yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] lasikie:
I don't have access to a Linux system, can this be done through a VM?
[Fire TV Original Android Development] brick00444:
Not sure on the VM but I just made a linux live usb drive and it worked great (don't necessarily need a full install). Hope that helps
[Fire TV Original Android Development] lasikie:
Didn’t even think of that thanks
[Fire TV Original Android Development] ForForkSake:
This Lindy cable works perfect for less than £5 Inc delivery.. Think it was even cheaper on amazon.

https://www.lindy.co.uk/cables-adap...-usb-2-0-type-a-to-a-cable-anthra-line-p11306
[Fire TV Original Android Development] toybits:
Does it have to be or is it better to use usb 2.0 a to a cable or can you use a usb 3.0 cable? Thanks.
[Fire TV Original Android Development] Rortiz2:
You can use twice but it's more recommended to use a 2.0 one. For some weird reason it works better with the bootROM communication. Same goes with USB Ports.

Cheers!
[Fire TV Original Android Development] Sus_i:
Today I did a second attempt to attach a TTL UART Adapter to the serial console. I used the testpoints above the UART pads and got it working at 115200 baud, logging the boot process works too but with 921600 baud.

I did a few logs, in order to look for differences between shorted/not shorted attempts... and the third attempt was successful :p :D

ubuntu@ubuntu:~/Desktop/amonet-sloane-v2.0$ sudo ./bootrom-step.sh
[2019-11-07 14:17:45.803225] Waiting for bootrom
[2019-11-07 14:18:00.145280] Found port = /dev/ttyACM0
[2019-11-07 14:18:00.150441] Handshake
[2019-11-07 14:18:00.159637] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-11-07 14:18:01.676687] Init crypto engine
[2019-11-07 14:18:02.008178] Disable caches
[2019-11-07 14:18:02.012202] Disable bootrom range checks
[2019-11-07 14:18:02.204437] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes
[2019-11-07 14:18:02.214995] Send payload
[2019-11-07 14:18:11.350292] Let's rock
[2019-11-07 14:18:11.358244] Wait for the payload to come online...
[2019-11-07 14:18:14.921397] all good
[2019-11-07 14:18:14.921922] Check GPT
[2019-11-07 14:18:16.224232] gpt_parsed = {'': (0, 1), 'userdata': (3171616, 12098239), 'NVRAM': (2048, 10240), 'DKB': (139264, 2048), 'TEE1': (12288, 10240), 'recovery': (86016, 51200), 'TEE2': (22528, 10240), 'MISC': (141312, 1024), 'system': (182016, 2477600), 'EXPDB': (158720, 23296), 'LOGO': (142336, 16384), 'boot': (34816, 51200), 'lk': (32768, 2048), 'PRO_INFO': (1024, 254), 'KB': (137216, 2048), 'cache': (2659616, 512000)}
[2019-11-07 14:18:16.224508] Check boot0
[2019-11-07 14:18:17.418348] Check rpmb
[2019-11-07 14:18:17.627359] Downgrade rpmb
[2019-11-07 14:18:17.632285] Flashing preloader..
[319 / 319]
[2019-11-07 14:18:25.853859] Flashing TEE..
[3725 / 3725]
[2019-11-07 14:19:44.186747] Flashing bootloader..
[806 / 806]
[2019-11-07 14:20:01.860582] Flashing unbrick image..
[8956 / 8956]
[2019-11-07 14:23:12.589581] Flashing boot..
[31252 / 31252]
[2019-11-07 14:33:41.089946] Reboot to TWRP..
ubuntu@ubuntu:~/Desktop/amonet-sloane-v2.0$

This is the method I did, works fine as you can see above.

