yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Pro-me3us:
That's a very nice improvement over Superna9999's design, you should share this with him :D I did start to strip the plating on my HDMI cable from all the plugging/unplugging during testing. With this design, does the Cube end up powering two ICs, the one on the dongle and the one in the TV HDMI port? Are there any issues having the Cube power both?

Even with the original design, I think a power cycle is required to get into DFU, rather that just a reboot. I remember adb rebooting would cause the Cube to keep resetting until a power cycle or the dongle was removed. It may be that there is a bootrom level 'reboot reason' stored in volatile memory, that's not cleared until power cycling? If you send a reboot command from u-boot / burn mode are you put in DFU, or do you still need to power cycle? I briefly looked for a command to reboot into DFU (without I2C), but couldn't find anything.

You'll need to use a canary build of Magisk to make your own patched boot.img. There is an Amlogic quirk that probably affects many slot A only devices. Amlogic uses the suffix 'normal' rather than '_a', which is not recognized by Magisk. A patch was added to ignore the suffix in canary build ~24.310.

When patching the boot.img with Magisk, choose recovery mode and leave vbmeta unchecked. Using the regular boot mode (not recovery mode), results in a mount/unmount loop during bootup. The cause of this will have to be worked out long-term for a persistent root. Right now SU works for Magisk but Zygisk doesn't. I'm not sure if that is a limitation of loading Magisk with fastboot boot, or because recovery mode is being used to create the patch.

You will also want to enable UART output from the kernel. This will be applied to your Cube automatically by choosing bash menu 1) boot to FireOS with ADB root / permissive. You can do it manually by booting to fastboot

fastboot oem flags fos: 0x4

The flags are stored in IDME and can also be changed directly there

fastboot oem IDME fos_flags 0x4

The IDME values will persist without the exploit, but values like

ADB root and DM-verity off will be ignored/rejected by the native bootloader when uboot determines the Cube is not an engineering device (defined as ARB=0). But the console enable value will be accepted, letting you see native FireOS uart output.

EDIT: I added the 31 IDME properties that can be edited
[Fire TV Original Android Development] Deleted member 11959327:
I don't think current draw is a problem. A 24c02 eeprom draws 1 mA max when reading, and 5 μA max when in standby. Even if both eeproms on the bus were read at the same, that would not be a lot of current. There is only one read operation of each serial device per power cycle.

Consider another edid emulator with passthrough, the gofanco prophecy. The gofanco emulator has not only two onboard 24c02 eeproms, but also a 3AQ20 MCU and a hc4052 mux/demux IC, all powered by the hdmi port.

Thanks. I didn't realize that 24.310 was used on the supplied image or that a recovery style patch was required. Now it all works.

Thanks for the list of IDME properties. I'm getting up to speed now. It's quite different than the typical amlogic setup. No env or vbmeta partitions. There doesn't seem to be any vulnerabilities like the uboot/rsv exploit used for the gen 1 cube.
[Fire TV Original Android Development] Pro-me3us:
Oh ok that's a minuscule amount. I think HDMI ports are rated for 50-300mA output. Are you able to passthrough 4k 30FPS, 60FPS (Youtube for example) with the one of those connected? Or DV/HDR? I'm curious if a dongle like that could be left in for regular use of the device.

Yeah an ENV partition would have made things a lot easier. Most Fire devices are MediaTek based, and the Cube is sort of alone in the use of U-Boot. There's also the 1st gen Cube and Pendant, but they are getting hard to come by. Frederic's exploit will probably work for any G12A/G12B/SM1 SOC from Amlogic, including the 1st gen Cube and Pendant, but I don't have one to test and make the necessary modifications. Amazon no longer sells these two models, and I'm assuming they also lost DFU access with the February/March update.

I think the uboot/rsv exploit got patched pretty soon after the FireFU release. I also checked aml_emmc_partition.c for the 2nd gen Cube and it was patched by the release version 7.2.0.4.

There is the u-boot vulnerability database. I don't know if any of these are present or useful on the Cube, testing them is above my skill level. I was only able to apply Frederic's exploit to the Cube because he documented everything very well.

I've posted a draft of the raven exploit on github with a little more information. I still need to edit it a bit, but the outline is there.
[Fire TV Original Android Development] Deleted member 11959327:
It all seems to work so far. All 19 lines are wired as passthrough. The passthrough hdmi ddc link doesn't seem to be bothered by having a non-standard i2c address eeprom on the bus.

