• We are moving to xdaforums.com!

    Posts made between now and when the migration is complete will not be carried over.
    You will be automatically redirected once the migration is complete.

[Temp ROOT] - [BOOTLESS MAGISK] - [UNLOCK/MAGISK/TWRP] FireTV 2nd gen Cube (raven) ≤ PS7624

Search This thread
By:
Advanced…
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
boxster03 said:
I'm not interested in using Alexa and wondering how to know if it is completely disabled and not constantly listening?

Also after unlock, is there a list/guide somewhere on how/what unnecessary background processes to disable and make the device more efficient?
Click to expand...
Click to collapse
I think amazon.speech.davs.davcservice is the app that listens for Alexa requests (through Cube and remote). It is an extension of the actual Alexa app (com.amazon.vizzini).

Because app functions and dependencies change over time, it's hard to make a concrete list. Disabling one app could cause another app to go haywire leading to high CPU usage and a slow down.

FireOS apps are mostly identical between FireTV models, so using one of the Stick lists as a template is ok. I would only disable a few apps at a time, reboot the Cube to make sure it still boots, and check the background processes to verify there are no obvious problems. If the Cube doesn't boot, use USB ADB to re-enable the apps.

Make use of top in adb, this program will show you all the running processes on the Cube, including RAM and CPU utilization. The Cube has 6 cores, so there is a total of 600%. Raven idles at ~520-540%, with ~60% dedicated to Alexa listening.

I use the CPU temp as a crude way to quickly check for problems. cat /sys/class/thermal/thermal_zone0/temp
Idle temp (520-540% CPU) is ~35000 (35C), playing 4k HDR video (400-450% CPU) is ~40000-48000 (40-48C). So something is obviously wrong if the temp is +55-60C, but top is a lot more informative.
 
Last edited:
  • Like
Reactions: boxster03
C

cityhunter_1919_xyz

Member
Dec 29, 2022
37
18
Recently, I got a brand new cube (2nd), but luckily it was a PS7206, so I was able to install Bootloader unlock and TWRP. With PS7206, the remote control with an app button was not possible, so I updated to PS7624 from TWRP and was able to pair successfully.

I used "blank_app_button.zip" from the magisk module, but since "key249-key253" in Vendor_0171_Product_0421.kl was blank, I couldn't use it as is. (I was able to use it safely by replacing it with a file in which an arbitrary key was entered in the blank part.)
Thanks to that, I can enjoy cube.
 
  • Like
Reactions: Pro-me3us
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
cityhunter_1919_xyz said:
luckily it was a PS7206, so I was able to install Bootloader unlock and TWRP. With PS7206, the remote control with an app button was not possible, so I updated to PS7624 from TWRP and was able to pair successfully.
Click to expand...
Click to collapse
Thanks to @roligov for providing the data needed to get shrinker working on PS7206. I wasn't sure anyone would actually need it

Let me know if anyone comes across even older 2nd gen Cubes with PS7204 or PS7202 and those can be made to work too 😁
 
Last edited:
  • Like
Reactions: rocker0 and cityhunter_1919_xyz
J

Joejohnson1

New member
May 31, 2023
2
0
Is anybody having a problem with the appstore crashing everytime you go to search after doing this?

Any ideas on how to fix it?
 
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
Joejohnson1 said:
Is anybody having a problem with the appstore crashing everytime you go to search after doing this?

Any ideas on how to fix it?
Click to expand...
Click to collapse
You are using a custom launcher?

Search in the App Store depends on the Amazon Launcher, and doesn't work when Amazon Launcher is disabled.

There are a few solutions to this

1) Re-enable the Amazon Launcher (easily done with Launcher Manager) any time you need to search the App Store, or use any Amazon Launcher dependent services.

2) Use bootless Magisk to specifically disable the home screen function of the Amazon Launcher, keeping the rest of the package active/working. Magisk is only temporarily needed for this, it can then be disabled/removed.

3) Use full Magisk (requires bootloader unlock method), to set your custom launcher as the default, and keep Amazon Launcher fully active, letting you visit it with an icon on your homescreen like it's just another app.
 
Last edited:
J

Joejohnson1

New member
May 31, 2023
2
0
Pro-me3us said:
You are using a custom launcher?