Finally this box is unbricked and rooted... Thanks a lot :good: :laugh:
[Fire TV Original Android Development] Rortiz2:
Perfect:highfive:

Glad that finally worked :good:

It's much to request a photo of that pads?:p

Cheers!
[Fire TV Original Android Development] Sus_i:
Sadly the box is already assembled ;)

If you look at the bottom side of the PCB, outgoing from the USB port strait down the edge, approximately half way down the edge, you see that small quadrangular field used for UART. In there the left pin (of the three pins, the one to the board edge) is GND. Above that field you see the testpoints I used. TP7542 is RX and TP7543 is TX. I haven't attempt to send anything to the box via the serial console, only wanted to capture a few logs.

In DL mode, 115200 baud works. Small snipet of the amonet script serial console output:

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2019.11.07 15:18:06 =~=~=~=~=~=~=~=~=~=~=~=
[DL] 00009C30 00000000 010501

Entered the payload
MSDC_CFG: 0x00201199
CMD<0><0x02000000> Arg<0x00000000>
return<0> resp<0x00000000>
GO_IDLE = 0x00000000
CMD<1><0x02000181> Arg<0x00000000>
return<0> resp<0x40ff8080>
SEND_OP_COND = 0x00000000 ocr = 0x40FF8080
new ocr = 0x40030000
CMD<1><0x02000181> Arg<0x40030000>
return<0> resp<0x40ff8080>
CMD<1><0x02000181> Arg<0x40030000>
return<0> resp<0xc0ff8080>
SEND_OP_COND = 0x00000000 ocr = 0xC0FF8080
CMD<2><0x02000102> Arg<0x00000000>
return<0> resp<0x15010038>
ALL_SEND_CID = 0x00000000 cid = 0x15010038 0x57504433 0x520064C3 0xE22F8229

I don't know why it finally worked, tried the shorting/script process about forty times total. ;)
[Fire TV Original Android Development] Sus_i:
I know soldering looks bad on this picture, but at least the serial console was working :p

Edit: The picture is a bit misleading.

For clarification, the red wire (VCC) isn't connected at all.

TX, RX and GND is enough to access the serial console.
[Fire TV Original Android Development] Rortiz2:
Cool.

Don't worry, I don't know if looks bad or good, not soldered much times so I don't have good experience:p

About the adapter, is it an USB to TTL adapter no?

Cheers!
[Fire TV Original Android Development] Sus_i:
Yes, its a USB to TTL UART Serial Converter with CP2102 for about 3 bucks ;)
[Fire TV Original Android Development] Rortiz2:
Thanks, so that's not the problem, mine is get a soldering station xD.

Cheers!
[Fire TV Original Android Development] lasikie:
I've managed to get to recovery but I can't get the remote to connect to choose an option. Is there a command I can run through terminal to get control of the recovery?
[Fire TV Original Android Development] Rortiz2:
Recovery doesn't have bluetooth so you can't use the remote. You need to use

adb shell twrp

commands or just connect a mouse into the Fire TV;)
[Fire TV Original Android Development] lasikie:
Legend.

adb shell twrp didn't work, mouse did.
[Fire TV Original Android Development] Sus_i:
Glad to hear that :D

Let me guess... :p First thing to check out is why downgrade/overwrite RPMB fails... and if thats working, full read/write access and payload execution is achieved. Second step, change offsets in amonet to exploit LK, i.e. disable signature checks, in order to boot TWRP and unsigned system images ;) :p :laugh:
[Fire TV Original Android Development] Rortiz2:
Yep.

About, RPMB it's related in b-rom payload as k4y0z said. Then, the lk-payload, get the correct addresses, can be a pain I think (yes, I have IDA Pro but I don't think will be more easier;)).

Also, we already can boot unsigned system.imgs, the main problem is the kernel and SELinux, if we get a permissive SELinux we can easily boot custom roms based on Lollipop due still locked bootloader but would be a nice start. tbh I already started working on it and built a few zips and doing some tests (all failed, stuck at amazon logo with no boot menu). I've tried the kernel module by k4y0z but fails due sloane needs signed kernel modules :( Asked to rbox, and he says we can use his 2ndinit to put SELinux in Permissive at boot :good:

Just trying to boot LineageOS 12.1 as we done in the past with Fire 7 2015 (ford) with locked bootloader using stock boot.img:)

If you want to take a look at the (working) device tree:

https://github.com/R0rt1z2/android_device_amazon_sloane

The main problem rn is that after flash the rom, doesn't boot (obv due selinux) but we loose TWRP even if I copy rbox's pppd, ext4_resize and ramdisk into their correct places. I think I need to copy ALL the contents of unbrick+ramdisk including the linker64 and the libs in lib64 folder. If with that we reach at least boot menu, would be more easy.

