yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Skel40:
When you unlock the 4K, be sure to update the tz image with the latest prerooted rom so it doesn't automatically reboot. The unlock downgrades the tz
[Fire TV Original Android Development] leokon:
Hi guys,

is stock FW 6.2.8.0 rootable? Serial number G070VM180...

Just want to be sure before I'll try.

Thanks
[Fire TV Original Android Development] Bertonumber1:
@leokon

You should be good to go mate if the device is vulnerable to the exploit. Dont matter bout firmware versions just follow the steps carefully and be sure to disable ota updates once you've got through the steps on first boot.

Regards
[Fire TV Original Android Development] yener90:
Are you sure about it? I thought update 6.2.8.0 destroys a fuse, which breaks the rooting possibility. I tried to root my device and it's impossible.
[Fire TV Original Android Development] tw39515:
Just got one its on 6.2.8.1 serial G070VM221 getting error

ERROR: Serial protocol mismatch, expected {} got {}".format(gold.hex(), test.hex()))

RuntimeError: ERROR: Serial protocol mismatch, expected 0001 got 0000

Is this due to the newest update or am i not shorting properly.

Is there a way to disable future updates in hope of a fix.

Thanks TW.
[Fire TV Original Android Development] micmacxda:
at same point here too...have you tried accurately shorting clk too?
[Fire TV Original Android Development] tw39515:
Its hard to see under the frame but yes I tried with foil and wire.
[Fire TV Original Android Development] Sus_i:
It's already written countless times in this and in other threads!

6.2.8.0 and later burns an efuse in the SOC which blocks bootrom access via shorting forever.
[Fire TV Original Android Development] bibikalka:
Right! I managed to "wake up" right before 6.2.8.0, and root mine :)

These rooted sticks are to be cherished!
[Fire TV Original Android Development] phickasphuck:
Hi Guy's I really hate to bother you but I need your help please.....

Booting to Ubuntu via usb cant get past the bootrom, literally nothing happens just a flashing cursor! and with the FireISO i just get the "root #" then nothing please please help

thanks in advance for the advice
[Fire TV Original Android Development] phickasphuck:
Now for the record I would like to kick myself! rule No 1 "always read previous post's" I think on the very first page it say's "I wonder why it don't work on Ubuntu?" then a reply say's "It will if you patch the Kernel" have no idea about Linux so best left....... how ever would still like some help with FireISO V2.0.0 if at all possible
[Fire TV Original Android Development] Bertonumber1:
Hi,

Define help? Downloading the image? Using kamakiri.. Please elaborate where you need assistance

Regards
[Fire TV Original Android Development] phickasphuck:
Hi, Seasons greetings to you and thanks for responding I really apricate it, sorry or the delay, Ok so I really need help with all of the procedure but I haven't got past the "bootstep" when I load Kamakiri and enter the command I get "file /home/ubuntu/desktop/kamakiri/modules/main.py, line 6, in <module> from common import device" and "file /home/ubuntu/desktop/kamakiri/modules/common.py, line 6, in <module> from common import serial" culminating in no "module not found error: no module named serial"

I've tried to remove the lines but it just throws up another error if you can point me in the right direction please.
[Fire TV Original Android Development] Bertonumber1:
Hi,

No dont remove any lines..

Delete those files and extract the zip again. Start over....

Are you sure the stick you have is vulnerable to the amonet exploit what serial number is displayed in adb? Try another usb port and cable also.

Lastly when you run bootrom-step be sure to run it as exactly :

./bootrom-step.sh

Let me know whats happening

Regards
[Fire TV Original Android Development] phickasphuck:
Hi ,

So can i go through this a step at a time with you please?

I can't get the fireISO to boot from usb? i can get it working in a linux terminal is that the correct way?

Regards
[Fire TV Original Android Development] eac5:
I'm a little confused with the conflicting information surrounding the 6.2.8.1 and efuses. Some say its better to do the initial setup for the stick, then root, so that the ota update doesn't interrupt the root process, others say it's necessary to do the root right out of the box without ever booting the stick, as the update will burn an efuse and prevent bootrom access thru shorting even on an exploit-compatible model.

