yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] teephart:
this is the result

[root@sysresccd# adb push kamakiri-mantis-v1.2.zip /sdcard

kamakiri-mantis-v1.2.zip: 1 file pushed. 12.2 MB/s (15816900 bytes in 1.241s)

[root@sysresccd# adb shell

~ # twrp install /sdcard/kamakiri-mantis-v1.2.zip

Installing zip file '/sdcard/kamakiri-mantis-v1.2.zip'

Checking for Digest file...

[amonet] Load microloader from recovery...

[amonet] Failed to open the recovery device

[amonet] Remove boot patch...

[amonet] Failed to open the boot device

[amonet] Install boot patch...

[amonet] Failed to open the boot device

[amonet] Install recovery patch...

[amonet] Failed to open the recovery device

Error installing zip file '/sdcard/kamakiri-mantis-v1.2.zip'

Done processing script file

same error reply

---------- Post added at 09:55 PM ---------- Previous post was at 09:48 PM ----------

This is what i got whne i check the updater file in /tmp

seems like a mounting issue

("SELinux contexts loaded from /file_contexts

I:Unable to mount '/cache'

I:Actual block device: '', current file system: 'ext4'

Full SELinux support is present.

tw_get_context failed to get selinux context

I:Failed to get default contexts and file mode for storage files.

I:Unable to mount '/cache'

I:Actual block device: '', current file system: 'ext4'

I:Failed to mount /cache/ for TWFunc::Update_Log_File

I:Recreating /cache/recovery/ folder.

I:Copying file /cache/recovery/log to /cache/recovery/last_log

I:Unable to mount '/cache'

I:Actual block device: '', current file system: 'ext4'

E:

I:Unable to mount '/cache'

I:Actual block device: '', current file system: 'ext4'

I:Unable to mount '/data'

I:Actual block device: '', current file system: 'ext4'

I:Unable to mount '/data'

I:Actual block device: '', current file system: 'ext4'

Unable to mount /data/media/TWRP/.twrps

I:Attempt to load settings from settings file...

I:InfoManager file '/data/media/TWRP/.twrps' not found.

I:Backup folder set to '/data/media/TWRP/BACKUPS/G070VM08844251KP'

I:Unable to mount '/cache'

I:Actual block device: '', current file system: 'ext4'

I:Unable to mount '' to write version number.

I:Unable to mount '/data'

I:Actual block device: '', current file system: 'ext4'

I:Unable to mount '/auto0'

I:Actual block device: '', current file system: 'vfat'

I:Unable to mount '/auto1'

I:Actual block device: '', current file system: 'vfat)

SEEMS IT HAS TO DO WITH THE FILE SYSTEM.
[Fire TV Original Android Development] Sus_i:
Yes, it seems so.

You can try a fix for the gpt with the gpt-fix from here.

Extract the two files in the kamakiri folder, make sure that the gpt-mantis.bin file goes to the bin folder... then run:

./gpt-fix.sh

(ofc with shorting).
[Fire TV Original Android Development] teephart:
i just inspect fstab.mt8695, to check the filesystem mount,

the mounting point is not there anymore

e.g

/dev/block/platform/soc/11230000.mmc/by-name/boot, i was able to locate the folder /dev/block/platform/soc/11230000.mmc/

but no /by-name/boot

hence the reason why file system cannot mount.

what are my options?
[Fire TV Original Android Development] teephart:
This works very well.

THANK YOU SO MUCH
[Fire TV Original Android Development] Bertonumber1:
Thanks again for your hard work [MENTION=10414053]Skel40[/MENTION] and [MENTION=2334142]085[/MENTION]1hoffi I'm having a rare old time here :laugh: don't mind messing with these scripts and trying to learn a bit more.

Respect
[Fire TV Original Android Development] :
RuntimeError: received b'' instead of expected pattern

Hi folks, I'm trying to unlock my 4k (using virtualbox with a linux host) but I keep getting this error, can somebody help me:

If you have a short attached, remove it now

Press Enter to continue

[2020-03-07 23:44:13.554354] Load payload from ../brom-payload/stage1/stage1.bin = 0x27C bytes

[2020-03-07 23:44:13.639669] Let's rock

[Errno 5] Input/Output Error

[2020-03-07 23:44:13.639905] Waiting for stage 1 to come online...

Traceback (most recent call last):

File "main.py", line 114, in <module>

main(dev)

File "main.py", line 24, in main

load_payload(dev)

File "/home/xxxxkama1/kamakiri/modules/load_payload.py", line 85, in load_payload

raise RuntimeError("received {} instead of expected pattern".format(data))

RuntimeError: received b'' instead of expected pattern

Thanks!

UPDATE:

Tried with another laptop and with a Win10 host and it worked! So I guess the issue was my usb ports or the linux host
[Fire TV Original Android Development] Bertonumber1:
Sometimes usb ports are funny with the android rule in plugdev and need amended this happened to me before.
[Fire TV Original Android Development] mkfsf2fs:
The death of a capacitor

Hi,

I have just bought a 3rd Gen Fire TV Stick which has almost the same specs as the Fire TV Stick 4k. Therefore I couldn't resist tinkering around and tried the hardware rooting approach described here.

It did not took long and my incredibly calm hands did it again and swept away a capacitor close to the emmc -.-'

Is anyone able to tell me what that capacitor's specs are? I might find a sparepart.

[MENTION=7104332]k4y0z[/MENTION], do you know whether the root procedure of the FTV 4k can be applied to the 3rd Gen FTV as is? Otherwise, I might adapt it. But it's usally quite hard for me to get hold of a MTK ref manual :(

In the attachments you can see the pcba (excluding said capacitor). I wonder, whether there were any changes to it that may be a dealbreaker for rooting...

Edit: One key difference that can be seen easily is the lack of the DAT0 testpoint (or tunnel) that was led out beneath the emmc chip :/

I guess I have to have a look at the other side of PCBA...

Best regards

mkfsf2fs
[Fire TV Original Android Development] Sus_i:
There is already a thread about the new sticks here, [MENTION=10401573]0815hoffi[/MENTION] did a quick test and it seems that the new sticks acting just like the 'newer' br patched tank sticks, aka. no phone message while shorted...

Good luck with that, I guess no one can tell you the specs.

For what purpose do you need DAT0?

If you like to short the stick, use the part to the right (outgoing from your red arrow), short the side with the big trace running under the chip.
[Fire TV Original Android Development] Ghost719:
Hi, is it possible to port kamakiri to another device and how to port it? (Xiaomi Redmi 6A, MT6762V)

When I'm trying to port, I always get this error

[Errno 110] Operation timed out

on this line:

udev.ctrl_transfer(0xA1, 0, 0, 10, 0)

What does this line is actually do?
[Fire TV Original Android Development] marklar_RR:
Sorry for a noobie question but how do you connect Fire TV 4K to computer? I tried 5 or 6 different USB cables, 3 different ports but cannot get pasts "Waiting for bootrom" message. Even without the points shorted I should get some information that my stick is connected, right? Nothing is happening, whether the points are shorted or not.

I thought I damaged it somehow after dismantled it but no, the stick still works fine when connected to TV.
[Fire TV Original Android Development] CapeCon:
Confused - Seeking Assistance

Hi guys,

I am confused by the step of "Your device will now reboot into TWRP." Is this talking about when I plug it into my TV or how do I move forward with this step?
[Fire TV Original Android Development] dcarvil:
Reboot to TWRP happens immediately after running ./fastboot-step.sh, while the stick is still connected to the PC. Once in TWRP, you can flash whatever you are trying to install.
[Fire TV Original Android Development] chinkster:
anyone how know to return this to stock? i might sell my firestick 4k
[Fire TV Original Android Development] 0815hoffi:
Check my 2nd Test on Post.

https://xdaforums.com/showpost.php?p=83828923&postcount=19

extract boot.img from ftvs4k_6.2.7.3.zip
[Fire TV Original Android Development] Bertonumber1:
[MENTION=2617401]chinkster[/MENTION] Easiset way to return to stock is just use the latest stock download and push to internal storage, use twrp to wipe everything except the sticks internal storage extract the "boot img" to your fastboot folder.

