[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 3 and Fire TV Stick Lite (sheldon/p)

Search This thread

kirpeace

Senior Member
Dec 26, 2010
585
39
too bad I saw the post after update. It immediately started updating on first boot. and now it is on 7.2.9.2
 
  • Sad
Reactions: CAPSITUP

ChriMo

Senior Member
Oct 13, 2014
466
121
What you need:
  • A Linux installation or live-system
I would suggest to edit to "A Linux installation or live-system using systemd as Init Software".
I almost only use MX Linux (based on Debian with SysV init presetting).
After trying to disable/uninstall ModemManager without success in MX and having an error message mentioning systemd, instead of changing to systemd in MX I created a live-system with Linux Mint and everything worked. Since the connected external device via USB lost power by my accidental removal I suggest to save all necessary settings (WLAN, shell commands, etc.) to a txt file or maybe creating a persistent system. In the second attempt all worked well and sheldon booted into TWRP.

Since I did not connect the remote beforehand and have no USB Y-splitter for an external keyboard I have no idea how to possibly control the TWRP GUI buttons. I did the ROM installation over adb/shell, but so far are not able to BT-connect the remote neither in LineageOS. I do not think wiping cache or other adb/shell commands could solve the connection problems?

EDIT regarding control in TWRP I found this in LineageOS thread:
You need OTG with mouse to control TWRP, remote will not work.
Or you can use TWRP commandline using adb to perform actions
Would be interesting to hear which USB Y-splitter or other solution works well for external USB Mouse connection.

EDIT2: I finally was able to activate the remote in LineageOS after several attempts and using this 3 button method. It seems everytime I wanted to boot into a clean LineageOS I needed to boot into a fresh live-system with Linux Mint and restart all the commands from scratch. Otherwise with sudo ./bootrom-step.sh the Check GPT would raise RuntimeError("read fail")
adb devices etc. will not work

Is there any shorter way (tutorial) to reboot into TWRP without the remote working?
 
Last edited:
Mar 2, 2017
11
1
Samsung Galaxy A52s 5G
Read this whole guide before starting.
This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon).

NOTE: FireOS < 7.2.7.3 required

NOTE: This process does not require you to open your device.

What you need:
  • A Linux installation or live-system
  • A micro-USB cable

Install python3, PySerial, PyUSB, adb, fastboot. For Debian/Ubuntu something like this should work:
  • sudo apt update
  • sudo add-apt-repository universe
  • sudo apt install python3 python3-serial python3-usb adb fastboot dos2unix

Make sure ModemManager is disabled or uninstalled:
  • sudo systemctl stop ModemManager
  • sudo systemctl disable ModemManager

NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)


1. Extract the attached zip-file "kamakiri-sheldon-1.0.zip" and open a terminal in that directory.

2. Start the script:
  • sudo ./bootrom-step.sh
It should now say Waiting for device.

3. Plug in the stick (powered off) and wait for the script to finish.
If it fails at some point, stop it and restart the process from step 2.

4. Your device should now reboot into unlocked fastboot state.

5. Run:
  • ./fastboot-step.sh

6. Wait for the device to reboot into TWRP.

7. Use TWRP to flash custom ROMs, Magisk etc.

NOTE: Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit, your device will likely not boot anymore (unless you flashed a signed image). TWRP will patch recovery/boot-images on the fly.

NOTE: NEVER erase Preloader, otherwise you’ll hard brick the device and you won’t be able to unbrick it (since bootrom isn’t accessible).

Important information

Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

It is still advised to disable OTA.

special thanks to @Sus_i for all the testing and support.

Contributors
@xyz`
@k4y0z
@Rortiz2
@t0x1cSH
Sir please provide TWRP LINK
 

aospray

Senior Member
Feb 7, 2017
59
19
Would be interesting to hear which USB Y-splitter or other solution works well for external USB Mouse connection.
To use an external mouse, I use an OTG adapter that looks like this:

iu


Is there any shorter way (tutorial) to reboot into TWRP without the remote working?
Yeah, I'd like to know this as well without having to use an OTG adapter. Not really a big deal since updates do not occur very often.
 
  • Like
Reactions: ChriMo

ChriMo

Senior Member
Oct 13, 2014
466
121
We can also run the boot-recovery script (from the kamakiri folder) and connect the stick via usb to boot straight into TWRP.
I was thinking about a solution of "local update" meaning when the ROM.zip is saved in a certain folder with a certain name in to the Stick memory an update start command (booting into TWRP + flashing update) from the Lineage OS TV + remote could be given, without the need to connect to PC/Linux.
 
