[Fire TV Original Android Development] Pro-me3us:
View attachment 5831563

Raven Boot v2.0 now includes persistent root. A huge thank you to @Functioner for getting it working! This package includes unrestricted U-Boot, fastboot & Amlogic burn mode commands, as well as TWRP and Magisk support. The Raven boot tool includes options to root your Cube, gain temporary root access without modifying your device, and a number of options for recovery and backup.

View attachment 5642907

NOTE: PS7242/3516 or older required

A newer method is available that works up to PS7292, that doesn't use DFU or a DFU device, but has no DFU recovery options

NOTE: This process does not require you to open your Fire TV 2nd gen Cube

Changelog:

v2.2 April 7th, 2023​

Minor update to Magisk 25.208

Hopping back on official signed Magisk app line

v2.0 and v2.1 use an unofficial Magisk build that will result in a signature mismatch when updating.

If you are using Raven root v2.0/2.1, delete the file /data/adb/magisk.db on your Cube,

before updating to Raven root v2.2.

Added USB booting for flash drives that use aml_autoscripts, for future development.

​

v2.1 February 18th, 2023​

Updated TWRP v3.6.1-9-0 ---> v3.7.0-9.0

Fixed problem with TWRP not always displaying all the partitions under 'Mount/Backup'

Always mounts 'Internal Storage' to /sdcard now

Fixed bash menu to always use the included fastboot binary

Cube's physical buttons can be used on bootup

Volume Up ---> Fastboot

Volume Down ---> TWRP recovery

Action button ---> Amlogic Update

**Hold down button for ~5sec after power-on, and before the blue LEDs / 1st Amazon logo​

​

v2.0 February 9th, 2023​

Root is now persistent, does not require computer after every reboot

One click option to install root access, TWRP, Magisk & OTA blocker module

Magisk updates

Zygisk is working (July 1st, 2022)

Magisk can be installed from TWRP or direct installed from within Magisk Manager

Created module to block Amazon OTA updates via etc/hosts and hiding the OTA apk

updated quick access images to Magisk v25.2

TWRP updates

Bootloader flashing is blocked, so that full OTA firmware bins can be easily flashed (tested up to PS7624/3337)

Removed firmware downgrade checks & warnings

Added NTFS support for flash drives within TWRP

Added options to backup entire reserved partition, and mmcblk0boot0 & mmcblk0boot1 boot partitions in Amlogic update

Added emergency boot to Fastboot/Update modes

v1.0 May 15th, 2022​

Temporary unrestricted fastboot, u-boot & update commands

Boot with root access or Magisk support

Boot to TWRP for backup & recovery

Backup Cube using Amlogic Update

What's needed:

linux installation or live-system (Ubuntu 20.04.x recommended)

micro-USB cable

device to put Cube into device firmware upgrade (DFU) mode [read below]

View attachment 5643031

libusb is needed for your linux installation to detect the Cube over USB.

sudo apt-get install libusb-1.0-0

To automatically set the proper udev rules for Amlogic install Khadas utils:

sudo apt-get install libusb-dev git

sudo apt-get install git

git clone https://github.com/khadas/utils

cd utils

./INSTALL

***NOTE: If you previously installed Magisk on your Cube from raven_boot v1.0, first run adb shell rm /data/adb/magisk.db to prevent any conflicts with the new Magisk version.

Instructions

Download the latest raven_boot.zip and unzip it. Open a terminal window from the unzipped raven_boot directory

Power off the Cube and connect your DFU device to the Cube's HDMI port. Connect the USB cable (microUSB to USB-type A) to computer & Cube

Power on the Cube, type lsusb in the terminal to confirm ID 1b8e:c003 Amlogic, Inc. is present, indicating the Cube is in DFU mode

Unplug the DFU device from the HDMI port, reconnect the Cube to TV with HDMI cord. Keep the computer connected.

In the terminal type bash menu, and choose option 1) to automatically root the Cube.

To preserve the Cube's persistent root, be sure to confirm that both TWRP & Magisk are installed.

Quick Access

For options 2) and 3) to gain temporary root, download the images zip file that corresponds to your current FireOS version, and unzip the contents into raven_boot/images directory.​

For Cubes running FireOS 7242/2896 or later get ---> images_7242-2906_v2.0.zip​

For FireOS versions 7201/942 to 7242/2216 get ---> images_7229-1853_v2.0.zip​

View attachment 5831657	View attachment 5642919

Magisk v25.206 is included with Raven boot, it's recommened that you use this version or newer. For instructions on how to update your firmware and keep root access, read here

About the exploit

This exploit is based on a vulnerability in the Amlogic bootrom that allows for us to run unsigned code in the next boot stage (Bl2). To pause the automatic boot up process, before the Cube's saved Bl2 is loaded, we rely on Amlogic's device firmware upgrade mode (DFU). In DFU, only the boot code from the Amlogic s922x SOC (Bl1) has been loaded into memory. We then use the vulnerability to load our modified Bl2, breaking the 'chain of trust', and disabling secure boot so that we can make modifications to the bootloader downstream. The last stage of the bootloader is U-boot (Bl33) which hands off the startup process to the kernel (boot.img). U-boot is modified to unlock any restrictions on u-boot and fastboot commands, giving us full access to system features. We can then use fastboot boot to load our modified boot images (TWRP, magisk-patched boot.img), into memory without modifying the Cube's eMMC.

Visit GitHub for a more in depth write-up and resources used in this project

Contributors

@Functioner

@Zenofex

@npjohnson

@zeewox

@Pro-me3us

Additional thanks to

@tchebb - a bottomless encyclopedia of Amlogic knowledge, answering countless questions & troubleshooting

@roligov - providing photos, additional FireOS updates, and testing

@osm0sis, @canyie, @vvb2060 & @yujincheng08 - the Magisk team for being awesome, troubleshooting and making a number of code changes to get all features working on the Cube

@k4y0z - helping troubleshoot some TWRP and Magisk issues