Make sure you complete registration process and enable adb

Type: adb reboot recovery

Once in twrp navigate to shell and

Type : adb shell reboot-amonet

Check your connected

Type : fastboot devices

Then

Type : fastboot flash boot boot.img

(the one extracted from your rom download)

Next

Type: fastboot reboot

Your device will now boot to stock

Once it boots up perform a factory reset just to make sure. And voilla amazon ****ty city :good:

Should you wish to return to unlocked you will have to repeat the shorting process over.
[Fire TV Original Android Development] stefss:
I read everything and i am tottaly confused, please advices.

My firestick is 6.2.7.3

I connect stick to tv an type./bootrom-step.sh, but nothing happens. Advices?

This tutorial seems most easies for me, maybe i should try another?

I want: to root my firestick, install twrp or something similar, get ntfs and exfat support, and install new launcher or rom.
[Fire TV Original Android Development] 0815hoffi:
Run

./bootrom-step.sh

Then connect usb to pc
[Fire TV Original Android Development] stefss:
I get this error, help?
[Fire TV Original Android Development] stefss:
Edit: Its not 6273, its 6276 sorry.
[Fire TV Original Android Development] 0815hoffi:
Start Script.

Hold short and connect usb cable.

Wait for Massage to remove short .....
[Fire TV Original Android Development] beceruse:
Hello, I want to port kamakiri in my device (MT676X). But I have some problems when learning kamakiri . I'm confused why can you just do some writing in wdt area and send cmd e0 to flash the payload? Plz tell me, thank you！

@k4y0z
[Fire TV Original Android Development] Weysincha:
Hello everyone,

i have a question, my Amazon FireTV Stick 4K have the Fire OS 6.2.7.6 and Model No. E9L29Y.

i want to root it but i saw the kamakiri-mantis v 1.2 is only until 6.2.6.6 is there a even tho a way to Root my Fire Stick ? or does someone know if a new Build is ongoing ?

thank you
[Fire TV Original Android Development] Sus_i:
No, the kamakiri-mantis v1.2 works fine on all OS versions, just try it out^^
[Fire TV Original Android Development] I_CRAFT:
did you get it running?

Are you sure ?

i've got a new 4K-Stick with v6.2.7.6 and tried kamakiri-mantis v1.2 and the Master branch from github, but everytime im stuck at "waiting for bootrom", it seems it doesnt boot

at all if DAT0 is on ground.
[Fire TV Original Android Development] Sus_i:
Well, Amaz. could fix the BR on the hardware side (like they did for the second gen. firesticks), but there are no reports for now.

You can take a look in lsusb while the stick is shorted.

The vulnerable stick should print something about mediatek phone while shorted. If you see something like preloader, mtp device or so, the short wasn't proper.

Question is, what prints lsusb while shorted/waiting for bootrom/stuck on the boot screen?

Edit: Did you used the fireISO too?
[Fire TV Original Android Development] I_CRAFT:
yes i also used fireiso after serveral atampts failed (stuck bootrom).

I will check the lsusb output later this day and post my findings here.
[Fire TV Original Android Development] Sus_i:
Ok, nice :)

Only way to patch the exploit is with a new hardware revision (SOCs bootrom), not fixable with a new fireOS version.

Is your Stick rather new?
[Fire TV Original Android Development] luciferin:
Exploit is working fine for me from v6.2.7.7 --I've run it on two devices in the past couple days. My guess is the USB cable you are using doesn't support data (charging only). Try a diffent cable.

If you plug the Fire Stick 4k in without grounding the pin, the script should crash and spit out an error. If it's not even doing that, then for whatever reason the device isn't connecting to your system.
[Fire TV Original Android Development] Sus_i:
Ok, fine, thanks.

It's normal that it won't boot when shorted (the SOC can't access the eMMC).

It doesn't need a whole new hardware revision, to patch the exploit a revised bootrom in the SOC is enough.

The patched 'tank' sticks won't show a message at all when shorted, same as yours.

How old is the stick?
[Fire TV Original Android Development] I_CRAFT:
It just arrived yesterday, after amazon couldn't deliver it for a month.
[Fire TV Original Android Development] Sus_i:
Ok, then I guess we have the first report of a patched non-vulnerable 4k stick^^

If you have an usb ttl uart adapter, you can take a log during boot, when shorted, but its only a proof, won't help you with the unlock.
[Fire TV Original Android Development] dkennyd:
I have the same problem ( stuck at "waiting for bootrom"), i just got it two days ago, tried everything what i found in the forum but nothing helped. :S
[Fire TV Original Android Development] Sus_i:
Have you checked the output in lsusb too?

Make sure the short is steady and proper, then connect the sticks usb (to the PC running fireISO) and watch out in lsusb.
[Fire TV Original Android Development] I_CRAFT:
so i've attached two TTL-to-USB adapters (some generic and one with the CH340G chip) to the three pins (RX/TX/Ground) and got no output at all.

i have tested it with a baudrate of 300 to 115200 and this command from linux

# screen /dev/ttyUSB0 <baudrate>
[Fire TV Original Android Development] Sus_i:
The bootrom baudrate is 115200.

If you boot without a short, the output should only be a line and some numbers, something like this:

[DL] 00008B50 00000000 010801

F0: 103B 0000

F3: 0000 0000

V0: 0000 0000 [0001]

00: 0008 4000

01: 0000 0000

BP: 0000 0301 [0000]

G0: 0162 0000

T0: 0000 02A1 [000F]

Jump to BL

After that the bootprocess jumps to the bootloader. At this point the baudrate is 921600.

You can take some logs, at BR baudrate 115200, ofc first without a short and then with a short. Just to see what happens. If I remember correct, the patched tank sticks doesn't jump to the BL, they print something like 'system halt' (in case the eMMC is proper shorted out).

Can't help you with the command, used always putty on a win7 machine... ;)
[Fire TV Original Android Development] itsyaboy:
After rooting how do we update? It’s been a while since I set everything up and I may have disabled ota etc, I’m trying to get google stadia to run but it’s not getting passed the “get started” screen so I’m assuming I need to update.. so 1) is it safe to update and will the root stay intact? 2) how do I enable ota updates? 3) is there a safer manual way of updating?
[Fire TV Original Android Development] k4y0z:
I suppose it was just a matter of time until they also disabled DL-Mode on mantis.

I haven't looked into it in detail, but I don't think it actually requires a newer BROM/SOC.

They probably simply disabled the DL-Mode using an efuse.

Yes, that should work, make sure to cross-connect TX and RX (RX goes to TX and vice versa).
[Fire TV Original Android Development] Pretoriano80:
@k4y0z on FireOS 6.2.7.7 Amazon added an efuse check, any idea about it?

Edit: Probably it confirms the efuse theory from your previous post!?

This is how the script looks:

# Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.

# Default status
STATUS=invalid

# Read the e-Fuse once
ewriter 0 0 1 > /dev/null 2>&1

if [ $? -eq 0 ]; then
log -t efuse Reading e-Fuse succeeded
STATUS=$(ewriter 0 0 1 | sed '2!d')
else
log -t efuse Reading e-Fuse failed
fi

# Log the value in logcat buffer
log -t efuse Initial e-Fuse value: $STATUS
# ...and property
setprop efuse.status $STATUS
[Fire TV Original Android Development] Sus_i:
I thought (until now) that the efuse theory is somewhat unlikely, since @xyz` said that the BR exploit is unpatchable... but now we see some eFuse/ewriter code. o_O

Worst case. Maybe efuses are implemented in all MT8695 chips out there... (most likely, isn't it?),

and in case they are as easy to trigger like for qualcomm or nvidia chips... (also high likely!?)

it should be an easy task for Amaz. to f*ck up all the older vulnerable 4k sticks out there too. :oops:
[Fire TV Original Android Development] tsynik:
That's output of ewriter 0 0 1 on 4K updated to 6.2.7.7 via TWRP:

mantis:/ # ewriter 0 0 1

failed to creat efuse session ffff0008

failed to read efuse

tee result = 0xffff0008

status code = -65528, which means "tee error"
[Fire TV Original Android Development] Pretoriano80:
Maybe the efuse was implemented on the newer 4K sticks?!

It's odd that the default STATUS value it's "invalid".

It may require a new bootloader/preloader (or whatever MTK calls its stuff), which (thankfully) it's not updated when installing FireOS with TWRP.

Someone with more experience on this low level stuff may know better.
[Fire TV Original Android Development] tsynik:
Looks like it not used yet, because from getprop efuse.status i have empty line on my 4K with 6.2.7.7
[Fire TV Original Android Development] Pretoriano80:
Same here! However, the check it's enabled in ramdisk and if you "getprop | grep efuse", you will probably see that the service is stopped.
[Fire TV Original Android Development] k4y0z:
As said, I haven't really looked at it.

To me the efuse-theory seemed most likely.

The BROM probably always had the option to disable the DL-Mode via efuse.

And that doesn't really patch the vulnerability, it's more of a mitigation, in that sense xyz` was right.

Typically that wouldn't be disabled though, since that also means no SP Flash tools or similar for amazon themselves either (i.e no way to recover bricked devices even for the manufacturer)

If the efuse-theroy is correct, then indeed they could burn it via an update, so far it seems they haven't gone that route and have only disabled it on recently manufactured devices.

It may need an up to date TZ to work, the code may just not be implemented in the older one.
[Fire TV Original Android Development] tsynik:
Yes, but not only tz need to be updated. I flashed kamakiri with only new tz.img from 6.2.7.7 and had same error. after i replaced all: lk.bin, preloader.img and tz.img from 6.2.7.7 in kamakiri.zip and updated with it from twrp, now I have this output about eFuse:

mantis:/ # ewriter 0 0 1
efuse hex:
00
status code = 0, which means "eFuse is ok."

and new param in props:

mantis:/ # getprop|grep fuse
[efuse.status]: [00]
[init.svc.efuse_check]: [stopped]

does that mean I can't short eMMC in the future on this 4K? =) is it better to revert to kamakiri-1.2 bins? we can always spoof efuse.status with Magisk ;-)
[Fire TV Original Android Development] Pretoriano80:
Have you checked if fastboot flashing still works?
[Fire TV Original Android Development] Sus_i:
Nice to see that your stick is working with the new tz image.

Probably the error is gone, because the LK updated something during boot, at least rpmb should be updated now.

I guess eFuse ok mean that the efuse isn't burned for now. Have you checked the message in lsusb when shorted? ;)
[Fire TV Original Android Development] k4y0z:
When updating TZ, typically preloader also needs to match.

If you update LK you'll lose the unlock (which might also happen, when updating preloader).

If you use the ZIP-file to update via TWRP, only tz will be updated unless you uncomment the following in the update-binary:

#ui_print "- updating preloader"
#dd if=/${INSTALLER}/kamakiri/bin/preloader.img of=/dev/block/mmcblk0boot0 bs=512

You will have to test if this burned the efuse or just displays its current status.

What use would it be to spoof the status?
[Fire TV Original Android Development] k4y0z:
Doublepost, sorry.
[Fire TV Original Android Development] tsynik:
Today I checked that 4K and unlocked 2 new ones. Good thing is old one on 6.2.7.7 and with current TZ only show efuse status, but still have ability to be unlocked with a short. It detected and flashed with kamakiri fine. Another findings are new 4K sticks with current preloader always throw error after kamakiri's waiting for bootrom... about serial protocol mismatch. Just powered it from USB without a short and bootrom-step.sh script failed soon without any other actions done. With old one kamakiri don't throw that error on boot (old preloader differs in behaviour?) - waiting for bootrom forever until short. New ones still can be unlocked with a proper short fine.

p.s. probably it's better to stay on previous fw (6.2.7.6?) Amazon will not have ability to burn OTP in the future with it (their New Year gift maybe? =)
[Fire TV Original Android Development] Sus_i:
Are you able to check if your stick plays prime 4k content with the updated TZ?

Probably yes.

Question is if we can use the new TZ with the old preloader, or if we should try the new preloader, in order to avoid license and keybox errors in the future...

Remember what k4y0z said:

I had a quick look into all OTA packages since 6.2.6.6, just comparing the size of the images.

-The Preloader changed only in 6.2.7.1 and it's still the same in the latest. (We are using the older 6.2.6.6 PL in kamakiri).

-LK changed in 6.2.7.3 (this image is a lot bigger than all other versions) and it changed again in 6.2.7.6.

-TZ changed in 6.2.6.8 (the one already included in kamakiri) and it changed again in 6.2.7.7.

In conclusion I guess we can test the new Preloader together with the updated TZ. @tsynik do you want to try the new PL/TZ, together with a 6.2.7.6 rom for safety? ;)

In case the PL breaks the unlock somehow (could be that the PL won't boot the vulnerable LK / LK payload), we can switch back with kamakiri/shorting method, as we know already that shorting was possible even for sticks running 6.2.7.3. Isn't it?

Maybe the newer PL/TZ combination could help to avoid the LICENSE_ERROR at 4k content, someday in the future...!?
[Fire TV Original Android Development] tsynik:
I don't have Prime and outside US so can't test this case.

I've done last 4K sticks unlock prior to 1st boot and update to 6.2.7.6 in OOBE cycle, so can't be 100% sure, it's no way to check which preloader was flashed out of the box ;-) But it's definitely differs in boot behaviour than kamakiri bundled one (protocol mismatch error in kamakiri on every boot).
[Fire TV Original Android Development] Sus_i:
Ok, I see. Thank you.

Anyway, a test of an up-to-date PL isn't important, since the old TZ works still fine together with the old PL. :)
[Fire TV Original Android Development] techville:
Hi,

I have tried this on my fire stick 4K (6.2.7.7) and recieved errors, hoping someone can help ?

I also used this youtube as a guide but follow the process and used the files from this thread

Rebooted into ISO, ran bootrom-setup from extracted kamakiri-mantis-v1.2.zip

I did not recieve the message 'If you have short attached, remove it now' (as in video), only got the 'waiting for bootrom' message and then I attached firestick and got the following error.

Is this because it was not short properly or due to something else ?

Thanks

[2020-12-20 15:04:37.098761] Waiting for bootrom

[2020-12-20 15:09:58.104136] Found port = /dev/ttyACM0

[2020-12-20 15:09:58.136965] Handshake

[2020-12-20 15:09:58.158100] Disable watchdog

Traceback (most recent call last):

File "main.py", line 119, in <module>

main(dev)

File "main.py", line 24, in main

load_payload(dev)

File "/root/Desktop/4k/kamakiri-mantis-v1.2/kamakiri/modules/load_payload.py", line 47, in load_payload

dev.write32(0x10007000, 0x22000000)

File "/root/Desktop/4k/kamakiri-mantis-v1.2/kamakiri/modules/common.py", line 147, in write32

self.check(self.dev.read(2), b'\x00\x01') # arg check

File "/root/Desktop/4k/kamakiri-mantis-v1.2/kamakiri/modules/common.py", line 84, in check

raise RuntimeError("ERROR: Serial protocol mismatch, expected {} got {}".format(gold.hex(), test.hex()))

RuntimeError: ERROR: Serial protocol mismatch, expected 0001 got 0000
[Fire TV Original Android Development] Sus_i:
How old is the stick? When did you buy it?
[Fire TV Original Android Development] techville:
It was purchased in July 2019. Updated to 6.2.7.7 a few days ago.

What does that error mean? I'm unsure.

Thanks