yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] janflapjes:
Thank you for your great work. I am on PS7614/3227 (which works with the pro remote BTW). I have succesfully gotten temporary root with raven_shrinker, and have used it to block any updates via your instructions.

I think I read in another post, that you are looking for users with newer firmwares than PS7292 to test the bootloader unlock script under your guidance. So I am willing to try that. PM?
[Fire TV Original Android Development] Pro-me3us:
I had already tested PS7614/PS7624 last week

We weren't sure if it was possible to apply the unlock method to firmware PS7603/PS7608. @mavsman13 just helped test that today, and unfortunately it didn't work on those two firmware.

It's now confirmed that PS7292 is the last firmware version to work with the unlock method.
[Fire TV Original Android Development] janflapjes:
Ok, that's too bad.

I also have a fresh and sealed Raven, which I can probably unlock with the HDMI dongle method. But to use the pro remote, I will probably then need to update it after that. Now I could do that via TWRP, but would that then disable TWRP recovery again or remove magisk?
[Fire TV Original Android Development] Pro-me3us:
Sealed new 2nd gen Cubes are guaranteed to be on PS7229 or older firmware, they are golden! Make sure to skip the forced registration update

Whether you use the new unlock procedure or the older DFU procedure, both keep the Cube on an old vulnerable bootloader version (coincidentally PS7229). The included TWRP version for raven is modified to never flash the bootloader. So as long as you update the firmware through TWRP, you won't lose the unlock / root (or TWRP/Magisk)

I've been using PS7624/3337 without any issues, and @Functioner is using PS7633/3345 after updating through TWRP. Don't feel pressure to update to the newest firmware though, there is little to no noticable benefit. Remember to always reflash Magisk directly after any firmware flash in TWRP!

If you want to use the pro remote, check out this post because I suspect it might be relevant for getting the pro remote working with a custom launcher.
[Fire TV Original Android Development] janflapjes:
Thanks for the heads up. Right now, I have actually deleted the amazon launcher because at some point it was blocking my wolf launcher. The pro remote works fine, but I have not seen a recent apps section. So maybe it is due to that.
[Fire TV Original Android Development] Pro-me3us:
Only the 3rd gen Cube (and FireTV televisions) remotes have that recent button. I wasn't sure if the two shortcut buttons and the programming screen was run through Amazon Launcher, sounds like they aren't.

I was wondering what app the shortcuts button use. If you don't mind, can you use the 'system status monitor' (app visible on custom launcher homescreen), and toggle on 'system x-ray'. Then open the shortcut programming window for the pro. The name of the shortcuts app will be printed right below memory usage at the top of the screen.

I'd like to see if I can access it without a pro remote.
[Fire TV Original Android Development] janflapjes:
Well the official shortcuts programming uses the standard settings dialog; remotes and bluetooth devices, alexa voice remote pro. Then select button 1 or 2, and a list of actions shows up (you can also program alexa commands and system shortcuts). When I go to the app selection, a list of apps will show up within the settings environment. The package name is com.amazon.tv.settings.v2.
[Fire TV Original Android Development] Pro-me3us:
Thanks, I'll look through the settings app to see if I can access that actions dialogue.
[Fire TV Original Android Development] ktjensen:
Have 7633 so looks like am out of luck. Was trying to just block updates, so could get launcher manager working. All a dead end at this point.
[Fire TV Original Android Development] Osaka_23:
Hi,

Thank you so much for your excellent guide and your hard work.

My Cube Gen 2 is now rooted, has TWRP installed, and updated to Fire OS 7.6.2.4. I updated through TWRP and reinstalled Magisk. The only issue I am having is editing PackageManagerDenyList as per the instruction below.

Protected Packages

Amazon added package protection in +PS7273. To remove this, boot into FireOS with Magisk or root support, edit /data/system/PackageManagerDenyList, delete the list of applications, and save.

I booted info FireOS on Magisk (opening the Magisk app and then rebooting into FireOS) but when do I go next to edit the list?

Thanks
[Fire TV Original Android Development] Pro-me3us:
Those are the old less descriptive instructions, and were for people using the old temp root method through DFU.

As a result of using the bootloader unlock method, you always have ADB root access (including any apps you grant ADB access to). You don't really need to worry about the PackageManagerDenyList, because you can enable/disable any app regardless.

If you do want to clear it anyway, follow the instructions in the second half of post #2 for temporary root.

