[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 2nd gen (tank)

Search This thread

Sus_i

Senior Member
  • Apr 9, 2013
    1,048
    393
    Currently, I am running Ubuntu 20.04 as an app from the MS store
    Here is what I currently get when typing lsusb - unable to initialize libusb: -99

    If you have an usb storage stick, you can download ubuntu as a live version and flash it to the storage stick with 'rufus'. Then you should be able to boot from the usb storage via boot menu.
     

    megamb11

    Senior Member
    Oct 11, 2017
    56
    2
    If you have an usb storage stick, you can download ubuntu as a live version and flash it to the storage stick with 'rufus'. Then you should be able to boot from the usb storage via boot menu.
    Trying this now... and getting of topic of the OP... I created the boot disk and successfully booted into the the Ubuntu OS. However, when I powered down and tried to boot into it again, my comp just hung up (tried this on my PC and laptop both with the same results). Again, Linux noob...

    Any solution on getting successful boot to Ubuntu OS each time? BIOS is setup correctly for this, BTW (boot order is USB and then SSD).
     

    megamb11

    Senior Member
    Oct 11, 2017
    56
    2
    Have you tried ? I'm in the same case, I wanted to know if it can work with FireOS 5.2.7.8 too
    First, depends on how old the device is. As per the OP, Fire Sticks built after Dec '19 will not be able to be rooted. However, there is no way of telling when the device was built. I know mine is older because I picked it up a few years ago.
     

    nsanity99

    Member
    Apr 1, 2021
    7
    0
    I managed to unlock the stick and downgrade from 5.2.7.8 to 5.2.7.1, but when I try”adb shell” “su” I don’t have root privileges

    am I not rooted?
     

    megamb11

    Senior Member
    Oct 11, 2017
    56
    2
    I managed to unlock the stick and downgrade from 5.2.7.8 to 5.2.7.1, but when I try”adb shell” “su” I don’t have root privileges

    am I not rooted?
    The OP only has you unlock the device so that you can install custom firmware and root with Magisk. Check the details, but I am sure that once you access TWRP, the first thing that needs to be flashed will be Magisk. This will give you root that you are looking for. From there, you can install custom firmware (e.g. - debloated stock ROM's).
     

    nsanity99

    Member
    Apr 1, 2021
    7
    0
    Yeah
    The OP only has you unlock the device so that you can install custom firmware and root with Magisk. Check the details, but I am sure that once you access TWRP, the first thing that needs to be flashed will be Magisk. This will give you root that you are looking for. From there, you can install custom firmware (e.g. - debloated stock ROM's)

    yeah I was being dumb, I successfully managed to root it thanks.
     
    Last edited:

    megamb11

    Senior Member
    Oct 11, 2017
    56
    2
    Yeah


    yeah I was being dumb, I successfully managed to root it thanks.

    don’t suppose you know anything about adb pull? I’m trying to pull the contents of the firestick out to an image and then use something like FTK to examine the image
    Sorry... my knowledge of android and linux systems only goes so far as to breaking and rooting devices. Sadly, I do not have the time to invest further into these systems though I wish I did.
     

    WoOzGaME

    Member
    Jul 18, 2017
    14
    0
    First, depends on how old the device is. As per the OP, Fire Sticks built after Dec '19 will not be able to be rooted. However, there is no way of telling when the device was built. I know mine is older because I picked it up a few years ago.
    20210507_181912-min (1).jpg

    Here's the infos... It's possible ?
     

    Attachments

    • 20210507_181912-min (1).jpg
      20210507_181912-min (1).jpg
      537.9 KB · Views: 12

    WoOzGaME

    Member
    Jul 18, 2017
    14
    0
    You can find firmwares online... just dig around XDA. I know I have seen a process to downgrade firmwares on here as well.

    How did you get confirmation that you could not unlock your stick?
    I have tried the method of this thread, it works until the step where the Stick appear as "Phone" and not "Preloader", I managed to make the Stick appear as "phone" but nothing happens on the program, always "Waiting for bootrom"... Maybe I did something wrong, but I have tried like 3-4 times, but the program never react
     

    ninadsarang18

    Member
    May 2, 2020
    5
    2
    have v2020 firestick with mediatek processor..i tried to open it to short clk n gnd but bit confused which pins are those?

    Im stuck on infinite bootloop, tried keeping it on for sevaral days, otg keyboard method but keyboard is not being detected (numpas, caps lights are not glowing) but nothing worked

    Now thinking to root it but not able to identify clk pin on the circuit..plz help
     

    Attachments

    • Screenshot_20210509-165941_Gallery_Go.png
      Screenshot_20210509-165941_Gallery_Go.png
      2 MB · Views: 29
    Last edited:

    megamb11

    Senior Member
    Oct 11, 2017
    56
    2
    have v2020 firestick with mediatek processor..i tried to open it to short clk n gnd but bit confused which pins are those?

    Im stuck on infinite bootloop, tried keeping it on for sevaral days, otg keyboard method but keyboard is not being detected (numpas, caps lights are not glowing) but nothing worked

    Now thinking to root it but not able to identify clk pin on the circuit..plz help
    Refer to the OP... though I do not recognize the image you sent as compared to the image in the OP. Is yours a Gen 2 Fire Stick?
     

    Sus_i

    Senior Member
  • Apr 9, 2013
    1,048
    393
    have v2020 firestick with mediatek processor..i tried to open it to short clk n gnd but bit confused which pins are those?

    Now thinking to root it but not able to identify clk pin on the circuit..plz help

    Yes its gen2 firestick

    This is the thread for the second gen. fireTVstick called tank (MT8127D SOC).

    Your picture shows a somewhat later fireTVstick with a MT8695 SOC, could be a fireTVstick 4k or one of the new 3th-gen sticks, incl. the lite.

    You can try this if you like:

    I guess you've got one of the newer non4k sticks and the mantis unbrick won't work...
     

    ninadsarang18

    Member
    May 2, 2020
    5
    2
    This is the thread for the second gen. fireTVstick called tank (MT8127D SOC).

    Your picture shows a somewhat later fireTVstick with a MT8695 SOC, could be a fireTVstick 4k or one of the new 3th-gen sticks, incl. the lite.

    You can try this if you like:

    I guess you've got one of the newer non4k sticks and the mantis unbrick won't work...
    Ohh you are right..I checked the technical details on amazon..its 3rd gen stick and 2nd gen remote..
    Many thanks for reference I will try that method.

    Cheers!!!
     

    nsanity99

    Member
    Apr 1, 2021
    7
    0
    I have tried the method of this thread, it works until the step where the Stick appear as "Phone" and not "Preloader", I managed to make the Stick appear as "phone" but nothing happens on the program, always "Waiting for bootrom"... Maybe I did something wrong, but I have tried like 3-4 times, but the program never react
    Longshot but are you using a live version of Linux or VM? I tried this method using a virtual machine of Ubuntu and it wouldn’t work, the second I dual booted into Ubuntu it worked.
     

    Top Liked Posts

    • There are no posts matching your filters.
    • 1
      As I said before, I have a tank, but the program don't recognize my Fire TV even if my Fire TV IS detected as Phone, si I think this is the hardware limitation
      You have a newer Tank 2020/21 edition stick. The clk and neighbouring resistors are located elsewhere going by your pic.

      Use pm commands to debloat and use tduk launcher manager to at least get rid of some crap and that ****ty launcher

      Regards
    • 63
      Read this whole guide before starting.

      This is for the 2nd gen Fire TV Stick (tank)

      Current relase: amonet-tank-v1.2.2.zip

      NOTE: Recent reports indicate a change that disables brom DL-mode
      The change seems to have been introduced with devices that where manufactured in December 2019 or later.
      The change is unrelated to the software-version and results in the device not showing up as a USB device when shorted.
      Unfortunately these devices cannot currently be unlocked.

      NOTE: If you are on version 1.0, don't update to 1.2.1 through TWRP, as there is a bug.
      NOTE: This issue has been fixed in version 1.2.2
      NOTE: When updating from version 1.0, don't install anything else before rebooting



      To update to the current release if you are already unlocked, just flash the zip in TWRP.

      What you need:
      • A Linux installation or live-system
      • A micro-USB cable
      • Something conductive (paperclip, tweezers etc)
      • Something to open the stick.


      NOTE: Ideally you want to update your system to 5.2.6.9 before starting this process, since this flashes the 5.2.6.8 boot.img and people have reported issues with adb-authorization with older firmware.
      Since version 1.2 this isn't required, because instead of flashing the 5.2.6.9 boot.img, your existing boot.img will be patched.
      It is still recommended to first update to 5.2.6.9


      Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work:
      Code:
      sudo apt update
      sudo add-apt-repository universe
      sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot

      Make sure ModemManager is disabled or uninstalled:
      Code:
      sudo systemctl stop ModemManager
      sudo systemctl disable ModemManager


      NOTE: If you have issues running the scripts, you might have to run them using sudo.
      Also try using different USB-ports (preferably USB-2.0-ports)


      1. Extract the attached zip-file "amonet-tank-v1.2.2.zip" and open a terminal in that directory.
      2. start the script:
      Code:
      ./bootrom-step.sh

      It should now say Waiting for bootrom.

      Short CLK to GND (The metal shielding is also GND) according to the attached photo and plug it in.


      NOTE:

      In lsusb the boot-rom shows up as:
      Code:
      Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone

      If it shows up as:
      Code:
      Bus 002 Device 014: ID [b]0e8d:2000[/b] MediaTek Inc. MT65xx Preloader
      instead, you are in preloader-mode, try again.

      dmesg lists the correct device as:
      Code:
      [ 6383.962057] usb 2-2: New USB device found, idVendor=[b]0e8d[/b], idProduct=[b]0003[/b], bcdDevice= 1.00


      4. When the script asks you to remove the short, remove the short and press enter.

      5. Wait for the script to finish.
      If it stalls at some point, stop it and restart the process from step 2.

      6. Your device should now reboot into unlocked fastboot state.

      7. Run
      Code:
      ./fastboot-step.sh

      8. Wait for the device to reboot into TWRP.

      9. Use TWRP to flash custom ROM, Magisk etc.


      NOTE:
      Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit,
      your device will likely not boot anymore (unless you flashed a signed image).
      TWRP will patch recovery/boot-images on the fly.


      NOTE:
      This process does not disable OTA or does any other modifications to your system.
      You will have to do that according to the other guides in this forum.


      Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
      Thanks to @hwmod for doing initial investigations and providing the attached image.
      11
      There are three options for interacting with TWRP:
      1. A mouse via USB-OTG
      2. TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html
      3. Via /cache/recovery/command

      Example for /cache/recovery/command:
      Code:
      echo "--update_package=/path/to/zipfile" > /cache/recovery/command
      echo "--wipe_cache" >> /cache/recovery/command
      reboot recovery

      Should you somehow end in a bootloop you can boot into hacked fastboot or recovery using.
      Code:
      sudo ./boot-fastboot.sh

      Code:
      sudo ./boot-recovery.sh

      NOTE:This will only work if the boot-exploit is still there.

      Source Code:
      https://github.com/chaosmaster/amonet
      https://github.com/chaosmaster/android_bootable_recovery
      9
      Changelog

      Version 1.2 (25.03.2019)
      • Update TWRP to twrp-9.0 sources
      • Implement downgrade-protection for LK/PL/TZ
      • Add scripts to enter fastboot/recovery in case of bootloop
      • Automatically restore boot-patch when you boot into recovery

      Features.

