yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Rortiz2:
Unbricking / Unlocking with non-rooted Firmware

Prepare the environment, disable modemmanager and install the required packages:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

NOTE: If you use this method to unlock the device you don't need to flash the unlock-zip linked in the first post (OP).

If FireOS is still accessible there are other means of recovery, don't continue.

If your device shows one of the following symptoms:

It doesn't show any life (screen stays dark)

You see the white amazon logo, but cannot access FireOS.

If you have a Type 1 brick, you may not have to open the device, if your device comes up in bootrom-mode (See Checking USB connection below).

Unplug the device from the wall

Start bootrom-step.sh

Plug in the power source and then the USB

NOTE: If you have issues running the scripts, you might have to run them using sudo.

Also try using different USB-ports (preferably USB-2.0-ports)

1. Extract the attached zip-file "amonet-sloane-v1.1.zip" and open a terminal in that directory.

2. Start the script:

sudo ./bootrom-step.sh

It should now say Waiting for bootrom.

3. Connect the USB A-A cable, short the board according to the picture (DAT0 with GND), and connect the power supply.

4. When the script asks you to remove the short, remove the short and press enter.

5. Wait for the script to finish.

If it stalls at some point, stop it and restart the process from step 2.

6. Your device should now reboot into unlocked fastboot state.

7. Run

sudo ./fastboot-step.sh

8. Wait for the device to reboot into TWRP.

9. Format data and use TWRP to flash a custom ROM, Magisk or SuperSU.

Checking USB connection

In lsusb the boot-rom shows up as:

Bus 002 Device 013: ID 0e8d:0003 MediaTek Inc. MT6227 phone

If it shows up as:

Bus 002 Device 014: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader

instead, you are in preloader-mode, try again.

dmesg lists the correct device as:

[ 6383.962057] usb 2-2: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
[Fire TV Original Android Development] Rortiz2:
Unlocking with ADB + root

NOTE: Please refer to the #2 post on how to prepare your environment before proceeding.

1. Extract the attached zip-file "amonet-sloane-v1.0.1.zip" and open a terminal in that directory.

NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder

2. Enable ADB in Developer Settings.

3. Start the script:

sudo ./step-1.sh

Your device will now reboot into recovery and perform a factory reset.

NOTE: If you are on firmware 5.2.7.3 or newer, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)

If you chose the brick option, you need to continue with bootrom-step-minimal.sh:

NOTE: Please refer to the #2 post on how to prepare your environment before proceeding.

NOTE: If you use this method to unlock the device you don't need to flash the unlock-zip once you're in TWRP.

Once the zip-file finished flashing, disconnect the device and run:

sudo ./bootrom-step-minimal.sh

Then plug the device back in.

The device will reboot to hacked fastboot mode (Static Amazon White Logo + white blinking LED).

Then run:

sudo ./fastboot-step.sh

After that, the device will reboot to unlocked TWRP. Then go to Wipe > Format Data and type "YES".

If you used this method (brick), you're done with the unlock. Skip the step 4.

NOTE: Make sure you re-enable ADB after Factory Reset.

4. Start the script:

sudo ./step-2.sh

The exploit will now be flashed and your device will reboot into TWRP.

You can now install Magisk from there.
[Fire TV Original Android Development] Rortiz2:
There are three options for interacting with TWRP:

A mouse/keyboard via USB

ADB over ethernet/USB

TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html

Via /cache/recovery/command

Example for /cache/recovery/command:

echo "--update_package=/path/to/zipfile" > /cache/recovery/command
echo "--wipe_cache" >> /cache/recovery/command
reboot recovery

If you somehow end in a bootloop you can boot into hacked fastboot or recovery using.

sudo ./boot-fastboot.sh

sudo ./boot-recovery.sh

NOTE: This will only work if the boot-exploit is still there.

