yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Pro-me3us:
Make micronucleus executable:

sudo chmod +x micronucleus

Connect ATtiny88 to you computer with USB cable. Red LED will blink, meaning it's in programming mode. Flash it (only needs to be done once):

sudo ./micronucleus --dump-progress filename i2c-flash_USB.hex

Were there any errors (show the output)? The ATtiny88 is now ready to use. When the ATtiny88 is powered on (via USB), the LED will blink 10x (is in programming mode for 10sec) then stop, this is when the flashed program is ready and running. If the LED doesn't stop blinking after 10sec, then there was a problem with the flashing command above.

Use this wiring diagram description to connect the ATtiny88 to an HDMI breakout board.

Booting Cube in DFU

1) Plug HDMI breakout board into Cube HDMI port

2) Power-on ATtiny88 with USB cable

3) Connect Cube to Computer with second USB cable

4) Make sure ATtiny88 LED has stopped blinking (10sec), then plug-in Cube power cord

The Cube will instantly enter DFU, typing lsusb on computer will show ID 1b8e:c003 Amlogic, Inc., indicating DFU mode. If after choosing any raven root menu option you need to get back into DFU,

1) unplug Cube power

2) press ATtiny88 reset button, wait for red LED to stop blinking (10sec)

3) plug power cord back into Cube

To restore your Cube, you only need to choose the fastboot option 5), and run

fastboot flash misc images/misc.img

You can then proceed to FireOS (fastboot continue). Remember to block updates, and verify Magisk and TWRP are installed.
[Fire TV Original Android Development] pretzells:
attiny would not stop flashing(red) and error was .micronucleus not found, not 100% on the error , terminal in folder. i did not know to make micronucleus as exe, will tryy later today when i get home. thanks for the details above, much apreciatted. cheers

p.s thanks for highlighting the hdmi wiring diagram, i had only 3 wires connected,

Tiny88 pin A5 SCL (clock) to HDMI pin 15

Tiny88 pin A4 SDA (data) to HDMI pin 16

Tiny88 pin GND (ground) to HDMI pin 17

need pin 18 - 5v connection, thanks
[Fire TV Original Android Development] Pro-me3us:
Only use 3 wires (SCL, SDA, GND). The ATtiny88 doesn't need 5V, it has it's own power (USB cable).

maybe you didn't have the ./ in front of micronucleus (./micronucleus)?
[Fire TV Original Android Development] pretzells:
another edit: yes, 3 wires not 4, the hdmi/display port/vga i think diagram showd 4 connections, i was mistaken. only 3 like you originally wrote

success, attiny flash went perfect, had to enable .exe permission to micronuleus, thanks for the advice.

lsub - ID 1b8e:c003 Amlogic, Inc. (not exact but Amlogic, Inc.) was in menu list

bash menu was perfect, thats where things ended. c/p

Please enter your choice:

1) Patch your Cube (installs root access, TWRP & Magisk)

Quick access options (no changes made to Cube's storage)

2) FireOS boot with ADB root and SElinux=permissive

3) FireOS boot with Magisk support

4) TWRP Recovery

5) Fastboot mode

6) Amlogic burn mode

7) Download partitions with Amlogic burn mode

8) Boot alternative OS from USB drive

9) U-boot console (UART connection)

10) Boot Cube's native FireOS from bootloader exploit

11) Quit

5

Normal is best, emergency when that doesn't work

1) Fastboot normal

2) Fastboot emergency

3) Quit

1

menu: line 203: ./amlogic-usbdl: Permission denied

----To restore your Cube, you only need to choose the fastboot option 5), and run

fastboot flash misc images/misc.img ------ did not work same ./amlogic-usbdl: Permission denied error

fastboot reboot

Rebooting OKAY [ 0.004s]

Finished. Total time: 0.105s

every error was essentially ./amlogic-usbdl: Permission denied

tried - fastboot reboot

rebooting OKAY [ 0.004s]

Finished. Total time: 0.105s

c@r:~/Downloads$ fastboot flash recovery twrp.img

< waiting for any device >

Sending 'recovery' (22644 KB) OKAY [ 1.453s]