That's a very illuminating writeup. It instantly filled in a lot of holes in my understanding.

That also seems to have been quite a lot of work, thanks again for sharing it all.
[Fire TV Original Android Development] Pro-me3us:
Isn't that most projects, more work than initially anticipated :LOL:

I did all my testing with the ribbon cable to the physical buttons disconnected. Can you check something for me since you have UART access with the buttons active?

When in FireOS, holding down the Cube action button (button with dot) for 15sec kills all processes and appears shut the device down. But the device is not powered off, the mute button still turns on/off. If you boot into FireOS with the adb root/permissive option, what does the UART output say when doing this?

In this mode, if I press the action button again the Cube reboots, but if I press any of the other buttons, and then action, the Cube does not reboot. So I'm wondering if the Cube is being dropped into some sort of diagnostic that may be accessible from UART.

I'd be interested in seeing any of the UART output including the reboot string

G12B:BL:6e7c85:2a3b91;FEAT:F2FB39B0:432060;POC:7;RCY:1;USB:3;

I don't know if there are any hidden button combinations when powering the device on that do anything. I'm not sure where that would be defined in the source code. Holding the vol - button during bootup puts the Cube in safe mode. I don't think there are any other known power up button functions yet.
[Fire TV Original Android Development] Deleted member 11959327:
Do you happen to know why a uart command prompt console can't be started? If;

start console

is executed in a shell with root access, it appears to execute successfully, but no console command prompt appears over the uart connection.

Edit: resolved, disregard.
[Fire TV Original Android Development] Pro-me3us:
Ah ok, maybe it is only a shutdown command in that case. The reboot reason 0x108 might be SHUTDOWN_LONG_PWR_KEY_PRESS according to sign_of_life_vendor.c. This looks similar to adb reboot -p which is a software shutdown (0x109?). After a software shutdown the Cube can also be rebooted with the action button. There may be no way to completely shutdown Cube without a real power button. I don't know why in this state pressing the action button doesn't consistently reboot.

Pressing the power button on the remote might also put the Cube in a similar suspension state that does allow waking.

I only ever used UART for logs while the kernel was loaded. I never tried to bring up a command prompt. Did you manage to get input working through UART?

For fos_flags the default is 0x0. If you are using the bash menu script it is setting the fos_flags to 0x87 each time FireOS with ADB root is booted. You will have to fastboot boot the image manually to avoid that. You can also set the Flag values with ADB root using the command 'idme fos_flags value'.

The focus was pretty narrow while working on getting the exploit working. I didn't spend much time with the bootrom. Frederic gave me most of the addresses I needed once the bootrom was extracted. I haven't heard of anyone finding extra I2C commands. Both the FireFU and Superna9999 page mention boot@SPI, but I don't know if that actually works.

You can take a look to see if there is anything interesting. To dump the Cube bootrom run the following command with the zipped files:

sudo ./amlogic-usbdl memdump_over_usb_s922x.bin cube_bootrom

There is also the question of what that missing 20pin connector is on the Cube PCB.
[Fire TV Original Android Development] Pro-me3us:
@fire_cuber When downgrading, you usually need to do a data wipe, because there are settings on the data partition that are not present or incompatible with earlier OS versions. Why did you want to downgrade to PS7212?

But if you are now trying to update from PS7229/1850 to PS7229/1853 that shouldn't be an issue (no data wipe needed). Did you initially root with Raven Boot 2.0 or 2.2? The important difference is the version of Magisk that they use, they aren't compatible.

First rerun the patching procedure with Raven boot 2.2, and see if you can boot to FireOS. If not, boot into TWRP and delete the Magisk database.

raven:/ # rm /data/adb/magisk.db

Keep your Cube offline until you can verify updates are blocked in FireOS.