So which order is correct?

I'm ordering an older model specifically for rooting purposes and it's quite pricey here so I really wanna get this right.

Edit: with a bit of further digging I gather rooting straight away is the only way now. So just one more question, can anyone confirm whether the following order will work?

Root stick out of the box -> on first TWRP boot flash 6.2.8.1_r2 from rbox to do the firmware and TZ updates -> Flash the OTA update disabler from SweenWolf

I take it the prerooted roms already remove the efuse related files so I should be safe in that regard?

TIA
[Fire TV Original Android Development] Bertonumber1:
No you have to run the patched kernel (fireiso) as a live image. Ofc if you have telegram i can help you step by step to save bloating the thread. Then we can share the steps/problems here if need be to help others.

Regards
[Fire TV Original Android Development] Bertonumber1:
Yes if you want the latest firmware with new ui 6.2.8.0 you can use rbox modified 6.2.8.0 firmware. This has this efuse disabled.

Disabling fota updater is mandatory when playing with root on these devices.

Regards
[Fire TV Original Android Development] duckneo:
Hi there

I just got a new fire tv stick 4k with serial # G070VM1904****

it says unable to update when fist starup

I've tried many times but have no idea

is there anybody help me ....
[Fire TV Original Android Development] MrTooPhone:
And you confirmed the FS is connected to the Internet?
[Fire TV Original Android Development] halfpipe:
Hello Folks, I'm trying to find in past messages inside this thread, if with the use of the tools, twrp, etc.. is possible to do a full installation of linux on the fire stick, if yes, can you please direct me to a thread? This is the closest I've found
[Fire TV Original Android Development] Sus_i:
Nope, there isn't a way to do something like this...
[Fire TV Original Android Development] halfpipe:
oh ok, I thought it was possible just like it has been done with some tv box running android
[Fire TV Original Android Development] smumar143:
My firesrick 4k stuck on Amazon black screen logo and after some time it restarts.

Same process continues all the time.

It all happed after I root my firestick 4k

Before that i was using iOS 6.2.7.6 and for root I updated to 6.2.8.0.

Now my fire stick is useless for me .

If it could be recovered then pls help me how to do it.
[Fire TV Original Android Development] Sus_i:
Try an OTG cable together with a mouse, maybe you can boot TWRP... and in TWRP flash 6.2.7.7 ;)

Another option is to use the 'unbrick' solution from OP...
[Fire TV Original Android Development] smumar143:
Hi

thanks for the help.

I have done before the both methods and also pin shortening method.

Earlier (Before installing iOS 6.2.8.0,) both the methods worked for me but after after getting root they didn't work for me.
[Fire TV Original Android Development] Sus_i:
Ofcourse, the shorting thing gets blocked if you flash a 'stock' update 6.2.8.0 and later... (but the 6.2.8.0 and later rbox prerooted is fine). Did you missed the whole efuse discussion?

Anyways, there is no reason why a stick may stop working because of flashing stock 6.2.8.0. It should work just fine, it stays unlocked with TWRP installed, only an efuse gets burned in order to block the shorting.
[Fire TV Original Android Development] smumar143:
Thanks for the information

Is there anything to deal with the efuse

Thanks
[Fire TV Original Android Development] Sus_i:
Nope, but who knows, maybe we will see a new unbrick solution in the future.
[Fire TV Original Android Development] smumar143:
Ok thanks for the help
[Fire TV Original Android Development] Pejay:
I'm getting this error when i tried to root my 4k stick. I downloaded the ISO file and created a live usb.

See below. I have trid ifferent usb ports etc.