  • Like
Reactions: aospray

Sus_i

Senior Member
Apr 9, 2013
1,799
775
I was thinking about a solution of "local update" meaning when the ROM.zip is saved in a certain folder with a certain name in to the Stick memory an update start command (booting into TWRP + flashing update) from the Lineage OS TV + remote could be given, without the need to connect to PC/Linux.
We can do all this with adb / adb shell via network connection, i.e. adb push the file and then place the recovery commands, like this:
Code:
adb shell
su
echo "--update_package=/path/to/zipfile" > /cache/recovery/command
echo "--wipe_cache" >> /cache/recovery/command
reboot recovery
TWRP will boot/flash the zip/wipe cache/reboot to the OS.

You may be able to use a terminal app or scripting via tasker in order to place the cache recovery commands... but that is a bit overkill if you ask me.

I guess @Rortiz2 could add such an updater app to lineage, but that is also a bit overkill if you ask me :p
 
  • Like
Reactions: ChriMo and aospray

ChriMo

Senior Member
Oct 13, 2014
466
121
We can do all this with adb / adb shell via network connection, i.e. adb push the file and then place the recovery commands, like this: ...
TWRP will boot/flash the zip/wipe cache/reboot to the OS.
Thx but I'm sorry I do not know how to exactly apply. Pushing the file to sheldon should be ok.
But where to place / execute the commands in sheldon (with no keyboard/mouse attached) and no third party PC available?
As said I'm fine doing this but I wonder if family/friends will be able to do without my help (if I donate a Stick to them).
 

Sus_i

Senior Member
Apr 9, 2013
1,799
775
Pushing the file to sheldon should be ok.
How do you push the file to sdcard?
If you are able to push the update.zip with adb to sheldons sdcard, then you may also able to type the few adb commands from my last posting and the TWRP commands will be at the right place. Only thing to adjust is the path to the update.zip on /sdcard
 

ChriMo

Senior Member
Oct 13, 2014
466
121
If you are able to push the update.zip with adb to sheldons sdcard, then you may also able to type the few adb commands from my last posting and the TWRP commands will be at the right place. Only thing to adjust is the path to the update.zip on /sdcard
I'm using MyPhoneExplorer over WLAN to move files and it can't execute ADB AFAIK. But I never used ADB over WLAN (always over USB-Cable): I looked and this seems to be the command (can't test now):
Code:
adb connect ip-address-of-sheldon:5555
Interesting
 

aospray

Senior Member
Feb 7, 2017
59
19
We can do all this with adb / adb shell via network connection, i.e. adb push the file and then place the recovery commands, like this:
Code:
adb shell
su
echo "--update_package=/path/to/zipfile" > /cache/recovery/command
echo "--wipe_cache" >> /cache/recovery/command
reboot recovery
TWRP will boot/flash the zip/wipe cache/reboot to the OS.

You may be able to use a terminal app or scripting via tasker in order to place the cache recovery commands... but that is a bit overkill if you ask me.

I guess @Rortiz2 could add such an updater app to lineage, but that is also a bit overkill if you ask me :p
Thanks Sus_i! These commands were exactly what I was looking for!

Will try this on the next LOS update.
 
  • Like
Reactions: Sus_i

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Hi,

    Successfully installed on:

    G071EL0214260M6T (sheldonp PS7242)
    G071EL0214260M64 (sheldonp PS7242)

    Recently bought om Amazon...

    Thx for sharing.
    1
    I'm going to try but just wondering if taking the remote from a sheldonp and registering it on a sheldon: is then the sheldon basically a sheldonp, meaning the remote is the only difference between the two? So the Sticks are the same?

    EDIT/ANSWER:
    Both sticks share the same hardware, only the remote and the installed rom is different.
    So the installed ROM probably has an additional part for the IR/infrared remote setup depending on the HDMI-TV-device.

    3th DSN REPORT UPDATE
    • sheldon mid Sept. 2022 UE Central Europe, DSN G071CQ13206..... China, unlocking OK successful
    • sheldon End. Oct. 2022 MW Central Europe, DSN G071CQ13207..... China, unlocking OK successful
    • sheldon begin Oct. 2022 UE Central Europe, DSN G071CQ15228..... China, unlocking UNSUCCESSFULL
    • sheldonp mid. Oct. 2022 MW Central Europe, DSN G071EL1520 China, not on sale / not buyed
    • sheldonp mid. Oct. 2022 MW Central Europe, DSN G4N1EL0614 Vietnam/China, not on sale / not buyed
    • sheldonp mid. Nov. 2022 MW Central Europe, DSN G071EL13141..... China, unlocking OK successful
    I got a sheldonp on Black Friday sale burried under a lot of DSN G071EL1520..... devices. But one refurbished reclosed primitely with scotch had an even older DSN - I think G071EL10... Did not take that as I hoped the one above would work as it did.
    After unlocking+TWRP I went into Fire OS 7.2.4.2 to setup the infrared remote for the TV and it went well (Samsung). Now I need to see to backup this Fire OS version in case I need it for IR setup/changes. Did not bother on the sheldon devices for a backup. Might such a backup from this sheldonp also work on a sheldon stick in combination with the sheldonp remote?
    BTW Fire OS tried to update and went into TWRP, I just rebooted so it seems the update will not work. Need to see what the correct update/reboot process is with TWRP, maybe before I go on to flash Lineage OS TV.
    1
    So the installed ROM probably has an additional part for the IR/infrared remote setup depending on the HDMI-TV-device.
    Probably,
    at least the sticks name and the DTS AC3 stuff in the settings is different between sheldon/sheldonp roms.
    Might such a backup from this sheldonp also work on a sheldon stick in combination with the sheldonp remote?
    Most likely it will work, but could be that the BT numbering is causing an issue and the remote needs to be paired again. Maybe the remote needs a reset too.
    BTW Fire OS tried to update and went into TWRP, I just rebooted so it seems the update will not work. Need to see what the correct update/reboot process is with TWRP, maybe before I go on to flash Lineage OS TV.
    Update fails because the fireOS only downloads a diff partial update at the first try, the second attempt might work better...
    1
    Update fails because the fireOS only downloads a diff partial update at the first try, the second attempt might work better...
    Don't know if using Mobile Hotspot (speed not very high) is influencing but so far the Update failed at least 5 times. I will not care because only the remote IR setup is important and I guess this will not change/improve with new fireOS Updates.

    NTFS/ext4 USB Sticks on my microUSB to USB-C OTG Adapter seem to be not recognized in FireOS using ES File Explorer (ADB-Debugging is on). In Lineage OS this worked. FireOS wants to format them in FAT32. Also Mouse over USB does not work in FireOS (in TWRP it works). So need to see if using USB-Space will work to move a TWRP backup away from internal space. Directly saving from TWRP to USB would also be desirable. I will see to find a Stick I can format in FAT32.
    A 4 GB FAT32 Stick was not recognized or I was not able to mount it in FireOS; TWRP was able to see it.

    EDIT just for the record: BT-Keyboard Layout (Language) is also not recognized or changeable in FireOS (like Lineage OS). The lack of ML support is surprising to me.

    EDIT2 I had a hard time going into fastboot mode to flash LineageOS: I did a factory reset in FireOS (after having done a TWRP backup to USB-Stick). Then in MX Linux systemd I started the first steps until "sudo ./bootrom-step.sh" which shows "Waiting for device". When I connect the USB cable the FireStick went into TWRP and said "reboot in 5 sec." and then it did boot FireOS. Only after a while I discovered the USB-OTG adapter should be the culprit, as when connected directly the kamakiri script returned to work.

    EDIT3 so have now LineageOS on the sheldonp, but since I had difficulties to connect the remote, I removed the batteries and then BT connecting worked. However the IR settings for the TV done in FireOS seem to be lost, when batteries are removed. Huge dealbreaker, because also battery changing will cause this. Need to look how others with sheldonp succeded using the IR remote under LineageOS.
    1
    Thats a common issue and usually PC releated. You may need to update the fastboot package...
    I understand, but I've used the exact method described in post #1 with an Ubuntu 22.04 live stick and that worked flawlessly when I rooted the stick for the first time (just commented lines 73-76 in main.py).
    But following your suggestion, to be sure I have tried:

    1) another pc
    2) using a FireISO stick instead of Ubuntu

    They all work the same (fine), but no fastboot appear. The white logo remains for about 2 minutes and then the stick self-reboot (judging on what happens on the tv) in a bootloop.

    But kamakiri bootrom-step.sh still works and flash its images, so maybe that a more consistent portion of the emmc could be flashed to revive the stick, at least I think ... am I wrong?
  • 40
    Read this whole guide before starting.
    This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon).

