yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Rortiz2:
Hi,

Not the only with this problem. You will need to ask somebody to send you a backup of mmcblk0boot1 (via private as contain device-specific stuff) and you will need to flash it with dd (in TWRP for example), after that just manually change your values with the idme tool provided in the stock ROM (with root ofc).

Regards.
[Fire TV Original Android Development] bilitte22:
Thanks Rortiz2 for lhe guidelines. As I don’t have friends ,who I’m confortable with to ask for that. I m wondering if a friend or any ops here can send me in private ,a backup of mmcblk0boot1 either via google drive or dropbox. That’d be great.
[Fire TV Original Android Development] bilitte22:
Can anyone provide me with what is below. In private please.

Not the only with this problem. You will need to ask somebody to send you a backup of mmcblk0boot1 (via private as contain device-specific stuff) and you will need to flash it with dd (in TWRP for example), after that just manually change your values with the idme tool provided in the stock ROM (with root ofc).
[Fire TV Original Android Development] Katzenstreu:
Thanks a lot. That worked!

But now I've to chose "normal boot" instead of "TWRP" by pressing lift arrow key every boot. Default is now "TWRP".

How I can change default boot priority to "normal boot"?

Best regards

Tim
[Fire TV Original Android Development] Sus_i:
LOL

You may donate some bucks to the developer, in order to get rid of that nag screen ;) :p :D
[Fire TV Original Android Development] bilitte22:
Can anyone provide me with what is below. In private please.

Not the only with this problem. You will need to ask somebody to send you a backup of mmcblk0boot1 (via private as contain device-specific stuff) and you will need to flash it with dd (in TWRP for example), after that just manually change your values with the idme tool provided in the stock ROM (with root ofc).

My problem is SOLVED .I want to take the opportunity to thank everyone who helped me to fix the fire tv 2. Big thanks in particular to Sus_i you're the best. Big thanks to Rortiz2 for giving me the idea to ask in private for what I wanted.
[Fire TV Original Android Development] brigantti:
Finally after 2 days i made it is working perfect now thanks.just a quick question how can i get to boot normal the fire tv 2?after all this and install the rooted rom. the box every time i power cycle goes on to the twrp how can i get it to go to normal boot instead of that.again thank you for your tutorial.
[Fire TV Original Android Development] Rortiz2:
Hi,

Unless you modify the bootable recovery sources you can't;)

Regards.
[Fire TV Original Android Development] beatbreakee:
Can someone repost 5.2.6.8 .... mediafire links are bad for lots of the originals. Also did anyone find a working solution to the RPMB downgrade? I can flash the script and mine reads RPMB, and doesnt say downgrade, it skips it. And thats what i think is causing my device to never boot past the Amazon White logo. I can get to twrp, but can never boot the FireOS. Always flashes white led for maybe 30 sec then loops. Followed every step and , 3 different TV's , 6 different USB cables, 6 dif HDMI cables... 2 power adapters. . And both Usb 2.0 & 3.0 ports. Using linux via FireOS Live iso.
[Fire TV Original Android Development] Rortiz2:
Hi,

Just wait.. We did a lot of progress and will be released soon once is stable ;)

If you get TWRP then RPMB is not the issue:good: Try flashing latest prerooted ROM.

Regards!
[Fire TV Original Android Development] Sus_i:
Solution is (probably): Boot into twrp, go to wipe, wipe cache. This may take some time, wait until it finishs. Reboot.

Now the boot option should be fireOS as new default, instead of twrp.
[Fire TV Original Android Development] Katzenstreu:
Wiping Dalvik didn't helped. And I don't want to wipe system cache because this was the root cause of the problem.
[Fire TV Original Android Development] DanielF50:
Boot to twrp, go to file explorer, then cache, delete the file called "bootmenu_recovery", reboot & it should default to Fire OS instead of TWRP.
[Fire TV Original Android Development] Katzenstreu:
Great, thanks a lot! I deleted "/cache/bootmenu_recovery" an it worked!
[Fire TV Original Android Development] SamLehman617:
Is it possible to downgrade unrooted stock firmware 5.2.7.0 to 5.2.6.X using this method?
[Fire TV Original Android Development] Sus_i:
Yes, but you have to be careful, it could be that you damage the resistor and brick your box while shorting...

In case you downgrade to 5.2.6.6 or below, you must flash 5.2.6.7 before going to 5.2.6.8 or later.
[Fire TV Original Android Development] Sus_i:
The recovery is installed on /system (ramdisk). Did you wipe system for some reason?

