yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] xionbunny:
Well here's the error anyway...https://ibb.co/nBHzY56
[Fire TV Original Android Development] hyperblu:
Another thought... DRM can have hardware security implemented as well. The stick that has license issues, I ran the exploit using DAT0 which could be the fuse that was popped on DRM licensure?
[Fire TV Original Android Development] LuCkyCn:
I used the CLK point to cause the short and I have the same license issue. I don't think it would be the cause of the issue.
[Fire TV Original Android Development] hyperblu:
Then I believe the license issue is being caused by something being changed during the exploit process that DRM apparently checks for. I do know on some phones, they lack something hardware wise that will flag Amazon's DRM and block any HD content delivery. I DO believe Amazon periodically checks bootloader information or something of the sort between DRM authentication. It maybe done by a type of lease (like checking only during ota updates, when registering a new fire device, etc). It could be a one time deal, it could only happen when an action triggers it. The question is "what".

One user (can't remember who) has stated that their license error occured days later. Maybe an action triggered it?
[Fire TV Original Android Development] sogoku_vn:
After unlock and root devices, DRM L1 still there or not and Netflix will FHD 4K or SD due to lack of DRM L1. Thanks
[Fire TV Original Android Development] xionbunny:
I just checked my rooted device and L1 drm is alive and well.
[Fire TV Original Android Development] LuCkyCn:
How to do flash the bin via hack bootloader? I've tried the flash it but it's saying locked hw. Maybe I'm not using the correct hacked bootloader? Any advice would be greatly appreciated

Edit- NVM. I figured it out.
[Fire TV Original Android Development] hyperblu:
Is prime video a system app now? My theory is that the app requests a license from drmmanager which stores the drm license in the vendor image. Perhaps uninstalling prime video (I noticed Amazon made this app permanent) will remove the DRM license for the app as well and a fresh install with Android TV apk version will replace it with valid bootloader/system information and generate a new license going forward?

---------- Post added at 06:26 AM ---------- Previous post was at 06:22 AM ----------

Is prime video a system app now? My theory is that the app requests a license from drmmanager which stores the drm license in the vendor image. Perhaps uninstalling prime video (I noticed Amazon made this app permanent) will remove the DRM license for the app as well and a fresh install with Android TV apk version will replace it with valid bootloader/system information and generate a new license going forward?

I'm thinking changes to the bootloader triggered DRM as keysetid is only good for 50 uses before requiring a new license/updated system info.
[Fire TV Original Android Development] rbox:
Yup, this was exactly it. Thanks for the nudge in the right direction.

I was never planning on removing addon.d. After some more thinking, I think what I am going to try is to patch the kernel to disable verity in my rom and leave everything else the way it is. And try to figure out what went wrong originally so Magisk didn't flash properly when i went to the new version.
[Fire TV Original Android Development] LuCkyCn:
So... I returned the device to stock and updated it to the latest software. After the update was completed, I redid the exploit and the license error is still there. I'm not sure what to do now
[Fire TV Original Android Development] AtoZ0to9:
So, the Amazon license issue. It affects nothing else other than watching Prime? While I would rather it work, I don't use it.
[Fire TV Original Android Development] k4y0z:
It should suffice, if you just delete the verify flag in the fstab in boot.img to disable dm-verity.

Allthough if you edit boot.img and system anyway, why not just add magisk to boot.img as well as the survival script in addon.d? Then it would be a truly "prerooted" ROM and may help clear some confusion about the terminology.

That still wouldn't keep anyone from installing a newer version of Magisk (which would then stick when upgrading the ROM)

Installing prerooted without installing Magisk doesn't seem like a real usecase, so why not just include it?

Of course I would also pledge on keeping addon.d, since it would not just benefit Magisk, but I don't think that was ever up for discussion ;)
[Fire TV Original Android Development] rbox:
I'm seeing this in logcat:

