[GUIDE] I Rooted my Fire TV via dirtycow

slackbladder · Feb 11, 2017

Hi, adam_ky,

Could you explain to me please how you managed to stop your firetv from rebooting and installing further updates please.

I was also on firmware 51.1.4.0, but stupidly forgot to pull the plug on my firetv when i had an upgrade from my isp, and my dns got changed.
this allowed my unit to update to 51.1.6.3, at the time there were no other updates so I quickly put in the opendns server details to my router and no more updates.

I would like to get this 1st gen rooted but I believe it has the efuse problem.

could you please let me know what you did,.... would be really helpful if you could..
cheers..
slackbladder.

Bren123 · Mar 6, 2017

Does this work on 5.2.4.0?

Ultraschorsch · Mar 7, 2017

Bren123 said:
Does this work on 5.2.4.0?

You can check here: http://www.aftvnews.com/how-to-root-the-amazon-fire-tv-using-the-dirty-cow-vulnerability/

tehlers · Aug 5, 2017

Fire TV Stick 5.2.1.1 rootable with dirtycow

Hello,

I just can confirm, that Fire TV Stick (montoya) on version 5.2.1.1 is rootable through dirtycow. It actually took me 5 days of research and trying. I'll not post a step by step howto, but some hints. At first you compile the dirtycow.c with toolchain for android and you need the su binary from SuperSU. You will notice, that root in nearly all selinux contexts can't read emulated sdcard, nor /data/local/tmp, while shell user can only write to these locations. So already data exchange between shell and root is very problematic. But of course you can use dirtycow, but only for small files.

Here are the hints:

/system/bin/watchdogd is started as root in context init. It can remount /system (but cannot write to any directory in /system) and read/write raw devices.
Exchange /system/bin/vcdbg (it's fairly big) with su. This can be used to start su in the exchanged watchdogd shell Script, like:

Code:

#!/system/bin/sh
/system/bin/vcdbg -ad

Reboot, now you can use "vcdbg -c <command>", e.g. test it with "vcdbg -c id". Then do something like:

Code:

vcdbg -c mkdir /data/tmp
vcdbg -c chmod 777 /data/tmp
vcdbg -c dd if=/dev/block/platform/sdhci.1/by-name/system of=/data/tmp/system.img
vcdbg -c chmod 777 /data/tmp/system.img
vcdbg -c chmod 777 /data
cp -a /data/tmp/system.img /data/local/tmp/system.img

And

Code:

adb pull /data/local/tmp/system.img

Then loop-mount the image in your computer, add su, supolicy, libsupol.so and SuperSU.apk (you see files and needed locations in the pre-rooted images). Also watch out for the default contexts these files need to be in (u

bject_r:system_file:s0). If you have a linux without active selinux, copy an existing file, e.g.:

Code:

/root/temp/mount/system/bin # ls -laZ ip
-rwxr-xr-x 1 root 2000 u:object_r:system_file:s0 165484  6. Aug 2016  ip
/root/temp/mount/system/bin # cp -a ip su
/root/temp/mount/system/bin # cat /root/SuperSU/su > su
/root/temp/mount/system/bin # ls -laZ su
-rwxr-xr-x 1 root 2000 u:object_r:system_file:s0 75364  5. Aug 2017  su

push back the file to /data/local/tmp/system.img. Now you need to find a way to get this file readable for root. I did that like this:

Code:

cat /data/local/tmp/system.img | vcdbg -c 'echo "$(cat)" > /data/tmp/system.img'

Now check size and write everything back with dd:

Code:

ls -la /data/tmp/system.img
vcdbg -c dd if=/data/tmp/system.img of=/dev/block/platform/sdhci.1/by-name/system

Reboot and you are fully root.

Afterwards you can install TWRP and install latest pre-root image.

Best

Tim

sumwong · Aug 12, 2017

tehlers said:
I just can confirm, that Fire TV Stick (montoya) on version 5.2.1.1 is rootable through dirtycow. It actually took me 5 days of research and trying. I'll not post a step by step howto, but some hints. At first you compile the dirtycow.c with toolchain for android and you need the su binary from SuperSU.

/system/bin/watchdogd is started as root in context init. It can remount /system (but cannot write to any directory in /system) and read/write raw devices.

Exchange /system/bin/vcdbg (it's fairly big) with su. This can be used to start su in the exchanged watchdogd shell Script, like:

@tehlers: thank you for this! Maybe you can help me on my 5.2.1.1 montoya. I compiled dirtycow (timwr/CVE-2016-5195) for android21/armeabi-v7a and pushed it to the stick. Running it on /system/bin/watchdogd and /system/bin/vcdbg does nothing unfortunately. There are no changes to the files, no matter what I do. I tried a few pre-compiled binaries for dirtycow from this thread and still no changes. I'm fairly new to this. Any chance you could point me into the right direction?

tehlers · Aug 12, 2017

Hi,

sumwong said:
@tehlers: thank you for this! Maybe you can help me on my 5.2.1.1 montoya. I compiled dirtycow (timwr/CVE-2016-5195) for android21/armeabi-v7a and pushed it to the stick. Running it on /system/bin/watchdogd and /system/bin/vcdbg does nothing unfortunately. There are no changes to the files, no matter what I do. I tried a few pre-compiled binaries for dirtycow from this thread and still no changes. I'm fairly new to this. Any chance you could point me into the right direction?

