yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] ECrispy:
Do I need to do anything other than the unlock/root method #3 (using twrp/magisk) on a Cube 2nd gen that still has original firmware, to block updates permanently?

Will this also keep the old Amazon UI and it will keep working with no other changes needed for Prime etc?
[Fire TV Original Android Development] Pro-me3us:
No, the root install script installs a Magisk update blocker. It's in effect unless you disable it or wipe the data partition.

The UI will be whatever it was on that particular FireOS firmware version. It's not going to change, that would require a system app update, which are also blocked.

It's good to be cautious but you are overthinking this. The patching procedure takes 5 or 10min and then it will stay in whatever state it is unless you update it. The hardest part is finding a new/sealed 2nd gen Cube.

No ROM is going to work with the Cube with zero modifications. There are generic Amlogic ROMs, but even those would require some modification. The Cube is going to fail to boot immediately when it gets to loading the kernel and can't find the device tree which needs to be included in the boot.img.

You would need a UART connection to debug the problems you encounter after that.

I've only attempted to run CoreELEC and EmuELEC on raven.
[Fire TV Original Android Development] ECrispy:
thank you. I seem to have found a local seller who claims to have an unused Cube 2 they bought earlier but never used, so I have some hope.

Right now I use a FireStick4K, bought 5 years ago. The Cube should be a good increase in speed but I'd really like the old UI back if possible.

another qn - is there a procedure to wipe/reinstall if something goes wrong? e.g. I read that once I use the root script, a factory reset can brick the device? what happens if something goes wrong and I want to recover i.e. can I clean flash the device firmware, then run the script again etc? I only have experience with phone roms - e.g. you could just boot into twrp/recovery then clean flash either the stock rom or custom rom and even lock the bootloader to get back to stock completely.

yes I might be overthinking :) but just want to be sure.
[Fire TV Original Android Development] Pro-me3us:
Make sure the tear strip is still present, indicating it was never opened. People will say something is new and unused even when it's just a little used, thinking you'll never know.

The instructions are never to do a factory reset from FireOS. You can still perform a data wipe in TWRP which is the equivalent of a factory reset. In TWRP you can upgrade and downgrade firmware, and data wipe. Magisk needs to be reflashed immediately following any firmware flash, in TWRP.

The oldest official firmware link that was saved was for PS7212/1333, you can flash that if you want. I'm not sure what you mean by old UI. PS7212 is May 2020, and looks pretty much the same as the firmware that first shipped with the release Cube in 2019. The newest possible firmware a new Cube will come with is PS7229/1856 (January 2021).
[Fire TV Original Android Development] Pro-me3us:
For those using raven_buf or raven_shrinker for temp root only, there was always a problem with accessing services after gaining root. Thanks to @Baiker000 for pointing out an easy fix:

raven:/ $ /data/local/tmp/raven_shrinker

raven:/ # runcon u:r:system_app:s0 /system/bin/sh

Executing the above runcon command after gaining root will allow you to run pm commands as well as any other services. The OP was updated to include this.
[Fire TV Original Android Development] pretzells:
No ROM is going to work with the Cube with zero modifications. There are generic Amlogic ROMs, but even those would require some modification. The Cube is going to fail to boot immediately when it gets to loading the kernel and can't find the device tree which needs to be included in the boot.img.

You would need a UART connection to debug the problems you encounter after that.

I've only attempted to run CoreELEC and EmuELEC on raven.

----------------------------------------------------------------------------------------------------------------------------------------------------------------

thanks Pro-me3us, the sheldon/firestick lineage rom was nice, be great to install similar on the cube. so bootloader is the problem??? ive been able to write modded images but not able to get them to boot. once software ulocked, dont understand why the hardware still is, anyway, thanks for your effort and share.

regarding CoreELEC, is there a way to load directly to cube as opposed to running from usb stick?? have you had any luck with this???

cheers
[Fire TV Original Android Development] Pro-me3us:
Yeah it would be great to have more people developing for raven. There's LOS 20 and LOS 21 development projects for Amlogic boxes. You can check those out and use those as a starting point to compile for your raven.

I don't think raven's bootloader should be a problem. I was saying that any ROM that you have tested was missing the DTB from raven which needs to be included with the ROM boot.img. When you compile LOS you'll want to use the option to compile the DTB with the boot.img.