Source Code:

https://github.com/chaosmaster/amonet-sloane

https://github.com/R0rt1z2/twrp_device_amazon_sloane

https://github.com/chaosmaster/android_bootable_recovery
[Fire TV Original Android Development] k4y0z:
Reserved
[Fire TV Original Android Development] DanielF50:
Nice to see this released - it's been a while in the making... just glad that me and my multiple sloanes could be of service to the community 😅

edit: obviously Magisk works with a full unlock, but as Rortiz2 states above this must be flashed to boot_x - I would advise you pull your ROM's boot.img, patch it with MagiskManager & then flash this manually via hacked fastboot, otherwise it won't work & you'll probably brick your device again.
[Fire TV Original Android Development] Bertonumber1:
Yeah I'll second that, It works perfect and flawlessly. Be sure to follow the guide to the letter ..... .... It's good to see development continue to make progress on what I would say is the best amazon device of them all.

Well done. All your hardwork is greatly appreciated. @k4y0z , @Rortiz2 , @t0x1cSH, @Sus_i , @retyre , @diplomatic @DanielF50 without you guys continued attention and testing of these sticks/boxes we would be stuck with plain old boring devices.

Cheers again

regards
[Fire TV Original Android Development] Sus_i:
Don't worry, magisk flashing in TWRP works (now). ;)
[Fire TV Original Android Development] Michajin:
Time to pull the Sloanes out of the drawer!
[Fire TV Original Android Development] Michajin:
Ok, so I ran into some issues. I flashed the zip in the pre-rooted TWRP. No errors and reboots into unlocked TWRP. From unlocked TWRP i format data and type yes, then reboot. Now i am at the black amazon fire logo and nothing happens. I think i missed or didnt understand the downgrading part to older than 5.2.7.3. So, i think i have to do the shorting method now? Also, does anyone know where i can find a old version <5.2.7.3 .bin to flash? Is there anyway to get back into unlocked TWRP now?
[Fire TV Original Android Development] 0815hoffi:
http://aftvhacks.de/downloads/rooting/fire-tv-2/sloane-5.2.7.0-rooted_r1.zip

http://aftvhacks.de/downloads/rooting/fire-tv-2/sloane-5.2.6.7-rooted_r1.zip

All here, scroll down

Fire TV & Fire TV Stick Downloads: APKs von Apps & Games

Fire TV Downloads Sammlung von Android Apps (APK-Dateien), die man herunterladen und auf dem Amazon Fire TV und Fire TV Stick 4k installieren kann.

aftvhacks.de
[Fire TV Original Android Development] Michajin:
Thanks, great resource. I am looking for stock though...

" NOTE: Flashing prerooted ROM will disable unlocked TWRP. It's recommended to flash an stock update.bin until that gets sorted out. "
[Fire TV Original Android Development] Rortiz2:
If the zip flashed fine forget about the downgrading part. Are you able to boot unlocked TWRP using boot-recovery.sh?

Here's an stock update.bin: https://d1s31zyz7dcc2d.cloudfront.n...indle-full_sloane-36.6.4.8_user_648594820.bin
[Fire TV Original Android Development] Michajin:
yes, boot-recovery works perfect. That is exactly what I needed thanks!
[Fire TV Original Android Development] Sus_i:
In case someone needs some newer 'full OTA update' packages of the stock rom, only for sloane:

Fire OS 5.2.7.3 (652614020).

https://d1s31zyz7dcc2d.cloudfront.net/7af0a9a31621db60bf48d23e680751d3/update-kindle-full_sloane-36.6.5.2_user_652614020.bin

Fire OS 5.2.7.4 (656638420).

https://d1s31zyz7dcc2d.cloudfront.net/7758ad70f668023cc93ddee2655c6226/update-kindle-full_sloane-36.6.5.6_user_656638420.bin

Fire OS 5.2.7.6 (659654620).

https://d1s31zyz7dcc2d.cloudfront.net/c5b513d2116f5ad2942426ab79bb437b/update-kindle-full_sloane-36.6.5.9_user_659654620.bin

5.2.7.6 is the latest OS (as of today).

