yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] hyperblu:
I'm fairly certain that if you run the script with power on and apply the short (if you get a reaction from the script telling you to remove it) your hardware is fine. Mine would run successfully whether or not I even had a short too, but it took actually supplying a short to actually get it to work.

---------- Post added at 01:07 PM ---------- Previous post was at 01:00 PM ----------

mine would start white and flash yellow, yes. When applying the short with script already running (until the light went out and stayed out) the light never came back on, despite successful scripts. Eventually one try, I ran the short with power on-script open, it told me to remove it, I did, it flashed, and my light came back on white then went to flashing yellow, but no twrp. That's when I pulled the power and USB. The light continued until I pulled the USB. That's why I was saying to pull the USB as it seems to keep it keep it stuck from rebooting to twrp.

---------- Post added at 01:33 PM ---------- Previous post was at 01:07 PM ----------

Mine was doing this... I could apply the short, apply power and it would tell me to remove it. If I applied power without a short, after about 45 seconds it would tell me to remove the short despite even applying one. All I can really say is keep trying and use various methods until it's successful. I lost my LED and thought it was ruined, so started shorting all kinds of points around the emmc (lol) and figured I'd finish it off that way (yet still recovered it shortly after that). Don't spend hours of frustration on it, just keep trying different things and hopefully you'll hit the jackpot on one.

---------- Post added at 01:40 PM ---------- Previous post was at 01:33 PM ----------

Replaying the events in my head, I would do this:

supply power, apply the short until light goes out... Run the script. IIRC, the white/yellow lights appeared after it said reboot to twrp, but never did actually reboot. At that point I unplugged power, LED stayed on until I unplugged USB. Connected power back and that's when I finally saw the twrp screen again. I honestly think the USB being plugged in when it said rebooting to twrp was actually hanging it up.
[Fire TV Original Android Development] Rortiz2:
Yellow light? lol, never heard about it:confused:

Anyway, it shouldn't be a preloader problem if you are saying that the script ran successfully. It first clears the header and the final step restores it, so preloader is here ;)

Try the USB suggestions. If still can't boot to TWRP sounds more like a HW problem.

Regards.
[Fire TV Original Android Development] genica:
Are you sure it's not orange? It may turn orange when you short. After it reboots if it stays orange is thought to be boot.img

Also power the box up without the hdmi cable plugged in to see if it changes to white
[Fire TV Original Android Development] hyperblu:
The script never successfully rebooted itself to twrp for me, even when it was successful in unbricking mine. I may intentionally re-brick mine and try to recreate some of these scenarios and see what seems to work and what doesn't and what/if the lights actually mean something by watching serial/ttl.

In my case, I flashed magisk from within fireOS, so depending on the scenario, the procedure to unbrick maybe different assuming different things were affected. Some people wiped /system, which I did not.

I'm starting to believe that the short to ground quality is pretty important and must be precise. We are dealing with tiny points to short out here. I really need to buy a lighted magnifying glass for this kind of stuff. Half of my problem is keeping my shorting tool still. This is surgical precision we are dealing with. ;)
[Fire TV Original Android Development] Sus_i:
:D

Haven't seen a yellow light too, until now. My box flashs white or in case of shorting the led is off.
[Fire TV Original Android Development] bogart1117:
i get this message if i dont release the short fast enough and hit enter.

ot@SucADicSpace:/home/bogart1117/amonet# sudo ./bootrom-step.sh

[2019-11-26 19:41:56.964310] Found ['preloader.img', 'boot.img', 'unbrick.img', 'tz.img', 'lk.img'] to flash

[2019-11-26 19:41:57.941412] Waiting for bootrom

[2019-11-26 19:43:35.590749] Found port = /dev/ttyACM0

[2019-11-26 19:43:35.592746] Handshake

[2019-11-26 19:43:35.596727] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-11-26 19:43:41.569473] Init crypto engine

Traceback (most recent call last):

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 537, in write

n = os.write(self.fd, d)

OSError: [Errno 5] Input/output error

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "main.py", line 158, in <module>

main()

File "main.py", line 95, in main

load_payload(dev, "../brom-payload/build/payload.bin")

File "/home/bogart1117/amonet/modules/load_payload.py", line 112, in load_payload

init(dev)

File "/home/bogart1117/amonet/modules/load_payload.py", line 9, in init

dev.write32(CRYPTO_BASE + 0x0C0C, 0)

File "/home/bogart1117/amonet/modules/common.py", line 141, in write32

self.dev.write(b'\xd4')

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 571, in write

raise SerialException('write failed: {}'.format(e))

serial.serialutil.SerialException: write failed: [Errno 5] Input/output error

im not a linux person, i just run dual-boot on two laptops so im flexible.
[Fire TV Original Android Development] hyperblu:
Technically, the emmc is an SD card, but booting from the external one, probably not. Have you tried using different tools/grounding locations to create a short with? I swear, for some reason, hardware rooting these fire TV devices it seems the scripts will appear to run as normal, but always have issues. I'll switch it up with a different tool or hit another grounding area and PRESTO!