Cheers!
[Fire TV Original Android Development] Rortiz2:
Got some progress ;)

We got logs of the rom (tombstones to be exact).

Also, about amonet, borrowed some code from k4y0z's one to erase the Preloader header and make the device to don't reboot while the flash and avoid the famous:

device reports readiness to read but returned no data (device disconnected or multiple access on port?)

Cheers!
[Fire TV Original Android Development] iustikka:
root@mint:/home/mint/Downloads/amonet-mt8173-sloane# sudo ./bootrom-step.sh

[2019-11-11 21:34:15.028206] Waiting for bootrom

[2019-11-11 21:34:34.624708] Found port = /dev/ttyACM0

[2019-11-11 21:34:34.625183] Handshake

[2019-11-11 21:34:34.625673] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-11-11 21:34:39.858776] Init crypto engine

[2019-11-11 21:34:39.875490] Disable caches

[2019-11-11 21:34:39.875865] Disable bootrom range checks

[2019-11-11 21:34:39.886643] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes

[2019-11-11 21:34:39.888650] Send payload

[2019-11-11 21:34:40.337191] Let's rock

[2019-11-11 21:34:40.337767] Wait for the payload to come online...

[2019-11-11 21:34:43.898747] all good

[2019-11-11 21:34:43.899399] Check GPT

[2019-11-11 21:34:45.173625] gpt_parsed = {'PRO_INFO': (1024, 254), 'NVRAM': (2048, 10240), 'TEE1': (12288, 10240), 'TEE2': (22528, 10240), 'lk': (32768, 2048), 'boot': (34816, 51200), 'recovery': (86016, 51200), 'KB': (137216, 2048), 'DKB': (139264, 2048), 'MISC': (141312, 1024), 'LOGO': (142336, 16384), 'EXPDB': (158720, 23296), 'system': (182016, 2477600), 'cache': (2659616, 512000), 'userdata': (3171616, 12098239), '': (0, 1)}

[2019-11-11 21:34:45.173899] Check boot0

[2019-11-11 21:34:46.362385] Check rpmb

[2019-11-11 21:34:46.569259] Clear preloader header

Traceback (most recent call last):

File "main.py", line 131, in <module>

main()

File "main.py", line 94, in main

flash_data(dev, b"EMMC_BOOT" + b"\x00" * ((0x200 * 8) - 9), 0)

NameError: name 'flash_data' is not defined

root@mint:/home/mint/Downloads/amonet-mt8173-sloane#

doesn't work, please help
[Fire TV Original Android Development] Rortiz2:
My fault, sorry... Lemme fix it.

Enviado desde mi Aquaris M8 mediante Tapatalk
[Fire TV Original Android Development] iustikka:
What do you mean with "Lemme fix it" ?
[Fire TV Original Android Development] Rortiz2:
There's an error in the code. I will disable the error part to temporarily fix it because can't full fix it right now.

Enviado desde mi Aquaris M8 mediante Tapatalk
[Fire TV Original Android Development] Rortiz2:
Redownload amonet. Now should work.

Cheers.

Enviado desde mi Aquaris M8 mediante Tapatalk
[Fire TV Original Android Development] iustikka:
Rortiz2 thnx a lot, it work again.
[Fire TV Original Android Development] Rortiz2:
Leaving this here... Almost booted Lineage!