10-18 23:05:59.445 281 1871 D PlayReady3.3: [API] Drm_Initialize in
10-18 23:05:59.445 281 1871 D PlayReady3.3: g_LogFlag = 0
10-18 23:05:59.451 281 1871 D PlayReady3.3: 0 means f_eKeyType(3) has been not cached in TEE: f_cbPRAssets = 0
10-18 23:05:59.451 281 1871 E : [drmkey_ree.c] kb_value = 1
10-18 23:05:59.451 281 1871 E : [drmkey_ree.c]KEYBLOCK_F_PATH = /dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/kb, KEYBLOCK_O_PATH = /dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/dkb
10-18 23:05:59.453 1395 5212 I : T5212: AIVDashFragmentJNI::Java_com_amazon_avod_smoothstream_dash_Mp4FragmentJni_parse: Parsing fragment (size 48277)
10-18 23:05:59.457 212 212 E kisd : keyblock header is not vailded,maybe blank
10-18 23:05:59.459 1395 5211 I AmazonVideo: DownloadRequest downloading http://<SOME URL>.mp4 | {Range=bytes=762605-810881}
10-18 23:05:59.473 281 1871 D PlayReady3.3: 0 means f_eKeyType(1) has been not cached in TEE: f_cbPRAssets = 0
10-18 23:05:59.473 281 1871 E : [drmkey_ree.c] kb_value = 1
10-18 23:05:59.473 281 1871 E : [drmkey_ree.c]KEYBLOCK_F_PATH = /dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/kb, KEYBLOCK_O_PATH = /dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/dkb
10-18 23:05:59.479 212 212 E kisd : keyblock header is not vailded,maybe blank

Looking at kb and dkb, and looking at idme print, my kb partition starts with the bytes that kb shows in the print, but for dkb in the print the first byte is 30 and the rest are 00. In my dkb partition it's all 00. I ran the command you suggested for both kb and dkb. The kb was identical afterwards and the dkb was identical except that first byte. No change. I did find a test app ExoPlayer.apk (https://www.cnx-software.com/2016/1...-vp9-and-h-265-in-android-with-exoplayer-app/). Selecting "Super speed (PlayReady)" under the "Smoothstreaming" menu results in the same type of failure messages in logcat that I see with Amazon content.
[Fire TV Original Android Development] tehlers:
Hi,

I was not aware, that *everything* is part of the boot-Image. I thought we have a hacked bootloader and hacked recovery (TWRP), which is normally in separate partitions? Probably I do not completely understand how the hacked boot sequence works.

Now, the interesting part of this post: Today in the morning I got the update to 6.2.6.6 offered in FireOS -- and guess what: The license_error is gone now (after the update)!

I would normally do the hack now again, but shall I do something before or while the hack -- so we get more information about the root cause of the license_error?

Best
[Fire TV Original Android Development] Sus_i:
I messed a lot with my zenfone some time ago, couldn't pass that cts profile missmatch thing, maybe I take a look at it again. Thank you.

Looks good. :good:

I suppose the shorting point worked as expected?

Take a TWRP backup and dd-ing all emmc partitions to your harddisk. Perhaps the next update drops in a half year or so, at worst ;)
[Fire TV Original Android Development] tehlers:
I will definitely do. :) But before I can use TWRP, I need to do the exploiting and partly flashing (hacked BL, TWRP) and this could already lead to the license_error, so I'll wait until [MENTION=7104332]k4y0z[/MENTION] also has no idea to check before I do that.

I guess, I could always flash back 6.2.6.5 from TWRP, install original boot.img from 6.2.6.5 and redo the update in FireOS to fix the license_error again -- so I don't need to wait for the next update release. But you are right, you never know if amazon only sends you an update once per device.
[Fire TV Original Android Development] hyperblu:
This pretty much confirms that Amazon's servers are checking bootloader data of some sort of license errors disappear after going through in-OS updates. If you flash to the latest and don't allow it to connect, license error.

---------- Post added at 12:12 PM ---------- Previous post was at 12:04 PM ----------

I bet Amazon is seeing software version mismatch. They are recording what version you're at at the time of updating. If you flash to another update without connecting to them first, it triggers DRM. That means we would have to run the exploit for every software update.

This is why I was saying the rom should be stripped of the proprietary version of prime video and replaced with a generic Android TV version that has to accept a wider range of devices. Prime video "used" to be able to be uninstalled from fireOS. Obviously Amazon added some proprietary restrictions to the app.
[Fire TV Original Android Development] chia4k:
[MENTION=2891328]LuCkyCn[/MENTION] I have same problem . Please help to do the flash bin. Thanks in advance.
[Fire TV Original Android Development] extrem0:
Is it possible to be done by our end? I already did the exploit procedure. I ask this because where I live amazon doesn't support fire tv stick 4k device. I can't use its built-in prime video software because the fire tv stick 4k isn't supported here. Using prime video app on my android phone I can watch prime video just fine. I'm sure doing what you are suggesting would fix my fire tv stick 4k to work with prime video.
[Fire TV Original Android Development] Pretoriano80:
Fixed that myself! There's a problem with the magic version between FireOS 6.2.6.6 kernel modules and the version the kernel compiled from sources.

If you compile from sources, the version will be 4.4.120, while the kernel modules are expecting 4.4.120+ .

Setting "CONFIG_LOCALVERSION="+" in mantis defconfig will do the trick.
[Fire TV Original Android Development] hyperblu:
Theoretically, I would assume it could be stripped from the rom. However in your case, you would probably have to use a VPN service to the nearest country that is allowed to use prime services when using the generic Android TV prime video app.
[Fire TV Original Android Development] tehlers:
I couldn't wait to re-hack the stick. :D

I did:

1. Reuse the exploit to get TWRP running.

2. Directly booted into TWRP made a backup.

3. Checked if license_error occurs: ALL OK!

4. Back to TWRP, flash Magisk-v20.0.zip

5. Checked if license_error occurs: ALL OK!

6. Got root, backuped with dd: boot dkb kb lk logo MISC tee1 tee2

7. Back to TWRP and rebackup everything

So now, I had kb, tee1 and tee2 from before (where the license_error was present) and diff says, that all 3 partitions have changed. So could it be, that there is indeed something in these partitions, which must match to the running system version? The official update-kindle-mantis-NS6266_user_2292_0003054040196.bin has at least "lk.bin", "logo.bin", "preloader.img" and "tz.img" under "images".

Next question is: How do I prevent future updates in unprotected environments? I usually set in build.prop a very high version, so FireOS always thinks it's already on a higher version. But can I mount /system rw? Or maybe bind-mount /system/build.prop via Magisk to a modified file?

Best
[Fire TV Original Android Development] Pretoriano80:
Use a Magisk module to setprop systemless. You can use Magisk's Module Template to build yourself a module.
[Fire TV Original Android Development] alias100:
root

Hi,

Sorry for my bad English, I'm from Germany. After rooting the Stick, i installed Magisk V19.3.zip in TWRP. The Stick was booting to Amazon OS without problems.

Then i updated to Magisk V20.0, now the Stick doesn't boot. Only Black Screen with white Amazon Picture, after a while the Stick reboot and the same.

What can i do now ?
[Fire TV Original Android Development] Sus_i:
Why not pm disable the ota updater?

Just do the unlock again and flash magisk with twrp.
[Fire TV Original Android Development] tehlers:
Because I don't trust it to be really disabled. I had a Fire HD 8-Tablet and I disabled all possible stuff (which was possible without root, including the OTA updater) and the tablet was quite a long time on the old OS version. Then, suddenly it started an update, which seems to have been pushed to the tablet from amazon on a different way. When I saw it, it was already booting on the new version and I was quite angry with amazon -- so I believe it's better to fake a high version, that every OTA channel will not update.
[Fire TV Original Android Development] alias100:
error

I've got an error. I can't post links here :mad:

---------- Post added at 07:32 PM ---------- Previous post was at 07:28 PM ----------

directupload.net/file/d/5611/kaxdf5to_jpg.htm

I'hve made the Update over Magisk Manager ....... Now i know that was a failure.
[Fire TV Original Android Development] Sus_i:
How often have you tried the script?

Did you damage parts on the board?
[Fire TV Original Android Development] alias100:
I've tried ~5 times the script. No, i don't damaged parts.
[Fire TV Original Android Development] Sus_i:
what happens if you run the script without a short on the stick?
[Fire TV Original Android Development] rbox:
Am I correct in understanding that you went back to full 6.2.6.5 stock including flashing the 6.2.6.5 boot manually, then got the 6.2.6.6 update and the Amazon recovery flashed it, and then the license error went away? It's not the extra images in the official 6.2.6.6 bin because I tried flashing that with TWRP and it didn't fix the problem.
[Fire TV Original Android Development] alias100:
Nothing happens, the scipt is waiting für device.
[Fire TV Original Android Development] tehlers:
Hi,

yes, I took update-kindle-mantis-NS6265_user_2157_0002852679044.bin (renamed it to zip) and flashed it via TWRP, which only flashes system and vendor (as I remember). Then I booted hacked BL and flashed the boot.img via fastboot (also from update-kindle-mantis-NS6265_user_2157_0002852679044.bin). So the hack was reverted, recovery was stock recovery again, no hacked fastboot, but the license_error persisted (I originally came from 6.2.5.8 and I assume, that my other partitions like kb or tee[12] therefore didn't match 6.2.6.5). But today in the morning I finally got the message in FireOS to update to 6.2.6.6 and after updating the license_error was gone.

