[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 2nd gen (tank)
- Thread starter k4y0z
- Start date
Ok, the stick is most likely blacklisted, reported as stolen, broken or something like that.
Bertonumber1
Senior Member
I've had this issue before.
Unless they've blocked it. You should still be able to use the stick with a custom launcher. .. At the update screen where its stuck.. Download and install the firetv remote app from playstore and use this to connect WiFi and access manage application settings to give Magisk rights.
When that's done call su and disable com.amazon.oobe, com.amazon.firehomstarter, com.amazon.tv launcher but only once you have ATV launcher and 0815hoffi root settings apk installed (adb installed).
You should then be able to use it as normal without amazon account.
Let us know
It will brick if you damage parts, you may need to do the shorting carefully, don't use sharp tools...
hehe ok.
A steady hand is needed!
I think i need to read quite a bit more before doing this.
Was hoping i could root it and install IinageOS.
Hi everyone, during my attempt's to root the device I've accidentally crushed what i think is a capacitor on the pcb, I've attached an image indicating the broken part with a red arrow.
Interestingly rooting and flashing worked without problems, but after checking logcat it seems that neither the stock os nor lineage are still able to communicate with the wifi and Bluetooth Chipsets. Can anyone confirm that this cap is part of the connection to the chipset, and if yes can anyone figure out the rating of the cap so i can replace it?
Thanks in advance!
Interestingly rooting and flashing worked without problems, but after checking logcat it seems that neither the stock os nor lineage are still able to communicate with the wifi and Bluetooth Chipsets. Can anyone confirm that this cap is part of the connection to the chipset, and if yes can anyone figure out the rating of the cap so i can replace it?
Thanks in advance!
It works for me BUT ONLY NOT WITH THE NATIVE remote control. Now the remote control is attached from 1 Modell (without a microphone).
Airmouse also works via OTG
только один подключается...
Last edited:
I've done the step on the first post before. assuming this situation if i accidentally reset faxcory do i need to redo the whole paper clip step again? thx
No, but re-do is necessary if you brick somehow (like flashing magisk via the manager).
Should you somehow end in a bootloop you can boot into hacked fastboot or recovery using.
sudo ./boot-fastboot.sh
TWRP
sudo ./boot-recovery.sh
its not a bootloop. for some reason im unable to sign in my amazon account. the stick will keep on looping on connecting to amazon part. i might deleted the apk for that function not too sure. this happened after i sign out my existing amazon account. resign in with another
im thinking to go twrp and reflash the rom
anyway thanks for all the reply appreciate it
edit. just tried the sudo command. showing that sudo not avail
im thinking to go twrp and reflash the rom
anyway thanks for all the reply appreciate it
edit. just tried the sudo command. showing that sudo not avail
Last edited:
thanks. it's currently just stuck at waiting for preloader.
i tried to adb shell and run adb reboot recovery. nothing happened.
it seems some of the file still there. i can see my downloaded ROM. and apk.
note:
2nd attempt i managed to go TWRP. now trying to restore factory and now reflashing 5.2.7.3 and magisk. finger crossed.
fixed!!! thanks for all your help
i tried to adb shell and run adb reboot recovery. nothing happened.
it seems some of the file still there. i can see my downloaded ROM. and apk.
note:
2nd attempt i managed to go TWRP. now trying to restore factory and now reflashing 5.2.7.3 and magisk. finger crossed.
fixed!!! thanks for all your help
Last edited:
sudo ./boot-recovery.sh
everything is right! Now Just plug in the plug from the stick in USB
and the stick will be loaded into TVRP
I don't know if a similar question was asked and there is 88 pages of comments so I apologize for that.
I do not have any problems regarding the exploit, but I do not have the remote and can't get past the setup screen.
I wiped the fire stick from twrp.
The problem I am having is that without the remote you can't really do anything, so I found a way to emulate inputs using "adb shell input" but that, as it is an adb command, requires USB debugging to be on, which I, again can't do without the remote.
So my question is has anyone faced a similar problem? Was anyone able to enable USB debugging by editing build.prop or other system files? Also I am kinda new to this and as this post says don't flash the system partition, I am unsure if I am allowed to edit it. Does that count as editing it?
Nonetheless, I am stuck without a way to enable USB debugging or even connecting it to the WiFi.
If someone succeeded in enabling adb and authorizing your pc, please tell me, but by then I will continue to search for an answer.
I do not have any problems regarding the exploit, but I do not have the remote and can't get past the setup screen.
I wiped the fire stick from twrp.
The problem I am having is that without the remote you can't really do anything, so I found a way to emulate inputs using "adb shell input" but that, as it is an adb command, requires USB debugging to be on, which I, again can't do without the remote.
So my question is has anyone faced a similar problem? Was anyone able to enable USB debugging by editing build.prop or other system files? Also I am kinda new to this and as this post says don't flash the system partition, I am unsure if I am allowed to edit it. Does that count as editing it?
Nonetheless, I am stuck without a way to enable USB debugging or even connecting it to the WiFi.
If someone succeeded in enabling adb and authorizing your pc, please tell me, but by then I will continue to search for an answer.
5.2.9.4 available for fire stick tank
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
67Read this whole guide before starting.
This is for the 2nd gen Fire TV Stick (tank)
Current relase: amonet-tank-v1.2.2.zip
NOTE: Recent reports indicate a change that disables brom DL-mode
The change seems to have been introduced with devices that where manufactured in December 2019 or later.
The change is unrelated to the software-version and results in the device not showing up as a USB device when shorted.
Unfortunately these devices cannot currently be unlocked.
NOTE: If you are on version 1.0, don't update to 1.2.1 through TWRP, as there is a bug.
NOTE: This issue has been fixed in version 1.2.2
NOTE: When updating from version 1.0, don't install anything else before rebooting
To update to the current release if you are already unlocked, just flash the zip in TWRP.
What you need:
- A Linux installation or live-system
- A micro-USB cable
- Something conductive (paperclip, tweezers etc)
- Something to open the stick.
NOTE:Ideally you want to update your system to 5.2.6.9 before starting this process, since this flashes the 5.2.6.8 boot.img and people have reported issues with adb-authorization with older firmware.
Since version 1.2 this isn't required, because instead of flashing the 5.2.6.9 boot.img, your existing boot.img will be patched.
It is still recommended to first update to 5.2.6.9
Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work:
Code:sudo apt update sudo add-apt-repository universe sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot
Make sure ModemManager is disabled or uninstalled:
Code:sudo systemctl stop ModemManager sudo systemctl disable ModemManager
NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)
1. Extract the attached zip-file "amonet-tank-v1.2.2.zip" and open a terminal in that directory.
2. start the script:
Code:./bootrom-step.sh
It should now say Waiting for bootrom.
Short CLK to GND (The metal shielding is also GND) according to the attached photo and plug it in.
NOTE:
In lsusb the boot-rom shows up as:
Code:Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone
If it shows up as:
instead, you are in preloader-mode, try again.Code:Bus 002 Device 014: ID [b]0e8d:2000[/b] MediaTek Inc. MT65xx Preloader
dmesg lists the correct device as:
Code:[ 6383.962057] usb 2-2: New USB device found, idVendor=[b]0e8d[/b], idProduct=[b]0003[/b], bcdDevice= 1.00
4. When the script asks you to remove the short, remove the short and press enter.
5. Wait for the script to finish.
If it stalls at some point, stop it and restart the process from step 2.
6. Your device should now reboot into unlocked fastboot state.
7. Run
Code:./fastboot-step.sh
8. Wait for the device to reboot into TWRP.
9. Use TWRP to flash custom ROM, Magisk etc.
NOTE:
Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit,
your device will likely not boot anymore (unless you flashed a signed image).
TWRP will patch recovery/boot-images on the fly.
NOTE:
This process does not disable OTA or does any other modifications to your system.
You will have to do that according to the other guides in this forum.
Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Thanks to @hwmod for doing initial investigations and providing the attached image.12There are three options for interacting with TWRP:
- A mouse via USB-OTG
- TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html
- Via /cache/recovery/command
Example for /cache/recovery/command:
Code:echo "--update_package=/path/to/zipfile" > /cache/recovery/command echo "--wipe_cache" >> /cache/recovery/command reboot recovery
Should you somehow end in a bootloop you can boot into hacked fastboot or recovery using.
Code:sudo ./boot-fastboot.sh
Code:sudo ./boot-recovery.sh
NOTE:This will only work if the boot-exploit is still there.
Source Code:
https://github.com/chaosmaster/amonet
https://github.com/chaosmaster/android_bootable_recovery9Changelog
Version 1.2 (25.03.2019)
- Update TWRP to twrp-9.0 sources
- Implement downgrade-protection for LK/PL/TZ
- Add scripts to enter fastboot/recovery in case of bootloop
- Automatically restore boot-patch when you boot into recovery
Features.
- Hacked fastboot mode lets you use all fastboot commands (flash etc).
- Boots custom/unsigned kernel-images (need to be patched)
- For the devs: sets printk.disable_uart=0 (enables debug-output over UART).
- TWRP protects from accidental lk/preloader/tz downgrades
- Set bootmode via preloader
NOTE: Hacked fastboot can be reached via TWRP.
NOTE: Hacked fastboot won't patch your boot/recovery-images, so you can easily go back to stock.
Use TWRP for autopatching.8Please read the instructions k4y0z wrote (1st page), then read the extra info below. It was my first time rooting a FireTV Stick via hardware and I had a lot of questions. Although, most answered via post replies throughout this thread. Here is a descriptive version of the rooting process for other beginners from what I learned.
Any damages or issues resulting from rooting your own device falls on you!
EDIT: I know this is long, but if you are a beginner DO NOT SKIM THROUGH.
A Linux operating system is required. Ubuntu 19.04 is recommended and the following instructions are for Debian based systems like Ubuntu.
The following packages were used (Check for updates):
Amonet-tank-v1.2.2
tank-5.2.6.9-rooted_r1
Magisk-v19.2
Everything was saved to the Downloads folder.
Step 0: Open the FireTV Stick
- Use a plastic tool like an unused credit card. With a bit of force push the plastic tool into the edge (seam) of the FireTV Stick while slightly popping the side wall outwards until a snap. Continue on all sides until the plastic shell can be separated. Then, remove the motherboard. Disassembly video - Link
- On the side with the smaller metal shield, use a thin blunt knife or flathead. Start near the HDMI port above and below the black pad. There are small gaps that can be used to push the metal shield up. Continue around the metal shield until it is removed. Be careful not to scratch the board and leave the metal rim.
- Attach the micro USB cable to the FireTV Stick but not to a computer!
- Extract “amonet-tank-v1.2.2.zip” in the Downloads folder and open a Terminal on a Linux system.
Step 1: Update Ubuntu
Code:sudo apt update && sudo apt upgrade -y
Step 2: Install Dependencies (Ignore if Android Studio is installed)
Code:sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot
Step 3: Stop and Disable ModemManager
Code:sudo systemctl stop ModemManager sudo systemctl disable ModemManager
Step 4: Short CLK to GND (Please read k4y0z instructions as well)
- Navigate to script directory:
Code:
cd ~/Downloads/amonet-tank-v1.2.2/amonet/ - Start the script:
Code:
sudo bash bootrom-step.sh - When the Terminal prompt says "waiting for bootrom" (Easiest with two people)
- Place the removed metal shield next to the disassembled FireTV Stick. If it doesn't short, then use k4y0z suggested GND method.
- Use a paperclip (etc), and lightly touch the bottom metal piece of the CLK to the metal shield (CLK location, but use metal shield as GND). The CLK is tiny so be careful.
