yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] mozgoeb:
Hi!

Need help of the community.

The fire tv worked for a week after rooting. It was new - rooted out of the box. And at some point it stopped turning on. If you connect the player under Windows, it finds a 'new device' every 20 seconds (It looks like the player is in bootloop.). If you boot into Linux, run the script (bootrom-step.sh), short the capacitor, release the short, hit 'enter' the result will be the eror:

Spoiler content hidden.

I read the first 30 pages of this thread and understood that it's an emcc related error. But I don't understand how it could happened and how to solve the problem? Is the stick completely bricked or is there a chance to fix it?
[Fire TV Original Android Development] luciferin:
Most likey just means you did not properly apply the short. Try repositioning the jumper (tin foil) and try again. It can be difficult to seat it properly and takes a few tries.
[Fire TV Original Android Development] Sus_i:
Connect it to the fireISO, then watch out in lsusb, what devices show up?

If you short the stick without a running bootrom-script, the device should show up as mtk phone and it should stay in there, until you remove the short. Is this the case and if yes, what boot stages are next? I.e. phone -> preloader -> ... ?

In case you short at CLK/CMD points from the OP picture, make sure to short the opposite component side, i.e. the side without the red circle markings. FYI @techville
[Fire TV Original Android Development] mozgoeb:
Fist of all thanks for reply! I have shorted the left pin of 4th (from left) capacitor with the shield.

Spoiler content hidden.

Just like I did it before on three other 4K sticks and on this one at the moment when I was rooting it.

ОК! I'll provide the output as soon as return to home.

In case I run bootrom-script (with short) the script stops at the middle of 2nd stage (while checking GPT):

Spoiler content hidden.
[Fire TV Original Android Development] Sus_i:
(y)

Thats fine. Short both sides together will work too.

You can try a fix for the gpt with the gpt-fix from here.

Extract the two files in the kamakiri folder, make sure that the gpt-mantis.bin file goes to the bin folder... then run:

./gpt-fix.sh instead of the bootrom-step (ofc with shorting).
[Fire TV Original Android Development] mozgoeb:
Thanx for the "recipe". =) I will also post the result.
[Fire TV Original Android Development] k4y0z:
This error typically indicates hardware-damage, likely at the location used for shorting (broken traces, missing components), missing components can sometimes be fixed by bridging the gap.

If the bootrom-step asks you to remove the short even when you run it without a short, that may be another indicator for hardware-damage.

the gpt-fix is unlikely to work in this situation, where it doesn't even read the GPT from EMMC.
[Fire TV Original Android Development] mozgoeb:
After the rooting, the stick was inserted into the TV (and was powered by TV's USB port). It worked absolutely fine for about a week. And then it just stopped turning on. =(

It was indeed! =) At some iteration during "resuscitation" attempt, I broke off the 4th capacitor. After that, I simply short-circuited capacitor's pad to the shield, so that the script can run. And after the script suggested removing the jumper, I tried to close the two contact pads. But there was no result.

Then I went to the professionals with a soldering station and a microscope. =))) They said that I physically damaged the capacitor (yes i was able to find a 0.8x1 mm item on my desk) аnd therefore they had to replace it with a "donor". But they honestly said that the "donor" was removed from some phone and they have no idea what was it's nominal value. Something like: "believe me, friend, all capacitors of this size are the same!" =))))

As a result, I returned exactly to the point when the stick stopped turning on.

This is the story. I guess it was probably a factory defect (for example with hynix chip). But for obvious reasons, it's pointless to return the stick to Amazon. So I want to try to fix it before throwing away...
[Fire TV Original Android Development] Sus_i:
What 4th capacitor do you mean? The one marked as 'CLK?' at the OP picture?
[Fire TV Original Android Development] k4y0z:
A missing resistor may be replaced with a bridge.

A capacitor cannot be replaced with a bridge and should either be replaced or left off completely.

The caps are used for filtering and it may or may not work without it.
[Fire TV Original Android Development] mozgoeb:
Nope. Next one. Marked blue at my fist post.

