FORUMS
Remove All Ads from XDA

[UNBRICK] [ROOT] [TWRP] Fire TV 2 (sloane)

1,509 posts
Thanks Meter: 732
 
Post Reply Email Thread
This guide is only for the Fire TV 2 codenamed "sloane" with mt8173.
This will flash correct partitions and TWRP into it.
I am not responsable of any physical damage in your device, YOU choose to make this modifications.

NOTE: You will need to open the device so be prepared

MATERIAL NEEDED:
  • Linux based system
  • USB Cable
  • Something conductive (paperclip, tweezers etc)
  • Something to open the device.

Install python3, PySerial, adb, fastboot:
Code:
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot
Uninstall modemmanager:
Code:
sudo apt remove modemmanager
PROCEDURE:

1. Open up the device and locate the marked point in the attatched image.
2. Download amonet-mt8173-sloane from downloads and unpack it.
3. Open the unpacked folder of amonet, open a terminal inside it and type:
Code:
sudo ./bootrom-step.sh
4. When you see something like:
Code:
[2019-02-07 14:35:59.478924] Waiting for bootrom
Short the point with the ground (and wait until the script starts).
5. The script will say to remove the short. When this happens, stop shorting the BootROM point and then press enter.
6. Now just wait until finishes.
7. The device should reboot into TWRP. Please, consider now flashing a prerooted ROM for get full TWRP.

NOTE: If TWRP freezes, DON'T UNPLUG THE Fire TV, open an adb shell session and type the following command to restart TWRP:
Code:
killall recovery
ERRORS?
You can easily get an error during the process for a lot of reasons. The main problems are:
Code:
ERROR: Serial protocol mismatch
Code:
device reports readiness to read but returned no data (device disconnected or multiple access on port?)
The first one, means you're in Preloader Mode instead of BootROM mode. To fix it, make sure to uninstall modemmanager and check your short.
If you get the second, means that the TV it's powering on while the payload comes online, in order to avoid that, use a good cable and a good short. If still not working, disconnect the box and let it 1 min, then retry again.

THANKS:
- @CFKod for his patience and for test the script
- @retyre & @k4y0z for the correct addresses for mt8173
- @xyz` for his original exploit for the HD8 2018.
- @Sus_i for locate the bootrom point
- @rbox for inject script, 2ndinit, twrp & for provide old img's.

DOWNLOAD:
Attached Thumbnails
Click image for larger version

Name:	https:_i.imgur.com_eAlQBdh.jpg
Views:	438
Size:	270.6 KB
ID:	4850835  
The Following 9 Users Say Thank You to Rortiz2 For This Useful Post: [ View ] Gift Rortiz2 Ad-Free
19th October 2019, 11:56 AM |#3  
CFKod's Avatar
Senior Member
Flag Cardiff
Thanks Meter: 41
 
Donate to Me
More
Brick no more!!
thank you for your patience and knowledge.

My brick was because I wiped system.

I've added another photo, I simply shorted against the metal hole circled in the picture. This is so useful, it not only unbricks, it allows for downgrade of preloader
Meaning I was then able to resolve my lack of system with @rbox unbrick image.

Also it's so much quicker than flashing via mediatek inject. Wooooo
Attached Thumbnails
Click image for larger version

Name:	photostudio_1571481431179.jpg
Views:	318
Size:	89.2 KB
ID:	4848991  
The Following 2 Users Say Thank You to CFKod For This Useful Post: [ View ] Gift CFKod Ad-Free
19th October 2019, 01:18 PM |#4  
Senior Member
Thanks Meter: 115
 
More
Quote:
Originally Posted by Rortiz2

8. Now your device should start booting back to FireOS. Mount it and enjoy your unbricked TV.

Looks good.

I suppose if step 8 (reboot to system) fails for someone, i.e. something in /system is messed up, the old unbrick solution from @rbox comes handy, in order to flash a system?

Don't know, don't own that box, but maybe it's possible to add a 'flash TWRP to recovery partition' to your unbrick solution? As last point, instead of boot system, boot to recovery... Then users could flash the latest prerooted rom from @rbox, and skip the old unbrick solution? Just a thought... as I said, I don't know details about that box.

