yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Rortiz2:
This guide is only for the Fire TV 2 2015 (not stick) codenamed "sloane" with mt8173.

This will flash correct partitions and TWRP into it.

This WILL NOT clean RPMB neither will unlock the device.

I am not responsable of any physical damage in your device, YOU choose to make this modifications.

NOTE: Full unlock has been released, please refer to this thread: https://xdaforums.com/t/unlock-root-twrp-unbrick-firetv-2-sloane.4222331/

NOTE: You will need to open the device so be prepared ;)

NOTE: This will flash 5.6.2.8 images meaning RPMB will be updated.

MATERIAL NEEDED:

Linux based system.

USB A-A Cable.

Something conductive (paperclip, tweezers, etc).

Something to open the device.

- Install python3, PySerial, adb, fastboot:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot

- Uninstall/disable modemmanager:

sudo apt remove modemmanager

PROCEDURE:

0. Open up the device. You can use a pick or a kinfe or any special tool to open it up.

1. Locate DAT0 in the attatched image. You will need to flip the motherboard.

2. Download amonet-mt8173-sloane from downloads and unpack it.

3. Open the unpacked folder of amonet, open a terminal inside it and type:

sudo ./bootrom-step.sh

4. Wait until you see something like:

[2019-02-07 14:35:59.478924] Waiting for bootrom

5. Once that message shows up, connect the A-A cable but not the power supply. After that, prepare the short and at same time you short DAT0 with GND, plug in the power supply to the wall.

6. The script will ask you to remove the short. When this happens, stop shorting DAT0 and then press enter.

7. Wait until it finishes.

8. The device should now reboot into TWRP. Please, consider now flashing a prerooted ROM or LineageOS 12.1 for get full TWRP.

NOTES:

In lsusb boot-rom shows up as:

Bus 001 Device 009: ID 0e8d:0003 MediaTek Inc. MT6227 phone

If you see:

Bus 001 Device 013: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader

means you're in preloader mode. Try shorting again.

If somehow you have a corrupt gpt (shouldn't happen), just run:

sudo ./gpt-fix.sh

If TWRP freezes, DON'T UNPLUG THE THE POWER SUPPLY, instead, open an adb shell session and type the following command to restart TWRP:

killall recovery

Please, your bootloader is still LOCKED. If you flash custom kernels/unsigned boots (i.e: Magisk Manager, etc) the bootloader will refuse to load the boot image and you will be not able to boot in TWRP anymore unless you re-unbrick the device.

THANKS:

- @CFKod for his patience and for test the script;)

- @retyre & @k4y0z for the initial port to mt8173:)

- @xyz` for his original exploit for the HD8 2018.

- @Sus_i for locate DAT0, DAT1 and DAT2.

- @rbox for TWRP/Boot menu.

DOWNLOAD:

amonet-sloane-v1.3.zip (Or attachments)
[Fire TV Original Android Development] Rortiz2:
Source Code: https://github.com/R0rt1z2/amonet/tree/mt8173-sloane
[Fire TV Original Android Development] ForForkSake:
Brick no more!!

thank you for your patience and knowledge.

My brick was because I wiped system.

I've added another photo, I simply shorted against the metal hole circled in the picture. This is so useful, it not only unbricks, it allows for downgrade of preloader

Meaning I was then able to resolve my lack of system with [MENTION=3991724]rbox[/MENTION] unbrick image.

Also it's so much quicker than flashing via mediatek inject. Wooooo
[Fire TV Original Android Development] Sus_i:
Looks good. :good:

I suppose if step 8 (reboot to system) fails for someone, i.e. something in /system is messed up, the old unbrick solution from [MENTION=3991724]rbox[/MENTION] comes handy, in order to flash a system?

Don't know, don't own that box, but maybe it's possible to add a 'flash TWRP to recovery partition' to your unbrick solution? As last point, instead of boot system, boot to recovery... Then users could flash the latest prerooted rom from [MENTION=3991724]rbox[/MENTION], and skip the old unbrick solution? Just a thought... as I said, I don't know details about that box. ;)

Edit: probably flash TWRP won't work, since the bootloader isn't unlocked?
[Fire TV Original Android Development] Rortiz2:
Sure. I can use MISC flags for boot to recovery.

