yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Sus_i:
I doubt that is the reason, but anyway, this is what you can try:

You may be able to update a rom via fastboot, but you can't flash zip files...

I think you cannot flash system.new and vendor.new images from out of the zip too, ̵b̵e̵c̵a̵u̵s̵e̵ ̵t̵h̵e̵y̵ ̵a̵r̵e̵ ̵m̵o̵s̵t̵ ̵l̵i̵k̵e̵l̵y̵ ̵s̵p̵a̵r̵s̵e̵.̵ ̵I̵f̵ ̵y̵o̵u̵ ̵w̵a̵n̵t̵ ̵t̵o̵ ̵f̵l̵a̵s̵h̵ ̵s̵p̵a̵r̵s̵e̵ ̵i̵m̵a̵g̵e̵s̵,̵ ̵y̵o̵u̵ ̵n̵e̵e̵d̵ ̵t̵o̵ ̵c̵o̵n̵v̵e̵r̵t̵ ̵t̵h̵e̵m̵ ̵t̵o̵ ̵i̵m̵g̵ ̵v̵i̵a̵ ̵s̵d̵a̵t̵2̵i̵m̵g̵ ̵f̵i̵r̵s̵t̵.̵

Edit/Update: Fastboot flashs sparse images fine.

But since you've got another 4k stick, it should be way easier just to take some image backups via dd (from your working stick ofc) and flash the backups via fastboot.

To do this, you need to connect to your working stick with adb, then run:

adb shell
su
dd if=/dev/block/platform/soc/11230000.mmc/by-name/system of=/sdcard/system.img
dd if=/dev/block/platform/soc/11230000.mmc/by-name/vendor of=/sdcard/vendor.img
dd if=/dev/block/platform/soc/11230000.mmc/by-name/boot of=/sdcard/boot.img
exit
exit
adb pull /sdcard/boot.img
adb pull /sdcard/vendor.img
adb pull /sdcard/system.img
exit

Edit: convert the dd backup to sparse with img2simg.

Then do the bootrom step on your broken stick again.

In fastboot run something like this:

fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot flash boot boot.img
fastboot erase MISC

In case you get an error, you probably need to add a / infront of the target partition, i.e. like this: /system

Then run the fastboot-step...

Now you should have the same rom on your two sticks...

Report back if that works ;)

Edit: added the fastboot step to the fastboot thing.

Edit2: added fb erase MISC

Edit3: Fastboot flashs sparse without a problem. dd backups (non-sparse) needs to be converted with img2simg.
[Fire TV Original Android Development] k4y0z:
the bootrom-step will "force" the device to boot into fastboot until recovery is booted, you might also want to add

fastboot erase MISC

to the list of commands to delete the flag.
[Fire TV Original Android Development] adamoc9:
thank you
[Fire TV Original Android Development] Sus_i:
Done :)
[Fire TV Original Android Development] Sirdey Ojas:
For the developers

Thank you for this exploit

I have read most of the posts

My apologies if my inquiry was already answered

I am trying to make all of this work without using an otg cable

I must admit it was a bit of a hassle but I could get the bootloader unlock and install TWRP

Reading all the other posts the hard part is done

After the exploit the stick is in TWRP and I can actually see my stick as "adb devices".Is there any way to "enable adb debugging" and "unknown sources", without booting up the installed rom, right after the exploit while still in TWRP?
[Fire TV Original Android Development] Sirdey Ojas:
I have unlocked the bootloader and installed TWRP. I am now in TWRP. Can you please help me what to do next to make my firestick usuable again?

I read your other reply thst goes to a Google drive. Still can't make head or tails. Please help.

