yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Functioner:
I spent the time and sorted it out myself. Something that I noticed that is kind of interesting is that if a magisk boot image is flashed to the emmc on a raven device running the native PS7279/1856N bootloader, it will fail (aml log : Sig Check -1) to a fastboot connection if a usb cable is connected. However, boot can still continue if "fastboot continue" is executed. Though for some reason magiskinit doesn't execute, even though the boot proceeds pretty far it eventually fails due to dm-verity. Not sure why magiskinit doesn't execute. It might be because it's booting the recovery partition and not the boot partition, or possibly it is because of the recovery style patch. I was able to get a 1 value for eng_device on the native PS7279/1856N bootloader, but still get the "aml log : Sig Check -1" bootm failure.
[Fire TV Original Android Development] Functioner:
I managed to get my raven in a state that even DFU can't fix. The ./amlogic-usbdl image boots ok via DFU, but any of the ./update bl2_boot images eventually result in this

"Synchronous Abort" handler, esr 0x96000010
ELR: 77e2836c
LR: 77e28300
x0 : 0000000000000009 x1 : 0000000000000000
x2 : 0000000077daa164 x3 : 0000000000000001
x4 : 0000000000000030 x5 : 0000000000000000
x6 : 00000000ffffffd0 x7 : 0000000000000004
x8 : 0000000000000038 x9 : 0000000000000008
x10: 000000000000000f x11: 0000000077e3abe0
x12: 0000000000000000 x13: 000000000108660d
x14: 0000000001675200 x15: 0000000001c86516
x16: 0000000073d71f30 x17: 0000000073d72ab8
x18: 0000000073d55e28 x19: 0000000000000001
x20: 0000000000000010 x21: 0000000000000000
x22: 0000000000020000 x23: 0000000087d65000
x24: 0000000000000010 x25: 0000000087d65000
x26: 0000000000000002 x27: 0000000000000003
x28: 0000000077e62f63 x29: 0000000073d54850

Resetting CPU ...

I think the only way to fix it is to build a bootloader image that doesn't proceed through the normal boot process, and starts burn mode, or uart console mode, earlier than this

enable_dolby_vision
Dolby Vision turn on
[OSD]load fb addr from dts:/meson-fb
[OSD]set initrd_high: 0x7f800000
[OSD]fb_addr for logo: 0x7f800000
[OSD]load fb addr from dts:/meson-fb
[OSD]fb_addr for logo: 0x7f800000
[OSD]VPP_OFIFO_SIZE:0xfff01fff

It is shortly after that the "Synchronous Abort" handler reset happens, using any of the provided images. It might be a recovery bootloop, I was modifying various contents of the emmc.

Should it be possible to build such a bootloader image?
[Fire TV Original Android Development] Pro-me3us:
I'm not totally sure what changes you were making, but I don't recommend editing the reserved partition if that's what it was.

I have an old bootloader that I made that exits into fastboot mode a little bit earlier than the bootloaders included in the OP. Let me know if that gets you past the crash, in which case I can compile one to dump you into update mode instead.

If you want to flash the magisk patched boot image to the Cube, you need to create a new patched image with Magisk Manager, and leave both recovery and vbmeta unchecked. Also, if you don't have a bootloader exploit to bypass verified boot, the bootloader will always reject modified boot images, which is the signature check fail you are seeing.
[Fire TV Original Android Development] Functioner:
Yes! That did it...

vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)
vpu: vpu_module_init_config
vpp: vpp_init
vpp: g12a/b osd1 matrix rgb2yuv ..............
vpp: g12a/b osd2 matrix rgb2yuv..............
vpp: g12a/b osd3 matrix rgb2yuv..............
USB3.0 XHCI init start
detect ID pin : Device mode , r5.b.iddig_curr=1nboard_usb_stop cfg: 2
hpd_state=0
Info: logoparam_getvalue: get succeed: key: logoparam.var.hdmi_mode, value: null
do_hpd_detect: hdmimode=null
Info: logoparam_getvalue: get succeed: key: logoparam.var.hdmi_colorattr, valuet
do_hpd_detect: colorattribute=rgb,8bit
Info: logoparam_getvalue: get succeed: key: logoparam.var.hdmi_crcvalue, value:0
Info: logoparam_getvalue: get succeed: key: logoparam.var.hdmi_mode, value: null
no sink, fallback to 720p60hz[4]
g_dnl_register: g_dnl_driver.name = usb_dnl_fastboot

USB RESET
SPEED ENUM

USB RESET
SPEED ENUM
.