Have you tried grounding DAT0 until the light goes out (if it can), THEN running the script? Next time you get a successful flash, but no reboot, what's the light doing? Does unplugging USB allow it to reboot?

---------- Post added at 06:49 AM ---------- Previous post was at 06:42 AM ----------

Also, not sure if it makes a difference, but I noticed you're using the sudo ./bootrom-step.sh command while already in root shell. When you're in the terminal and you see the "#" you're running commands with root privlege already so "sudo" isn't really necessary. That's only if you're in a non-sudo shell and want to run a command under root.

Maybe try just ./bootrom-step.sh and see how that goes?

Also, try a different A-to-A cable if you have one, try switching between USB 2.0 and USB 3.0 ports.
[Fire TV Original Android Development] genica:
The fact nobody has posted about a yellow led, he may have hardware issues. Has anybody tried to short while the script is running without the power supply hooked up? Just the usb attached

You should always use soft wire when shorting out a resistor, meaning breaded
[Fire TV Original Android Development] Rortiz2:
If the script doesn't throw any error, it's OK;)

I'm starting thinking it's a hardware problem, because I insist, never saw that "yellow" light...

Doing a quick search at google found that some people had yellow light and the device came irresponsible during 15 mins or so, so it kinda looks like a HW problem.

Regards.
[Fire TV Original Android Development] bogart1117:
I haven't a clue on the way the commands entered/issued. But I see the possibilities in changing that part.

I'm working with only 2.0 jacks so not much to change in that area. I could try to run the script with only a USB connected.

I think that idea about "sudo" being in the command might have potential though.

Read somewhere on using what's basically a boot microsd card to salvage VZW S3's. They stated that android runs off similar procedures of going through boot options. Firestick is AOSP oriented so didn't know if that was viable.

After my first successful flash, when it never rebooted, I haven't seen but one light(Yellow) 5 hours later, and I only saw that the one time. While the light was on I tried differemt ideas before disabling all connections to power it down. I checked any possible connections thru ADB and FASTBOOT, on both Linux and Windows command line. I dont think the drivers on my Linux are up to date but it ran the script so it's good enough. I plugged in the ethernet and eventually plugged in the HDMI. The Yellow light persisted in staying on, no stutters or any other signs of life. So out of ideas I finally killed the power. No lights came on when I reconnected power and haven't since.

But, it sparks sometimes when i have everything hooked up to try and run the script again. Seeing that seems to say software problem. The boards live, and doesn't the script require an active server so it can give the commands.
[Fire TV Original Android Development] Sus_i:
Can you post a good quality picture from the area you shorting?

If you damaged something in that area, the flashed data could be corrupt, although the script runs thru without errors.
[Fire TV Original Android Development] romolac:
Hello, hoping I could get some help with my fire tv please.

I messed up with a factory reset and the box got stuck on the white amazon logo with flashing white light, so I'm now trying to debrick it.

For starters my box has a Samsung chip in it (KLM8G1WEPD) and not the Toshiba one in the picture, I don't know if this makes any difference?

I thought I had found the BootROM point, but in hind sight I don't think I did.

The script completes but doesn't boot into TWRP. And currently my box won't boot at all, with no light flashing and nothing on HDMI.

A strange issue I'm getting is that I can run the script and then power on the box and the script will run. Also if I plug in the box, then run the script, it seems to periodically find BootROM. The script will also run if I simply unplug and plug the usb.

It also ignores the short, if I keep any of the pins shorted the script will continue without complaint. However if I short a pin part way through it will fail?

I've also tried running the other debrick script and recovery installer and they both get stuck at "Reading 000000200: 0%" on both windows and linux.

Any help would be appreciated.
[Fire TV Original Android Development] Sus_i:
No difference at all

The working point is mentioned with picture in the OP.

Could be two issues. You may just read a few posts back or try it again with that version
[Fire TV Original Android Development] romolac:
Thankyou very much, I used v2.0 and its all working fine now.
[Fire TV Original Android Development] bogart1117:
This S10e better put up a good picture.

So i survived the week, thus far.