Writing 'recovery' FAILED (remote: 'blocked command')

fastboot: error: Command failed

theres life in the cube, fire logo i think like i had after the brick, no led's . but have to say that as far as hardware goes(attiny/breakout board) good, everything works, im just missing something. im close!!! thanks for your advice, cheers
[Fire TV Original Android Development] Pro-me3us:
try making amlogic-usdl executable

sudo chmod +x amlogic-usbdl
[Fire TV Original Android Development] pretzells:
thanks, tried that, no change. now pretty much everything from the bash menu ends up

Error: cannot open device 1b8e:c003

i believe i understand that i have to reset the attiny and re-power cube each time due to memory, just not clear how the existing terminal window is used or i have to close and open a new terminal in tha avr folder of yours. lsusb each time, then bash. option 5, then fastboot normal(1) error.

i did make sure that everything was set/allowed as exe in all folders also, getting there, slowly but shirley.....lol
[Fire TV Original Android Development] Pro-me3us:
Error: cannot open device 1b8e:c003 means you're not in DFU. To get into DFU everytime

1) HDMI board has to be connected to Cube HDMI port

2) Cube and computer have to already be connected with USB cable.

3) ATtiny has has to be reset, or repowered on (second USB cable), and the LED has to have stopped blinking

4) When all three steps are complete, then plug the power into the Cube.

If that's not working, verify that the three wires between the HDMI board and ATtiny88 are secured, and that no exposed metal is touching betwee wires (eg SCL and SDA exposed wires are touching).

Using lsusb isn't required, this just tells you if the Cube is actually in DFU or not. None of the menu options will work if the Cube's not in DFU, so it's just easier to first verify with lsusb.

Everytime you issue an option from the bash menu, the Cube leaves DFU mode. That's why you need to repeat the steps above to get back in.
[Fire TV Original Android Development] Pro-me3us:
BTW setup the udev rules mentioned in the OP if you haven't already:
[Fire TV Original Android Development] pretzells:
yes, done at start
[Fire TV Original Android Development] pretzells:
Everytime you issue an option from the bash menu, the Cube leaves DFU mode. That's why you need to repeat the steps above to get back in.

this is where i am going wrong! did not realize i had to this each time. will try later today. cheers
[Fire TV Original Android Development] pretzells:
success, i recovered the cube!!! thanks Pro-me3us, went fairly smooth, i did come out unscathed, cube did pretty good too.

thanks
[Fire TV Original Android Development] abdul1907:
I cannot install applications such as Netflix and YouTube on my device. What is the solution?@Pro-me3us

Fireos 7.2.0.6
[Fire TV Original Android Development] Pro-me3us:
PS7206 is early 2020 firmware, unless you like the old UI, update to PS7229 to fix any old Amazon App Store compatibility problems.

Remember to reflash Magisk after flashing any firmware, and to confirm updates are still blocked when FireOS loads.

There's instructions here.
[Fire TV Original Android Development] Pro-me3us:
Magisk: Zygisk & Modules are now working, available shortly in Magisk Canary build, and eventually in Magisk v25.2 when it's released.

The updated Magisk patched boot image is attached below, unzip and put into the images folder of your boot menu folder

[UPDATE: get Magisk v25.2 patched images here]

magisk_boot_7242-2906.zip for FireOS 7242/2906+

magisk_boot_7212-1333.zip for any version earlier than 7242/2906

To patch your own boot.img, install the latest Magisk Canary build. Check "recovery mode" and leave VBmeta unchecked.

Leave both "recovery mode" and VBmeta unchecked if you want to create a Magisk boot image to flash to the boot partition. I don't recommend this, since it will only be possible to boot the Cube with the exploit, after doing that ("bash menu" option 9).

===================

Magisk Modules

With Magisk & Modules we can make system modifications without actually touching the system partition.

One example is App Systemitizer, which can make any user app into a system app to gain extra privileges. Make Wolf Launcher a system app, so that it can remain the default launcher after re-enabling Amazon Launcher. With Amazon Launcher enabled in the background, all search functions from Wolf Launcher work again.

There is MagiskHide Props Config to modify the build prop, and many more modules to checkout. These modules will only take effect while booting with Magisk, and not affect regular booting without the exploit loaded.

===================

FireTV 2nd gen Cube Firmware

I've posted a list to all the OTA firmware links that we have. Full firmware bins are the most useful but for now I'm also including partials. If anyone has any URLs not already listed there, please share. Thanks to @roligov for provinding many of these.

EDIT: updated the images to work with Magisk v25.2 here
[Fire TV Original Android Development] :
Is it known if the payload to burn the efuse is contained merely in the bootloader, like it apparently is for the ccwgtv?

Is the bootloader version for any particular raven os version tied to the particular matching raven os system?

For example, would the bootloader from PS7242/3516 work with the remainder of PS7285/2877?

It seems that if it was desired to obfuscate the nature of how the efuse is burned, this would be best accomplished if the payload was contained within the bootloader, or the same would be true if burning the efuse requires a privilege level that is easiest to accomplish within the bootloader.

All of this is a long way of asking if the newest os can be run with a slightly older bootloader in order to avoid burning the efuse. Even if this would cause some sort of hash check to fail that could be overcome by the exploit.
[Fire TV Original Android Development] Pro-me3us:
I'm sure there are multiple ways of dealing with efuses, and Amazon may not choose the same path as Google. The Cube bootloader has the code to burn the eFuse, but it doesn't initiate the process. I loaded the bootloader from 7273/2622 on a Cube with an older FireOS firmware version, without triggering the eFuse to disable DFU.

There is a fair amount of flexibility. The exploit in the OP uses Bl2 from 7273/2625, Bl33 from 7204, and the rest from 7212/1333. And that bootloader loads on both new and old Cube firmwares. This is because a number of signature checks have been disabled. If you are asking if 7273+ will boot from the current modified bootloader, possibly, it would have to be tested. It's always possible that some new change could make the current modified bootloader fail.

Hard to say until tested.

Possibly, I'd just be guessing if I said yes or no :) My impression is that Amazon has been pushing out updates more frequently the last 6-8 months. And I'm not seeing / hearing about much changing on the user side. The more changes, the more likely backwards compatibility breaks.
[Fire TV Original Android Development] :
Thanks. Is it incorrect that there was a transition from android 7 based fire os to android 9 based fire os starting with 7273?
[Fire TV Original Android Development] Pro-me3us:
FireTV's use:

FireOS5 - based on Android 5.1

FireOS6 - based on Android 7.1.2

FireOS7 - based on Android 9.0

Amazon doesn't transition their Fire devices from one major OS version to another. So if you buy a FireTV with FireOS6, you can be confident that it will remain on FireOS6 (Android 7) until you stop using it.

The first gen Cube was and is still on FireOS6. The 2nd gen Cube was released with FireOS7 (Android 9). Amazon needs to keep FireOS somewhat compliant to Android guidelines to make it easier for Android developers to port their apps to FireOS. Mixing Android versions might muddy that?

FireOS8 was just released and is based on Android10 and Android11. But I'm assuming it's mostly Android 11, with some features missing/not working. Currently FireOS8 is only available on one or two Fire Tablets. None of the FireTV devices on the market today will ever see FireOS8.
[Fire TV Original Android Development] Sus_i:
Sometimes they do major updates, like the fireOS3 (android 4.x) to fireOS5 update for the first fireTV box and the stick... Same for the 2018 fireHD8 tablet (karnak) which jumped from fireOS 6 to 7. ;)
[Fire TV Original Android Development] :
What's the significance of "raven:7.0" and "raven:9" in the build fingerprint?

For example, in the ota archive for PS7273/2625, in META-INF\com\android\metadata, the build fingerprint is:

Amazon/raven/raven:7.0/PS7273/2625N:user/amz-p,release-keys

Whereas, in the ota archive for PS7279/2766, in META-INF\com\android\metadata, the build fingerprint is:

Amazon/raven/raven:9/PS7279.2766N/0023253929472:user/amz-p,release-keys

The location of "7.0" and "9" is typically where the android version is indicated in non-fireos android build fingerprints. What does it mean here? If it just refers to the fireos version, why did it change from 7 to 9? Because the fireos version changed from 7 to 9 between these two releases? And if so, both are still android 9?
[Fire TV Original Android Development] Pro-me3us:
Oh I see, I hadn't noticed that. The third gen FireSticks have also moved from using v7 to v9. I'm not entirely sure, perhaps Amazon is shifting their fingerprinting scheme to match regular Android devices.

FireOS version numbers are falling further and further behind Android just from a marketing perspective. To the layman FireOS8 is three versions behind Android11, and even more primitive looking compared to this year's Android13 (or iOS15). Maybe we are seeing the beginning of Amazon shifting towards an Android numbering scheme.