Anyway, shorting sloane is a bit tricky, thats what your console output looks like... (in case the LED starts flashing as soon as an error shows up) but ofc could be a hardware failure too.
[Fire TV Original Android Development] DanielF50:
First off, try redownloading the package, it could be a corrupt download.

Second, have you tried running gpt-fix.sh instead of bootrom-step.sh? How about using a different USB port? Seemingly the USB 3 ports dont work as well as USB 2 ports.

As Sus_i says though, if the light comes on (on the box), it's booted too far and you need to unplug, and try to short again - the device shouldn't show any signs of life (apart from showing up in lsusb) until the script has completely run through.

I'm curious if your device has a Samsung, Transend or SanDisk EMMC? SanDisk and Transcend seem to be really easy to work with in my experience, but the Samsung chip seems to take a bit of trial and error to get the exploit to work.

Most of the time I find the script will run until just after it clears the preloader, then crash out. If you manage to get this far later on, keep the box plugged in via the power cable once the script errors out, but unplug the USB, run the script, hit enter twice afterwards, then plug the USB in and let it do its thing - I always get a successful run through to twrp when doing that.
[Fire TV Original Android Development] g-man1:
Just wanted to say a massive thanks to all you guys had a fire tv 2nd sat in cupboard for about 10 months, failed update I think, bootloop glowing white light, reseting amazon logo, followed steps, (several times), eventually soldered a tiny wire to dat0, changed usb ports, best tip was after a fail pull the usb out keep power plugged in, reconnect wire and usb, flash went through, got to twrp, installed image zip, (December 2, 2018 - 5.2.6.7_r2 (md5sum: b50a1fddb3e01c18c353195c9f7f50cd)) from https://xdaforums.com/fire-tv/development/firetv-2-sloane-prerooted-stock-images-t3309783, cleared cache,davik etc. Now have a working box, amazon told me at the time it was scrap and they would give me 10% off a new box, it was only 16 months old, and they said only 12months warranty, massive thanks guys
[Fire TV Original Android Development] rarcega:
Erro sending payload

Hi, hope someone could help me with this error:

pi@raspberrypi:~/Downloads $ sudo ./bootrom-step.sh

[2020-07-20 23:42:42.702523] Waiting for bootrom

[2020-07-20 23:43:07.007998] Found port = /dev/ttyACM0

[2020-07-20 23:43:07.010530] Handshake

[2020-07-20 23:43:07.016000] Disable watchdog

* * * Remove the short and press Enter * * *

[2020-07-20 23:43:08.691928] Init crypto engine

[2020-07-20 23:43:08.928171] Disable caches

[2020-07-20 23:43:08.931164] Disable bootrom range checks

[2020-07-20 23:43:09.053212] Load payload from ../brom-payload/build/payload.bin = 0x48B0 bytes

[2020-07-20 23:43:09.079682] Send payload

Traceback (most recent call last):

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 490, in read

'device reports readiness to read but returned no data '

serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "main.py", line 164, in <module>

main()

File "main.py", line 86, in main

load_payload(dev, "../brom-payload/build/payload.bin")

File "/home/pi/Downloads/modules/load_payload.py", line 137, in load_payload

dev.write32(load_addr, words)

File "/home/pi/Downloads/modules/common.py", line 154, in write32

self.check_int(self.dev.read(4), word) # echo word

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 497, in read

raise SerialException('read failed: {}'.format(e))

serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

I tried a over and over, and still get the same error. Even tried all 4 usb ports of the Pi. Thanks
[Fire TV Original Android Development] rarcega:
No worries, fixed it.
[Fire TV Original Android Development] LazorBlind:
I'm having this exact same problem. I tried flashing Rbox's prerooted stock ROM, but it didn't do anything. I tried a factory reset, nothing, I wiped system and was going to try flashing the preroot ROM again, but my flash drive wasn't connected, so I rebooted unaware that the recovery was in /system. So now I'm just stuck at the white amazon logo and when I try to run the unbrick script, I get the error.

Any help?
[Fire TV Original Android Development] 0815hoffi:
Maybe this .....

Fastboot must be updated.....