Don't forget to rename the file, i.e. .bin to .zip.
[Fire TV Original Android Development] DanielF50:
Oh, awesome news!
[Fire TV Original Android Development] Bertonumber1:
Hey guys, So do users of the new unlocked twrp to only use the clean update.bin files provided by @Sus_i and not the rbox prerooted stock (supersu) roms? Just to clarify for the sake of Magisk clashing with Supersu prerooted firmware incase it throws some nasty surprises.

Regards
[Fire TV Original Android Development] Sus_i:
Next OTA update incoming...

Full OTA update package (latest stock) for sloane:

Fire OS 5.2.7.7 (662663720).

https://d1s31zyz7dcc2d.cloudfront.net/b9f7c8f9a8a4ba1f34da8ce7a8077474/update-kindle-full_sloane-36.6.6.2_user_662663720.bin
[Fire TV Original Android Development] Bertonumber1:
5.2.7.7 yipeee

Seconds later bootloader is locked lol

I'm currently on 5.2.7.4 I think I'll stay there. This is the os before big A started messing with adb and accessibility (launchers) you can just disable launcher and firehomestarter apk provided there is a settings apk installed (hoffis is great).
[Fire TV Original Android Development] tw39515:
lol
[Fire TV Original Android Development] k4y0z:
The one retyre provided only clears the preloader, nothing else.
[Fire TV Original Android Development] Seattleweather:
Tried, but nothing happens now, not even LED.
[Fire TV Original Android Development] Rortiz2:
If no LED it's showing up means there's no PL installed in the device. Now you don't need to short anymore.
[Fire TV Original Android Development] Seattleweather:
But when I ran bootrom-step.sh nothing shown up, just waiting. There was no signal from HDMI also.
[Fire TV Original Android Development] k4y0z:
The device is currently "bricked", that is expected, there will be NO sign of life.

Please run the bootrom-step.sh of the original ZIP or the updated version I provided and supply a complete log of your operations.

You do NOT need to short the device in the state it is currently in.
[Fire TV Original Android Development] Seattleweather:
Used both 1.00 and 1.0.2 file. I had use Ctrl-C once to see if something changes or not. It's still waiting for bootrom. lsusb did not show MT6227 or MT67xx phone once.

One thing that I noticed was the USB port on my PC won't light up without power plug in, and it light up and off when the power is on. Not sure if it's normal or not.

UPDATES: I made it!!! i let the bootrom-step.sh run first, and had another window run ./fastboot-step.sh. then plugged in USB to PC DIRECTLY, not hub, then power on. this time worked, and installed TWRP in one step. THANK YOU VERY MUCH GUYS!!!
[Fire TV Original Android Development] Michajin:
OK, Like others some reason I had issues with it only seeing the preloader. I tried this version and everything is loading. Odd thing was is when i ran lsusb it showed me the phone (not preloader) and it was stuck there, but the script was saying waiting for bootrom. I ran the script again, unplugged and short again and it is running the script. Thanks @k4y0z for all you do to help! (and FYI this was a Demo version)
[Fire TV Original Android Development] KB!:
Couple of questions...

1. Is there a guide somewhere that will explain how to install python, pyserial, etc. and make sure the environment is set up correctly???

I installed Python but I'm not sure if everything is correct.

2. Is there an easy way to brick my sloane running 5.2.7.7 so I don't have to open it and short the pins???

I actually opened the device but the pins are SO small I don't want to risk messing it up.

Thanks in advance
[Fire TV Original Android Development] Michajin:
Use at you own risk, I shorted all over it with a piece of aluminum foil until I got it. As far as I know there isn't a exploit that gets unlocked without shorting for force the boot rom. I was all over with the foil and finally got it. I used a raspberry pi and installed the pythons just as the OP showed worked just fine. From my experience with the fire tank, fire 4k, 8hd (2018), 10hd suez, It is safe to do the shorting.. The only issue I ever had was with a paperclip that broke a a resistor off a fire 4k (that still works normal without it). But this is my experience ...
[Fire TV Original Android Development] Sus_i:
Idk why you used the br-minimal -step, but maybe it worked too on your demo unit.