Haven't been home till now and my cousin messed with it , so it seems. I will say i started with the recommended safety pin, so this damage could be mostly my fault.

Or, through blame shifting, I'll avoid any guilt by stating that amazon sold me some sh***y dat0 chippy thingy's.

Either way I'm here making the salvage attempt begin. I just wanted to get something posted.

Here's a pics.

and let me state again, with added emphasis, "WHEN THAT FLASH HAPPENED AND THE YELLOW LIGHT CAME ON, THERE HAS

NOT

BEEN

ANY

LED LIGHTS." "NONE."

p.s. Had no clue about this v2.0 flashscript. So potential???
[Fire TV Original Android Development] Sus_i:
Looks a bit scratchy but at least the resistor isn't gone ;)

Please try the v2.0 script and report back...
[Fire TV Original Android Development] bogart1117:
Wasn't a hardware problem...

Script ran pretty normal like:

sudo] password for bogart1117:

[2019-12-02 01:58:36.336829] Waiting for bootrom

[2019-12-02 01:58:43.124411] Found port = /dev/ttyACM0

[2019-12-02 01:58:43.125057] Handshake

[2019-12-02 01:58:43.125636] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-12-02 01:58:45.335936] Init crypto engine

[2019-12-02 01:58:45.357760] Disable caches

[2019-12-02 01:58:45.358212] Disable bootrom range checks

[2019-12-02 01:58:45.372559] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes

[2019-12-02 01:58:45.377882] Send payload

[2019-12-02 01:58:45.963636] Let's rock

[2019-12-02 01:58:45.964339] Wait for the payload to come online...

[2019-12-02 01:58:49.525193] all good

[2019-12-02 01:58:49.525629] Check GPT

[2019-12-02 01:58:50.797009] gpt_parsed = {'PRO_INFO': (1024, 254), 'NVRAM': (2048, 10240), 'TEE1': (12288, 10240), 'TEE2': (22528, 10240), 'lk': (32768, 2048), 'boot': (34816, 51200), 'recovery': (86016, 51200), 'KB': (137216, 2048), 'DKB': (139264, 2048), 'MISC': (141312, 1024), 'LOGO': (142336, 16384), 'EXPDB': (158720, 23296), 'system': (182016, 2477600), 'cache': (2659616, 512000), 'userdata': (3171616, 12098239), '': (0, 1)}

[2019-12-02 01:58:50.797285] Check boot0

[2019-12-02 01:58:51.983891] Check rpmb

[2019-12-02 01:58:52.189368] Downgrade rpmb

[2019-12-02 01:58:52.191451] Flashing preloader..

[319 / 319]

[2019-12-02 01:58:58.968276] Flashing TEE..

[3725 / 3725]

[2019-12-02 01:59:54.479506] Flashing bootloader..

[806 / 806]

[2019-12-02 02:00:07.472592] Flashing unbrick image..

[8956 / 8956]

[2019-12-02 02:02:20.710810] Flashing boot..

[31252 / 31252]

[2019-12-02 02:10:02.057099] Reboot to TWRP..

IT WORKED.

So I used the same cable cause in the end it's the only one for he job. i switched to a 4in cable with 8-10 wires ran in it and twisted one end to a ground and whittled the other end down to three little wires and used that to ground with. I was careful, slow, and pretty precise in placement, even practiced the motion while it was unplugged. Only other to mention is I unplugged the usb after the script finished. I used one hand and wasn't quick. I say this cause I had the TV plugged in to and my peripherals seemed to catch the blue screen light to twrp as i disconnected the usb. there was a good 1-1 1/2 secs I tried to disconnect, maybe even 2 secs.

Now to find what to flash. Hope they start with the 2.0 version whatever I find.
[Fire TV Original Android Development] Sus_i:
Congratulations ;)

You can grab one of the prerooted roms from rbox, thread is here.

Rbox writes in the thread 'you MUST flash 5.2.6.7 before going to the latest'. Don't know why, haven't looked into it, I guess it's a TWRP update, idk.
[Fire TV Original Android Development] Rortiz2:
Hi all,

I want to say sorry for the problems that you guys had....

I think my friend [MENTION=5213625]Sus_i[/MENTION] found the solution to the problem;)

As he said, in "V2.0" (old one) Preloader was flashed in first step so there was no problem.

Sadly, when I implemented (borrowed from k4y0z xD) the option that cleans the Preloader at first step and the flashes it at last one, ****ed up the things.

With Sus_i's suggestion, I applied a commit that waits 5 seconds before reboot to allow data to be flushed to EMMC (also from k4y0z script) to see if this helps.

Just wanted to say that. Sorry for inconvenience caused.