[root@sysresccd ~/kamakiri-mantis-v1.2/kamakiri]# ./bootrom-step.sh

[2022-02-04 20:32:41.631533] Waiting for bootrom

[2022-02-04 20:33:07.490734] Found port = /dev/ttyACM0

[2022-02-04 20:33:07.492709] Handshake

[2022-02-04 20:33:07.496680] Disable watchdog

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

[2022-02-04 20:33:14.584862] Load payload from ../brom-payload/stage1/stage1.bin = 0x27C bytes

Traceback (most recent call last):

File "main.py", line 119, in <module>

main(dev)

File "main.py", line 24, in main

load_payload(dev)

File "/root/kamakiri-mantis-v1.2/kamakiri/modules/load_payload.py", line 69, in load_payload

udev = usb.core.find(idVendor=0x0e8d, idProduct=0x3)

File "/usr/lib/python3.7/site-packages/usb/core.py", line 1253, in find

import usb.backend.libusb1 as libusb1

File "/usr/lib/python3.7/site-packages/usb/backend/libusb1.py", line 39, in <module>

import usb.libloader

File "/usr/lib/python3.7/site-packages/usb/libloader.py", line 32, in <module>

import ctypes.util

File "/usr/lib/python3.7/ctypes/util.py", line 2, in <module>

import shutil

File "/usr/lib/python3.7/shutil.py", line 22, in <module>

import bz2

File "<frozen importlib._bootstrap>", line 983, in _find_and_load

File "<frozen importlib._bootstrap>", line 967, in _find_and_load_unlocked

File "<frozen importlib._bootstrap>", line 677, in _load_unlocked

File "<frozen importlib._bootstrap_external>", line 724, in exec_module

File "<frozen importlib._bootstrap_external>", line 859, in get_code

File "<frozen importlib._bootstrap_external>", line 917, in get_data

OSError: [Errno 5] Input/output error

[root@sysresccd ~/kamakiri-mantis-v1.2/kamakiri]#
[Fire TV Original Android Development] Bertonumber1:
Hi just saw this post, how did you get on with this? Did you get your stick unlocked?

Let us know..

Regards
[Fire TV Original Android Development] k4y0z:
I'v just uploaded a new Version of the unlock for mantis.

It comes with an all new TWRP (3.6.1) and an unlock method that works even for fused devices with firmware version < 6.2.8.7, no shorting needed!

For detailed instructions check https://xdaforums.com/t/unlock-root...k-3-and-fire-tv-stick-lite-sheldon-p.4410297/ (Use mantis-zip from here, will update instructions here in a bit)
[Fire TV Original Android Development] SweenWolf:
Can i inplace update TWRP? I'm already unlocked
[Fire TV Original Android Development] k4y0z:
Yes, just install the zip via TWRP
[Fire TV Original Android Development] SweenWolf:
So i updated the TWRP by flashing the zip,

all seems to work, unlock is still there, TWRP and all are still there, but there was no option to go to TWRP when OTG is attached, even though it was the only thing I wanted (to not get a prompt every time i start the device with my pendrive attached to it) is the option removed or did i mess something up?
[Fire TV Original Android Development] Sus_i:
I guess it's supposed not to open with only a pendrive attached ;)

I still get the twrp bootmenu, if I connect an OTG cable + keyboard/touchpad (logitech K400), works for me very well on mantis and the sheldons. :)
[Fire TV Original Android Development] k4y0z:
Unfortunately it's not possible to detect whether something is actually connected to the OTG.

The OTG-Adapter itself should be enough to trigger the bootmenu.
[Fire TV Original Android Development] SweenWolf:
It can open bootmenu with otg only or with a hub attached to it with a pendrive, mouse and keyboard.

You are right, shorting the otg sense pin to ground opened bootmenu, but after flashing the latest mantis zip from the OP there is no more bootmenu, i usually have no problem with that, but yesterday i was creating patch for 6.2.8.7 and for the whole day my stick bootlooped because my OTG was not working (i made the otg myself i haven't bought it) after that i fixed it, it was still showing bootmenu and i was able to debug fix and create a patch for it. But when i flashed the zip to update the TWRP its not showing bootmenu anymore, and will cause a problem i were to create some other patch.
[Fire TV Original Android Development] k4y0z:
Bootmenu is still working here as expected.

