yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] BeAtSs:
Pretty high chance these are refurbished sticks that are patched. I have 2 of them here now, both show nothing when shorted in lsusb and both have a little green mark on the chip. Probaly an indicator they have been patched.

Something else, does anyone know if we can pull the Firetv device cert via adb? Where are the client certs stored in Android?
[Fire TV Original Android Development] emkorial:
I am on 6.2.6 so this could be the case.
[Fire TV Original Android Development] emkorial:
When I flash 6.2.7.7 the Stick will not get past the Boot screen (the white screen with the yellow "Fire" and arrow on it) it just sits there forever. Any ideas how to fix that?
[Fire TV Original Android Development] Sus_i:
At the white screen adb is aviable, if you power the stick with a PC usb port.

You can use adb logcat and take a look whats wrong.

Best is to run this: adb logcat > 6277.txt

The stick will print the whole log constantly in that file.

Open it up with a txt editor and investigate.

If you see something suspect, use search and filter options of the editor.
[Fire TV Original Android Development] emkorial:
I'll give that a try thnks

One more thing, I know when flashing ROMS on rooted Android phones you are supposed to wipe a bunch of stuff (like /system) before you flash the new ROM. DO you need to do that in the Fire Stick? If you just reboot into recovery and do the twrp flash of the new ROM, is that a totally clean process? I want to make sure any "upgrades" that 6.2.8 installed don't persist through the flash of the lower version ROM
[Fire TV Original Android Development] Sus_i:
TWRP flashs only full images of system, vendor and boot and yes, thats clean.
[Fire TV Original Android Development] emkorial:
Cool thanks. I will post the logcat of 6.2.7.7 once I get it. Appreciate the help
[Fire TV Original Android Development] T3ch_@advanced:
I really hope that howto comes as soon as possible my friend. It would really help a lot of people. Including me.
[Fire TV Original Android Development] emkorial:
Just download the apk and sideload it. It does everything else for you

Launcher Manager 1.0.7 | TechDoctorUK

www.techdoctoruk.com
[Fire TV Original Android Development] h3ct0rx:
Is there any chance to unlock an old 4k fire stick recently updated to 2.6.8.0? Previously was 2.6.7.7 and now it has the dark boot screen.

Edit: After making the short the output of 'lsusb' is 1949:03a8 Lab126, Inc.
[Fire TV Original Android Development] kurpiq:
hi i have VM180

and everytime when i try to short i have error with

but still when it's shorted it's not booting up and showing as:

Bus 001 Device 045: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader

so it's have to be well shorted... why it's not working
[Fire TV Original Android Development] Sus_i:
It isn't well shorted, if it shows Preloader...

Well shorted shows mtk phone or in case of a patched stick just nothing.
[Fire TV Original Android Development] BeAtSs:
So I have new stick since today, bootrom unlock worked. I flashed TWRP and installed Magisk, but the last step is getting root with su, for that the device needs to be discoverable through adb.

But I unlocked it out of the box, so it was not configured yet.

If I flashed TWRP and installed Magisk, is it safe to let the stick go through the whole update process? And then enable ADB Debug in settings. Can anyone confirm? Thank you
[Fire TV Original Android Development] Sus_i:
Yes. About two weeks ago, that worked just fine for me...
[Fire TV Original Android Development] BeAtSs:
And it updated to 6.2.8 for you?
[Fire TV Original Android Development] Sus_i:
6.2.8.0
[Fire TV Original Android Development] emkorial:
Yes, this is the exact process I went through.

New Fire Stick out of the box, never updated

Unlocked bootloader, installed TWRP

Plugged in Fire Stick, let it self update all the way to 6.2.8.0

Went into Developer options, enabled ADB debugging

Connected to Fire Stick, flashed older ROM (currently running 6.2.6.6, going to go to 6.2.7.1 soon)

Where did you buy an unlockable stick?

I will say, based on my condition and what I am experiencing I am not 100% convinced that the downgrade is completely "clean", in that some app's, even using identical versions of the apps, that caused me no visual issues pre 6.2.8.0, ARE causing me issues after the upgrade and downgrade process. So I'm not completely convinced the downgrade process is 100% "clean". But my issue could also be caused by minor hardware difference between multiple sticks, so the fact I am having symptoms is not conclusive evidence that the downgrade is not clean.
[Fire TV Original Android Development] 47M4RZ:
Good day all

I'm trying to follow the steps to get my Fire TV Stick 4k out of the boot loop (also picks up as unauthorized in ADB)

When I boot the ISO mounted to flash drive from the bios boot menu of my windows laptop this is what I get:

Then...

