[GUIDE] Hardware root via emmc chip (requires soldering!)

Search This thread
By:
Advanced…
S

skyball2

Member
Jun 25, 2009
37
15
zeroepoch said:
That's a good question. I have no idea. If it uses the EXACT same system partition then no problems, but if it's different than we'll need a different pre-rooted image. Maybe rbox knows if the non US models are different. There really isn't an easy way to check that I know of besides MD5SUM the partition which requires at least restricted root access.
Click to expand...
Click to collapse

Thanks again! So I hope that rbox will know an answer to that. I'll receive my Fire TV today and I'd be willing to experiment a bit but wouldn't want to take the risk of bricking my device.

Greets, Christian
 
C

Calibaan

Senior Member
Jan 23, 2014
219
39
lostech.bplaced.net
For the 1st gen FireTV there were no differences between US or EU/UK/GER devices despite the power supply adaptor. So identically hardware and software. It´s very likely that´s still the same for the 2nd gen aTV.
 
Z

zeroepoch

Senior Member
Dec 30, 2010
313
215
San Jose, CA
www.zeroepoch.com
Google Pixel 7
skyball2 said:
Thanks again! So I hope that rbox will know an answer to that. I'll receive my Fire TV today and I'd be willing to experiment a bit but wouldn't want to take the risk of bricking my device.

Greets, Christian
Click to expand...
Click to collapse

I've attached the /system/build.prop file from my device. If there was some sort of difference it would probably need to be in that file since that defines a lot of version and device name variables. If you can attach yours or just diff the two that would give some strong confidence in them being the same or not.
 

Attachments

  • build.prop.txt
    5.8 KB · Views: 62
K

kilumnati

Member
Mar 31, 2016
32
0
hey guys i recently bricked my firetv1 using KINGROOT, then using super sume, and now firetv is stuck on boot color logo, i ordered the E-MMC chip, waiting for it in the mail, want to ask is how do i get it back to rooted or even non rooted as i just want it to boot again. what do i flash to it. it was on frimware 5.0.5 and its non rooted now as i still can ADB to it for a while before it reboots after like 5 min. please help thanks..
 
S

superkoal

Senior Member
Sep 24, 2011
1,026
717
Vienna
kilumnati said:
hey guys i recently bricked my firetv1 using KINGROOT, then using super sume, and now firetv is stuck on boot color logo, i ordered the E-MMC chip, waiting for it in the mail, want to ask is how do i get it back to rooted or even non rooted as i just want it to boot again. what do i flash to it. it was on frimware 5.0.5 and its non rooted now as i still can ADB to it for a while before it reboots after like 5 min. please help thanks..
Click to expand...
Click to collapse

Tried this?
http://www.aftvnews.com/how-to-unbrick-by-entering-recovery-mode-and-factory-reset-the-amazon-fire-tv/
 
K

kilumnati

Member
Mar 31, 2016
32
0

Attachments

  • 20160405_181806.jpg
    20160405_181806.jpg
    252.1 KB · Views: 409
Last edited:
P

papars

Senior Member
Dec 12, 2008
166
7
Does this method works with 5.0.5?
Any suggestion of a linux LiveCD I can use, since all my PCs run windows?
 
P

papars

Senior Member
Dec 12, 2008
166
7
I hate kingroot and what it does to the system files. I have bad experience with this and some mobile phones. It does root but ...
Unless there is another way, say to root by kingroot and then flash an image with supersu ...
In any case I have the emmc adaptor so I can hardware root, thus I wonder if there is a change in the procedure in the latest s/w versions.
 
C

CrashInc

Member
Apr 30, 2016
11
6
Can anyone help??

Hi can anyone confirm if this still works on AFTV 5.0.5.1?
I only ask as I have done this before on an older firmware however when trying to gain root access on newer FW I have no luck?
The SU file is in the xbin folder and can even be seen from es file explorer but still no root?

I have tried this about 9 times today following different guides, different versions of SU and it still just doesn't work.

Any help from anyone would be greatly appreciated.
 
P

pwntrik

Member
Apr 29, 2016
35
7
rbox said:
That's interesting... screw up or on purpose... But it looks like the OTA updates are patch updates and the kernel file is a patch also. So someone will need to extract the image from the actual device. Although it's curious that you feed it image.gz. I would imagine it'd need a regular ANDROID! image style file. Either way, once you do have a bootable kernel, all you need to do is replace adbd with one that can start as root.

But I must caution. Whatever you do, DO NOT MODIFY /system before making a FULL image with dd and VERIFYING it is 100% perfect. Because the updates are patch updates, there is no way to apply the updates without a pristine version of the /system. And there is no way to fix /system with an OTA once it's been modified.
Click to expand...
Click to collapse

Will this work...

Code: 
dd if=/dev/sdb20 of=system.img

Then later do the inverse?

About to solder again. I'd love to just take my TWRP backup or at least your prerooted image and use dd, rather than deal with setting up a custom recovery.
 
Last edited:
W

walkabouts

Member
Aug 1, 2012
20
2
Does anyone know if its possible to reflash the emmc, in order to recover a bricked fire TV 1, that is in Qualcomm qdloader 9008 state (in this state I have no access to fastboot, recovery, adb, or even the partitions). Thanks!
 
F

fifo209

Member
Feb 12, 2011
33
4
So I just opened my fire TV 4K and my chips look different then the one in the guid. Any idea where to solder wires for the 4K version? The one I have has the MediaTek chip along side 2 Elpida RAM chips under the main shield and my eMMC has a diff "R" arey between it and the main shield :confused: Anyone know where to solder the wires on this?
HTML: 
https://ibb.co/bsW3Sa
 

Attachments

  • IMG_20170612_211016017.jpg
    IMG_20170612_211016017.jpg
    252.2 KB · Views: 506
Last edited:
E

elektrinis

Senior Member
Mar 23, 2012
101
5
Anyone tried to get away without level converter? I mean add a series resistor, like 1k, on all data lines? This is sometimes used as lever converter, as 3.3V receiver will still accept 1.8V as logic one, and 1.8V receiver will clamp 3.3V signal on internal diode.
Would this work?
 
U

unforsaken

Senior Member
Jan 12, 2013
57
25
fifo209 said:
So I just opened my fire TV 4K and my chips look different then the one in the guid. Any idea where to solder wires for the 4K version? The one I have has the MediaTek chip along side 2 Elpida RAM chips under the main shield and my eMMC has a diff "R" arey between it and the main shield :confused: Anyone know where to solder the wires on this?
HTML: 
https://ibb.co/bsW3Sa
Click to expand...
Click to collapse

I'll keep watching this topic for the answer to this as well. I'm also interested in doing to this to my FTV2.

Let me know if you found any information.

Thanks
 
R

rdpdo

Member
Nov 11, 2017
9
1
Hello all,

I am from France and I use a Fire TV Basic edition.

I will unsolder the BGA eMMC to get pinout and do a hardware rooting.

Can I use the root files for v1 or v2 on the FireTV bsic edition ?

Thanks !
 
I

iLLNiSS

Senior Member
Aug 5, 2016
62
18
rdpdo said:
Hello all,

I am from France and I use a Fire TV Basic edition.

I will unsolder the BGA eMMC to get pinout and do a hardware rooting.

Can I use the root files for v1 or v2 on the FireTV bsic edition ?

Thanks !
Click to expand...
Click to collapse

Did you ever lift the BGA to check pinout? I have a post with what I believe to be are the schematics of the chip (https://xdaforums.com/showpost.php?p=74681052&postcount=5) if you were looking to find the CMD/CLK/RST/DAT[0-7]/VCC/VSS pads elsewhere on the board.
 
Last edited:
  • Like
Reactions: Kramar111
You must log in or register to reply here.