    NOTE: FireOS < 7.2.7.3 required

    NOTE: This process does not require you to open your device.

    What you need:
    • A Linux installation or live-system
    • A micro-USB cable

    Install python3, PySerial, PyUSB, adb, fastboot. For Debian/Ubuntu something like this should work:
    • sudo apt update
    • sudo add-apt-repository universe
    • sudo apt install python3 python3-serial python3-usb adb fastboot dos2unix

    Make sure ModemManager is disabled or uninstalled:
    • sudo systemctl stop ModemManager
    • sudo systemctl disable ModemManager

    NOTE: If you have issues running the scripts, you might have to run them using sudo.
    Also try using different USB-ports (preferably USB-2.0-ports)


    1. Extract the attached zip-file "kamakiri-sheldon-1.0.zip" and open a terminal in that directory.

    2. Start the script:
    • sudo ./bootrom-step.sh
    It should now say Waiting for device.

    3. Plug in the stick (powered off) and wait for the script to finish.
    If it fails at some point, stop it and restart the process from step 2.

    4. Your device should now reboot into unlocked fastboot state.

    5. Run:
    • ./fastboot-step.sh

    6. Wait for the device to reboot into TWRP.

    7. Use TWRP to flash custom ROMs, Magisk etc.

    NOTE: Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit, your device will likely not boot anymore (unless you flashed a signed image). TWRP will patch recovery/boot-images on the fly.

    NOTE: NEVER erase Preloader, otherwise you’ll hard brick the device and you won’t be able to unbrick it (since bootrom isn’t accessible).

    Important information

    Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

    TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

    For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

    It is still advised to disable OTA.

    special thanks to @Sus_i for all the testing and support.

    Contributors
    @xyz`
    @k4y0z
    @Rortiz2
    @t0x1cSH
    6
    Yeah, probably just needs a more recent FireOS installed the TZ in kamakiri is from 7.2.4.9
    Had a look into all fw bin's, TZ is the same until the newest 7.2.7.3 got an updated one...

    @etami @yacinecino @Tech0308 and all other people with the netflix/disney error):
    Can you provide more Information, i.e. what kind of stick (sheldon or sheldonp) and the installed fireOS, please!?
    Make sure (check in stettings) that the stick hasn't got an update already, because the latest OS will need the updated TZ.

    FYI, disable updates with:

    Code:
    adb shell
    su
    pm disable com.amazon.device.software.ota
    pm disable com.amazon.device.software.ota.override
    pm disable com.amazon.tv.forcedotaupdater.v2
    exit
    exit

    Maybe someone of you with a sheldonp device can install 7.2.4.9 from here, without to flash magisk behind the OS update please, to see if it works?

    Users with sheldon can flash this too, but you need to change this prop first from twrp shell:
    Code:
    adb shell
    resetprop ro.product.device sheldonp
    exit
    4
    @k4y0z will a similar unlocking method be used for the Max once we receive the 7.2.7.3 update?
    No, the Max isn't vulnerable to the preloader-exploit
    3
    @Sus_i and @bloot and @Tech0308 and @Rortiz2 just to say all your painstaking coaching and my reading paid off (for me anyway😊) Instead of magisk, flashed the older 7.2.4.2/2907 update (from before ota update processes became protected) and set LM to block updates. It also fixed the issues with Netflix, Disney etc. Will look to flash Lineage custom rom sometime, now that I know how, and also put Linux on one of my laptops. Thanks heaps!

    Open TWRP, then mount /system, go to file explorer, go to navigate to priv-app and delete the folder
    "com.amazon.device.software.ota"
    Usually you should be good to go now, but goto /data/app and check for same folder (it will have something as suffix) if its present then delete it, your ota should be blocked.
    @SweenWolf thanks for your suggested fix . . . appreciate your work (and that of your good mate TDUK😊) LM and Debloat Tool are must-haves. This other way to block updates, is it somehow more permanent or safer than thru LM or Debloat Tool?
    3
    I have the same problem since I flashed only TWRP alone and didn't installed anything on it just to be sure that my sheldon don't update ,Now any application who try to check DRM on stock firmware cause a bug and a reboot of the system. like netflix and disney+ or live tv with DRM..
    Could be that this is TZ related...
    We saw the same on mantis 4k fireTV stick, hangs and wont play if the TZ image on tee partition is too old compared to the installed fireOS version. Anyways, your problem sounds different to @Tech0308 problem.

    @Tech0308 You don't see this without a magisk install, then everything plays fine?