Yup, it completes without issues, I just meant to say I am not sure if reflashing the same BL that is now already on the stick would mask an issue that's not tracked by the script (like the very first run of the original script).

Thanks again for your work k4y0z.
[Fire TV Original Android Development] k4y0z:
Yes, that would be Magisk removing the flag.
[Fire TV Original Android Development] Pretoriano80:
Well, in this case i have no idea what's causing the issue when trying to replace the vold binary, i double checked permissions and it's all good.
[Fire TV Original Android Development] hyperblu:
I couldn't make it past initial setup with that 6.2.6.5 update you provided. Kept saying my Amazon credentials were invalid even though they were. I then tried wiping system cache and did not make a difference. I loaded a previous backup and logged in no problem. All I did was rename that .bin file to .zip and installed it. It booted into fire OS, but nothing on the home page would load. I went to settings and it confirmed 6.2.6.5 was currently installed, it kicked me out, and made me sign into Amazon, which it couldn't.
[Fire TV Original Android Development] t3ch42:
Any luck with this? I tried with the prerooted ROM, but didn't have any luck. After flashing the boot partition with boot.IMG in the hacked bootloader and rebooting, the firestick hung at the black firetv screen. Needing some help.

Thanks.
[Fire TV Original Android Development] hyperblu:
I take it you can't get into recovery either? I was successfully able to run the exploit using a delayed bash script and access twrp again when I was stuck at the black boot screen. I was in the same boat.
[Fire TV Original Android Development] Sus_i:
The current prerooted ROM won't boot without a proper unlock & installed magisk.zip... i.e. don't expect that your stick boots with the stock boot.img ;)

The sequence is flash stock bin renamed to zip and then the stock boot.img.
[Fire TV Original Android Development] k4y0z:
So, I'll repeat my question...

Did you do a factory reset (i.e. wipe data + cache) after installing the stock ROM, as I've been telling you?

Well, did you install stock ROM first and then the stock boot.img from that same ROM?
[Fire TV Original Android Development] t3ch42:
No, no issues with running the exploit again after the black screen. My intentions were to flash the stock boot image and hope for a refresh, but there's more to it it seems.

On an semi-related note, I finally found a use for the old USB A to USB A cable from the old Firetv2 days. Works well for talking in fastboot to the 4k stick after a quick swap from the otg mouse USB.

---------- Post added at 01:01 PM ---------- Previous post was at 12:56 PM ----------

No, not yet. Will try this evening after I get home from work. I hadn't seen the stock image until today...

Will report back.
[Fire TV Original Android Development] xionbunny:
hopefully someone will release a pre rooted version of the latest build.
[Fire TV Original Android Development] Pretoriano80:
I wonder if the "prerooted" rom is installing something in system!

If that's the case, wouldn't that trigger a failure in dm-verity if Magisk wasn't installed prior to installing the rom?

Why would you need a pre-rooted rom when you can install Magisk from TWRP?

There's already a stock update that you can flash (after renaming from .bin to .zip) with TWRP, just add Magisk zip to the install sequence and you will have a rooted rom

If, for some reason you only want to install only boot, system and vendor partitions, let me know and i will upload a zip for you.
[Fire TV Original Android Development] xionbunny:
Well im just concerned that it would wipe out twrp every time, or is that not the case?
[Fire TV Original Android Development] k4y0z:
Yes, that is exactly what is happening. AFAIK the system is modified to add addon.d support.

You would install Magisk after installing the ROM, not before though.

[MENTION=3991724]rbox[/MENTION] maybe you could disable verity in the boot.img that is in your ROM or add Magisk to it?

TWRP won't install any of the other partitions anyway, no need to modify the ZIP.

It wouldn't.

The major difference between stock and prerooted is, that it adds support for addon.d, which means you won't have to reinstall Magisk (or gapps, if someone gets that working) after an update to a newer prerooted ROM.
[Fire TV Original Android Development] xionbunny:
Alrighty thanks, one other question is there any way to fix this problem im having with my other non working 4k stick

Check GPT

Traceback (most recent call last):

File "main.py", line 117, in <module>

main(dev)

File "main.py", line 28, in main

switch_user(dev)

File "/root/.local/share/Trash/files/kamakiri/modules/functions.py", line 114, in switch_user

raise RuntimeError("what's wrong with your GPT?")