      • Hacked fastboot mode lets you use all fastboot commands (flash etc).
      • Boots custom/unsigned kernel-images (need to be patched)
      • For the devs: sets printk.disable_uart=0 (enables debug-output over UART).
      • TWRP protects from accidental lk/preloader/tz downgrades
      • Set bootmode via preloader

      NOTE: Hacked fastboot can be reached via TWRP.

      NOTE: Hacked fastboot won't patch your boot/recovery-images, so you can easily go back to stock.
      Use TWRP for autopatching.
      8
      Please read the instructions k4y0z wrote (1st page), then read the extra info below. It was my first time rooting a FireTV Stick via hardware and I had a lot of questions. Although, most answered via post replies throughout this thread. Here is a descriptive version of the rooting process for other beginners from what I learned.

      Any damages or issues resulting from rooting your own device falls on you!

      EDIT: I know this is long, but if you are a beginner DO NOT SKIM THROUGH.

      A Linux operating system is required. Ubuntu 19.04 is recommended and the following instructions are for Debian based systems like Ubuntu.

      The following packages were used (Check for updates):
      Amonet-tank-v1.2.2
      tank-5.2.6.9-rooted_r1
      Magisk-v19.2
      Everything was saved to the Downloads folder.

      Step 0: Open the FireTV Stick
      1. Use a plastic tool like an unused credit card. With a bit of force push the plastic tool into the edge (seam) of the FireTV Stick while slightly popping the side wall outwards until a snap. Continue on all sides until the plastic shell can be separated. Then, remove the motherboard. Disassembly video - Link
      2. On the side with the smaller metal shield, use a thin blunt knife or flathead. Start near the HDMI port above and below the black pad. There are small gaps that can be used to push the metal shield up. Continue around the metal shield until it is removed. Be careful not to scratch the board and leave the metal rim.
      3. Attach the micro USB cable to the FireTV Stick but not to a computer!
      4. Extract “amonet-tank-v1.2.2.zip” in the Downloads folder and open a Terminal on a Linux system.

      Step 1: Update Ubuntu
      Code:
      sudo apt update && sudo apt upgrade -y

      Step 2: Install Dependencies (Ignore if Android Studio is installed)
      Code:
      sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot

      Step 3: Stop and Disable ModemManager
      Code:
      sudo systemctl stop ModemManager
      sudo systemctl disable ModemManager

      Step 4: Short CLK to GND (Please read k4y0z instructions as well)
      1. Navigate to script directory:
        Code:
        cd ~/Downloads/amonet-tank-v1.2.2/amonet/
      2. Start the script:
        Code:
        sudo bash bootrom-step.sh
      3. When the Terminal prompt says "waiting for bootrom" (Easiest with two people)
      4. Place the removed metal shield next to the disassembled FireTV Stick. If it doesn't short, then use k4y0z suggested GND method.
      5. Use a paperclip (etc), and lightly touch the bottom metal piece of the CLK to the metal shield (CLK location, but use metal shield as GND). The CLK is tiny so be careful.
      6. Plug the USB cable connected to the FireTV Stick into the computer while holding the short!!! When I did it, I accidentally lost the short but it still worked (uncommon).
      7. The Terminal prompt will say when to "remove the short and press enter".
      8. Wait until the script finishes. If the script stalls, unplug USB and start the script again and short.
      9. Run fastboot script:
        Code:
        sudo bash fastboot-step.sh
      10. Next step has instructions.

      Step 5: Using Fastboot to install Roms and Magisk
      1. Wait for the FireStick to reboot into TWRP
      2. Push Tank’s prerooted rom zip file onto the FireTV Stick sd card:
        Code:
        adb push ~/Downloads/tank-5.2.6.9-rooted_r1.zip /sdcard/
      3. Push Magisk zip file:
        Code:
        adb push ~/Downloads/Magisk-v19.2.zip /sdcard/
      4. Go into ADB Shell:
        Code:
        adb shell
      5. Install rom:
        Code:
        twrp install /sdcard/tank-5.2.6.9-rooted_r1.zip
      6. Install Magisk:
        Code:
        twrp install /sdcard/Magisk-v19.2.zip
      7. EDIT: STOP! DO NOT WIPE ANYTHING OTHER THEN WHAT WAS STATED OR SKIP WIPING ENTIRELY IF YOU'RE A BEGINNER! You can skip wiping and reboot (#9 & #10) or decide if you want to wipe the cache and dalvik only (advanced):
        Code:
        twrp wipe cache
      8. Code:
        twrp wipe dalvik
      9. Code:
        reboot -p
      10. Unplug USB and plug the disassembled FireTV Stick into a monitor or TV. Use the power brick and handle with care.
      11. The "Optimizing Storage" screen will display and will take 10 minutes to complete.

      Optimizing Storage Screen Hangs Issue*
      Try plugging the FireTV Stick's USB to a different power brick temporarily.

      Otherwise and unfortunately, the following instructions will erase your apps and will force you to re-register your FireTV Stick.
      1. Unplug the FireTV Stick USB from the power brick only and open a Terminal window.
      2. Navigate to script directory:
        Code:
        cd ~/Downloads/amonet-tank-v1.2.2/amonet/
      3. Run the boot recovery script to boot into twrp:
        Code:
        sudo bash boot-recovery.sh
      4. When the Terminal prompt says "Waiting for preloader", plug the USB into the computer.
      5. Go into ADB Shell:
        Code:
        adb shell
      6. Code:
        twrp wipe data
      7. Code:
        twrp wipe cache
      8. Code:
        twrp wipe dalvik
      9. Install rom:
        Code:
        twrp install /sdcard/tank-5.2.6.9-rooted_r1.zip
      10. Install Magisk:
        Code:
        twrp install /sdcard/Magisk-v19.2.zip
      11. Code:
        reboot -p
      12. Plug FireTV Stick into a TV or Monitor and wait for the "Optimizing Storage" screen to finish and re-register your device.

      TWRP Can Be Accessed Anytime via Boot Recovery Script*
      Run the boot-recovery script and plug the FireTV Stick into the computer.

      How to backup TWRP**
      I haven't made a backup yet via the command line. But I assume it would go as follow and if anyone wants to help, please do.
      1. Unplug the FireTV Stick USB from the power brick only and open a Terminal window.
      2. Navigate to script directory:
        Code:
        cd ~/Downloads/amonet-tank-v1.2.2/amonet/
      3. Run the boot recovery script to boot into twrp:
        Code:
        sudo bash boot-recovery.sh
      4. When the Terminal prompt says "Waiting for preloader", plug the USB into the computer.
      5. Go into ADB Shell:
        Code:
        adb shell
      6. Create a TWRP backup (everything):
        Code:
        twrp backup twrp
        OR here is a list of partitions that can be backed up.

      Here is a list of bloatware to disable***
      Be extremely careful. Disabling the wrong thing can break your FireTV Stick! - Link

      1. Enable ADB debugging via FireTV Stick Settings and get the ip address under About.
      2. Connect to the FireTV Stick via Wifi:
        Code:
        adb kill-server
        adb start-server
        adb connect <ip-address>:5555 # Grant access via prompt on TV or monitor.
        adb shell
        su
      3. If su command does not work in shell, then open Magisk app and grant root access to shell (in sidebar menu).
      4. Disable bloat as shown in the link above. Be careful!!
      5
      I have not ported my bootmenu recovery to this device yet. I'll try to work on getting the device added to my build system and see what I can put together. Unfortunately I don't have any time this weekend, I'll see if I can get something going next weekend.
    Our Apps
    Get our official app!
    The best way to access XDA on your phone
    Nav Gestures
    Add swipe gestures to any Android
    One Handed Mode
    Eases uses one hand with your phone