[Fire TV Original Android Development] Pro-me3us:
Overview

This rooting method is based on a new vulnerability in the ARM Mali GPU driver (CVE-2022-46395) discovered by security researcher Man Yue Mo at GitHub Security Lab, to gain root access to the 3rd gen Cube that is on firmware PS7652/3564 or older. You can also check the older root method that works up to firmware PS7613/3701.

**Note: staying on PS7613 is recommended if interested in possible future bootloader unlock / full root.

**2nd Note: This is still working on new Cubes (July 17th, 2024) that block the OS update during setup.

The exploit program (gazelle_buf) is run directly on the Cube to spawn a temporary root shell for quick access. On average it takes 20-60sec for the exploit to gain root access. For best results, run gazelle_buf after a fresh reboot.

View attachment 5944847

Temporary Root

Open an adb root shell for quick admin access

Pros:

Access all files and folders from ADB

Simple to use, runs in RAM and doesn't make any changes to the Cube, no chance of bricking.

Remove app package protection so that you can enable/disable any app even without root (eg custom launchers, disabling updates, debloat, etc).

Cons:

Only enables ADB root

NOTE: gazelle_buf won't brick your device, but what you do with that root access can. DM-verity is still in place checking the integrity of the system/vendor partitions, do NOT modify anything in those directories, or the boot partition!!

Instructions

Enable ADB debugging in FireOS settings

Download, unzip and copy gazelle_buf to your Cube

adb push gazelle_buf /data/local/tmp/

Open an ADB shell and give gazelle_buf execution permission (only needs to be done once)

adb shell ---> opens a 'gazelle: / $' prompt

gazelle:/ $ chmod +x /data/local/tmp/gazelle_buf

Run the program. Be patient, takes 20-60sec on average (sometimes longer).

Root access is gained when the '$' prompt changes to '#' (gazelle:/ $ --> gazelle:/ #)

gazelle:/ $ /data/local/tmp/gazelle_buf

View attachment 5935613

Disable package protections

Use gazelle_buf to open a root shell and delete all the apps listed in the file /data/system/PackageManagerDenyList

gazelle:/ # setenforce 0

gazelle:/ # echo '<?xml version="1.0" encoding="utf-8" standalone="yes" ?><map><set name="DenyListKeyPackages"></set></map>' > /data/system/PackageManagerDenyList

Disable Arcus Proxy, to keep package protections off

gazelle:/ # pm clear com.fireos.arcus.proxy

gazelle:/ # pm disable-user com.fireos.arcus.proxy

Disable Amazon's ability to block apps on your device (eg Launcher Manager)

gazelle:/ # pm disable-user com.amazon.adep

gazelle:/ # pm clear com.amazon.adep

Disable OTA updates

gazelle:/ # pm disable-user com.amazon.device.software.ota

gazelle:/ # pm clear com.amazon.device.software.ota

gazelle:/ # pm disable-user com.amazon.device.software.ota.override

gazelle:/ # pm disable-user com.amazon.tv.forcedotaupdater.v2

A reboot is required before the package protections removal takes effect. Check & confirm the list of disabled apps:

gazelle:/ $ pm list packages -d

Optional app button remapping.

Changelog:

v1.1 June 28th, 2023​

Fix for PS7607/3166 through PS7613/3688

v1.2 September 5th, 2023​

Support added for PS7646/3565, PS7652/3556, PS7652/3564

Contributors:

Man Yue Mo, @Functioner, @Pro-me3us

Thanks to @Renate for many great tools

@RiCkLaR for tip on disabling ADEP and AppBlockList