I'm I on the right track?

Kindly assist me. I'm trying to follow steps 1 to 4; I should be okay from there onward.
[Fire TV Original Android Development] 47M4RZ:
UPDATE: Ran the ISO via VM and got it to work.

I also get the exact same error as this.

Note: My firestick is a day old. It's stuck in a boot loop after installing google services framework, play store etc.

I'm pretty sure I'm shorting it properly but will continue to try and update you on my progress.
[Fire TV Original Android Development] 47M4RZ:
To add, I distinctly remember, turning USB debugging on in dev mode before I got jammed.
[Fire TV Original Android Development] 47M4RZ:
Okay, conclusion. It turns out I have one of the devices with DL mode disabled. Tough luck. Should have gone with the Chromecast with Google TV...Smh mxm
[Fire TV Original Android Development] JohanVincent:
Yeah maybe Chromecast is a better product, IDK. But I did go through and debloat the FireStick and then used Wolf Launcher. I was in the same boat as you a few weeks ago but Wolf Launcher is much nicer than the stock launcher.
[Fire TV Original Android Development] tokoam:
you cannot root the google tv with chromecast .
[Fire TV Original Android Development] tocUK:
"Firesticks running FireOS 6.2.8.0+ are now blocked from this exploit."

This should be in the OP .. this would have saved me a lot of time, With so many posts and pages to the thread took a while to drill this simple info out. Hope this helps someone else.
[Fire TV Original Android Development] lasauce22:
Yes exploit now patched, i have buy 20 fire tv stick from different place and all are patched =(

EVERYBODY DON'T WASTE YOUR TIME TO TRY ROOTING FIRE TV STICK 4K, IT IS NOW IMPOSSIBLE !
[Fire TV Original Android Development] Gsharpshooter80:
Hey, not sure if this could be of any use to get around forced OTA updates at registration point but figured I'd run it by here anyways. I noticed the hidden Dev Menu can be enabled before registering and there's a proxy network tab that can be accessed. Can that be of any use to block OTA's? To access the hidden menu hold select button followed by holding the down button together for 3-4 seconds and then quickly let go of both and hit the hamburger menu (button to the right of home button) and the dev menu should pop up
[Fire TV Original Android Development] Bertonumber1:
Yes!! Good find.. Whilst I'm not sure about proxies.... It Should maybe let one enable developer options to then enable usb debugging which ofc will let the user run pm disable commands for ota updates @0815hoffi? What you thinking?

ie

pm disable com.amazon.device.software.ota.override

pm disable com.amazon.device.software.ota

pm disable com.amazon.tv.forcedotaupdater.v2

(these commands sometimes need alteration of -- user 0 or --user com. Xxx)

II would say you've done well there mate but it may well be that disabling updates at this point will cause the stick to crash or reboot in search of the ota file. Idk

Regards
[Fire TV Original Android Development] Bertonumber1:
NOTE: There have been multiple reports of devices with serial numbers containing VM190 or higher being shipped with DL-Mode disabled in BROM.

These devices cannot be unlocked using kamakiri.

These devices do not show up at all on USB when shorted.

It's there right at the top of the OP and has been for some time loud and clear

Regards
[Fire TV Original Android Development] Bertonumber1:
It's in the software/rom thread not here in the hardware/exploit thread.

Use the search function it works rather well and will save you time in future.

Also, reading the threads and various posts expands your knowledge ;)

Regards
[Fire TV Original Android Development] Gsharpshooter80:
So I noticed Developer Options as well but when I turned it on it showed 2 more option tabs underneath it and none of the options were for ADB Debugging. However one of them has a off/on slider for an option called "developer row" which seems to detect application packages installed on the device. Not sure if it's of any use or not but anyone can access this Dev Option menu on any device whether they are past registration screen or not and you can mess around with it yourself.
[Fire TV Original Android Development] tocUK:
wow, I never asked about hardware revisions as this points out, I suggest you re-read what you quoted.

If this was as you suggest the wrong thread for this info then why would you suggest searching it, secondly the info is in the thread (as it should be) so would be obvious to add this important info to the OP for the same reason the with hardware revisions/serial numbers have been added as times have changed since the OP. The blowing of the efuse via software update has affected the hardware thus ability of this exploit to work (to date) regardless of original serial number/hardware revisions.