Similar threads

SweenWolf
[APP][FIRETV][NOROOT] Launcher Manager (Change Launcher without Root)
Replies
2K
Views
499K
F
Finnzz
A
[Guide] Installing Google Play Service on Non-Rooted Firestick 2
Replies
102
Views
143K
S
soaib333
I
Fire TV Stick rooted via eMMC (Soldering required)
Replies
70
Views
34K
vanzan
vanzan
A
[Guide] Comcast Xfinity TV Go App on FTV
Replies
283
Views
163K
T
TimmyP
B
[GUIDE][NO ROOT] Disable Bloatware on 2nd Gen Fire TV Stick
Replies
160
Views
100K
oldman20
oldman20

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 11
    X
    xXhighpowerXx

    https://www.youtube.com/watch?v=IgC4iDzQ8gw
    View
    7
    D
    derpeter
    So today i opened the fire tv and build a adapter similar to the SD Sniffer

    SrjigIL.jpg


    After some discussion in our local hackerspace I decidet to try it without the level shifter, power the AFTV via a lab powersupply on the 1,8V pin shown in the gtfv wiki (On the running AFTV i measured 1,65V there).

    I connected all pins from the AFTV to the SD-Card adapter except the VCC.

    FkOW7tT.jpg


    sadly nothing happens. I tried 2 USB SD reader and one build in. On one reader i saw the kernel to reset the USB device a few time but nothing more.

    Next step will be connecting a logic analzer and see if there is SPI traffik when i boot the AFTV.
    In that case i will add the level shifter.

