[Q] Amazon Fire Tv

Search This thread

gregcavaretta

Member
Feb 21, 2014
13
3
as some of you may know by now amazon has released its Amazon fire Tv witch is like apple tv.... so what i want to know is this an android OS because its uses the app store and has games like Minecraft or Need For Speed... if theres aonther forum for plases let me know

because after i know its andorid then comes the race for ROOT access :)
 

shimp208

Inactive Recognized Contributor
Jan 25, 2011
2,624
3,072
Boston
as some of you may know by now amazon has released its Amazon fire Tv witch is like apple tv.... so what i want to know is this an android OS because its uses the app store and has games like Minecraft or Need For Speed... if theres aonther forum for plases let me know

because after i know its andorid then comes the race for ROOT access :)

The Amazon Fire TV like the Kindle Fire series of devices runs a heavily modified version of the Android operating system. As far root access goes, I'm sure in due time the development community will root the device and allow you to install Google apps that include the framework files necessary for the Play Store to work properly.
 

gregcavaretta

Member
Feb 21, 2014
13
3
The Amazon Fire TV like the Kindle Fire series of devices runs a heavily modified version of the Android operating system. As far root access goes, I'm sure in due time the development community will root the device and allow you to install Google apps that include the framework files necessary for the Play Store to work properly.

well i do know you can plug it into a computer with adb so getting root won't be that hard...if you brick i wonder if you can use something like fastboot
 

shimp208

Inactive Recognized Contributor
Jan 25, 2011
2,624
3,072
Boston
well i do know you can plug it into a computer with adb so getting root won't be that hard...if you brick i wonder if you can use something like fastboot

They may have taken a different attitude then with the kindle fire devices which came with locked bootloaders. Out of curiosity can you pull the build.prop and upload it. Additionally try running the command:

Code:
adb reboot bootloader

Then in fastboot:

Code:
fastboot devices

And seeing what it says as this will give insight into a possible root method.

Sent from my SCH-I535 using XDA Premium 4 mobile app
 

gregcavaretta

Member
Feb 21, 2014
13
3
They may have taken a different attitude then with the kindle fire devices which came with locked bootloaders. Out of curiosity can you pull the build.prop and upload it. Additionally try running the command:

Code:
adb reboot bootloader

Then in fastboot:

Code:
fastboot devices

And seeing what it says as this will give insight into a possible root method.

Sent from my SCH-I535 using XDA Premium 4 mobile app


I'll post when mine comes in two days i was at a my buddy's house when i tested it out.....as I recall to access /system/ on the kindle Fire HD , HDX
and any other android you don't need root permissions to access to build.prop how ever you would need root access to edit it (duh) that is if apps like es file explore Or Astro File manager work.

I don't about fastboot yet i'll try a few things.



For those who want to buy this they can at

http://www.amazon.com/Amazon-CL1130-Fire-TV/dp/B00CX5P8FC
 

Determined

Member
Sep 17, 2010
16
6
It is hackable!



If you take it apart, there are easily accessible UART and JTAG ports. If I have time, I'll dig further over the weekend. Somebody, please beat me to this. :)

"adb reboot bootloader" puts it into the bootloader. Power led blinks and HDMI display only shows amazon's logo, need to check serial port.
"adb reboot recovery" also works (displays Amazon "System Update")
 
Last edited:

shimp208

Inactive Recognized Contributor
Jan 25, 2011
2,624
3,072
Boston
If you take it apart, there are easily accessible UART and JTAG ports. If I have time, I'll dig further over the weekend. Somebody, please beat me to this. :)

"adb reboot bootloader" puts it into the bootloader. Power led blinks and HDMI display only shows amazon's logo, need to check serial port.
"adb reboot recovery" also works (displays Amazon "System Update")

Does fastboot devices in the bootloader show anything?

Sent from my SCH-I535 using XDA Premium 4 mobile app
 

Determined

Member
Sep 17, 2010
16
6
Does fastboot devices in the bootloader show anything?