Thanks much! I was actually trying to generate certain failures during my efforts to obtain persistent root. I see a path that I'm working on.

All of the memory locations used by your bootloader, like, for example, the devicetype location patch;

77d7c850: 00 00 2b 91

14 00 00 1b

Are different on the native bootloader, which is what I'll have to patch in order to do persistent. So, I was trying to sort out all of the native bootloader patch locations. And learn other stuff too.

I can get back to work now without having to spend time compiling a bootloader. Thanks again!
[Fire TV Original Android Development] Functioner:
The boot image has no ramdisk. If a recovery style patch isn't used, will magisk still add a ramdisk to a boot image lacking any native ramidsk?
[Fire TV Original Android Development] Pro-me3us:
Glad it worked, here's a new bootloader that exits early and drops you in update. And a zipped copy of the reserved partition if you need it. To disprotect the reserved partition ./update bulkcmd 'amlmmc key'

Typically if a device boot image doesn't include a ramdisk, the device won't use it if it's added. There are exceptions to this like certain Xiaomi devices and the 2nd gen Cube (probably other Amlogic boxes too).
[Fire TV Original Android Development] Functioner:
The FireFU exploit has the advantage of being able to intercept u-boot prior to execution, patch the changes, and then jump to the patched u-boot.

The entry vector that I'm using can only make hot patches after u-boot has already initialized everything. The same FireFU exploits won't work in this case. I'll need to use different patches.

Next thing I'm trying is disassembly of the native bootloader's u-boot.bin. I don't think I can easily get the equivalent from amazon's source code. I worry though that a hot patch to another memory address won't be at a fixed address, like the u-boot.bin code.
[Fire TV Original Android Development] Functioner:
Would it be much trouble for you to build a bootloader that uses u-boot from PS7229/1856N, and has no exploit patches other than enabling unrestricted u-boot shell access? Somewhere in the github Raven_Bootloader_Builder section, you noted that the newer versions wouldn't build, or that bootm didn't work, but the latter wouldn't matter.

Edit: may not need another bootloader. Having some success with hot patches to sig check function (rsa_verify_hash.c)

Is the ARB value entirely repurposed for determining the production/engineering device status, or does it also enforce anti-rollback of the flashed bootloader?
[Fire TV Original Android Development] Pro-me3us:
This bootloader is compiled from the PS7229 open source. Only amzn_lockdown.c was edited to remove the u-boot command blacklist. I don't have uart hooked-up to test it, but it should work.

After the release of the source for PS7204, Amazon added more of their UFBL code to the subsequent bootloader source releases. I could not get Fastboot boot to work on the later versions. I don't know if there was a check that I failed to find and patch, or if the source is just incomplete. After PS7229, the later bootloader source fails to even compile.

I assume it's also used to enforce downgrades of the bootloader. I think it's still up to the vendor (Amazon) to choose to set it in the bootloader. There is no downgrade restriction from PS7242/3516 going down to PS7204. Amazon may have triggered it in one of the 3 bootloader updates since PS7242/3516.
[Fire TV Original Android Development] Functioner:
I'll share it with you privately if I'm unable to get anywhere by the weekend. I don't want to share it publicly until I'm sure it bears fruit.
[Fire TV Original Android Development] Pro-me3us:
If you can disable the boot image signature verification, that's probably the most important thing. Setting the device to ARB=0 or engineering mode, may be required too. Engineering mode will enable the fos flags that include disable dm-verity and ADB root. But disabling dm-verity and root with fos flags isn't needed, the magisk-patched boot image can take care of that.
[Fire TV Original Android Development] Functioner:
I agree. There's the amlogic verification "aml log : Sig Check -1" (which, oddly, amlogic abandoned after android 9), and the amazon certificate verification. Engineering device mode probably won't overcome the amlogic signature verification, but will give full IDME.
[Fire TV Original Android Development] Functioner:
This is what I believe will be the key to the possibility of persistent root. If, with free rein of arbitrary bootloader modifications, you were unable to get bootm (fastboot boot) to boot a modified boot image on these later versions, then we are stuck. We have to hope the source was bad or that you missed a patch.

Did you only try fastboot boot, or also bootm directly? A boot image can also be loaded to the loadaddr using update:

update mwrite boot.img mem 0x1080000 normal

update bulkcmd 'bootm 0x1080000'
[Fire TV Original Android Development] Functioner:
GOT IT! Can boot a modified image!

I'll get a PoC package together within the next 24 hours and DM the details on discord.

