[Fire TV Original Android Development] Pro-me3us:
Overview

This rooting method is based on a new vulnerability in the ARM Mali GPU driver (CVE-2022-46395) discovered by security researcher Man Yue Mo at GitHub Security Lab, to gain root access to the 2nd gen Cube that is on firmware PS7633/3445 through PS7646/3565. Check the older root method for firmware PS7624/3337 and older. Bootloader unlock is recommended for devices on PS7292 or below (has many advantages).

The exploit program (raven_buf) is run directly on the Cube to spawn a temporary root shell for quick access. On average it takes 2-5min for the exploit to gain root access. For best results, run raven_buf after a fresh reboot.

View attachment 5944849

Temporary Root

Open an adb root shell to for quick access admin access

Pros:

Access all files and folders from ADB

Simple to use, runs in RAM and doesn't make any changes to the Cube, no chance of bricking.

Remove app package protection so that you can enable/disable any app even without root (eg custom launchers, disabling updates, debloat, etc).

Cons:

Only enables ADB root

NOTE: raven_buf won't brick your device, but what you do with that root access can. DM-verity is still in place checking the integrity of the system/vendor partitions, do NOT modify anything in those directories, or the boot partition!!

Instructions

Enable ADB debugging in FireOS settings

Download, unzip and copy raven_buf to your Cube

adb push raven_buf /data/local/tmp/

Open an ADB shell and give raven_buf execution permission (only needs to be done once)

adb shell ---> opens a 'raven: / $' prompt

raven:/ $ chmod +x /data/local/tmp/raven_buf

Run the program. Takes 2-5min on average.

Root access is gained when the '$' prompt changes to '#' (raven:/ $ --> raven:/ #)

raven:/ $ /data/local/tmp/raven_buf

View attachment 5934761

Disable package protections

Use raven_shrinker to open a root shell and delete all the apps listed in the file /data/system/PackageManagerDenyList

raven:/ # runcon u:r:system_app:s0 /system/bin/sh

raven:/ # echo '<?xml version="1.0" encoding="utf-8" standalone="yes" ?><map><set name="DenyListKeyPackages"></set></map>' > /data/system/PackageManagerDenyList

Disable Arcus Proxy, to keep package protections off

raven:/ # pm clear com.fireos.arcus.proxy

raven:/ # pm disable-user com.fireos.arcus.proxy

Disable Amazon's ability to block apps on your device (eg Launcher Manager)

raven:/ # pm disable-user com.amazon.adep

raven:/ # pm clear com.amazon.adep

Disable OTA updates

raven:/ # pm disable-user com.amazon.device.software.ota

raven:/ # pm clear com.amazon.device.software.ota

raven:/ # pm disable-user com.amazon.device.software.ota.override

raven:/ # pm disable-user com.amazon.tv.forcedotaupdater.v2

Check & confirm the list of disabled apps:

raven:/ $ pm list packages -d

Optional app button remapping.

Better way to disable Amazon homescreen than Launcher Manager.

Changelog:

v1.1 September 5th, 2023​

Support added for PS7646/3565

Contributors:

Man Yue Mo, @Functioner, @Pro-me3us

Thanks to @Renate for many great tools

@RiCkLaR for tip on disabling ADEP and AppBlockList

@Baiker000 for the tip on changing the security context