yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] FormulaCars:
I am getting this error using method 3 boot loader unlock.

C:\Windows\system32>adb shell

raven:/ $ /data/local/tmp/raven_shrinker

fingerprint: Amazon/raven/raven:7.0/PS7224/1752N:user/amz-p,release-keys

failed, retry.

failed, retry.

failed, retry.

failed, retry.

region freed 11

alias gpu va 100c85000

read 0

cleanup flush region

release_mem_pool

jit_freed

jit_free commit: 4 0

Found freed_idx 4

Found pgd 23, 100d00000

overwrite addr : 104100634 634

overwrite addr : 104300634 634

overwrite addr : 1041001bc 1bc

overwrite addr : 1043001bc 1bc

result 48

raven:/ $

I've tried for hours each time waiting different amounts before running raven but it doesn't seem to change the results. Sometimes the cube will reboot or I will get a success message, but I never get granted the temporary root access I need to run the following script.

Instead I get the dreaded "The script must run as root" error when I try to run install_root.sh I can see that I wasn't granted root as I get $ instead of #.

Fire Cube 2nd Gen Version 7.2.2.4 Fire TV Home 6240499.1

I unplugged the coax cable from my router/modem so I could use add shell without the risk of connecting. The cube has a flashing orange light like it wants to update but can't.

Any help would be beyond appreciated as I have spent countless hours trying to run the root script.
[Fire TV Original Android Development] Pro-me3us:
The problem isn't on your end. raven_shrinker has to be tweaked for each firmware version. I don't have a copy of PS7224/1752, so the current values were a guess based on firmware around that version. Here's another version to try.

When you see this part of the output

overwrite addr : 104100634 634
overwrite addr : 104300634 634
overwrite addr : 1041001bc 1bc
overwrite addr : 1043001bc 1bc
result 48
raven:/ $

that will indicate if the new values succeeded (raven:/ #) or failed (raven:/ $)

It might take a few versions of raven_shrinker to get this right without having the firmware itself.

If it does succeed, can you make a copy of the boot.img and bootloader before you run the unlock script. They will be in the Cubes download folder:

raven:/ # dd if=/dev/block/boot of=/sdcard/downloads/boot.img

raven:/ # dd if=/dev/block/bootloader of=/sdcard/downloads/bootloader.img
[Fire TV Original Android Development] FormulaCars:
I have tried this script and I am getting the same error as above. Result 48 with no root granted.

I will gladly upload my files once I get root access.
[Fire TV Original Android Development] Pro-me3us:
Try this version. Copy & paste the output here.
[Fire TV Original Android Development] FormulaCars:
Unfortunately I am still having problems.

Here is my output:

C:\adblink>adb shell

raven:/ $ /data/local/tmp/raven_shrinker

fingerprint: Amazon/raven/raven:7.0/PS7224/1752N:user/amz-p,release-keys

failed, retry.

failed, retry.

failed, retry.

failed, retry.

region freed 18

alias gpu va 100c85000

read 0

cleanup flush region

release_mem_pool

jit_freed

jit_free commit: 1 0

Found freed_idx 1

Found pgd 23, 100cb5000

overwrite addr : 104100634 634

overwrite addr : 104300634 634

overwrite addr : 104100490 490

overwrite addr : 104300490 490

result 48

raven:/ $
[Fire TV Original Android Development] Pro-me3us:
Ok that version relied on the raven source code. This is going to require a little more work, I PM'ed you.
[Fire TV Original Android Development] pretzells:
can twrp recovery be applied to 7624 or later as of yet???? no custom roms either???
[Fire TV Original Android Development] Pro-me3us:
TWRP needs an unlocked bootloader to boot. That's only possible up to PS7292. There's CoreELEC and EmuELEC. Doubt anyone's going to build a LineageOS ROM for raven.
[Fire TV Original Android Development] pretzells:
thanks Pro-me3us, just checking in to see if theres been any updates, been out of the loop for awhile.
[Fire TV Original Android Development] pretzells:
i plugged in a cube an hour ago, it was fully rooted with twrp and magisk and 7.2.1.2 bin, was registering when it rebooted and got stuck now on fireOs screen. fastboot not working, no signs of life just black screen with fireOs image in middle of screen, no idea what happened. any ideas???
[Fire TV Original Android Development] Pro-me3us:
Sounds like a FireOS update downloaded during registration, the cube rebooted to install it, and wiped the unlock exploit in the process. Maybe you did a data wipe and didn't reflash the Magisk OTA_blocker after flashing Magisk?