Edit: Confirmed that fastboot boot also works with this single byte patch, so long as fastboot is invoked from the same boot session as when the patch was made. Actually flashing the modfied boot image to the boot partition on the emmc will probably require another patch, since engineering mode is not enabled.
[Fire TV Original Android Development] Pro-me3us:
I was looking back at the source for 7229 today. Booting images through fastboot and update both halt at the same point. I can see what the problem is. in 7229 the uboot command rsvmem is missing, and this is called during the mboot, and then halts when it can't use that command. the cmd_rsvmem file is included with 7229, but typing help in uboot, I can see it's missing.

The source that Amazon posts is just so full of mistakes it's ridiculous. I might be able to find out what is the cause for the exclusion of that command, but it sounds like you may not need it.

Is the single edit you are making just an unlock? and that's enough to remove the signature check?

Very good work! I'm glad to finally see a solution for this on the horizon :)
[Fire TV Original Android Development] Functioner:
With the patch in effect, I see this before it boots the modified image:

[rsvmem] no check for rsvmem, should check int kernel

But then it continues to boot fine. Yes, all that is done is a single byte patch to the unlock code. It's just a matter of hunting the other patches down though, although even this is completely fine for most uses.

Do you have a raven device with the 7229/1856N native bootloader? The patch address is bootloader dependent. Even the 7229/1853 that you complied earlier is at a different address. What is the newest bootloader that can be used w/o losing DFU?

Edit: uboot help shows rsvmem in the command list on the native 7229/1856N bootloader. Executing rsvmem gives the same result as shown during boot:

rsvmem

no check for rsvmem, should check int kernel

So i guess it is just missing in the source code.
[Fire TV Original Android Development] Pro-me3us:
This is the correct message, and indicates that cmd_rsvmem is present.

Bootloaders aren't changed often. I've only seen 6 versions since the Cube was released.

PS7204->PS7212/1333 same

PS7229/1853+1856 are the same

PS7242/2906-PS7242/3516 same

These are the 3 bootloaders before the eFuse is triggered, then there are 3 after. I've tested PS7242/3516 with the latest firmware, it's the last safe one to use as far as I can tell.

One thing to keep in mind. When the bootloader is flashed to the Cube it's offset by 512 bytes. Depending how you extract the bootloader, that 512byte lead may or may not be present.

7229/1853+1856 are the same from what I remember. I have a copy of each if needed
[Fire TV Original Android Development] Functioner:
Okay, good. I'll ask for them if I don't already have them.
[Fire TV Original Android Development] Pro-me3us:
I found the issue with rsvmem and fixed it. PS7229 now boots to FireOS, but I don't know if it makes any difference once you get into FireOS what bootloader version was used. This PS7229 was an old testing version, and I made a number of patches, probably a bunch of redundant ones. If you need I can try to make single patches to give you an idea where certain settings/attributes are.
[Fire TV Original Android Development] p0werpl:
From what I understand, root is not persistent? Does the FTV have to be tethered to the DFU entry device at fresh boot?
[Fire TV Original Android Development] Pro-me3us:
Updated the OP with a new version of the Raven boot package. A BIG THANK YOU to @Functioner for getting the root to persist through reboots!

There is now a new bash menu option to root your 2nd gen Cube, with all features working. Make sure that after running the root menu option that Magisk and TWRP are present & functional, because they are both needed to provide an extra layer of protection from accidental Amazon OTA updates. It goes without saying, only update your firmware through TWRP!

DFU access is still needed to apply the new patch, so this will only work on Cubes with firmware older than PS7273 (or that still have USB DFU access). Anyone with a Cube past PS7273, I'd recommend blocking updates now on PS7624, FireOS is only going to get more locked down in future updates.

Any new sealed 2nd gen Cube is guaranteed to come with firmware PS7229 or older and can be fully rooted. Unfortunately new 2nd gen Cubes are getting harder to find fast.
[Fire TV Original Android Development] JJ2017:
Many thanks @Pro-me3us for this - good to see some progress on this device.

.... However, I've run into some problems using RAVEN2. I had previously installed the RAVEN exploit and everything was fine. I ran option 1 (in RAVEN2) for persistent root and (as SU) the script seemed to run without issue. But now the device wont boot beyond the initial boot screen. Since then every change I've made (e.g. flashing newer firmware (was on 7229/1856), wiping data in TWRP and flashing boot.img in fastboot) has only made the situation worse!