1) clear the list

echo '<?xml version="1.0" encoding="utf-8" standalone="yes" ?><map><set name="DenyListKeyPackages"></set></map>' > /data/system/PackageManagerDenyList

2) disable & clear arcus proxy

pm disable-user com.fireos.arcus.proxy
pm clear com.fireos.arcus.proxy

Because you are using the bootloader unlock method before your Cube ever got PS7273+ through the regular Amazon OTA update process, your Cubes still have DFU access (low level recovery option). You can still make a DFU device as a safetynet to get out any software issue. You probably won't need it but it's nice to have as a tool just in case.
[Fire TV Original Android Development] cityhunter_1919_xyz:
It's wonderful.

Similarly, is there any hope for the fire tv stick 4K MAX?
[Fire TV Original Android Development] boxster03:
After bootloader unlock:

How can I confirm it has TWRP installed?

When I open the magisk app: On the magisk home screen, it says Zygisk No and Ramdisk No. What are those? There is an "Install" button across "Magisk". What is that for? Also below that , across from "App" there is a highlighted "Update" button. Am I okay to click Update or Install? I didn't want to mess anything up and left everything as is.
[Fire TV Original Android Development] Pro-me3us:
The 2nd gen Cube doesn't have a ramdisk in the boot.img, so that's correct and not a problem. Zygisk isn't enabled by default, you need to go into Magisk Manager settings and toggle it on to enable it. I'd probably mangle any explanation of Zygisk so it's better to Google it. It's a big part of Magisk since v24 and required for some Magisk modules.

Both Magisk and Magisk Manager can be updated from within the app, that's why there are two install buttons. v26 is still new, it's better to wait a few stable releases before updating, or just stick with v25.208.

You can boot to TWRP by 1) holding volume down on the Cube while booting up (before the blue light on Cube turns on), 2) typing 'reboot recovery' in ADB or 3) by tapping the reboot icon in Magisk Manager in the top right corner, selecting reboot to recovery.

NOTE: Holding volume down at power on, BEFORE the blue LEDs on the Cube, boots TWRP.

Holding volume down AFTER the blue LEDs light up, boots FireOS in safemode. Safemode disables Magisk modules, which enables Amazon OTA updates! Magisk modules remain disabled until you reboot in 'normal' mode, open Magisk manager and toggle them back on manually. DON'T forget to do this!!

Not with this exploit, it's specific to code in Mali GPU drivers. The 4k Max doesn't use a Mali GPU.
[Fire TV Original Android Development] boxster03:
@Pro-me3us Thanks for the reply with details. Sounds like a warning to be aware of if it had inadvertently booted to FireOS in Safemode. Is there a valid reason to go to FireOS in Safemode?

Also, if I want obtain root, I run the raven_shrinker as before?

I was thinking of leaving the Cube in 7.2.9.2. I saw above @Osaka_23 update to 7.6.2.4. What am I missing? What features were added?
[Fire TV Original Android Development] Osaka_23:
I only updated because I wanted to link my Fire TV Pro remote with my Cube Gen 2. I couldn't link it on older firmware.

I find the Find my remote function very useful.
[Fire TV Original Android Development] Pro-me3us:
With the bootloader unlock method, you automatically have ADB root whenever you use ADB. You don't need raven_shrinker anymore

The only weakness of the bootloader unlock method is that you can never perform a factory reset from FireOS (not even with the remote button combination), or allow the Amazon OTA update app to update the Cube. If either occur, the Cube will be bricked. Use TWRP to wipe data/dalvik, which is the same as a factory reset, but won't brick the Cube.

The install_root.sh script installs a magisk module to block OTA updates. Booting to safe mode disables that module until you reboot and re-enable it in Magisk Manager manually. Until you do that the Cube is exposed to an Amazon update, and getting bricked.

The OTA block module was just an easy way to ensure updates were blocked right away for the user. If you prefer, you can disable the Magisk OTA block module in Magisk Manager, reboot for the change to take effect, and just run adb shell pm disable com.amazon.device.software.ota. This will do the same thing and remain disabled even in safe mode.

Regarding Safe mode itself, it just disables all user installed apps and Magisk modules in case the device can't boot because one of those apps or modules is causing a problem. You shouldn't ever need to use it, but it's a standard Android feature that's there.

