[Fire TV Original Android Development] Pro-me3us:
Overview

This rooting method is based on a vulnerability in the ARM Mali GPU driver (CVE-2022-38181) discovered by security researcher Man Yue Mo at GitHub Security Lab, to gain root access to the 2nd gen Cube that is on firmware PS7624/3337 or older. Newer method for PS7633 through PS7646 here.

The exploit program (raven_shrinker) is run directly on the Cube to spawn a temporary root shell for quick access. It can also be run automatically on every boot in combination with @diplomatic's bootless Magisk script to grant apps root access. Cubes that are on firmware PS7292/2984 or older, are able to use @Functioner's bootloader exploit used in the previous Raven Root bootloader unlock to install TWRP & full Magisk without a DFU device.

For best results, run raven_shrinker 30-90sec after boot up, when loading is complete and the device is idle.

Three options for root depending on your needs & comfort level

1) Temporary ADB root - Open an adb root shell for quick access (PS7624/3337 or older)

Pros:

Access all files and folders from ADB

Simple to use, runs in RAM and doesn't make any changes to the Cube, no chance of bricking.

Remove app package protection so that you can enable/disable any app even without root (eg custom launchers, disabling updates, debloat, etc).

Cons:

Only enables ADB root

raven_shrinker occassionally crashes/reboots the Cube when being run. Run it 30-90sec after bootup for greater reliability.

NOTE: raven_shrinker won't brick your device, but what you do with that root access can. DM-verity is still in place checking the integrity of the system/vendor partitions, do NOT modify anything in those directories, or the boot partition!!

2) Bootless Magisk - Automatically start a lite version of Magisk that runs entirely from the data partition, (PS7624/3337 or older).

Pros:

Both ADB root and ability to grant root to apps through Magisk Manager

Once the Magisk dameon has started, root can be granted stably whenever needed

Doesn't modify boot or system/vendor partitions, DM-verity is preserved

Cons:

This is experimental, use at your own risk! It's been working stably during my testing but it's impossible to foresee every issue.

Still relies on raven_shrinker to start, and may occasionally crash when raven_shrinker runs at boot

Most Magisk modules don't work.

NOTE: Be careful of what apps you give root access to. Giving root access to an app that modifies the boot, system or vendor partitions will brick your device. Again, DM-verity is still actively checking that no changes have been made to system/vendor directories.

3) Bootloader Unlock - Install Magisk & TWRP, and enable many more features (PS7292/2984 or older)

Pros:

Use the latest version of Magisk, with Zygisk & module support

Use TWRP for backups & upgrades

Unrestricted use of Fastboot and the U-Boot command line (Amlogic Update)

Only requires raven_shrinker for the initial installation, more stable and tested than bootless Magisk

Remap Cube buttons to allow booting to fastboot, TWRP, Amlogic update.

Possible to update firmware to PS7624/3337 through TWRP and keep device unlocked

Cons:

There is no recovery option in case of a brick.

Requires older firmware to work

NOTE: It's very important to NEVER allow the Amazon OTA app to update the firmware. NEVER run the factory reset option in FireOS settings. If either of these occur, the Cube will be bricked.

Contributors:

Man Yue Mo, @Functioner, @Pro-me3us

Thanks to @Michajin & @mavsman13 for testing & feedback

Thanks to @diplomatic for bootless Magisk script, and @SweenWolf for Launcher Manager

Thanks to @Renate for many great tools

Thanks to all the folks who have worked on TWRP & Magisk