[Fire TV Original Android Development] DanielF50:
You could possibly write all of this information back to the IDME temporarily (I think it clears after a full wipe/reset).

eg, if I used:

adb shell
su
idme mac_addr A12B3C445D6E

"idme print" would return:

mac_addr: A1:2B:3C:44:5D:6E

You could do this for every parameter and it MIGHT boot to FireOS, but I'm not 100% - see below.

---

Stock IDME data is as follows

:

board_id: 0024001040000015
serial: redacted
mac_addr: redacted
mac_sec: redacted
bt_mac_addr: redacted
product_name: 0
productid: 0
productid2: 0
bootmode: 1
postmode: 0
bootcount: 0
manufacturing: PSN=8101redacted
eth_mac_addr: redacted
device_type_id: A12GXV8XMS007S
unlock_code:
sensorcal:
4800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
wifi_mfg: 62760002000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF37D89FC0FF7FFD9BFFFFFFFFFFFFFFFFFFFF22FF0020FFFFB101000000000000FFD700000000000000000F0000000000000000BA840C220000008310220000007A061C00007A071E0000780A1E00007E051E000076181E0000751F1E0000790A1C0000790E1F00007B091E000077171E00007E0A1E000079151E00000000C3C4C4C40000C4C40000C4C4000000000000C5C5000000000000000000008383FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000FFFFFFFFFFFFFF
bt_mfg: 00004676620160002310000007800006059003401f401f00048000ffffff00000000000000000000000000000000000000000000000000000000000000000000
KB:
4b 42 50 46 b8 13 00 00 c8 13
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
DKB:
30 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
dev_flags: 0
fos_flags: 0
usr_flags: 0

---

NOTES:

"serial" - you may be able to find your serial somehow (create backup in twrp? I don't know), or you can just make one up. These always start with "G070GV" and are then followed by 10 alphanumeric characters in the order 00000000AA OR 000000000A, for example "012345678A" or "01234567AB" would turn into "G070GV012345678A" or "G070GV01234567AB" - just make it up. Amazon pulls this from somewhere other than the IDME, which is how they can block stolen/blacklisted devices.

"mac_addr, bt_mac_addr & mac_eth" are all regular length MAC addresses (12 characters) - just make something up, as above.

"mac_sec" is always a set of 20 alphanumeric characters in a random order - I don't think it makes a difference on what this is set to (eg: AB12345CDE6789FGH012)?

"manufacturing" always starts with: " PSN=8101" (note the space infront of PSN!) which is then followed by 8 alphanumeric characters in order sequence 0000000A OR 000000AA OR 00000AAA (for example, these ones I just made up: 8473833A, OR 847383AF, OR 84738AFE) so the full data entry would be something like "PSN=8101847383A" or "PSN=810184738AFE" but I am also unsure if this matters what this is set to.

---

As you are going to need to rewrite most of this information to your IDME, the commands would consist of:

---

Long post, but maybe it will help you out.

---

EDIT 30/11/21: I have now attached a

BLANK

IDME backup

.bin file.

You will NEED to download & edit this file with a HEX editor (thanks @Sus_i!), add all your own parameters (see: #NOTES above) & after doing so, you can then place "boot1.bin" on the sloanes internal SD card (adb push while in twrp) or external SD card (copy via pc, then mount in twrp). Finally, you can then run the below commands to write it to the correct partition. This should then stick after a factory reset too, hopefully.

If you do not edit this file, your serial/MAC address's/mac_sec/psn will all be "00000000" and will probably wont work.

To dd flash this bin file to your device (once edited), run these commands in shell via usb/network or twrp terminal:

echo 0 > /sys/block/mmcblk0boot1/force_ro

If boot1.bin is on internal SD:

dd if=/sdcard/boot1.bin of=/dev/block/mmcblk0boot1

If boot1.bin is on external microSD:

dd if=/external_sd/boot1.bin of=/dev/block/mmcblk0boot1

Obviously just reboot after running this command, and the new IDME should have been written to boot1.