• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 2nd gen (tank)

Search This thread

SweenWolf

Senior Member
Mar 18, 2016
547
387
Paradise
Amazon Fire TV
When I flashed Magisk, something went wrong. Now my Fire TV Tank stuck with Amazon logo.
When i try with "adb devices", no device is shown. Any trick to boot in recovery?
Should I reuse this to unbrick it?
Yes you'll have to unlock your stick again.
You should never update any images using Magisk Manager, be it uninstalling or updating, doing so will ALWAYS brick your stick.
 
  • Like
Reactions: lars1384 and Sus_i

lars1384

Member
Apr 2, 2017
22
6
Yes you'll have to unlock your stick again.
You should never update any images using Magisk Manager, be it uninstalling or updating, doing so will ALWAYS brick your stick.
Yes, then tell us how it worked for you^^

Thank you guys, it workd :)
Do you guys by any chance know the Adb command to format the storage? I have tried "Format data", but I get an error that Format command is unknown
 
  • Like
Reactions: Sus_i

Sus_i

Senior Member
Apr 9, 2013
1,145
455
I tried, but the content of the storage is intact. It does not look like to format the data of the storage.
Try this:
Boot into TWRP with usb cable to your PC, then run:
Code:
adb shell
reboot-amonet
fastboot devices
In case there is a fastboot device, run:
Code:
fastboot erase userdata
or:
Code:
fastboot format userdata
Idk if the first one will work for you, but the second one should work fine.
 
  • Like
Reactions: lars1384

lars1384

Member
Apr 2, 2017
22
6
Try this:
Boot into TWRP with usb cable to your PC, then run:
Code:
adb shell
reboot-amonet
fastboot devices
In case there is a fastboot device, run:
Code:
fastboot erase userdata
or:
Code:
fastboot format userdata
Idk if the first one will work for you, but the second one should work fine.
Great thanks.
Actually the first one worked fine.
The second one give this error:

fastboot: error: Formatting is not supported for file system with type 'unknown'.
 
  • Like
Reactions: Sus_i

rkaede

Senior Member
Sep 27, 2011
663
88
thank you very much for the cli guide. was abit lost on the twrp part. cause i dont have otg cable with me. i might have dirty flash it from my previous os. still have all my apps and profile intact. except its rooted now.
 

yass

Senior Member
Aug 14, 2005
82
13
Hello,

After performing the the commands successfully, Ive sideloaded prerooted image and magisk. When rebooting, how do I block the autoupdate during initial setup? I want it to stay at the current installed version instead.

EDIT: Nevermind, used the tip from this post, and managed to skip the update.
 
Last edited:
  • Like
Reactions: Sus_i

lev1_

Member
Oct 11, 2021
7
1
Thanks guy, this is great, got lineage running on gen2 firestick.

I've read through much of this post, but think I'm having same issue a few have asked, but maybe not resolved. I've no OTG cable, so only linux laptop, I can get to TWRP via


Code:
adb reboot recovery

But cannot swipe to allow modifications, is there a command for that?
It isn't clear on here: TWRP cmd guide
I think without swipe, I'm still not fully rooted and so updates could prevent me getting back to TWRP?
 

Sus_i

Senior Member
Apr 9, 2013
1,145
455
But cannot swipe to allow modifications, is there a command for that?
It isn't clear on here: TWRP cmd guide
I think without swipe, I'm still not fully rooted and so updates could prevent me getting back to TWRP?
You don't need the swipe, if you use twrp commandline.
Also you don't need to mount system if you want to root it, just flash magisk, it is a systemless root...
 

lev1_

Member
Oct 11, 2021
7
1
# twrp install /sdcard/magisk.zip
Yes cheers, but I did that at the beginning with the Lineage ROM. And then magisk wanted to update once booted into the OS. But I dont get how to root with it? I'm guessing I need to swipe in TWRP via OTG or use magisk to get proper root that prevents being overwritten if I mess-up with ROMs in the future.
 

