yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] nicedog:
No virtual machines, I have many desktops and laptops and I use Linux / MacOS everyday.

Before I modified the script, I tried both fireISO and Ubuntu 21.10, none of them worked.

I used Ubuntu 21.10 to install magisk.
[Fire TV Original Android Development] nicedog:
-- deleted -- never mind.
[Fire TV Original Android Development] nicedog:
OK, I changed the script to write b"\x10" * 0x100 instead, it appears that it doesn't write the value successfully. According to github's comment, it's for "Zero out rpmb to enable downgrade". Strangely, I was still able to hack it without zeroing out rpmb.

[2022-03-12 11:30:25.473349] Downgrade rpmb, writing b'\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10'

[2022-03-12 11:30:25.473838] Recheck rpmb

[2022-03-12 11:30:25.593581] rpmb is b'AMZN\x01\x00\x00\x00\x02\x00\x02\x01\x01\x00^c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
[Fire TV Original Android Development] Rortiz2:
The script is supposed to clear the replay protected memory block (which prevents you from downgrading firmware images in some scenarios, since they aren't always updated), so on the next reboot, the preloader updates the LK/PL/TEE versions of RPMB.

In your case, I guess the versions were already the same so that's why it didn't brick at all.​
[Fire TV Original Android Development] nicedog:
Guess I was lucky then, still don't understand why it's not able to zero out the rpmb though.
[Fire TV Original Android Development] wwwkkk:
Hi there, i`ve used the kamakiri 2 to unlock my mantis and everything is all right. in twrp i flashed a new rom, but anything i flashed wont work. i tried the oldes rom 6.2.6.4 and also 6.2.7.6r1 , 6.2.8.1r3 and many more.

the boot screen frezzes allways at the beginning without playing any bootanimation.

how can i fix the problem ? is there a efuse ? I format data, wipe all partitions but nothing can fit the problem.

twrp works fine but the rest is bricked, it seems.
[Fire TV Original Android Development] SweenWolf:
Flash magisk
[Fire TV Original Android Development] wwwkkk:
nope, that doesn't fix the problem. After you wrote that right now,

i had flashed the magisk 23.0 zip. it hangs and there is only the Fire Tv Logo, no Boot Animation. okay, again i wipe all partitions, Format Data, flashed the 6276r1 and installed magisk 19.3 - reboot and it hangs again.
[Fire TV Original Android Development] SweenWolf:
Wipe system, data, cache and dalvik cache.

Reboot to TWRP

flash any rom without efuse.

And reboot
[Fire TV Original Android Development] bobdob123usa:
I have a couple of VM201s which can't use the original shorting method. They are 6.2.7.7 out of the box. I tried with Kamakiri 2.01, but they fail the GPT check. Specifically, they read fail because the read is only 340 bytes when expecting 512. I also tried running gpt-fix, which appears to complete successfully, but does not correct the issue. It looks like they are trying to download 6.2.8.1 as the update, but I have that blocked. Any recommendations?
[Fire TV Original Android Development] wwwkkk:
i tried and it sucks, the system freezes just like the other times before. Yet, i also flashed the unlock step again. Bootrom-step and fastboot-step and tested the result again. it always hang up and freeze! No Bootanimation.
[Fire TV Original Android Development] wwwkkk:
Note: do not flash any stock rom which has efuse in them

Whose version number 6.2.8.0 or higher

or you will blow your efuse.

What does that mean? Once an efuse is blown, the stick ist dead ?

Is that maybe the problem I'm having ?

What does a stick with "blown efuse" does?

Can it be fixed ?
[Fire TV Original Android Development] Sus_i:
I had the same error for a stick together with the fireISO, but after about 30 mins of idling, it worked fine.

It's not clear what causes this issue, maybe it's the eMMC type/manufacturer, who knows.

You may try it again after some idling, maybe do a reboot and/or redownload the zip, maybe try another usb port, best is an usb2 if there is one...
[Fire TV Original Android Development] Sus_i:
The efuse isn't your issue.

You may do the kamakiri gpt-fix, then a format data in twrp wipe advanced tab section, then flash a new stock rom with magisk.
[Fire TV Original Android Development] wwwkkk:
Hi, that sounds pretty good. I had done so, but no handshake - still the same problem.

The kamakiri-mantis-v2.0.1 ist dated from 20220304 and doesnt contain the gpt-fix.sh itselfe. So ich had a look at the kamakiri-sheldon-v1.0 and this contain it. Shure thats an little bit other device, and the bin dir contain the file gpt-sheldon.bin (17.408 bytes)

I use the search function on this board to find the file gptfix-mantis.zip (dated 20200521 same size) an implementate it in the kamakiri-mantis-v2.0.1, let it run.

It will do the complete prozes with open the boot and restart in fastboot-mode where ich flashed the twrp once again.

Everything so far so good ?

Then i format data, wipe data, system, cache and dalvik, restart in recovery, flash the 6276r1, flash the magisk 23.0 und restart to system.

I done this 2 x and its allways the same freezin Start-logo.
[Fire TV Original Android Development] Sus_i:
No, that wont work, sheldon got a different partition layout...

How do you've started the gpt-fix?

The bootrom-step will not flash the gpt, if you do just the bootrom-step... needs to be started with gpt-fix.sh.
[Fire TV Original Android Development] wwwkkk:
i started the gpt-fix.sh and this wrote the gpt tables. Then the gpt-fix continue the whole process of writing the tz und so on.

Maybe the File, two years old is not compatible with the new one ? Is there a newer gpt-fix ?
[Fire TV Original Android Development] Sus_i:
No, it's the same gpt for all mantis sticks, nothing new.

Your stick is still looping just at the black/white amaz. logo?
[Fire TV Original Android Development] wwwkkk:
Yes, i had done the process today 3 times (gpt-fix) and always the loop.

The TWRP shows the 5Seconds to chancel, then it start to boot and freezes. After maybe 2 minutes it crashs and loop again.
[Fire TV Original Android Development] Sus_i:
You flashed the prerooted 6.2.7.6r1 rom, isn't it?

Maybe try to flash this stock rom, renamed to zip:

https://d1s31zyz7dcc2d.cloudfront.net/fafaa562a37ab6b8dad1d31cd297185e/update-kindle-mantis-NS6276_user_2933_0004396381572.bin

Skip the magisk flash, format data, wipe cache and dalvik.
[Fire TV Original Android Development] wwwkkk:
well, that sounds good. I will do so tomorrow and report you in about 9 hours.... thanx so far
[Fire TV Original Android Development] bobdob123usa:
It looks like it was due to using a VM. Same VM I had used in the past for the old method, but for whatever reason didn't work now. Anyway, booted FireISO from a thumb drive and all is well. Thanks!
[Fire TV Original Android Development] wwwkkk:
....the flash even crashs at the middle of the burn...

i downloaded the file twice and its impossible to flash it to the stick...i cant believe what's going on....
[Fire TV Original Android Development] wwwkkk:
i have bought an old 22" television to test the Sticks near by my pc, for a couple of weeks ago.

this is an used one from an Internet market for a few bugs , not expensive.

is it possible that such an old tv got the stick broken, may be the ram of the stick?

I think that's not possible, but what is your opinion ?
[Fire TV Original Android Development] Sus_i:
Most likely a hardware issue...

You can try another usb cable, but seems your stick is somehow bricked/broken.

Did you damaged something due shorting?
[Fire TV Original Android Development] wwwkkk:
nope, i never opened the stick. I guess the TV has overvoltage the stick, is that possible? Contains the HDMI Port (of an older TV) some voltage, that can damage such a stick? :unsure:
[Fire TV Original Android Development] Sus_i:
Thats weird, idk whats wrong.

You may get some information about your issue, if you connect two cables to the UART port on the mainboard, you need an USB TTL UART adapter for a bootlog.

Here is a picture from such an UART port, rx/tx marked:

[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)

NOTE: There have been multiple reports of devices with serial numbers containing VM190 or higher being shipped with DL-Mode disabled in BROM. These devices cannot be unlocked using kamakiri. These devices do not show up at all on USB when...

xdaforums.com
[Fire TV Original Android Development] wwwkkk:
VM141 is the value
[Fire TV Original Android Development] 4qman:
This is exactly what i come back here to say :silly::silly::silly::silly:
[Fire TV Original Android Development] cluelessperson:
Shorting isn't working.

So I've booted the firetv ISO on a separate machine, and I'm running `./fastboot-step.sh` but shorting the pins while plugging in the USB doesn't seem to do anything.

and after fumbling around for awhile, I knocked off the 3rd and 4th resistors/caps (from the left) next to the DATA0 pad.

