[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 3 and Fire TV Stick Lite (sheldon/p)

Search This thread

ChriMo

Senior Member
Oct 13, 2014
462
121
You can try an app for your phone like 'Remote ADB Shell' or something similar...
I'm mainly on Win10 and MX-Linux. So on Win10 I tried Minimal ADB and Fastboot and it seems to work
c:\Minimal ADB and Fastboot>adb connect 192.168.1.x:5555
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
connected to 192.168.1.x:5555

c:\Minimal ADB and Fastboot>adb devices
List of devices attached
192.168.1.x:5555 unauthorized
 
  • Like
Reactions: Sus_i

Forty7.

New member
Sep 15, 2022
3
0
I successfully flashed it but now I get after 2-3 minutes a greyscreen/blackscreen and I cannot do anything. To use it again I have to unplug it and plug it in again. Can you help me with that problem?
 

ChriMo

Senior Member
Oct 13, 2014
462
121
Shi*! Two weeks ago I got a sheldon with new 2022 remote (4 stream service buttons) on offer for € 19,99 in a local chain store and successfully rooted/flashed it (DSN number G071CQ132062xxxx). I'm fascinated about Lineage OS 18.1 with Kodi on this device. So today I went in the same store to get two sheldom (same package and content, DSN G071CQ152287xxxx) again on offer for € 19,99 (before maybe for a week they where 29,99).

Was looking very forward to two other De-Googled sheldon but then this:
Code:
sudo ./bootrom-step.sh
[2022-10-01 18:57:31.671503] Waiting for device
[2022-10-01 18:57:43.102308] Found port = /dev/ttyACM0
[2022-10-01 18:57:43.126473] Handshake
[2022-10-01 18:57:43.152696] Load payload from ../brom-payload/pl/pl.bin = 0x3A04 bytes
Traceback (most recent call last):
  File "/media/.../firetv-sheldon/modules/main.py", line 137, in <module>
    main(dev)
  File "/media/.../firetv-sheldon/modules/main.py", line 25, in main
    load_pl_payload(dev)
  File "/media/.../firetv-sheldon/modules/load_payload.py", line 47, in load_pl_payload
    dev.send_da(0x40001000, len(payload), 0, payload)
  File "/media/.../firetv-sheldon/modules/common.py", line 342, in send_da
    self.check(self.read(2), to_bytes(0, 2))
  File "/media/.../firetv-sheldon/modules/common.py", line 103, in check
    raise RuntimeError("ERROR: Serial protocol mismatch, expected {} got {}".format(gold.hex(), test.hex()))
RuntimeError: ERROR: Serial protocol mismatch, expected 0000 got 2001
So unfortunately it seems getting more rootable sheldon becomes near impossible.
Just to warn others - not sure if the DSN number (with barcode below the UPC Code) is a good indication but in my case it seems so. Maybe others can confirm?
So now I need to see if I can bring back the two > 7.2.7.3 sheldons (will not open the second one to try) and maybe see if older DSN are there, but it seems unlikely.
So adios making more old TVs smart :-((((
 

Rortiz2

Senior Member

mitraglia

New member
Aug 7, 2014
1
0
Read this whole guide before starting.
This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon).

NOTE: FireOS < 7.2.7.3 required

NOTE: This process does not require you to open your device.

What you need:
  • A Linux installation or live-system
  • A micro-USB cable

Install python3, PySerial, PyUSB, adb, fastboot. For Debian/Ubuntu something like this should work:
  • sudo apt update
  • sudo add-apt-repository universe
  • sudo apt install python3 python3-serial python3-usb adb fastboot dos2unix

Make sure ModemManager is disabled or uninstalled:
  • sudo systemctl stop ModemManager
  • sudo systemctl disable ModemManager

NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)


1. Extract the attached zip-file "kamakiri-sheldon-1.0.zip" and open a terminal in that directory.

2. Start the script:
  • sudo ./bootrom-step.sh
It should now say Waiting for device.

3. Plug in the stick (powered off) and wait for the script to finish.
If it fails at some point, stop it and restart the process from step 2.

4. Your device should now reboot into unlocked fastboot state.

5. Run:
  • ./fastboot-step.sh

6. Wait for the device to reboot into TWRP.

7. Use TWRP to flash custom ROMs, Magisk etc.

NOTE: Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit, your device will likely not boot anymore (unless you flashed a signed image). TWRP will patch recovery/boot-images on the fly.

NOTE: NEVER erase Preloader, otherwise you’ll hard brick the device and you won’t be able to unbrick it (since bootrom isn’t accessible).

Important information

Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

It is still advised to disable OTA.

special thanks to @Sus_i for all the testing and support.

Contributors
@xyz`
@k4y0z
@Rortiz2

I have a 2nd generation fire stick ... can I use this system?
Read this whole guide before starting.
This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon).

NOTE: FireOS < 7.2.7.3 required

NOTE: This process does not require you to open your device.

What you need:
  • A Linux installation or live-system
  • A micro-USB cable

Install python3, PySerial, PyUSB, adb, fastboot. For Debian/Ubuntu something like this should work:
  • sudo apt update
  • sudo add-apt-repository universe
  • sudo apt install python3 python3-serial python3-usb adb fastboot dos2unix

Make sure ModemManager is disabled or uninstalled:
  • sudo systemctl stop ModemManager
  • sudo systemctl disable ModemManager

NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)


1. Extract the attached zip-file "kamakiri-sheldon-1.0.zip" and open a terminal in that directory.

2. Start the script:
  • sudo ./bootrom-step.sh
It should now say Waiting for device.

3. Plug in the stick (powered off) and wait for the script to finish.
If it fails at some point, stop it and restart the process from step 2.

4. Your device should now reboot into unlocked fastboot state.

5. Run:
  • ./fastboot-step.sh

6. Wait for the device to reboot into TWRP.

7. Use TWRP to flash custom ROMs, Magisk etc.

NOTE: Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit, your device will likely not boot anymore (unless you flashed a signed image). TWRP will patch recovery/boot-images on the fly.

NOTE: NEVER erase Preloader, otherwise you’ll hard brick the device and you won’t be able to unbrick it (since bootrom isn’t accessible).

Important information

Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

It is still advised to disable OTA.

special thanks to @Sus_i for all the testing and support.

Contributors
@xyz`
@k4y0z
@Rortiz2
@t0x1cSH
 

Wolverine86mi

Member
Jan 14, 2020
5
2
hello everyone I would like to return to stock including recovery how should I proceed thanks to those who will help me
 

Miguel_hrvs

New member
Oct 4, 2022
2
2
Like others said, buying new tv sticks unpatched is becoming impossible. I bought two new ones and I get the serial protocol mismatch error, expected 0000 got 2001. We will need to find a new way to unlock the bootloader.
 

ozfunghi

Member
Jun 6, 2016
25
12
Haven't been keeping track of this thread for some months now. I think i came across a post that stated the last version still doesn't have Netflix or casting working, but now i can't seem to find the post anymore. It's a good thing i found my Fire stick for only 19 euro, because otherwise it wouldn't have been worth the hastle compared to a Mi TV stick, lol.

Anyway, i have Netflix working via the Kodi app. It's a bit less flashy, but it works and that's the main thing. I followed this walkthrough and though it wasn't written for Android TV, most of the steps explained were close enough to how it was presented in order to figure out what to do. https://kodibeginner.com/install-netflix-kodi/
I installed the latest Kodi from the google play store, so no shady website had to be visited nor did Aptoide have to be downloaded.

Hope that helps some people who might be on the fence (or already made the jump like myself only to be disappointed to find out Netflix still isn't working 6 months later). For me Netflix not working was kind of a deal breaker, especially with casting also not working, so i'm glad now the Fire stick can actually be usefull.

I won't be upgrading/updating the OS unless either Netflix or casting has been fixed, i don't feel it's worth going through all that again for some minor improvements. I actually wanted to use the Fire stick as a genuine Android TV device, not as a tinkering hobby project. It now serves its purpose for what it is. I'm running Kodi/Netflix, Stremio, some local TV stations official apps (VRTnu, VTMgo, Auvio...) and Spotify. All works well. I'm thankful for the work that has been put into the OS, even though it would have been nice to have those extra features working. But for me, it does what it needs to do.
 