I'll try.

At first: I used exactly the same implementation of dirtycow. You need to pay attention, that you (in contrast to the other dirtycow implementations) give as arguments "./dirtycow src dst", instead of "./dirtycow dst src".

Second thing is, that it only works for a few bytes, and not always. But since it checks what bytes still actually differ, you can go further with every next round. I wrote something like this:

Code:

exit=1; while [ "$exit" != "0" ]; do ./dirtycow /data/local/tmp/watchdogd_new.txt /system/bin/watchdogd; exit=$?; echo $exit; done

You should first try it with e.g. /system/etc/hosts, exchange "127.0.0.1" with e.g. "127.0.0.2", this should go fast (but does not need to work in the first round).

I may also note that I made the shellscripts always exactly as big as the original binary (and always saved the original binary in /data/local/tmp "cp -a /system/bin/watchdogd /data/local/tmp/" before doing anything). So let's say (this is from current firmware, not 5.2.1.1):

Code:

shell@montoya:/data/local/tmp $ ls -la /system/bin/watchdogd                   
-rwxr-xr-x root     shell        5288 2017-06-10 01:45 watchdogd

And you now have a shellscript "watchdogd_new.txt" (this is on my computer, "bc" is not part of the firmware; but the rest would also work in the stick):

Code:

> ls -la watchdogd_new.txt
-rw-r--r-- 1 root root 39 Aug 12 19:29 watchdogd_new.txt
> echo "5288-39" | bc
5249
> i=0; while [ "$i" != "5249" ]; do echo >> watchdogd_new.txt; let i=$i+1; done
> ls -la watchdogd_new.txt
-rw-r--r-- 1 root root 5288 Aug 12 19:31 watchdogd_new.txt

And last thing I would like to note: When finally exchanged everything of the binary and you want to reboot. You should first play a video from e.g. Amazon Video and skip around a bit. That has the effect, that the kernel syncs dirty caches to flash, because it needs the memory for playing the video and caching it. Since you poke with dirtycow something in the cache, a "sync" does not synchronize this to disk (or flash in this case).

I hope this helps.

Best

Tim

sumwong · Aug 12, 2017

tehlers said:
I hope this helps.

Yup! I had tried so many versions of dirtcow that my script called it with paramters in the wrong order. Also I hadn't read up on the exact mechanics of dirtcow so changes to the files were incomplete, exactly like you pointed out, probably because I just rebooted directly after dirtcow finished successfully. I am now in the process of pulling the system image and will report back if all goes well. Seems straight forward from here. Thanks again for the great work and for saving me all those hours of work!

sumwong · Aug 13, 2017

Thanks again to @tehlers for sharing this great work. I had some issues in the process mainly with dirtycow being unstable / mixing up versions of dirtycow but overall this worked like a charm.
I am leaving the files I used and my notes here. I completed those from memory so I might have mixed some things up. I worked on ubuntu and had temporary files in /root/.

Code:

#local

# make sure you activated usb debugging in settings, then connect to your firetv
adb connect 192.168.x.x

# push working files to firetv
# use attached dirtycow for montoya or compile it yourself, using NDK for armeabi-v7a/android-22:
# Makefile build section should read: 
# ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=armeabi-v7a APP_PLATFORM=android-22

adb push /root/su /data/local/tmp
adb push /root/watchdogd_script /data/local/tmp
adb push /root/dirtycow /data/local/tmp

adb shell

#-----------
#aftv

ls -la /system/bin/vcdbg
# 370380 in my case

ls -la /data/local/tmp/su
# 75348 in my case

# pad su to the size of vcdbg (size_of_vcdbg-size_of_su = 295032)
i=0; while [ "$i" != "295032" ]; do echo >> /data/local/tmp/su; let i=$i+1; done
ls -la /data/local/tmp/su

ls -la /system/bin/watchdogd 
# 5288 in my case

ls -la /data/local/tmp/watchdogd_script
# 39 in my case

# pad watchdogd
i=0; while [ "$i" != "5249" ]; do echo >> /data/local/tmp/watchdogd_script; let i=$i+1; done
ls -la /data/local/tmp/watchdogd_script

# exchange watchdogd
exit=1; while [ "$exit" != "0" ]; do /data/local/tmp/dirtycow /data/local/tmp/watchdogd_script /system/bin/watchdogd; exit=$?; echo $exit; done

# exchange vcdbg
exit=1; while [ "$exit" != "0" ]; do /data/local/tmp/dirtycow /data/local/tmp/su /system/bin/vcdbg; exit=$?; echo $exit; done

# surf around a little, watch videos for the system to dump changes

# make sure the changes were applied (should return "root")
vcdbg -c id

# reboot the system
reboot

#reconnect
adb connect 192.168.x.x
adb shell

# dump system to shell accessible system.img
vcdbg -c mkdir /data/tmp
vcdbg -c chmod 777 /data/tmp
vcdbg -c dd if=/dev/block/platform/sdhci.1/by-name/system of=/data/tmp/system.img
vcdbg -c chmod 777 /data/tmp/system.img
vcdbg -c chmod 777 /data
cp -a /data/tmp/system.img /data/local/tmp/system.img

#-----------
#local

# now we pull the system.img to our local system
cd /root
adb pull /data/local/tmp/system.img
# 824180736 bytes in my case

# not sure if all paths correct, writing this down from memory
cd mount
mkdir system
mount ../system.img ./system/
cd system/xbin

# using existing files to make sure context is correct
cp -a trapz su
cp -a trapz supolicy
cp -a trapz libsupol.so
cat /root/su/su > su
cat /root/su/libsupol.so > libsupol.so
cat /root/su/supolicy > supolicy
cd ../app
cp -aR PicoTts SuperSU
cd SuperSU/
mv PicoTts.apk SuperSU.apk
rm -rf arm
rm -rf lib
cat /root/su/SuperSU/SuperSU.apk > SuperSU.apk
cp SuperSU.apk ../
adb push system.img /data/local/tmp/

#-----------
#aftv

# cat system.img to root accessible place
cat /data/local/tmp/system.img | vcdbg -c 'echo "$(cat)" > /data/tmp/system.img'
# double check file size 
ls -la /data/tmp/system.img
# and write back
vcdbg -c dd if=/data/tmp/system.img of=/dev/block/platform/sdhci.1/by-name/system

# just to make sure, deactivate ota service and remove banner ad while we're here
adb shell pm hide com.amazon.device.software.ota
pm uninstall -k --user 0 com.amazon.kso.blackbird

reboot

tehlers · Aug 13, 2017

Dear all,

upon request, I tried to make things easier with a bundle of files and scripts you can run on the Fire TV Stick 5.2.1.1. I will take no responsibility if your stick bricks! I have prepared the system.img with TWRP and su.

Here are the following files:

Code:

Archive:  auto-root-fireos-5.2.1.1.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  2017-08-23 15:25   auto-root-fireos-5.2.1.1/
     1565  2017-08-23 15:15   auto-root-fireos-5.2.1.1/run_me2.sh
     5288  2017-08-13 19:09   auto-root-fireos-5.2.1.1/watchdogd_new.txt
   370380  2017-08-05 14:57   auto-root-fireos-5.2.1.1/vcdbg_new.txt
     5400  2017-07-31 22:30   auto-root-fireos-5.2.1.1/dirtycow
     1351  2017-08-14 20:25   auto-root-fireos-5.2.1.1/run_me.sh
824180736  2017-08-13 20:31   auto-root-fireos-5.2.1.1/system-5.2.1.1-root-recovery.img
     1838  2017-08-23 15:25   auto-root-fireos-5.2.1.1/run_me3.sh
---------                     -------
824566558                     8 files

https://www.androidfilehost.com/?fid=673368273298980527

At first you put the whole directory into /data/local/tmp:

Code:

> adb push auto-root-fireos-5.2.1.1 /data/local/tmp/auto-root-fireos-5.2.1.1

Then you go into this directory and make sure the permissions are right:

Code:

> adb shell
shell@montoya:/ $ cd /data/local/tmp/auto-root-fireos-5.2.1.1
shell@montoya:/data/local/tmp/auto-root-fireos-5.2.1.1 $ chmod 755 dirtycow run_me.sh run_me2.sh

You start "./run_me.sh":

for the first part, exchanging the binaries and becoming root. The more dangerous part is "./run_me2.sh" which exchanges the whole /system with my prepared version:

For security, check md5sums of files before reboot:

Again: I'll take no responsibility for any damage caused. I have prepared everything to the best of my knowledge. If you use it and succeed (or fail), please report back here.

Best

Tim

EDIT: Updated to newest version, if you have problems with copying data to /data/tmp (in run_me2.sh), it might be worthwhile to test over network (not via USB) and use adb from a linux system.

EDIT2: Upon request the hint from the later pages: Instead of playing a video to sync changes to flash (short before the first script finishes, it seems to be more effective to fill the memory with artificial content until completely full. This can be done with a memory filling App, see https://xdaforums.com/showpost.php?p=73766497&postcount=157 and https://xdaforums.com/showpost.php?p=73838299&postcount=163.

Spider1996 · Aug 13, 2017

tehlers said:
[...]
Then you go into this directory:

Code:

> adb shell shell@montoya:/ $ cd /data/local/tmp/auto-root-fireos-5.2.1.1

You start "./run_me.sh":
[...]

All files are in that folder (I listed them with ls -R). While running ./run_me.sh, the adb shell only returns a "./run_me.sh: can't execute: Permission denied"

Thanks for your work anyway.

tehlers · Aug 13, 2017

Hi,

Spider1996 said:
All files are in that folder (I listed them with ls -R). While running ./run_me.sh, the adb shell only returns a "./run_me.sh: can't execute: Permission denied"

Thanks for your work anyway.

ok, you unziped on a windows system, right? I'll update the description above for permissions.

Best Tim

Spider1996 · Aug 13, 2017

yeah, currently I use Windows. Got a Linux System here too if needed. Does it make any difference? I execute the script right in the shell.

tehlers · Aug 13, 2017

Hi,

Spider1996 said:
yeah, currently I use Windows. Got a Linux System here too if needed. Does it make any difference? I execute the script right in the shell.

on a linux system the permissions would have been correctly unzipped and transferred. The rest should be the same for windows or linux, just do "chmod 755 dirtycow run_me.sh run_me2.sh" in the directory on the stick.

Best Tim

Spider1996 · Aug 13, 2017

tehlers said:
Hi,

on a linux system the permissions would have been correctly unzipped and transferred. The rest should be the same for windows or linux, just do "chmod 755 dirtycow run_me.sh run_me2.sh" in the directory on the stick.

Best Tim

Now it keeps repeating the attached message

tehlers · Aug 13, 2017

Spider1996 said:
Now it keeps repeating the attached message

looks good, let it keep doing dirtycow.

EDIT: You are currently in the state, where I said: "Second thing is, that it only works for a few bytes, and not always. But since it checks what bytes still actually differ, you can go further with every next round."

Spider1996 · Aug 13, 2017

tehlers said:
looks good, let it keep doing dirtycow.

EDIT: You are currently in the state, where I said: "Second thing is, that it only works for a few bytes, and not always. But since it checks what bytes still actually differ, you can go further with every next round."

Okay, after that is done, I see I have to play a prime video or something like that. How to do that without Wifi connection? If I connect, the Stick wants to update I think. (Still waiting for Dirtycow to end the second process now.)

tehlers · Aug 13, 2017

Spider1996 said:
Okay, after that is done, I see I have to play a prime video or something like that. How to do that without Wifi connection? If I connect, the Stick wants to update I think. (Still waiting for Dirtycow to end the second process now.)

mhh, yeah I have disabled the update domains in my nameserver, so I could use the stick. I think what sumwong wrote

sumwong said:
"pm hide com.amazon.device.software.ota"

should disable updates (or maybe "pm uninstall -k --user 0 com.amazon.device.software.ota"). Maybe for this case someone else with experience on that could help?

Spider1996 · Aug 13, 2017

tehlers said:
mhh, yeah I have disabled the update domains in my nameserver, so I could use the stick. I think what sumwong wrote

should disable updates (or maybe "pm uninstall -k --user 0 com.amazon.device.software.ota"). Maybe for this case someone else with experience on that could help?

I read somewhere, thats only possible on rooted devices. Do I need to play something from Amazon Prime? Maybe it is possible to push a video to the device and a file explorer app?

Edit: Now it asks for that prime video. It is possible to block this: http://www.aftvnews.com/how-to-block-software-updates-on-the-amazon-fire-tv-or-fire-tv-stick/#router

tehlers · Aug 13, 2017

Spider1996 said:
I read somewhere, thats only possible on rooted devices. Do I need to play something from Amazon Prime? Maybe it is possible to push a video to the device and a file explorer app?

you just need to allocate memory, that the stick is writing the changes on flash. It may already work by pushing a large file in /sdcard or /data/local/tmp (and delete it afterwards). If you want to try if you poked around enough, you can try to reboot and check with "vcdbg -c id". If this command gives you "uid=0(root) gid=0(root) context=u:r:init:s0", then everything has worked, otherwise start over with "./run_me.sh".

If you want to keep the original contents of the binaries watchdogd and vcdbg, save them from /data/local/tmp/ before starting over, because my script will overwrite them with every call of "./run_me.sh" and they may have already changed a few bytes.

Best

Spider1996 · Aug 13, 2017

okay blocked everythying in Method 3. No Amazon Service, but YouTube works/was possible to download. So playing some Videos from there....

So it's late in germany now and vcdbg -c id gave me "Segmentation fault". Trying again tomorrow

[GUIDE] I Rooted my Fire TV via dirtycow

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Member

Member

Attachments

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts