yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] bibikalka:
I was able to read eMMC info in TWRP using the command line from the dead stick. I have an OTG cable, USB hub, and added a mouse, keyboard, and a USB stick - all 3 at once. Then in TWRP go to the Advanced/Terminal, and type away!

Use this utility:

[EXE] Static Linux binaries for ARM/Android (Cryptsetup, EncFS, F2FS-Tools, Testdisk, PhotoRec,..)

Native ARM/static Linux binaries (for all ARMv7+ compatible platforms) Open-source Linux binaries that are either not available on Android (e.g. in Termux) or make sense to be statically compiled (e.g. to run in TWRP/recovery for data...

xdaforums.com

mmc extcsd read /dev/block/mmcblk0

The dead stick has this:

eMMC Pre EOL information [EXT_CSD_PRE_EOL_INFO]: 0x03

A good stick had 0x01. Reading the manual, 0x03 is the sign of the dying/dead eMMC.

Troubleshooting Disk Lifetime | pfSense Documentation

docs.netgate.com

Pre-EOL

Pre EOL information is an overall status for reserved blocks on the disks.

Possible values are:

Value	Severity	Meaning
0x00	Not defined.
0x01	Normal	The disk has consumed less than 80% of its reserved blocks
0x02	Warning	The disk has consumed more than 80% of its reserved blocks
0x03	Urgent	The disk has consumed more than 90% of its reserved blocks

Thanks to @Kramar111 for suggesting me to look at this!
[Fire TV Original Android Development] hasobist:
Hello @bibikalka !

Great info diving much deeper .

Wonder if the EMMC values stay constant or keep dipping?

Thank you for the info, you see that's the goodness, warmth, greatness and culture of the XDA community based on the values of "SHARING IS CARING", appreciate that especially all who take time to contribute, support and respond to fellow members with patience. Personally owe loads to the community for educating me and indeed each and everyone of us as well in turn, increasing from strength to strength and marching along.

Keep the good work going!

Thank you one and all.......

Cheers!!
[Fire TV Original Android Development] Sus_i:
To check eMMC status we can also run something like this via TWRP adb

adb shell
cat /sys/class/block/mmcblk0/device/cid
cat /sys/class/block/mmcblk0/device/csd
mount -t debugfs none /sys/kernel/debug && cat /sys/kernel/debug/mmc0/mmc0:0001/ext_csd
[Fire TV Original Android Development] Kramar111:
Root needed (or TWRP)

cat /sys/block/mmcblk0/device/life_time
cat /sys/block/mmcblk0/device/pre_eol_info

Thanks to @bibikalka for the link - https://docs.netgate.com/pfsense/en/latest/troubleshooting/disk-lifetime.html
[Fire TV Original Android Development] xdaforums.f6o79:
Hi All,

I am running Fire OS 6.7.0.2 on a Fire Stick model E9L29Y - is it possible to unlock and if so how?
[Fire TV Original Android Development] xdaforums.f6o79:
I think I have managed to short the device, however Its just stuck on waiting for device.

Maybe it's possibly patched?
[Fire TV Original Android Development] gutbpbb:
Hello guys.

This step by step to unbrick using TWRP will work for amazon fire stick 4K Max?

I am stucked on the fire stick logo on screen since the first setup (that I never could finish). I already tried this one:

https://xdaforums.com/t/unlock-root...k-3-and-fire-tv-stick-lite-sheldon-p.4410297/

but also does not work.

Please help me.
[Fire TV Original Android Development] bibikalka:
Another 6.2.7.7 finding. I was able to assign "DirectTV' remote button to Wolf launcher, and it works! This is for the FireOS version that did not even have or support special remote buttons yet! The launcher manager seemed glitchy - and I don't mind the old Amazon interface, so I'll use other than special occasions when Wolf is preferred.
[Fire TV Original Android Development] bibikalka:
Woot has Mantis for $17 in the US:

Amazon Fire TV Stick 4K (1st Gen) with Alexa Voice Remote (3rd Gen)

Amazon Fire TV Stick 4K (1st Gen) with Alexa Voice Remote (3rd Gen)

electronics.woot.com

Grab one, block updates, keep the hope alive it can be rooted one day!!!
[Fire TV Original Android Development] bankerjoe:
I'm not sure if this is the right place to ask. I have a Fire TV Stick 4K Max (didn't purchase, was acquired). It has Fire OS 7.6.7.1/Fire TV Home Version 6510118.1. Is it not rootable? I ask less about rooting but more about the obnoxious levels of bloat. I'd love to just clean it up, but I'd also not be against a different OS/interface. I don't really have designs on it yet...that's all going to depend on what is possible. TYIA.
[Fire TV Original Android Development] blakegriplingph:
Sadly 7.6.7.1 is locked down tight at least at the moment. There is currently no chance of a downgrade or exploit due to Amazon utilising efuses among other safeguards.
[Fire TV Original Android Development] bankerjoe:
As in "shorting" methods don't work either?