Assuming the unlock exploit was wiped, the Cube is booting straight to fastboot now. Connect your computer to the Cube with a USB cable and type Fastboot devices, that will tell you if you are in fastboot. But it won't matter without the unlock exploit, fastboot is locked down.

The Cube is bricked, and will require the original unlock exploit to unbrick it.
[Fire TV Original Android Development] pretzells:
Sending 'boot.img' (22644 KB) OKAY [ 2.192s]

Booting FAILED (remote: 'blocked command')

fastboot: error: Command failed

whats strange is that theres no led's or anything, bricked i guess cant get into fastboot or any state for that matter. got a little project when the weather goes bad. thanks for the help. cheers
[Fire TV Original Android Development] Pro-me3us:
When the exploit is wiped, the modified boot and recovery images (magisk / twrp) fail the normal boot image signature check, and the Cube automatically drops into fastboot.

You're in fastboot, but without the exploit all the Amazon fastboot restrictions are in place. That's why you get 'blocked command' when trying most fastboot commands.

Unbricking is easy once you're able to boot into DFU mode. If you aren't in a rush, the required parts are $5 or less on Aliexpress.
[Fire TV Original Android Development] pretzells:
yes, im going to try to recover this cube, no rush, cant believe i did this, my mistake. im sure i will be bothering you when i come to a roadblock. thanks again for your time. im posting another question without quoting
[Fire TV Original Android Development] pretzells:
through adb, pm list users, how would i change and delete users?? i see current user that im not familiar, must be original registered user. my profile/account is nowhere listed. i can create new users, pm create-user no problem, i can delete users, pm remove-user. but what i cant do is switch user and then delete one. anyway of doing this>>

im guessing that current user is the running user, therefore it cannot be deleted, how can users be switched through adb??? any idea, i was quite surprised to see who and what was in the devices memory. cheers
[Fire TV Original Android Development] Pro-me3us:
I don't know, I've only ever had one account on a Fire device. I assume those accounts are under /data/user. You can check if it's taking up any signicant space, probably not. Be careful about deleting accounts without going through the proper app (package manager). A factory reset would also clear it all away.
[Fire TV Original Android Development] Wagmans:
Same issue- 2nd Gen cube- PS7204/1044N, getting a "unable to match build id" error for shrinker.
[Fire TV Original Android Development] Pro-me3us:
Let's see if PS7206/1098 is a match. I added an entry for PS7204/1044. If you gain root, can you grab the boot.img before running the unlock script.

raven:/ # dd if=/dev/block/boot of=/sdcard/download/boot.img

boot.img will be in the download folder.
[Fire TV Original Android Development] Wagmans:
Almost.

Am I missing something?
[Fire TV Original Android Development] Pro-me3us:
You need to get the exploit to run to completion resulting in raven:/ $ (no root) or raven:/ # (root) to know if it worked or not.

This is a memory exploit so it's a little sensitive to running processes. Reboot the Cube, wait 30sec after you see the homescreen and run the script again. There is a chance you get an out of memory error or that the exploit crashes and reboots the Cube. So repeat this up to 3-5 times if you have to, to get a result.

ps you don't need root to disable updates, so disable them right away

raven:/ $ pm disable-user com.amazon.device.software.ota

raven:/ $ pm clear com.amazon.device.software.ota
[Fire TV Original Android Development] Wagmans:
Thanks! That worked. Now I'm going to attempt to install CoreElec 21.0.
[Fire TV Original Android Development] Pro-me3us:
Great, I'll add PS7204/1046 along with PS7204/1044 to raven_shrinker. Thanks to @roligov for the PS7206/1098 boot.img and values. When you have a moment can you post your boot.img for the archive? thanks
[Fire TV Original Android Development] Wagmans:
Hmmm, so TWRP definitely successfully installed and I rebooted to the Amazon home menu.

I then put my flash Coreelec 21.0 flashdrive into my hub and rebooted (and after directly to the Cube) and neither time did it notice it- it just booted right back to the Amazon menu. Odd.
[Fire TV Original Android Development] Pro-me3us:
@Wagmans moving the CoreELEC discussion over to it's thread.
[Fire TV Original Android Development] Pro-me3us:
If you're using a USB cable, connect it to your computer/Cube, then reboot. Rebooting with the USB cable already connected will put the Cube USB port in device mode, which is what's needed for a USB ADB connection. Let me know if that still doesn't work. You want to follow these unlock instructions.
[Fire TV Original Android Development] abdul1907:
@Pro-me3us

Thank you, now it saw my device and although it saw it as an unknown device at first, I introduced it as adb.