RuntimeError: what's wrong with your GPT?
[Fire TV Original Android Development] rbox:
So yeah, the first time installing my ROM you need to manually install magisk. But after that, it is supposed to automatically reinstall it via the addon.d. But it's possible that that broke somehow even though I know that worked. Because of the situation I ran in to with my stick. I may just say screw it and stick to including Magisk in my ROM.
[Fire TV Original Android Development] Michajin:
Sorry to spam, but if anyone is interested the fire stick 4k is on sale for $25. Use- 4KFIRETV for promo.
[Fire TV Original Android Development] hyperblu:
No, probably not. Look man, I didn't go to lambda or have extensive experience in black hat exploiting. I dabble around with linux, but trying my best to learn as much as I can without having everyone spoon feed me. That's why I, unlike most people, am willing to donate money toward someone's efforts that I'm benefitting from. No need to be snarky about it. When you say "factory reset" I think in terms of within FireOS, what actually happens over in recovery is beyond me.

---------- Post added at 12:22 AM ---------- Previous post was at 12:12 AM ----------

I have literally a OTG cable and a single USB port to work with. Pushing updates through twrp command prompt via adb isn't my strong suit. I can load it on a USB drive and install stuff that way, but I'd sacrifice my limited means of navigating through TWRP for my skill set when I have one USB port to work with.

---------- Post added at 12:26 AM ---------- Previous post was at 12:22 AM ----------

I also had success with the delayed bootrom-step.sh script with a broken smd that you were asking us to try, in case you didn't see that.
[Fire TV Original Android Development] AtoZ0to9:
Been following this thread before I get my stick. Is it possible for simultaneous use of a mouse, keyboard, and USB stick in TWRP with a hub?
[Fire TV Original Android Development] codezilla99:
if I don't have an OTG cable, is there a way to interact with TWRP? I can't use #2 ADB because my TWRP doesn't have a network connection. When I try #3 I get permission denied errors in adb shell. I feel like I am missing something. Do I need to order a fireTV OTG cable that gives separate connections for usb power + usb connection to mouse? I have an old OTG cable with a single USB A female port but connecting a mouse won't work, cause there's no power.
[Fire TV Original Android Development] xionbunny:
Guess no one knows how to fix the issue I asked about in my last post...
[Fire TV Original Android Development] hyperblu:
as far as I know, yes. The hub must have its own power source though.

---------- Post added at 04:27 AM ---------- Previous post was at 04:25 AM ----------

It's showing a partition error, but I get random errors if the short to ground is insufficient. Try using something else that maybe a better conductor or using the delayed script I talked about earlier. Is there any physical damage to the board?

---------- Post added at 04:34 AM ---------- Previous post was at 04:27 AM ----------

Just to mention, I took another new 4k stick, let it update, flashed rbox ROM and installed magisk successfully, no issues with Amazon this time. I'm going to take the initial backup I made on that stick and try flashing the one with license errors and see if that clears it up.
[Fire TV Original Android Development] t3ch42:
That's good to know that there weren't the amazon errors when letting it update all the way and then performing the exploit. I just went through the whole process back to stock and waiting to see what happens when it updates. For some reason though, it did not update during the registration and initial boot. I have verified twrp is not installed and the bl is locked.
[Fire TV Original Android Development] xionbunny:
Thanks, I'm just gonna call it a write off, I thought id try and recover it, but honestly I replaced it with the one I'm currently using at this point, and I rooted it fine but figured if I could recover the old one that would be great, but its completely fubar, oh well no loss really. I must have fried something in it when it originally stopped booting.
[Fire TV Original Android Development] hyperblu:
Depending on which version you flashed, your stick may not be priority to Amazon if they release updates by serial number. This stick I just did would only update to 6.5.2.5 or whatever out of the box. It would not get the newest update from ota no matter how many times I rebooted and ran update check.

---------- Post added at 05:20 AM ---------- Previous post was at 05:18 AM ----------

I'd at least try the delayed bootrom-step.sh script. I broke an SMD on the board and wouldn't boot past the black fire TV screen, nor allow me into recovery. I was able to run the exploit successfully (again) and get into twrp.
[Fire TV Original Android Development] xionbunny:
I did try it and it failed, it's alright though.
[Fire TV Original Android Development] ChronoWerX:
Will not work for me :( Every point to short terminal says only waiting for bootrom
[Fire TV Original Android Development] Sus_i:
This means that you think about to discontinue addon.d support in the 4k rom?

Yes, may be that you need a powered hub or a stronger 5v power supply for the stick, the original powerbrick is a bit weak.