Search in the App Store depends on the Amazon Launcher, and doesn't work when Amazon Launcher is disabled.

There are a few solutions to this

1) Re-enable the Amazon Launcher (easily done with Launcher Manager) any time you need to search the App Store, or use any Amazon Launcher dependent services.

2) Use bootless Magisk to specifically disable the home screen function of the Amazon Launcher, keeping the rest of the package active/working. Magisk is only temporarily needed for this, it can then be disabled/removed.

3) Use full Magisk (requires bootloader unlock method), to set your custom launcher as the default, and keep Amazon Launcher fully active, letting you visit it with an icon on your homescreen like it's just another app.
Click to expand...
Click to collapse
Thanks that worked!

I have one more question.

I set my firecube to put up a black screensaver after like 30 seconds of inactivity to expand the life of my oled tv, but everytime it pops up there’s a little text box at the bottom right saying “press x for screensaver settings” that stays up for a while. Any way to disable this?
 
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
Joejohnson1 said:
I set my firecube to put up a black screensaver after like 30 seconds of inactivity to expand the life of my oled tv, but everytime it pops up there’s a little text box at the bottom right saying “press x for screensaver settings” that stays up for a while. Any way to disable this?
Click to expand...
Click to collapse
If you only want a black screen, you can turn off the screensaver, and set the sleep timeout:

raven:/ $ settings put secure screensaver_enabled 0
raven:/ $ settings put secure sleep_timeout 30000

This can also be done through Launcher Manager / Other settings / Screensaver
Set screensaver off, and sleep timeout to 1 for 1min. The adb command will let you set the timeout to less than 1min (30000 = 30,000 milliseconds).
 
Last edited:
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
Minor update to raven_shrinker, added support for PS7201/942, in case anyone finds a 2nd gen Cube from the first lot in a warehouse. Thanks to @rocker0 for the firmware.

raven_shrinker should cover just about any firmware between PS7201 and PS7624. For PS7633 and PS7645, check out raven_buf
 
Last edited:
  • Like
Reactions: rocker0 and Osaka_23
F

fiy雨夜10086

New member
Oct 25, 2015
2
1
There is an easy mistake to make. It's the same as #124.
I use way2 bootless magisk to root.
Firstly, I initially followed all the instructions. And I want to use su command in adb to check whether I root successfully.
It says I don't have su command. So I mistakenly thought that root failed.
Then I checked the Launcher Manager, I find that it's blank, it doesn't have my command. This further deepens my judgment of root failure.
So I add the start.sh command again, and reboot it. Now it's stuck on android recovery, and I can't choose botton to reset.

I didn't know that the su command was originally invalid until I read other's post, and also don't know Launcher Manager Command disappearance is normal, so I add twice. So it's broken. I think you should add it to you post.
Anyone know how to save the cube, I will be grateful.
 
  • Sad
Reactions: roligov
roligov

roligov

Senior Member
Dec 29, 2012
308
110
London
Unfortunately you can't fix it, best case you can get a refurbished replacement from Amazon if it's still in warranty.
 
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
@fiy雨夜10086 Once you are in that recovery menu, there isn't any known way to exit out of it. Amazon implemented that menu for all FireOS7 devices (Sticks too) a few firmware ago, but didn't implement any navigation options. There have been a number of unsuccessful (1, 2) attempts to use the physical Cube buttons, remote, and keyboard. I'm not entirely sure what error or event triggers a device to boot into it.

I'd like to better understand what might have led to this on your device.
fiy雨夜10086 said:
I checked the Launcher Manager, I find that it's blank, it doesn't have my command.
Click to expand...
Click to collapse
I've not seen this happen before. Is it possible you didn't press the save button when you first entered the ADB command? The known issue with Launcher Manager is that Amazon has been remotely disabling the app, which makes the entire app disappear, not the ADB commands. If that happens, the bootless Magisk script isn't started, which isn't a problem in itself.

After you re-added the ADB command to Launcher Manager to automatically start bootless Magisk on boot, did you reboot right away, and the Cube went to the recovery menu? Or did the Cube boot successfully at least once, and then boot to recovery on a later reboot? The bootless Magisk script isn't run until FireOS boots to the homescreen successfully. If the device doesn't boot to FireOS, it never has a chance to attempt to initiate the start.sh / bootless Magisk.