Enviado desde mi Aquaris M8 mediante Tapatalk
[Fire TV Original Android Development] DanielF50:
We're getting there :laugh:
[Fire TV Original Android Development] safcscon:
Any help with this error guys ?

sudo ./bootrom-step.sh

[2019-11-18 19:12:58.900164] Waiting for bootrom

[2019-11-18 19:14:10.226439] Found port = /dev/ttyACM0

[2019-11-18 19:14:10.228381] Handshake

[2019-11-18 19:14:10.232364] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-11-18 19:14:12.998613] Init crypto engine

[2019-11-18 19:14:13.227340] Disable caches

[2019-11-18 19:14:13.231332] Disable bootrom range checks

[2019-11-18 19:14:13.350529] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes

[2019-11-18 19:14:13.355814] Send payload

Traceback (most recent call last):

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 501, in read

'device reports readiness to read but returned no data '

serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "main.py", line 144, in <module>

main()

File "main.py", line 81, in main

load_payload(dev, "../brom-payload/build/payload.bin")

File "/home/john/Desktop/amonet-mt8173-sloane/modules/load_payload.py", line 137, in load_payload

dev.write32(load_addr, words)

File "/home/john/Desktop/amonet-mt8173-sloane/modules/common.py", line 154, in write32

self.check_int(self.dev.read(4), word) # echo word

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 509, in read

raise SerialException('read failed: {}'.format(e))

serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

root@john-Extensa-5630:/home/john/Desktop/amonet-mt8173-sloane#
[Fire TV Original Android Development] Rortiz2:
Bad connection between the device and the computer and due that, device tried to power on. Switch cables, use other thing to short, try USB 2.0 port. Read other posts with same issue.

Cheers.
[Fire TV Original Android Development] sconnyuk:
Thanks for replying.

I'm shorting to the usb outer, and have tried straight to the shield right next to the point.

The cable I've used is the same I used quite a while ago to unbrick the box with rboxs unbrick image, could it still be an issue ?

I'm using an older laptop with Ubuntu installed and is only usb 2, I have tried all 3 of the ports and get the same output everytime I'm successful with the short.

The fire TV 2 I'm using is stuck on resetting your fire tv, and will restart over and over if this is relevant ?

I certainly will purchase another usb a to a cable if you think this might be the issue.

Can I ask what point is a good point to short to ? Just as to rule this out.

I've also tried with hdmi plugged in and unplugged.

Thanks again.
[Fire TV Original Android Development] Rortiz2:
Ok so, your fire is like in a loop. Happened here sometimes, the trick was disconnect it and leave it disconnected like 1 min or faster/dangerous way was short vbat 1 second or less (NOT RECOMMENDED, CAN KILL THE DEVICE) to run out of power completely and then short and run the script. It's just keep trying.

Cheers.
[Fire TV Original Android Development] sconnyuk:
Rather not short vbat if there chance of killing device.

I'm going to make a usb to usb a cable (short length) and try that, can I ask what length a to a cable you used ?
[Fire TV Original Android Development] Rortiz2:
Original one ;)

If I recall correctly, [MENTION=5213625]Sus_i[/MENTION] had exactly same issue as you and fixed it (can't remember how exactly). Try with other cable, maybe does the trick. Also do the 1 minute thing. Believe me, even if you disconnect the box, this still have power inside.

Regards.
[Fire TV Original Android Development] sconnyuk:
Thanks ever so much for help, unfortunatly for waht ever reason im having no luck. ive tried 2 different wires to short and cables and 3 different computers, have tried all you have suggested but keep getting the same output.

I was quite opeful on getting this box up and running too.

is there anything else i could try ?

---------- Post added 19th November 2019 at 12:35 AM ---------- Previous post was 18th November 2019 at 11:58 PM ----------

Any chance of an insight on how you managed [MENTION=5213625]Sus_i[/MENTION] ?

---------- Post added at 12:35 AM ---------- Previous post was at 12:35 AM ----------

Any chance of an insight on how you managed [MENTION=5213625]Sus_i[/MENTION] ?
[Fire TV Original Android Development] DanielF50:
My first box took about ~6 hours of shorting to get it to actually unbrick, so all I can suggest is be persistent :eek:
[Fire TV Original Android Development] Sus_i:
No, can't tell why it worked for me, I tried it multiple times on several days until it worked.