Can someone help me?
[Fire TV Original Android Development] Sus_i:
You can bridge the two pads from the third capacitor with a wire, tinfoil or something like that, as one side of the cap is ground.

Keep that capacitors and solder them back to the pads ;)
[Fire TV Original Android Development] 4qman:
My progress so far :)

1. prepare the USB stick to boot the laptop (as per 1st page)

2. boot the laptop from USB and give it an internet connection & download the kamakiri-mantis-v1.0.zip, extract and run from terminal

3. download Magisk & MagiskManager

4. Short pins to Gnd and plug in firestick and run both the scrips (i used tin foil and followed images on page 12)

5. ADB shell to install the magisk (i didnt have an OTG cable)

6. copied the Magisk file to sdcard of fire stick (this shows up now i have run both the scripts bootrom-step.sh and then fastboot-step.sh)

7. run the adb shell from same terminal on laptop

adb shell

twrp install /sdcard/Magisk-v20.0.zip

EDIT: resolved step 8
[Fire TV Original Android Development] ForForkSake:
This is where I am clueless on which places to try and short, any guidance would be much appreciated..

[IMG="back"]https://i.ibb.co/M64cf47/00back.jpg[/IMG]

[IMG="front"]https://i.ibb.co/tmwQRNy/00front.jpg[/IMG]
[Fire TV Original Android Development] asislife20:
So restoring the full twrp backup worked but it still doesn't boot, looks like you may be right and I borked up my first stick. I bought the second one for $25 though so it's not the end of the world. If Rbox rom doesn't work, I'll either trash it or give it to someone on here who has the skill and to try and fix it.

You don't even have to plug the HDMI in to run the exploit, just plug the USB into your laptop. Alto after screwing up my first stick, I realized melting the plastic off of a bread tie and using the metal strand works great.
[Fire TV Original Android Development] cluelessperson:
[/COLOR]

* I don't have the two missing componetnts.

* I don't have the tools for SMT soldering.

* The FireTV Stick 4K still boots "fine"

* The data0 trace appears largely intact, but the fastboot script isn't detecting the unit.

Not sure how to proceed.
[Fire TV Original Android Development] xyz`:
For the steps which require shorting you need to run the "bootrom-step.sh" script, not the "fastboot-step.sh" one.
[Fire TV Original Android Development] asislife20:
There's definitely something wonky going on. My second Firestick stopped me from opening settings just like the first did. I booted to twrp and wiped cache, rebooted, then the home screen loaded just the words on top, then went black and back and forth. I did a factory reset, and it now works.
[Fire TV Original Android Development] cluelessperson:
Unfortunately, even running the correct script isn't working for me now.

Are those two missing components now preventing me from unlocking the bootloader?

How should I proceed?

Thanks btw.
[Fire TV Original Android Development] hyperblu:
So I trashed my 4k stick when I broke an SMD on it trying to reflash after a failed flash of magisk. Just FYI I just ordered another 4k stick new for $7 shipped from Amazon. They're running a $25 off credit with promo and I had a $17 courtesy credit already applied to my next order. WIN!
[Fire TV Original Android Development] Rortiz2:
Woah! Looks like the HD8 2017. In that case was TP28 but I'm not sure. Can you post a bit better quality pics?

Regards.

Enviado desde mi WAS-LX1A mediante Tapatalk
[Fire TV Original Android Development] ForForkSake:
Yes sure, I can take some in a few hours.

However it's the same as can be found here:

https://www.allaboutcircuits.com/news/teardown-tuesday-amazon-fire-tv/
[Fire TV Original Android Development] Rortiz2:
If you want to PM me for continue and not spam this thread;)

Regards.
[Fire TV Original Android Development] Sus_i:
I didn't noticed that the guy talks about the wrong script. ;)

Thank you very much, escpecially for finding vulnerabilities and ofcourse for developing such amazing exploits like for the ps vita. Your work is highly appreciated. :good:
[Fire TV Original Android Development] Sus_i:
Let me know if you couldn't find that testpoint mentioned from [MENTION=8978978]Rortiz2[/MENTION]

I know a pad for shorting on sloane (DAT0).
[Fire TV Original Android Development] extrem0:
It looks like it's the 2nd gen that's for $25, not the 4k (it's $35 though).
[Fire TV Original Android Development] hyperblu:
View attachment 4843043

Nope. It's a 4k stick
[Fire TV Original Android Development] Michajin:
Probably not a good idea to post all your personal info on that screen shot...
[Fire TV Original Android Development] hyperblu:
Yeah just realized it had my address on there. Good looking out. ?
[Fire TV Original Android Development] Giuseppe 1971:
Hello, is there someone else who is getting the Error 8056/request to update when opening Prime Video app? I'm on the ROM 6.2.7.6 and it occurred the same to me months ago, I updated the app to the latest version (27.1617-L) took from the ROM 6.2.8.1 and all was working fine till today.

EDIT: Hi again, I ignore the reason but Prime Video today works flawlessly.
[Fire TV Original Android Development] jorges4lu2:
Hi,

Is it posible to do all the process (with the new 2.0.1) while the stick is connected to the tv? In order to see when it boots to the twrp recovery.
[Fire TV Original Android Development] Sus_i:
Yes :)
[Fire TV Original Android Development] PTmotoG:
Hello,

I sucessfully unlocked my mantis with fw OS 6.2.8.1, got the error from "Downgrade rpmb" but after apply the "receipt" from @nicedog (comment line 72, 73, 74) it completed and I managed to load into TWRP.

Then I simply reboot it and all boot smoth, but when trying to play video in a App usually use for TV it just got hang, only way is to reboot (unplug power) to solve.

Any idea?

Is it fine to be this way or shall not skip the rpmb downgrade?
[Fire TV Original Android Development] Sus_i:
It's better if you just try it a few times until it works... instead of disabling the downgrade.

Anyways, you need to flash a TZ image from 6.2.8.1 to the tee1 and tee2 partition, in order to fix streaming.

Easiest way is to flash the prerooted 6.2.8.1r2 from rbox:

https://xdaforums.com/t/fire-tv-stick-4k-mantis-prerooted-stock-images-6-2-8-1_r3.3983091/

but flashing only the TZ image with hacked fastboot or via dd is also working.
[Fire TV Original Android Development] PTmotoG:
If understood correctly, your sugestion is to try script several times until it trigger the rpmb downgrade?
[Fire TV Original Android Development] Sus_i:
Yes, but this wont help you with the streaming issue.

You see, Kamakiri downgraded your TZ image on tee partiton, it will work and stream fine up to 6.2.8.0.

Since your stick is/was on 6.2.8.1, you need to update the TZ yourself.

One of this options will fix the streaming issue:

-flash rbox prerooted 6.2.8.1r2 with twrp.

-or exchange the TZ image in kamakiri with the TZ out of the rbox 6.2.8.1 and do the unlock again.

-or use hacked fastboot to flash TZ to tee1 and tee2

-or use dd to flash the TZ instead of flashing it with hacked fastboot.
[Fire TV Original Android Development] PTmotoG:
thanks, regarding the stream issue I got the point :)

Was referring to the downgrade, will try again to see if I have sucess with it to have the correct rpmb.
[Fire TV Original Android Development] SweenWolf:
-or download this zip and flash via TWRP

https://xdaforums.com/attachments/tz-update-twrp-zip.5367085/
[Fire TV Original Android Development] k4y0z:
If your stick still boots, you don't need to do the downgrade.

The downgrade is to prevent bricking the device in case there were newer pl, tz or lk installed previously.
[Fire TV Original Android Development] akela1979:
please tell me if this method is compatible with this 4k stick ?
[Fire TV Original Android Development] Sus_i:
Yes, if you use kamakiri 2.0.1 from OP.

Same procedere as for sheldon, guide here:

[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 3 and Fire TV Stick Lite (sheldon/p)

Read this whole guide before starting. This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon). NOTE: FireOS < 7.2.7.3 required NOTE: This process does not require you to open your device. What you need: A Linux...

xdaforums.com
[Fire TV Original Android Development] wwwkkk:
Hi guys, so many posts here and i get no clue, where i`ve seen the post of the link to the archive of all mantis firmware and all different versions of the amazon apks ever been released.

I need to know - can someone send me a PM with the link ?
[Fire TV Original Android Development] Sus_i:
https://xdaforums.com/t/fire-tv-sti...ps-official-cloud-front-direct-links.4088247/
[Fire TV Original Android Development] gabardal:
Hello, I'm interested in how to do this, I mean, would you be kind enough to share these commands?

Also, do you know how can I backup my current tz.img?

Thanks!
[Fire TV Original Android Development] Sus_i:
If you boot hacked fastboot with the boot-fastboot.sh script, then this should work:

fastboot flash tee1 /bin/tz.img
fastboot flash tee2 /bin/tz.img

Make sure that the path points to the image...

If you want to use adb shell in twrp:

adb push tz.img /sdcard/Download/
adb shell
dd if=/sdcard/Download/tz.img of=/dev/block/platform/soc/11230000.mmc/by-name/tee1_real
dd if=/sdcard/Download/tz.img of=/dev/block/platform/soc/11230000.mmc/by-name/tee2_real

In adb shell from fireOS add su to the commands and use tee1 and tee2 without to add _real.

Backup works too, you just need to reverse the if/of command, i.e. of points to the sdcard folder, you may use a different filename... ;)

EDIT: works only for updating images, downgrade needs a rpmb cleaning with kamakiri...
[Fire TV Original Android Development] gabardal:
Thank you so much for this. I have one question, regarding backups, are the contents of tee1 and tee2 the same? Or (in the case of dd-ing), are the contents appended to tz.img? I mean, is tz.img, tee1 plus tee2? Thanks for your help 🙏
[Fire TV Original Android Development] Sus_i:
tee2 is just a backup, content is the same.

The update script from the stock rom extracts the tz.img to both partitions (blocked by twrp).
[Fire TV Original Android Development] squaleca1974:
so ive debloated using githut prop, used shizuk/icebox froze recommended apps useing wolf launcher what else are go to tweaks?
[Fire TV Original Android Development] tomislavv:
Succesfully unlocked with kamakiri 2.0.1, flashed stock NS6277/3033, everything went fine. Stick works properly, can boot to TWRP, but is not recognized on computer anymore when connected to USB, even when booting (tried also with FireISO, different cables, different computers...), Any ideas ?
[Fire TV Original Android Development] Conan179:
Hello@all.

Now I have to ask, I have a fireTV 4k (sn:G4N0VM10142XXXXX Fire OS 6.2.8.7) at home, can I do something with it or not?
[Fire TV Original Android Development] Sus_i:
Nope

(y)

Have you tried a normal usb cable, i.e. not an OTG cable?
[Fire TV Original Android Development] tomislavv:
Yes, tried all sorts of cables...

Checking with lsusb, seems as it is not connected at all.
[Fire TV Original Android Development] Sus_i:
but the stick still boots and works fine?
[Fire TV Original Android Development] tomislavv:
Yes, boots normally or to TWRP and works fine. Really curious about this...
[Fire TV Original Android Development] Sus_i:
You can try to use the boot-recovery.sh script from kamakiri. Run the script with sudo, then connect the sticks usb. In case twrp boots up, try adb devices
[Fire TV Original Android Development] tomislavv:
Thanks, but already tried that. Been also checking lsusb for any hardware change when stick was connected but nothing happened. Also tried rebooting to recovery while connected to computers adb to see whether adb works from twrp but it didn't, computer doesn't see any devices connected to usb.
[Fire TV Original Android Development] Sus_i:
Question is if the script found the stick or not...

Does twrp come up with the boot-recovery script?
[Fire TV Original Android Development] tomislavv:
No, the script doesn't find the stick, "waiting for device" indefinitely. Basically none of the kamakiri scripts find the device.
[Fire TV Original Android Development] Sus_i:
Thats odd.

I guess the stick may got a hardware damage.

You can try to take a log via logcat, maybe you can use an app for this if there isn't a chance to use adb.
[Fire TV Original Android Development] tomislavv:
I also thought that could be a hardware issue. Not sure how to use logcat when adb is unavailable on boot. Is it possible to start it on booted stick via remote adb connection to keep logging after the reboot ?
[Fire TV Original Android Development] Sus_i:
via network ip yes, but you need to enable developing option in the settings and grant access on your TV if you get a prompt... This will copy the whole log into a file:

adb logcat > log.txt
[Fire TV Original Android Development] tomislavv:
adb logcat exits on reboot so cannot log the boot sequence unfortunately. Tried adb bugreport but got 95k lines logfile, not sure what to look for...

adb reboot bootloader sends device to fastboot, now it is recognized on computer. But how to reboot the device to hacked bootloader mode ?