[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 3 and Fire TV Stick Lite (sheldon/p)

Search This thread

k4y0z

Senior Member
Nov 27, 2015
1,468
2,003
Read this whole guide before starting.
This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon).

NOTE: FireOS < 7.2.7.3 required

NOTE: This process does not require you to open your device.

What you need:
  • A Linux installation or live-system
  • A micro-USB cable

Install python3, PySerial, PyUSB, adb, fastboot. For Debian/Ubuntu something like this should work:
  • sudo apt update
  • sudo add-apt-repository universe
  • sudo apt install python3 python3-serial python3-usb adb fastboot dos2unix

Make sure ModemManager is disabled or uninstalled:
  • sudo systemctl stop ModemManager
  • sudo systemctl disable ModemManager

NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)


1. Extract the attached zip-file "kamakiri-sheldon-1.0.zip" and open a terminal in that directory.

2. Start the script:
  • sudo ./bootrom-step.sh
It should now say Waiting for device.

3. Plug in the stick (powered off) and wait for the script to finish.
If it fails at some point, stop it and restart the process from step 2.

4. Your device should now reboot into unlocked fastboot state.

5. Run:
  • ./fastboot-step.sh

6. Wait for the device to reboot into TWRP.

7. Use TWRP to flash custom ROMs, Magisk etc.

NOTE: Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit, your device will likely not boot anymore (unless you flashed a signed image). TWRP will patch recovery/boot-images on the fly.

NOTE: NEVER erase Preloader, otherwise you’ll hard brick the device and you won’t be able to unbrick it (since bootrom isn’t accessible).

Important information

Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

It is still advised to disable OTA.

special thanks to @Sus_i for all the testing and support.

Contributors
@xyz`
@k4y0z
@Rortiz2
@t0x1cSH
 

Attachments

  • kamakiri-sheldon-1.0.zip
    17.4 MB · Views: 10,970
Last edited:

bloot

Senior Member
Feb 10, 2008
518
230
Barcelona
It works, thank you very much for your work, now let's see if I can flash a ROM (tried the Lineage 18.1 but TWRP says it's corrupted :()

Edit

Solved, turns out the ubuntu livecd corrupted the zip file when transfering it, tried transfering it again this time via ftp and it works now.
 
Last edited:
  • Like
Reactions: linkntbsg and Sus_i

navin23

Member
Sep 29, 2018
48
8
Thanks for unlocking the firetv stick 3. I was trying to unlock my stick 3 lite however, I'm getting stuck at step 2 .

Now I'm getting the white firetv screen with Hacked Fastboot mode: at the bottom left of the screen. I tried to run bootrom multiple times with the same results. Thanks

[[email protected] ~/Desktop/kamakiri-sheldon-1.0/kamakiri]# ./fastboot-step.sh
fastboot: core/libsparse/sparse.cpp:131: int write_all_blocks(struct sparse_file *, struct output_file *): Assertion `pad >= 0' failed.
./fastboot-step.sh: line 5: 1850 Aborted (core dumped) fastboot flash recovery bin/twrp.img
 
Last edited:

navin23

Member
Sep 29, 2018
48
8
I tried another linux computer and it works now. I had to install the usb module below too.

All is well now. Thanks again

[email protected]:~/Desktop/stick_3/kamakiri$ sudo ./bootrom-step.sh
Traceback (most recent call last):
File "main.py", line 8, in <module>
from load_payload import load_payload, load_pl_payload
File "/home/dell/Desktop/stick_3/kamakiri/modules/load_payload.py", line 9, in <module>
import usb.core
ModuleNotFoundError: No module named 'usb'

sudo apt-get update
sudo apt-get install python-usb python3-usb
sudo apt-get install python-pip
sudo pip install pyusb

 
  • Like
Reactions: sanangel and Sus_i

Sus_i

Senior Member
Apr 9, 2013
1,858
811
Thanks for unlocking the firetv stick 3. I was trying to unlock my stick 3 lite however, I'm getting stuck at step 2 .