Raven boot 2.2 also adds USB booting for CoreELEC/EmuELEC
[Fire TV Original Android Development] fire_cuber:
Would the commands in the order via ADB be correct?

twrp wipe cache

twrp wipe dalvik

twrp wipe data

I have to correct myself it was not Raven Boot 2.0 but with your raven_root_shrinker_v2.2.3

[Temp ROOT] - [BOOTLESS MAGISK] - [UNLOCK/MAGISK/TWRP] FireTV 2nd gen Cube (raven) ≤ PS7624

Overview This rooting method is based on a vulnerability in the ARM Mali GPU driver (CVE-2022-38181) discovered by security researcher Man Yue Mo at GitHub Security Lab, to gain root access to the 2nd gen Cube that is on firmware PS7624/3337 or...

xdaforums.com

Do I still have to do this if I used method raven_root_shrinker_v2.2.3?

That's what I do with the DNS method of Ighor

Block updates. DNS way. No root needed

Here is instructions of how to block Updates on a Fire TV. Important! Recently a Fire TV update released, it blocks any way to disable auto updates, except this one Some ISP are replacing client DNS requests by their own answers, in that case...

xdaforums.com

FireOS 7.2.1.2 (PS7212/1333) is the oldest version I have found, prior to FireOS 7.2.2.9 (PS7229/1853).

I need remote access to my mother's cube via the internet. With Anydesk, I was able to set this up so far that my mother doesn't have to approve or confirm anything else.

I can connect to the cube via the internet from my tablet or PC without any problems and can also move the cursor visibly, but there is no reaction to the mouse clicks.

As far as I've read here in the forum, it's supposed to have worked until before 7.2.2.8. From 7.2.2.8 onwards, Amazon's accessibility services were probably restricted.

With [APP][FIRETV] Accessibility Permissions Manager for FireTV Devices, lider doesn't help either.

Clicks in Anydesk also don't work because of this.

[APP][FIRETV] Accessibility Permissions Manager for FireTV Devices

Accessibility Permissions Manager Hi Everyone, I would like to share with you my app which you will only need if you want to use apps which needs Accessibility Permissions to work. This app reduces the hassle to enter the commands to set those...

xdaforums.com

If there is another method without the person seeking help having to send any codes like with Vysor, I would be interested.

Unfortunately, I can't continue testing until tonight because I'm still at work.

Thank you so far.
[Fire TV Original Android Development] Pro-me3us:
If you do a 'wipe data' that will likely work. But wipe data is the equivalent of a factory reset, and I was trying to save you the hassle of setting FireOS up from scratch. Since you want to use PS7229, you'll need to do this anyway.

twrp wipe cache

twrp wipe dalvik

twrp wipe data

twrp install firmware PS7229

twrp install Magisk

twrp install Magisk OTA blocker zip (included in Raven Root/Boot)

You'll then need to go through device setup/registration. Assuming the OTA blocker module is working, the Cube will immediately fail on the checking for updates screen, hold Back + Menu buttons on the remote for 5sec to bring up voice accessibility screen, press back, and that should get you to the Amazon registration screen.

If you do the procedure above, any magisk issues will also be resolved. The directory /data/adb/ where Magisk files are installed, is deleted with twrp wipe data.

A lot of the time if you are updating, and get stuck at the animated FireOS logo, it's something with Magisk. Installing an older version of Magisk over top a newer version can be a problem. Installing a signed copy over an unsigned copy can cause problems. In both cases, deleting /data/magisk.db usually enough to fix that, and non-destructive (Magisk modules and FireOS remain in tact).

Ok, I'm not sure what the app is requesting and being denied, so I can't say. With root, you should be able to grant any privileges required. I don't know if the app relies on some Android function that is disabled later on, or just restricted without root.

You can install the app from adb with the -g parameter which should grant it all permissions it's requesting.

raven:/ # pm install -g <app-filename.apk>

You can also check what permissions it's requesting and if it's been granted with

raven:/ # dumpsys package <package.name>
[Fire TV Original Android Development] fire_cuber:
When I came home after work and turned on the Cube and suddenly it took off until the normal launcher.

I guess I hadn't waited long enough the first time I rebooted or whatever.

As of now, the Cube starts normally again

Is still on FireOS 7.2.2.9 (PS7229/1853)

But when I do adb reboot recovery I can't get into TWRP anymore, it just says "no command"

Looks like I've lost root and TWRP now.

But since I'm still on 7.2.2.9 because no update can be done, it should be possible to get back to the goal with raven_root_shrinker, shouldn't it?
[Fire TV Original Android Development] Pro-me3us:
Make sure updates are blocked immediately, and clear the update folder /data/ota_package, also

raven:/ # pm clear com.amazon.device.software.ota

Yes, you can run raven root shrinker to repatch it. It sounds like you got VERY lucky that an update didn't download and install, because there was nothing protecting it.