Did you ever run the start.sh script manually from the ADB command line? What version of FireOS is your Cube on?

One way to check if bootless Magisk has started is to check if /sbin/magisk is present. This is created only after it starts. The other way is to check Magisk Manager, and see if Magisk is still listed as not installed.
 
F

fiy雨夜10086

New member
Oct 25, 2015
2
1
My fireOS: PS7614/3227
Concrete behavior:
For the first time I add start.sh command, then I reboot cube, it startup and shows incomplete desktop and don't have internet., After 30s, the desktop display normal. Maybe it's because of sleeping 30s. Then I go to Launcher Manager, the command was disappeared. I haven't checked /sbin/magisk or open magisk app. I'm ensure press the save button.
Then I add start.sh command for the second time, I reboot cube. Then it also startup, and shows incomplete desktop, but after some seconds, the cube reboot itself, then it enters recovery mode.
And I never run the start.sh script via adb command line, I also know I can't run it twice. The only diffrent command is I use the "adb install magisk_manager.apk" to install magisk, because I can't use "adb shell pm install -r /data/local/tmp/magisk_manager.apk" command.
 
  • Like
Reactions: Pro-me3us
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
Thank you for the details. I'm not sure what the cause of the incomplete desktop and no internet might have been. Bootless Magisk is different than regular Magisk, it has no processes that boot with FireOS. The 30sec pause, is to give FireOS time to startup before running shrinker and starting Magisk. The reboot may have been due to shrinker, since it has a ~15% chance of crashing the 2nd gen Cube upon running. But if shrinker crashes the Cube, root is never achieved and the start script for Magisk isn't run. Running 'install' rather than 'install -r' for Magisk Manager isn't a problem.

The only thing I can think of is that magiskinit v21.2 may not play well with PS7614/3227 since this was the same firmware @roligov was on too. I will add a note to the bootless Magisk instructions, that PS7614 may be incompatible.
 
S

SpranklesXDA

Member
Jul 10, 2023
6
1
Hello can this be run on windows 10 Pc using CMD or ADBLINK .

CAN temporary root be run from the cube/ firetv app to copy and paste commands or does all methods require Linux. Thanks for everything been reading for a few months. Just have to put Linux on a PC if windows won't due
 
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
SpranklesXDA said:
CAN temporary root be run from the cube/ firetv app to copy and paste commands or does all methods require Linux.
Click to expand...
Click to collapse
No Linux isn't needed. raven_shrinker is run directly on the Cube to gain root access. You only need a program or app to run the commands on your Cube. You can use ADBLink for windows to copy and past the commands.

You can use the android app Remote ADB Shell on an Android phone, tablet, or install the app directly on the Cube. It would be a bit more work entering commands with a remote and on screen keyboard.

btw what firmware version is your Cube on?
 
Last edited:
S

SpranklesXDA

Member
Jul 10, 2023
6
1
Pro-me3us said:
No Linux isn't needed. raven_shrinker is run directly on the Cube to gain root access. You only need a program or app to run the commands on your Cube. You can use ADBLink for windows to copy and past the commands.

You can use the android app Remote ADB Shell on an Android phone, tablet, or install the app directly on the Cube. It would be a bit more work entering commands with a remote and on screen keyboard.

btw what firmware version is your Cube on?
Click to expand...
Click to collapse
Hello thanks but I can't get adb not found. Have the raven shrinker file on my cube but can't get it started. Been about 7 years since I've really messed with anything so I know it's something easy I'm missing. ( I can push APK with adblink all day long to my cube but can't get raven shrinker started on windows / or Chromebook.
Cube was on 7.2.9.2 out of the box and I blocked update with Adguard and cleared pm updates but I logged out my Amazon account into another and while messing with this forgot apps weren't still there so took an update to 7.6.1.4 and i blocked updates with Adguard trick and luckily cleared and OTA that was ready to install
7.6.4.6 wew at least I can still use custom launcher once I figure out what I'm doing wrong with raven shrinker

Oh yeah 4 more cube's do to soon lol
 
Pro-me3us

Pro-me3us

Senior Member
May 12, 2022
309
335
Use ADBLinks's 'Console' button, rather than 'ADB Shell' button.