Best regards.
[Fire TV Original Android Development] bogart1117:
Yeah, I'm snooping through there

Why would I wanna rollback to older versions of of the OS? How far back in FireOS would I wanna go?
[Fire TV Original Android Development] Sus_i:
First 5.2.6.7, then 5.2.7.1

As I said, I don't know why rbox mentioned this. I guess something gets updated with 5.2.6.7... something special that isn't included in the latest ;)
[Fire TV Original Android Development] Rortiz2:
Just a FYI, I updated the script to force recovery (no boot menu, directly booting to twrp) at reboot by using a cache flag.

If your unbrick succeeds but after reboot, you get a blank screen, unplug it and plug it again, it should boot at TWRP in second time.

Regards.
[Fire TV Original Android Development] No3ight:
You made my day!

Hey Rortiz2,

wanted to say thanks to you. Looked around and found some thing how to root the FTV. Nothing worked only your thread gave me hope to get root access. Thanks a lot for your work.

Greetings from Germany.

No3ight :D
[Fire TV Original Android Development] Lochy19:
Working just fine! I missed this device! Thanks!
[Fire TV Original Android Development] genica:
Copy the command "sudo ./bootrom-step.sh" to avoid typing it each time. Run the script and short the resistor horizontal from the dat1, dat2 side. Usually works within 5 tries. Don't short it vertical and use a soft wire is the best way I found
[Fire TV Original Android Development] Rortiz2:
[MENTION=7104332]k4y0z[/MENTION] I need your help :/

I know you're pretty busy so sorry for this ping. If you don't have time to help me no worries, just ignore the ping:)

Anyway, we done some deeper tests with RPMB. I finally uploaded a working source code of brom-payload with a working load_addr (yes, in linker.x aswell) based on suez's payload. Anyway, still not downgrading anything:(

I guess the problem is in mmc.c exactly on this line: https://github.com/chaosmaster/amonet/blob/mt8173-suez/brom-payload/drivers/mmc.c#L907

I just want to know what exactly I need to edit to make this thing work. I have a dump of the bootrom if you need it.

Regards, and thanks in advance.
[Fire TV Original Android Development] Owningle:
Hello, after a while of trying, I got it to work, but when it booted into twrp, I got this.

https://imgur.com/kMayh5O

It works, can I can interact with it, but I cannot tell what I am clicking. Any ideas?

BTW, I haven't unlocked the bootloader, I don't know if you need to do that for this device. Is it possible to unlock the bootloader?
[Fire TV Original Android Development] Rortiz2:
Looks more like a hardware issue or cable issue. Try changing the HDMI cable or the HDMI port. And no, there's no method to unlock the bootloader on sloane atm.

Regards.
[Fire TV Original Android Development] Owningle:
Not a hardware issue, managed to install a pre rooted rom via guesswork of where buttons are, and it booted fine
[Fire TV Original Android Development] Rortiz2:
Oh ok.. So not sure what went wrong here:confused:

Anyway, congrats for you unbricked sloane:)

Regards.
[Fire TV Original Android Development] k4y0z:
Not sure what you mean with working code for brom-payload, the suez-code should work without modifications besides RPMB downgrade.

If RPMB downgrade doesn't work, it's likely due to RPMB-key derivation working differently on sloane (although that's a bit odd, since it works the same way on all other Fire devices).

You'd have to analyze how RPMB-key derivation is implemented in preloader. Not sure I can be much help with that.

TWRP handles video-output a bit differently so it may still be an incompatibility with your TV.

You can try if it does the same thing when connected to a different TV.
[Fire TV Original Android Development] Rortiz2:
Thanks for the response. Very appreciated.

With working brom-payload, I mean, suez's payload without edit anything fails... Yeah sounds weird but I'm saying the truth. I've got it to work by changing load_addr in load_payload.py and linker.x (As I've done with my BQ Aquaris M8 that finally got amonet working :o). Basically I just wanted to inform you that I'm using same code as suez with just with one edit in linker.x. Sorry if sounds confusing.

Yes, I can confirm RPMB-key derivation it's different, It always prints the same RPMB, even after the "clean RPMB step". Will look at what you said.

Thanks you!

Regards.
[Fire TV Original Android Development] Owningle:
Tried another TV, still same issue.
[Fire TV Original Android Development] bogart1117:
gpt

So...

Got this problem that happened back in Nov when I posted asking for help in this thread. Shortly thereafter I think I remember I powered off in recovery during a process(yes, you can put the word flash in front of process) But I figured "Hey, I'll unbrick whatever happens.

