yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Bertonumber1:
Yes thats okay , extract kamikiri to desktop

Open terminal in extracted folder .

Ensure you have made short correctly (ie its connected to the points correctly )

Then run:

./bootrom-step.sh

Sometimes you need to update fastboot on fireos , you can do this in terminal by type:

pacman -Sy fastboot

Please note as of approximately August 2020 onwards, there has apparently been a revision to the sticks which stops them being modified.

##Edited## command error
[Fire TV Original Android Development] seandop:
I'm not sure if sudo wool help him here. Both scripts had all the executable flags set to off when I extracted them. Chmod 777 *.sh worked for me.
[Fire TV Original Android Development] king200:
"Please note as of approximately August 2020 onwards, there has apparently been a revision to the sticks which stops them being modified. "

I had done this several time without problem. It would not run the exploit on newer Firesticck
[Fire TV Original Android Development] someone123456:
Would it be possible to get serial number of you device? I would like to see if we can see hardware/software revision from the SN and avoid buying non rootable devices.
[Fire TV Original Android Development] Bertonumber1:
You cant , serial numbers are probably embedded with the factory firmware . It would be nothing short of a security risk for amazon to disclose device specific serial numbers prior to individual registration to each specific device.

Otherwise everybody wishing to mod a stick/box would be cherrypicking all the vulnerable ones and leaving all the rest lol

I like your thinking though 😉
[Fire TV Original Android Development] Skel40:
I bought 3 4Ks last January with the working hardware exploit on the OP. Considering the 4K being 2 years now with one year since the exploit, it comes to no surprise Amazon is catching on with these vulnerabilities as they done for the HD Tank by patching the hardware mods already done on these devices. I'd take a look on eBay for 4Ks if possible.
[Fire TV Original Android Development] Skel40:
Serial numbers won't do anything to run exploits as its hardcoded in the device verifying purchase or else it's blacklisted if not paid for. It's mostly the production of the stick being updated hardware wise so checking the date when the device is published would usually give you an idea if the exploit is patched or not. It's not easy to figure out right away because of the same software/hardware it's currently using compared to the exploitable versions before the hardware revision
[Fire TV Original Android Development] Bertonumber1:
Yeah i know bro , if someone is looking for a device (4k mantis) thats vulnerable to the exploit i would recommend buying one from the bay or some other market for cheap . Chances are it will be a pre august 2020 edition with the best luck being a 2019 model . Probably same for tank 2nd gen , id be looking for a 2018/19 , before the boogeyman came on decemberish 2019 tank models
[Fire TV Original Android Development] mozgoeb:
+1

I have the same issue as others: I bought 2 sticks on BF2020. Finally today I found time to root the device.

Spoiler content hidden.

It looks like I have no luck with the sticks. =((
[Fire TV Original Android Development] k4y0z:
As this seems to come up more often:

This error does not indicate a patched device.

This error typically means the device is not shorted correctly and the script is trying to talk to the preloader (instead of the bootrom).

The only way to reliably tell, whether the device is patched or not, is that a patched device doesn't come up at all on USB while shorted.

If it comes up as MediaTek Inc. MT65xx Preloader, the short isn't applied properly.

If it comes up as MediaTek Inc. MT6227 phone, The device is vulnerable and the short is applied properly.
[Fire TV Original Android Development] seandop:
Agreed. I got this error multiple times until I finally got my wire in the write position. It's not particularly easy to get it right... takes some dexterity.
[Fire TV Original Android Development] Bertonumber1:
Try the short again and make sure its properly in place , what does lsusb say? If it shows mediatek phone mtk xxxx your device can still be had mate
[Fire TV Original Android Development] mozgoeb:
Found the cause of the error. Earlier I already noticed that (sometimes) there are problems with external HDDs on one of the laptop USB ports. Switched from laptop to BRIX. And at the same time I took the cable from the player's box. Both sticks were flashed without any problems.
[Fire TV Original Android Development] mozgoeb:
While searching for a solution, I read forums in several languages. Russians say that most likely players with serial numbers starting with 190 (after VM) have problems. G070VM190. VM170, VM180 and all previous "series" reported still can be rooted!
[Fire TV Original Android Development] mozgoeb:
del
[Fire TV Original Android Development] someone123456:
ok thanks for this information. I have tried and tested VM149, VM160 and VM170 and are confirmed working. Need to get my hands on 190+ and try it out.
[Fire TV Original Android Development] Bertonumber1:
Hmm ..pretty good indicator , just a shame we wont know if we have a vulnerable stick until we spend our money
[Fire TV Original Android Development] mozgoeb:
The serial number is printed on the bottom of the box. You can return the stick to Amazon without opening it!
[Fire TV Original Android Development] Bertonumber1:
So then what do we do keep sending them back if its not a number under 190? Would they not become suspicious of this ?
[Fire TV Original Android Development] Sus_i:
lel, they obviously selled all old stock^^
[Fire TV Original Android Development] Bertonumber1:
Ah okay , i see , i would say best bet is still a cheap/used one from the bay if youre looking to mod one no ?
[Fire TV Original Android Development] Sus_i:
Yeah, ofc, I think the same ;)