But the question is: Does the twrp can be loaded with newest preloader?

Also if my memory is OK, I remember it's a ramdisk;)

Cheers.
[Fire TV Original Android Development] Sus_i:
If I remember right, [MENTION=7104332]k4y0z[/MENTION] said that the recovery is flashed out of the boot.img at first boot... and if the TWRP solution is a ramdisk like on the first fireTV, then flashing a TWRP image to the recovery partition will probably not work. Don't know. ;)
[Fire TV Original Android Development] Rortiz2:
Correct. TWRP is actually a ramdisk.cpio.

rbox flashes it using his 2ndinit script which needs to be runned with "su".

This script, simply put SeLinux in permissive mode and boots TWRP at every boot:

https://github.com/androidrbox/firetv-2ndinit/blob/master/jni/2ndinit.c

As you said, flashing the ramdisk directly into /recovery partition will not work since in needs to be signed.

Cheers.
[Fire TV Original Android Development] Sus_i:
Ok. I know that from the 1gen stick/box.

Maybe there is a way to (push and) boot that recovery ramdisk as last step with your script, in order to have the option for flashing the latest prerooted?

Don't know... If you could manage that somehow, you can add the [ROOT] tag into the thread headline ;) :p

[MENTION=3991724]rbox[/MENTION], what do you think?
[Fire TV Original Android Development] Rortiz2:
Yeah it will be pretty nice.

If we can't, we can downgrade preloader, run unbrick image via Preloader and then run a second part of the script that restores correct preloader.

Idk, just for throw ideas.

I added source code in the second post for rbox.

Cheers.
[Fire TV Original Android Development] Kramar111:
Sloane it's Fire TV 2 Gen, not Stick
[Fire TV Original Android Development] Rortiz2:
Thanks;)
[Fire TV Original Android Development] Rortiz2:
[MENTION=5213625]Sus_i[/MENTION] I think I have an idea:)

https://xdaforums.com/fire-tv/orig-development/firetv-2-recovery-installer-t3309785

That installer will help us since it talks with the preloader.

Well, I've a added an argv in the main.py that allows you to downgrade the preloader in order to be able to use rbox tools.

After the downgrade, the scripts reboots the TV and immediatelly it starts with the .sh by rbox that injects the necessary files into the /system/partition.

This is what should do the (let's say step-1.sh). When it finishes, the idea is that the user can run bootrom-step.sh to restore new preloader (shorting again obv) and allow the device to boot with the injected TWRP :)

What do you think?

Best regards!
[Fire TV Original Android Development] Sus_i:
Yeah, sounds good, if the system is in good condition it should work fine.

If system is somewhat corrupt, maybe by an interrupted or failed update or so, I don't know if it will work.

Maybe we think to complex. I assume the amonet script can flash all partitions!? Why not flash a whole new system with that.

Since the prerooted rom is in sparse image format and the updater script does all the rooting stuff after flashing, we can't use that.

But maybe it's possible to write a dd image of a allready rooted /system partition with the amonet script.

Just an idea, don't know if that will work.
[Fire TV Original Android Development] Rortiz2:
/system doesn't need to be ok. We need a working boot.img that loads the 2ndinit.

We can't flash a system with bootROM, it will take 1 day lol.

Take this commit as reference:

https://github.com/R0rt1z2/amonet/commit/339bb4ab2055507f2ed72ebea3861dbdfef67484
[Fire TV Original Android Development] Sus_i:
lol, as I said, don't know if that is possible with the amonet script :D :p

Yeah, if the boot.img will load 2ndinit, i.e. the recovery, that should do the trick fine :good:
[Fire TV Original Android Development] Rortiz2:
Let's see if we can try today.

Also it will require to copy the ramdisk recovery to an external usb or external sd.

Regards!
[Fire TV Original Android Development] Sus_i:
Yes, have seen it on github, but both is possible with the second gen FireTV box... only the usb port could be a problem, if usb debugging is enabled (but I don't know if debugging is aviable at this early stage?).
[Fire TV Original Android Development] Rortiz2:
I don't think usb debugging is aviable at Preloader Stage;)

Basically would be this:

Format the sdcard/usb and copy the .cpio on it, then insert sdcard/usb into the TV.

Run first step:

sudo ./step-1.sh

It will downgrade preloader & inject 2ndinit.

After that, you disconnect the tv and run bootrom-step for restore working imgs:

sudo ./bootrom-step.sh

After that will reboot and since we have 2ndinit as pppd it will boot in TWRP.

From there you flash prerooted ROM and you're done:)

That's my idea but maybe doesn't work.

Cheers.
[Fire TV Original Android Development] Sus_i:
Sounds and looks good. :good:

I'm confident that it will work :fingers-crossed:

only sad thing is that I can't test it ;)
[Fire TV Original Android Development] DanielF50:
Hey [MENTION=8978978]Rortiz2[/MENTION], thanks for this! My sloane has been bricked for a few months after trying to root - this script ran & uploaded the boot.img to the device, but unfortunately it still won't boot (flashing with amazon logo).

I tried using your twrp test, but that results in terminal hanging at the below:

I was hoping I could get twrp running & then flash a pre-rooted image so that it clears whatever's wrong with the unit, but as above, I don't seem to be able to get it to boot :(

Any ideas?

Edit: welp, after cancelling the terminal command she now won't boot at all, lol... no signs of life but I'll keep this updated if I get can resurrect her.
[Fire TV Original Android Development] Rortiz2:
Do you have telegram? If so, message me, please, I would like to talk there better:

R0rt1z2

Regards.
[Fire TV Original Android Development] Sus_i:
Then its probably way safer to short the DAT1 pad, as it can't be damaged...

Thanks for testing...
[Fire TV Original Android Development] sconnyuk:
I have just installed and set telegram up, how would I add you ?
[Fire TV Original Android Development] genica:
No doubt this thing could be a pain to short out. I short the pins around the OP pic for ten or so seconds. The white led should go out and stay out even when you remove the short. The script will bring it back to life
[Fire TV Original Android Development] DVO99:
A while back I wiped the OS through TWRP and had some issues so I rebooted without an OS thus resulting in a dead device. I'm trying to catch up on what this unbricks. Would this fix that?
[Fire TV Original Android Development] Rortiz2:
Yes. This can unbrick almost all bricks (not hardware ones ;))

Cheers.
[Fire TV Original Android Development] DVO99:
Thank you so much!! Alright time to start reading it through then.
[Fire TV Original Android Development] Rortiz2:
No problem man;)

Please, post your results to see if you get too that f... error:p

Regards.

Add:

--------------------------------------------------------------------------------------------------------------------------------------------------------

Based on what t0x1cSH said (Thanks xD), dat0 is currently panicking the EMMC so that's why enters in bootROM. I think if we find CLK may work better than DAT0.. I had a quick peak and seems that is under a soldered shield. [MENTION=5213625]Sus_i[/MENTION] can you confirm us that?

Thanks
[Fire TV Original Android Development] sconnyuk:
This way won't work either with my box.

If I understand correctly you short dat0, plug power and when the script tells you to release short you hold it for more seconds then release and hit enter ?
[Fire TV Original Android Development] genica:
The power cable is plugged in, the usb cable is plugged into the pc and box. Short the pins around the op pic and led light will go out. It needs to stay out after removing the short. Once the led stays out run the script
[Fire TV Original Android Development] DVO99:
I've been trying to short it but with no success. Here are the steps I did.

- Run script

- Plug in USB

- Hold the paper clip in position to short

- Plug in power while already holding the paper clip shorting it

The LED won't come on and the script will say remove it, and click enter to proceed. After a few seconds the LED turns back on but gives me the error that everyone has been experiencing. I don't know whats going on. Do I just have to keep cycling it and redoing it? I usually leave it for a minute as suggested unplug and redo it but no success.
[Fire TV Original Android Development] Rortiz2:
Follow exactly this instructions:

https://xdaforums.com/showpost.php?p=80950067&postcount=190

They finally worked for the other friend;)

Regards.
[Fire TV Original Android Development] sconnyuk:
Thanks very much for continued help, this did work and allows me to go through with the script, however this still won't get me to TWRP, when the script tells me it's booting TWRP, I boot straight to resetting your fire TV screen. Anyone have any ideas on how to get me to TWRP ?
[Fire TV Original Android Development] Sus_i:
At power up the box, the bootrom waits about 150ms for a attached host (handshake). If there is no host, the bootrom reads the emmc and execute the preloader...

It doesn't enter the bootrom, it starts always with that step ;)

If a host is aviable within this 150ms and the handshake is complete, the bootrom stays in DL Mode, waiting for commands from host (i.e. run the script with enter).

Shorting DAT0 or CLK does the same, EMMC isn't aviable for the SOC's bootrom, can't execute the preloader. Unfortunately CLK location is unknown. But I think it won't work better than DAT0. ;)
[Fire TV Original Android Development] DVO99:
After spending quite a bit shorting it, I was able to run the script successfully. The issue that I'm coming across now is the script ends with "Reboot to TWRP..." but theres no LED on the fire tv, the fire tv is connected to a TV, and unplugging it and plugging it back in from the wall isn't showing up with the LED light. If I short it (while the LED is off), I am able to run the script again...
[Fire TV Original Android Development] Sus_i:
You mean that the led is off, if you power on the box?

If yes, you may check if the script tells you to remove the short 'without any shorting'...

If this is the case, the bootrom can't jump to the preloader. Two reasons possible, first is that the resistor on DAT0 is damaged or second (and most likely) the preloader wasn't flashed correctly in the last step of the script...
[Fire TV Original Android Development] hyperblu:
I spent a while trying to run this exploit to unbrick tonight. I'm getting an error stating that it seems ready to respond, but isn't communicating back. I'm going to try again using a USB 2.0 port and see if that clears it up. I had to order an A-to-A cable, so hopefully I can get this one to work.

Mine resulted same as above. I finally got it to flash everything, says reboot to twrp, but the device doesn't restart. Unplugging and plugging back in results in nothing happening, nor LED lighting up, however has no issue reflashing bootrom once the short is made again.

---------- Post added at 12:12 PM ---------- Previous post was at 11:20 AM ----------

Once again, I popped the resistor cap off. ?*♂️ That's what was causing it to fail to power on. Doesn't the other end of the cap of DAT0 need to be grounded or something to make it boot?
[Fire TV Original Android Development] Sus_i:
No ;) The other side of the DAT0 resistor is VCCQ = 1.8v power line.

It's the 'pull high resistor' for the emmc interface.

You probably need to replace that resistor...
[Fire TV Original Android Development] hyperblu:
Does it look broken? What's strange is I had a flashing LED before I actually got the script to run. Now it's stuck in mediatek mode. Not sure why pic didn't upload. The other caps are black. This one is grey at DAT0. I'm assuming the cap popped off.
[Fire TV Original Android Development] Sus_i:
May be its not broken, can't tell at this point, probably not broken.

You see, if you got the script to run, it deletes a few blocks from the preloader, in order to get back into bootrom if the script fails...

Whats happen if you run the script without shorting? Do you get an error message?
[Fire TV Original Android Development] sconnyuk:
Well with the extensive help from Rortiz2 I have managed on multiple occasions to get this script to flash my box, even with modified scripts and files very kindly sent to me from Rortiz2 it looks as though this box is a dead end.

No matter what I try after the script finished and tells me it is booting to TWRP it reboots straight to the resetting fire TV screen, (the problem I'm trying to get past) as all it does is the progress bar fills, waits 5 to 10 minutes then restarts.

It seems no matter what is flashed or modified won't get past this.

Anyone else in here able to think of anything else to try ? I really appreciate the help from Rortiz2 but cannot keep expecting help from him as I don't want to continue to impose.
[Fire TV Original Android Development] Sus_i:
Without a full unlock (and twrp flashed to recovery partition), last chance is maybe a wipe of cache (and maybe data) partition with the amonet script, in order to remove this resetting flag. The script can overwrite every partition, if someone edits it to do that.