More importantly your post has just created more filler making harder for people to find the correct info. 🤦‍♂️
[Fire TV Original Android Development] Bertonumber1:
Thank you for your kind words in these difficult times.

Regards
[Fire TV Original Android Development] darksavior:
I previously had this rooted with recovery. I made the mistake of updating magisk and my 4k stick now boot loops the white fire tv logo. I don't get the option to boot to twrp with otg anymore. Adb does not see the 4k stick. It was on the latest version of fireos. I think 6.2.8.0.

I'm booting off the fireiso2.0 usb stick to macbook.

4k Stick is directly connected to macbook.

Is there a trick to get it to recovery?
[Fire TV Original Android Development] Skel40:
Is the latest version of the os stock or prerooted? If it's stock, you're out of luck because the efuse is triggered to disable the brom unless you unlocked it before it got blown. Don't hesitate to try running the exploit again to try again if that makes any sense.
[Fire TV Original Android Development] darksavior:
It was originally a prerooted rom found in this forum but it updated to the latest stock version which I then rooted again with magisk. Updating magisk from fireos really hosed the bootloader.

I decided to crack it open again and short the point to redo the process. Success. I'm back in twrp.
[Fire TV Original Android Development] Skel40:
Perfect!!! At least we know what the issue was just in case it happens again by accident! I was worried myself that it was going to be in a bootloop forever. You should be fine. When it bootloops after installing Magisk with FireOS it doesn't relock the bootloader because it's still unlocked in the process so messing up by accident is alright in some situations! Make sure to keep the 4K unlocked and you'll be safe
[Fire TV Original Android Development] xoxo_xdagirl91:
Had my 4k firestick for awhile and realized it updated itself to 6.2.8.0. Never got around to rooting it. Is it too late for that now? The recent comments in this thread have kinda confused me on wether or not I can so I just want to make sure
[Fire TV Original Android Development] emkorial:
Yes it is to late now. The only way to root the device is to get a device that has:

A - Not been patched

B - Not been upgraded to 6.2.8.0

Whether or not a new method to root will be discovered, who knows.
[Fire TV Original Android Development] Bertonumber1:
Just to clarify for anyone else in the near future (and save people time reading through threads)

If you purchase one of the Firestick 4K 2020 models with serial number VM190 or higher....

OR

You have been sitting on top of an exploitable (but never before unlocked) mantis 4K firestick that happens to take the 6.2.8.0 ota update.

You will NOT be able to Unlock/Root the device at this time.

Regards
[Fire TV Original Android Development] emkorial:
Thoughts on another exploit method being discovered that would work?

Could the chip with the efuse in it be identified and possible replaced?
[Fire TV Original Android Development] The Fume:
so do these need to be setup on an account BEFORE unlocking them and installing twrp? i saw this on another website where they say you must set them up before doing so. i bought a few backups based on serial numbers (and got lucky they all were easily unlocked) and went ahead and unlocked them and installed twrp but have yet to use those i put them back in the box's in case i need them later on. but now i saw this other site saying they need to be setup first? but if i go ahead and set them up they will update then not be able to be unlocked?? hope i didnt hose 4 new ones by doing it first. thanks for any help
[Fire TV Original Android Development] The Fume:
so reading more through this thread it seems the proper way is to unlock it before doing anything at all. then do whatever u need to after that since the bootloader remains unlocked even if you let it update at that point. am i correct here?
[Fire TV Original Android Development] soolcio:
Hello :)

I am kinda new to Fire Stick (hopefully not to android and rooting in general) and I would like to root it.

I bought my FireStick 4k about 2 years ago and since then the box has never been opened nor the stick was powered on. It put it in my drawer and I forgot about it. According to the first post my stick should be rootable (it definately has some old fw version and the serial number is VM139...)

I went through this thread (77 pages of posts) and I am still unsure if I get everything right.

Could you please guide me what to do next, I do not want it to OTA to 6.2.8.x to blow the fuses.

What are all the steps to unlock it, register it and avoid to obtain the OTA root patch.

Thank you for your help :) I would like to do it right and not break it and lose the ability to root the device.
[Fire TV Original Android Development] Sus_i:
Yes, thats right...
[Fire TV Original Android Development] Skel40:
Do you think Amazon is going to temporarily disable the efuse on the future firmwares as it's on the newer update? Meaning aren't they going to re-enable with for example, the 5th os update on the interface? Or is it permanent after it's triggered? This is out of curiosity
[Fire TV Original Android Development] The Fume:
once an efuse is blown its done. you can not go back. and i would guess that even if they release a new update and you are on an older one even if you skip over this current one to say update to like 7 (if it ever comes) it will still blow the efuse going forward.
[Fire TV Original Android Development] Skel40:
So no alternatives at all then? I'm sure glad I kept my 3 4K's unlocked beforehand
[Fire TV Original Android Development] Michajin:
no, only issue may be trying to downgrade. the update doesn't relock it. i flashed 6.2.8.0 and still have total unlock and root. You can install earlier than 6.2.8.0 and still downgrade. You didnt need to set up to unlock them though.... The unlocking causes a factory reset at minimum....
[Fire TV Original Android Development] The Fume:
i meant if you update PRIOR to unlocking it only. if you updated already then you are stuck. not after unlocking
[Fire TV Original Android Development] rateo:
yes, I unlocked and rooted out of the box and it remained that way even though it updated during first setup. Downgrade probably wouldn't be possible, but I dont need it because everything works this way
[Fire TV Original Android Development] Bertonumber1:
Hey There ,

Not necessarily , if youre unlocked/rooted already you should be okay.... you can use twrp/adb to change or disable the OTA apk state. There are a few ways to get around this . download rbox prerooted 6.2.8.0 and if the OTA isnt disabled then adb shell pm disable ota immediately is probably best option.

Regards
[Fire TV Original Android Development] emkorial:
Take device out of box

Root it per the guide

After that you are fine. When you plug in the device it will update all the way up to the latest version but since you are already rooted, it will not blow the eFuse.

Once it is all updated you can flash whatever you want and disable updates
[Fire TV Original Android Development] emkorial:
Theoretically if we could identify the chip that has the eFuse in it, and a source to buy that chip, you could buy a new one with an intact eFuse, desolder the chip on the stick, and solder in your new one.
[Fire TV Original Android Development] subhash_india:
For downgrade to work correctly

Flash FM (below 6.2.8.0)+Kamakiri+Magisk+Aftv-mm(opt) and reboot
[Fire TV Original Android Development] Conti93:
So, I have bought a new Fire TV Stick S/N G4N0VM071 etc, etc, and of course it's locked.

I mean, I didn't try unlocking it BEFORE turning it on at all, however the only thing I did was powering it on and verifying it was working, WITHOUT connecting it to internet (I stopped at the network selection screen). It said "update in progress", I guess that was a local update. Mmmh, who knows if that's what locked it or it comes already locked from the factory.

Anyway, since I had to rework a couple of tiny ass BGAs in my life:

I was wondering if someone managed to desolder the flash and stick it on another board, would it be readable or is it encrypted?

That would be quite inconvenient, but it would work nonetheless to write the custom recovery in the flash.
[Fire TV Original Android Development] Sus_i:
Can you take a detailed picture from the board with the flash removed, please?

It's readable, not encrypted at all. :)

You may be able to do almost all steps from the OP scripts, like downgrade LK, TZ and PL images to the exploitable version, flash boot and recovery images and so on, but in order to boot the downgraded images, you need to zero out the RPMB too (take a look into the main.py from OP).
[Fire TV Original Android Development] Conti93:
That's good news.

Sorry, the BGA in the photo is a Sony Effio of a FPV cam 😅

The Fire TV Stick flash looks like this:

The "hard" part now is finding, ideally, a ZIF socket for the flash and something that can read it, I never had a look at a "flash reader" or something similar, if it does exist.
[Fire TV Original Android Development] Sus_i:
Yes.

Would be great if you can take a picture from the Sticks mainboard with the flash removed. Maybe helpful sometimes, in order to trace the wiring of CLK, CMD and DAT0 on the board...

You can solder a few enameled copper wires to the CLK, CMD, DAT0, Vcc, VccQ and GND pads. ;)

Here is a propper tool for r/w the chip:

Interfacing with e-MMC Storage Devices - Exploitee.rs

www.exploitee.rs

Some old root guide for the first gen. fireTV stick ever:

Amazon Fire TV Stick - Exploitee.rs

www.exploitee.rs

Won't work nowadays because of androids dm-verity.
[Fire TV Original Android Development] Conti93:
Oh! It's an e-MMC! I'm dumb. I made practically the same thing when I bricked my 3DS in 2015.