Is there any way to return to stock & restart the process? I've not updated the bootloader - the exploit still works & I can still access TWRP. But now firmware updates in TWRP are no longer working - the device won't progress beyond boot screen & I'm now stuck in bootloop :confused: Any ideas?
[Fire TV Original Android Development] Pro-me3us:
One thought, about people who were using the previous version. There may be a conflict between the new Magisk and old Magisk build because they have different signatures.

Do this:

1) rerun bash menu option 1), at the end will be in twrp.

2) delete the magisk.db file from within twrp

adb shell rm /data/adb/magisk.db

Then reboot, and see if FireOS loads

When in FireOS uninstall old Magisk Manager, and install new Magisk Manager from /sdcard/download
[Fire TV Original Android Development] JJ2017:
No, that's not working as I've already wiped the data partition in TWRP

.... I've really dug myself into a hole here which is why I'm asking if it's possible to do a complete reset!
[Fire TV Original Android Development] Pro-me3us:
A couple things, if TWRP and Magisk are present, but you lost root, this will trigger authentication error and the device will just boot to fastboot.

If you can do a regular boot, and tell me what lsusb is reporting, I will have a better Idea what the problem is. If you see Google Inc. Celkon A88 you are in fastboot, lost root, and having authentication error. Rerunning option 1) will fix this.

If that's not working you can boot to TWRP again using option 1) and then flash one of the ota firmwares. You can start with 7229/1853 which is pretty much 1856.

You have DFU access, so no need to panic, the Cube is definitely recoverable
[Fire TV Original Android Development] JJ2017:
Thanks for your quick replies - i appreciate that.... But I'm OK now - re flashing vendor.img from fastboot seemed to clear the boot-loop (y)

Now with everything back to 'normal' I will report back when i get RAVEN2 working!

Really appreciate you work on this.

=====================================

Edit: Yes, did get Raven2 working eventually & updated Firmware to latest version too - all good!
[Fire TV Original Android Development] Pro-me3us:
Vendor.img? I would not have guessed that being an issue :unsure: Were you previously re-flashing individual partitions?
[Fire TV Original Android Development] Pro-me3us:
@JJ2017 I was able to confirm that the old version of Magisk will cause the Cube to hang after installing the new Magisk.apk over it. I added a note to the OP to first run adb shell rm /data/adb/magisk.db before patching the Cube with v2.0. It can even be run after patching with v2.0 at the black blank loading screen, followed by a reboot. This will not affect any of your previously installed Magisk modules.

I had wanted to wait for a Magisk Canary build with official package signature, but Canary builds are only coming out every +2months now, and there was no ETA on the next one. This adds a messy little complication if you already had an official build installed.

If you encounter any other issues let me know.
[Fire TV Original Android Development] Michajin:
Great work @Pro-me3us ! If anyone is interested, they still sell the unlockable Cube2 through Verizon to even non-customers (maybe customers can get them cheaper). Costly though $119, I would expect them to a clearance sale soon. The parts to do the exploit $10. OP is very responsive. I am very much a novice and he walked me through the process with the tiny88 card. I can't promise every cube2 verizon sells is going to be on 7.2.2.9 but the one i bought was and the refurbished ones were. If you decide to get one, make sure you dont update or anything, either do the exploit on first boot before connecting network or use the bypass from aftvnews (make sure you have a SLOW, SLOW CONNECTION SPEED (i used my metered hotspot).
[Fire TV Original Android Development] Pro-me3us:
Updated the OP with a newer version of TWRP and a couple bug fixes. I've also included options to boot into Fastboot, TWRP, and Amlogic Update using the buttons on the Cube during bootup.

Holding volume down still works to boot in to safe mode / disable Magisk modules, you just need to wait until the blue LEDs / first Amazon logo to press and hold. Remember that if you do this you need to manually re-enable modules in Magisk Manager, and that the OTA blocker won't be in effect until the module is re-enabled and the Cube is rebooted.

The last batch of 2nd gen Cubes manufactured have PS7229, so if anyone can find a new unit anywere, it can be rooted. If you patch the Cube right out of the box before registration, the Magisk OTA blocker module should be in effect during setup. Hold 'back'+'menu' when you get the checking for update error, to skip that step.

Thanks for the feedback, I think the new v2.1 should cover a couple of the issues you encountered while patching with v2.0

Great! The new version of TWRP will show all the main partitions now consistently. This may have been why you had issues with your backup?