Anyway. First make sure that fb is up-to-date with:

sudo apt update

sudo add-apt-repository universe

sudo apt install fastboot

Then run sudo ./fastboot-step.sh and connect your box.

In case there isn't a device, disconnect the box, run sudo ./boot-fastboot.sh and then connect the box.

As soon twrp comes up, format data, reboot to twrp (You can use sudo ./boot-recovery.sh to boot twrp too).

Then flash the amonet zip from OP with twrp (to make sure that the tz and lk are flashed too, i.e. the minimal step skips that part).
[Fire TV Original Android Development] k4y0z:
Is there a reason you used the minimal script?

If your LK was not already on the correct version (which is unlikely), you'll have to redo the procedure (including short) with the bootrom-step.sh
[Fire TV Original Android Development] Seattleweather:
Love to try your LineageOS14.1 since I could not pair new remote on 12.1. Also found this on YouTube last night. Is this real or fake?

Thanks,
[Fire TV Original Android Development] Michajin:
It is real, it is just a launcher replacement. There is a magisk module that does this to the firestick 4k. Not really a custom rom. It is just a firestick leanback launcher...
[Fire TV Original Android Development] Michajin:
Ok, turns out the demo unit i have is actually 5.2.6.3 which makes it vulnerable to the mtk-su and going that route. Seems like the shorting method would be faster than this right now. But i am curious, I remember 5.2.6.7 contains updated DRM firmware. So do i need to find a version of 5.2.6.7 and flash that before i flash 5.2.7.7. I just flashed the 5.2.7.7 and have to test the DRM to make sure it works.
[Fire TV Original Android Development] k4y0z:
If it's vulnerable to mtk-su, you can just use the adb-method described in Post #3

TZ/TEE (which is responsible for DRM) will be replaced anyway by the version included in the unlock.
[Fire TV Original Android Development] brick00444:
Just completed my 3rd demo box. This one went through everything first time. Thank you everyone for the guidance.
[Fire TV Original Android Development] KB!:
@k4y0z @Sus_i

@Rortiz2

What am I doing wrong???

I opened the device and shorted it but could never get it to recognize it in the script, it just kept saying waiting for bootrom.

It is currently bricked with no HDMI output or LED light working.

I tried what @Seattleweather did by opening 2 terminals and running the bootrom-step.sh in one and the fastboot-step.sh in the other simultaneously, since my device seemed to be displaying the same symptoms as his but I still never get past the waiting for bootrom or waiting for device.

The picture I posted is what I get when I run LSUSB, so something isn't correct.

Do I need to install the drivers in the Linux/Ubuntu system or is it ok just in the windows 10 system?

The sloane appears to be trying to boot up every so often as I can hear my computer make a sound like when you plug a device in and then a little later it sounds like it was unplugged and this just continually repeats.

Any help is appreciated.
[Fire TV Original Android Development] :
Great discovery as it was what finally made everything work for me too. It just wasn't seeing or communicating with the devices otherwise. Somehow it seems to have initialized the device which doesn't happen without doing it. I found that the steps didn't matter, it just has to be plugged in to power and USB and both scripts need to be running beforehand.

Nothing like finally getting things working after all the time spent on it.
[Fire TV Original Android Development] Rortiz2:
If you're using virtualbox enable usb passthrough.
[Fire TV Original Android Development] :
One thing that you could of possibly overlooked is making sure the USB for the FireTV is enabled in VirtualBox?

It will probably just be listed as MediaTek something.
[Fire TV Original Android Development] :
pi@raspberrypi:~/Desktop/amonet1.02 $ sudo ./fastboot-step.sh

Press Enter to Continue...