There were reports that the 4k stick wasn't avialable for weeks, for months in some countrys, so I think the old stock is gone.

Edit: But ofc it could be worth a shot, just to watch out at local stores. Maybe there are older devices for sale, idk.
[Fire TV Original Android Development] SweenWolf:
Now mantis is also coming with patched BROM??
[Fire TV Original Android Development] Bertonumber1:
It appears sticks manufactured and distributed from approx july 2020 onwards are patched sween
[Fire TV Original Android Development] Bertonumber1:
Apologies if slightly off topic . Does Anyone know if there is a way to permmanently install the patched fireiso usb to an old laptop ? I actually like this distro but cant find it anyhere obv cos its unique ?
[Fire TV Original Android Development] k4y0z:
FireISO is based on SystemRescueCd which in turn is based on Arch Linux

Neither FireISO nor SystemRescueCd are meant to be installed as main OS, though there exist instructions for doing just that: https://www.system-rescue.org/manual/Installing_SystemRescue_on_the_disk/

You may want to look into Arch Linux instead, if you want to have a full-fledged operating system.
[Fire TV Original Android Development] Bertonumber1:
Hey @k4y0z cheers man . Just what i was looking for .
[Fire TV Original Android Development] mybrownays:
Hello @k4y0z .You don't remember who initially found a way to close the capacitor on the stick at all. Maybe these craftsmen will again find ways to fill the recovery for new batches of devices (digits 190 in the serial number, and digit 7 on the memory chip)? Went on sale in mid-December 2020 (s/n: G070VM190*******).

I "shorting" the capacitor to the frame correctly, not for the first time, with foil twisted into a tube. In the second photo, the SMD element was not torn off by me :)
[Fire TV Original Android Development] Bertonumber1:
Jeez you ain't half had a go at shorting that 👀
[Fire TV Original Android Development] Aldaris001:
Hi guys,

I have a fire stick 4k bought beginning of 2019 which I rooted last year successfully. Unfortunately I forgot to disable OTA so with the latest update in December, my root access was overwritten. I have tried again to use the shorting methodology but I failed so far. The stick is recognized (interestingly not in all USB ports) but the handshake fails with a weird error:

Spoiler content hidden.

Does someone of you have a similar experience? Is there any other chance how to get maybe into twrp and then flash the image from there?
[Fire TV Original Android Development] Bertonumber1:
This is because your not make shorting correctly.

so make sure you have short in place secured.

also check you have latest zip and its extracted to Arch linux desktop and open terminal within that folder .

sometimes we get errors sometimes we dont keep trying
[Fire TV Original Android Development] Aldaris001:
Thanks, I tried some more times and got it working in the end! :)
[Fire TV Original Android Development] kenmac96:
I can confirm. VM190 device here not coming up while USB powered and properly shorted.
[Fire TV Original Android Development] I_CRAFT:
@k4y0z

Maybe you should mention it in the OP, that there is a high chance for devices with SN ...VM190... for being (atm) not rootable to prevent further confusion.
[Fire TV Original Android Development] k4y0z:
Done
[Fire TV Original Android Development] DirtyAngelicaSecured:
What are the instructions on how to put the device back together? It gets hot and I wonder if I can improve cooling by using thermal compound I place between my PC's CPU and CPU heatsink?

The foil method can short much more than needed. Are there problems with that?
[Fire TV Original Android Development] k4y0z:
The same way you took it apart, I don't think that needs explicit instructions.

There should already be a thermal-pad between the CPU and the shield/heatsink.