adblink.png


ADBLink Console button (remember to put raven_shrinker in your ADBLink folder on your Windows machine)

$ adb push raven_shrinker /data/local/tmp/
$ adb shell

raven:/ $ chmod +x /data/local/tmp/raven_shrinker
raven:/ $ /data/local/tmp/raven_shrinker

raven:/ # echo '<?xml version="1.0" encoding="utf-8" standalone="yes" ?><map><set name="DenyListKeyPackages"></set></map>' > /data/system/PackageManagerDenyList
raven:/ # exit
raven:/ $ pm clear com.fireos.arcus.proxy

At this point a reboot is required for the package protection changes to take effect, but the Cube will immediately contact an Amazon server on bootup and rebuild the package protections list. So before rebooting disable your internet, by disconnecting the internet cable going into your router. This will allow you to still connect to your wireless devices in your house, but they won't be able to contact the outside world internet. Now reboot

$ adb shell

raven:/ $ pm disable-user com.fireos.arcus.proxy
raven:/ $ pm clear com.fireos.arcus.proxy

raven:/ $ pm disable-user com.amazon.adep
raven:/ $ pm clear com.amazon.adep

raven:/ $ pm disable-user com.amazon.device.software.ota
raven:/ $ pm clear com.amazon.device.software.ota
raven:/ $ pm disable-user com.amazon.device.software.ota.override
raven:/ $ pm disable-user com.amazon.tv.forcedotaupdater.v2


Done, this will disable package protections (can disable/enable any app without root), disable Amazon's AppBlockList (Let's Amazon disable apps they dont' like on your Cube, eg Launcher Manager), and disable OTA firmware updates. Go ahead reconnect your internet, and reboot your Cube one last time and verify the apps you disabled are disabled with:

raven:/ $ pm list packages -d

NOTE: raven:/ $ --> raven:/ #, the '$' to '#' switch indicates that you have switched to root user. raven_shrinker doesn't work 100% of the time, for best results, run it 1-2min after a fresh reboot. If it reboots, or fails to gain root, reboot and try again a second time.

In the future if you want root acces again, you only need to run
raven:/ $ /data/local/tmp/raven_shrinker

That's too bad you lost PS7292 on that device, it was the last firmware version that could be bootloader unlocked.
 
Last edited:
S

SpranklesXDA

Member
Jul 10, 2023
6
1
Pro-me3us said:
Use ADBLinks's 'Console' button, rather than 'ADB Shell' button.

View attachment 5952101

ADBLink Console button (remember to put raven_shrinker in your ADBLink folder on your Windows machine)

$ adb push raven_shrinker /data/local/tmp/
$ adb shell

raven:/ $ chmod +x /data/local/tmp/raven_shrinker
raven:/ $ /data/local/tmp/raven_shrinker

raven:/ # echo '<?xml version="1.0" encoding="utf-8" standalone="yes" ?><map><set name="DenyListKeyPackages"></set></map>' > /data/system/PackageManagerDenyList
raven:/ # exit
raven:/ $ pm clear com.fireos.arcus.proxy

At this point a reboot is required for the package protection changes to take effect, but the Cube will immediately contact an Amazon server on bootup and rebuild the package protections list. So before rebooting disable your internet, by disconnecting the internet cable going into your router. This will allow you to still connect to your wireless devices in your house, but they won't be able to contact the outside world internet. Now reboot

$ adb shell

raven:/ $ pm disable-user com.fireos.arcus.proxy
raven:/ $ pm clear com.fireos.arcus.proxy

raven:/ $ pm disable-user com.amazon.adep
raven:/ $ pm clear com.amazon.adep

raven:/ $ pm disable-user com.amazon.device.software.ota
raven:/ $ pm clear com.amazon.device.software.ota
raven:/ $ pm disable-user com.amazon.device.software.ota.override
raven:/ $ pm disable-user com.amazon.tv.forcedotaupdater.v2


Done, this will disable package protections (can disable/enable any app without root), disable Amazon's AppBlockList (Let's Amazon disable apps they dont' like on your Cube, eg Launcher Manager), and disable OTA firmware updates. Go ahead reconnect your internet, and reboot your Cube one last time and verify the apps you disabled are disabled with:

raven:/ $ pm list packages -d

NOTE: raven:/ $ --> raven:/ #, the '$' to '#' switch indicates that you have switched to root user. raven_shrinker doesn't work 100% of the time, for best results, run it 1-2min after a fresh reboot. If it reboots, or fails to gain root, reboot and try again a second time.