Sus_i

Senior Member
Apr 9, 2013
1,145
455
Yes cheers, but I did that at the beginning with the Lineage ROM. And then magisk wanted to update once booted into the OS. But I dont get how to root with it?
Everytime you flash a rom, you need to re-flash magisk.
In case you need root for an App or adb shell, simply allow (grant root access) to the app or for the shell in the magisk manager app.
I'm guessing I need to swipe in TWRP via OTG or use magisk to get proper root that prevents being overwritten if I mess-up with ROMs in the future.
Magsik gets always overwritten if you or the OTA process flashs an update. You may use the OTA update block commands via adb shell, in order to disable the OTA update process (not needed for the LOS rom).
 

Sus_i

Senior Member
Apr 9, 2013
1,145
455
Can I follow this guide to install TWRP and downgrade to the oldest usable ROM.?
I'm on the new version with me new gui and I have a lot of problems.
Oh and can you advice me a ROM?
You may try the OP (unlock) as a first step, nobody knows if your device is vulnerable or not, i.e. there are also brom dl-mode patched sticks out there...
If the unlock works for you, downgrade to an older stock rom or flashing LOS is possible.
 
  • Like
Reactions: RealPsygnosis

RealPsygnosis

Senior Member
Oct 1, 2008
243
18
Taranto
You may try the OP (unlock) as a first step, nobody knows if your device is vulnerable or not, i.e. there are also brom dl-mode patched sticks out there...
If the unlock works for you, downgrade to an older stock rom or flashing LOS is possible.
Thank you so much i have the first tank ever maked so i don't think it's patched but i have to try.
 
  • Like
Reactions: Sus_i

lev1_

Member
Oct 11, 2021
7
1
Everytime you flash a rom, you need to re-flash magisk.
In case you need root for an App or adb shell, simply allow (grant root access) to the app or for the shell in the magisk manager app.

Magsik gets always overwritten if you or the OTA process flashs an update. You may use the OTA update block commands via adb shell, in order to disable the OTA update process (not needed for the LOS rom).
Thanks for explaining, I maybe getting mixed up with bootloader, I was sure with older phones I've applied TWRP to that it was on a separate bit of hardware meaning it's never overwritten.
 
  • Like
Reactions: Sus_i

RealPsygnosis

Senior Member
Oct 1, 2008
243
18
Taranto
You may try the OP (unlock) as a first step, nobody knows if your device is vulnerable or not, i.e. there are also brom dl-mode patched sticks out there...
If the unlock works for you, downgrade to an older stock rom or flashing LOS is possible.

I have two questions:
  1. I have open the FTV, I will install twrp with the guide by connecting the Tank to my laptop, but how can I operate on twrp without a display? Because maybe I'm limited but I don't know how to send rom to twrp, adb command?
  2. Can you advice me a custom rom? I just want to root for lock the update and if its possible to read ntfs disk, my main concern is to have the most "fluid" navigation untill I can afford the new 4k max version.
thank you
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    I have a really serious problem.
    No, not really ;)
    If i run ./boorom-step.sh everything is fine and it flash correctly everything.
    BUT
    when I run ./fastboot-step.sh simply nothing happens
    with Arch linux and with a live mx linux.
    with sudo and not.
    I'm a bit desperate because if I plug the stick into the tv I have the amazon logo with a little message "hacked fastboot"
    Thats fine. :)
    Seems your system got some detection problems and if you update the fastboot package, I bet the fault is gone... For arch something like this work (make sure that there is a connection to the internet):
    Code:
    pacman -Sy
    pacman -Sy fastboot
    Then take a look with fastboot devices and if your device is there (in hacked fastboot mode), the sudo fastboot-step command should work fine. If not, you can run the commands also by hand (open up the fastboot-step script with an editor to see all commands in there).
    1
    Yes you'll have to unlock your stick again.
    You should never update any images using Magisk Manager, be it uninstalling or updating, doing so will ALWAYS brick your stick.
    Yes, then tell us how it worked for you^^

    Thank you guys, it workd :)
    Do you guys by any chance know the Adb command to format the storage? I have tried "Format data", but I get an error that Format command is unknown
    1
    I tried, but the content of the storage is intact. It does not look like to format the data of the storage.
    Try this:
    Boot into TWRP with usb cable to your PC, then run:
    Code:
    adb shell
    reboot-amonet
    fastboot devices
    In case there is a fastboot device, run:
    Code:
    fastboot erase userdata
    or:
    Code:
    fastboot format userdata
    Idk if the first one will work for you, but the second one should work fine.
    1
    Try this:
    Boot into TWRP with usb cable to your PC, then run:
    Code:
    adb shell
    reboot-amonet
    fastboot devices
    In case there is a fastboot device, run:
    Code:
    fastboot erase userdata
    or:
    Code:
    fastboot format userdata
    Idk if the first one will work for you, but the second one should work fine.
    Great thanks.
    Actually the first one worked fine.
    The second one give this error:

    fastboot: error: Formatting is not supported for file system with type 'unknown'.
    1
    Code:
    su
    pm disable com.amazon.device.software.ota
    pm disable com.amazon.device.software.ota.override
    pm disable com.amazon.tv.forcedotaupdater.v2
    pm clear com.amazon.device.software.ota
    exit

    Boot on TWRP and give
    Code:
    adb shell
    su
    # /sbin/sh: su: not found
    pm disable com. amazon.device.software.ota
    # /sbin/sh pm: not found

    I've tried to mount System/bin but I have error on "cannot link executable dependancies"...
    I don't want to bother you but search doesn't bring me anything


    Solved by start FireOS and connect to adb via wifi and give the commands
    Thank you
  • 65
    Read this whole guide before starting.

    This is for the 2nd gen Fire TV Stick (tank)

    Current relase: amonet-tank-v1.2.2.zip

    NOTE: Recent reports indicate a change that disables brom DL-mode
    The change seems to have been introduced with devices that where manufactured in December 2019 or later.
    The change is unrelated to the software-version and results in the device not showing up as a USB device when shorted.
    Unfortunately these devices cannot currently be unlocked.

    NOTE: If you are on version 1.0, don't update to 1.2.1 through TWRP, as there is a bug.
    NOTE: This issue has been fixed in version 1.2.2
    NOTE: When updating from version 1.0, don't install anything else before rebooting



    To update to the current release if you are already unlocked, just flash the zip in TWRP.

    What you need:
    • A Linux installation or live-system
    • A micro-USB cable
    • Something conductive (paperclip, tweezers etc)
    • Something to open the stick.


    NOTE: Ideally you want to update your system to 5.2.6.9 before starting this process, since this flashes the 5.2.6.8 boot.img and people have reported issues with adb-authorization with older firmware.
    Since version 1.2 this isn't required, because instead of flashing the 5.2.6.9 boot.img, your existing boot.img will be patched.
    It is still recommended to first update to 5.2.6.9


    Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work:
    Code:
    sudo apt update
    sudo add-apt-repository universe
    sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot

    Make sure ModemManager is disabled or uninstalled:
    Code:
    sudo systemctl stop ModemManager
    sudo systemctl disable ModemManager


    NOTE: If you have issues running the scripts, you might have to run them using sudo.
    Also try using different USB-ports (preferably USB-2.0-ports)


    1. Extract the attached zip-file "amonet-tank-v1.2.2.zip" and open a terminal in that directory.
    2. start the script:
    Code:
    ./bootrom-step.sh

    It should now say Waiting for bootrom.

    Short CLK to GND (The metal shielding is also GND) according to the attached photo and plug it in.


    NOTE:

    In lsusb the boot-rom shows up as:
    Code:
    Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone

    If it shows up as:
    Code:
    Bus 002 Device 014: ID [b]0e8d:2000[/b] MediaTek Inc. MT65xx Preloader
    instead, you are in preloader-mode, try again.

    dmesg lists the correct device as:
    Code:
    [ 6383.962057] usb 2-2: New USB device found, idVendor=[b]0e8d[/b], idProduct=[b]0003[/b], bcdDevice= 1.00


    4. When the script asks you to remove the short, remove the short and press enter.

    5. Wait for the script to finish.
    If it stalls at some point, stop it and restart the process from step 2.

    6. Your device should now reboot into unlocked fastboot state.

    7. Run
    Code:
    ./fastboot-step.sh

    8. Wait for the device to reboot into TWRP.

    9. Use TWRP to flash custom ROM, Magisk etc.


    NOTE:
    Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit,
    your device will likely not boot anymore (unless you flashed a signed image).
    TWRP will patch recovery/boot-images on the fly.


    NOTE:
    This process does not disable OTA or does any other modifications to your system.
    You will have to do that according to the other guides in this forum.


    Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
    Thanks to @hwmod for doing initial investigations and providing the attached image.
    12
    There are three options for interacting with TWRP:
    1. A mouse via USB-OTG
    2. TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html
    3. Via /cache/recovery/command

    Example for /cache/recovery/command:
    Code:
    echo "--update_package=/path/to/zipfile" > /cache/recovery/command
    echo "--wipe_cache" >> /cache/recovery/command
    reboot recovery

    Should you somehow end in a bootloop you can boot into hacked fastboot or recovery using.
    Code:
    sudo ./boot-fastboot.sh

    Code:
    sudo ./boot-recovery.sh

    NOTE:This will only work if the boot-exploit is still there.

    Source Code:
    https://github.com/chaosmaster/amonet
    https://github.com/chaosmaster/android_bootable_recovery
    9
    Changelog

    Version 1.2 (25.03.2019)
    • Update TWRP to twrp-9.0 sources
    • Implement downgrade-protection for LK/PL/TZ
    • Add scripts to enter fastboot/recovery in case of bootloop
    • Automatically restore boot-patch when you boot into recovery

    Features.

    • Hacked fastboot mode lets you use all fastboot commands (flash etc).
    • Boots custom/unsigned kernel-images (need to be patched)
    • For the devs: sets printk.disable_uart=0 (enables debug-output over UART).
    • TWRP protects from accidental lk/preloader/tz downgrades
    • Set bootmode via preloader

    NOTE: Hacked fastboot can be reached via TWRP.

    NOTE: Hacked fastboot won't patch your boot/recovery-images, so you can easily go back to stock.
    Use TWRP for autopatching.
    8
    Please read the instructions k4y0z wrote (1st page), then read the extra info below. It was my first time rooting a FireTV Stick via hardware and I had a lot of questions. Although, most answered via post replies throughout this thread. Here is a descriptive version of the rooting process for other beginners from what I learned.

    Any damages or issues resulting from rooting your own device falls on you!

    EDIT: I know this is long, but if you are a beginner DO NOT SKIM THROUGH.

    A Linux operating system is required. Ubuntu 19.04 is recommended and the following instructions are for Debian based systems like Ubuntu.

    The following packages were used (Check for updates):
    Amonet-tank-v1.2.2
    tank-5.2.6.9-rooted_r1
    Magisk-v19.2
    Everything was saved to the Downloads folder.

    Step 0: Open the FireTV Stick
    1. Use a plastic tool like an unused credit card. With a bit of force push the plastic tool into the edge (seam) of the FireTV Stick while slightly popping the side wall outwards until a snap. Continue on all sides until the plastic shell can be separated. Then, remove the motherboard. Disassembly video - Link
    2. On the side with the smaller metal shield, use a thin blunt knife or flathead. Start near the HDMI port above and below the black pad. There are small gaps that can be used to push the metal shield up. Continue around the metal shield until it is removed. Be careful not to scratch the board and leave the metal rim.
    3. Attach the micro USB cable to the FireTV Stick but not to a computer!
    4. Extract “amonet-tank-v1.2.2.zip” in the Downloads folder and open a Terminal on a Linux system.

    Step 1: Update Ubuntu
    Code:
    sudo apt update && sudo apt upgrade -y

    Step 2: Install Dependencies (Ignore if Android Studio is installed)
    Code:
    sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot

    Step 3: Stop and Disable ModemManager
    Code:
    sudo systemctl stop ModemManager
    sudo systemctl disable ModemManager

    Step 4: Short CLK to GND (Please read k4y0z instructions as well)
    1. Navigate to script directory:
      Code:
      cd ~/Downloads/amonet-tank-v1.2.2/amonet/
    2. Start the script:
      Code:
      sudo bash bootrom-step.sh
    3. When the Terminal prompt says "waiting for bootrom" (Easiest with two people)
    4. Place the removed metal shield next to the disassembled FireTV Stick. If it doesn't short, then use k4y0z suggested GND method.
    5. Use a paperclip (etc), and lightly touch the bottom metal piece of the CLK to the metal shield (CLK location, but use metal shield as GND). The CLK is tiny so be careful.
    6. Plug the USB cable connected to the FireTV Stick into the computer while holding the short!!! When I did it, I accidentally lost the short but it still worked (uncommon).
    7. The Terminal prompt will say when to "remove the short and press enter".
    8. Wait until the script finishes. If the script stalls, unplug USB and start the script again and short.
    9. Run fastboot script:
      Code:
      sudo bash fastboot-step.sh
    10. Next step has instructions.