I use a black ugreen usb3 hub with build in LAN network port (unpowered), together with a logitech K400 keyboard and a sometimes a usbstick. I've got some reboots i.e. optimizing-storage loops. I grabbed the big old power supply from a gen1 firestick and that fixed it for me.

Have you fixed your bios problem? Do you using that fireISO from OP?
[Fire TV Original Android Development] ChronoWerX:
Yes have overwrite my bios and it work :D

Yes use the fireISO from OP. Can only short CMD, RX, TX, GND, because the other points are under the cage holder
[Fire TV Original Android Development] Sus_i:
Yes, the point marked as CMD is the easiest one (TX and RX won't work at all).

Shorting is easy. Take a look at my posting here
[Fire TV Original Android Development] LuCkyCn:
Yes it's possible. I'm using Ugreen from Amazon and it doesn't need any extra power source.
[Fire TV Original Android Development] Pretoriano80:
Considering that Magisk save all its stuff on /data/adb, i think that it makes more sense to only add Magisk's zip to the install sequence.Even better would be if people would learn to install Magisk themselves, but that's another story. xD

Or is there any other use for that addon.d folder?
[Fire TV Original Android Development] tehlers:
license_error

Hi,

today I tried to install the original "update-kindle-mantis-NS6265_user_2157_0002852679044.bin" in TWRP:

1. put file in /sdcard of the stick (check md5)

2. rename file to .zip

3. Install the file via "Install" (installs system and vendor)

4. Wipe cache / dalvik

5. Go to "Wipe" and do "factory reset" (wipe cache / dalvik / data without sdcard)

6. Boot stick and go through the whole setup process

No other result. TWRP is (of course) still available, Magisk (root) is gone, still license_error. I think the first message in logcat pointing to the problem is:

10-18 10:34:17.980 1486 5233 I AmazonVideo: MediaDrm no license available in the null license store, keySetId is null, returning null rights.

From what I googled, keySetId should not be null? Does this hint helps? Could there be different firmware versions between the 4k sticks, depending on the country sold (I also don't get the newer version 6.2.6.6 presented from fireOS)? My stick is from Germany.

Best
[Fire TV Original Android Development] LuCkyCn:
I tried the stock ROM and it's not fixing the license issue and yes, I've factory reset it afterwards and the same problem persists.

---------- Post added at 10:00 AM ---------- Previous post was at 09:50 AM ----------

Where did you get the boot partition with boot.img?
[Fire TV Original Android Development] Sus_i:
The real magic part from Magisk goes into the boot.img ;)

Magisk has it's own implemented addon.d script and should survive updates with that just fine, if the custom rom provides proper addon.d support.

I think a magisk.zip install sequence integrated in the ROM update (as a 'flash after update'), may be cause problems in case there is any addon-d support!?
[Fire TV Original Android Development] Pretoriano80:
Yeah, i know how it works, but what i meant is that in our case the addon.d does the same thing as flashing Magisk zip in sequence.

Probably for a "real" prerooted rom, the best solution would be to have Magisk zip and addon.d support.

The install script should check if addon.d exists and if not, then first install Magisk and then push the addon.d.That might work because Magisk will remove dm-verity from fstab so theoretically it should avoid boot issues.
[Fire TV Original Android Development] Sus_i:
You can extract the stock boot.img from a stock update.bin, if that was the question?

Yes, it flashs the inside Rom integrated version of magisk, but via addon.d magisk restores the currently installed version.

The old 'playing with fire' thing (Gapps/Exposed/some settings) as an example, survived with an addon.d script at an update too.

Don't know if that check you mentioned is possible or easy to do.

But my opinion is that addon.d is a godsend ;)

due to this I would upvote for keeping addon.d support, please :p
[Fire TV Original Android Development] hyperblu:
Has anyone tried installing a generic Android TV apk for amz prime video? Wonder if that would have any affect?
[Fire TV Original Android Development] k4y0z:
That looks like your GPT is corrupted.

I can upload a script that flashes a new GPT later.

can you try the following from FireOS using su:

dd if=/dev/block/platform/soc/11230000.mmc/by-name/tee1 of=/dev/block/platform/soc/11230000.mmc/by-name/tee2

See if that fixed the issue (after reboot)?