If you connect a serial console to rx/tx, you could watch out for hardware errors. The preloader boot process with some checks is in that log (logging stops with the jump to the kernel). In one of the last log entrys you can see what boot flag is used, i.e. normal, stock recovery etc.
[Fire TV Original Android Development] hyperblu:
I'm not sure. I'll check when I get home this evening. I just know if I unplug it, run the script and plug power back in it tells me to remove the short even though I don't have it shorted.
[Fire TV Original Android Development] sconnyuk:
No serial console or even the knowledge to use one as I'd get one to test it.

I know Rortiz2 did modify the script a few times to try get rid of the resetting flag.

Even a script modded to mess system partition up and it was there as soon as it booted up.

I wish I knew myself how to mod the script I'd try every which way I could think.
[Fire TV Original Android Development] Rortiz2:
Hi,

Already tried to flashing a zeroed out image into system without success...

I don't know where the **** is that flag..

We will try with cache.

Cheers...
[Fire TV Original Android Development] hyperblu:
Edit: so I had some strange success?! For some reason the flash was successful and I regained the flashing LED and it rebooted to the flashing white Amazon logo, but not twrp. I believe someone else was having this issue. Here's what I did. I unplugged the power and the led continued to flash white... For some reason the USB was actually supplying some power to it. As soon as I unplugged the USB, the led went out and successfully booted into twrp upon power up. It's no longer a brick!
[Fire TV Original Android Development] genica:
You mind sharing the script that formatted the system partition?

---------- Post added at 09:43 PM ---------- Previous post was at 08:57 PM ----------

You think you could add the option to format the system, data and catch?
[Fire TV Original Android Development] DVO99:
I'm hoping the last step was the one that didn't flash correctly. How would I go about fixing it? Do I just rerun the script?
[Fire TV Original Android Development] Sus_i:
You ran the script a second time? Seems the preloader flashed successful this time. :good:

Yes, the box needs a working preloader to boot.

Look first if the script finds the box without shorting.

Rerun the script, watch out for errors.

As soon as the script is done, disconnect the usb cable and connect HDMI (if not already done)...

TWRP should boot up.

You can connect a mouse, usb hub/sticks or whatever.

---------- Post added at 09:14 AM ---------- Previous post was at 09:06 AM ----------

If this reset is caused by OS, it's stored/flagged somewhere.

But could be some kind of hardware error too. The preloader checks various things like ram at boot process.

Although I think that cache or data is messed up and the box trys to fix that.
[Fire TV Original Android Development] DanielF50:
Only problem with that is that wiping these paritions via the bootrom is slow as hell - think about how slowly it flashes a 15mb file, then multiply that by how big /data or /system are :eek:
[Fire TV Original Android Development] bogart1117:
Solid Yellow LED Light

So i got to the "Reboot to TWERP" and my devices never rebooted. I was able to start it with the short being an on/off switch. So I ran the script 5-7 times and then gave up and left everything running and the Fire TV just had the yellow light going.

Any helps appreciated.

---------- Post added at 09:04 AM ---------- Previous post was at 08:37 AM ----------

I flashed it again:(
[Fire TV Original Android Development] Sus_i:
Isn't the yellow light an indicator for hardware failures? idk.

How long is that light flashing? Was it already there before the unbrick attempt with the script?

There isn't a white flashing light at all?
[Fire TV Original Android Development] bogart1117:
The white was on at the beginning. This yellow light showed up after the script was successful and the script said for it to "Reboot to TWRP." Ain't seen the white light sense. It took 5 hrs of sitting there hooked up and doing nothing and all of a sudden I saw the yellow had came on.

I just ran it again but i never made the "Short" happen but the script still ran. So preloader issue?
[Fire TV Original Android Development] Sus_i:
Yes, could be the case. Other option is a damaged resistor at DAT0 or one of the parts around that point... You may take a close look...

What light is flashing if you re-run the script?
[Fire TV Original Android Development] hyperblu:
Keep messing with it. It took me several "successful" attempts to get mine to work correctly. Only I had no flashing led for many of them. Try to run the script, do the short, and when you get to twrp reboot, unplug the power, then usb, then supply power again and see if you boot to twrp.
[Fire TV Original Android Development] Sus_i:
Have you seen a yellow light?