It was replaced with another one. But with unknown capacitance. May be less then 0.1 uF...
[Fire TV Original Android Development] Sus_i:
Try a 0.1uF
[Fire TV Original Android Development] mozgoeb:
I have neither the microscope, nor the required capacitor, nor the skill to solder parts of this size. =) So I need to buy a capacitor. And I need to call in for repairs again. Time is money. The main thing is to stop in time and not spend more money than a new one's cost. =)))
[Fire TV Original Android Development] Sus_i:
Then try the 'left off' first^^
[Fire TV Original Android Development] mozgoeb:
I read about 12th page of this thread that in some cases everything can work without a cap. And before "I went to the guys with a microscope and a soldering station", I tried (after the moment when the script asked to to release the short and hit enter) both to close the contacts and to leave them open. With no luck in both cases. =(
[Fire TV Original Android Development] Sus_i:
Forget about it, I guess the cap isn't the issue.

Best is if you return the faulty crap to Jeff, asking for a replacement. ;) :p
[Fire TV Original Android Development] Sus_i:
I exaggerated that a bit :p

The emmc isn't permanently shorted, as you can see on your picture. But if that thing goes without a short into bootrom, I think it's at least very unstable.

You may replace that missing mlc and run the two scripts again. I bet that is your solution.

---------- Post added at 10:53 PM ---------- Previous post was at 10:32 PM ----------

Yes, that is ok. The power you measure comes from the internal emmc and requires a mlc at this point and is used by the internal voltage regulator, that supplys the emmc controller. The resistance to ground that you measure at this point, is from inside the emmc, i.e. you're measure the voltage regulator in the emmc.
[Fire TV Original Android Development] hyperblu:
Sent donation. Great job! ?
[Fire TV Original Android Development] el_smurfo:
Does it make sense that this script would work on a Fire TV 4K pendant if I can get it into the bootloader mode? I assume the hardware is pretty similar inside, but perhaps not? I have a blacklisted one that's been taking up space in my closet and I could probably scope out the EMMC signals...
[Fire TV Original Android Development] extrem0:
I also ended up toring the same capacitor off and it's still working. Even without the capacitor it was very hard to short and make the script works (I could do it shorting CLK to GND).

There's probably another place in the board where it's shorting.

I don't think so. They are different. The fire tv 4k pendant has an Amlogic S905 SOC while the stick 4k has a MTK8695.
[Fire TV Original Android Development] hyperblu:
Just an FYI, I was able to short DAT0 no problem. I used tweezers to bend the shield back, use kids fingernail clippers to trim the shield back, and a straight pick tool to touch DAT0 pin to the shield and plugged in the USB to the laptop. I used my phone camera with flashlight on set to macro mode to be able to see the spot.
[Fire TV Original Android Development] hyperblu:
It also downloaded an update immediately after and occasionally would boot loop. I let it finish the update and going to see if it continues to crash. Hopefully rbox will have a prerooted rom soon.

Edit: still rebooting after a few minutes of netflix. I think the twrp preloader lock is conflicting with the partial update that downloaded immediately after running the exploit.
[Fire TV Original Android Development] kigba:
In that and the depths of the depths ... On the one hand, the behavior of emmc indicates a constant short circuit. On the other hand, examination of the board and measurements of the accident site at the capacitor do not show this circuit. And there are also confirmed cases when the stick works normally without this reference capacitor. But I do not give up, I will try to restore the scheme. And another question - can the fact that this stick was flashed right out of the box affect my situation? It was new and never connected to the TV at all. Perhaps he had a completely old, non-updated firmware version and the unlock exploit did not work correctly? Perhaps more recent firmware is required for a successful unlock?
[Fire TV Original Android Development] rbox:
I hope to have a ROM up this weekend.
[Fire TV Original Android Development] Kramar111:
[MENTION=3991724]rbox[/MENTION]

Thank you for all you work with Amazon devices

Can i kindly ask you repack/update TWRP for Stick 4K with mouse emulator like for Fire TV 2 Gen?

Its very usefull and maybe integrate it into kamakiri?
[Fire TV Original Android Development] Sus_i:
Can't believe that so many people rip off components.

That shorting procedere is really easy, please don't use sharp tools, no steel or something like that.

A small snippet of tinfoil, maybe two or three times pleated, does the job fine. Simply shove it carefully about a millimeter under the heatshield, goal is to short one of the components right by the edge of the shield. Please use no pressure at all, don't force it... the slightest short will work.

I made a picture for better understanding:
[Fire TV Original Android Development] kigba:
Today I completely restored the iron to the fire stick. But this did not solve the problem. The preloader remains open for firmware. I will assume that there is a place for a software failure during unlock. The stick was right out of the box on its first Amazon firmware. Perhaps the exploit did not work correctly on the old, very first bootloader. I ran out of ideas ...