Maybe try reinstalling the zip.
[Fire TV Original Android Development] Sus_i:
OTG cable + Logitech K400

but just tried an otg + hub + pendrive, mouse/keyboard and it's working too :)

I've updated my sticks via bootrom-step (without shorting ofc).
[Fire TV Original Android Development] Sus_i:
Wrong thread, sry.

Delete^^
[Fire TV Original Android Development] SweenWolf:
I think I'll just stick to it for now, if the system can start adb daemon then i can just use adb reboot recovery to get into it, otherwise I'll just open the stick to unbrick.

I like it more now.
[Fire TV Original Android Development] SweenWolf:
I just flashed the zip in twrp
[Fire TV Original Android Development] k4y0z:
With this version there is now also support for the boot-recovery.sh and boot-fastboot.sh scripts.

And no need to open for unbricking either ;-)
[Fire TV Original Android Development] Sus_i:
You may just try the new bootrom-step, it's awesome.

Start the bootrom-step and then connect the usb from the stick, done :)

No shorting ofc.

It's really easy if you have ubuntu or arch running, no need for a patched kernel anymore...

If you need a live system, there is also a fireISO 2.0 at github.
[Fire TV Original Android Development] SweenWolf:
I have kali and ubuntu, but i will try it once i have something to patch on the stick.

Can you try flashing https://xdaforums.com/attachments/kamakiri-mantis-v2-0-zip.5551029/ using TWRP and check if yours bootmenu is OK, i would like to reproduce this so i can redo these steps later on when needed.
[Fire TV Original Android Development] Sus_i:
I'll try that later today and let you know...

testing lineageOS for the lite-stick right now and it looks awesome :)
[Fire TV Original Android Development] mama.:
Hi there, I've read the instructions in this thread and the other one, prepared Linux distro w/ all the dependencies, my Fire TV 4K is 6.2.8.7 (G070VM1700...), downloaded kamakiri-mantis-v2.0.zip from the first post and when I run the script and plug in the stick to USB (using Amazon's stock cable) I get:

...@mint:~/kamakiri$ sudo ./bootrom-step.sh
[2022-03-03 15:45:20.419138] Waiting for device
[2022-03-03 15:45:27.342909] Found port = /dev/ttyACM0
[2022-03-03 15:45:27.382361] Handshake
[2022-03-03 15:45:27.403692] Load payload from ../brom-payload/pl/pl.bin = 0x3A04 bytes
Traceback (most recent call last):
File "main.py", line 135, in <module>
main(dev)
File "main.py", line 25, in main
load_pl_payload(dev)
File "/home/kamakiri/modules/load_payload.py", line 47, in load_pl_payload
dev.send_da(0x40001000, len(payload), 0, payload)
File "/home/kamakiri/modules/common.py", line 342, in send_da
self.check(self.read(2), to_bytes(0, 2))
File "/home/kamakiri/modules/common.py", line 103, in check
raise RuntimeError("ERROR: Serial protocol mismatch, expected {} got {}".format(gold.hex(), test.hex()))
RuntimeError: ERROR: Serial protocol mismatch, expected 0000 got 2001

I can't seem to find any info about "expected 0000 got 2001" error. Am I missing something in my steps? Thanks
[Fire TV Original Android Development] Rortiz2:
Error 2001 means DA_IMAGE_SIG_VERIFY_FAIL (in this case, it means it failed to verify the payload, pl.bin).

This usually means you updated to the latest version which includes a patch for the Preloader image.
[Fire TV Original Android Development] k4y0z:
Unfortunately the vulnerability has been fixed in 6.2.8.7, you'll need to downgrade to a lower version.