The SDK API level is still level 28 before and after the fingerprint numbering change, which leads me think the change is just superficial.
[Fire TV Original Android Development] hasobist:
Hello Pro-me3us

Trying to root Firetv cube 2nd gen followed all the instructions in op ran all the commands.

The bash menu how to go about with the options any help appreciated.

Is root lost at every boot?

Thank you.......
[Fire TV Original Android Development] Pro-me3us:
The average user will probably just want to use the Magisk support option to gain root access.

2) FireOS boot with Magisk support

And use the second sub command

2) USB host mode - connect peripherals to Cube

You need to install Magisk Manager from within FireOS to manage SU access. I updated the magisk-patched boot image here, to fix Zygisk and modules. Unzip it and place it in the 'images' directory of the exploit. Or make your own patched boot.img if you prefer.

This is a sort of toolbox release, to give easy access to the various boot modes of the Cube, for backups, penetration testing, etc.

Yes, currently this is a temporary exploit, and you will lose root access after a reboot. A second bug will need to be discovered in order to allow this exploit to persist after a reboot. The Cube is pretty stable so you don't need to reboot often, I've gone over a month without having to reboot. It's not ideal, but it's the best there is for now.

Using Magisk will allow you to make changes to the system/vendor partitions without actually touching those partitions, preventing any problems with verified boot.

If you have something specific in mind that you want to do and aren't sure, let me know, there is probably a simple Magisk way to do it.

BTW which DFU entry device are using? Arduino, ATMega or HDMI dongle?
[Fire TV Original Android Development] hasobist:
Thank you for the prompt reply

Using a HDMI dongle.

Is there any possibility can downgrade using TWRP ?

Any possibilities or permanent root?
[Fire TV Original Android Development] roligov:
Unfortunately not.
[Fire TV Original Android Development] hasobist:
Oh okay

Thank you will await development for the Ftvcube-2.

For now will use it the way it is and no updates.......

Thank you all for the wonderful work.
[Fire TV Original Android Development] Pro-me3us:
You mean downgrade the Cube that you have working with the exploit now?

Yes, that should be possible through TWRP, but I haven't tried / tested it. I updated the list of full firmware bins I know of here

There may be an issue with TWRP not allowing zips to be flashed. I might need to create two TWRP images, like I did with magisk, based on the firmware version present on the Cube. I can compile a second version later and see if that fixes the issue I saw.

If you are asking about downgrading a Cube that is on 7273/2566+, then like Roligov said no. The newer firmware burns an efuse that disables the ability to enter DFU mode.

What firmware is your Cube on? If you are on 7242/3515 - 7242/3516, and just want to disable the OTA packages, I think you can do this with Magisk/root ADB now and the package will remain disabled even after a reboot.

I should also say that all the changes you make with Magisk will be saved to a directory on the Cube. So any Magisk modules will automatically load any time you boot from the exploit.
[Fire TV Original Android Development] hasobist:
Thank you at present on firmware 7.2.4.2/3515

Hope we find a permanent root cheers.

Was able to do a complete TWRP backup though.

If of any help always a pleasure.......
[Fire TV Original Android Development] Pro-me3us:
Did you want to downgrade because of the package protection? If that's the case, check your Cube to see if this file exists:

/data/system/PackageManagerDenyList (use MiXplorere, Total Commander etc, and grant SU access with Magisk)

If that exists, look for a DenyList within it, and remove any packages that you want. That would allow enabling/disabling the OTA packages even without root.

Alternatively, you can use ADB root access to disable/enable protected packages. ADB root can be enabled a number of ways. The easiest is to use the bash menu:

1) FireOS boot with ADB root and SElinux=permissive

2) USB host mode - connect peripherals to Cube

This sets the FOS_flag = 0x87

This is a FireOS setting that enables a few features including ADB root, and will remain active, even when you reboot back into Magisk support mode. If you have already used bash menu option '1)' previously, then it's already set, and you already have ADB root now.

**I don't recommend staying booted in '1)', having the Cube set SElinux=permissive, it's a bit of a security risk. Like running a router without a firewall.

To check if you have root in ADB:

ADB shell whoami

Shell = no root, Root = root

With ADB root, disable OTA packages

pm disable com.amazon.tv.forcedotaupdater.v2
pm disable com.amazon.device.software.ota
pm disable com.amazon.device.software.ota.override
pm clear com.amazon.device.software.ota

or enable

pm enable com.amazon.tv.forcedotaupdater.v2
pm enable com.amazon.device.software.ota
pm enable com.amazon.device.software.ota.override

If you are using a custom launcher, the App Systemitizer module might interest you. Check my previous post for details
[Fire TV Original Android Development] hasobist:
Wow!