You can fix this issue if you connect the FireISO system to the internet and run this, in order to update fb:

Code:

pacman -Sy

pacman -Sy fastboot
[Fire TV Original Android Development] Bertonumber1:
hey [MENTION=4692368]rarcega[/MENTION] , you have same error message as me can you tell what you did to fix it pleease mate.

i have brand new box and its currently dead what did you do to get past this error during bootrom step,

cheers in advance

---------- Post added at 05:53 PM ---------- Previous post was at 05:45 PM ----------

Hi [MENTION=10401573]0815hoffi[/MENTION] m8

I'm using Ubuntu 18.0.4, I've been updating adb pyserial and fastboot through apt get install ,as described in OP and according to Ubuntu terminal it's the latest fastboot and adb pyserial.

I don't know how to use or update fireiso I struggle with Linux lol.

Updating Ubuntu as we speak will try that, have just noticed the emmc on my firetv2 sloane board is a SanDisk not mediatek..... Do you think will this matter????

The process starts flashing TEEE

Then immediately gives the error device reports readiness to read but returned no data "

This is with and without short
[Fire TV Original Android Development] Rortiz2:
Hi,

The eMMC can be either Samsung, SanDisk or Transcend.

Did it really cleared the PL? (i.e: You connect the box now and shows up as MT6627 MediaTek Inc. Phone without shorting).

Regards.
[Fire TV Original Android Development] Bertonumber1:
Hey [MENTION=8978978]Rortiz2[/MENTION],

Thanks for replying, it's a brand new box straight out of the wrapper.

Its not showing up at all, I've tried multiple ports, just comes back with no devices emulators found, lsusb it's not showing either, when it's downgrading rpmb it gets to around 80/256 then "device shows readiness to connect but returns no data, multiple ports connected" every time.

I've tried without short, I have left it overnight to give emmc a break will try fresh short today
[Fire TV Original Android Development] Bertonumber1:
You are a diamond m8:good:

Followed your advice unplugged usb and left power on ......hit enter twice plugged in usb and went straight to flashing ..

Happy as a pig in **** here man ....thanks :cool: dude thought id fooked a brand new box
[Fire TV Original Android Development] DanielF50:
Glad I could help, from the archives :silly:
[Fire TV Original Android Development] Seattleweather:
my firetv 2 (sloane) has 5.2.7.4. can I use this method to root it?
[Fire TV Original Android Development] Bertonumber1:
[MENTION=7828313]Seattleweather[/MENTION]

The software version don't matter mate.

Because it's a hardware root method it will work for you. Mines was on 5.2.7.4 too.

Follow the OP to the letter.

Look at my post above.

If you run into the same error just leave the box plugged in and remove the USB,

Run the script again hitting enter twice,

Then plug USB in and it should flash no problemo.

Any problems just holler and someone will help you out [emoji106]
[Fire TV Original Android Development] Seattleweather:
Thanks a lot.
[Fire TV Original Android Development] Bertonumber1:
No worries m8
[Fire TV Original Android Development] Kooneybert:
From what I read here, my problem doesn't seem to be very unusual. Nevertheless I can't get it right. It also fails with me because of ".serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)"

But I don't understand your tip either, Bertonumber1. If I remove the USB cable and start the script (bootrom-step.sh) again and press Enter... then obviously nothing can happen? Only "Waiting for bootrom", of course.

Can you please explain to me in detail how to use your trick again? It seems to work for some others, but I don't understand how.
[Fire TV Original Android Development] Sus_i:
This trick itself can be tricky.

In case you press enter twice, you need to remove the short as soon the script finds it, or the script will error out too.

If you press enter once, you have more time to remove the short / enter press.

Shorting sloane isn't easy, if you do it the first (about fifty) times ;)

Main problem (compared to the sticks) is that the box sucks power over usb and the power supply.

If the script errors out, you need to disconnect both...

then run the script with sudo, do/keep shorting and connect usb, then power.

Works best if you use a third hand ;)

In case the script runs somewhat behind the check gpt thing, the preloader gets deleted.

If this is the case, you'll see no white LED at power up...

Now you can re-run the script without a short (a powercycle/connect usb is enough).

Most important, make sure not to damage the resistor.

Good luck.
[Fire TV Original Android Development] Bertonumber1:
[MENTION=5213625]Sus_i[/MENTION] I couldn't get the script to go through and got the same error mentioned in the quote.

From the archives danielf50 method worked same as you describe. I had tried everything. Nearly 40hours straight lol

Run the script

When you get the readiness to connect error

Unplug USB, leave the box power on

Run the script again hitting enter twice

Then plug USB back in

It goes straight to flashing preloader and into twrp

I struggled to get the script to go through and this method worked first shot. It's a stubborn root this box
[Fire TV Original Android Development] Bertonumber1:
Great, this is progress believe it or not.