Now I'm getting the white firetv screen with Hacked Fastboot mode: at the bottom left of the screen. I tried to run bootrom multiple times with the same results. Thanks

[[email protected] ~/Desktop/kamakiri-sheldon-1.0/kamakiri]# ./fastboot-step.sh
fastboot: core/libsparse/sparse.cpp:131: int write_all_blocks(struct sparse_file *, struct output_file *): Assertion `pad >= 0' failed.
./fastboot-step.sh: line 5: 1850 Aborted (core dumped) fastboot flash recovery bin/twrp.img
I know it's too late, since you're already done :)
but if anyone gets 'Assertion `pad >= 0' failed', the fastboot package needs an update. Connect to the network and run this in a terminal:
Code:
pacman -Sy fastboot
 
  • Like
Reactions: puppinoo and bloot
Worked great and a great surprise to see this, thought it's never happen! Had to install pyusb as well and need to get an otg connecter but managed to root my sheldon stick.
Any recommendations, links etc.? I've never had the chance to play with a rooted Fire stick and resources seem quite thin since it's Fire os7. I'm hoping for a magisk module of google apps like the one for FireOS 6 arrives soon and like a guide to install sheldonp onto sheldon vice versa
 
  • Wow
Reactions: Andreneres

Rortiz2

Senior Member
Worked great and a great surprise to see this, thought it's never happen! Had to install pyusb as well and need to get an otg connecter but managed to root my sheldon stick.
Any recommendations, links etc.? I've never had the chance to play with a rooted Fire stick and resources seem quite thin since it's Fire os7. I'm hoping for a magisk module of google apps like the one for FireOS 6 arrives soon and like a guide to install sheldonp onto sheldon vice versa
You can give a try to LineageOS 18.1. Besides Netflix, everything works perfectly.
 

emma80200

New member
Mar 5, 2022
3
2
Hello i've been trying to follow your steps but i always end up with this error message. Using Fire TV Stick 3 gen (sheldonp) with FireOs 7.2.4.2, do i need version 7.2.7.3 for the root to work?

[2022-03-05 13:40:37.517594] Check boot0
[2022-03-05 13:40:37.996077] Check rpmb
[2022-03-05 13:40:38.026461] Downgrade rpmb
[2022-03-05 13:40:38.026862] Recheck rpmb
Traceback (most recent call last):
File "main.py", line 137, in <module>
main(dev)
File "main.py", line 76, in main
raise RuntimeError("downgrade failure, giving up")
RuntimeError: downgrade failure, giving up

Thank you!
 
Last edited:
  • Like
Reactions: roodrizx

Rortiz2

Senior Member
Hello i've been trying to follow your steps but i always end up with this error message. Using Fire TV Stick 3 gen (sheldonp) with FireOs 7.2.4.2, do i need version 7.2.7.3 for the root to work?

[email protected]:~/Desktop/kam/kamakiri$ sudo ./bootrom-step.sh
[2022-03-05 13:40:26.865130] Waiting for device
[2022-03-05 13:40:33.943838] Found port = /dev/ttyACM0
[2022-03-05 13:40:33.982781] Handshake
[2022-03-05 13:40:34.004239] Load payload from ../brom-payload/pl/pl.bin = 0x3A04 bytes
[2022-03-05 13:40:36.501491] All good
[2022-03-05 13:40:36.996590] Check device_type_id
[2022-03-05 13:40:36.996836] Detected sheldonp (A265XOI9586NML)
[2022-03-05 13:40:36.996952] Check GPT
[2022-03-05 13:40:37.517453] gpt_parsed = {'lk': (1024, 2048), 'tee1': (3072, 10240), 'tee2': (13312, 10240), 'boot': (23552, 32768), 'recovery': (56320, 32768), 'logo': (89088, 7168), 'kb': (96256, 2048), 'dkb': (98304, 2048), 'MISC': (100352, 2048), 'vendor': (102400, 307200), 'system': (409600, 3072000), 'cache': (3481600, 1048576), 'userdata': (4530176, 10743391), '': (0, 1)}
[2022-03-05 13:40:37.517594] Check boot0
[2022-03-05 13:40:37.996077] Check rpmb
[2022-03-05 13:40:38.026461] Downgrade rpmb
[2022-03-05 13:40:38.026862] Recheck rpmb
Traceback (most recent call last):
File "main.py", line 137, in <module>
main(dev)
File "main.py", line 76, in main
raise RuntimeError("downgrade failure, giving up")
RuntimeError: downgrade failure, giving up

Thank you!
Are you using a Virtual Machine?
 