In the future if you want root acces again, you only need to run
raven:/ $ /data/local/tmp/raven_shrinker

That's too bad you lost PS7292 on that device, it was the last firmware version that could be bootloader unlocked.
Click to expand...
Click to collapse
Awsome that worked
and this was the end so all good right ?
raven:/ $ pm list packages -d
package:com.android.nfc
package:com.amazon.tahoe
package:com.fireos.arcus.proxy
package:com.amazon.firehomestarter
package:com.amazon.tv.forcedotaupdater.v2
package:com.amazon.device.software.ota
package:com.amazon.tv.launcher
package:com.amazon.device.software.ota.override
raven:/ $

I can disable any TDUK blockers etc no problem now correct.

only step i got an error was this but maybe its normal fyi
raven:/ $ pm disable-user com.amazon.adep

Exception occurred while executing:
java.lang.IllegalArgumentException: Unknown package: com.amazon.adep
at com.android.server.pm.PackageManagerService.setEnabledSetting(PackageManagerService.java:21014)
at com.android.server.pm.PackageManagerService.setApplicationEnabledSetting(PackageManagerService.java:20957)
at com.android.server.pm.PackageManagerShellCommand.runSetEnabledSetting(PackageManagerShellCommand.java:1610)
at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:201)
at android.os.ShellCommand.exec(ShellCommand.java:103)
at com.android.server.pm.PackageManagerService.onShellCommand(PackageManagerService.java:21600)
at android.os.Binder.shellCommand(Binder.java:634)
at android.os.Binder.onTransact(Binder.java:532)
at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:2796)
at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:3954)
at android.os.Binder.execTransact(Binder.java:731)
255|raven:/ $ pm clear com.amazon.adep
Failed
1|raven:/ $ pm disable-user com.amazon.adep
 
  • Like
Reactions: Pro-me3us
You must log in or register to reply here.

Similar threads

K
[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 2nd gen (tank)
Replies
2K
Views
367K
H
hasobist
K
[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)
Replies
2K
Views
479K
Y
ycodryn
Pro-me3us
[UNLOCK][ROOT][TWRP][UNBRICK][...] FireTV 2nd gen Cube (raven) ≤ PS7242
Replies
135
Views
78K
Pro-me3us
Pro-me3us
K
[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 3 and Fire TV Stick Lite (sheldon/p)
Replies
764
Views
152K
Mridul_Negi
Mridul_Negi
tsynik
[Magisk][Module] FireTV 4K Stick Add-Ons
Replies
283
Views
100K
S
subhash_india

Top Liked Posts

24 Hours 30 Days All time
  • There are no posts matching your filters.
  • 1
    Pro-me3us
    Pro-me3us
    cityhunter_1919_xyz said:
    It's a 2nd gen cube and for about a minute after starting the silk browser, the buttons become unresponsive as if frozen.
    If I leave it alone for a while it works fine, but is there any solution?
    Also, I can't get tasker to trigger logcat to trigger a task, is this a specification?
    Click to expand...
    Click to collapse
    I haven't witnessed either of these issues myself.

    To help diagnose Silk, open logcat (raven:/ $ logcat) then open Silk and look for any repeating errors or messages.

    I'd also check top (raven:/ $ top) to see if the CPU's are being bogged down by any specific processes. I use top whenever making system changes, like disabling a bunch of apps, to make sure that there aren't any obvious problems. I've seen some issues where one app will repeatedly try to communicate with a disabled app in a loop, causing the Cube to slow down. Or when manually installing a new version of something like Alexa on an older FireOS firmware, Alexa will slow down the system trying to communicate with services that don't exist on the older firmware.

    For Tasker, do you mean you have identified an event in logcat through Tasker, that you are trying to use as a trigger, but when the event occurs Tasker doesn't react? What's the trigger?
    View
    1
    C
    cityhunter_1919_xyz
    Pro-me3us said:
    I haven't witnessed either of these issues myself.

    To help diagnose Silk, open logcat (raven:/ $ logcat) then open Silk and look for any repeating errors or messages.