My stick is also from germany, that won't be the issue ;)
[Fire TV Original Android Development] tehlers:
Both partitions indeed differ, but dd-ing tee1 to tee2 did not fix the license_error (I did reboot after dd). I made a backup first of tee2, I will copy it now back. Shall I test the opposite (dd tee2 to tee1), too?

Best
[Fire TV Original Android Development] k4y0z:
OK, can you send me dumps of both partitions please.

Also send me the output of "idme print" via PM.

Then take the tz.img from the kamakiri zip and dd it to both tee1 and tee2, see if that works.

EDIT:

Also try doing another factory reset after dding tz to both partitions if it doesn't work right away.
[Fire TV Original Android Development] xionbunny:
Awesome, I'll give that a shot when you upload it, thanks.
[Fire TV Original Android Development] kgirlx:
Love the thread.. Been reading every page before I try this.. Anyone have a link to a good OTG cable from Amazon known to work? I don't have one.. Want one here before I do this..Thanks.
[Fire TV Original Android Development] tehlers:
I will try the factory reset again (maybe with flashing the update[...]NS6265[...].bin from TWRP again, since dd-ing tz to tee1 and tee2 did not work out.

BTW: the partitions "tee1" and "tee2" are 5242880 bytes in size, while tz.img is only 3112960 bytes. Shall we add zeros to the end to fill it up?
[Fire TV Original Android Development] k4y0z:
I checked the files you sent me.

tee1 is the same as the tz.img as would be expected, since that is flashed during the exploit.

So easiest would probably be copying from tee1 to tee2 like i first asked you.

Then do a factory reset.
[Fire TV Original Android Development] k4y0z:
Please try running gpt-fix.sh from the attached ZIP.
[Fire TV Original Android Development] tehlers:
I did now exactly this:

1. Restored tee1 backup to both, tee1 and tee2.

2. Booted TWRP and reflashed update-kindle-mantis-NS6265_user_2157_0002852679044.bin

3. Wiped cache / dalvik and data (aka Factory reset) in TWRP

4. Reboot to system and resetup the stick

5. Installed offered updates (system components it says; still no 6.2.6.6. offered)

Still license_error when trying to playback something from Prime...
[Fire TV Original Android Development] k4y0z:
OK, I have one more idea to try:

First take a backup of kb partition (/dev/block/platform/soc/11230000.mmc/by-name/kb)

Then run

idme copy KB /dev/block/platform/soc/11230000.mmc/by-name/kb

try if that works and also take another copy and compare with the backup
[Fire TV Original Android Development] tehlers:
Unfortunately this creates exactly the same content on kb:

mantis:/sdcard/backup # dd if=/dev/block/platform/soc/11230000.mmc/by-name/kb of=kb
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.072 secs (14563555 bytes/sec)

mantis:/sdcard/backup # idme copy KB /dev/block/platform/soc/11230000.mmc/by-name/kb
Wrote 5120 bytes to /dev/block/platform/soc/11230000.mmc/by-name/kb.

mantis:/sdcard/backup # dd if=/dev/block/platform/soc/11230000.mmc/by-name/kb of=kb.new
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.075 secs (13981013 bytes/sec)

tehlers@acer:~/fire-tv-tablet/backup-firetv-4k> adb pull /sdcard/backup/kb
/sdcard/backup/kb: 1 file pulled. 2.8 MB/s (1048576 bytes in 0.360s)
tehlers@acer:~/fire-tv-tablet/backup-firetv-4k> adb pull /sdcard/backup/kb.new
/sdcard/backup/kb.new: 1 file pulled. 2.9 MB/s (1048576 bytes in 0.344s)

tehlers@acer:~/fire-tv-tablet/backup-firetv-4k> diff kb kb.new
tehlers@acer:~/fire-tv-tablet/backup-firetv-4k>
[Fire TV Original Android Development] k4y0z:
I'm afraid I am out of ideas.

You can try going back to stock completely (flash stock first, then flash boot.img separately via hacked fastboot).

Allthough I'm not sure how that could help.
[Fire TV Original Android Development] xionbunny:
Thanks for that, I've concluded after trying that, that it's a hardware failure based on the emmc write error, so I tossed it in the trash.
[Fire TV Original Android Development] k4y0z:
What was the output from running that script?
[Fire TV Original Android Development] Sus_i:
I'm a bit curious, you think about a hardware failure, did you damage the stick somehow during the unlock?

Edit: Maybe you should pull that stick out of the trash, in order to track down the issue ;)
[Fire TV Original Android Development] AtoZ0to9:
Thanks for the input everyone. I've put together this order of stuff I will need.