The problem is that adb is accessible over IP only (or at least I have not yet found other way) and I cannot do fastboot.

build.prop attached. Also, here is a (mostly useless) boot log from the internal serial port (115200-8N1)
Code:
Android Bootloader - UART_DM Initialized!!!
[0] welcome to lk: current version is lk_rel_3.0.1_02272014
[10] platform_init()
[10] target_init(): platform_id 109
[10] Its BUELLER. revision 3
[70] display_init(),target_id=7337.
[70] hdmi_msm_panel_init: default format=4
[2730] splash_screen_mmc :235, 67
[2750] Config HDMI PANEL.
[2750] Turn on HDMI PANEL.
[2760] EDID: no DTD or non-DTD data present
[2760] EDID: no DTD or non-DTD data present
[2760] hdmi_edid_get_audio_data: No adb found
[2770] hdmi_audio_playback: 48KHz not supported by TV
[2770] hdmi_msm_audio_acr_setup: video format 0 not supported
[2780] aboot_init: calling idme_initialize 
[2780] Idme version is 2.0 and set related function to V2.0
[2790] IDME INFO: checking for new items to add (stored items:12  specified items:12)
[2790] serial num from idme: XXXXXXXXXXXXXXXXXX
[2800] Reboot -- restart_reason=427810811 (0x197fdffb) 
[2800] aboot_init: IDME - device boot up info
[2810] idme items number:12
[2810] name: board_id, size: 16, exportable: 1, permission: 292, data= XXXXXXXXXXXXXXXXXX
[2820] name: serial, size: 16, exportable: 1, permission: 292, data= XXXXXXXXXXXXXXXXXX
[2830] name: mac_addr, size: 16, exportable: 1, permission: 292, data= XXXXXXXXXXXXXXXXXX
[2830] name: bt_mac_addr, size: 16, exportable: 1, permission: 292, data= XXXXXXXXXXXXXXXXXX
[2840] name: productid, size: 32, exportable: 1, permission: 292, data= 00000000000000000000000000000000
[2850] name: productid2, size: 32, exportable: 1, permission: 292, data= 00000000000000000000000000000000
[2860] name: bootmode, size: 4, exportable: 1, permission: 292, data= 1
[2860] name: postmode, size: 4, exportable: 1, permission: 292, data= 2
[2870] name: bootcount, size: 8, exportable: 1, permission: 292, data= 32
[2880] name: eth_mac_addr, size: 16, exportable: 1, permission: 292, data= XXXXXXXXXXXXXXXXXX
[2890] bootcount = 33
[3080] aboot_init: Boot linux from MMC 
[3090] boot_into_recovery=0  idme_bootmode=1 (NORMAL) 
[3090] use_signed_kernel=1, is_unlocked=0, is_tampered=0.
[3100] Loading boot image (6344704): start
[3340] Loading boot image (6344704): done
[3340] Authenticating boot image (6344704): start
[3350] Attempting to enable ce3_src_clk before setting its rate.[3360] TZ channel swith returned 0
[5070] TZ channel swith returned 0
[5070] Authenticating boot image: done return value = 1
[5090] cmdline = 'androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 maxcpus=2'
[5100] Power on reason 1
[5100] Its bueller again 3.
[5100] cmdline_length=170, n=172, n1=45
[5110] IDME: idme atag init (export to kernel),  atag_size=514 
[5110] name: board_id, size: 16, exportable: 1, permission: 292, data: XXXXXXXXXXXXXXXXXX
[5120] name: serial, size: 16, exportable: 1, permission: 292, data: XXXXXXXXXXXXXXXXXX
[5130] name: mac_addr, size: 16, exportable: 1, permission: 292, data: XXXXXXXXXXXXXXXXXX
[5140] name: bt_mac_addr, size: 16, exportable: 1, permission: 292, data: XXXXXXXXXXXXXXXXXX
[5140] name: productid, size: 32, exportable: 1, permission: 292, data: 00000000000000000000000000000000
[5150] name: productid2, size: 32, exportable: 1, permission: 292, data: 00000000000000000000000000000000
[5160] name: bootmode, size: 4, exportable: 1, permission: 292, data: 1
[5170] name: postmode, size: 4, exportable: 1, permission: 292, data: 2
[5180] name: bootcount, size: 8, exportable: 1, permission: 292, data: 33
[5180] name: eth_mac_addr, size: 16, exportable: 1, permission: 292, data: XXXXXXXXXXXXXXXXXX
[5190] The atag idme items number:11

booting linux @ 0x80208000, ramdisk @ 0x82200000 (368957)
 

Attachments

  • atv_build.prop.txt
    6 KB · Views: 68
Last edited:

gregcavaretta

Member
Feb 21, 2014
13
3
If you look in the back there's a usb port I'm going to try using usb to usb from it to my computer...