    I'd also check top (raven:/ $ top) to see if the CPU's are being bogged down by any specific processes. I use top whenever making system changes, like disabling a bunch of apps, to make sure that there aren't any obvious problems. I've seen some issues where one app will repeatedly try to communicate with a disabled app in a loop, causing the Cube to slow down. Or when manually installing a new version of something like Alexa on an older FireOS firmware, Alexa will slow down the system trying to communicate with services that don't exist on the older firmware.

    For Tasker, do you mean you have identified an event in logcat through Tasker, that you are trying to use as a trigger, but when the event occurs Tasker doesn't react? What's the trigger?
    Click to expand...
    Click to collapse
    Sorry for the late reply.
    Even when I looked at the logcat, I couldn't really understand it due to my lack of skill.
    There were times when the speed on Wi-Fi 5GHz was slow due to poor compatibility with the router, so I tried to open a speed test site when I started Silk browser to check, but that seems to be the cause.
    When I changed to another site at startup, the freeze did not occur.

    When I press the home button on xposed edge, it is set to always force close the foreground and background apps, and all apps are refreshed every time.

    Regarding tasker, it can be used in other Fire TV series, but only in Cube (2nd gen), tasks triggered by logcat are not executed.
    View
  • 14
    Pro-me3us
    Pro-me3us
    Overview

    This rooting method is based on a vulnerability in the ARM Mali GPU driver (CVE-2022-38181) discovered by security researcher Man Yue Mo at GitHub Security Lab, to gain root access to the 2nd gen Cube that is on firmware PS7624/3337 or older. Newer method for PS7633 through PS7646 here.

    The exploit program (raven_shrinker) is run directly on the Cube to spawn a temporary root shell for quick access. It can also be run automatically on every boot in combination with @diplomatic's bootless Magisk script to grant apps root access. Cubes that are on firmware PS7292/2984 or older, are able to use @Functioner's bootloader exploit used in the previous Raven Root bootloader unlock to install TWRP & full Magisk without a DFU device.

    For best results, run raven_shrinker 30-90sec after boot up, when loading is complete and the device is idle.


    Three options for root depending on your needs & comfort level

    1) Temporary ADB root - Open an adb root shell to for quick access (PS7624/3337 or older)
    Pros:
    • Access all files and folders from ADB
    • Simple to use, runs in RAM and doesn't make any changes to the Cube, no chance of bricking.
    • Remove app package protection so that you can enable/disable any app even without root (eg custom launchers, disabling updates, debloat, etc).
    Cons:
    • Only enables ADB root
    • raven_shrinker occassionally crashes/reboots the Cube when being run. Run it 30-90sec after bootup for greater reliability.
    NOTE: raven_shrinker won't brick your device, but what you do with that root access can. DM-verity is still in place checking the integrity of the system/vendor partitions, do NOT modify anything in those directories, or the boot partition!!


    2) Bootless Magisk - Automatically start a lite version of Magisk that runs entirely from the data partition, (PS7624/3337 or older).
    Pros:
    • Both ADB root and ability to grant root to apps through Magisk Manager
    • Once the Magisk dameon has started, root can be granted stably whenever needed
    • Doesn't modify boot or system/vendor partitions, DM-verity is preserved
    Cons:
    • This is experimental, use at your own risk! It's been working stably during my testing but it's impossible to foresee every issue.
    • Still relies on raven_shrinker to start, and may occasionally crash when raven_shrinker runs at boot
    • Most Magisk modules don't work.
    NOTE: Be careful of what apps you give root access to. Giving root access to an app that modifies the boot, system or vendor partitions will brick your device. Again, DM-verity is still actively checking that no changes have been made to system/vendor directories.


    3) Bootloader Unlock - Install Magisk & TWRP, and enable many more features (PS7292/2984 or older)
    Pros:
    • Use the latest version of Magisk, with Zygisk & module support
    • Use TWRP for backups & upgrades
    • Unrestricted use of Fastboot and the U-Boot command line (Amlogic Update)
    • Only requires raven_shrinker for the initial installation, more stable and tested than bootless Magisk
    • Remap Cube buttons to allow booting to fastboot, TWRP, Amlogic update.
    • Possible to update firmware to PS7624/3337 through TWRP and keep device unlocked
    Cons:
    • There is no recovery option in case of a brick.
    • Requires older firmware to work
    NOTE: It's very important to NEVER allow the Amazon OTA app to update the firmware. NEVER run the factory reset option in FireOS settings. If either of these occur, the Cube will be bricked.