- Plug the USB cable connected to the FireTV Stick into the computer while holding the short!!! When I did it, I accidentally lost the short but it still worked (uncommon).
- The Terminal prompt will say when to "remove the short and press enter".
- Wait until the script finishes. If the script stalls, unplug USB and start the script again and short.
- Run fastboot script:
Code:
sudo bash fastboot-step.sh - Next step has instructions.
Step 5: Using Fastboot to install Roms and Magisk
- Wait for the FireStick to reboot into TWRP
- Push Tank’s prerooted rom zip file onto the FireTV Stick sd card:
Code:
adb push ~/Downloads/tank-5.2.6.9-rooted_r1.zip /sdcard/ - Push Magisk zip file:
Code:
adb push ~/Downloads/Magisk-v19.2.zip /sdcard/ - Go into ADB Shell:
Code:
adb shell - Install rom:
Code:
twrp install /sdcard/tank-5.2.6.9-rooted_r1.zip - Install Magisk:
Code:
twrp install /sdcard/Magisk-v19.2.zip - EDIT: STOP! DO NOT WIPE ANYTHING OTHER THEN WHAT WAS STATED OR SKIP WIPING ENTIRELY IF YOU'RE A BEGINNER! You can skip wiping and reboot (#9 & #10) or decide if you want to wipe the cache and dalvik only (advanced):
Code:
twrp wipe cache -
Code:
twrp wipe dalvik -
Code:
reboot -p - Unplug USB and plug the disassembled FireTV Stick into a monitor or TV. Use the power brick and handle with care.
- The "Optimizing Storage" screen will display and will take 10 minutes to complete.
Optimizing Storage Screen Hangs Issue*
Try plugging the FireTV Stick's USB to a different power brick temporarily.
Otherwise and unfortunately, the following instructions will erase your apps and will force you to re-register your FireTV Stick.
- Unplug the FireTV Stick USB from the power brick only and open a Terminal window.
- Navigate to script directory:
Code:
cd ~/Downloads/amonet-tank-v1.2.2/amonet/ - Run the boot recovery script to boot into twrp:
Code:
sudo bash boot-recovery.sh - When the Terminal prompt says "Waiting for preloader", plug the USB into the computer.
- Go into ADB Shell:
Code:
adb shell -
Code:
twrp wipe data -
Code:
twrp wipe cache -
Code:
twrp wipe dalvik - Install rom:
Code:
twrp install /sdcard/tank-5.2.6.9-rooted_r1.zip - Install Magisk:
Code:
twrp install /sdcard/Magisk-v19.2.zip -
Code:
reboot -p - Plug FireTV Stick into a TV or Monitor and wait for the "Optimizing Storage" screen to finish and re-register your device.
TWRP Can Be Accessed Anytime via Boot Recovery Script*
Run the boot-recovery script and plug the FireTV Stick into the computer.
How to backup TWRP**
I haven't made a backup yet via the command line. But I assume it would go as follow and if anyone wants to help, please do.
- Unplug the FireTV Stick USB from the power brick only and open a Terminal window.
- Navigate to script directory:
Code:
cd ~/Downloads/amonet-tank-v1.2.2/amonet/ - Run the boot recovery script to boot into twrp:
Code:
sudo bash boot-recovery.sh - When the Terminal prompt says "Waiting for preloader", plug the USB into the computer.
- Go into ADB Shell:
Code:
adb shell - Create a TWRP backup (everything):
OR here is a list of partitions that can be backed up.Code:
twrp backup twrp
Here is a list of bloatware to disable***
Be extremely careful. Disabling the wrong thing can break your FireTV Stick! - Link
- Enable ADB debugging via FireTV Stick Settings and get the ip address under About.
- Connect to the FireTV Stick via Wifi:
Code:adb kill-server adb start-server adb connect <ip-address>:5555 # Grant access via prompt on TV or monitor. adb shell su - If su command does not work in shell, then open Magisk app and grant root access to shell (in sidebar menu).
- Disable bloat as shown in the link above. Be careful!!