Maybe @Ighor can help with that?
[Fire TV Original Android Development] mama.:
Yes, my Firestick unfortunately updated to 6.2.8.7 as I have mentioned. I thought new kamakiri can patch this version (says up to 6.2.8.7 in release notes).
[Fire TV Original Android Development] Ighor:
If I publish downgrade exploit, it will be patched on next FW update, need a good reason to do it now and not later.
[Fire TV Original Android Development] mama.:
Agreed. I'll stick with stock.
[Fire TV Original Android Development] Skel40:
I installed the kamakiri v2 zip with the same issue as @SweenWolf. I have an otg attached with a mouse and keyboard. No bootmenu was shown
[Fire TV Original Android Development] dikodahan:
Same here...
[Fire TV Original Android Development] Rortiz2:
For those people who are having the problem with the bootmenu, try flashing everything using bootrom-step.sh
[Fire TV Original Android Development] forkup:
V2 worked great for me on a firestick 4K with a VM number higher than 190. Great job guys.
[Fire TV Original Android Development] tw39515:
ok i got twrp installed but do not have an otg cable. is it safe to unplug it and reboot or is there a way to interface with it remotely? thanks to all for the updates
[Fire TV Original Android Development] Skel40:
Would I have to flash the commands via hacked fastboot?
[Fire TV Original Android Development] Sus_i:
No, you need to boot ubuntu or fireISO, then type sudo ./bootrom-step.sh

then connect the sticks usb. Shorting isn't needed anymore :)
[Fire TV Original Android Development] Rortiz2:
(just to clarify) You don't need fireISO with the preloader-exploit though, any Linux OS should work.
[Fire TV Original Android Development] Sus_i:
Maybe amaz. patched it already for all fireTVs running fireOS7 and it's only a matter of time until fireOS6 is also...? ;) Idk.
[Fire TV Original Android Development] gabardal:
Yes, this works, thanks!
[Fire TV Original Android Development] k4y0z:
I have uploaded kamakiri-mantis-v2.0.1.zip which fixes the boot menu when installed via TWRP.
[Fire TV Original Android Development] tw39515:
After I got unlocked and installed magisk (20.4) on stock 6.2.8.1(NS6281/4812), im having an issue with xfinity tv it starts to load a show and the firestick reboots. I also noticed netflix freezes and locks up the sytem. Any ideas?
[Fire TV Original Android Development] Sus_i:
That issue is TZ related. The kamakiri.zip uses an old TZ image (from 6.2.7.7) to keep the SOCs efuse safe, which allows us unlocking/unbricking via shorting...

If you want using 6.2.8.0 or later, you need to update the TZ, via flashing rbox prerooted 6.2.8.1r2 which will update the TZ and also disable the efuse burning.

If you do/did the unlock on a stick running Stock 6.2.8.0 or later, the efuse is already burned...

Now you need no efuse protection and you can flash an updated TZ image via dd to tee1 and 2 or you can also exchange the TZ image in the kamakiri folder... i.e. grab a TZ image from 6.2.8.0 update (or later) and replace the one in the kamakiri folder), then do the unlock again.
[Fire TV Original Android Development] dikodahan:
Thank you!

I was having the exact same issue.

Can you please share a link to a recommended pre-rooted 6.2.8.x image?

Much appreciated!
[Fire TV Original Android Development] Sus_i:
This is the thread from rbox prerooted for mantis:

https://xdaforums.com/t/fire-tv-stick-4k-mantis-prerooted-stock-images-6-2-8-1_r3.3983091/

It seems that 6.2.8.1 r2 got the updated TZ... :)
[Fire TV Original Android Development] tw39515:
I replaced the tz image from 6.2.8.1_r2 and and flashed kamakiri-mantis-v2.0.1.zip with twrp. still getting freezing
[Fire TV Original Android Development] tw39515:
i got it thanks for the help, i had to run it from ./bootrom-step.sh with the replaced tz image.
[Fire TV Original Android Development] Wickie87:
I’m afraid I already know the answer, but just to confirm: there’s currently no other way to downgrade a stock 6.2.8.7 stick to a supported FW? I’m in the same boat as @mama. unfortunately.