The process at the moment appears to be setting up the stick until it's up to date, paying attention to the versions to make sure it got the latest update. Before performing the exploit, enable adb access and disable updates. Perform the exploit to boot TWRP, make a backup of all available partitions and save it externally, flash prerooted ROM followed by magisk, and reboot. Check for amazon license issues, and manually install any updates with TWRP, followed by Magisk.
[Fire TV Original Android Development] tehlers:
I am a bit lost now, sorry. I tried to just flash the "boot.img" from the update-kindle-mantis-NS6265_user_2157_0002852679044.bin via hacked BL (fastboot flash boot boot.img). Now I have reverted the whole hack? I cannot enter TWRP anymore and "adb reboot recovery" brings the recovery from Amazon.

BTW: Still license_error... (even after a "reset to factory" in fireOS)

Do I need to redo the hack now? Can I just use the original python scripts (as the first time)?

Thanks
[Fire TV Original Android Development] k4y0z:
Yes, that was the idea, sorry if that wasn't clear.

Yes you would have to redo the procedure to unlock again.

Maybe wait for it to give you the option to update to 6.2.6.6 and do the unlock afterwards, hopefully that will fix the license error.
[Fire TV Original Android Development] bibikalka:
Can Amazon simply blacklist some of these devices by the serial numbers? Given the reports that the license issue appears after some time, could they detect root and block devices from capturing the 4k content?
[Fire TV Original Android Development] Sus_i:
:good:

You can't disable updates without su. Only thing you can do is that:

cmd appops set com.amazon.device.software.ota RUN_IN_BACKGROUND ignore
cmd appops set com.amazon.device.software.ota.override RUN_IN_BACKGROUND ignore

Since the updater runs in background, this command prohibits the RUN_IN_BACKGROUND permission.

The fireOS stops the update service, but it's not diabled, a press 'search for updates' in settings starts the ota updater again.

After the exploit, flash magisk, do your backup, sideload the magisk manager and disable updates with adb.

You may skip any kind of rom flashing, since it's not clear what causes the license issues... especially since it's useless to update twice, as the stick is up-to-date.

Hopefully not.

We could hide root with magisk hide, but an unlocked bootloader is always detectable...
[Fire TV Original Android Development] Pretoriano80:
Guys, anyone tried to build latest (6.2.6.6) kernel and flash it?

Here it boots fine, but wifi and remote doesn't seem to work. Completely stock, no changes made to the source code.
[Fire TV Original Android Development] k4y0z:
Your guess is as good as mine at this point.

My stick still works fine on 6.2.6.6 rooted with Magisk 20.0 (also worked fine on 6.2.6.5)

EDIT:

I don't have a 4K display, so I'm testing on a HD screen.

Maybe someone who has the error could connect to a HD-Display and check?

Although I doubt it will make a difference.
[Fire TV Original Android Development] Sus_i:
Hmm, I've read somewhere that netflix and other apps play fine.

Has anyone tested if the stick streams lower resolution prime content? Probably won't play anything prime related, isn't it?
[Fire TV Original Android Development] xionbunny:
Just a emmc write failure, trust me the board is a write off, this only confirmed it.
[Fire TV Original Android Development] tsynik:
With other magisk modules for Google Pay etc there was some tweaks which allow to pas CTS. One of them was changing /proc/cmdline with a module. On Unlocked 4K stick there is orange bootloader status. I added this to post-fs-data.sh Magisk Module script just for sure, but I don't have Prime and DRM play issues before:

# SafetyPatch
sed 's/unlocked_kernel=true/unlocked_kernel=false/i' /proc/cmdline | sed 's/orange/green/i' | sed 's/yellow/green/i' > /data/local/tmp/cmdline
mount -o bind /data/local/tmp/cmdline /proc/cmdline

so we can spoof system for botloader / boot status also.
[Fire TV Original Android Development] xionbunny:
Wonder if we can achieve working Google play store etc.

---------- Post added at 11:23 PM ---------- Previous post was at 11:11 PM ----------

the ram chip got a scratch on it so i know thats enough to screw it up, thus its garbage, i just wanted to confirm it so i tried the script, it said there was a failure writing to the emmc chip, so 2 plus 2 =4, its a write off and stays in my garbage can.
[Fire TV Original Android Development] xyz`:
RAM isn't on until after the bootrom has finished executing, so it should not matter for the first stage of the exploit.