< waiting for any device >

[/QUOTE]

Try loading bootrom-step.sh in a seperate window or tab before running fastboot-step.sh
[Fire TV Original Android Development] LocoMexican:
Got these responses. Nothing on fasrboot-step.sh. Device remains as before.

pi@raspberrypi:~/Desktop/amonet1.01 $ sudo ./bootrom-step.sh

[2021-02-13 12:19:06.254514] Waiting for bootrom

^CTraceback (most recent call last):

File "main.py", line 143, in <module>

main()

File "main.py", line 22, in main

dev.find_device()

File "/home/pi/Desktop/amonet1.01/modules/common.py", line 82, in find_device

time.sleep(0.25)

KeyboardInterrupt

pi@raspberrypi:~/Desktop/amonet1.01 $ sudo ./boot-recovery,sh

sudo: ./boot-recovery,sh: command not found

pi@raspberrypi:~/Desktop/amonet1.01 $ sudo ./boot-recovery.sh

[2021-02-13 12:27:48.203082] Waiting for preloader

[2021-02-13 12:28:00.442729] Found port = /dev/ttyACM0

[2021-02-13 12:28:00.482776] Handshake

[2021-02-13 12:28:00.503321] Preloader ready, sending FACTORYM

pi@raspberrypi:~/Desktop/amonet1.01 $ sudo ./boot-recovery.sh

[2021-02-13 12:30:44.612868] Waiting for preloader

[2021-02-13 12:30:56.072678] Found port = /dev/ttyACM0

[2021-02-13 12:30:56.112722] Handshake

[2021-02-13 12:30:56.133078] Preloader ready, sending FACTORYM
[Fire TV Original Android Development] KB!:
Ok, I got it to flash by using the 1.0.2 version that @k4y0z posted.

Now I am stuck at the white Amazon logo on screen with blinking white LED light, I assume this is fastboot mode but cannot figure out how to get anything else to work.

Please help.
[Fire TV Original Android Development] LocoMexican:
No, just ignorance on my part. Nothing else seemed to be working so I said w t hell. Seriously, just shooting in the dark and trying not to bother you guys too much with dumb ????
[Fire TV Original Android Development] :
If it is in fastboot mode it will be listed using fastboot devices
[Fire TV Original Android Development] KB!:
What does that mean? Sorry I'm kind of a newbie.

What should I do from here?
[Fire TV Original Android Development] Sus_i:
The boot-recovery script can't work at this point, it needs a finished fastboot-step in the first place to do so.

You may run sudo ./boot-fastboot.sh script, then connect the usb a-a cable without a short and power on the box.

Then run fastboot devices

and in case there is no device, re-do the bootrom-step with a proper short...

If you see a device, run sudo ./fastboot-step.sh
[Fire TV Original Android Development] KB!:
This is where I am...

White Amazon logo on screen and slow flashing White LED.

I pressed enter but nothing appears to be happening.

Any suggestions?
[Fire TV Original Android Development] KB!:
The device is in fastboot according to Ubuntu.

I just can't seem to get anywhere else.

Any and all help appreciated.
[Fire TV Original Android Development] Sus_i:
Open up a terminal in the amonet folder, then try to run the commands by hand:

fastboot flash recovery_x bin/twrp.img

fastboot flash MISC bin/boot-recovery.bin

In case that works, type:

fastboot reboot
[Fire TV Original Android Development] KB!:
Ubuntu shows fastboot device.

I entered the fastboot flash recovery_x bin/twrp.img

It is just sitting there, not sure how long I should wait or if I should enter the next command.

Tv shows white Amazon logo, white led slow flashing.

Tried opening a new terminal in amonet and it shows the fastboot device but when I try to run the same command in it it says waiting for device.
[Fire TV Original Android Development] Rortiz2:
try with

fastboot -i 0x0bb4 flash recovery_x bin/twrp.img
fastboot -i 0x0bb4 fastboot flash MISC bin/boot-recovery.bin
[Fire TV Original Android Development] KB!:
How can I get it to accept new commands.