I downloaded the file in the subject you mentioned and put the folder in the main directory of my computer and entered the first command

C:\raven_root_shrinker>adb push raven_root_shrinker/* /data/local/tmp/

adb: error: cannot stat 'raven_root_shrinker/*': No such file or directory

I haven't dealt with these things for a long time, excuse my ignorance :)
[Fire TV Original Android Development] Pro-me3us:
It looks like you are inside the directory you are pushing to the Cube, try

adb push c:/raven_root_shrinker/* /data/local/tmp/

Otherwise push each of the files individually from you current directory.

adb push install_root.sh /data/local/tmp/

adb push raven_shrinker /data/local/tmp/

etc
[Fire TV Original Android Development] Pro-me3us:
If you rebooted and ended up in stock recovery instead of TWRP, the install_root.sh script didn't run.

After you have copied the files to the Cube, open a 'shell' connection so that your running the commands directly on the Cube.

Example, when you see this, you are still running commands from your computer and sending them to the Cube

C:\raven_root_shrinker>

After you type:

C:\raven_root_shrinker> adb shell

you will see:

raven:/ $

This means you are now running commands directly on the Cube. Enter the commands from the instructions at the raven:/ $ prompt.

It will be easier to diagnose any problems if you show what your typing and what the output is.

Reboot the Cube to FireOS, open an adb shell, and continue on from step 3) Give raven_shrinker & install script executable permissions

C:\raven_root_shrinker> adb shell
[Fire TV Original Android Development] abdul1907:
C:\Users\Rabia>adb shell

raven:/ $ chmod +x /data/local/tmp/raven_shrinker

raven:/ $ chmod +x /data/local/tmp/install_root.sh

raven:/ $ adb shell

/system/bin/sh: adb: not found

127|raven:/ $

127|raven:/ $ /data/local/tmp/raven_shrinker

fingerprint: Amazon/raven/raven:7.0/PS7206/1098N:user/amz-p,release-keys

failed, retry.

failed, retry.

failed, retry.

failed, retry.

failed, retry.

/data/local/tmp/raven_shrinker: Out of memory.: Success

1|raven:/ $ /data/local/tmp/install_root.sh

←[1;31mThis script must be run as root←[0m

1|raven:/ $

Then I exited and rebooted into recovery, it still showed me the command not found screen.
[Fire TV Original Android Development] Pro-me3us:
Ok, everything looks good until you run raven_shrinker, which failed to grant you temporary root, required for the install_root.sh script.

raven_shrinker doesn't succeed every time. For best chance of success, reboot the Cube, wait 30sec when you see the homescreen, then re-run raven_shrinker.

You will know you have root when you see raven:/ $ switch to raven:/ #, then run install_root.sh

If you don't get root after running raven_shrinker, reboot and try again. It shouldn't take more than 2 or 3 attempts.
[Fire TV Original Android Development] abdul1907:
So far, everything is going well, but the app store on the Fire Cube homepage is not working. Is there something missing in this version, or can I upgrade to a different version that can be rooted?
[Fire TV Original Android Development] Pro-me3us:
Do you have Ethernet or WiFi enabled in FIreOS? The homepage won't load without internet access. PS7206 is from a couple months after the Cube's release, it might not be a bad idea to update to something a little newer. As long as you flash the OTA firmware bins in TWRP, you'll keep root. Firmware list here.

Upgrading is easy, downgrading is more of a pain. Try PS7229/1853, see how you like it. I've tested updating as far as PS7652. With FireOS newer doesn't mean better, it can be the opposite.

To flash an update, download the firmware bin, rename the .bin extension to .zip, copy the file to your Cubes Download folder, reboot to TWRP and use a USB mouse to navigate the UI. There are more detailed instruction here.

Be sure to reflash Magisk in TWRP directly after flashing any firmware. And verify that updates are still blocked when FireOS boots back up, and that Magisk is working.
[Fire TV Original Android Development] pretzells:
quick question regarding firmware version after brick recovery> would the firmware version be at the newest emazone pushed to the cube causing the brick or after recovery, would it be the firmware i loaded?? it starts at the first screen one would get for initial signup, it looks like the screen i had seen just before things went wrong???

p.s i cannot get into twrp recovery, volume up during startup does nothing but if i open terminal and fastboot devices, i get the device, i fastboot flash recovery with success and fastboot reboot recovery with success but nothing happens, no twrp!!! any thoughts
[Fire TV Original Android Development] Pro-me3us:
The firmware version will be whatever you flashed. If the OTA update had gone through successfully, you'd likely have lost DFU and the ability to unlock.

Holding Volume up = Fastboot

Holding Volume down = TWRP (release when blue lights come on)

Holding Action = Amlogic Update (U-boot)

adb shell reboot recovery, gets you to TWRP too.
[Fire TV Original Android Development] leon13131313:
Is there anything I can do with the latest firmware 7673? Or can I throw it away Cube 2? Thanks for the answer.
[Fire TV Original Android Development] Pro-me3us:
There's no root options for the 2nd gen Cube above PS7646. You can prevent it from updating any further. If you're serious about throwing it away, I know someone that would be interested in taking one of those apart.
[Fire TV Original Android Development] leon13131313:
It would be nice to put this in the title so that people don’t waste time looking for a solution.
[Fire TV Original Android Development] leon13131313:
Starting with FireOS firmware 7.6.5.2 (PS7652/3564) dated 08/26/2023, it is impossible to ROOT. The update occurs automatically when connected to the network. The same applies to Cube 3nd gen.
[Fire TV Original Android Development] Pro-me3us:
What FireOS version are you on? And what apps aren't working? For Prime Video you'll need to manually sideload and update Prime Video & FireTV Player. All authentication is done through Amazon, so Google Play Store isn't needed.
[Fire TV Original Android Development] Woolium:
Would something like this work on any fire tablet? fire max 11 (sunstone) or Fire HD 8 (onyx)?
[Fire TV Original Android Development] yakovperelman69:
Ok, thanks for answering.

Any hope to develop a new method or discover a new vulnerability ?
[Fire TV Original Android Development] Pro-me3us:
Honestly the prospects are not good. These types of vulnerabilities are very rare.
[Fire TV Original Android Development] Osaka_23:
Thank You.

Do you know which version of FireOS will allow me to use Launcher Manager and the Pro Remote?

I brought the Pro Remote when it was on sale but unfortunately I connect it to any of my Fire TV cubes because they are on Fire OS PS7624/3337.

Also, as the Fire OS are in bin format, would TWRP recognise the files? I have previously dealt with Zip files on android phones.

Thanks
[Fire TV Original Android Development] u_no_fr:
DEAD for me I think !
[Fire TV Original Android Development] Pro-me3us:
I've never used the pro remote so I don't know any specifics about it. Since it was released in November 2022, I would guess firmware PS7614 (November 19th) is compatible with the pro remote

The FireTV firmware have the .bin extension, but you can simply rename it to .zip

There is a list of firmware here, and instructions on TWRP flashing here

It's extremely important that you not forget to flash magisk, directly after flashing any firmware. You should still have a copy of magisk on your cube at /data/local/tmp/magisk.apk (v25.208) from the root installation in post #4.
[Fire TV Original Android Development] yakovperelman69:
Is there any way to downgrade the firmware to previous versions ?
[Fire TV Original Android Development] Pro-me3us:
No, downgrading would require already having root access
[Fire TV Original Android Development] yakovperelman69:
No, downgrading would require already having root access

====================================

ok, thanks Pro-me3us , I will keep reviewing this post waiting for new procedures​
[Fire TV Original Android Development] yakovperelman69:
Yes, we are DEAD :mad:
[Fire TV Original Android Development] loznic89:
hi. temporary adb root work in fire 4k max?

thanks and good work
[Fire TV Original Android Development] Pro-me3us:
No, sorry. This vulnerability is specific to the Mali GPU drivers. The 4k Max does not use a Mali GPU, neither do the 4k or 3rd gen sticks.
[Fire TV Original Android Development] teschke:
Good afternoon. I can't figure out how to upload 7 files to /data/local/tmp on the Cube. I'm doing this for the first time. I tried to throw it through the FX file manager installed on the Cube. But you can't go further than /data/local.
[Fire TV Original Android Development] Pro-me3us:
A lot file browsers are going to have restricted access, so I'd recommend using ADB on another device to push (transfer) the files to your Cube. But if you don't have a computer, you can copy the 7 files to your Downloads folder (/sdcard/Download/), then move them to /data/local/tmp/ with the app Remote ADB Shell.

mv /sdcard/Downloads/amzn_ota_block.zip /data/local/tmp/
mv /sdcard/Downloads/install_root.sh /data/local/tmp/
mv /sdcard/Downloads/misc.img /data/local/tmp/
mv /sdcard/Downloads/twrp.img /data/local/tmp/
mv /sdcard/Downloads/bootloader.img /data/local/tmp/
mv /sdcard/Downloads/magisk.apk /data/local/tmp/
mv /sdcard/Downloads/raven_shrinker /data/local/tmp/

Once these are in place, follow the rest of the instructions
[Fire TV Original Android Development] teschke:
Thank you very much. I will try.
[Fire TV Original Android Development] teschke:
For some reason the first command doesn't work.