Since all partitions I had a backup (which is only kb and tee[12]) now differ, I assume that there is something done with these.

Best
[Fire TV Original Android Development] Sus_i:
ok, thats good.

Just wait for [MENTION=7104332]k4y0z[/MENTION]
[Fire TV Original Android Development] chia4k:
Please help How do you flash boot.img via fastboot I've tried the flash it but it's saying locked hw using PC.
[Fire TV Original Android Development] Michajin:
no, you don't. if you want to verify it is there..

adb reboot recovery
[Fire TV Original Android Development] vanzan:
Looks like I must have done some damage to mine. Trying to use the remote today and it either doesn't respond or makes loads of clicks together. Not blaming anyone as I knew the risks but just to caution folk.
[Fire TV Original Android Development] Michajin:
try another remote... i scratched the heck out of mine and shorted everything on the board during testing... i have (4) complete without issues....
[Fire TV Original Android Development] Pretoriano80:
Hmm, mine looks a bit different than the photo from OP, so i wonder if it will still work...
[Fire TV Original Android Development] mrblack1134:
was going to post the exact same thing :)

Just popped the heatsink and I too have a sandisk, and also DAT0 and CLK are under the quarter round "notch" ... the only point I could potentially reach with a hairpin (clipped to ground) would be CMD, if it's the same as in OP's picture (ie. right side of 3rd component from the right at the bottom of the chip).

Has anyone got it working by shorting this point? is it safe to assume it's the same point as in OP's SEC 819 etc. memory chip?
[Fire TV Original Android Development] k4y0z:
Yeah, the points are a bit hidden under the "notch".

It shouldn't really matter what manufacturer the EMMC is, the basic layout should be the same.

Mine is a sandisk as well...
[Fire TV Original Android Development] Sus_i:
Yeah, that's a similar chip.

I've shorted always the third one in that row, on the picture called CMD, works fine for me :good:

I didn't touch that one under the shield.
[Fire TV Original Android Development] vanzan:
Yeah tried a different remote. Also tried the suspect remote with a Fire Stick 2 and it worked fine.

Things are OK with the Fire Stick 4K when I'm up close but far away the remote seems to lose connection a lot. The other remote on the other Fire TV works fine at the same distance. I guess I did some damage to the bluetooth or something....

I have a Skynix with that little notch. I bent it back in order to get at DAT0. Ended up shorting CLK though.
[Fire TV Original Android Development] vanzan:
Could someone check something for me please? I'll attach a photo and could you tell me if the part I have circled is exposed like mine is? Because I had a small fine piece of steel that like an idiot I mislaid and I'm wondering could its absence be the cause of my bluetooth issues? Could be barking up the wrong tree altogether as I'm out of my comfort zone here.
[Fire TV Original Android Development] iLLNiSS:
Thanks for this info, it boots into TWRP fine. I shouldn't have ignored you last time I thought that would only work at the flash screen that shows up after the initial hack.
[Fire TV Original Android Development] Sus_i:
Nope, that is covered by a small piece of silver something, maybe steel, idk.

Don't think that this can cause bt issues. Have you checked for a remote update in settings?

Edit: Hmm, don't know why, but my small silver something is gone.

Edit2: Found it, it's sticking at the tape on the shield. On an another stick it's in place.

Edit3: Tried to investigate that, seems that the manufacturer sometimes paste that shield into the slot.. and sometimes above on the heatshield . It doesn't matter at all.
[Fire TV Original Android Development] Pretoriano80:
Yep, worked just fine for me too, easy and painless.
[Fire TV Original Android Development] vanzan:
You were right it was a software issue. I'm a prize wally. I had updates blocked all along by means of Pi-Hole DNS. After I performed the exploit the Stick somehow updated itself to the latest FireOS. I was getting loads of Fire Remote update notifications and then did a factory reset out of panic.

Anyway thank you and I don't have to buy a new 4K Fire Stick.
[Fire TV Original Android Development] bilitte22:
It is still advised to block Ota.

Can you tell us how to disable Ota update on the fire tv stick 4k after a successful root.

And since there is no superuser installed how can this be done.
[Fire TV Original Android Development] sconnyuk:
Absolutely fantastic ! Thanks very much for the continued effort.

I've had a 4k stick in my draw for months that I bought in a job lot and won't go past setup screen, suspected blocked by Amazon.

Now we have TWRP is there anyone kind enough to upload a backup made in TWRP for me to restore toy stick (thus bypassing registration screen).

This way around worked fine for a 2nd gen stick I had that was the same suspected blacklisted.