[IMG="stik-3"]https://s8.hostingkartinok.com/uploads/images/2019/10/f8f9824b3cbec24feb6a8a035c0257c1.jpg[/IMG]
[Fire TV Original Android Development] k4y0z:
As I have told you previously, the script flashes the bootloader.

Also have you tried powering it using a power brick instead of through your computers USB as I have suggested earlier?

You could try attaching a serial console at 115200 baud and see if the bootrom tells you any reason for not loading the preloader.
[Fire TV Original Android Development] Sus_i:
I'm curious, have you shorted a point or runs the script like yesterday without a short?

The script runs up to the reboot, in the picture from yesterday it stops at the preloader thing.

I would try to run the second script again, you may plug your stick in multiple times until it finds the stick.

You can try to run adb devices.

If the fastboot script doesn't find the stick, start the first script and look if that thing goes always into bootrom without a short.
[Fire TV Original Android Development] k4y0z:
Good eye, I didn't even notice, that the script didn't finish earlier.

Of course if it didn't properly flash the preloader, then it can't load the preloader.
[Fire TV Original Android Development] kigba:
have not tried with additional nutrition. Here you will need an otg cable, which I do not have. I'll try to do it later. I probably will not be able to check through uart or I need to give the fire stick to more competent specialists :(
[Fire TV Original Android Development] k4y0z:
No need for an OTG.

Just plug it into HDMI and power it using a power brick and watch if it boots into hacked fastboot.
[Fire TV Original Android Development] kigba:
no. It doesn’t load in twrp. It should not, because I can’t complete the second step to install tvrp - the console says that there is no device. This is visible in my photos. Repeated attempts to complete the second step are futile. Only the first script is executed, and always when the USB cable is connected, without any short circuits. The bootloader is always "open" :( It would be nice to try the reverse procedure of "closing" the bootloader, but you do not have such a scenario :(
[Fire TV Original Android Development] k4y0z:
I didn't ask if it loads TWRP, but if it loads "HACKED FASTBOOT".

But since you are saying it still goes into bootrom without shorting it wouldn't.

I will tell you again, if it goes straight into bootrom, that means it doesn't even load the preloader,

there is no such thing as closing the bootloader that would help in this case.
[Fire TV Original Android Development] a5538544:
Thank you very much for everything you've done.

May I ask a question? Can Major Update affect root ? ...I mean Fire OS 7.
[Fire TV Original Android Development] Jesstr8803:
NTFS file useage

Just FYI,

I rooted my FireStick 4K, which was already updated to the latest FireOS, following these fine instructions on the top of this forum! (Many many many Thanks! :o) A little trick I did for shorting the pin and not having to "cut" away any of the shielding was to take a pin and stick it between the two capacitors that are right next to each other, slightly underneath the shielding, then angle the pin so that it touched the shield at the same time (which would be GND). Worked like a charm!

[IMG="Short Point"]https://i.imgur.com/iuNtICR.png[/IMG]

[IMG="Shorted to shield"]https://i.imgur.com/tiIksV9.jpg[/IMG]

[IMG="Another view"]https://i.imgur.com/6HLiK8r.jpg[/IMG]

After I had completed installing TWRP, I used ADB and transferred and install Magisk 19.4 Zip ( from Magisk.me). Once that was completed I used ADB to install the Magisk Manager APK. Booted everything up and worked like a hot damn.

My final step was to get the system to notice and use NTFS file systems. Using ADB I looked through some of the files on the FireStick, trying to see if I could find some script which was launched when a USB stick was inserted into the OTG cable and how the OS was handling it. I gave up quickly. Haha. If anyone knows what files/code that the FireOS uses for checking and mounting external USB drive please let me know. Instead I used ADB and installed StickMount 3.5, which works perfectly.

In summary,

I was easily able to root ( Thank you, [MENTION=295159]xyz[/MENTION] [MENTION=7104332]k4y0z[/MENTION]), install Magisk, Install StickMount, and now I can mount NTFS, and watch my own files greater that 4GB on Kodi!

Thank you!
[Fire TV Original Android Development] mozgoeb:
lusb output without short:

Spoiler content hidden.

lusb output with short:

Spoiler content hidden.

And gpt-fix execution (no)result:

Spoiler content hidden.

I think from my level of English it is clear that I am not from the USA. To be precise, I am exactly from the opposite side of the Globe. =) So sending the player back to Uncle Jeff doesn't make any economic sense.

