yashsingh1/xdaforums huggingface dataset:
[Fire TV Original Android Development] Pro-me3us:
The exploit doesn't run as smoothly on raven compared to gazelle. The exploit is trying to perform a tightly timed code execution. Usually it succeeds within a couple minutes. Don't run it for more than 10min straight (or past failed after 3000-3500 tries).

To increase the chance of success

1) unplug the Cube for 10sec this will completely clear RAM. Might be my imagination but I think this has helped sometimes.

2) reboot to FireOS, wait another 30-60sec once you see the homescreen.

3) don't open or run any other apps on the Cube while raven_buf is running. It's a timing dependent exploit, and running / opening other apps makes getting the timing right harder.

Most of the time just doing a fresh reboot without unplugging the Cube is enough to be able to get raven_buf to succeed in a couple minutes.

If it doesn't succeed in under 10min, run

raven:/ $ pm list packages -3

This will list all the 3rd party apps you have installed. It's possible that something is starting up with FireOS that is running in the background complicating things.

You can also press the physical mute button on the Cube, and this will free up ~7-10% (40-60%/600%) of the CPU that is being used listening for the Alexa wake word.

If none of that helps, then run the command

raven:/ $ top

And show the output, this will display all the processes running on the Cube. I would want to check that activity levels look normal
[Fire TV Original Android Development] madonnaragu:
Ok, IT WORKED NOW! I tried running raven.buf several times, it finally worked.

My router is a 5G mobile one, so I just removed the SIM card from it before running all those commands.

THANK YOU SO MUCH! 🙏

PS: I previously used the Permissions Manager & AdGuard hack to disable updates - can I remove these apps now, as they seem to slow things down? I also previously renamed my Wolf launcher to match the name of the default Amazon launcher. Can I leave that as it is?
[Fire TV Original Android Development] Pro-me3us:
Assuming you disabled the OTA app in the instructions (com.amazon.device.software.ota), updates are blocked.

You can verify which apps are disabled with

raven/: $ pm list packages -d

Go to FireOS settings, check for updates, and you should get an error. There is no way for Amazon to re-enable the OTA app that I know of.

Remove AdGuard and Permission Manager if you want.

You can name Wolf Launcher however you like. Amazon only added Launcher Manager to their blacklist, and since you have disabled com.amazon.adept, the blacklist is no longer active.
[Fire TV Original Android Development] madonnaragu:
That's wonderful, thank you SO MUCH! 😄 I truly appreciate your help with this. The biggest issue for me is that Amazon's launcher is just so overwhelming and it makes me anxious just looking at it for a second. This helps by allowing me to use my own launcher. 🙏
[Fire TV Original Android Development] Pro-me3us:
I made a script to remap the remote app buttons to any app you want. I'll need to make a separate thread on remote mapping at some point to post anything I come across.
[Fire TV Original Android Development] Pro-me3us:
I've updated the raven_buf script in the OP to cover PS7229/1850, PS7652/3564 & PS7646/3565. Thanks to Fritsch for his help and confirmation.
[Fire TV Original Android Development] xender11:
I was able to successfully root my 3rd gen today but not on 2nd gen. I've followed this advise and unplugged my 2nd gen cube a few times and then wait 60 sec to try again. I also uninstalled a bunch of apps now but it still doesnt work.

Here's some info from running the command mentioned above.

Version: /PS7652.3564N/

Last Failed run:

benchmark_time 139

failed after 4000

failed after 4100

failed after 4200

benchmark_time 183

failed after 4300

failed after 4400

failed after 4500

benchmark_time 182

C:\adb\platform-tools>adb -s 192.168.1.168:5555 shell

raven:/ $ pm list packages -3

package:com.amazon.spiderpork

package:com.amazon.firetv.youtube

package:com.teamsmart.videomanager.tv

package:org.xbmc.kodi

package:com.esaba.downloader

raven:/ $ top

PID USER PR NI VIRT RES SHR S[%CPU] %MEM TIME+ ARGS

30899 audioserver 20 0 53M 6.7M 5.0M S 12.3 0.3 3:39.41 fireos.hardware.audio@2.0-service

6223 u0_a185 10 -10 1.8G 295M 196M S 11.6 14.8 2:26.47 com.teamsmart.videomanager.tv

3202 mediacodec 20 0 60M 13M 10M S 7.0 0.6 1:43.40 media.codec hw/android.hardware.media.omx@1.0-service

3143 system -2 -8 106M 10M 7.1M S 5.0 0.4 1:21.90 surfaceflinger

31008 system 18 -2 1.9G 181M 136M S 3.0 9.1 1:42.82 system_server

1889 root RT 0 0 0 0 S 3.0 0.0 0:20.88 [irq/59-meson-am]

3006 root 10 -10 0 0 0 S 2.6 0.0 0:16.85 [rx_thread]

3004 root 10 -10 0 0 0 S 2.3 0.0 0:18.03 [main_thread]

3005 root 10 -10 0 0 0 S 2.0 0.0 0:19.04 [hif_thread]

8510 shell 20 0 6.3M 3.4M 2.6M R 1.3 0.1 0:00.17 top

2836 root RT 0 0 0 0 D 1.3 0.0 0:23.75 [vdec-core]

30894 audioserver 20 0 71M 5.8M 4.7M S 1.0 0.2 0:20.60 audioserver

3117 system -3 -8 72M 3.0M 2.6M S 1.0 0.1 0:28.35 android.hardware.graphics.composer@2.2-service

2212 u0_a49 20 0 1.7G 139M 116M S 0.6 7.0 0:16.91 com.amazon.avod

3375 root -3 0 0 0 0 S 0.6 0.0 0:15.73 [aml_buf_toggle]

2985 root -2 0 0 0 0 S 0.6 0.0 0:07.21 [ksdioirqd/sdio]

2834 root RT 0 0 0 0 S 0.6 0.0 0:05.66 [irq/50-vdec-0]

6407 u0_a46 20 0 1.6G 124M 109M S 0.3 6.2 0:05.35 com.amazon.firebat

962 u0_a147 20 0 1.8G 179M 114M S 0.3 9.0 0:30.80 com.amazon.tv.launcher

3102 root 20 0 20M 2.6M 2.5M S 0.3 0.1 0:03.92 systemcontrol

1854 root 20 0 0 0 0 S 0.3 0.0 0:03.63 [kthread_di]

7 root 20 0 0 0 0 S 0.3 0.0 0:07.16 [rcu_preempt]

8483 root 20 0 0 0 0 S 0.0 0.0 0:00.00 [kworker/1:0]

8478 root 20 0 0 0 0 S 0.0 0.0 0:00.00 [kworker/u12:4]

8477 root 20 0 0 0 0 S 0.0 0.0 0:00.00 [kworker/u12:3]

8476 root 20 0 0 0 0 S 0.0 0.0 0:00.00 [kworker/u12:2]

8475 root 20 0 0 0 0 S 0.0 0.0 0:00.00 [kworker/u12:1]

8473 shell 20 0 4.9M 2.4M 2.0M S 0.0 0.1 0:00.00 sh -

8470 root 20 0 6.2M 2.4M 1.9M S 0.0 0.1 0:00.00 sleep 110

8378 root 20 0 0 0 0 S 0.0 0.0 0:00.01 [kworker/5:0]

8076 u0_a72 20 0 973M 80M 73M S 0.0 4.0 0:00.31 com.amazon.device.software.ota

8025 root 20 0 0 0 0 S 0.0 0.0 0:00.05 [kworker/u12:0]

8011 root 20 0 0 0 0 S 0.0 0.0 0:00.06 [kworker/5:1]

7733 root 20 0 0 0 0 S 0.0 0.0 0:00.16 [kworker/2:1]

7607 root 20 0 0 0 0 S 0.0 0.0 0:00.00 [kworker/5:2]

I dont see anything weird running but i'm not an expect with fire tv. any help would be great!

Thanks
[Fire TV Original Android Development] Pro-me3us:
If anyone has run raven_buf on PS7652, successfully or unsuccessfully please let us know.