    Step 5: Using Fastboot to install Roms and Magisk
    1. Wait for the FireStick to reboot into TWRP
    2. Push Tank’s prerooted rom zip file onto the FireTV Stick sd card:
      Code:
      adb push ~/Downloads/tank-5.2.6.9-rooted_r1.zip /sdcard/
    3. Push Magisk zip file:
      Code:
      adb push ~/Downloads/Magisk-v19.2.zip /sdcard/
    4. Go into ADB Shell:
      Code:
      adb shell
    5. Install rom:
      Code:
      twrp install /sdcard/tank-5.2.6.9-rooted_r1.zip
    6. Install Magisk:
      Code:
      twrp install /sdcard/Magisk-v19.2.zip
    7. EDIT: STOP! DO NOT WIPE ANYTHING OTHER THEN WHAT WAS STATED OR SKIP WIPING ENTIRELY IF YOU'RE A BEGINNER! You can skip wiping and reboot (#9 & #10) or decide if you want to wipe the cache and dalvik only (advanced):
      Code:
      twrp wipe cache
    8. Code:
      twrp wipe dalvik
    9. Code:
      reboot -p
    10. Unplug USB and plug the disassembled FireTV Stick into a monitor or TV. Use the power brick and handle with care.
    11. The "Optimizing Storage" screen will display and will take 10 minutes to complete.

    Optimizing Storage Screen Hangs Issue*
    Try plugging the FireTV Stick's USB to a different power brick temporarily.

    Otherwise and unfortunately, the following instructions will erase your apps and will force you to re-register your FireTV Stick.
    1. Unplug the FireTV Stick USB from the power brick only and open a Terminal window.
    2. Navigate to script directory:
      Code:
      cd ~/Downloads/amonet-tank-v1.2.2/amonet/
    3. Run the boot recovery script to boot into twrp:
      Code:
      sudo bash boot-recovery.sh
    4. When the Terminal prompt says "Waiting for preloader", plug the USB into the computer.
    5. Go into ADB Shell:
      Code:
      adb shell
    6. Code:
      twrp wipe data
    7. Code:
      twrp wipe cache
    8. Code:
      twrp wipe dalvik
    9. Install rom:
      Code:
      twrp install /sdcard/tank-5.2.6.9-rooted_r1.zip
    10. Install Magisk:
      Code:
      twrp install /sdcard/Magisk-v19.2.zip
    11. Code:
      reboot -p
    12. Plug FireTV Stick into a TV or Monitor and wait for the "Optimizing Storage" screen to finish and re-register your device.

    TWRP Can Be Accessed Anytime via Boot Recovery Script*
    Run the boot-recovery script and plug the FireTV Stick into the computer.

    How to backup TWRP**
    I haven't made a backup yet via the command line. But I assume it would go as follow and if anyone wants to help, please do.
    1. Unplug the FireTV Stick USB from the power brick only and open a Terminal window.
    2. Navigate to script directory:
      Code:
      cd ~/Downloads/amonet-tank-v1.2.2/amonet/
    3. Run the boot recovery script to boot into twrp:
      Code:
      sudo bash boot-recovery.sh
    4. When the Terminal prompt says "Waiting for preloader", plug the USB into the computer.
    5. Go into ADB Shell:
      Code:
      adb shell
    6. Create a TWRP backup (everything):
      Code:
      twrp backup twrp
      OR here is a list of partitions that can be backed up.

    Here is a list of bloatware to disable***
    Be extremely careful. Disabling the wrong thing can break your FireTV Stick! - Link

    1. Enable ADB debugging via FireTV Stick Settings and get the ip address under About.
    2. Connect to the FireTV Stick via Wifi:
      Code:
      adb kill-server
      adb start-server
      adb connect <ip-address>:5555 # Grant access via prompt on TV or monitor.
      adb shell
      su
    3. If su command does not work in shell, then open Magisk app and grant root access to shell (in sidebar menu).
    4. Disable bloat as shown in the link above. Be careful!!
    5
    I have not ported my bootmenu recovery to this device yet. I'll try to work on getting the device added to my build system and see what I can put together. Unfortunately I don't have any time this weekend, I'll see if I can get something going next weekend.