If you ever see the recovery screen with an OTA firmware updating your cube, unplug it immediately! It's better to brick the Cube than to let it update. You can always unbrick it as long as the DFU fuse isn't burned.
[Fire TV Original Android Development] fire_cuber:
I'm not sure if I was lucky.

But I didn't see a recovery screen and updates are still blocked via DNS.

I just tried it and got the following ad.

Any ideas?

Ah I see raven again:/ # instead of raven:/

Instead of

raven:/ $

Does it mean that I am root again?

raven:/ $ /data/local/tmp/raven_shrinker

fingerprint: Amazon/raven/raven:7.0/PS7229/1853N:user/amz-p,release-keys

failed, retry.

failed, retry.

failed, retry.

region freed 45

alias gpu va 100c84000

read 0

cleanup flush region

release_mem_pool

jit_freed

jit_free commit: 0 0

Found freed_idx 0

Found pgd 23, 100c9b000

overwrite addr : 104100634 634

overwrite addr : 104300634 634

overwrite addr : 1041001bc 1bc

overwrite addr : 1043001bc 1bc

result 50

raven:/ #
[Fire TV Original Android Development] Pro-me3us:
Ok, the DNS block saved the Cube then. I'm guessing you didn't reflash Magisk after the last firmware flash. Without a Magisk patched boot image, TWRP is lost after the next reboot.

The shrinker script worked fine above, you have temp root. Now you need to run install_root.sh
[Fire TV Original Android Development] fire_cuber:
OK :)

Do I have to run again?

chmod +x /data/local/tmp/install_root.sh

Or is that enough?

ADB Shell

/data/local/tmp/install_root.sh
[Fire TV Original Android Development] fire_cuber:
OK worked :)

Is everything going as it should :)

Thanks again for your help!

raven:/ # /data/local/tmp/install_root.sh

Firmware version check passed

Checking if required files exist and have the correct hashes...

All required files exist and have the correct hashes. Proceeding...

Making backups in /data/local/tmp/backup/...

8192+0 records in

8192+0 records out

4194304 bytes transferred in 0.147 secs (28532680 bytes/sec)

8192+0 records in

8192+0 records out

4194304 bytes transferred in 0.146 secs (28728109 bytes/sec)

2048+0 records in

2048+0 records out

1048576 bytes transferred in 0.039 secs (26886564 bytes/sec)

49152+0 records in

49152+0 records out

25165824 bytes transferred in 2.166 secs (11618570 bytes/sec)

Enabling persistent ADB root...

Flashing bootloader...

3285+0 records in

3285+0 records out

1681920 bytes transferred in 0.374 secs (4497112 bytes/sec)

3285+0 records in

3285+0 records out

1681920 bytes transferred in 0.309 secs (5443106 bytes/sec)

Flashing misc exploit...

2048+0 records in

2048+0 records out

1048576 bytes transferred in 0.079 secs (13273113 bytes/sec)

2048+0 records in

2048+0 records out

1048576 bytes transferred in 0.018 secs (58254222 bytes/sec)

Writing idme data...

Installing TWRP recovery...

45288+0 records in

45288+0 records out

23187456 bytes transferred in 6.974 secs (3324843 bytes/sec)

Creating script to protect misc...

Writing instructions for TWRP...

To finish installation, type:

1) 'exit'

2) 'pm install -r /data/local/tmp/magisk.apk'

3) 'reboot recovery'

raven:/ # exit

raven:/ $ pm install -r /data/local/tmp/magisk.apk

Success

raven:/ $ reboot recovery
[Fire TV Original Android Development] fire_cuber:
Damn too early rejoiced. :(

Now the voice control (Alexa) no longer works.

And yes, I need them because I use them to control lighting and heating.

Unfortunately, resetting the voice remote doesn't help either.

Unfortunately, this is where the Alexa app goes haywire.

When starting (or asking) an action with "Alexa start..." the LED strip on the cube lights up briefly.

After that, the following error message is displayed on the TV:

"Stop 🎤, speak by the tone. An unexpected error has occurred. If the problem persists, contact Amazon customer service."

I have to redo everything again.

But I don't do that until the weekend.

But half as wild, for my Kodi and the Wolf launcher I have a backup and the rest of the apps drag the cube then pulls on its own as soon as I click on the shortcut in the Wolf launcher.

In addition, you learn a lot from such mistakes.

Is there actually somewhere the firmaries compiled as .bin?

for

FireOS 7.2.1.6

FireOS 7.2.2.4

I can only find the source code

Are these actually differential firmware updates between

FireOS 7.2.1.2

and

FireOS 7.2.2.9

Or full firmware updates?
[Fire TV Original Android Development] Pro-me3us:
When you downgraded to PS7212, and then upgraded again to PS7229, did you do a data wipe? Maybe some settings got messed up? A data + cache + dalvik wipe will put you on a clean slate. You'll need to reinstall Magisk Manager and any modules.

You didn't install any Alexa apk updates? Vizzini v3+ shouldn't be installed on any FireOS below PS7273.

There are full firmware bins for all the FireOS versions, but I missed most of the early ones. The only full firmware bins I found are the ones listed on the firmware page.
[Fire TV Original Android Development] fire_cuber:
#####

No, I didn't do any data erasure when downgrading to PS7212 and then upgrading to PS7229.

#####

No, I don't have any Alexa Apk updates installed.

It will be the case that it is messed up without the data deletion.

So I'm not going to get around it.

I'm going to do it as in your post #183.

Of course, with the DNS block for the updates in my router.

#####

I didn't find any other firmware bins via google either
[Fire TV Original Android Development] Pro-me3us:
@fire_cuber before you do that, try clearing the data for just the app

raven:/ # pm clear com.amazon.vizzini

raven:/ # pm clear com.amazon.tv.launcher

raven:/ # pm clear com.amazon.venezia

Not sure that will be enough, otherwise go with post #183 to start clean.
[Fire TV Original Android Development] fire_cuber:
OK, I'll try that again in a moment.

Thanks for pointing this out :)

##edit 1##

Super awesome, that helped the voice control work again.

This saves me the extra tour with the data deletion.

Thank you so much for that!

I wish you a nice evening :)

##edit 2##

Small addendum.

I have now downgraded to FireOS 7.2.1.2 with a new configuration and Anydesk is finally working fantastically.

RustDesk also runs perfectly.

I also liked the old start page better anyway, in case I ever open it.

But I'm usually in the Wolf Launcher.
[Fire TV Original Android Development] pretzells:
just to confirm, the hdmi boot dongle, pictured, is still current and the best interface??
[Fire TV Original Android Development] Pro-me3us:
'Best' is more about technical abilities and what you already have :D

If you already have an ARM based Arduino, then that is best because it's already in your hands. This HDMI dongle is the most convenient. It does require some fine soldering and programming the address.

IMO the ATtiny88+HDMI breakout board is the easiest to program and setup. It can be assembled without soldering, and programmed with one command.

All three of these will work, and you only need to enter DFU once to unbrick the Cube, so convenience is not going to be so important.
[Fire TV Original Android Development] pretzells:
will be starting with everything new, hardware, thanks for the advice, will pick up the ATtiny88+HDMI breakout board. glad i dont have to play with the dongle as my tools are more geared to large projects rather than fine electronics. if there anything else that you could think of that would make for smoothe sailing, im open to suggestions. thanks again, cheers
[Fire TV Original Android Development] Pro-me3us:
On Aliexpress you can find the ATtiny88 for $1-2. The header pins don't come pre-soldered in. If you don't want to do any soldering there is this style of HDM breakout board. You can wrap the three wires through the ATTiny88, and screw the other ends down on the HDMI board.

If you don't mind soldering the header pins into the ATtiny88, there is this style HDMI breakout board and this one, and you can connect the two boards with 3 female-female dupont wires. Browse around Aliexpress to find the cheapest sellers.

To use the ATtiny88 you'll need 2 microUSB-to-USB-A cables. One cable to power the ATtiny88 and a second cable to connect your computer to the Cube. And Linux (Ubuntu 20.04 recommended) to program the ATtiny88 and to unbricking script.
[Fire TV Original Android Development] pretzells:
having a problem flashing attiny88, if i understand correctly, flash with micronucleus then send the hex to cube afterwards. i cannot flash the attiny, linux 21.3, installed all drivers in instructions, red light flashing indicating waiting.......any suggestions. thanks