I found

https://xdaforums.com/t/fire-tv-stick-4k-mantis-prerooted-stock-images-6-2-7-7_r1.3983091/

also found

https://xdaforums.com/t/magisk-module-google-play-market-services-and-tv-search-for-fireos-6.4019095/

I just want to know. How do I implement the

https://drive.google.com/drive/folders/1GbMTBHuFhwT_uyZaJs0ApsG_RQ5Wg_7F

After doing the exploit

Please help
[Fire TV Original Android Development] fabian19vs:
I have a problem with pulling the img files from the working fire stick 4k:

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
mantis:/ $ su
/system/bin/sh: su: not found
127|mantis:/ $ dd if=/dev/block/platform/soc/11230000.mmc/by-name/system of=/sdcard/system.img
dd: /dev/block/platform/soc/11230000.mmc/by-name/system: Permission denied
1|mantis:/ $ sudo dd if=/dev/block/platform/soc/11230000.mmc/by-name/system of=/sdcard/system.img
/system/bin/sh: sudo: not found
127|mantis:/ $ su dd if=/dev/block/platform/soc/11230000.mmc/by-name/system of=/sdcard/system.img
/system/bin/sh: su: not found
127|mantis:/ $ dd if=/dev/block/platform/soc/11230000.mmc/by-name/vendor of=/sdcard/vendor.img
dd: /dev/block/platform/soc/11230000.mmc/by-name/vendor: Permission denied
1|mantis:/ $ dd if=/dev/block/platform/soc/11230000.mmc/by-name/boot of=/sdcard/boot.img
dd: /dev/block/platform/soc/11230000.mmc/by-name/boot: Permission denied
1|mantis:/ $ exit

C:\Program Files (x86)\Minimal ADB and Fastboot>adb pull /sdcard/boot.img
adb: error: remote object '/sdcard/boot.img' does not exist
[Fire TV Original Android Development] 0815hoffi:
You need Root Access.

mantis:/ $ su

/system/bin/sh: su: not found
[Fire TV Original Android Development] rpmuploads:
I am also stuck at the b/w logo boot, and I've tried this method, but I'm getting:

Invalid sparse file format at header magic

while flashing system and vendor.

Should I process the image files with sdat2img before flashing? (the ones extracted from the working stick -same model- via adb shell, su, dd ..)

I've tried to 'fastboot flash' both from fireiso and windows abd (latest platform tools) and the outcome is the exactly the same. See log below:

C:\Users\rui\Desktop\platform-tools>fastboot flash system system.img
< waiting for any device >
Invalid sparse file format at header magic
Sending sparse 'system' 1/8 (130823 KB) OKAY [ 10.093s]
Writing 'system' OKAY [ 16.474s]
Sending sparse 'system' 2/8 (126331 KB) OKAY [ 10.358s]
Writing 'system' OKAY [117.031s]
Sending sparse 'system' 3/8 (127082 KB) OKAY [ 8.252s]
Writing 'system' OKAY [ 14.430s]
Sending sparse 'system' 4/8 (131069 KB) OKAY [ 6.006s]
Writing 'system' OKAY [ 25.069s]
Sending sparse 'system' 5/8 (131068 KB) OKAY [ 5.959s]
Writing 'system' OKAY [ 11.981s]
Sending sparse 'system' 6/8 (129349 KB) OKAY [ 5.772s]
Writing 'system' OKAY [ 11.528s]
Sending sparse 'system' 7/8 (130117 KB) OKAY [ 5.912s]
Writing 'system' OKAY [ 26.348s]
Sending sparse 'system' 8/8 (30616 KB) OKAY [ 1.466s]
Writing 'system' OKAY [ 3.073s]
Finished. Total time: 321.781s

C:\Users\rui\Desktop\platform-tools>fastboot flash vendor vendor.img
Invalid sparse file format at header magic
Sending sparse 'vendor' 1/1 (55075 KB) OKAY [ 3.666s]
Writing 'vendor' OKAY [ 84.755s]
Finished. Total time: 93.959s

C:\Users\rui\Desktop\platform-tools>fastboot flash boot boot.img
Sending 'boot' (16384 KB) OKAY [ 1.217s]
Writing 'boot' OKAY [ 0.998s]
Finished. Total time: 2.246s

C:\Users\rui\Desktop\platform-tools>fastboot erase MISC
Erasing 'MISC' OKAY [ 0.000s]
Finished. Total time: 0.016s

C:\Users\rui\Desktop\platform-tools>fastboot flash recovery twrp.img
Sending 'recovery' (11592 KB) OKAY [ 0.499s]
Writing 'recovery' OKAY [ 0.718s]
Finished. Total time: 1.232s

C:\Users\rui\Desktop\platform-tools>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s

After flashing and rebooting the situation is exactly the same (stuck at b/w logo)

Perhaps this error message regarding the partition's header magic is related with:

(another mantis user stuck at b/w logo boot in another thread, who was able to submit the logs)

I wonder if the header magic could be the culprit.

As I had mentioned in this other thread, I became stuck at b/w logo after cloning the stick via twrp backup/restore.
[Fire TV Original Android Development] Sus_i:
Make sure you allow superuser permission for adb shell in the magisk manager. Won't work without su.

Another option is to use adb shell while booted into twrp.

E̵d̵i̵t̵:̵ ̵I̵f̵ ̵y̵o̵u̵ ̵g̵e̵t̵ ̵t̵h̵e̵ ̵f̵o̵l̵l̵o̵w̵i̵n̵g̵ ̵e̵r̵r̵o̵r̵ ̵t̵o̵o̵,̵ ̵t̵r̵y̵ ̵t̵o̵ ̵f̵l̵a̵s̵h̵ ̵s̵p̵a̵r̵s̵e̵ ̵f̵i̵l̵e̵s̵.̵.̵.̵

Edit2: You have to flash sparse files, i.e. convert the dd backups infront of the flash. See this posting:

https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-tv-stick-4k-mantis.3978459/post-84539071

Already answered this in the post above. Maybe you can't flash sparse images with fastboot. But it could be the other way round too. ;) Never messed with this on a mantis.

Did you extract them out of an OTA.bin or via dd?

Try to flash them as sparse... The error could be related to the file size (too big to flash).

Could be something with the size of the files (too big for a flash via fastboot, depends on the device). Maybe try to flash them sparse, i.e. convert the non-sparse dd backup back to sparse. ;) Let me know what happens.

Edit: Flashing sparse works fine:

https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-tv-stick-4k-mantis.3978459/post-84539071

Already said it in the other thread... I had a look into the logs and I doubt that is the reason. The stick is unlocked, exploit and magisk installed. Due to the modifications, its ok that the magic doesn't match, compared to stock. The unlock allows to boot in this condition nevertheless.
[Fire TV Original Android Development] rpmuploads:
I've extracted them via dd.

I flashed them as sparse (after converting with img2simg) and now the flashing went ok without any error :D

Nevertheless the problem persists.
[Fire TV Original Android Development] Sus_i:
Alright. Thanks for testing.
[Fire TV Original Android Development] k4y0z:
It looks like you're flashing a stock (unpatched) boot.img together with twrp, that probably won't work.

Also i would suggest to factory reset, i.e wipe userdata and cache:

fastboot format userdata
fastboot format cache

Then redo the unlock from the start.
[Fire TV Original Android Development] rpmuploads:
Many thanks for the suggestion @k4y0z. I'll try and report back.

Btw, the boot.img that I was flashing was extracted from another 4K stick that had been unlocked and it is working fine.
[Fire TV Original Android Development] Androoit:
I tried to unlock the bootloader yesterday using kamakiri on a new Fire TV Stick 4K purchased last week with VM190 in the serialnumber, it doesnt work anymore.

Because the bootrom is read only reactivating DL-Mode should be impossible?!

Are there any known workarounds?

If i can do something to help the devs, let me know
[Fire TV Original Android Development] SweenWolf:
If you are messing with your stick its always a good idea to keep a TWRP backup. I've read somewhere about amazon forcing the os upgrade on initial boot???

Few days ago i bricked my device, and man it wouldn't even start package manager, have no idea what went wrong. Logs gave me nothing, was showing something isn't available on the stick, how could that happen, i have disabled updates. After opening up my stick once again i couldn't even locate the pad, man it wasn't shining and i thought it corroded away. After doing everything and restoring twrp backup, pairing remote again, flashing stock image again. (Reason being, i cannot modify me system from TWRP, makes no affect on the system. TWRP shows something and system shows something making it seems like there are two partitions of the system itself, and i don't like to root my stick because i don't do ant changes on system level. And as i always have a pendrive attached to it, it opens TWRP menu, sometimes making system to crash, don't know why, and some apps like peacock TV doesn't work).

Sometimes things can go wrong so always keep a TWRP backup.

And if this methods of unbricking isn't available then i wouldn't even dare to modify any thing on this stick. There are many things which can break. So thank you guys yet again..
[Fire TV Original Android Development] rpmuploads:
I've tried but I still do not get past the black and white Fire TV logo. You can find attached the terminal outputs of 2 attempts I made:

terminal-unlock.log - unlock and install Magisk at the end

terminal-revert stock.log - unlock and revert back to stock firmware (stock boot.img and no twrp)

This post by @Sus_i summarizes the several attempts I've already made in another thread:

Many thanks anyway for your help! :)
[Fire TV Original Android Development] k4y0z:
So TWRP works, but system doesn't boot up?

Maybe try flashing all the images that are included in the update.bin (including tee1, tee2, lk, and pl) using fastboot and also format MISC, cache and userdata.

That will obviously kill the unlock, but hopefully get the device booting again?
[Fire TV Original Android Development] rpmuploads:
Exactly, TWRP works fine but I'm stuck in the b/w firetv logo forever.

I already tried a similar approach, which was to extract each and every partition from another working stick (same model), using:

dd if=/dev/block/platform/soc/11230000.mmc/by-name/...

and then converting them with to sparse images and flashing via fastboot. The outcome was the same (stuck at b/w logo).

I'll try your suggestion and flash the images included in the update.bin instead.

Analysing a stock update, I see in META-INF/com/updater-script the following:

block_image_update("/dev/block/platform/soc/11230000.mmc/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") ||
abort("E1001: Failed to update system image.");
show_progress(0.100000, 0);
ui_print("Patching vendor image unconditionally...");
block_image_update("/dev/block/platform/soc/11230000.mmc/by-name/vendor", package_extract_file("vendor.transfer.list"), "vendor.new.dat", "vendor.patch.dat") ||
abort("E2001: Failed to update vendor image.");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/platform/soc/11230000.mmc/by-name/boot");
show_progress(0.200000, 10);
package_extract_file("images/logo.bin", "/dev/block/platform/soc/11230000.mmc/by-name/logo");
package_extract_file("images/lk.bin", "/dev/block/platform/soc/11230000.mmc/by-name/lk");
package_extract_file("images/tz.img", "/dev/block/platform/soc/11230000.mmc/by-name/tee1");
package_extract_file("images/tz.img", "/dev/block/platform/soc/11230000.mmc/by-name/tee2");
package_extract_file("images/preloader.img", "/dev/block/platform/soc/11230000.mmc/mmcblk0boot0");

and I'll proceed accordingly, i.e. tz.img goes into tee1 and tee2, etc.
[Fire TV Original Android Development] k4y0z:
Some partitions like kb and dkb are device-specific, I don't know what happens when you clone them from another device.

You can try wiping them (after taking a backup).
[Fire TV Original Android Development] Sus_i:
At some point during sloane testing, my boot1 idme stuff was gone, i.e. empty. I used an idme copy from another user and restored/edited my serial, mac and such stuff with a hex editor. Tried to clone KB from another device (i.e. used idme copy KB command) but got only a white screen without any sign of the launcher at the reboot. Then I looked into it with a hex editor and the data in KB is just a plain copy of the device-specific idme KB part., so I was able to restore it in my blank boot1 with my old dd backup of KB. DKB is unused on sloane (unlike on mantis).

Flashing TZ and wiping KB and DKB should be safe and easy to restore with the idme command, as long boot1/idme is fine.
[Fire TV Original Android Development] k4y0z:
That sounds similar to what @rpmuploads is experiencing

Yes, IDME contains a copy of kb/dkb and IIRC if the kb/dkb-partitions are empty they will be automatically restored from idme.

This could also be done manually using the idme copy KB and idme copy DKB commands
[Fire TV Original Android Development] Sus_i:
Yeah, I remember, idme copy is what I did, not idme write ;)
[Fire TV Original Android Development] marcge 63:
Same for me.... Serial with VM190 get me error at the connection at "waiting for bootrom" step, with short or without, I get an error instantly.
[Fire TV Original Android Development] rpmuploads:
YOU NAILED IT!!!!!!!