Can anyone help ?

Thanks.
[Fire TV Original Android Development] tsynik:
You guys rock! Unlocked without issues. Rooted with Magisk 19.3.

Note: in my case, correct pin was left side of 3rd smd component from right.

Heatsink can be easely detached with flat screwdriver (just rotate it in points as on the picture)
[Fire TV Original Android Development] tsynik:
ota can be disabled with root by following commands:

adb shell
su
pm disable com.amazon.tv.forcedotaupdater.v2
pm disable com.amazon.device.software.ota
pm disable com.amazon.device.software.ota.override
[Fire TV Original Android Development] bibikalka:
Try to rename the offending setup apk in twrp, so it's not blocking you! It's one of apks in /system/priv-app
[Fire TV Original Android Development] retarded1:
What can you do with this. Is the any custom ROMs or anyway to debloat.?
[Fire TV Original Android Development] sconnyuk:
Thanks for the reply, have you any idea on which one in system/Priv is the offender ?

There are alot in there and I wouldn't know which to disable.

Appreciate your time.

Thanks.
[Fire TV Original Android Development] extrem0:
Actually prime video is supported here, but it won't work with the built-in prime video app in fire tv stick 4k. I'd have to strip the built-in app and install a generic android tv prime video apk. I tried to sideload it using Apps2fire but it didn't work. Maybe it should be stripped from the rom indeed.
[Fire TV Original Android Development] tehlers:
then you are not in the hacked BL (or hacked fastboot), but in the stock fastboot. You need to boot TWRP and then go to reboot and there choose "hacked BL".

And if you have the problem, that in hacked BL the stick is not recognized (lsusb does not see any device in hacked fastboot behind OTG), then select with OTG cable in TWRP "reboot to hacked BL" and then immediately pull the power cord, reconnect the stick directly via USB (without OTG) and then the stick boots the hacked BL without OTG-stuff in between and you can flash the boot.img.
[Fire TV Original Android Development] chia4k:
Thank you for reply . Is is needed to connect to USB PC ? when I choose to hacked BL then ADB can not connect and fastboot with waiting for device message. Please help with detail instruction . Thank you again
[Fire TV Original Android Development] tehlers:
See my edit above. I had this problem, too. The hacked BL does not seem to like OTG stuff.
[Fire TV Original Android Development] alias100:
Ok. I'll be wait.
[Fire TV Original Android Development] chia4k:
Thank you very much I am able to flash boot image. No more licence error after update to 6.2.6.6 FW
[Fire TV Original Android Development] alias100:
Gpt-fix doesn't work. It means, device error. Flashing GPT only 1/34
[Fire TV Original Android Development] Sus_i:
Why you tried the gpt-fix? :confused:

Do you had errors like 'whats wrong with your gpt?'

I said just wait for [MENTION=7104332]k4y0z[/MENTION]
[Fire TV Original Android Development] LuCkyCn:
Use a mouse with OTG Y Cable. You'll need a mouse to access the HackedBL in the "reboot" section of the TWRP recovery.

-When you select the HackBL, you're going to want to quickly unplug the Y OTG cable and directly plug it into your computer as a direct access. (I couldn't use adb with my Y OTG cable)

-You're going to want to flash the boot.img from the stock.bin as mentioned in the post. (Go back a few post to find the link, download it and change the bin to zip and extract the boot.img)

------Make sure you flash the stock.zip first in TWRP before you flash the boot.img

- Use ADB via HackedBL (Fastboot flash boot boot.img)

- Make sure you factory reset when it's all completed.
[Fire TV Original Android Development] alias100:
I'm now in TWRP again. I think, i need a Image from the OS.

Where i can find an Image ?
[Fire TV Original Android Development] rbox:
/system/bin/amzn_drmprov_check should report the status of the DRM keys. If you use adb shell and then run su, you should be able to run it and have it report status on the DRM keys.

For people with working Prime, I'm assuming it's not going to report any errors, and people with the LICENSE_ERROR i'm assuming it does report errors? I get failures on mine.
[Fire TV Original Android Development] rbox:
I don't really know anything about Magisk. How do you do this?
[Fire TV Original Android Development] tehlers:
Working prime:

mantis:/ # /system/bin/amzn_drmprov_check
Unable to retrive DRM key [devicecertificate.dat] ID [14]
Unable to retrive DRM key [amazonprivblob.dat] ID [15]
Unable to retrive DRM key [devicecertificate.dat] ID [14]
Unable to retrive DRM key [amazonprivblob.dat] ID [15]