I don't think anyone has reported issues with that, and it's much less likely to physically damage the board.
[Fire TV Original Android Development] Pachacouti:
Actually, bein an electronics engineer fo over 40 years, I can honestly say that last night I cut in half 4 usb leads, 2 had the micro usb end, and I joined all the same colours to same colours, added a usb socket for power, or anything else, and a standard usb to plug into laptop, by applying a 3amp power supply, I now could jump from fireiso to windows, but what I had to do to flash the boot.img, was first use fireiso to do the first step, I then wiped everything I could see, rebooted laptop into windows, wwhile power kept me in fastboot, then I unplugged the firestick, plugged it straight back in, fastboot showed because I'd wiped everything else, I could then flash what ever I wanted (boot.img), at no time did I not use this makeshift lead. Just a heads up and a hint ;) the more devices, requires more mA, (millamps) , so to power a firestick and mini usb bluetooth keyboard (using lead, not bluetooth), it's good to have a quality 3A 5v power supply ;)

Edit: pc's usually only provide 500ma per usb socket, I set mine in windows to 2000 (2A), so it's understandable to think an otg wont work if your usb only puts out 500mA, standard windows settings :) , go to hardware settings, check each usb port's power output!
[Fire TV Original Android Development] behtjes:
My fire tv 4k doesn't show up when shorted. Serial number contains starts with G070VM129.. so it should be possible to use this method? I see the device when it's not shorted using lsusb. When shorted it doesn't show up. What's going wrong?

Edit: using this guide it worked:

Rooting an Amazon Fire TV Stick 4K » Miguel Mota | Software Developer

Software developer

miguelmota.com

It's showing a different point to short than this tutorial?
[Fire TV Original Android Development] Geordiepaul15:
Hi all, I've loaded the ISO to a 4gb USB stick via Rufus and changed the boot sequence in the Lenovo BIOS.

For some reason the laptop will not boot via the USB.

What am I doing wrong or do I have other options?

I also tried running bootrom from command prompt but it said there was no associated application.
[Fire TV Original Android Development] I_CRAFT:
I'm glad that this guide worked for you, but he used the same points that were mention in the OP.

I would suggest you try again to "burn" that image to this USB drive.

So time it can happen that not all files were transfered correctly, parts of the data were still inside of the write cache while ejecting.

Spoiler content hidden.
[Fire TV Original Android Development] i_teach_it:
Hi, I'm having the same problem..

I was able to finaly flash the bootloader, but now i'm stuck the flashboot step. On my screen I only see the Logo with hacked fastbook mode: (0) - xyz. k4y0z.

I tried to plugin the usb to my computer and do ./flashboot-step.sh and it just mentions waiting for any device.

Is there any other steps I need to do?

Regards,
[Fire TV Original Android Development] Bertonumber1:
hacked fastboot screen....

Connect to your stick and inside terminal/CMD type:

sudo ./fastboot-step.sh

Your device will reboot to twrp

If not, try swapping cables/ports and running the command again.

Regards
[Fire TV Original Android Development] Bertonumber1:
You can't be shorting correctly, some SOCs differ on the board. But the exploit should still work if shorting properly.

Just make sure to use a piece of foil or thin wire and be sure it's connecting with the resistor/points securely.

Regards
[Fire TV Original Android Development] i_teach_it:
Thanks for the suggestion.. I swapped cables and port .. I was able to do everything without a hitch.. Root, Change Mac addr. , add apps, etc.

Regards,
[Fire TV Original Android Development] jorges4lu2:
Hi,

I have a Firestick 4K with the serial G4N0VM060... Is it vulnerable? I bought it December 2020.

Thanks in advance.
[Fire TV Original Android Development] Sus_i:
Most likely, but nobody knows. Try it...
[Fire TV Original Android Development] The shadow 5249:
I have trouble with the root image. After half hour using my firestick 4k i lost wifi signal and need to reboot for get it back. Any suggestion?
[Fire TV Original Android Development] turilo:
I'll have to try all this out on my useless 4k Firestick. It's the second gen early 2020 I believe. I'm assuming it being on latest updates wouldn't matter
[Fire TV Original Android Development] spaceguyy123:
Hi , After trying for 2 hrs, i was unable to get past initial handshake

My serial # is VM070494 , I Purchased last month itself

tried shorting all pins individually, keep getting the below error every time , please find below pictures

PLease help
[Fire TV Original Android Development] h1ghfrequencywavform:
I am having the same problem!

I bought two black Friday sticks. They were lost in the mail. They sent two more. Now I have four, they all arrived very late.

The two that were reported lost got blacklisted. I tested unlocking one of them prior to any wifi connections and it worked! It was very easy, but unfortunately this stick won't update and won't get past the initial checking for updates screen because of blackist....

To be clear, there is no alternate OS or way to skip amazon login and update check, correct?

So I moved to the two good sticks:

One is a VM190 and one is a VM180. I followed prior instructions of logging in, turning on ADB, debugging and allowing updates to procced. I then attempted exploit. I get the same error using all of the target ground points and can't proceed in the bootrom script. I believe this exploit has been blocked. They were received in December 2020.
[Fire TV Original Android Development] fabian19vs:
Please help! I have tried almost everything, followed all the steps until 9. Your device will now reboot into TWRP.

But keeps stuck on the BLACK fire tv logo loop, sometimes with a small text in the lower left corner saying: =>RECOVERY mode... but them boot again.

The TWRP never appeared. Even connecting a powered OTG with a mouse or a keyboard.

I tested the otg cable with a working fire tv stick and it is fine.

I tried older versions of the kamakiri-mantis...

'adb shell' gives: error : no devices /emulators found.

I haven't enabled adb in settings as I cannot access the device further than the boot logo.
[Fire TV Original Android Development] Sus_i:
Did you get some errors at the fastboot-step?

Unfortunately, there isn't a solution except a redo of the shorting/bootrom-step.

After the bootrom-step, try running this:

fastboot flash recovery bin/twrp.img

In case that works, run:

fastboot oem reboot-recovery

Could be wrong, but the initial update is maybe the culprit.

Back then it was fine to update as an initial step before doing the exploit...

Nowadays amaz. burn efuses in the SOC, which disable the bootrom access, to block the exploit...

So it could be a good idea to try the exploit before doing any updates. Only a guess...
[Fire TV Original Android Development] fabian19vs:
Thank you for the super fast answer!

No, there are not any errors at the fastboot-step. Says everything OK, I will try your suggestions tomorrow. That makes sense because once, I got stuck with a "Hacked fastboot mode" message on the black boot screen, and the only period of successful communication between the computer and the stick is between the boot room-step and the fastboot-step, after or before that, nothing.
[Fire TV Original Android Development] fabian19vs:
I tried and still stuck in the black boot loop, with the OTG connected with a mouse. The steps that you gave me worked, I think that means that it is possible to try something different between bootroom and fastboot steps. thank you again :)

[root@sysresccd ~/Downloads/kama/kamakiri-mantis-v1.2/kamakiri]# sudo ./bootrom-step.sh
[2021-02-17 05:25:13.712315] Waiting for bootrom
[2021-02-17 05:28:56.318761] Found port = /dev/ttyACM0
[2021-02-17 05:28:56.319322] Handshake
[2021-02-17 05:28:56.320030] Disable watchdog

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *

[2021-02-17 05:29:06.373196] Load payload from ../brom-payload/stage1/stage1.bin = 0x27C bytes
[2021-02-17 05:29:06.536401] Let's rock
[2021-02-17 05:29:06.542980] Waiting for stage 1 to come online...
[2021-02-17 05:29:06.545223] All good
[2021-02-17 05:29:06.545329] Load 2nd stage payload
[2021-02-17 05:29:06.545476] Load payload from ../brom-payload/stage2/stage2.bin = 0x36D4 bytes
[2021-02-17 05:29:06.545550] Send 2nd stage payload
[2021-02-17 05:29:06.569582] Party time
[2021-02-17 05:29:06.570910] Waiting for stage 2 to come online...
[2021-02-17 05:29:06.824510] All good
[2021-02-17 05:29:06.825576] Check GPT
[2021-02-17 05:29:06.952778] gpt_parsed = {'lk': (1024, 2048), 'tee1': (3072, 10240), 'tee2': (13312, 10240), 'boot': (23552, 32768), 'recovery': (56320, 32768), 'logo': (89088, 7168), 'kb': (96256, 2048), 'dkb': (98304, 2048), 'MISC': (100352, 2048), 'vendor': (102400, 307200), 'system': (409600, 2252800), 'cache': (2662400, 1048576), 'userdata': (3710976, 11558879), '': (0, 1)}
[2021-02-17 05:29:06.952904] Check boot0
[2021-02-17 05:29:06.993971] Check rpmb
[2021-02-17 05:29:07.198416] Clear preloader header
[4 / 4]
[2021-02-17 05:29:07.294839] Downgrade rpmb
[2021-02-17 05:29:07.296796] Recheck rpmb
[2021-02-17 05:29:08.175645] rpmb downgrade ok
[2021-02-17 05:29:08.176372] Flash tz
[7265 / 7265]
[2021-02-17 05:30:49.472999] Flash lk
[613 / 613]
[2021-02-17 05:30:58.077151] Flash lk-payload
[6 / 6]
[2021-02-17 05:30:58.203097] Inject microloader
[2 / 2]
[2021-02-17 05:30:58.348250] Force fastboot
[2021-02-17 05:30:58.441052] Flash preloader
[294 / 294]
[2021-02-17 05:31:07.739743] Reboot
[root@sysresccd ~/Downloads/kama/kamakiri-mantis-v1.2/kamakiri]# fastboot flash recovery bin/twrp.img
Sending 'recovery' (11592 KB) OKAY [ 0.530s]
Writing 'recovery' OKAY [ 0.715s]
Finished. Total time: 1.258s
[root@sysresccd ~/Downloads/kama/kamakiri-mantis-v1.2/kamakiri]# fastboot oem reboot-recovery
OKAY [ 0.002s]
Finished. Total time: 0.002s
[Fire TV Original Android Development] Sus_i:
The terminal output looks really good. It should work without a hitch.

I guess you did the reboot from fastboot with the fireISO connected?

Did you tried to run adb devices or adb shell, just after this reboot?

In case a TV was connected, what message showed down in the left corner?

Then you tried an OTG cable with a mouse? What power supply are you using? Are there any messages on the B/W logo?
[Fire TV Original Android Development] Sus_i:
Thats weird.

You can't boot fireOS, it boot loops always?

What happens if you boot with the orig cable and the orig power supply?

Did it boot to fireOS before you tried the unlock?

Do you know the fireOS version of the stick?

You can try to flash a boot image with fastboot.

You can format data, cache and dalvik with fastboot too, but idk if that will fix your issue.
[Fire TV Original Android Development] k4y0z:
Can't say I've seen this behavior before.

All I can imagine is issues with power-delivery or used display.

While all of this is true, please note, that fastboot won't automatically patch boot/recovery-images with microloader.
[Fire TV Original Android Development] adamoc9:
Hi, does anyone know what I am doing wrong?

Thanks in advance
[Fire TV Original Android Development] adamoc9:
getting the same, did you figure it out in the end?
[Fire TV Original Android Development] k4y0z:
See Post #1,221
[Fire TV Original Android Development] fabian19vs:
Thank you for the quick response! I've never seen that the device booted to fire OS, even before unlock. It was a gift, I knew that the device was having problems with boot, but I thought that following the procedure for kamakiri will fix it. As it never booted, I don't know which version of fireOS it has.

I don't have the original power adapter, only the original cable from Amazon. I am using one from a Ring device which output is: 5V - 1A 5W. I read that this meets the fire stick requirements.

How can I get a boot image to flash with fastboot? Can I get it from my other fire tv stick 4k?
[Fire TV Original Android Development] Sus_i:
I see^^

You can open up a stock update file with 7zip, in there is always a boot.img

https://d1s31zyz7dcc2d.cloudfront.net/fafaa562a37ab6b8dad1d31cd297185e/update-kindle-mantis-NS6276_user_2933_0004396381572.bin

You may redo the bootrom step until it reboots into fastboot.

Copy the boot.img out of a bin file into the kamakiri folder or to desktop and open a terminal over there.

Then run:

fastboot flash boot boot.img

fastboot format userdata

fastboot format cache

In case all that worked, run:

fastboot reboot

It will try to boot fireOS... watch out what happens on your TV.

The unlock and TWRP is gone now.

In case fireOS comes up, it could be that you see some issues, wifi, network, something like that... because the boot.img (kernel) doesn't match to the installed system image (as we don't know your OS version).

If you see the fireOS or the colorful bootlogo, you can try the unlock again.

If TWRP comes up, don't forget to flash the OTA bin file, renamed to .zip (flash the one you took the boot.img from) and magisk.zip