Leave the firetv box as is with the dc power of your box still comnected

disconnect the USB from the back of the firetv and run the script again (be sure to hit enter twice after boot rom command)

With the script running (boot rom step) it will run with the message " waiting for preloader"

Pull the dc power

Reconnect Connect USB

Connect dc power

It should then flash successfully

Note : this is mirror image to the error I was getting each time, until I done it this way instead.

Let me know how you get on
[Fire TV Original Android Development] Sus_i:
:good:

Yeah, if you see this in the log:

[2020-10-08 18:03:08.690012] Clear preloader header
[8 / 8]

then there is no need for a short anymore.

This is the best case (or progress like you said), the cleared PL acts now as the short :)

Always bootrom (phone) mode at power up.

Worst case is if the error comes infront the clear PL :p
[Fire TV Original Android Development] masterElmar:
[2020-10-08 18:40:45.647373] Flashing TEE..

[233/3725]

this is the last out put befor it stops.

USB 2 connected

nothing else connected and the Fire TV 2 is on stock and the latest firmware

:(

I would mention that the error stops after the same period of time again every time when i try to flash.

Also when i press the enter button manually later the TEE flash process wont reach 230 of 3725

it already stops at 140 / 3725 , so i think that it could be another program or task that would enter the device or connection?!
[Fire TV Original Android Development] Sus_i:
What linux are you using?

You followed the OP and the ModemManager is disabled?

If yes, try redownloading the zip from OP, extract it with linux to Dektop.

If it doesn't help, try some other usb port.

Maybe give the gpt-fix.sh a shot... (instead bootrom-step.sh).
[Fire TV Original Android Development] masterElmar:
Iam using Ubuntu 20.04.1 LTS with the latest updates but in Live Mode.

I checked it on two PCs either an Intel Desktop and a new Notebook.

I tested USB 2.0 ports, USB 3.0 and some type C ports. On all these ports the same issue.

Is there any option to get back to normal FireOS now after this state of flashing and no need of short?
[Fire TV Original Android Development] Sus_i:
Ok.

As you know, if you boot in live mode, make sure to run this commands on every boot:

sudo add-apt-repository universe
sudo apt update
sudo apt install python3 python3-serial adb fastboot
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

You can try the fireISO instead ubuntu too.

All requirements inbuild. Link

Have you tried this?

sudo ./gpt-fix.sh

Next thing to try is a second usb cable...

What a-a cable are u using?

PS: There isn't another way to get your box up and running again.
[Fire TV Original Android Development] Kooneybert:
What do you mean when you say "hit enter twice"?

- I open terminal in the folder with the script and type "sudo ./bootrom-step.sh"

- I press enter once to run the script. Waiting for bootrom shows up.

- I press enter twice again?? This just adds new lines to the terminal windows...

- I start over and type in the starting command but press enter twice immediatly in order to execute the script.. This doesnt change anything.
[Fire TV Original Android Development] Bertonumber1:
WOAH WOAH WOAH [MENTION=7085952]Kooneybert[/MENTION] I was explaining this to the below member.

I take it you're at this stage too?????

[MENTION=9094464]masterElmar[/MENTION]

It does work

hit enter to run script,

then hit enter again

go through the process above.

Hell yeah it will add those extra lines after command (ignore those and focus on plugging USB back in and repowering device)

It will go through. Try again and again sometimes it's just timing.

Always try another USB a to USB a cable sometimes this is the problem from a hardware perspective.

It works mate, it does seem weird but this is a weird device to root.

I've had the exact same error as you on each device, hundreds of times and managed to enable numerous devices this way.
[Fire TV Original Android Development] Rortiz2:
Hey:)

Thanks for try the script.

About the first one, is your /system OK? Bootlop at Amazon Grey Logo is like you don't have correct system.

Sounds like modemmanager is still here. Did you disabled it?

sudo service ModemManager stop

Cheers!
[Fire TV Original Android Development] DanielF50:
Thanks for the response - yeah, I did. I assume this only has to be done once per reboot & not once per terminal window?

I edited my previous post instead of posting this, but I'll repeat it here: she seems dead now (maybe just in mediatek mode?) as there's lights or hdmi output now, but I'll update if I get it to come back.
[Fire TV Original Android Development] Rortiz2:
Ofc is dead, step-1.sh flashes older preloader xD. "Downgrading Preloader..."

Does your /system partition was ok when the device bricked?