To restore a previous firmware you only need to flash:

boot

data

odm_image

product_image

vendor_image

system_image

These are the only partitions that get updated with OTA updates. There's also the bootloader but it's blocked in TWRP and should never be updated. For a complete Cube backup you can use bash menu 7) Download partitions with Amlogic burn mode to dump everything to your computer. Those .img files can be flashed back to the Cube from Fastboot or TWRP.
[Fire TV Original Android Development] Michajin:
This is awesome...

Cube's physical buttons can be used on bootup

Volume Up ---> Fastboot

Volume Down ---> TWRP recovery

Action button ---> Amlogic Update
[Fire TV Original Android Development] Pro-me3us:
Magisk Canary build v25.208 is newly available.

Magisk included with Raven boot menu 2.0 and 2.1 has a different signature than the official build line. There's no need to upgrade if you don't want to, but if you want to hop back on the official build line:

Download Magisk v25.208+ to Cube's Download folder

Reboot to TWRP. Open Magisk Manager, tap on reboot icon in top right corner, select 'Reboot to Recovery'. Alternatively, reboot, press and hold volume down on Cube.

Flash Magisk apk in TWRP. Connect a mouse to the Cube, tap install button, select Magisk apk

Reboot to FireOS, install Magisk apk to enable Magisk Manager.

If you don't have a mouse or prefer to use a computer:

Connect computer to Cube with microUSB to USB-A cable

Reboot to TWRP adb shell reboot recovery, or use either method above.

Flash Magisk apk

adb shell

twrp install '/data/media/0/Download/<magisk-filename.apk>'

Reboot to FireOS and install Magisk apk

Once back on the official Magisk build line, all future Magisk updates can be done directly through Magisk Manager.

If the Cube hangs at the FireOS logo during bootup, delete the magisk.db file (adb shell rm /data/adb/magisk.db). You can either open an adb connection (connected computer) at the logo, or delete magisk.db in TWRP.
[Fire TV Original Android Development] Pro-me3us:
A couple DFU dongles were added to Tindie for anyone with a Cube still on pre PS7273 firmware.
[Fire TV Original Android Development] cali.s:
any chance to root current firmware?
[Fire TV Original Android Development] Pro-me3us:
Unfortunately no, this rooting method uses two vulnerabilities that were both patched in PS7273. This is all there is for the 2nd gen Cube currently
[Fire TV Original Android Development] Pro-me3us:
There are refurbished 2nd gen Cubes on Woot for $40. No idea if these are on pre7273 firmware.

I'm rolling the dice and in for one.
[Fire TV Original Android Development] butterchips:
I don't know how to read schematics, but if I get this exact dongle, do I lift the top pin or bottom pin from the PCB?
[Fire TV Original Android Development] errut:
does this Method work for PS7633/3445?
[Fire TV Original Android Development] Pro-me3us:
You lift pin2 and connect it to pin8 with a wire

@errut This DFU based method of rooting the Cube only works up to Firmware PS7242/3516.

Unfortunately there's nothing for PS7633/3445. I'd suggest blocking updates to prevent any further updates, in case a new method is ever found.

@butterchips you can use this newer method to root your Cube, but assuming your Cube is on Firmware PS7242/3516 or older, I'd still recommend making a DFU dongle so that you have it as a recovery option if you ever get in trouble.
[Fire TV Original Android Development] boxster03:
Appreciate all your work and help. Have you checked what OS version came on the woot deal?
[Fire TV Original Android Development] Pro-me3us:
The two Woot Cubes I've seen came with firmware between PS7273 and PS7292. I don't know that there was a set firmware version.
[Fire TV Original Android Development] boxster03:
So to make the hdmi dongle, I have to DISCONNECT pin2 from the pcb (GND) and via a wire connect pin2 to pin8 (+5V) (pin2 goes from GND to +5V)?

How to find out whether the method will work for the Woot deal refurb cube 2 I received recently? I don't know what firmware it is on (still in box). If I connect and power up, then sign on to Amazon, will it lose the chance of rooting? I believe I can stop it from auto update FireOS at initial set up by the method discussed in other threads and sign on to amazon to find what OS it is.

What are the chances it is a rootable OS <7242??? If it is 7273 will this method work? I am wondering if it is worth dealing with those tiny pins with the soldering iron I have (it is not meant for such small pins).
[Fire TV Original Android Development] Michajin:
dont let it update...

How to Skip Software Updates during Initial Setup or Factory Reset on a Fire TV, Firestick, or Fire TV Cube

Since the latest software update for Fire TV devices is blocking the ability to use custom launchers, you may want to avoid updating a new or factory reset Fire TV.

www.aftvnews.com