Sus_i, k4y0z thank you for your willingness to help and the time spent on me. =)

🎚Amazon TV stick. 2020/12/06-2020/12/21 R.I.P🎚
[Fire TV Original Android Development] Timmons:
Hello. Does factory reset work in TWRP appropriately? I want to refresh my now rooted fire stick 4k but don't want to lose root or twrp
[Fire TV Original Android Development] elektroplax:
A few weeks ago I bought a FireTV Stick 4k from Amazon (Germany).

Now I wanted to root it, but I can't get it to work. I did everything in the right order and think I have made the short correctly. The stick's firmware version is 6.2.7.6.

Unfortunately I always get this error ("dat" is just a placeholder for date and time):

[ 1297.603086] cdc_acm 11-1:1.0: Zero length descriptor references
[dat] Found port = /dev/ttyACM0
[dat] Handshake
[dat] Disable watchdog
Traceback (most recent call last):
File "main.py", line 119, in <module>
main(dev)
File "main.py", line 24, in main
load_payload(dev)
File "/root/kamakiri/modules/load_payload.py", line 47, in load_payload
dev.write32(0x1000070000, 0x22000000)
File "/root/kamakiri/modules/common.py", line 147, in write32
self.check(self.dev.read(2), b’\x00\x01’) # arg check
File "/root/kamakiri/modules/common.py", line 84, in check
raise RuntimeError("ERRROR: Serial protocol mismatch, expected {} got {}]".format(gold.hex(),.....
RuntimeError: ERROR: Serial protocol mismatch, expected 0001 got 0000

Is the firmware not compatible?
[Fire TV Original Android Development] Timmons:
Mine was on newest version. You have to try the short again until it works. I put a very little playdough over the foil to get it to stick the video recommends something else bluetack? but with my toddler playdough was more easily available. Playdough probably worst thing to use in the world heh.
[Fire TV Original Android Development] elektroplax:
Nope, not working. I even removed some of the shielding, so I could reach the DAT0 easier. There is definitely a short, but I always get the aforementioned error.
[Fire TV Original Android Development] Sus_i:
There are some reports that new sticks from Amaz. are BROM patched (probably via eFuse), so the exploit in OP wont work.

Quick check, run lsusb when shorted:

If you see preloader, the short isn't proper.

If you see nothing (no phone or preloader message), the stick is patched.
[Fire TV Original Android Development] elektroplax:
The short has to be proper because I even soldered it. lsusb shows me:

Bus 011 Device 005: ID 0e8d:2000 MediaTek Inc. MT65xxx Preloader
[Fire TV Original Android Development] Sus_i:
If you see mediatek phone, the stick is vulnerable.

If you see preloader, the stick isn't shorted correct, i.e. the BROM loads the preloader from the eMMC, that shouldn't be possible when shorted ;)

If you try to short CLK/CMD marked points from the OP picture, make sure that you short the side that isn't marked with a circle... or simply bridge both sides of a cap.
[Fire TV Original Android Development] elektroplax:
Thanks. I will try bridging the cap sides.
[Fire TV Original Android Development] tien99:
I received the stick a few days ago. I set it up and then tried to flash it but got the exact behavior as you described - SOL
[Fire TV Original Android Development] Bertonumber1:
It would appear production of the July/August onwards Editions of 2020 4K Mantis are patched , ive went through a few of them and the ones from those times until today present dont show up on lsusb. No response at all .

Ive bought numerous brand new ones on sale at 30 quid a piece directly from big A and they all seem to behave in the same manner as the patched Tank 2nd generstions of October/December 2019.
[Fire TV Original Android Development] elektroplax:
@Sus_i

I tried everything, from bridging the caps to connecting the caps with GND to connecting the small DAT0 point with GND. I tried it with pins, various wires and even soldering. Nothing works.

By the way: I broke off the 4th cap (from the left) in the process, but the stick is still working. :)

If just plug the stick into a USB port without shorting, lsusb tells me there's a "MediaTek Inc. MT65xxx Preloader" connected.

If the HDMI output is also connected to my TV, lsusb tells me it's "Lab126, Inc. AFTMM".

If I short it, and it 1000% is shorted, the script just does nothing and stays at "waiting for bootrom".

Any advice on how I could still root it?
[Fire TV Original Android Development] I_CRAFT:
Maybe you also have bad luck with the 4K Stick, like some of us.

Because this is the same behavior I've seen on my Stick and @Bertonumber1 told us in the post above yous that this effects many devices build after August this year.
[Fire TV Original Android Development] Bertonumber1:
Yup :cool: all thats needed to do the short successfully is a thin piece of folded aluminum foil or a thin piece of copper wire , nothing heavy.

Ive messed a few clks in my time :D soldering is not required unless you are repairing a broken resistor, reseating one or bridging gap of missing ceramic due to excessive digging for oil lol

I think @Sus_i called it a few posts up , patched BROM 110%

Buy a 2019 model from ebay to be sure you have one that can be modified .
[Fire TV Original Android Development] Sus_i:
Yes, that is ok and fine...

If you never got mtk phone in lsusb when shorted, then you are out of luck.

Maybe go for a second hand one... ;)
[Fire TV Original Android Development] elektroplax:
Yep. Just checked lsusb again with the short, nothing. Patched.
[Fire TV Original Android Development] Sus_i:
Same for the (almost identical) new 2020 fireTV stick / lite stick...

On this sticks they patched the uart TX/RX (serial console) somehow too.

As soon a ttl uart adapter is connected to the TX/RX pads, the stick wont boot at all (doesn't step to the preloader, no device in lsusb).

Idk if the stick stays in bootrom (waiting for commands?) or if the uart is disabled via eFuse too.

Anyway, wasn't able to log a single letter of the boot process, not at BROM stage, not at PL/LK baudrate, just nothing.

FYI @k4y0z ;)
[Fire TV Original Android Development] gabardal:
Hello, is there any way (by software) to find out if my device is patched (ie. can't be rooted)? Cheers
[Fire TV Original Android Development] k4y0z:
That's weird, I would have assumed it still boots up, even if they disabled UART.

I thought these devices are tanks as well, or do they have a different codename?

Possibly using this this
[Fire TV Original Android Development] I_CRAFT:
@Sus_i @Bertonumber1 @k4y0z

Only for logging, device data gethered via "easy fire tools" maybe there is an indicator like SN or Build Date, since it got fixed.
[Fire TV Original Android Development] Sus_i:
No, not like tank. They are new, look basically like mantis (with different wifi antennas), layout looks the same, soc also the same.

Yeah, it's weird. As soon the uart adapter is attached, it's like the stick waits in BROM at power up. PL wont come up, no sign of life in lsusb. Maybe it waits for a factory flashtool handshake or something? Idk :)

Edit: Pic's from a new lite:

https://xdaforums.com/t/new-firetv-sticks-2020-edition.4168113/post-83753653
[Fire TV Original Android Development] k4y0z:
Thanks, codename is apparently "sheldon"
[Fire TV Original Android Development] story:
How do you guys boot to TWRP with OTG and then connect to a PC?

I got a "hacked fastbook mode: (0) - xyz. k5y0z
[Fire TV Original Android Development] 0815hoffi:
On fastboot.

./fastboot-step.sh

Otg? Never used this 🤷‍♂️

From os

# reboot recovery
[Fire TV Original Android Development] story:
k

Is this a permanent hack? I wiped/factory reset in TWRP and I unplug it because I didn't plug in my USB drive. Now it's just boot back to my personal FireTV setup without wiping anything?

FIXED! It was my OTG and power. It wasn't giving enough power. Everything works now.
[Fire TV Original Android Development] Bertonumber1:
Theyre codenamed "sheldon" these new Lite versions
[Fire TV Original Android Development] 0815hoffi:
TWRP is permanent, you can allways access with...

# reboot recovery

Over adb shell
[Fire TV Original Android Development] kayshyuk:
Thank you so much!

After finishing the installation, I started the factory reset because I thought something wasn't smooth.

After that, I just look at the "fire TV" logo. I've started over from the beginning,

but I type in the command "adb install,"

it's already installed.

After rebooting, I can only see the logo on TV.

help me. :(
[Fire TV Original Android Development] Bertonumber1:
@kayshyuk

adb install ?

within twrp

select your firmware

add more zips

select magisk

swipe to install

wipe cache , dalvik if you want

reboot

or if you want you can use twrp command line

adb shell

twrp install nameofyourrom.zip

twrp install magisk-vxx.x.zip

wipe cache , dalvik IYW

reboot

Profit ;)
[Fire TV Original Android Development] king200:
I followed the OP instructions. I am able to boot my PC with the fireiso-1.0.0.iso. I put the files from "kamakiri-mantis-v1.2" (terminal in kamakiri folder on desk}.

"./bootrom-step.sh"

I get "permission denied".

HELP!
[Fire TV Original Android Development] seandop:
You need to change the permissions on the two scripts to make them executable.