Regards.
[Fire TV Original Android Development] DanielF50:
Ah, I see, so if I can reflash the current preloader should get it back to where I was before? Or is she dead? :p

Yeah, I never touched the system partition before it was bricked so I'm struggling to figure out what the issue is. It bricked after I rebooted to recovery for step 5 of the sloane root tutorial for some reason a few months back & I was never able to restore it.
[Fire TV Original Android Development] Rortiz2:
Weird. You were in 5.2.6.8 and this unbrick flashes stock 5.2.6.8 stock imgs.

Is not dead. Try run again bootrom-step.sh.

Regards.
[Fire TV Original Android Development] DanielF50:
Thanks bud, I didn't realise I could run the script when it was "dead" but saw it was showing up on devices, so tried it and it's back to "life", but again not booting completely.

Ill try to figure this out and keep you updated think :confused:
[Fire TV Original Android Development] Rortiz2:
When it was "dead" it was in Mediatek MT65xx Preloader Mode. For bring it back to life just short and run bootrom-step.sh as you done.

A serial output would be very useful right now :silly:

I need to take a look of what does that zip that you flashed for brick the device.

EDIT: It edits the /system partition so maybe that ****ed up. In order for not spam this thread, do you have Telegram?

DM me: R0rt1z2. I need to investigatie further the /system based bricks.

Cheers.
[Fire TV Original Android Development] Rortiz2:
To all (specially [MENTION=5213625]Sus_i[/MENTION] :P):

We got a working solution for broken /system partitions. Will update soon :)

Cheers!
[Fire TV Original Android Development] k4y0z:
[MENTION=8978978]Rortiz2[/MENTION] What issues did you have with clearing RPMB?

That has worked unmodified an all the other devices.
[Fire TV Original Android Development] Rortiz2:
Hey;)

Yeah weird error check attatchment.

Anyway, Iwe just got a working method that uses rbox's preloader tools in step 1.
[Fire TV Original Android Development] ForForkSake:
So I managed to brick it again by flashing magisk.... black and white Amazon logo

However, I modified the main.py to just flash boot .. used the boot.img from the rom I'm using and voila....

./bootrom-step.sh

[2019-10-20 07:23:59.002373] Waiting for bootrom

[2019-10-20 07:24:31.950455] Found port = /dev/ttyACM1

[2019-10-20 07:24:31.954718] Handshake

[2019-10-20 07:24:31.955841] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-10-20 07:24:34.776454] Init crypto engine

[2019-10-20 07:24:34.802285] Disable caches

[2019-10-20 07:24:34.802823] Disable bootrom range checks

[2019-10-20 07:24:34.817753] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes

[2019-10-20 07:24:34.821298] Send payload

[2019-10-20 07:24:35.454587] Let's rock

[2019-10-20 07:24:35.455346] Wait for the payload to come online...

[2019-10-20 07:24:39.016282] all good

[2019-10-20 07:24:39.016624] Check GPT

[2019-10-20 07:24:40.286955] gpt_parsed = {'PRO_INFO': (1024, 254), 'NVRAM': (2048, 10240), 'TEE1': (12288, 10240), 'TEE2': (22528, 10240), 'lk': (32768, 2048), 'boot': (34816, 51200), 'recovery': (86016, 51200), 'KB': (137216, 2048), 'DKB': (139264, 2048), 'MISC': (141312, 1024), 'LOGO': (142336, 16384), 'EXPDB': (158720, 23296), 'system': (182016, 2477600), 'cache': (2659616, 512000), 'userdata': (3171616, 12098239), '': (0, 1)}

[2019-10-20 07:24:40.287148] Check boot0

[2019-10-20 07:24:41.474004] Check rpmb

Do you want to restore stock boot? y/n >> y

[2019-10-20 07:24:44.472855] Flashing boot.img..

[31252 / 31252]

[2019-10-20 07:32:39.329416] Reboot to FireOS..

Cant get over how quick and easy it is. Thanks again guys
[Fire TV Original Android Development] Rortiz2:
You still have locked bootloader. Flashing unisgned boot.img will cause the device to refuse to boot.

Unless someone ports lk-payload from hd10, you will have locked bl.

Cheers.
[Fire TV Original Android Development] ForForkSake:
Ahhh that's the reason magisk failed? Fair enough. I don't mind risking things now .. but gpod to know... its not important anyway.. rbox has supersu on his pre rooted roms
[Fire TV Original Android Development] Sus_i:
:good:

Maybe I pickup a (stuck at booting) box just to test this out :p