Edit: probably flash TWRP won't work, since the bootloader isn't unlocked?
19th October 2019, 01:22 PM |#5  
Quote:
Originally Posted by Sus_i

Looks good.

I suppose if step 8 (reboot to system) fails for someone, i.e. something in /system is messed up, the old unbrick solution from @rbox comes handy, in order to flash a system?

Don't know, don't own that box, but maybe it's possible to add a 'flash TWRP to recovery partition' to your unbrick solution? As last point, instead of boot system, boot to recovery... Then users could flash the latest prerooted rom from @rbox, and skip the old unbrick solution? Just a thought... as I said, I don't know details about that box.

Sure. I can use MISC flags for boot to recovery.
But the question is: Does the twrp can be loaded with newest preloader?
Also if my memory is OK, I remember it's a ramdisk
Cheers.
19th October 2019, 01:27 PM |#6  
Senior Member
Thanks Meter: 115
 
More
Quote:
Originally Posted by Rortiz2

Sure. I can use MISC flags for boot to recovery.
But the question is: Does the twrp can be loaded with newest preloader?
Also if my memory is OK, I remember it's a ramdisk
Cheers.

If I remember right, @k4y0z said that the recovery is flashed out of the boot.img at first boot... and if the TWRP solution is a ramdisk like on the first fireTV, then flashing a TWRP image to the recovery partition will probably not work. Don't know.
19th October 2019, 01:47 PM |#7  
Quote:
Originally Posted by Sus_i

If I remember right, @k4y0z said that the recovery is flashed out of the boot.img at first boot... and if the TWRP solution is a ramdisk like on the first fireTV, then flashing a TWRP image to the recovery partition will probably not work. Don't know.

Correct. TWRP is actually a ramdisk.cpio.
rbox flashes it using his 2ndinit script which needs to be runned with "su".
This script, simply put SeLinux in permissive mode and boots TWRP at every boot:
https://github.com/androidrbox/firet.../jni/2ndinit.c
As you said, flashing the ramdisk directly into /recovery partition will not work since in needs to be signed.
Cheers.
19th October 2019, 02:33 PM |#8  
Senior Member
Thanks Meter: 115
 
More
Quote:
Originally Posted by Rortiz2

Correct. TWRP is actually a ramdisk.cpio.
rbox flashes it using his 2ndinit script which needs to be runned with "su".
This script, simply put SeLinux in permissive mode and boots TWRP at every boot:
https://github.com/androidrbox/firet.../jni/2ndinit.c
As you said, flashing the ramdisk directly into /recovery partition will not work since in needs to be signed.
Cheers.

Ok. I know that from the 1gen stick/box.

Maybe there is a way to (push and) boot that recovery ramdisk as last step with your script, in order to have the option for flashing the latest prerooted?
Don't know... If you could manage that somehow, you can add the [ROOT] tag into the thread headline

@rbox, what do you think?
The Following User Says Thank You to Sus_i For This Useful Post: [ View ] Gift Sus_i Ad-Free
19th October 2019, 02:47 PM |#9  
Quote:
Originally Posted by Sus_i

Ok. I know that from the 1gen stick/box.

Maybe there is a way to (push and) boot that recovery ramdisk as last step with your script, in order to have the option for flashing the latest prerooted?
Don't know... If you could manage that somehow, you can add the [ROOT] tag into the thread headline

@rbox, what do you think?

Yeah it will be pretty nice.
If we can't, we can downgrade preloader, run unbrick image via Preloader and then run a second part of the script that restores correct preloader.
Idk, just for throw ideas.
I added source code in the second post for rbox.
Cheers.
19th October 2019, 03:09 PM |#10  
Senior Member
Flag Near Center of Ukraine
Thanks Meter: 119
 
More
Quote:
Originally Posted by Rortiz2

This guide is only for the Fire TV Stick 2 codenamed "sloane" with mt8173.

Sloane it's Fire TV 2 Gen, not Stick
The Following User Says Thank You to Kramar111 For This Useful Post: [ View ] Gift Kramar111 Ad-Free
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes