yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] rbox:
Okay, that's slightly different from what I am seeing:

Unable to retrive DRM key [devicecertificate.dat] ID [14]
Unable to retrive DRM key [amazonprivblob.dat] ID [15]
Unable to retrive DRM key [fairplay.pobj] ID [16]
Unable to retrive DRM key [mfi.pobj] ID [17]
key 0x400 is missing, skip restoring
Unable to retrive DRM key [devicecertificate.dat] ID [14]
Unable to retrive DRM key [amazonprivblob.dat] ID [15]
Unable to retrive DRM key [fairplay.pobj] ID [16]
Unable to retrive DRM key [mfi.pobj] ID [17]

In [MENTION=6874029]tehlers[/MENTION] case, it sounds like there was some period of time that you were on 6.2.6.5 before doing the update to 6.2.6.6. Do you know if you were still getting the error after waiting that period of time? How long after 6.2.6.6 booted did you check? Was it immediate or was there hours between doing the update and trying it? I'm trying to figure out if it's somehow tied to the act of doing the update, or maybe on first boot, or maybe if it just sits there long enough. There is some sort of "provisioning" process for these keys, so I'm trying to figure out what makes it work.
[Fire TV Original Android Development] tehlers:
Hi rbox,

I you mean me: I was on 6.2.5.8 until I flashed your prerooted image from the other thread (6.2.6.5). I did unfortunately not check Prime before and also just checked after I read from others about the problem. Until today morning I got no offer from FireOS to update to 6.2.6.6, but I definitely checked yesterday evening that it still did not work (licence_error). And while the update I checked constantly about the licence_error, as reported. I pretty sure, that only the update fixed it (immediately).
[Fire TV Original Android Development] rbox:
But at some point you went to stock 6.2.6.5 and wiped out the exploit. That's really the timeline I'm trying to figure out. Did it fix itself while you were just on 6.2.6.5 without the exploit, or was it the act of doing the update to 6.2.6.6 while not exploited that fixed it.
[Fire TV Original Android Development] tehlers:
This was together with k4y0z here in the thread and *no*, as I said it did *not* fix the license_issue (see: https://xdaforums.com/showpost.php?p=80581105&postcount=333). So until today after the update I had the issue.

Edit: And BTW I did not need to factory reset after the update today, it was working right away after the update.
[Fire TV Original Android Development] Pretoriano80:
This line - > key 0x400 is missing, skip restoring <- it will be there only on 6.2.6.6, because the following prop was added to the default.prop and to selinux contexts :

persist.sys.amzn_drm.skip_mask=0x400

persist.sys.amzn_drm.skip_mask u:object_r:amzn_drm_prop:s0

Btw, my output from drmprov_check looks like yours, but Prime is working in HD(no 4k here).
[Fire TV Original Android Development] k4y0z:
That would have been my suggestion anyway.

tee1 should be the same as before, since that is overwritten during the exploit.

It's interesting that KB has changed, that may be (literally) the key to it.

Can you please send me these 3 partitions from before and after.

I am currently thinking KB is updated at some point and that may only work with the newer tz.

Could you maybe try flashing the old tz to both tee1 and tee2 and see if it still works?

How did you flash them in TWRP?

Remember that TWRP normally blocks flashing these partitions unless you account for that.

Using OTG and normal USB simultaneously will never work it's always either or.

To enter hacked fastboot you can also use the command "reboot-amonet" from TWRP shell.

adb shell reboot-amonet

This is the result on my stick with working prime:
[Fire TV Original Android Development] rbox:
What and how is it blocking them?

*edit*

nevermind, I see. It's the /dev nodes pointing to /dev/null.
[Fire TV Original Android Development] alias100:
After flashing the Rom Backup, the Stick work again. ?
[Fire TV Original Android Development] k4y0z:
Yes exactly there are symlinks to the actual blockdevices with the suffix _real you can use though

To flash preloader you need to

setprop amonet.preloader rw

or

echo 0 > /sys/block/mmcblk0boot0/force_ro
[Fire TV Original Android Development] rbox:
Well, that was it! LOL. tz needed to be updated. I didn't realize TWRP was blocking it. Which is why it just starts working after flashing the update with stock recovery. Still not sure why it's working for you. It's possible you already have provisioned keys that are still valid and may expire at some point. So I'll put out a 6.2.6.6 that includes the updated tz's flashing to the correct location.
[Fire TV Original Android Development] Pretoriano80:
Good, you fixed it!

I wonder the same thing, why for me (and probably others) Prime is working even without flashing a Full 6.2.6.6 update?

Personally i only flashed boot, system and vendor, but Prime (1080P) never complained.
[Fire TV Original Android Development] k4y0z:
Yes, that's exactly what I was thinking. That's why I asked [MENTION=6874029]tehlers[/MENTION] to revert back TZ and check if it still works.

You should probably also update preloader if you update TZ. On other fire devices I have seen issues when they didn't match.

If everything is working with the new tz and preloader I will update kamakiri to use them from the start.
[Fire TV Original Android Development] rbox:
So preloader didn't change. Just the TZ.

I have updated my prerooted rom page with 6.2.6.6. addon.d support is still there. And it will always install magisk, going back to true "pre rooted" images. I'm not explicitly creating the addon.d directory anymore, thus verity should be able to pass if you don't use Magisk. It also helps to not put the addon.d directory explicitly there so Magisk doesn't try to put it's addon.d script there. Thanks to everyone that helped me with my troubleshooting of the LICENSE_ERROR.
[Fire TV Original Android Development] tehlers:
Hi,

I copied back the old tee[12] and no change. Still no licence_error (and amzn_drmprov_check shows still the same), I even rebooted the stick to check if that is cached somewhere.

license_error idme print

[...]
KB:
4b 42 50 46 28 13 00 00 38 13
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
[...]

The new idme print (only differs in KB):

[...]
KB:
4b 42 50 46 38 24 00 00 48 24
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
[...]
[Fire TV Original Android Development] Pretoriano80:
If you still want to try, i've made a Magisk module fot for it
[Fire TV Original Android Development] Sus_i:
If I update locked sticks and then run the unlock, tee1 is flashed (downgraded?) by the bootrom script.

Is the conclusion now, tee2 remains untouched and therefore the sticks can play prime content?
[Fire TV Original Android Development] tehlers:
I think you have a typo in the sed in post-fs-data.sh:

sed 's/locked_kernell=false/locked_kernel=true/i' /proc/cmdline | sed 's/orange/green/i' | sed 's/yellow/green/i' | sed 's/unlocked/locked/i' > /data/local/tmp/cmdline

Should be "locked_kernel=false" with one "l", right?

---------- Post added at 12:44 ---------- Previous post was at 12:31 ----------

I'm currently unsure... You are right with what you write, but why is the stick working after I replace tee1 and tee2 with the old version, where I had license_error? It must somehow have to do with kb. So *maybe* (I did not try it out yet), kb is generated from tee1 and/or tee2 (via "idme copy KB [...]") and what's used for playing the content is kb.

If that would be right, the license_error should come back if I replace tee1 and tee2 with the old version and then generate a new kb with "idme copy KB [...]". Maybe I'll try it, I have at least all backups.
[Fire TV Original Android Development] k4y0z:
OK, I'll update kamakiri later.

Does that mean you removed addon.d support?

What about things like gapps etc?

That pretty much confirms my suspicion KB (KeyBox) has been updated using the new TZ.

After ist was updated it still works with the old TZ though

No, that's not it, tee2 is just a backup of tee1 it would probably only be used if tee1 doesn't load.

After KB has been updated at one point it continues working even with the old TZ.

I am pretty sure if you copy back your old KB it would stop working.

It has been updated in idme and then copied to the KB partition.

the idme print doesn't show the full content, and you probably shouldn't post the full content here.
[Fire TV Original Android Development] Pretoriano80:
Yep,good catch!Fixed and re-uploaded,thx!
[Fire TV Original Android Development] tehlers:
No, I tried it out now, I always get the "new", correct content of KB with "idme copy KB /dev/block/platform/soc/11230000.mmc/by-name/kb". Now I used dd to copy the old content of kb to the partition, but playback works and "idme print" still tells the new entry. So I rebooted the stick and while booting "kb" get back it's new content.

So: Partition "kb" is generated while boot. It's not generated from "tee1" or "tee2". I don't know where the content comes from and with the lack of "strace" I cannot see what "idme" is doing. Maybe [MENTION=7104332]k4y0z[/MENTION] can shed more light on this.
[Fire TV Original Android Development] k4y0z:
Yes, kb is updated in idme and then copied to KB partition.

idme is stored in boot1.

I would leave it alone, it's pretty clear now, what's happening.

Thank you for testing.
[Fire TV Original Android Development] Pretoriano80:
[MENTION=7104332]k4y0z[/MENTION] are the fos_flags of any use? Fastboot says user_flags are 0,which probably means disabled, but what about dev_flags and fos_flags?
[Fire TV Original Android Development] k4y0z:
Check init.fosflags.sh

I have uploaded version 1.2 which updates tz and should fix any license issues.

To update you can simply install the ZIP-file from TWRP.
[Fire TV Original Android Development] Pretoriano80:
Interesting,after removing

persist.sys.amzn_drm.skip_mask=0x400

i get this output from "amzn_drmprov_check" :

mantis:/ # amzn_drmprov_check
Unable to retrive DRM key [devicecertificate.dat] ID [14]
Unable to retrive DRM key [amazonprivblob.dat] ID [15]
Unable to retrive DRM key [fairplay.pobj] ID [16]
Unable to retrive DRM key [mfi.pobj] ID [17]
key 0x400 is missing, restore from backup
keys restored from RPMB.
[AMZN_DHA_TOOL]: Self-test success
Keys restored from backup
Unable to retrive DRM key [devicecertificate.dat] ID [14]
Unable to retrive DRM key [amazonprivblob.dat] ID [15]
Unable to retrive DRM key [fairplay.pobj] ID [16]
Unable to retrive DRM key [mfi.pobj] ID [17]

And this is from amzn_dha_tool :

mantis:/ # amzn_dha_tool --get-csr
amzndha_tool_get_csr: Unable to retrieve DHAv2 CSR
255|mantis:/ # amzn_dha_tool --get-certificate
amzndha_tool_get_certificate_chain: Unable to retrieve DHAv2 Certficate Chain
255|mantis:/ # amzn_dha_tool -c
Error in hardware/amazon_hal/security/amzn_dha/mediatek/amzn_dha_mtk.cpp:137 [Unable to execute TEE command]
amzndha_tool_create: Unable to generate key-pair

P.S : Never had the Prime license error,only investigating a bit on this.
[Fire TV Original Android Development] rbox:
The calls to run the addon.d is still in the updater. So if one would want to use it they'd have to add the addon.d directory and the file themselves, where as before i was automatically adding the directory.
[Fire TV Original Android Development] xionbunny:
Speaking of gapps, I hope someone gets that working some day, would be nice having a more native google experience.
[Fire TV Original Android Development] k4y0z:
I see.

I think it would be better to keep addon.d.

What would happen if you added it, then installed gapps and then update to a newer version of the ROM.

Would it then recreate addon.d?
[Fire TV Original Android Development] rbox:
In theory it would. Looking at the script as it is right now, it doesn't. But that's easy to fix. So the flow would be:

you install a rom

if /system/addon.d is present, it copies everything to /tmp

it runs any pre backup scripts

it installs to /system

it runs any post backup scripts

if the directory exists in /tmp, it creates the addon.d directory in /system and then copies everything to it
[Fire TV Original Android Development] tsynik:
Nope, if you'll cat your current /proc/cmdline on unlocked BL you'll se "unlocked_kernel=true", so on locked BL it must be "unlocked_kernel=false" probably (so need conversion from true to false, not opposite) ;) But it affects nothing ;)
[Fire TV Original Android Development] BigBossDogg:
Has anybody gotten Team Viewer to work with the Fire TV stick 4k with its bootloader unlocked?

There's a video of a guy getting it to work on a Nvidia Shield that he bootloader unlocked and installed full android: https://www.youtube.com/watch?v=Pkedz5deRmY

I wonder if the the bootloader unlocked 4k stick can now use Team Viewer properly to be controlled remotely from a PC?
[Fire TV Original Android Development] tsynik:
In case FireTV Stick - this device supports screen sharing only
[Fire TV Original Android Development] Sus_i:
He wrote unlocked_kernell=false, and [MENTION=6874029]tehlers[/MENTION] mentioned that one L at the end of kernel is enough ;) :p
[Fire TV Original Android Development] Pretoriano80:
Yeah, it was about that double "l" typo, not about the false/true statements. xD

---------- Post added at 12:26 PM ---------- Previous post was at 12:21 PM ----------

P. S. = Btw, i almost finished my work on usbotg (exfat, ntfs, f2fs, ext4) auto-mounting support.

It even mounts a test external hard-disk with 6 partitions on it, without FireOS complaining about not being FAT32. xD
[Fire TV Original Android Development] Sus_i:
Systemless via magisk plugin or modded /system?
[Fire TV Original Android Development] Pretoriano80:
Systemless, with Magisk module and eventually my custom kernel which has support for more filesystem (non-fuse).

But i may release two versions, one which requires the custom kernel and one which not.

My goal it's to make it work with SELinux Enforced, but if i fail to do so, then Permissive SELinux will be required.

Still under testing, but so far ext4 and f2fs are the champions regarding read/write speed and reliability.

Also, for some reason FireOS won't show the usb storage anywhere, so there's no way to unmount it from the UI, but still investigating on a possible solution.

Vold manages the mount/unmount part, so if you remove the usb storage, then it will remove the mount path.

My though is that FireOS it's lacking support for this stuff, because iirc, not even FAT32 usb storage mounted with stock FireOS doesn't show up in Settings. But if you remove the storage, FireOS will show a notification about unmounting the storage from Setting - My FireTV - USB devices, but that setting was never in there.
[Fire TV Original Android Development] Harry44:
My OTG cables arrive today. I can't wait to give this a go. Thanks to all involved.
[Fire TV Original Android Development] k4y0z:
OTG isn't a requirement.
[Fire TV Original Android Development] Harry44:
Yea, I am aware. Just would like to get external storage working. Thanks!
[Fire TV Original Android Development] vendo:
Rortiz how did you patched Ubuntu kernel? I want to use my RPi3 with Raspbian and looking for a guide how to patch the kernel needed for this 4K process.
[Fire TV Original Android Development] Harry44:
Wow! 10 mins and some tinfoil - two fire sticks "fixed." Thanks devs!
[Fire TV Original Android Development] k4y0z:
Look for any guide on how to compile your own kernel for raspian, then apply this patch to the kernel-sources.
[Fire TV Original Android Development] Shaggy214:
Even with this recent update 6.2.2.x this still works?

I'm having a hell of a time with th short.. Tried with dat0 , red clk, red cmd. And using the case and the USB socket as ground.
[Fire TV Original Android Development] hyperblu:
This exploit can't be patched with a software update. The shorting tool you're using may not be conductive enough to make a solid short to ground. You ARE executing the exploit before plugging in the stick to usb, correct?

You have to run the bash script, short the point, then plug in the USB while holding the short. You also need to look closer at the photo for reference. You're looking at an SMD resistor... One side of the cap has to be shorted to ground so you have to be touching that side of the cap when using cmd or clk. Also, use your phones zoom on the camera to help you see if you don't have a magnifying glass. Helped me.
[Fire TV Original Android Development] CrazyIvan:
Really looking forward to hearing more about this [MENTION=2642882]Pretoriano80[/MENTION]! The fat32 limitation absolutely sucks.
[Fire TV Original Android Development] Pretoriano80:
Probably i will release it later this evening/night! Just doing the latest tests and polish it, but so far it seems to work just fine.

Edit: You can download it from --> here
[Fire TV Original Android Development] Shaggy214:
Yes. Have the ISO from git on a USB.

Running v1.2 of KAM.

Was grounding out to the shield.

Even roughed up the shield for better contact, the dat0 pad. Also tried using the smd (side of the pad) as well. I'll try other grounds trmw.

Using really thin wire too.
[Fire TV Original Android Development] DarkH2O:
Thanks, I was trying th wrong end of that all this time.
[Fire TV Original Android Development] funnypanks:
Any chance you’d be able to write a quick guide on how to replace the launcher? Just rooted and am afraid to use the methods from FireOS 5 in case it black screens my box.

Thanks!
[Fire TV Original Android Development] gb160:
Ive used this guide without any trouble:

https://xdaforums.com/fire-tv/orig-development/firetv-4k-stick-add-ons-magisk-module-t3979117
[Fire TV Original Android Development] funnypanks:
I was hoping for a solution like the good ol days, without installing all the extra stuff (since we have root now, I thought it might be possible). I just want to disable the amazon launcher and run app starter. I was trying to avoid launcher hijack since I tried it in the past and it was quite buggy.
[Fire TV Original Android Development] tsynik:
Bad thing is when you disable launcher - you'll disable Settings and HUD also. If you don't like hijack method - you can use Xposed module which do the stuff - it completely disables stock one but preserve Settings access and also have keyboard switcher on Menu long press. Based on RBox work from older days.
[Fire TV Original Android Development] funnypanks:
Thanks! This looks promising! I saw you can install xposed through magisk. But I guess it’s safer to install xposed through twrp.

Or is this a magisk module based on the xposed module? I’ll do some reading. Last time I rooted something, magisk didn’t even exist, so I have some catching up to do haha.
[Fire TV Original Android Development] tsynik:
It doesn't matter which way you'll install Xposed, but safe way is to have systemless install (as Magisk module) so /system partition will be untouched and all your changes will be removed with simple wipe /data or module uninstall. You can also install it via Xposed Installer (from dvdandroid) - systemless xposed framework version.
[Fire TV Original Android Development] funnypanks:
Dunno if I'm dumb, but I installed xposed through magisk, installed xposed installer, installed this module and when I reboot, home button doesn't do anything. It's disabled the old home, but the new one doesn't show up still. Any help?

If I look in xposed installer, it says that xposed framework 89 is active, so I think it's working.
[Fire TV Original Android Development] tsynik:
Module looks for any user app (it have priority = 0) with android.intent.category.HOME intent and swap stock launcher with it. Maybe your home doesn't have required intent category in manifest so launcher doesn't switched. Check with ATV Launcher for example.
[Fire TV Original Android Development] funnypanks:
Just tried with the ATV Launcher you just linked, still the same issue. Any way to enable log/retrieve log to see what's going on?

Thanks for the help so far!
[Fire TV Original Android Development] tsynik:
This is offtopic here, you can create an issue on github. Try this version and check what list you have for HOME intent in logcat (filter it with "###" and press HOME).

it must look similar to this:

11-03 00:27:02.081 633 649 D ### I ### : Intent { act=android.intent.action.MAIN cat=[android.intent.category.HOME] flg=0x10200000 (has extras) }

11-03 00:27:02.081 633 649 D ### E ### : android.intent.extra.FROM_HOME_KEY : true

11-03 00:27:02.081 633 649 D ### 0 ### : com.amazon.tv.launcher.ui.HomeActivity_vNext priority: 950

11-03 00:27:02.081 633 649 D ### 1 ### : com.amazon.firehomestarter.HomeStarterActivity priority: 1

11-03 00:27:02.081 633 649 D ### 2 ### : ca.dstudio.atvlauncher.screens.launcher.LauncherActivity priority: 0

11-03 00:27:02.081 633 649 D ### 3 ### : com.amazon.tv.leanbacklauncher.MainActivity priority: 0

11-03 00:27:02.081 633 649 D ### 4 ### : com.amazon.tv.settings.v2.system.FallbackHome priority: -1000

Maybe you disable or delete firehomestarter before?
[Fire TV Original Android Development] funnypanks:
Good point, sorry for spamming. This will be my last reply here, just for reference for future people that might come here.

I just factory reset my box, installed magisk 20.1, installed the magisk xposed module, then installed your aftv 1.5 Xmposed module, then it worked perfectly!

Sorry again for all the posts. Hopefully this helps someone in the future.
[Fire TV Original Android Development] AmznUser444 Dev:
Say thanks to [MENTION=6680544]bibikalka[/MENTION] for donation for you.
[Fire TV Original Android Development] LuCkyCn:
The latest "fire update" prevented me from installing Magisk. I've tried reinstalling and factory resetting and it only boots loops to the recovery. Unfortunately, I was not able to block the latest update as it was a device that was given to me because of the license errors.
[Fire TV Original Android Development] Pretoriano80:
Interesting! Some logs would be useful. Is it bootlooping right after restarting feom recovery or while loading FireOS (the white screen with FireTV logo)?

Yesterday i pulled the update from the stick, but only diffed 6.2.6.6 ramdisk against the 6.2.6.8 ramdisk, noticed some changes but haven't looked deeply into it.

I thought there's nobody worse than Huawei regarding such stuff, but Amazon seems to be even worse. xD
[Fire TV Original Android Development] TitanUranus:
You can probably download and flash the older firmware image, block updates and install magisk:

https://xdaforums.com/fire-tv/development/fire-tv-stick-4k-mantis-prerooted-stock-t3983091

I guess you probably knew that but thought I'd mention it just in case. Hope you get it working.
[Fire TV Original Android Development] LuCkyCn:
Sorry, I didn't think to pull a logcat as I had already resolved the issue. I want to inform others of the implications of not blocking the OTA.
[Fire TV Original Android Development] Pretoriano80:
What do you mean with "resolved"? Downgraded to previous version?
[Fire TV Original Android Development] LuCkyCn:
Yes. Downgrade via hackBL, re did the exploit, root and blocked OTA. Latest Magisk is sticking and all is well. I could have used a pre rooted ROM, but I chose not to and the exploit was just as easy.
[Fire TV Original Android Development] Pretoriano80:
Just testing the new update and i don't think it's magisk that it's causing this issue. Will try to get some logs now.
[Fire TV Original Android Development] xionbunny:
so I guess that means we are generally screwed as far as future updates go.

edit: never mind *keeps watch on this thread closely*
[Fire TV Original Android Development] LuCkyCn:
I don't think it's Magisk either. I've used previous stable modules and none of them were working. As soon as you ununstall it, the Firestick will boot right up.