I haven't tried, but I remember seeing something about doing that on the CoreELEC forum in the past, you can probably find more information there.
[Fire TV Original Android Development] pretzells:
yes, ive seen the los 20/21 soc 905 wasnt working in my mix/recipe ive tried. i was hoping the dtb can remain and replace the rest of the img/dat/lists. my stumblin block, write takes a dump at the vendor img, approx 70%. i fix the vendor and it writes then the product img dumps. one or the other.. be great to have just have gsi or aosp without any fluff, plain.again, thanks for sharing, good job!
[Fire TV Original Android Development] Pro-me3us:
The s905 (gxbb) is a bit older SOC than the s922x (g12b), it's more closely related to the s905x2 (g12a). You can use mkbootimg to extract the dtb from the FireOS boot.img and pack it into what ever ROM boot.img you are trying. I'm sure there will be more issues after this that will require debugging. It would be nice to have LOS as an option, I hope you are able to get it working.
[Fire TV Original Android Development] pretzells:
any luck connecting to the amlogic burning tool???? writing an .img i bricked the cube, recovery lost. no combination of buttons to regain anything. got me a little project......lol.
[Fire TV Original Android Development] Pro-me3us:
It sounds like the unlock exploit may have been deleted.

Hold down the volume up button on the Cube for 10sec when powering it on, to boot it into fastboot. USB connect the Cube to a computer, and use fastboot to boot TWRP (inside raven_root_shrinker zip folder), then reflash one of the FirsOS bins, flash the TWRP.img to recovery, and reflash Magisk.

fastboot boot twrp.img

If you get a fastboot permission denial, the exploit is gone, and the Cube can only be recovered from DFU mode (low level recovery mode). Getting into DFU mode is only possible for Cubes rooted before OTA update PS7273+.

An HDMI dongle is needed to boot into DFU mode. Amlogic burning tool won't help, it would also rely on DFU under these circumstances.
[Fire TV Original Android Development] pretzells:
exactly! thanks. thats actually how it worked out. i rebooted volume down(recovery), no life. tried some other volume/power combos and did another volume up/reboot. on pc did fastboot commands and list devices, G......something string came up, i got life!! fastboot flash twrp, no problem, reboot to twrp. i got life, yes, then flash bin, then magisk. cube is alive. thanks, again, essentially thats how it worked out for me shortly after writing my post.

hope that LOS will be available, or similar. cheers
[Fire TV Original Android Development] Pro-me3us:
Glad you got it restored.

I don't have any plans to work on LOS or any alternative OS's that install on the eMMC (that's not going to change), I need to be able to use FireOS. Getting LOS running will likely be up to you if you want it, I haven't seen anyone wanting to develop for raven, especially such a time consuming project like LOS.

I don't recommend flashing random ROMs unless you have a uart connection for debugging and DFU recovery capabilities. There's little to no chance that a ROM will work without some modification. My guess is that the LOS ROM you flashed included LOS recovery. Recovery/Boot images will not load without the raven DTB included with them.
[Fire TV Original Android Development] pretzells:
yes, your correct, im gonna chilax for awhile, i got lucky and managed to keep my hardware, so fireos for the next while.

thanks for your work thus far, cheers!!
[Fire TV Original Android Development] ddogishere:
Hi buddy @Pro-me3us , I'm looking to updating to latest firmware 7671(March 2024). Have 2 questions.

1.what does loose "shrinker backdoor backup" means & what apps rely on ADB as I will lose that as well?

2.when i downgrade ( do i do data wipe first then flash or flash first then data wipe in twrp)?

Thank you in advance buddy.
[Fire TV Original Android Development] Pro-me3us:
This means that raven_shrinker & raven_buf will no longer work to gain temp root on newer patched FireOS firmware. It's only a problem if the Cube lost the unlock exploit.

Most apps don't require ADB access. Apps that do will display an ADB connection authorization request window on first use after installation.

It doesn't matter. A data wipe will delete the OTA update protections implemented by the unlock script. It will be up to you to either restore them or disable the OTA app. Also remember to reflash magisk directly after any firmware flash.