Thanks for the info, I'll probably buy another stick and desolder the eMMC on that, I'll keep you updated :)
[Fire TV Original Android Development] Conti93:
Wait a sec, I didn't catch that, since Mantis has Android 7 (hence dm-verity enabled?) does that mean it won't work by manually writing TWRP on the eMMC?

EDIT: Oh, you were referring only to the rooting procedure, correct? TWRP should work without major issues, right? 🤔
[Fire TV Original Android Development] Sus_i:
The rooting procedure via eMMC adapter used for the first gen. fireTVstick won't work on a later android (dm-verity).

Ofc you can access the eMMC partitions, flash whatever to it, but the early stages of the bootprocess (LK) won't boot TWRP in case the bootloader is locked (it starts only factory signed images).

Only if you are able to do all unlock steps from OP (including the stuff from inside the kamakiri.zip.), only then TWRP recovery or a patched Boot.img will boot.

The biggest hurdle is obviously the downgrade of the antirollback protection a.k.a. RPMB (Replay Protected Memory Block)... without a downgrade you can't finish the unlock from OP. Take a look into the main.py to see how it works.
[Fire TV Original Android Development] jack4455667788:
Ok, the main page (OP) does NOT say that any firestick 4k that has 6.2.8.0 (or above) installed cannot use this rooting method... Shouldn't that be changed?

I understand the efuse prevents downgrading, but my questions are :

1. What happens if you try this rooting method with an old (compatible?) firestick 4k that has the latest OS installed (like mine :()?

2. Has the efuse prevented the mediatek cpu from going into "dfu" mode, or just disabled downgrading?

Thanks!
[Fire TV Original Android Development] Sus_i:
The efuse disables only the bootrom (mtk phone) mode.

Nothing happens.

Yes, thats it, MTK phone mode gets disabled, which blocks the bootrom exploit from OP.
[Fire TV Original Android Development] nomobytes:
Latest stock firmware download -

(NS6281/3385)

https://d1s31zyz7dcc2d.cloudfront.net/2505e32d634eb38b303e08b3341b0140/update-kindle-mantis-NS6281_user_3385_0005604456836.bin

There may be issues with streaming some protected content after flashing this (followed by Magisk) from TWRP. I had problems with Netflix hanging so I reverted back to stock 6280/3236 on my unlocked, rooted device
[Fire TV Original Android Development] nomobytes:
Has anyone else encountered issues with the 6281/3385 stock firmware?
[Fire TV Original Android Development] mposadzy:
6281 is toxic no more Netflix or Prime watching
[Fire TV Original Android Development] Skel40:
That's why keeping your 4K on 6.2.7.7 is important. Amazon seems to screw things up when it comes to software updates. There's no changelog to what's fixed or not. Ever since 6.2.8.0, my apps have been buggy with a few more issues as well.
[Fire TV Original Android Development] nomobytes:
Consider that TWRP blocks the critical partitions from being flashed. This was a problem when TZ required an update to fix license issues and was addressed in the kamakiri-mantis-v1.2 release, after an exhaustive analysis. See posts #400-416.
[Fire TV Original Android Development] Pretoriano80:
The problem is that if updating TZ is mandatory on newer updates, that would be more complicated that it was in the past, because we also have the e-fuse thing now.

However, there's still no kernel sources for the new updated, so maybe it's still experimental, who knows...
[Fire TV Original Android Development] nomobytes:
Actually, the entire device freezes and then restarts after about a minute, so it's not clear which partition(s) need to be updated/modified.
[Fire TV Original Android Development] Sus_i:
I thought the problem is something about DRM, playback issues with prime and netflix?

@Pretoriano80 Any changes in the efuse script in 6281?
[Fire TV Original Android Development] Pretoriano80:
I had only a quick look at ramdisk and system image and the e-fuse script looks the same.

I would have to check the new system image against the previous one, but if something changed at lower levels, than it's not easy ro track it down.
[Fire TV Original Android Development] nomobytes:
The freeze and subsequent restart is triggered by attempting to play DRM material. I just wanted to clarify the behavior.
[Fire TV Original Android Development] Sus_i:
I see, Thanks.

Whats the resolution of your TVset? 4k?

Can you test/try this modded stock rom with your setup?

https://xdaforums.com/t/fire-tv-stick-4k-6-2-8-1-old-ui-mod-port.4298357/

It will use the same TZ image, but with the old UI...