@xender11 I guess nobody has actually confirmed that the the script is still working on raven PS7652. I had only confirmed it on gazelle and assumed the same would be true of raven. There's been a dozen or so downloads since it was updated for PS7652. If there is a problem I'm surprised it wasn't already brought up.

Are you only seeing benchmark timing and 'failed after' messages all the way through from the start? example

benchmark_time 139
failed after 4000
failed after 4100
failed after 4200

Do you ever see any 'failed to find pgd, retry' messages ever?

No need to run the script for so long, if you haven't had success after 10min, you are better off rebooting and trying again instead of letting the script run to 4500 retries. At 4500 retries, raven has run out of system resources, and is very unstable, and will probably reboot itself. Avoid going over 4000 retries.

I don't see anything obviously wrong with your top output either, ~50% of 600% total CPU cycles were in use, which is fine. If you mute the Alexa mic on the Cube, so that it's not listening for the wake word, you'll free up a little bit more.

In case you are using Remote ADB Shell, it doesn't include any terminal formatting. The top output will look something like this with Termux, ADBLink or most any other ADB program.

How many attempts have you made at running raven_buf so far? 2, 3, or more?
[Fire TV Original Android Development] tommy_01:
Just to add to this, I'm having the same issue as @xender11 and struggling to root 2nd gen raven with raven_buf on PS7652.

For some background, I've tried around a dozen or so times including restarting, unplugging, muting alexa and even unplugging HDMI to prevent fireos.hardware.audio@2.0-service from using ~10% CPU.

raven_buf tends to reach around 4500 before stopping/fire tv crashes without achieving root. I don't see any 'failed to find pgd' errors either, just benchmark_time ___ and failed after ___

I've attached results from running top in shell as well as 3rd party apps. Appreciate any help or if there's anything else I should be trying, cheers.
[Fire TV Original Android Development] Pro-me3us:
@tommy_01 @xender11 Can either of you run this test file and let me know what the output is.

Unzip it and transfer buf_test to /data/local/tmp/ and give it execution permission

raven:/ $ chmod +x /data/local/tmp/buf_test

Then run it

raven:/ $ /data/local/tmp/buf_test

and report back
[Fire TV Original Android Development] TJPC2_0:
@Pro-me3us

I am having a similar problem. I ran the buf_test and attached the output.
[Fire TV Original Android Development] Pro-me3us:
@TJPC2_0 @tommy_01 @xender11

Bad news, digging a bit, I see that Amazon patched the exploit in PS7652 on raven. It was still working in PS7646/3565 (posted August 26th).

The 'update failed' output from the test file that TJPC2_0 ran confirms the bug is no longer exploitable. It wasn't the patch I was expecting, but it's patched. There's nothing that can be done about this, the exploit is dead after PS7646. The gazelle team is taking longer to apply their patch, but it's a safe bet the next update will have it.
[Fire TV Original Android Development] xender11:
@Pro-me3us Thank you for digging into this!
[Fire TV Original Android Development] Manmade2:
@Pro-me3us Appreciate your work, and the folks who do this, a lot!

Mine got updated to PS7664 just last night.

What's the best way to disable updates until rooting becomes supported for this version?
[Fire TV Original Android Development] Pro-me3us:
The easiest way is with Ighor's DNS block. You can also do a DNS block with dedicated apps like NextDNS, RethinkDNS, NetGuard etc.
[Fire TV Original Android Development] Pro-me3us:
For those using raven_buf or raven_shrinker, there was always a problem with accessing services after gaining root. Thanks to @Baiker000 for pointing out an easy fix:

raven:/ $ /data/local/tmp/raven_buf

raven:/ # runcon u:r:system_app:s0 /system/bin/sh

Executing the above runcon command after gaining root will allow you to run pm commands as well as any other services. The OP was updated to include this.
[Samsung Galaxy Watch 4] wr3cckl3ss1:
The following available firmware, is for you to use at your own discretion. If you don't know how to flash an update.zip...don't be a warrior and do stupid things....Help yourself and help one another....

All firmware for R895U & R870 is NOW located here in one folder, take your time and download accordingly. Some labels are not correct and/or missing some info. Be mindful and use your head.

10.34 GB folder on MEGA

23 files

mega.nz

Special thanks to @adfree and @Dante63. They're the real Watch guys around here....so if they're here in this thread. Thank them for their outstanding and continuous work in the field.

--wr3cckl3ss
[Samsung Galaxy Watch 4] akzzy6:
Staying connected on the wifi is a task for me.

i've never flashed on watch. ive done on my phone and it was easy.there was still room for mistakes with an unlocked bootloader.
[Samsung Galaxy Watch 4] shivammangla:
I am on r870 gwd6 stable...can I install this 2nd beta on stable without installing 1st beta and what's the process
[Samsung Galaxy Watch 4] znel52:
Will the R895U files work for both bluetooth and LTE variants?
[Samsung Galaxy Watch 4] MehmetAliCan:
Hi, is there a tutorial how to do it? 🥺 Or if I flash the beta firmware, is it possible to go back to my home csc/firmware?
[Samsung Galaxy Watch 4] WolfHRB:
If it is possible, could you please how to capture this kind of information?
[Samsung Galaxy Watch 4] wr3cckl3ss1:
Probably one of the most nerve racking things. But patience is key.

How i got on Beta 2 was from Stable. So i can imagine, it shouldn't be an issue.

I only have the LTE version. So i can say necessarily.

There's plenty of tutorials here at XDA that can guide you on how to flash. And as far as your CSC. There's no definitive answer as to how to change it. But there are semi work-arounds. Head over to @adfree thread for more information.
[Samsung Galaxy Watch 4] Flyfish2333:
How to apply update.zip? I entered Recovery and switched to sideload mode, but adb: sideload connection failed: no devices/emulators found and nothing found on win11 device manager
[Samsung Galaxy Watch 4] shivammangla:
from which method u flashed...please share tutorial link
[Samsung Galaxy Watch 4] adfree:
1 way to apply update.zip is/was via system shell exploit...

Firmware and Combination Firmware and FOTA Delta and CSC change and...

Looks like it could be harder since Tizen... A Stock Firmware for netOdin/Odin not available yet... B Combination Firmware not available yet C FOTA Delta File for study I have...

xdaforums.com

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-32#post-88049893

At the moment unknown to me. If working system shell exploit for GW4/5...

Best Regards
[Samsung Galaxy Watch 4] Flyfish2333:
I just installed GWDA... How to downgrade my watch to use shell exploit?
[Samsung Galaxy Watch 4] OnnoJ:
I would like to hear some first impressions about new or updated functionalities...
[Samsung Galaxy Watch 4] yangton:
https://github.com/100Daisy/android_device_samsung_freshbl

maybe via twrp it work on sw4
[Samsung Galaxy Watch 4] Kiruno:
It's on its way to release soon.

View attachment 5969607
[Samsung Galaxy Watch 4] mangomonkey00:
Will it work on R895F

Difference between r895f and r895u?
[Samsung Galaxy Watch 4] ChaoticCapriquarius:
Does this work on the R890?
[Samsung Galaxy Watch 4] yangton:
When will it be available?When will it be available?
[Samsung Galaxy Watch 4] adfree:
After Beta ends... and after GW6 Release...

(After they sold few ugly GW6...)

Maybe earliest in few weekS... September

But I think maybe more October...

Is my guess...

Best Regards
[Samsung Galaxy Watch 4] wr3cckl3ss1:
View attachment 5973145

Hello there....nice to see you....system

Where's your friend SMT?

Gone ...you say.....ahhh ok

Think it's time to tell the world about new system yet?

....nah.....I didn't think so either....
[Samsung Galaxy Watch 4] wr3cckl3ss1:
OP... UPDATED.
[Samsung Galaxy Watch 4] akzzy6:
Complete guide when?
[Samsung Galaxy Watch 4] tutuco:
Hey, any way to have the update file to the Watch 5 BT - SM-R920 running the AWD6 software version?
[Samsung Galaxy Watch 4] adfree:
Only what others share...

If nobody share... then it wirds sehr schwer...

Best Regards
[Samsung Galaxy Watch 4] crimsonrommer:
So can someone tell me why it stops at 25% when flashing beta 2 on the watch 4 classic?

Btw for those that are trying to find a way to downgrade, if your watch is under warranty from Verizon, brick it by flashing something lower than the current version in netodin, then selecting factory from the reboot menu (press and hold power and back till it says rebooting under the text then press power button three times, press power till it highlights factory then long press, from this mode hard reset doesn't work so you essentially brick it), then gomto Verizon ask for a replacement and they'll send a new one with a lowet firmware, then update all the way until right before latest firmware Make sure to check that patch version stays as January 1 23 then try the smt exploit.
[Samsung Galaxy Watch 4] adfree:
Incremental...

Check File

build_info.txt

Then you see MANDATORY Source Firmware...

Best Regards
[Samsung Galaxy Watch 4] crimsonrommer:
That mandatory firmware patches the exploit needed for this update.zip to work, so kinda at an impass here are we?
[Samsung Galaxy Watch 4] bANONYMOUS:
Has anyone actually gotten this to work? It doesn't make any sense to me. The Beta 2 says that the source requires GWDA, but on GWDA, the exploit to flash this has been patched.

How does someone actually flash these update.zips?

The only thing I can think of is maybe we need to downgrade to the EV8 or whatever it was. And then possibly exploit that version, and use the exploit to flash the OTA files from that link? But wouldn't this just patch it again before getting to GWDA that's required to flash the Beta? Or will this leave the exploit working?

Is there an alternative to flash the updates? Like through ADB? How do we connect to ADB through recovery once the wifi connection is terminated? Is it possible over bluetooth?

I'm not trying to be a **** but these are literally the worst threads for info ever. There's three users who have claimed to have gotten this working, and not one of them actually said how they got it working. And the only one who made a guide, doesn't actually work because the required firmware is patched so the exploit they posted is impossible on the required build.

Unless I'm missing something and someone can actually made a legit guide on how to flash the update.zip on the required GWDA firmware, this all seems like a click farm to get likes seeing at nothing actually works and i'm not the only.person around these threads who has run into issues with no one clarifying anything other than saying "lots of info around here" when there is infact nothing regarding GWDA lol.

I'm skeptical of this snake oil until proven otherwise. And please, by all means, prove me wrong and show us how you guys were able to flash this cause it seems like a hoax at this point.

GWDA is required as the source firmware for the OTA to flash, it will not flash on any other firmware, this is a known way that Samsung OTA files are flashed.

There is no exploit for GWDA that anyone has shared on there.

This means it is impossible to flash these files unless there is an unshared method that they are keeping secret, or it's impossible and all of this is for clout.

Help us out, we all want to flash this, either say how or tell us it's impossible so we all stop wasting out time trying to make this work.
[Samsung Galaxy Watch 4] bANONYMOUS:
TL;DR on my previous rant lol.

wr3cckl3ss1 has already included screenshots of the metadata for both R870 and R895 in the opening post. So to confirm, I've downloaded both R870 and R895 Beta 2 files, opened them up, navigated to META-INF > com > google > android > and opened update-script in notepad.

From there it can be confirmed that the SOURCE firmware that is required to flash Beta 2 on R870 is GWD6 and on R895 is GWDA.

yangton has already mentioned that GWD6 has been patched so the com.samsung.SMT explot can not be used and we already know the same applies for GWDA on the R895.

So how is this being flashes? Both wr3cckl3ss1 and yangton said they got it working, but as far as I can tell, it's impossible as the explot required to flash the OTA.zips has been patched in both required firmwares.

If you're not on either of those firmwares, it will fail at 25% because the source firmware did not match, meaning you're on a version that's too old or too new for what is required.

What am I missing?

I've been trying to go through the entire FOTA Delta thread but there's 43 pages of info and it's taking a LOT of time to try and find what we're missing to flash these files cause as far as I can see. It's impossible.
[Samsung Galaxy Watch 4] bANONYMOUS:
Okay, this is my last ditch effort of trying to make sense of this lol.

The only thing I can think of that would make sense at this point, is you need to downgrade the R895 to FVD4, exploit it to provide the ability to flash the OTA.zip's for every incrimental update until GWDA and continue to use the exploit to flash the beta's, again, incrimentally? Is this correct?