The stick came back to life 😄👋👋👋👋

I checked the device-specific data and I noticed that the serial number, MAC, etc. are still the original, so I assumed idme data is still intact. All I had to do was to copy KB and DKB data back to their corresponding partitions, which somehow got messed during the twrp backup / restore (cloning from another stick).

Summing up, all I had to do was:

idme copy KB /dev/block/platform/soc/11230000.mmc/by-name/kb
idme copy DKB /dev/block/platform/soc/11230000.mmc/by-name/dkb

It did not work straight away, but I noticed that the behavior was slightly different because the stick was rebooting to recovery after a few seconds instead of being stuck at the logo. So I did the unlock/short once again (I may have done this 1000 times already) and I reverted everything back to stock using this post.

Thank you so much guys for your support on this forum!
[Fire TV Original Android Development] Sus_i:
@navin23
[Fire TV Original Android Development] k4y0z:
Glad to hear you were able to get it fixed :)

I'm not sure how that could happen during twrp backup/restore, since KB and DKB aren't included in the backup 🤔

I think just wiping them would also work, since FireOS will restore them from idme if they are empty IIRC.
[Fire TV Original Android Development] Skel40:
Only backup the system image, vendor image, boot, and data for a full working backup because backing up the vendor and system does brick the 4K. I don't know why it just does
[Fire TV Original Android Development] retyre:
With verity, a bit-perfect backup (i.e., image) should be preferred to a file-based backup.

Which brings me to a suggestion for k4y0z:

While the use of openrecoveryscript avoids the need for an OTG mouse/keyboard, a major limitation of openrecoveryscript is the inability to automate image backups (of /system and /vendor). I work around that by compiling TWRP with a modified recovery.fstab that maps System Image to /sd-ext and Vendor Image to /and-sec (SD-EXT and Android Secure are obsolete IMO). As a result, "backup EABRDCO" in /cache/recovery/openrecoveryscript does everything I need.

Is there another (possibly cleaner) way to do image backups using openrecoveryscript? If not, why not map /sd-ext and /and-sec in your TWRP builds for automated full backup?
[Fire TV Original Android Development] Skel40:
@k4y0z When will we see a new kamakiri version 1.3 with an updated TWRP that fixes a few bugs along with having the exploit being flash compatible like you done with the tank?
[Fire TV Original Android Development] k4y0z:
I'll look into that, may just remove the system and vendor options completely from the backup list.

What bugs? And not sure what you mean with being flash compatible?
[Fire TV Original Android Development] Skel40:
Mouse lag when selecting 'select storage' for backup and restore locations. By making it act as an update .zip flashed in TWRP to save more time from taking it apart for the unlocking procedure although it may be unnecessary
[Fire TV Original Android Development] Skel40:
So in general the bugs are very minor. It's very stable in the most part. Thanks for your hard work
[Fire TV Original Android Development] k4y0z:
I've never experienced any considerable lag, but then again I mostly use TWRP over adb.

The ZIP is already flashable for updating, that won't help for the unlock though...
[Fire TV Original Android Development] navin23:
Boot into TWRP, advance, click on terminal

mount /system

idme \print

idme copy KB /dev/block/platform/soc/11230000.mmc/by-name/kb

idme copy DKB /dev/block/platform/soc/11230000.mmc/by-name/dkb

reboot and it's booting now. Thank you very much
[Fire TV Original Android Development] yan2xme:
can someone help me? it is normal that kamakiri script couldn't read my device that has been exploited already (already installed kamakiri) and wont show up on the command?