Michajin

Senior Member
Oct 23, 2012
1,335
535
I tried using a PC with linux mint installed, a ubuntu live-system and lastly a ubuntu virtual machine. All returning exact same error
I just use his fireISO on a USB, it is already setup and worked perfect. I was on 7.2.4.2.

 

emma80200

New member
Mar 5, 2022
3
2
I just use his fireISO on a USB, it is already setup and worked perfect. I was on 7.2.4.2.

I did not know of this ISO. gave it a try, burned it to a USB, but ended with same results.

[2022-03-06 15:14:45.452690] Waiting for device
[2022-03-06 15:14:52.837378] Found port = /dev/ttyACM0
[2022-03-06 15:14:52.892900] Handshake
[2022-03-06 15:14:52.913387] Load payload from ../brom-payload/pl/pl.bin = 0x3A04 bytes
[2022-03-06 15:14:55.409614] All good
[2022-03-06 15:14:55.904632] Check device_type_id
[2022-03-06 15:14:55.904812] Detected sheldonp (A265XOI9586NML)
[2022-03-06 15:14:55.904884] Check GPT
[2022-03-06 15:14:56.433151] gpt_parsed = {'lk': (1024, 2048), 'tee1': (3072, 10240), 'tee2': (13312, 10240), 'boot': (23552, 32768), 'recovery': (56320, 32768), 'logo': (89088, 7168), 'kb': (96256, 2048), 'dkb': (98304, 2048), 'MISC': (100352, 2048), 'vendor': (102400, 307200), 'system': (409600, 3072000), 'cache': (3481600, 1048576), 'userdata': (4530176, 10743391), '': (0, 1)}
[2022-03-06 15:14:56.433294] Check boot0
[2022-03-06 15:14:56.913393] Check rpmb
[2022-03-06 15:14:56.944796] Downgrade rpmb
[2022-03-06 15:14:56.945073] Recheck rpmb
Traceback (most recent call last):
File "/root/Desktop/kamakiri/modules/main.py", line 137, in <module>
main(dev)
File "/root/Desktop/kamakiri/modules/main.py", line 76, in main
raise RuntimeError("downgrade failure, giving up")
RuntimeError: downgrade failure, giving up
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Bash:
    aax-eu.amazon-adsystem.com
    ab9hgnqkqtwh.eu.api.amazonvideo.com
    api.amazon.com
    api.github.com
    arcus-uswest.amazon.com
    aviary.amazon.de
    beb3d20a-dnsotls-ds.metric.gstatic.com
    cad9828c-dnsotls-ds.metric.gstatic.com
    cdn-gl.imrworldwide.com
    config.ioam.de
    d3h5bk8iotgjvw.cloudfront.net
    dcape-na.amazon.com
    det-ta-g7g.amazon.com
    device-messaging-na.amazon.com
    device-metrics-us.amazon.com
    dp-discovery-na-ext.amazon.com
    dp-gw-na.amazon.com
    freetimecaptiveportal.com
    ftv-smp.ntp-fireos.com
    ktpx-eu.amazon.com
    mas-ext-eu.amazon.com
    mas-sdk.amazon.com
    mobile-data.onetrust.io
    msh.amazon.co.uk
    prod.amazoncrl.com
    prod.us-east-1.sonar.prime-video.amazon.dev
    softwareupdates.amazon.com
    suggestqueries.google.com
    unagi-eu.amazon.com
    usji9q-dnsotls-ds.metric.gstatic.com
    wl.amazon-dss.com


    I am sure they may be different based on the region.
    1
    you must have the FireOS version required in the first post.
    You need to have a linux live system or a installed linux beacause the exploit need some installed packages which is unavailable in wsl.
    post says FireOs < 7.2.7.3 but My FireOs is 7.6.x.x
    Am i Out of luck? Or still i have chance
    cause i just installed Linux and downloaded all the file but i failed to check the Fireos Earlier. Or is there any Way to downgrade I googled that Amazon has stopped Downgrading FireOs.
    1
    (root or future downgrade or install Los)
    you can't do this if you install the latest amzn firmware
  • 40
    Read this whole guide before starting.
    This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon).

    NOTE: FireOS < 7.2.7.3 required

    NOTE: This process does not require you to open your device.