Between the attempts I told the box that I'll clamp it in a vice and hit it with a big hammer :D

Don't think its cable related. All I can say is just try it again and again, but be careful, don't damage the resistor.
[Fire TV Original Android Development] sconnyuk:
I'll just keep trying.

Thanks. ?

---------- Post added at 12:41 PM ---------- Previous post was at 11:55 AM ----------

Can I just ask where you were shorting too, what were you shorting with and if you were getting the short in the correct place then putting the power lead in ?

I know it may sound stupid but I want to rule out all variables.

Thanks.
[Fire TV Original Android Development] Sus_i:
I used that point from OP, its DAT0. You can attach one end of a wire to the shield with a clothes pin, or attach the wire end with a screw to one of the drilled holes in the board.

With one hand I shorted the pad from OP and with the other hand I plugged in the power supply into a wall socket...
[Fire TV Original Android Development] Rortiz2:
Yes, as [MENTION=5213625]Sus_i[/MENTION] said, I don't think it's a cable problem. Try what he say. I don't know why this box powers on in USBDL mode...

BTW ;):
[Fire TV Original Android Development] sconnyuk:
Thanks.

I've tried numerous points including what you did to short, I'm using dat0 as in op, tried copper wire and steel to short with. Someone said it took them 6 hours or so, I think I've went past that time now I've probably had 10 hours of trying now ?.

Very frustrating.

I'm quite sure these V2 boxes are all the same around the world unless someone can correct me ? I'm I've in the UK we normally get the same stuff as most places, just don't want to think I'm wasting my time if there is some part that differs in my V2 box.
[Fire TV Original Android Development] Rortiz2:
Hi,

This box has 2 versions. 4k one and non-4k if I recall correctly. I also noticed that the EMMC is different on some boxes but that doesn't seem to be the problem. You said you tried a lot of points, don't do that without good tools, can perma-brick your device ;)

Give a try to vbat if you want but not sure if will help. Here helped sometimes when I've getting readiness error.

Cheers.
[Fire TV Original Android Development] sconnyuk:
Yes I have the V2 4k box.

Ok, can you point out where vbat is to short to ?

Maybe a pic if you could be so kind ? And am I to short this momentarily ?

I'm only using a 0.5mm length of soft copper wire to short with as to be as careful as possible not to break nothing.

Very much appreciate all your help.
[Fire TV Original Android Development] Sus_i:
I know what you mean, thats why I said I tried it on serveral days... no desire to try that longer than a half hour ;)

There is only one version of the second gen box out, but the first gen's box casing looks like the second one, except the missing sdcard slot.

What do you mean with vbat? VCCQ power?

You can try to short the DAT1 or DAT2 pads. But I don't know if it will work, haven't tested it myself.

Look at the picture in OP.

Above the marked DAT0 point, you see 6 pads in two rows... a total of 12 pads.

Outgoing from the marked point, count three of this pads up, the right side pad next to the emmc edge is DAT1.

Outgoing from the marked point, count five of this pads up, the right side pad next to the emmc edge is DAT2. It's the next-to-last one pad.

Don't short the left row pads, that is VCCQ power = 1.8v current.
[Fire TV Original Android Development] Rortiz2:
Yes sorry... Yes, you're right not safe to short it. I already warned. Just that in mine helped to avoid the error.

Regards.

Enviado desde mi WAS-LX1A mediante Tapatalk
[Fire TV Original Android Development] Sus_i:
Probably won't damage anything if you short VCCQ to ground. I assume the whole box won't start at all. ;)

Maybe a (not grounded) short between VCCQ to the DAT pads damage something inside the emmc, don't know. Thats why I mentioned not to short the left row pads.
[Fire TV Original Android Development] sconnyuk:
I'm thinking is it because of the wayy box is booting, I know normally when we start up Amazon fire TV we see Amazon logo for a couple seconds then fire TV logo while it loads.