Bummer. At least they were free. I'd prefer a different OS and UX, but if nothing else I was hoping to debloat the damn thing.
[Fire TV Original Android Development] blakegriplingph:
Yea, @Rortiz2 mentioned somewhere that he managed to trash one of his Fire devices due to the stringent protection it uses.
[Fire TV Original Android Development] bankerjoe:
Good to know. So far I've learned that I'll never buy most Amazon/Fire products ever. And am beginning to learn acquisition of free/used may not be as worth it as hoped
[Fire TV Original Android Development] blakegriplingph:
It's a lottery as it'll be hard to know unless the previous owner somehow left the device at an exploitable version.

That being said, the problem with no-name TV boxes is their dubious reliability as they can be quite unstable and are a privacy nightmare because of embedded malware in the system image.
[Fire TV Original Android Development] radrnatn:
im getting permission denied when i run ./bootrom-step.sh and when i use sudo it says not found. ive done this exploit before not sure what im missing
[Fire TV Original Android Development] Iridule:
Not sure if this is the right area, I had tried to post some questions in an older thread Here about Rooting a Hisense U6H...I have the 50U6HF (Amazon version) I have a serial console through the Mainboard debug area, yet holding enter causes lockdown mode, so I can't get uboot bootloader menu to show up to extract the boot.img. Any ideas? If I unplug the tv and plug it in while holding enter it triggers lockdown mode, If I try to power on the device UART gets disabled. I've tried ESC, CTrL^C, SPACE only thing that does anything is Enter and that causes lockdown.
[Fire TV Original Android Development] sousa_jeferson:
*MOD EDIT* Translation - Good morning guys! I hope you are well! I have the fire tv stick 4k, which is in the fire logo loop. Following the step, you reached the no command, but it doesn't leave it. So far I haven't found a step-by-step guide here to help reset the factory, or even change the system. Can you help me

Pessoal bom dia!

Espero que esteja bem!

Estou com o fire tv stick 4k, que está no loop da logo de fogo.

Seguir o passo, chegou até o no command, porém não sai disso.

Até o presente momento não encontrei aqui um passo a passo para ajudar a reiniciar a fábrica, ou até mesmo mudar o sistema.

Poderiam me ajudar?
[Fire TV Original Android Development] Iridule:
So anyone have an idea how to unlock lockdown mode? (Hisense 50U6HF) I contacted the manufacturer Hisense, and Amazon they said they don't support anything to do with the internal of the device. So I contacted mediatek and am waiting to hear back. I also contacted a Hisense certified local repair shop and they never use the UART port they just swap the entire board.
[Fire TV Original Android Development] hasoc:
can you please explain more about what is the vulnerabilities of the "shorting"?
[Fire TV Original Android Development] Sus_i:
@hasoc

Forget about it. Amazon fixed the vulnerability used by kamakiri (i.e. bootrom aviable if the SOCs bootrom can't load the preloader from the eMMC while shorted) long ago...
[Fire TV Original Android Development] Iridule:
Would this "fix" be what is blocking me from getting a interactive shell after interrupting Uboot on my 50U6HF Hisense? I got RX,TX,GND soldered to the debug area of the mainboard but holding enter gives me a shell that is in lockdown mode. I notice while in lockdown though pushing any button on the fire tv remote shows feedback on the shell, maybe there is a special code (or combination of button presses) to exit lockdown?

============= set bootargs ===============

Hit any key to stop autoboot: 0 0

<< M7632 >>#

<< M7632 >># version

command not supported in lockdown
[Fire TV Original Android Development] hasoc:
@Sus_i , Thank you for answering my question.

can you help me understanding the meaning of "bootrom available"? does it mean the bootrom will go to download mode if it can't load the preloader from the eMMC?

my understanding is that the bootrom will wait for the START command from UART for a short period to enter download mode so the eMMC short may not needed (maybe it is device specific). please correct me if my understanding is not correct. thanks
[Fire TV Original Android Development] Sus_i:
Yes, the bootrom stays aviable during the short, kamakiri does a handshake and then as soon as the short is removed, kamakiri will flash stuff to the eMMC.