"F*** IT"

bogart1117@sUCadICspace:~/Downloads/sloane_unbrick_v2.0/amonet-mt8173-sloane$ sudo ./bootrom-step.sh

[2020-01-15 05:51:10.934742] Waiting for bootrom

[2020-01-15 05:51:35.032242] Found port = /dev/ttyACM0

[2020-01-15 05:51:35.034235] Handshake

[2020-01-15 05:51:35.038221] Disable watchdog

* * * Remove the short and press Enter * * *

[2020-01-15 05:51:36.294984] Init crypto engine

[2020-01-15 05:51:36.534196] Disable caches

[2020-01-15 05:51:36.538191] Disable bootrom range checks

[2020-01-15 05:51:36.669314] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes

[2020-01-15 05:51:36.672799] Send payload

[2020-01-15 05:51:41.207208] Let's rock

[2020-01-15 05:51:41.212239] Wait for the payload to come online...

[2020-01-15 05:51:44.773288] all good

[2020-01-15 05:51:44.773593] Check GPT

Traceback (most recent call last):

File "main.py", line 116, in <module>

main()

File "main.py", line 62, in main

switch_user(dev)

File "main.py", line 36, in switch_user

raise RuntimeError("what's wrong with your GPT?")

RuntimeError: what's wrong with your GPT?

That was the fireTV's response. I will say I got the short on the first try. Whoop Whoop.

I then switched to the 2nd gen FireStick (tank) and was successful, until I had the same thing occur on the 2nd FireStick I attempted. At that time I decided to put in study time and in the end I found the (tank) thread with these gpt related posts.

Thread: https://xdaforums.com/fire-tv/development/unlock-fire-tv-stick-2nd-gen-tank-t3907002/post79056952

Post:103

They had a zip and it showed this gpt who was boss.

So... Is there a sloane variant? That, or how can I mess it up more? Learning curve, right?

Roritz2, you's got any idea's?

Thanx Sus_i
[Fire TV Original Android Development] Rortiz2:
Yeah your GPT somehow looks corrupted. I'm sorry but I didn't had time today to add the GPT fix. I will add it tomorrow.

Regards.

Enviat des del meu Aquaris X5 Plus usant Tapatalk
[Fire TV Original Android Development] Rortiz2:
[MENTION=9745598]bogart1117[/MENTION] [MENTION=5213625]Sus_i[/MENTION] or whoever is interested in the gpt fix.

I updated it.

Download amonet from first post and run:

sudo ./gpt-fix.sh

Will reflash gpt and other partitions aswell.

Regards.
[Fire TV Original Android Development] Rortiz2:
duplicate
[Fire TV Original Android Development] schybiorz:
Wow. Perfect. Cause I got this problem as well due to a software update abort.

Is it also possible to directly flash a promoted rom via unbrick method?

Will try when I got home
[Fire TV Original Android Development] brick00444:
Is there a way to run the gpt fix from twrp? I can't seem to get it to flash from amonet. I get an error "raise RuntimeError(ERROR: Serial protocol mismatch")

RuntimeError: ERROR: Serial protocol mismatch.

I will keep trying to get it to go. Maybe the error is because of jumping the points wrong?
[Fire TV Original Android Development] k4y0z:
Why do you want to run the gpt-fix?

If you can load TWRP your gpt isn't broken.
[Fire TV Original Android Development] Rortiz2:
What is the point of flash a prerooted rom via amonet?

I mean, you guys have TWRP after the unbrick. Does install a ROM via TWRP is difficult?

Not sure why all people is having problems with TWRP.

Anyway, is not a good idea, bootROM rw speed isn't pretty fast so flash a system image would take a lot of time.

Regards.
[Fire TV Original Android Development] brick00444:
To be honest, I'm trying to recover a sloane box that gets to twrp then I flash one of rbox's roms and when I reboot it shows the black fire tv screen then goes black screen and nothing else. So I guess I'm grasping for straws.
[Fire TV Original Android Development] Rortiz2:
You should check HDMI cable or the TV.

Also, you can check if lsusb detects the device while you see that "Black Screen".

Same happens with LineageOS?

Regards.
[Fire TV Original Android Development] brick00444:
Checked HDMI cable, it shows it booting to rbox's twrp screen then black fire tv screen then black screen. Tried lsusb and it does not show the device. And yes the same with LineageOS
[Fire TV Original Android Development] schybiorz:
I know how to usw twrp. I only Gott tue Problem that at first i got no screen. But after another try it's now booting to twrp and flashed prerooted with success.

Superb. Thanks for all your useful stuff and findings in your freetime.

FireTV is back to live