    Here are some more pictures http://imgur.com/a/syYkh/all
    View
    7
    D
    derpeter
    I wrote a blog post about the emmc root and the steps for EU firetv owner to root/unlock/mod .
    Maybe it will help some people as finding all information to start was (at least back in 2014) not easy.
    Some information on the unlock are still missing. I hope this will help some people.
    I will also translate that to german asap as some people asked for it.
    View
    5
    Y
    YourNameInHere
    looks like i'm on the right way :D
    Code: 
    [...]
Nov 20 19:58:58  kernel: [45074.287457] mmc0: req done (CMD3): 0: 00000500 00000000 00000000 00000000
Nov 20 19:58:58  kernel: [45074.287471] mmc0: clock 400000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 0 timing 0
Nov 20 19:58:58  kernel: [45074.287473] OWN DEBUG: 2 (1=MMC_BUSMODE_OPENDRAIN, 2=MMC_BUSMODE_PUSHPULL)
Nov 20 19:58:58  kernel: [45074.287473] OWN DEBUG: 0 (0=MMC_CS_DONTCARE, 1=MMC_CS_HIGH, 2=MMC_CS_LOW)
Nov 20 19:58:58  kernel: [45074.287473] OWN DEBUG: 2 (0=MMC_POWER_OFF, 1=MMC_POWER_UP, 2=MMC_POWER_ON)
Nov 20 19:58:58  kernel: [45074.287473] OWN DEBUG: 0 (0=MMC_BUS_WIDTH_1, 2=MMC_BUS_WIDTH_4, 3=MMC_BUS_WIDTH_8)
Nov 20 19:58:58  kernel: [45074.287473] OWN DEBUG: 1 (0=MMC_SIGNAL_VOLTAGE_330, 1=MMC_SIGNAL_VOLTAGE_180, 2=MMC_SIGNAL_VOLTAGE_120)
Nov 20 19:58:58  kernel: [45074.287493] mmc0: starting CMD9 arg 00010000 flags 00000007
Nov 20 19:58:58  kernel: [45074.287502] rtsx_pci_sdmmc rtsx_pci_sdmmc.0: sd_send_cmd_get_rsp: SD/MMC CMD 9, arg = 0x00010000
Nov 20 19:58:58  kernel: [45074.288417] rtsx_pci_sdmmc rtsx_pci_sdmmc.0: cmd->resp[0] = 0xd00f0032
Nov 20 19:58:58  kernel: [45074.288419] rtsx_pci_sdmmc rtsx_pci_sdmmc.0: cmd->resp[1] = 0x0f5903ff
Nov 20 19:58:58  kernel: [45074.288421] rtsx_pci_sdmmc rtsx_pci_sdmmc.0: cmd->resp[2] = 0xffffffff
Nov 20 19:58:58  kernel: [45074.288422] rtsx_pci_sdmmc rtsx_pci_sdmmc.0: cmd->resp[3] = 0x8a404000
Nov 20 19:58:58  kernel: [45074.288423] mmc0: req done (CMD9): 0: d00f0032 0f5903ff ffffffff 8a404000
Nov 20 19:58:58  kernel: [45074.288425] mmc0: starting CMD7 arg 00010000 flags 00000015
Nov 20 19:58:58  kernel: [45074.288434] rtsx_pci_sdmmc rtsx_pci_sdmmc.0: sd_send_cmd_get_rsp: SD/MMC CMD 7, arg = 0x00010000
Nov 20 19:58:58  kernel: [45074.288990] rtsx_pci_sdmmc rtsx_pci_sdmmc.0: cmd->resp[0] = 0x00000700
Nov 20 19:58:58  kernel: [45074.288991] mmc0: req done (CMD7): 0: 00000700 00000000 00000000 00000000
Nov 20 19:58:58  kernel: [45074.288993] mmc0: starting CMD8 arg 00000000 flags 000000b5
Nov 20 19:58:58  kernel: [45074.288995] mmc0:     blksz 512 blocks 1 flags 00000200 tsac 100 ms nsac 0
Nov 20 19:58:58  kernel: [45074.289005] rtsx_pci_sdmmc rtsx_pci_sdmmc.0: sd_read_data: SD/MMC CMD8
Nov 20 19:58:58  kernel: [45074.289674] mmc0: req done (CMD8): 0: 00000000 00000000 00000000 00000000
Nov 20 19:58:58  kernel: [45074.289676] mmc0:     512 bytes transferred: 0
Nov 20 19:58:58  kernel: [45074.289678] mmc0: clock 25000000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 0 timing 0
Nov 20 19:58:58  kernel: [45074.289680] OWN DEBUG: 2 (1=MMC_BUSMODE_OPENDRAIN, 2=MMC_BUSMODE_PUSHPULL)
Nov 20 19:58:58  kernel: [45074.289680] OWN DEBUG: 0 (0=MMC_CS_DONTCARE, 1=MMC_CS_HIGH, 2=MMC_CS_LOW)
Nov 20 19:58:58  kernel: [45074.289680] OWN DEBUG: 2 (0=MMC_POWER_OFF, 1=MMC_POWER_UP, 2=MMC_POWER_ON)
Nov 20 19:58:58  kernel: [45074.289680] OWN DEBUG: 0 (0=MMC_BUS_WIDTH_1, 2=MMC_BUS_WIDTH_4, 3=MMC_BUS_WIDTH_8)
Nov 20 19:58:58  kernel: [45074.289680] OWN DEBUG: 1 (0=MMC_SIGNAL_VOLTAGE_330, 1=MMC_SIGNAL_VOLTAGE_180, 2=MMC_SIGNAL_VOLTAGE_120)
Nov 20 19:58:58  kernel: [45074.289718] mmc0: new MMC card at address 0001
Nov 20 19:58:58  kernel: [45074.289803] mmcblk0: mmc0:0001 SEM08G 0 B 
[...]

    at this moment i saw the block device but it wasn't accessible. :crying:
    Sadly this happens only once while testing yesterday - maybe due to suboptimal vccq voltage.

    I will do further testing at weekend and post the results.

    P.S. Box is still alive :victory:
    View
    5
    X
    xXhighpowerXx
    Ok here is an updated image of the pinout. I have triple check everything should be 100% correct :fingers-crossed:
    K7l0Gwe.jpg
    View

New posts