Anyway, here’s another vote for sharing that downgrade exploit once you feel the time’s right. :)
[Fire TV Original Android Development] Sus_i:
There is another way, but it will require hardware (eMMC adapter, sdcard reader, soldering tools, fine enamelled copper wire) and soldering skills... i.e. we know alternative breakout points to mount the eMMC manually. This way we can flash a preloader 6.2.8.1 to the eMMC and use the scripts from OP. :)
[Fire TV Original Android Development] Wickie87:
Sounds like an interesting project for the weekend, but I don’t think I trust my soldering skills enough to give that a try. Appreciate your reply, but I guess I’ll have to be patient and wait for a software-based solution then. :)
[Fire TV Original Android Development] Sus_i:
There may be a software-based solution too: A brand-new PoC exploit called 'Dirty Pipe'.

Public disclosure was yesterday. ;)

Could be thats possible to spawn a root shell and write the old vulnerable PL to the eMMC... could be that it's already patched.
[Fire TV Original Android Development] Wickie87:
Looks like that's not usable on FireOS 6, from https://dirtypipe.cm4all.com/:

From my FireTV stick:

Also you'd need a directory with write access not mounted with the 'noexec' flag to execute the script; I did a search via an adb shell and was unable to find any for the 'mantis' user (uid 2000).

Or am I missing something?
[Fire TV Original Android Development] Sus_i:
Idk, probably you're right. Haven't looked into it. I would use the soldering way :)

I saw this here:

vulnerability intended to be remedied in Linux 5.16.11, 5.15.25, and 5.10.102.

and wasn't aware that they use a 4.x kernel for mantis.
[Fire TV Original Android Development] JUUTYNUTTY:
after i boot into fireiso2.0.iso what is the command to run the GUI desktop?
[Fire TV Original Android Development] Sus_i:
It auto-boots to gui-desktop, maybe you choosed a wrong option at bootmenu?
[Fire TV Original Android Development] JUUTYNUTTY:
what do i type in the terminal [rootfs ]# to enter GUI desktop? startx? xwin?
[Fire TV Original Android Development] Sus_i:
You may do something wrong if you don't get a GUI by default.

FireISO is based on SystemRescueCd, take a look here:

www.system-rescue.org
[Fire TV Original Android Development] nicedog:
My serial number is VM070, it does not show up at all on USB when shorted either. I've tried a hundred times.
[Fire TV Original Android Development] Sus_i:
It's because Amaz. burned an efuse in the SOC with 6.2.8.0 and later, in order to patch the brom shorting exploit.

Anyways, Kamakiri 2.0.1 doesn't need a short anymore, your sticks OS only needs to be <6.2.8.7.

In other words, if your stick is on the latest, 6.2.8.7, there isn't a way to root/unlock/unbrick for now.

Description how it works is here:

https://xdaforums.com/t/unlock-root...d-fire-tv-stick-lite-sheldon-p.4410297/unread
[Fire TV Original Android Development] nicedog:
hmm, no, I bought it 4 years ago and had never opened it, it was brand new out of the box.

after I tried a million times I finally gave up (I tried kamakiri v1.2 and v2.0.1, shorted or unshorted), so I went ahead and connect it to the internet to get the latest update, to my surprise it only got updated to 6.2.7.3, still, kamakiri v2.0.1 does not work (without shorting).

I have two fire tv stick 4Ks, the first one went smooth after only a few tries, that's just two months ago when kamakiri v2.0.1 did not even exist so I had to do shorting.
[Fire TV Original Android Development] nicedog:
Success!!

I commented out the following three lines in kamakiri v2.0.1's kamakiri/modules/main.py

72 if rpmb != b"\x00" * 0x100:

73 dev.reboot()

74 raise RuntimeError("downgrade failure, giving up")

It finally went through, no shorting needed. I was able to install Magisk to enable root!

So, for those who get "downgrade failure, giving up" error, try commenting out those three lines.
[Fire TV Original Android Development] Sus_i:
Can you provide some info about your PC?

Did you use the fireISO booted via usb-pendrive or did you use the fireISO in a Virtual Machine?