Could it be at all possible why I'm getting no luck because of the way my box boots ?

My Amazon logo is there for a split second and goes directly to the 'resetting your fire tv' screen.

Is it possible the script is expecting the Amazon logo for a little longer ? And could it be changed at all ?
[Fire TV Original Android Development] Rortiz2:
Wrong. The script waits for a bootROM device. This means that the device is "powered off" with a white led if I remember correctly and in lsusb as:

MediaTek Inc. MT6227 phone

Maybe you are not in bootROM:confused: Try shorting and executing

lsusb

at same time in terminal.

Regards.
[Fire TV Original Android Development] sconnyuk:
Yes it seems when I short I am in bootrom mode.

With lsusb I do see MediaTek Inc. MT6227 phone listed.
[Fire TV Original Android Development] Rortiz2:
Weird. Tried Sus_i suggestions?

Cheers.
[Fire TV Original Android Development] sconnyuk:
Yes I've tried dat1 and dat2 can't get it to do anything with dat2 pad but dat1 gives same output as dat0, I've also tried shorting vbat to clear power from device.
[ASUS ROG Phone II Questions & Answers] 10darkprince:
Asus recently provide software update for Armory Crate – Added AirTrigger, Key-mapping and macro customization options.

Since key mapping feature is only available to asus accessories, personally i have Gamesir g5 controller & tried to work it out but they have disabled that feature.

Please someone look into it & provide mod to enable keymapping for any controller.
[ASUS ROG Phone II Questions & Answers] thugsta1:
+100 on this as i too use other controllers like the GameSir and the FlyDigi
[ASUS ROG Phone II Questions & Answers] WhyKlwd:
I am in no way capable of helping but I understand some of the inner workings and what you ask may not be as simple as "ticking off" a box. If ASUS is smart about it, they would probably activate mapping capabilities only when recognizing their own manufactured Hardware IDs, meaning that you'd either manually code-in generic or specific IDs to the software and hope it behaves accordingly OR spoof a device to make it seem like it's ASUS hardware. Either way, it would be either very complicated or specific to users depending on the hardware that is being used.

Not impossible, just something that is not likely to come anytime soon, if ever. I, for one, will simply buy the Kunai when it becomes available for purchase. I expect progress may happen when developers have the Kunai to better understand what "ticks".

I want this as much as the next guy but yeah, it's going to take a long while at best. (in my opinion)
[ASUS ROG Phone II Questions & Answers] MCube74:
How about key mapping for keyboard and mouse?

Is that also locked to ASUS keyboard and mouse?
[ASUS ROG Phone II Questions & Answers] WhyKlwd:
So I tried something... Using one of those universal USB-C HDMI-Out + USBx2 adapters, I tried to see if I could map KB+M and nope. They get recognized as normal in the OS but ASUS does not unlock mapping features. But to my surprise, the video and audio out also does not work which showcased, for the first time, a notable difference with the RoG 2 vs the many MANY Android devices out there. I now assume Video out through USB is locked behind the orange USB-C port. Meaning that the feature, usually stock on most modern Android device, can only be done through buying ASUS's proprietary accessories.

I'd assume that the KB+M mapping is unlocked when you have that ASUS PC dock and that without it, that feature will not be achievable.

So I decided I was going to risk my device for the sake of knowledge but to my surprise, I also noticed for the first time that ASUS made a notch and won't let you plug in a cable in the port therefore securing it only for ASUS accessories.

The way I see this, ASUS probably carefully redirected specific features onto the logic board so that these features pass only and exclusively through the orange USB-C cable which, by removing bandwidth, would also guarantee a better experience than most devices. I'm debating if I want to get rid of that notch that prevent the use of the orange USB-C....
[ASUS ROG Phone II Questions & Answers] Orion9k0:
Do it for science! Also, instead of modifying the port, could you alternatively modify a usb cable plug end?