A stick with a burned efuse will just halt/stop, the kamakiri method with short isn't working...

Maybe we get an update of mtkclient somehow/sometime with a build-in workarround for current amaz. preloader security, then kamakiri 2.1 may work again, probably even for new 4k mantis sticks. It's best to block OTA for all amazon devices.

Anyways, instead of waiting, there is also the soldering method, which will enable kamakiri if you manage to flash kamakiris preloader.img to eMMC boot1.

There is also another working method doing the same without soldering, but it's non-public for now or maybe for ever, idk.
[Fire TV Original Android Development] hasoc:
thanks for clarifying.
[Fire TV Original Android Development] hasoc:
one more quick question,

according to https://xdaforums.com/t/unlock-root...k-3-and-fire-tv-stick-lite-sheldon-p.4410297/

the sheldon device rooting doesn't require eMMC shorting, is it because the vulnerability of sheldon device is in the preloader instead of the bootrom?
[Fire TV Original Android Development] Rortiz2:
Correct. In fact, mantis is was affected by the same vulnerability (considering they both share the same SoC). This allowed unlocking newer units (without bootrom access), but Amazon patched it quickly ;)​
[Fire TV Original Android Development] Iridule:
So anyone have an idea about my issue possibly being related to the patch amazon has implemented ? I even read about code injection by using auto_update.bin"some command like help, or dump rom" and tried but no luck.
[Fire TV Original Android Development] supergonzo74:
Hi everybody,

seems I could use a little help as despite of all my efforts in order to prevent ota updates I somehow messed up my rooted mantis firetv stick:

In order to gain back root access I tried the kamakiri method - and thats where my questions arise: I ran into above error and as suggested I commented out the rpmb check. Thus I was able to boot into twrp and install prerooted mantis zip as well as Magisk. After the flashing I wiped cache and dalvik and rebooted into system. But no matter what I do after that my device never again shows up in "adb devices" as it used to do.

What am I doing wrong here?

Is that the normal behavior when the efuse got blown?

Or are my changes not persistent anymore since the rpmb downgrade is commented out?

Any help is highliy appreciated.
[Fire TV Original Android Development] hasobist:
Hello @supergonzo74 !

Few queries if you can answer, helps understand the situation:

1.Did you try the unlock by using the exploit kamakiri 2.0.1 from the unlock thread in OP of Kamakiri and following the instructions from Sheldons thread in the OP

2.which version of the pre-rooted rom is the stick running and did you clean flash the rom by clearing /system /data /cache and /dalvik-cache and then flash rom of choice followed by Magisk and then wipe /cache and /dalvik-cache before reboot

3.Did you toggle the adb and unknown sources in settings of Firetv to on or is it greyed out

4.When you messed up with your stick were you ain't able to boot into TWRP and flash Magisk again to gain root access ,which rules out the redoing of everything all over again

Thank you!

Cheers!
[Fire TV Original Android Development] supergonzo74:
Good evening everybody,

replying to my own post above. Seems it was a bit too late yesterday evening: Just wanted to inform you that my hardware is fine and not in some locked or efused state. Used kamakiri 2.0.1 but as mentioned above had to comment out the rpmb check in order to be able to flash mantis-6.2.8.1-rooted_r2.zip and afterwards mantis-6.2.8.1-rooted_r3.zip together with Magisk-v27.0.zip, wiped cache and dalvik after each flash. All this worked out well according to the logs - only thing that made me extremely unsure was that afterwards I couldn't get past network setup dialog and was not able to determine whether if my stick was online long enough in order to be able to download an ota image while it was connected to my mobiles hotspot and thus suspected efuse could eventually have been blown.

Thinking my situation over I remembered the bypass initial network connection setup dialog via voice assistant and was able to get past this point - then re-enabled the checkboxes for adb debugging and unknown sources in dev options and my root access was back again...

Another thing I stumbled upon is that when you request root access via su command in adb too early after boot as the stick still show its boot ani then probably magisks grant-root-access-notification-popup does not show up and root access is denied - that was at least my impression as I don't remember to have seen it. Consequently I had to manually to grant it in magisk-managers settings afterwards. As magisk remembers the answer and normally doesn't prompt again that could disturb some users - is there anybody around to confirm this suspicion?

Anyway thanks to @hasobist and all of you out there for your constant support...

Best Regards and sorry once again.
[Fire TV Original Android Development] hasobist:
Hello @supergonzo74 !

Good to know your Firetv stick is up and running,in most cases TWRP is a life saver.

As for Magisk, granting root access ,if you have been using the same apps and are trusted unlike me, in the superuser settings of Magisk root access always set to grant and in the Toast notifications section is always set to none. Hence no annoying notifications and your sure that the apps that run on root have been granted root access. There's certain delay as to the apps running in background ,requesting root access depends on priority, the logs speak for the behaviour of the apps granted/requesting root access ,mostly is after boot.

Thank you

Cheers!
[Fire TV Original Android Development] sharukhan2001:
I have Fire Stick 4k max 3d Gen How to unlock bootloader please please please Tell me any one
[Fire TV Original Android Development] stefss:
Hi, i do this at 2019, and it works perfectly all time. Suddlenly my remote stop working so i buy new.

But on new remote, volume buttons and power button just not work. I try everything.

Can problem be if fact that it rooted etc? I think no, but i not know why this is like that.
[Fire TV Original Android Development] hasobist:
Hello @stefss !

Wonder what's the problem you're facing with the remote,if you can specify, get an idea to clearly understand the problem your facing with the same and help escalate.

Thank you

Cheers!
[Fire TV Original Android Development] rigo88:
hi there's maybe a topic for it but.. i have an older otg if that even matters, and an older usb stick. i'd say usb2.0 or 2.1 not sure. when i move apps to the usb drive, they load significantly slower than when they're on the stick's internal storage. would it load just as or at least closer to the speed of the internal drive if i'd buy a new otg and a new 3.0 usb stick? are those 2-3 dollar otgs from amazon 3.0 at all? and/or the amazon stick's connection is the bottle neck and apps will never load as fast as when they're on the internal storage?

meaing... spending 15 bucks on trying to fix something when the result is miserable doesn't worth it i'd rather get a 4k max with 16 gb storage which would be enough for me for the moment. i think. i'm only watching tv on my fire stick nothing fancy. 1080 as of now but planning to get a 4k tv and was wondering if 4k streaming needs more than 5-600 mbyte free space on the device for caching.

thanks

btw the downloader - adb app method on newer (as of july29 2024) amazon fire stick os versions don't work, but the adblink2 win/mac/linux application from jocala works very well.
[Fire TV Original Android Development] hasobist:
Hello @rigo88 !

Is your Firetv unlocked,

Wonder which app you're using with the Firetv which takes time to load. How much free space you have in your internal storage?

Been using Easy2fire app since years and works well in the events of installing,transferring and even uploading/downloading files from/to Firetv/mobile device.

You need to have enough room in the internal storage, as you said you use an OTG ,you can use USB Storage drive and transfer heavy files from internal storage to the drive.

Also try clearing the built up /cache for respective apps.

Hope it helps.......

Cheers!
[Fire TV Original Android Development] rigo88:
i didn't mess with anything but logged in with adblink2 after allowing unknown sources and developer mode / adb. so no, not unlocked. hulu for one started slow. but after 1st start it starts fast enough. so i'm assuming it wrote some locals or something at first run after moving it. i think i'll get a usb 3.0 drive. 16 or 32gb.

question is if what speed the otg is connecting to the fire stick to...

thanks
[Fire TV Original Android Development] k4y0z:
Just rename it to ".zip" and install it using TWRP.
[Fire TV Original Android Development] hyperblu:
More strangeness. Booted into home menu, nothing would load, then kicked me out like I was deregistered and had to connect to WiFi again, and valid Amazon credentials were denied.

---------- Post added at 06:28 AM ---------- Previous post was at 06:24 AM ----------

Lol, I just recovered to a backup and for some reason I was brought to an "auth portal" on bootup. WTH.

I was able to successfully sign in this time after recovering back to latest. Tried flashing that .bin again and seeing if it does the same thing.

---------- Post added at 06:36 AM ---------- Previous post was at 06:28 AM ----------

Same results. How do I remove the hacked bootloader/recovery? Trying to get this thing back to normal. Something here is messing with Amazon authentication, just not sure what. I want to go back to stock recovery and a signed bootloader, try getting it all up to date, then running the exploit again.
[Fire TV Original Android Development] Sus_i:
Yes, that strange auth screen comes sometimes if you restore system without data and/or data without system... can't remember in detail, but I had this screen during tests too.

If I remember correct, you said that you own a 4k stick with a broken smd part. If yes, you may test the attachment from this post, maybe you can get the stick back to life. Please report back ;)
[Fire TV Original Android Development] Pretoriano80:
Hi! About dm-verity, any idea where that is flagged? I'm asking because on my custom kernel i disabled DM_VERITY in defconfig, but for some reason it seems that is still there. FSTAB doesn't have any "verify" flag either, so i'm clueless for now.

While testing some stuff, i replaced vold binary, set ownership and permissions, but the stick gets stuck on the first boot logo. The odd thing is that putting back the original vold binary trigger the same behavior and only flashing back the full system image fix it.

Any thoughts? Thx!
[Fire TV Original Android Development] hyperblu:
I'm about to try this now. I'll report back in a few.
[Fire TV Original Android Development] LuCkyCn:
I actually have this same problem. All Amazon contents shows license error. I'm not sure what to do at this point.
[Fire TV Original Android Development] Pretoriano80:
Download the update from here - > https://xdaforums.com/fire-tv/orig-development/unlock-fire-tv-stick-4k-mantis-t3978459/post80563827 < - rename it to .zip anf flash it with TWRP.

P. S. You may have to unlock it again with the exploit from OP after this.
[Fire TV Original Android Development] hyperblu:
[MENTION=5213625]Sus_i[/MENTION] and [MENTION=7104332]k4y0z[/MENTION] for what it's worth, I'm not sure if this will help or not, but my 4k stick was successfully exploited and I accidentally updated magisk via fireos. The device would not boot past the black/white fire TV screen or give me the option for twrp. I attempted to rerun the exploit and broke the left smd.

Sus_i had me run the delayed bootrom-step batch file and after several failed attempts on DAT0, I tried the right SMD (the intact one) and was successfully able to run the exploit and get back into twrp. I can't comment on whether I'm able to flash another ROM, but I'm assuming it wouldn't be an issue since I'm able to reach twrp once again.
[Fire TV Original Android Development] Sus_i:
That looks good :good:

Thank you for your quick reply.
[Fire TV Original Android Development] hyperblu:
I would attempt to push another ROM to it, but I hard reset my router and changed SSID (can't remember what the old one was), so I'm no longer able to adb wirelessly to it. All I have is an OTG cable and a handheld keyboard. No powered USB hub. Seems I have a few things I need to order from Amazon.
[Fire TV Original Android Development] LuCkyCn:
I already did that and it didn't work. TWRP actually stuck too...
[Fire TV Original Android Development] hyperblu:
I'm convinced we are probably going to have to flash the boot.img in fastboot in order to fix the license issue and attempt to rerun the exploit. I've tried flashing stock ROMs and it persists with issues authenticating with Amazon servers. This would lead me to believe something isn't jiving on Amazon's end to allow licensure for their content. I am able to play prime video for a brief second, so I know the stick is able to get the content.
[Fire TV Original Android Development] LuCkyCn:
Is your TWRP sticking too?
[Fire TV Original Android Development] hyperblu:
Just a thought, those of you having prime license issues, was your stick registered to Amazon's servers before running the exploit? Reason I ask is I exploited this one straight out of the box before setup. Maybe their server collects bootloader data (maybe for warranty reasons?) when you register the stick and if you're running a hacked bootloader, they're not able to authenticate your account to that device?

Maybe wiping data after the exploit and having to register the stick to an account again is what did us in? As opposed to it just installing an update?

---------- Post added at 12:34 PM ---------- Previous post was at 12:28 PM ----------

No, my twrp is fine. How is it "sticking" for you?
[Fire TV Original Android Development] LuCkyCn:
I meant, I was hoping it would reset to factory with factory bootloader. I actually ran the full set up and everything and did the exploit after. The error occurs days later after the exploit.
[Fire TV Original Android Development] k4y0z:
Did you do a factory reset after installing stock image?

I haven't really looked into it that much, but installing Magisk should get rid of dm-verity problems.

No need to redo the exploit after installing stock.

You can use adb over USB...

Anyone having issues with licensing errors, I suggest (again) install the stock ROM from TWRP and do a factory reset afterwards.

Here are the links for 6.2.6.5 and 6.2.6.6:

https://d1s31zyz7dcc2d.cloudfront.n...dle-mantis-NS6265_user_2157_0002852679044.bin

https://d1s31zyz7dcc2d.cloudfront.n...dle-mantis-NS6266_user_2292_0003054040196.bin
[Fire TV Original Android Development] xam1988:
Kigba test, and it's work greate.

Finally he restore his stick.