I put all seven files in the Downloads folder. Then he gave the command one by one. After that, the Downloads folder turned out to be empty. So, as I understand, all seven files have moved to the tmp folder.

Is it possible to check with a command if all the sem files are in tmp?
[Fire TV Original Android Development] Pro-me3us:
This will show you the files located at /data/local/tmp/

raven:/ $ ls /data/local/tmp/

Assuming they are there, proceed to the next instructions in the original post

'ADB' commands don't work inside an ADB shell, this is why you get ADB: not found. When you see 'raven:/ $' you are inside an ADB shell.
[Fire TV Original Android Development] teschke:
Yes, everything is in place.
[Fire TV Original Android Development] teschke:
Something went wrong again
[Fire TV Original Android Development] Pro-me3us:
The raven_shrinker program didn't grant you root. Raven_shrinker doesn't work 100% of the time since it's a memory management related exploit.

Reboot the Cube, wait 1minute after the homescreen loads, and try running raven_shrinker again, followed by install_root.sh
[Fire TV Original Android Development] teschke:
After this command, cube rebooted itself.
[Fire TV Original Android Development] Rortiz2:
Absolutely not. These devices use MediaTek SoCs, which are completely different from Amlogic. If you're talking about the Mali exploit, that I'm not really sure.
[Fire TV Original Android Development] Woolium:
I tried the Mali exploit ages ago and it didnt work. is there some kind of guide or something?
[Fire TV Original Android Development] Pro-me3us:
The mali gpu exploit was modified to work on Onxy here, and he explained his process here.
[Fire TV Original Android Development] ddogishere:
Hi @Pro-me3us Have lost adb shell in fireos-'not found'- all other unlock root function normal, any ideas?
[Fire TV Original Android Development] Pro-me3us:
When you see raven:/ # issue your commands without 'adb shell' in front.

raven:/ # means your logged into the Cube and issuing commands directly from it's command line.

ADB shell is for sending commands remotely to the Cube. It's a fine difference.
[Fire TV Original Android Development] Pro-me3us:
This is ok, like I mentioned previously, raven_shrinker does not always work. There is a higher chance of the Cube rebooting if raven_shrinker is run too early.

Just reboot the Cube, wait until you see your homescreen, wait another 90sec (don't open any apps on the Cube), then try raven_shrinker again.
[Fire TV Original Android Development] teschke:
As soon as he started, I immediately gave the command. Now, as I understand, it remains to give commands

exit

pm install -r magisk.apk

reboot recovery
[Fire TV Original Android Development] Pro-me3us:
You just need to type those last three commands

Type

raven:/ #exit

Then type

raven:/ $pm install -r /data/local/tmp/magisk.apk

Finally type

raven:/ $reboot recovery

Note:

raven:/ $ --> raven:/# (means you are root)

raven:/ # --> raven:/ $ (means you've switched from root to regular user again)
[Fire TV Original Android Development] teschke:
Having a problem with magisk I'll try to install it with TWRP

Thank you very much for your help
[Fire TV Original Android Development] Pro-me3us:
You must first type 'exit', this will switch you from root to regular user, then you can run pm install

Type

raven:/ # exit

Results in this change raven:/ # --> raven:/ $

Then type

raven:/ $ pm install -r /data/local/tmp/magisk.apk

Sorry, I forgot to include the full path to magisk
[Fire TV Original Android Development] teschke:
Everything worked out thank you very much.
[Fire TV Original Android Development] boxster03:
This might be my issue too. Let me try this solution. You can ignore my question in other thread.
[Fire TV Original Android Development] Pro-me3us:
A reminder to anyone using the bootloader unlock option

NEVER USE THE FIREOS FACTORY RESET!!!

NEVER ALLOW AN AMAZON OTA UPDATE!!!

Both of these will brick the Cube. If you want to factory reset, use TWRP and wipe data/dalvik.

If you want to update your firmware use TWRP to flash the bin
[Fire TV Original Android Development] mavsman13:
I have 2 gen2 cubes on PS7608/3614 and they both reboot when I run raven_shrinker no matter how long I wait. Any ideas? Thanks.
[Fire TV Original Android Development] Pro-me3us:
This might require some firmware specific troubleshooting, i'll pm you.
[Fire TV Original Android Development] Pro-me3us:
Added a fix, to make raven_shrinker work on PS7608/3614. I'll update the main posts in a few days. Anyone on this firmware can get the fix here for now.