The same principal would apply to the R870 going from EVA8, exploit, use exploit to flash OTA.zips all the way until GVD6, and from there use exploit to flash Beta OTA's?

Or is this still not possible and the OTA updates through the exploit will eventually over write the exploit making flashing newer builds not possible, which again makes flashing the beta impossible.

I'm really hoping a simple downgrade, exploit, and flash OTA's in incrimental order is what is needed to make this work.

Can anyone confirm this is how this actually works cause I just spent 3 hours now going through every thread about this that I could find and there is still no difinitive answer lmao
[Samsung Galaxy Watch 4] bANONYMOUS:
Can someone confirm if this is correct? I would just go for it and see what happens but firmwares for the watch are much harder to come by, and this is a very lengthy process which I would rather not waste an hour or more of my time doing all of this only for it to not work at all lol

1) Have R895 on GWDA

2) Downgrade to FVD4

3) Download com.samsung.SMT_v3.0.02.2.apk and SMT Shell v2.0.1.apk

4) adb install -d com.samsung.SMT_v3.0.02.2.apk

5) adb install SMT Shell v2.0.1.apk

6) adb push update.zip /sdcard

(update.zip being FVD4 to GVH2)

7) On watch using SMT exploit, System Update, Local Test, update.zip

8) Watch is now updating using OTA update.zip from FVD4 to GVH2 (and will retain exploit?)

Repeat steps 6 and 7 for GVH2 to GVK6, GVK6 to ????, ???? to GWA3, GWA3 to GWB2, GWB2 to GWDA, GWDA to the beta's in order of ZWF4, ZWFC, ZWG7, ZWH3.

Is this correct? Or will the local test exploit for flashing OTA.zips be patched before getting the required GWDA to flash Beta 2?

The only thing I've seen posted so far is that being on GWDA through official OTA updates will have the exploit patched and the SMT exploit to use local test install of OTA.zips will not work. But no one has ever mentioned if going from an exploitable version, and using the local test ability to flash every single incrimental OTA file will patch it or leave the ability there for further OTA files.
[Samsung Galaxy Watch 4] adfree:
https://xdaforums.com/t/watch-4-one...-r895u-r870-only.4596739/page-2#post-88878905

Try focus on this post...

Feel free to extract build_info.txt from update.zip

Then look with open eyes.

There are more then 1 tiny problem...

But all IMHO is because Samsu.g is ... %&§

But it is possible to find own solution...

Nothing is impossible...

BUT you need to understand the Basics...

Best Regards
[Samsung Galaxy Watch 4] bANONYMOUS:
I understand that the build info says the source needs to be GWDA, I verified this in the meta data in my previous rant lol. The issue is that the SMT exploit in order to use local test to flash the ota.zip does not work in GWDA because downgraded system apk's is no longer allowed.

I also understand the beta's need to flashed in incrimental order because they look for the source firmware the device already needs to be on in order to flash otherwise they will fail at 25%.

What I'm asking is if I downgrade the watch to FVD4, use the SMT explot, use local test to flash the OTA updates in incrimental order until I am at GWDA. Will I still have local test using the SMT explot? or will I lose that ability somewhere along the path from FVD4 to GWDA?

The order

FVD4 > GVH2 > GVK6 > GWA3 > GWB2 > GWDA and then it moves to the beta updates of ZWF4 > ZWFC > ZWG7.

But, if I downgrade to FVD4, apply OTA.zips using the local test to install them, will the exploit remain? Or will I lose that function before getting to GWDA?

If I can downgrade to FVD4, use the local test SMT exploit to flash each OTA all the way to GWDA and still have the exploit, then the beta OTA's will work and this will be 100% possible.

But if the exploit gets over written, even by local test flash of OTA.zips then there is still no clear way to make this work that I'm aware of and so far no one has been able to clarify how to actually flash these files lol
[Samsung Galaxy Watch 4] bANONYMOUS:
@wr3cckl3ss1 your OTA dump is missing GVK6 to GWA3 for R895
[Samsung Galaxy Watch 4] wr3cckl3ss1:
Small error if I didn't catch it. But I doubt it. And to answer your question about system shell. I leave you with this.