    What you need:
    • A Linux installation or live-system
    • A micro-USB cable

    Install python3, PySerial, PyUSB, adb, fastboot. For Debian/Ubuntu something like this should work:
    • sudo apt update
    • sudo add-apt-repository universe
    • sudo apt install python3 python3-serial python3-usb adb fastboot dos2unix

    Make sure ModemManager is disabled or uninstalled:
    • sudo systemctl stop ModemManager
    • sudo systemctl disable ModemManager

    NOTE: If you have issues running the scripts, you might have to run them using sudo.
    Also try using different USB-ports (preferably USB-2.0-ports)


    1. Extract the attached zip-file "kamakiri-sheldon-1.0.zip" and open a terminal in that directory.

    2. Start the script:
    • sudo ./bootrom-step.sh
    It should now say Waiting for device.

    3. Plug in the stick (powered off) and wait for the script to finish.
    If it fails at some point, stop it and restart the process from step 2.

    4. Your device should now reboot into unlocked fastboot state.

    5. Run:
    • ./fastboot-step.sh

    6. Wait for the device to reboot into TWRP.

    7. Use TWRP to flash custom ROMs, Magisk etc.

    NOTE: Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit, your device will likely not boot anymore (unless you flashed a signed image). TWRP will patch recovery/boot-images on the fly.

    NOTE: NEVER erase Preloader, otherwise you’ll hard brick the device and you won’t be able to unbrick it (since bootrom isn’t accessible).

    Important information

    Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

    TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

    For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

    It is still advised to disable OTA.

    special thanks to @Sus_i for all the testing and support.

    Contributors
    @xyz`
    @k4y0z
    @Rortiz2
    @t0x1cSH
    7
    Yeah, probably just needs a more recent FireOS installed the TZ in kamakiri is from 7.2.4.9
    Had a look into all fw bin's, TZ is the same until the newest 7.2.7.3 got an updated one...

    @etami @yacinecino @Tech0308 and all other people with the netflix/disney error):
    Can you provide more Information, i.e. what kind of stick (sheldon or sheldonp) and the installed fireOS, please!?
    Make sure (check in stettings) that the stick hasn't got an update already, because the latest OS will need the updated TZ.

    FYI, disable updates with:

    Code:
    adb shell
    su
    pm disable com.amazon.device.software.ota
    pm disable com.amazon.device.software.ota.override
    pm disable com.amazon.tv.forcedotaupdater.v2
    exit
    exit

    Maybe someone of you with a sheldonp device can install 7.2.4.9 from here, without to flash magisk behind the OS update please, to see if it works?

    Users with sheldon can flash this too, but you need to change this prop first from twrp shell:
    Code:
    adb shell
    resetprop ro.product.device sheldonp
    exit
    4
    @k4y0z will a similar unlocking method be used for the Max once we receive the 7.2.7.3 update?
    No, the Max isn't vulnerable to the preloader-exploit
    3
    @Sus_i and @bloot and @Tech0308 and @Rortiz2 just to say all your painstaking coaching and my reading paid off (for me anyway😊) Instead of magisk, flashed the older 7.2.4.2/2907 update (from before ota update processes became protected) and set LM to block updates. It also fixed the issues with Netflix, Disney etc. Will look to flash Lineage custom rom sometime, now that I know how, and also put Linux on one of my laptops. Thanks heaps!

    Open TWRP, then mount /system, go to file explorer, go to navigate to priv-app and delete the folder
    "com.amazon.device.software.ota"
    Usually you should be good to go now, but goto /data/app and check for same folder (it will have something as suffix) if its present then delete it, your ota should be blocked.
    @SweenWolf thanks for your suggested fix . . . appreciate your work (and that of your good mate TDUK😊) LM and Debloat Tool are must-haves. This other way to block updates, is it somehow more permanent or safer than thru LM or Debloat Tool?
    3
    I have the same problem since I flashed only TWRP alone and didn't installed anything on it just to be sure that my sheldon don't update ,Now any application who try to check DRM on stock firmware cause a bug and a reboot of the system. like netflix and disney+ or live tv with DRM..
    Could be that this is TZ related...
    We saw the same on mantis 4k fireTV stick, hangs and wont play if the TZ image on tee partition is too old compared to the installed fireOS version. Anyways, your problem sounds different to @Tech0308 problem.

    @Tech0308 You don't see this without a magisk install, then everything plays fine?