I'm going to release a minor update to the install_root.sh script to be more proactive in preventing people from accidentally performing a FireOS factory reset. This code will create a Magisk script that wil add an extra layer of protection from accidentally running a factory reset or allowing an Amazon OTA udpate.

echo '#!/sbin/sh
# Rename misc partition
mv /dev/block/misc /dev/block/misc_real
# Create symbolic links
ln -s /dev/null /dev/block/misc' > /data/adb/post-fs-data.d/misc_hide.sh && chmod +x /data/adb/post-fs-data.d/misc_hide.sh

Copy/Paste that into ADB as one command, and it will take effect on the next reboot.
[Fire TV Original Android Development] boxster03:
@Pro-me3us Thank you for the explanation. Great work.
[Fire TV Original Android Development] sjallipa:
@Pro-me3us thank you for all you have done, i am trying to do option #3 raven_root except i keep failing at install.sh on build PS7614, Option #2 with bootless went through but anytime I hit Magisk firecube is going into kernel panic and goes into bootloop for 3 or 4 times before coming back .... help appreciated.
[Fire TV Original Android Development] sjallipa:
just to add context, i stopped updates on this one, bought during the recent woot sale looks like they are coming with build PS7614 in case others are wondering (i believe to accommodate alexa remote it comes with)
[Fire TV Original Android Development] Pro-me3us:
Don't use the bootloader unlock method (option #3), it will brick the Cube if it's loaded on any firmware newer than PS7292. The install_root.sh has a check that will read the Cube's firmware to make sure its PS7292 or older, or stop the script from proceeding.

There is a fix to raven_shrinker for PS7614 here. Use this instead of the version included in option #1 or #2. Will update the main posts with this fix, I was just trying to get something else unrelated working first.

The Woot Cubes probably cover a range of firmware depending on when they were returned to Amazon. I got one with PS7279, I've seen a few with PS7292, and yours is the most recent with PS7614.
[Fire TV Original Android Development] Osaka_23:
I am trying to use Exposed Edge to remap my controller's buttons. Everytime I open the app it prompts me to activate the module. However, magisk doesn’t prompt me and it doesn't allow me to install the apk.

To install Exposed Edge apk, I have to install it with ES Explorer. How do I give it root permission?
[Fire TV Original Android Development] sjallipa:
Thank you for prompt reply, will try this
[Fire TV Original Android Development] Pro-me3us:
Xposed Edge requires installing the LSPosed Zygisk module. LSPosed is the new Xposed Framework for Magisk v24+

Releases · LSPosed/LSPosed

LSPosed Framework. Contribute to LSPosed/LSPosed development by creating an account on GitHub.

github.com

Make sure you've also enabled Zygisk in Magisk Manager settings

Download and install LSPosed as a Magisk module, in Magisk Manager. It should install LSPosed manager, but probably won't, so do it manually. It will be here

/data/adb/lspd/manager.apk'

Install it using a file manager or with adb command:

pm install -r /data/adb/lspd/manager.apk

Reboot the Cube for LSPosed to become active, open LSPosed manager app, and toggle on Xposed Edge module, and check "System Framework", reboot the cube again for the Xposed Module to become active.

You might need to reinstall Xposed Edge if it doesn't appear in LSPosed manager at first.
[Fire TV Original Android Development] Osaka_23:
Thanks for all the help.
[Fire TV Original Android Development] Pro-me3us:
Sorry, I was thinking of PS7608/3614. PS7614 should work with the original attachments for option #1 and #2. Reboot your Cube and run raven_shrinker ~90sec after you see your homescreen appear. Don't open any apps while waiting. Try waiting another 30sec if 90sec doesn't work. There is going to be some variability based on what and how many apps are loading up after boot. 90sec is already a pretty conservative waiting time

If that doesn't work let me know. Try it at least twice, although it should work ~80%+ of the time.
[Fire TV Original Android Development] sjallipa:
Sure thanks again, will try documenting if i see anything untoward .. Initial try was with Option 2 and every single time it went into panicked kernel with serial reboot.
[Fire TV Original Android Development] Pro-me3us:
I took a quick look at the addresses for PS7614 and they look ok. Can you copy/paste the output of raven_shrinker.

Should look something like this:

raven:/ $ /data/local/tmp/raven_shrinker
fingerprint: Amazon/raven/raven:9/PS7624.3337N/0026810845440:user/amz-p,release-keys
failed, retry.
failed, retry.
failed, retry.
failed, retry.
region freed 80
alias gpu va 100c85000
read 0
cleanup flush region
release_mem_pool
jit_freed
jit_free commit: 2 0
Found freed_idx 2
Found pgd 23, 100cce000
overwrite addr : 104100634 634
overwrite addr : 104300634 634
overwrite addr : 1041001c4 1c4
overwrite addr : 1043001c4 1c4
result 50
raven:/ #

There are two main reasons for crashing the Cube, and seeing the output will give me a better idea of why it is failing.
[Fire TV Original Android Development] sjallipa:
Software version Fire os 7.6.1.4 (PS7614/3227)

─    ~/Downloads/Fire Cube 2 ────────────────── ✔  at 05:00:50 PM  ─╮

╰─ adb shell ─╯

raven:/ $ /data/local/tmp/bin/raven_shrinker

fingerprint: Amazon/raven/raven:9/PS7614.3227N/0025938402048:user/amz-p,release-keys

failed, retry.

failed, retry.

region freed 65

alias gpu va 100c83000

read 0

cleanup flush region

release_mem_pool

jit_freed

jit_free commit: 4 0

Found freed_idx 4

Found pgd 23, 100cfe000

overwrite addr : 104100634 634

overwrite addr : 104300634 634

overwrite addr : 1041001c4 1c4

overwrite addr : 1043001c4 1c4

result 50
[Fire TV Original Android Development] Osaka_23:
I managed to get LSPosed installed with your adb command.

Xposed Edge Pro works fine but, I am having problems with adding the Amazon Music, Prime Video, Netflix and Disney buttons to it. Every time I press those buttons, they take me to the apps they are assigned to. How do I freeze or block those apps? Do you know of any adb commands?

Lastly, now that I have nearly setup the Cube Gen 2 to exactly how I want it to run, could I create a back up on TWRP and restore it to my other Cube Gen 2 after I have done the Bootloader unlock, install TWRP & Magisk?

If it works, would I need to update to the exact same version of Fire OS before restoring the backup on TWRP?

Many thanks!
[Fire TV Original Android Development] cityhunter_1919_xyz:
It is a method I wrote elsewhere, but my 4K has changed it like this. FYI.

①Display of connected devices

adb shell cat /proc/bus/input/devices

In my case, the remote control with the Prime Video and MUSIC buttons showed Vendor=0171 Product=0421

②/system/usr/keylayout/Vendor_0171_Product_0421.kl

Edit "Vendor_0171_product_0421.kl" and changed as follows (see)

Upper left = key 745 APP_2 > key 745 CHANNEL_UP

Lower left = key 746 APP_3 > key 746 CHANNEL_DOWN

Upper right = key 744 APP_1 > key 744 SETTINGS

Lower right = key 747 APP_4 > key 747 RECENTS

③"xposed edge"app and assign each button as you wish.

For apps, some apps do not appear on the xposed edge, so apps that are not installed can be assigned with "remap app."
[Fire TV Original Android Development] Pro-me3us:
Ah nice find! I'll piggyback off of this with a Magisk module so that the system partition doesn't need to be modified. The module includes 8 remotes, that should cover most of the regular ones. The app buttons have been remapped to

key 744 PROG_RED

key 745 PROG_GREEN

key 746 PROG_YELLOW

key 747 PROG_BLUE

Xposed Edge can remap these however one wants.

I know there are at least a couple Amazon account / device identifiers which might be an issue if you clone the Cube's data partition to another Cube. I've never tried doing that, so I can't recommend it. Also, the tee partition has device specific information that you definitely don't want to copy over to another device.

pm'ed you
[Fire TV Original Android Development] Osaka_23:
@Pro-me3us Are there any other apps or models you can recommend for a rooted Fire TV Cube Gen 2? If so, where can I download them.

Are there any modules that will allow me to overclock the Cube?
[Fire TV Original Android Development] Pro-me3us:
You can use Fox's Magisk Module Manager to find and download more modules. If you are googling for modules, try to find an official XDA or Github page for any module you are installing.

I've not tried to do any overclocking, so I'm not familiar with any modules to do that. There's probably a few ways to overclock, just be very careful if you are doing that sort of modification. I use the Cube's temperature as a general indicator to tell if something is wrong, and prefer that it not be over ~50C for extended periods of time. I think the Cube will reboot if it ever hits ~80C for more than a few seconds.

Instantaneous CPU temp:

cat /sys/class/thermal/thermal_zone0/temp

CPU temp log, taken every 20min (1st value is for CPU)

dumpsys ThermalTemperatureObserverSerivce

Check list of running processes, RAM, CPU usage etc

top
[Fire TV Original Android Development] Pro-me3us:
Updated original instruction posts with a fix for PS7608/3614 (raven_shrinker_v1.1.zip and raven_bootless_magisk_v1.1.zip)

The bootloader unlock install_root.sh script was also updated to create a Magisk script to try to prevent the user from accidentally running a FireOS factory reset, and bricking the Cube (raven_root_shrinker_v2.2.1.zip)

Anyone that's already installed raven_root_shrinker_v2.2.zip can copy/paste this as one ADB command to create the same script:

echo '#!/sbin/sh
# Rename misc partition
mv /dev/block/misc /dev/block/misc_real
# Create symbolic links
ln -s /dev/null /dev/block/misc' > /data/adb/post-fs-data.d/misc_hide.sh && chmod +x /data/adb/post-fs-data.d/misc_hide.sh

This script is just a repost mentioned earlier.
[Fire TV Original Android Development] tony353:
Hello, thanks for all the hard work.

It might sound dumb but after I gain root access and disable the updates, do I need to run "raven_shrinker" after every boot up to continue blocking updates?
[Fire TV Original Android Development] Pro-me3us:
No, disabled apps should stay disabled regardless of whether you're root user or not.

Root is only needed to clear the PackageDenyList, after that root is no longer needed to disable/enable apps.

You can see which apps are disabled by running

pm list packages -d

The instructions to reboot and verify is just to make sure arcus proxy didn't do anything fishy before it was disabled.
[Fire TV Original Android Development] Osaka_23:
Hi,

I copied the code above. Has it worked?

Thanks
[Fire TV Original Android Development] Pro-me3us:
I assume so, because there were no errors.

If after rebooting the cube you see this file here:

/dev/block/misc_real

Then it was successful
[Fire TV Original Android Development] boxster03:
Can someone tell me how to paste in Command Prompt at adb shell i.e., raven:/ # ?

CTRL-V is not working for me in adb shell prompt. It works outside eg. on C:\> after exit shell.
[Fire TV Original Android Development] boxster03:
@Pro-me3us I also executed those commands in order (I typed in one command at a time because paste wasn't working for me) and no errors. Seem to have worked. I see both misc and misc_real in /dev/block.

If you have a moment. can you explain a bit how this protects against accidental factory reset?

Also found it interesting that:

ln -s /dev/null /dev/block/misc' > /

part of the last instruction seem to have disappeared after entering. ??

Thank you for this extra safety net that gives some relief against an unintended factory reset.
[Fire TV Original Android Development] Pro-me3us:
The bootloader unlock code is in misc. If a factory reset or Amazon OTA update is performed, the operation writes to misc and deletes the code. The script renames misc to misc_real, and creates a new misc that directs all FireOS writes to /dev/null/ (trash).

As long as you are aware to never perform a FireOS factory reset or allow an Amazon OTA update, that script isn't even necessary.

I'm guessing part of the line disappeared because ADB doesn't wordwrap commands, but since the purpose of the command is to rename misc to misc_real, and you see misc_real, it's working.
[Fire TV Original Android Development] HeyImJ:
Am I even able to do this or am I just doing something wrong :)
[Fire TV Original Android Development] Pro-me3us:
Yes, raven_shrinker should work on your Cube. Are you encountering a problem?

Be careful, firmware PS7233/3445 was already rolled out over a week ago. You do not want to let your device update to that. This will not work on that version.

run

pm clear com.amazon.device.software.ota

to clear any update that might be sitting on your Cube, waiting for a reboot to install. This will only work temporarily while your Cube redownloads updates and waits for your device to go idle, to update.
[Fire TV Original Android Development] iSupakilla:
I'm either ****ing retarded or this doesn't work on an ACTUAL FireTV. no cube, stick or any of that BS? Running OS V7.6.2.4 (/3337) wanna do the temporary ADB root since I only care for Launcher Manager and to disable the package(s) blocking it.

I get down to step 4 of "disable package protection"

and again. I could be absolutely ****ing braindead but after i "disable the internet connection since amazon tries to rebuild xxx and reboot" how am I supposed to enter the next two commands before connecting to my internet, again if i'm not connected through ADB because i'm not connected through internet? i've tried the entire process 3 times and when i reconnect after reboot to even try to input more commands and i just get "cannot disable protected application"
[Fire TV Original Android Development] HeyImJ:
Think that's my problem to, I'm trying this on an actual Fire tv
[Fire TV Original Android Development] Pro-me3us:
What is your device? A FireTV television? Or a 2nd gen Cube?

This thread is only for the 2nd gen Cube (raven).

Although the vulnerability is present on most of the FireTV televisions, the raven_shrinker program is made specifically for the 2nd gen Cube's firmware.

A new program would likely have to be written for every individual FireTV television, and without a television to test with it would be hard for me to do.

The exploit program has to be adjusted for both the device, and each firmware on that device.
[Fire TV Original Android Development] HeyImJ:
I volunteer my TV as tribute if possible :)

But damn, all I'm trying it for is launcher manager as well 😔