I tried Cntrl+c but it doesn't give me the starting prompt like normal.

I'm afraid to unplug it because I don't want to lose fastboot.
[Fire TV Original Android Development] Rortiz2:
I guess you can close the terminal and open a new one.
[Fire TV Original Android Development] KB!:
Tried the first command and it just says waiting for any device.

It does show the device when you type fastboot devices however.
[Fire TV Original Android Development] k4y0z:
I'd suggest using a live-system instead of VirtualBox.

Using a VM is prone to issues with USB devices.
[Fire TV Original Android Development] KB!:
I'm not even certain how to do that.
[Fire TV Original Android Development] KB!:
When I finally unplugged the usb it says this...

Any ideas?
[Fire TV Original Android Development] KB!:
@Rortiz2

@Sus_i

Is there a way to use Ubuntu to change directories and flash the amonet zip from the SD card?
[Fire TV Original Android Development] :
Plug USB back in and don't enable yet.

Assuming your still in fast boot mode:

in the terminal window run the sudo ./bootrom-step.sh and enter password, but don't do anything else.

then you need to open another terminal windows and run sudo ./fastboot-step.sh

Enable the USB for the device and cross your fingers..
[Fire TV Original Android Development] KB!:
The only time mine asks for password is at the very beginning when I enter the first Sudo command... is that normal?
[Fire TV Original Android Development] Rortiz2:
I don't understand what are you saying. Try to use 2.0 USB ports and run again the fastboot commands. If it still doesn't works you can manually flash the images in windows.
[Fire TV Original Android Development] KB!:
Sorry the first quote was not for you. I was referring to the guy saying to run a live-system.

Would i flash the images using a .bat file or ???

I hate to be a nuisance but I need help.
[Fire TV Original Android Development] :
Yes
[Fire TV Original Android Development] KB!:
Unfortunately that didn't work. Its like it never recognizes the device. Just stays on waiting for bootrom and waiting on any device.

I guess I will try to install them manually through windows if someone can clue me in on how to accomplish that.
[Fire TV Original Android Development] :
You need only to pay attention to the fastboot script terminal window and you need to make sure you reenabled the USB in virtualbox.

If your referring to Linux, you can just use a cd/dvd in live mode, but I personally don't think it will make a difference.
[Fire TV Original Android Development] KB!:
I tried what you said to the best of my understanding.

I started a terminal inside the amonet folder and only entered the sudo ./bootrom-step.sh and hit enter

Then I opened a second terminal inside the amonet folder and entered only the sudo ./fastboot-step.sh and hit enter.

Then I toggled over the usb settings and enabled the usb.

It is still sitting at waiting for device.
[Fire TV Original Android Development] KB!:
I know you are probably busy but some instructions on how to do this in windows would be greatly appreciated if you can.

Thanks in advance.
[Fire TV Original Android Development] Bertonumber1:
Exact same happened to me with a tank 2nd gen. Paperclips are way too rigid and sharp. A piece of tinfoil or thin strand of copper wire is ample for the short. As long as it makes the ground and thus completes the short.

Be gentle... No need to dig for oil as I think I already said in an earlier post.

Regards
[Fire TV Original Android Development] KB!:
@Rortiz2

@Sus_i

@k4y0z

I tried the shorting method again and this is what I get...

The only script that will ever complete all the way through is the Amonet 1.0.2

I don't think I have tried the Amonet 1.0.0, only the 1.0.1

Any ideas, should I try the 1.0.0 and see if it completes?
[Fire TV Original Android Development] KB!:
I tried Amonet 1.0.0 and it won't do anything either... just waiting for bootrom.

The only one that will successfully flash is the Amonet 1.0.2 and it completes and then says rebooting to fastboot and then after that it gets stuck on the white Amazon logo and flashing white light.