    Contributors:
    Man Yue Mo, @Functioner, @Pro-me3us

    Thanks to @Michajin & @mavsman13 for testing & feedback
    Thanks to @diplomatic for bootless Magisk script, and @SweenWolf for Launcher Manager
    Thanks to @Renate for many great tools
    Thanks to all the folks who have worked on TWRP & Magisk
    View
    5
    Pro-me3us
    Pro-me3us
    Bootloader unlock, install TWRP & Magisk (PS7292/2984 or older)

    This rooting method will put your Cube on the same exploit and software versions used in the original Raven Root, without a DFU recovery option. Please post any questions or problems regarding this post & it's process, on the Raven Root thread.

    Disclaimer: Use this at your own risk, I'm not responsible for any data loss or corruption to your device. There is a nonzero chance of bricking the Cube, and little to no recovery options.

    NEVER FACTORY RESET YOUR CUBE!!!
    NEVER ALLOW AN AMAZON OTA UPDATE!!!
    Both of these will brick your Cube!

    To avoid any potential conflicts, if you were previously using a different version of Magisk, such as bootless Magisk (v21.4), first delete /data/adb/magisk.db before proceeding.

    Instructions
    1. Enable ADB debugging in FireOS settings
    2. Download the raven_root_shrinker, unzip, and copy the 7 files to /data/local/tmp on the Cube
      Code: 
      adb push raven_root_shrinker/* /data/local/tmp/
    3. Give raven_shrinker & install script executable permissions
      Code: 
      adb shell
chmod +x /data/local/tmp/raven_shrinker
chmod +x /data/local/tmp/install_root.sh
    4. Open a root shell and run the install_root.sh script
      Code: 
      adb shell
/data/local/tmp/raven_shrinker
/data/local/tmp/install_root.sh
    5. Finish by typing 'exit' to switch root back to regular shell, install Magisk Manager, and reboot to TWRP
      Code: 
      exit
pm install -r /data/local/tmp/magisk.apk
reboot recovery
    The Cube will reboot to TWRP, automatically flash Magisk and Amazon OTA blocker module, then reboot back to FireOS.

    NOTE: It's very important to NEVER allow the Amazon OTA app to update the firmware. NEVER run the factory reset option in FireOS settings. If either of these occur, the Cube will be bricked.

    Read here for TWRP firmware flashing instructions


    Changelog:

    v2.2.1 April 23th, 2023​
    • Added additional Magisk script to help prevent user from accidentally initiating FireOS factory reset.
      If you already installed v2.2, you can copy and paste the following as one ADB command to add this script to your Cube:
      Code: 
      echo '#!/sbin/sh
# Rename misc partition
mv /dev/block/misc /dev/block/misc_real
# Create symbolic links
ln -s /dev/null /dev/block/misc' > /data/adb/post-fs-data.d/misc_hide.sh && chmod +x /data/adb/post-fs-data.d/misc_hide.sh
    v2.2.2 May 4th, 2023​
    • Added support for PS7206/1098
    v2.2.3 June 23rd, 2023​
    • Added support for PS7201/942
    View
    3
    Pro-me3us
    Pro-me3us
    boxster03 said:
    Sounds like a warning to be aware of if it had inadvertently booted to FireOS in Safemode. Is there a valid reason to go to FireOS in Safemode?

    Also, if I want obtain root, I run the raven_shrinker as before?
    Click to expand...
    Click to collapse
    With the bootloader unlock method, you automatically have ADB root whenever you use ADB. You don't need raven_shrinker anymore

    The only weakness of the bootloader unlock method is that you can never perform a factory reset from FireOS (not even with the remote button combination), or allow the Amazon OTA update app to update the Cube. If either occur, the Cube will be bricked. Use TWRP to wipe data/dalvik, which is the same as a factory reset, but won't brick the Cube.

    The install_root.sh script installs a magisk module to block OTA updates. Booting to safe mode disables that module until you reboot and re-enable it in Magisk Manager manually. Until you do that the Cube is exposed to an Amazon update, and getting bricked.

    The OTA block module was just an easy way to ensure updates were blocked right away for the user. If you prefer, you can disable the Magisk OTA block module in Magisk Manager, reboot for the change to take effect, and just run adb shell pm disable com.amazon.device.software.ota. This will do the same thing and remain disabled even in safe mode.

    Regarding Safe mode itself, it just disables all user installed apps and Magisk modules in case the device can't boot because one of those apps or modules is causing a problem. You shouldn't ever need to use it, but it's a standard Android feature that's there.

    I'm going to release a minor update to the install_root.sh script to be more proactive in preventing people from accidentally performing a FireOS factory reset. This code will create a Magisk script that wil add an extra layer of protection from accidentally running a factory reset or allowing an Amazon OTA udpate.

    Code: 
    echo '#!/sbin/sh
# Rename misc partition
mv /dev/block/misc /dev/block/misc_real
# Create symbolic links
ln -s /dev/null /dev/block/misc' > /data/adb/post-fs-data.d/misc_hide.sh && chmod +x /data/adb/post-fs-data.d/misc_hide.sh
    Copy/Paste that into ADB as one command, and it will take effect on the next reboot.
    View
    2
    Pro-me3us
    Pro-me3us
    Temporary ADB root (PS7624/3337 or older)

    raven_shrinker_root.gif


    Disclaimer: Use this at your own risk, I'm not responsible for any data loss or corruption to your device. There is a nonzero chance of bricking the Cube, and little to no recovery options.

    Instructions
    1. Enable ADB debugging in FireOS settings
    2. Download, unzip and copy raven_shrinker to your Cube
      Code: 
      adb push raven_shrinker /data/local/tmp/
    3. Give raven_shrinker execution permission (only needs to be done once)
      Code: 
      adb shell
chmod +x /data/local/tmp/raven_shrinker
    4. Run the program
      For best results, run raven_shrinker 30-90sec after boot up, when loading is complete and the device is idle.
      Code: 
      adb shell
/data/local/tmp/raven_shrinker
    NOTE: Some functions do not work with this root shell. Services can't be accessed, so package manager 'pm' commands can't be run as root. However, package protections can still be removed so that you can enable/disable any app without root. Use bootless Magisk option if you need to access services as root.


    How to disable package protection
    1. Use raven_shrinker to open a root shell and delete all the apps listed in the file /data/system/PackageManagerDenyList
      Code: 
      echo '<?xml version="1.0" encoding="utf-8" standalone="yes" ?><map><set name="DenyListKeyPackages"></set></map>' > /data/system/PackageManagerDenyList
    2. Exit out of the root shell, and clear Arcus Proxy
      Code: 
      exit
pm clear com.fireos.arcus.proxy
    3. A reboot is required before the changes take effect, but FireOS will attempt to connect to Amazon servers on bootup and rebuild PackageManagerDenyList. Temporarily disable your internet, so that the Cube can't connect to the internet, then reboot.

    4. Package protections are now removed, and Arcus Proxy needs to be disabled to prevent it from being re-activated
      Code: 
      pm clear com.fireos.arcus.proxy
pm disable-user com.fireos.arcus.proxy
    Re-enable your Internet. You should now be able to enable/disable any app. Verify that any apps you disable are actually disabled. Then reboot, and verify again!
    Code: 
    pm list packages -d

    It's strongly recommended that you disable updates immediately
    Code: 
    pm disable-user com.amazon.device.software.ota
pm clear com.amazon.device.software.ota
pm disable-user com.amazon.device.software.ota.override
pm disable-user com.amazon.tv.forcedotaupdater.v2

    Changelog:
    v1.1 April 23th, 2023​
    • Fix for PS7608/3614
    v1.2 May 4th, 2023​
    • added support for PS7206/1098
    v1.3 June 23rd, 2023​
    • added support for PS7201/942
    View
    2
    Pro-me3us
    Pro-me3us
    teschke said:
    View attachment 5891569
    Something went wrong again
    Click to expand...
    Click to collapse
    The raven_shrinker program didn't grant you root. Raven_shrinker doesn't work 100% of the time since it's a memory management related exploit.

    Reboot the Cube, wait 1minute after the homescreen loads, and try running raven_shrinker again, followed by install_root.sh
    View

New posts