I know this is for a thumb drive or keyboard but you never know
 

Attachments

  • Amazon-Fire-TV-back.jpg
    Amazon-Fire-TV-back.jpg
    196 KB · Views: 310

kubik369

Member
Jun 25, 2013
13
5
It doesn't necessarily have to be such a spectacular view :) I recall USB on one of the Android dongles being host and if small reset button was held while plugging it into a computer, it was possible to rewrite the flash of the device.
 

fletch33

Senior Member
Jan 9, 2010
1,355
398
thought i would throw in here that my Fire TV arrived yesterday and so i plugged it in, did mandatory immediate software update, watch mandatory 5 minute unskippable tutorial video, and then experienced constant reboots on everything i tried to do with it.

i thought well it just did an update and i dont have any real data on it so lets try a factory reset which i did. after that i had to watch the mandatory video again since i did a reset ughh!

so now it fires up and IF it allows me to move the menu option without a reboot then it will either wait until i hit play to reboot or if all of that actauly works and i get a video to start playing then within 15 minutes i will be presented with a loud constant beep followed by (you guessed it) a reboot.

i have called and they are replacing it but i am not sure that is going to help and i usually wait for the first round to go out before i buy something but i was about to buy another Roku when this was announced so i jumped.
 

gregcavaretta

Member
Feb 21, 2014
13
3
Yeah, try that, and if it does not work, also try plugging that port into your electrical outlet. Result will be more or less the same, but the latter is more spectacular.

P.S.: That USB port is a host.
mines coming Monday (2 days) dam amazon lied to me :( .....

anyway have you tried plugging an lan ethernet cable from it to the computer hey you never know. if not i'm going to try messing with the UART and JTAG ports but i don't have mine yet so i'll have to wait....
 

shimp208

Inactive Recognized Contributor
Jan 25, 2011
2,624
3,072
Boston
Nicely done as always Justin! Anyone know if this comes with a locked bootloader (I'm assuming it does)?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 6
    Fastboot Connection is a Go

    The problem is that adb is accessible over IP only (or at least I have not yet found other way) and I cannot do fastboot.mat 0 not supported
    [/CODE]

    I got fastboot working by creating a custom cable. I took two USB printer cables (type A on one end and type B on the opposite) and cut off the two type B ends, after which simply (I, however experimented with all possible wire combinations) splice the two type A ends together by connecting similar transmission lines (i.e. green-Data + to green, ground to ground) . Connect the Fire TV to your PC with this and rebootinto recovery or bootloader via Wireless ADB or power cycle the unit by unplugging it and plugging it in. If this cable is attactched to both the Fire TV andvyou PC during boot it will boot into bootloader automatically. The device driver installed by Windows 8 is "Android ADB (Google)" it gets listed when the devices operand is given in fastboot and it accepts the basic fastboot commands like reboot and continue. That is all I could test as I do not have anything to write to the flash.
    3
    If you look in the back there's a usb port I'm going to try using usb to usb from it to my computer...

    Yeah, try that, and if it does not work, also try plugging that port into your electrical outlet. Result will be more or less the same, but the latter is more spectacular.

    P.S.: That USB port is a host.
    3
    Nicely done. I don't suppose you've already figured out how to put your own kernel on the device? I'm not really sure how fastboot is working on this thing, without a usb otg port (although I wouldn't be entirely surprised if usb otg accounts for some of those extra pads on the 16 pad connector behind the apq8064). Usually I see 10 or 20 pin jtag connectors.

    just fwiw, to introduce myself, since I'm new here: I'm the guy working on freedreno.. don't normally do the forum thing (you can find me on freenode).. just created an account here to reply on this thread. I pretty much need to be able to put my own kernel on the thing. I guess we'll see when my fire tv comes later this week... my soldering iron is standing-by..)

    Details soon enough. Fastboot is locked down, no flashin, lk checks image siagntures etc
    3
    Hmmmm. I wonder if it isn't locked with some flavor of OpenSSL.

    If you are thinking heartbleed, that isn't an option.

    nope.. there is some good info about secure boot here:

    https://github.com/CryptoPunk/Phone_research/wiki/MSM8960

    (but ofc, as with openssl, the way in will be bugs.. just different bugs)

    Bootloader isn't a problem, I've posted video of booting unsigned code. Problem is finding a root exploit I'm comfortable releasing, and getting a properly working recovery