(ps. 2 - my firestick dont have vm190 or higher it was vm139 like in that range in its serial number)

because im doubting that my firestick was not successfully flashed because mouse pointers wouldnt show up on the os or in the twrp recovery (yep twrp is still bootable but cant navigate it)... i did not tried yet trying a new otg cable but physically there was no damages to the cable itself.. idk if this was a hardware or software issue...

this prevents me from installing these beautiful modules to my old firestick...

sorry for the messy text, im not a native american speakers

hope you can help me too @k4y0z or any other tech geeks out there... thanks!
[Fire TV Original Android Development] Bertonumber1:
Please remember you will be unable to connect with adb if you have your otg cable plugged in, try just connecting the firestick cable itself and typing :

adb devices

adb shell

If you cannot connect even with twrp command line . Eg :

adb reboot recovery

and running

adb shell

twrp wipe /system

twrp wipe data

twrp wipe dalvik

twrp wipe cache

And if you still cannot connect via adb....

Starting over with the short again maybe your best bet as something maybe corrupted .

Regards
[Fire TV Original Android Development] yan2xme:
will be trying this tomorrow again, but still i directly plugged it in on my computer...

but can you guess why any of my Mouse wont work with firestick using otg? tried wired and wireless, still dont work... i guess i need to save some bucks again to buy new otg and a reliable usb splitter too
[Fire TV Original Android Development] Sus_i:
Additional note to the commands from berto... if you wipe system, you've to flash a new system (aka. a stock rom) too.

PS: I wouldn't wipe anything, just twrp install magisk.zip, done. Remember, like berto said, abd won't work over an otg cable.

Power issue. The orig. p. supply is pretty weak, get a bigger one.
[Fire TV Original Android Development] yan2xme:
still cant work with a 33watt fast charger... my power supply in the house works fine? whats wrong, my y usb splitter dont have any damages at the cable or any on that... maybe this is mission impossible
[Fire TV Original Android Development] Sus_i:
What do you mean with Y splitter? It must be one with an OTG wiring inside...

Who knows. Most of the time it's just a weak power supply. The wiring inside the OTG cable could be crap too.

You can try the mouse on a powered USB HUB, connected to the OTG, if you like...

But since a mouse is almost useless outside of twrp (won't work in/at the fireTV launcher at all, only in some Apps), I would run the few twrp commands via adb shell.

A keyboard with touchpad like the logitech k400 series is far better, it works in twrp, fireOS and Apps.
[Fire TV Original Android Development] Bertonumber1:
OK so what are you trying to achieve here?? If you could elaborate a little bit....

Like I said above if you can't use mouse to navigate use twrp command line to install the zips Once you've adb pushed them to the sticks /sdcard .

Run :

adb devices (to see if your connected)

adb push nameofyourfirnware.zip /sdcard

adb push Magisk-v2x.xx.zip /sdcard

Next run:

adb shell

twrp install nameofyourfirnware.zip

twrp install Magisk-v2x.xx.zip

(optional)

twrp wipe cache

twrp wipe dalvik

As Sus_i mentioned you don't have to wipe anything because twrp will treat the renamed firmware bin file (zip) as a flashable update.
[Fire TV Original Android Development] yan2xme:
Could you help me using adb to execute commands with twrp and flash this backup to automatically install all essentials? https://xdaforums.com/t/guide-rom-mantis-fire-tv-stick-4k-prerooted-android-tv-rom-6-2-7-6.4208859/ this is the source... thanks
[Fire TV Original Android Development] Bertonumber1:
The commands are listed above mate.

Just adb push from the folder your chosen files are located.

If you're using a back up you will have to place the back up in the TWRP >BACKUPS folder and then select "restore".

eg.

adb push nameofyourbackup /sdcard/TWRP/BACKUPS

in twrp select restore tab, you'll see the dated backup, select it and check all the partitions if they aren't checked/marked already.

Regards
[Fire TV Original Android Development] yan2xme:
ohh coincidence i did post my last comment didnt notice you replied to my comment, thanks!

but according to this thread with a tweak for Aftv4k to have an android tv ui: https://xdaforums.com/t/guide-rom-mantis-fire-tv-stick-4k-prerooted-android-tv-rom-6-2-7-6.4208859/

I do need to push a precompiled zip that serves as a backup after a factory reset to get all those modules installed in my stick..

well what command should i use? should I reset, and just install it?

my mind goes like 🤔😯 what step should I go first because im new to this stuff and I feel little bad to you guys being a spoonfeeder to y'all but I hope you can understand me.. thanks