RealPsygnosis

Senior Member
Oct 1, 2008
255
19
Taranto
OnePlus 7T
Goodevening,
My updated sheldon device was sent to RMA and they will give me another one, can I root it without even attach for the first time on tv? So I can avoid update?
After the root and install of twrp can I install an old an better version of fireOS, what do u advice?
 

Dismal.

Member
May 23, 2022
13
2
Hey there this is awesome. I have just ordered one and was wondering if I need to complete the first time setup. I don't want to turn it on and have it update leading to it being useless. I bought it new on amazon for 19.99 so is it going to be compatible since it hasn't been powered on? Or is there a chance it has been updated
 

ozfunghi

Member
Jun 6, 2016
25
12
Hey there this is awesome. I have just ordered one and was wondering if I need to complete the first time setup. I don't want to turn it on and have it update leading to it being useless. I bought it new on amazon for 19.99 so is it going to be compatible since it hasn't been powered on? Or is there a chance it has been updated
If it comes directly from Amazon there is a chance the newer firmware is already installed on the device and you will not be able to take advantage of the exploit.
 
  • Like
Reactions: Sus_i

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Hello guys. Could you tell me?
    How do i get out of keep system read only screen TWRP, without mouse or keyboard?

    My remote control doesn't work.

    Thank you very much for your help.
    you can use these

    adb shell
    twrp wipe system
    twrp wipe data
    twrp wipe cache
    exit
    adb push lineage-18.1-20220505-UNOFFICIAL-sheldon.zip /sdcard/
    adb push open_gapps-arm-11.0-tvmini-20220215.zip /sdcard/
    adb shell
    twrp install /sdcard/lineage-18.1-20220505-UNOFFICIAL-sheldon.zip
    twrp install /sdcard/open_gapps-arm-11.0-tvmini-20220215.zip
    reboot

    if they apply to you. also you can get this here

    1
    Ubuntu can't see firestick if I just plugged right into HDMI video card port, its saying keep waiting for device so I think there has to some type of capture card for it?
    Try again with the sticks usb port via usb data cable... ;)
    1
    Try again with the sticks usb port via usb data cable... ;)
    [2022-11-03 17:55:52.196517] Waiting for device
    [2022-11-03 17:56:13.464833] Found port = /dev/ttyACM0
    [2022-11-03 17:56:13.503817] Handshake
    [2022-11-03 17:56:13.524858] Load payload from ../brom-payload/pl/pl.bin = 0x3A04 bytes
    [2022-11-03 17:56:15.069227] All good
    [2022-11-03 17:56:15.559029] Check device_type_id
    [2022-11-03 17:56:15.559089] Wrong device detected: AKPGW064GI9HE


    thats what Im getting right now

    my Model is g070vm2421171k6h
    1
    [2022-11-03 17:55:52.196517] Waiting for device
    [2022-11-03 17:56:13.464833] Found port = /dev/ttyACM0
    [2022-11-03 17:56:13.503817] Handshake
    [2022-11-03 17:56:13.524858] Load payload from ../brom-payload/pl/pl.bin = 0x3A04 bytes
    [2022-11-03 17:56:15.069227] All good
    [2022-11-03 17:56:15.559029] Check device_type_id
    [2022-11-03 17:56:15.559089] Wrong device detected: AKPGW064GI9HE


    thats what Im getting right now

    my Model is g070vm2421171k6h
    Nice. Seems you've got a vulnerable 4k stick...
    If you grab/use the latest zip for mantis, it should work fine :)

    Edit: Btw, you need no short at all, use the sheldon guide together with the mantis zip...
    1
    The bootrom log at 115200 looks fine, but the other log failed somehow.
    I don't think that the bootloader is gone, as you said kamakiri bootrom-step worked fine, same as GPT fix, so at least the bootloader (MTK preloader and LK) is 100% there and the log should work fine.
    I would check the UART and USB/serial settings, cable connections and try again...
    Maybe disconnect the tx cable from the stick, try only with rx pad.
    You are right, disconnected TX wire and the stick started talking at 921K, here is the log, the file contains two boot sequences, line 539 is the point where self-restart happens
  • 38
    Read this whole guide before starting.
    This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon).

    NOTE: FireOS < 7.2.7.3 required

    NOTE: This process does not require you to open your device.

    What you need:
    • A Linux installation or live-system
    • A micro-USB cable

    Install python3, PySerial, PyUSB, adb, fastboot. For Debian/Ubuntu something like this should work:
    • sudo apt update
    • sudo add-apt-repository universe
    • sudo apt install python3 python3-serial python3-usb adb fastboot dos2unix

    Make sure ModemManager is disabled or uninstalled:
    • sudo systemctl stop ModemManager
    • sudo systemctl disable ModemManager

    NOTE: If you have issues running the scripts, you might have to run them using sudo.
    Also try using different USB-ports (preferably USB-2.0-ports)


    1. Extract the attached zip-file "kamakiri-sheldon-1.0.zip" and open a terminal in that directory.

    2. Start the script:
    • sudo ./bootrom-step.sh
    It should now say Waiting for device.

    3. Plug in the stick (powered off) and wait for the script to finish.
    If it fails at some point, stop it and restart the process from step 2.

    4. Your device should now reboot into unlocked fastboot state.

    5. Run:
    • ./fastboot-step.sh

    6. Wait for the device to reboot into TWRP.

    7. Use TWRP to flash custom ROMs, Magisk etc.

    NOTE: Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit, your device will likely not boot anymore (unless you flashed a signed image). TWRP will patch recovery/boot-images on the fly.

    NOTE: NEVER erase Preloader, otherwise you’ll hard brick the device and you won’t be able to unbrick it (since bootrom isn’t accessible).

    Important information

    Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

    TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

    For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

    It is still advised to disable OTA.

    special thanks to @Sus_i for all the testing and support.

    Contributors
    @xyz`
    @k4y0z
    @Rortiz2
    @t0x1cSH
    6
    Yeah, probably just needs a more recent FireOS installed the TZ in kamakiri is from 7.2.4.9
    Had a look into all fw bin's, TZ is the same until the newest 7.2.7.3 got an updated one...

    @etami @yacinecino @Tech0308 and all other people with the netflix/disney error):
    Can you provide more Information, i.e. what kind of stick (sheldon or sheldonp) and the installed fireOS, please!?
    Make sure (check in stettings) that the stick hasn't got an update already, because the latest OS will need the updated TZ.

    FYI, disable updates with:

    Code:
    adb shell
    su
    pm disable com.amazon.device.software.ota
    pm disable com.amazon.device.software.ota.override
    pm disable com.amazon.tv.forcedotaupdater.v2
    exit
    exit

    Maybe someone of you with a sheldonp device can install 7.2.4.9 from here, without to flash magisk behind the OS update please, to see if it works?

    Users with sheldon can flash this too, but you need to change this prop first from twrp shell:
    Code:
    adb shell
    resetprop ro.product.device sheldonp
    exit
    4
    @k4y0z will a similar unlocking method be used for the Max once we receive the 7.2.7.3 update?
    No, the Max isn't vulnerable to the preloader-exploit
    3
    @Sus_i and @bloot and @Tech0308 and @Rortiz2 just to say all your painstaking coaching and my reading paid off (for me anyway😊) Instead of magisk, flashed the older 7.2.4.2/2907 update (from before ota update processes became protected) and set LM to block updates. It also fixed the issues with Netflix, Disney etc. Will look to flash Lineage custom rom sometime, now that I know how, and also put Linux on one of my laptops. Thanks heaps!

    Open TWRP, then mount /system, go to file explorer, go to navigate to priv-app and delete the folder
    "com.amazon.device.software.ota"
    Usually you should be good to go now, but goto /data/app and check for same folder (it will have something as suffix) if its present then delete it, your ota should be blocked.
    @SweenWolf thanks for your suggested fix . . . appreciate your work (and that of your good mate TDUK😊) LM and Debloat Tool are must-haves. This other way to block updates, is it somehow more permanent or safer than thru LM or Debloat Tool?
    3
    I have the same problem since I flashed only TWRP alone and didn't installed anything on it just to be sure that my sheldon don't update ,Now any application who try to check DRM on stock firmware cause a bug and a reboot of the system. like netflix and disney+ or live tv with DRM..
    Could be that this is TZ related...
    We saw the same on mantis 4k fireTV stick, hangs and wont play if the TZ image on tee partition is too old compared to the installed fireOS version. Anyways, your problem sounds different to @Tech0308 problem.

    @Tech0308 You don't see this without a magisk install, then everything plays fine?