TWRP firmware update

1) flash firmware file

2) flash magisk.zip (same or higher version than currently installed version)

3) Exit TWRP with reboot, check OTA updates still blocked

TWRP firmware downgrade

1) flash firmware file

2) wipe data

3) flash magisk.zip

4) flash ota blocker magisk module (amzn_ota_block.zip)

5) enable secondary ota update protection, copy & paste as one ADB command in TWRP

echo '#!/sbin/sh
# Rename misc partition
mv /dev/block/misc /dev/block/misc_real
# Create symbolic links
ln -s /dev/null /dev/block/misc' > /data/adb/post-fs-data.d/misc_hide.sh && chmod +x /data/adb/post-fs-data.d/misc_hide.sh

6) Exit TWRP with reboot and re-register Cube (always wise to use caution)

Note: Rename firmware .bin to .zip for it to appear in the TWRP UI

Apps that stop working on older firmware (eg Prime Video) can be manually updated with newest version from here. New firmware updates are released every 1-2 months and rarely have anything good to offer.
[Fire TV Original Android Development] ddogishere:
Hi @Pro-me3us can someone make a module to block factory reset, just to safeguard against family members?
[Fire TV Original Android Development] Pro-me3us:
That's already automatically implemented as part of the bootloader unlocking script. Specifically it's the code I mentioned to copy & paste in step 5) after performing a TWRP data wipe, in the post above.

That code creates a Magisk script that's run on boot, to prevents both FireOS OTA update & factory resets. But there are two circumstances where it won't work. Magisk modules and scripts are disabled when booting the Cube in safe mode. And a TWRP data wipe will delete all Magisk scripts and modules.

Since no preventative is perfect, some responsibilty has to be laid on the user to just not peroform a FireOS factory reset in the first place.

If all preventatives fail and the Cube is bricked, there's one last recovery option. FireOS firmware PS7273+ permenantly disabled DFU (mask) mode with an eFuse. Cubes unlocked prior to the update (PS7242 or lower) still have DFU access, even if they were updated through TWRP later.

DFU mode can be used to recover from any brick, using the original raven bootloader exploit. The catch is that it requires making/buying a DFU HDMI dongle to enter DFU mode, and the restoration script has to be run in Linux/Ubuntu.
[Fire TV Original Android Development] ddogishere:
Thanks, how do we copy step 5 - the echo command, is it individually or all in one? & is there an easier way to do that like connect twrp via PC/phone?

Thanks once again.
[Fire TV Original Android Development] Pro-me3us:
Copy & paste all the code as one long command, and hit enter.

Enter it from ADB however is most convenient for you. Either USB connect the Cube to a PC and boot to TWRP or FireOS to open an ADB shell prompt (raven:/ #), or make a WiFi ADB connection in FireOS.

After entering the command, reboot FireOS. If you see misc_real listed under /dev/block/ it was successful.

raven:/ # ls -la /dev/block/
[Fire TV Original Android Development] Pro-me3us:
No you're only screwed if the firmware finishes downloading, and reboots into recovery and updates. If the Cube ends up at the recovery screen with an updating message, immediately unplug the power and come back here for instructions.

Unplug immediately if you ever get to this screen. Better to brick the Cube than let the update finish. A new Cube can be unbricked from DFU mode.

Ok, whatever happens, if you ever end up at the recovery screen above with the Cube updating, just unplug no matter how much progress was made.
[Fire TV Original Android Development] signde:
Thanks but I was able get around it.

I edited my post in the other thread just a few minutes ago, in my situation, just doing a hardware reset and trying again was enough to allow Voice View tutorial to come up again.
[Fire TV Original Android Development] Pro-me3us:
If you want extra peace of mind, you can checkout the original Raven rooting thread. That method can root or unbrick the Cube without even booting FireOS. As I told @ddogishere the catch is that you have to make/buy a DFU dongle ($5-8 in parts). Even if you are rooted now, you can still make one so that you have it if ever needed.

The rooting procedure in this thread is quite a bit easier, doesn't require Ubuntu or any extra hardware, but you do have to get past that registration screen without letting the update happen.

BTW by hardware reset, do you mean that you performed a factory reset with the remote, to reset the Voice View?
[Fire TV Original Android Development] signde:
Thanks @Pro-me3us.

I've hit a new snag, using method "Bootloader unlock, install TWRP & Magisk", I seem unable to obtain root.

Executing raven_shrinker yields this:

raven:/ $ /data/local/tmp/raven_shrinker
fingerprint: Amazon/raven/raven:7.0/PS7212/1335N:user/amz-p,release-keys
/data/local/tmp/raven_shrinker: unable to match build id
: Success

Looks like this is yet another version that needs to be accounted for?
[Fire TV Original Android Development] Pro-me3us:
I've never seen a raven on PS7212/1335N before but the required information is likely the same as PS7212/1333N. Give me 20min, I'll compile raven_shrinker with an entry for PS7212/1335N to try.
[Fire TV Original Android Development] Pro-me3us:
@signde Assuming this works, after running raven_shrinker to gain temp root (and before running the unlock script) can you make a copy of your boot.img and bootloader.img for the archive.

raven:/ # dd if=/dev/block/boot of=/sdcard/download/boot.img

raven:/ # dd if=/dev/block/bootloader of=/sdcard/download/bootloader.img

Copies will be placed in the Cube's download folder.

Also block updates now to be safe (root not required)

raven:/ $ pm disable-user com.amazon.device.software.ota

raven:/ $ pm clear com.amazon.device.software.ota
[Fire TV Original Android Development] signde:
Worked like a charm! Thanks so much for your help with this.

I made created the images you requested right after running raven_shrink. Just upload them somewhere for you to download?
[Fire TV Original Android Development] Pro-me3us:
Thanks, yeah you can zip and upload them to https://filetransfer.io/ then post the link here.
[Fire TV Original Android Development] signde:
Download Data package from May 31st.

Size of the data package: 10.26 MB. Free transfer of up to 6 GB of photos, videos and documents. Send large files via email or a link to share. No registration, no ads, just simple file sharing!

filetransfer.io

Thanks again!
[Fire TV Original Android Development] Pro-me3us:
Thank you, can you grab one last bit of information, the build date for PS7212/1335

raven:/ $ getprop | grep ro.build.date
[Fire TV Original Android Development] signde:
[ro.build.date]: [Wed Jul 15 19:46:55 UTC 2020]

[ro.build.date.utc]: [1594842415]
[Fire TV Original Android Development] signde:
I missed this question yesterday. What I did was the factory reset by using the buttons on the fire cube itself. I didn't try the method from the remote, perhaps that would have worked too.

Either way if you miss your initial window with the VoiceView hack you'll have to reset the device and try again. It only works because of the tutorial that pops up which only happens the very first time VoiceView is engaged.
[Fire TV Original Android Development] Pro-me3us:
Ah completely forgot about that factory reset button combo!
[Fire TV Original Android Development] ddogishere:
Hi thanks but i get no misc_real when i tried just misc dev dull. But mind you i didn't do twrp wipe or anything & still full rooted / unlock with magisk modules.

And also can we build a module / script to completely shut down the Cube?

TIA.
[Fire TV Original Android Development] Pro-me3us:
If you haven't performed a TWRP data wipe, then you don't need to run the echo command, the unlocking script already handled that. Running the command again will overwrite what was there before. You'll only see /dev/block/misc_real under FireOS (not TWRP).

The echo command creates misc_hide.sh with executable permissions, check it exists:

raven:/ # ls -la /data/adb/post-fs-data.d/

Then check the content of that file for this code

#!/sbin/sh
# Rename misc partition
mv /dev/block/misc /dev/block/misc_real
# Create symbolic links
ln -s /dev/null /dev/block/misc

Display contents of misc_hide.sh:

raven:/ # cat /data/adb/post-fs-data.d/misc_hide.sh

It's a very simple script, that hides the misc partition from FireOS so that it can't be written to by factory resets or the OTA update process.

This ADB command will power off the Cube

raven:/ # reboot -p

It can be called by Launcher Manager using the ADB commands submenu, issued by a button remapping app, mapped to a shortcut icon for the homescreen, etc. With firmware PS7669 and above, apps can no longer access ADB, so I'm not sure if any of those options will work. I haven't updated to that firmware to know how that new restriction is applied, or how it might be circumvented with root. @SweenWolf may have a better idea on that?

reboot -p could be issued by an app using Java/Kotlin instead of ADB, but that's out of my knowledge.

Last resort, holding the action button on the top of the Cube for 10sec or 15sec will also power it off.
[Fire TV Original Android Development] ddogishere:
@Pro-me3us Spot on mate, all is there 👍, thank you so much. Now to configure shut down in launch manager, will keep you updated
[Fire TV Original Android Development] ddogishere:
Hi @Pro-me3us launcher manager is now disabled on 7668/3894, is downgrade now needed?

P.s. is trwp data backup/ restore work on cube?

TIA.
[Fire TV Original Android Development] Pro-me3us:
PS7668 is fine as far as ADB functionality. Launcher Manager is on Amazon's app blacklist. You only need to disable the blacklist app:

raven:/ # pm disable-user com.amazon.adep

raven:/ # pm clear com.amazon.adep

Then re-enable Launcher Manager. I think you only need to:

raven:/ # pm enable com.wolf.lm

Otherwise just re-install it.

It should be working, it's been a long time since I build and tested TWRP. If you downgrade it's not a good idea to restore app data since there are a lot of system apps being downgraded in the process, and the system app data may not be compatible.
[Fire TV Original Android Development] ddogishere:
Phew , was not looking forward to it, thanks once again buddy.
[Fire TV Original Android Development] Pro-me3us:
A couple notes about powering off, in case you weren't already aware.

1) In FireOS you can reboot the Cube by simultaneously holding Select + Play buttons on the remote for 5sec.

2) If you power off the Cube with reboot -p (FireOS) or shutdown (CE), the Cube can be powered back on by tapping the action button on the top of the Cube.

3) You can use Launcher Manager to save the reboot -p command so that you can issue it more conveniently with the remote. However, Jamal over in the CoreELEC forums made an android app that simply issues a reboot update command. 'Reboot update' on the Cube will boot it to Amlogic update / uboot, so you don't need that.

Since Jamal already has the app all build, he might be willing to recompile the app with reboot -p instead. The first version of that app was a homescreen icon that only performed a reboot, simple. Since then more features have been added that you don't need, and that add more steps to reaching your shutdown goal. So maybe you could ask for an earlier version.
[Fire TV Original Android Development] Pro-me3us:
{Mod edit: Quoted post has been deleted. Oswald Boelcke, Senior Moderator}

If you can't get past registration to enable ADB debugging, then there is only one unlocking option. It requires that the Cube is on FireOS PS7242 or older firmware. Without being able to register the Cube there's no easy way to tell what firmware version it's on. If the setup/registration UI looks older that would give some positive confirmation that it might be unlockable. Post a couple photos of the setup screen. Maybe Amazon would be willing to tell you when it was blacklisted to give you a clue.

You could open up the Cube and make a uart connection, that would tell you for certain whether it can be unlocked. Or just follow the guide in the link, use a DFU dongle and find out that way. Making/buying the DFU dongle is the biggest hurdle for that original method.

Keep in mind, if successful this would only unlock the bootloader, making the Cube usable. It can not remove Amazon's blacklisting, that's maintained on their servers. So you'd have to rely on the Aurora store, Google Play Store, sideloading, or use it for EmuELEC/CoreELEC.
[Fire TV Original Android Development] Pro-me3us:
That looks like older UI. I think the newer UI looks more like this and uses the black/grey background instead of the dark green background. My hutch is that this is pre PS7273 firmware and unlockable. Best guess it's ~PS7229 or older.

@AFTVnews.com may know better when that UI change occurred.

Older setup UI with dark green/blue background

Newer setup UI with black/gray background and boxed WiFi APs
[Fire TV Original Android Development] ddogishere:
Hi @Pro-me3us, launcher manager main is still blocked, mini works but can't remapp buttons. Any ideas? Thanks.
[Fire TV Original Android Development] Pro-me3us:
What indicator is there that Launcher Manager is blocked? Is the app unable to open or is some functionality within the app not working? I'd use LM 1.1.6 if you need Launcher Manager.

Is com.amazon.adep disabled? Do you see it in the list of disabled apps?

raven:/ # pm list packages -d

Use Xposed Edge for button mapping, it's the best way to remap the remote on a rooted device. There are some install instructions here.
[Fire TV Original Android Development] ddogishere:
Thanks will give it a go and update 👍

Update: @Pro-me3us just want say thank you so much, got the map button to a tee.

Now just to figure a way to power on via remote or cec.