Thank you loads for the detailed instructions will give it a try this weekend and will update you.

Let's try work for a permanent root as that of Ftvcube-1 there's ain't any impossible for the wonderful.

Thank you warm regards.......
[Fire TV Original Android Development] JJ2017:
Hi, I could do with some help regarding Magisk.

The original (May'22) version installs OK but it's not fully functional.

The July update with working modules (from post#21) won't update and install: when I try to run it - and it asks to update - I just get 'downloading Magisk' spinning wheel.

If I try and ADB install Magisk apk I get:

>raven_boot# adb install Magisk-v25.2.apk

>adb: failed to install Magisk-v25.2.apk: Failure [INSTALL_FAILED_UPDATE_INCOMPATIBLE: Package com.topjohnwu.magisk signatures do not match previously installed version; ignoring!]

Can anyone advise? (I'm on firmware 7229/1856)
[Fire TV Original Android Development] hasobist:
Hello

Had the same problem this worked for me

Try installing Magisk 25.2 as normal apk before running the bash menu once installed use the magisk image provided by pro-me3us according to the version unzip to the raven boot/image folder rename the existing magisk_ image to any did magisk_imagebk and then flash the above by DFU+bash menu +magisk support think second option, once done the stick will reboot to FireOS and root available and Magisk gets updated and throws an error to update just cancel the pop up and works normal.

Never tried modules though hope it helps.......
[Fire TV Original Android Development] Pro-me3us:
When I created the magisk-patched boot.img in post#21, it was with a Canary build (before v25.2 was released). I think the Canary build may not have had signing enabled, which could be causing an issue with the official release.

I've created a new magisk-patched-boot.img from Magisk v25.2, for pre PS7242/2906 firmware. Download and unzip this into the 'images' directory of raven_boot. Then boot into FireOS and try installing Magisk Manager v25.2.

If that doesn't work, I can give you the steps for patching your own boot.img. It's easy, but requires a keyboard to navigate Magisk Manager on FireOS7, so I just post the patched images here to save people the hassle.

@hasobist Are you using the magisk image from post#21? I'm not sure if I need to create a second image for +PS7242/2906? The modules+Zygisk are broken in the image from the OP.

@JJ2017 which DFU entry device are you using? Arduino/ATmega/HDMI dongle? Just curious since this is the biggest barrier running this exploit.

EDIT: uploaded v25.2 Magisk patched boot.img for +PS7242/2906
[Fire TV Original Android Development] hasobist:
Hello

Yes used the magisk_image from your post#21

Followed the instructions then bash menu used option 2 but then as JJ2017 mentioned would never download all the features of Magisk manager and is stuck at downloading and freeze so tried first installing Magisk manager as normal apk then your magisk_image version 7242/2906 and works great and when pop up asking to update Magisk manager just cancelled.

At present on OS version 7242/3315

If can have a magisk_image for the said version will give it a try or will try patching the image using Magisk manager.

As said a permanent root is always good as me never leave the cube on standby.

Thank you......
[Fire TV Original Android Development] JJ2017:
Thanks for the replies and great news @Pro-me3us - the new patched Magisk image (@ post#40) did the trick.

Photos are a bit unnecessary (sorry!) but I like to document my progress!

I am using a HDMI dongle made as per the instructions @ https://github.com/superna9999/linux/wiki/Amlogic-HDMI-Boot-Dongle - that in itself was quite a hassle - but got there eventually.

Great hack BTW - thanks for the work (y)
[Fire TV Original Android Development] hasobist:
Wonderful

Did the Magisk manager download and complete installation post boot after using the bash menu option?

Cheers!
[Fire TV Original Android Development] JJ2017:
Can't remember the exact process but several reboots were required - changes did seem to persist after reboots, thankfully. I put Magisk Manager 25.2 onto internal storage and installed it using Total Commander. Also needed to go into Magisk settings to switch on Zygisk button. After this, and reboot, the modules tab should be functional.... However, loading modules is a thorough PITA as the Amazon remote won't navigate the file explorer (my solution was messy so won't go into details here - I wonder how everyone else manages that part?!). Hope that answers your question?