[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 3 and Fire TV Stick Lite (sheldon/p)

Search This thread

Sus_i

Senior Member
Apr 9, 2013
1,967
903
It appears that everything loaded fine, but I get a Hacked Bootloader message on the TV screen? Any ideas what I am doing wrong? Thanks in advance!
It's all fine.
At this step you need to run: sudo ./fastboot-step.sh
Then TWRP will come up next and adb devices will show a serial.
 

disco_y2k

Senior Member
Nov 18, 2007
149
26
It's all fine.
At this step you need to run: sudo ./fastboot-step.sh
Then TWRP will come up next and adb devices will show a serial.
Thanks for the help! I have LineageOS flashed to it, but it's stuck on
It's all fine.
At this step you need to run: sudo ./fastboot-step.sh
Then TWRP will come up next and adb devices will show a serial.
Sorry, message sent before I finished. It's stuck on the LineageOS screen with the 'Start' button.

I tried...

The remote control, nothing happens, then I tried

ADB devices
and
fastboot devices

And nothing is found? How do I get past this screen?

Thanks for the help!
 

disco_y2k

Senior Member
Nov 18, 2007
149
26
Thanks, I will check it out!

Just FYI I ordered mine on Amazon on Black Friday and it was able to be flashed.
 

seacamel

Member
Dec 23, 2009
32
17
Please forgive me but I'm a complete noob as far as AFTV is concerned.
I followed all steps successfully, no errors and when I do ./fastboot.sh I get that's booted in TWRP.
I didn't flash anything (yet) because for the time being I just want root access.
But when I open X-plore on my fire stick it says "Your device seems to be not root"
What am I missing, how do I get root access?
Cheers,
Luc
 

Wheresmycar

New member
Dec 11, 2022
3
2
I'm sorry for the super basic post, but I've lurked for many days and wasted more hours than I'd care to admit trying to figure out how to unlock and root a Fire Stick 4K. Out of the box, it's running Fire OS 6.2.8.1 (NS6281/3387) and I was able to prevent it from autoupdating during setup and also disable automatic updates through ADB. I'm now running FireISO as a livecd in a VirtualBox VM, but still can't complete the first step.

Running ./bootrom-step.sh responds with "Waiting for device" and this never changes. I have set the Fire Stick to automatically be connected to the VM and it appears to be connected properly, though the script never proceeds. I have also tried various combinations of powering it on before running the script and after. I have also tried running the second script, ./fastboot-step.sh. Nothing seems to make any difference.

Thanks in advance to anyone willing to point me in the right direction!

Edit: I was able to disable updates with the first two ADB commands in post #69, but "pm disable com.amazon.tv.forcedotaupdater.v2" resulted in "Error: java.lang.SecurityException: Shell cannot change component state for com.amazon.tv.forcedotaupdater.v2/null to 2". I had also run "pm clear com.amazon.device.software.ota" to clear the update that may have been downloaded based on another site I came across while trying to figure out what to do.

Edit 2: I bought the Fire stick a couple months ago, in case that makes any difference.

Edit 3: (in reference to the original edit) running "pm disable-user --user 0 com.amazon.tv.forcedotaupdater.v2" in adb shell led to the command working.
 
Last edited:

Wolverine86mi

Member
Jan 14, 2020
8
2
hello, i can't remove the twrp, i flashed the stock firmware but it still remains. I don't have a backup, can you explain me with going back with the stock recovery
 

Sus_i

Senior Member
Apr 9, 2013
1,967
903
Hi, one question: can i use the original fire tv micro usb cable or it doesn't send data ?
Yes
Running ./bootrom-step.sh responds with "Waiting for device" and this never changes. I have set the Fire Stick to automatically be connected to the VM and it appears to be connected properly, though the script never proceeds
FireISO is fine, your Sticks OS version too.
As you know, you can follow the sheldon OP guide, but only a kamakiri.zip for mantis will work.

Question is what state or process auto connects to the VM?
It's the first boot stage called preloader which needs to be connected, just at the same second as the usb connection... a mess doing this with a VM.
hello, i can't remove the twrp, i flashed the stock firmware but it still remains. I don't have a backup, can you explain me with going back with the stock recovery
You need to flash a clean stock rom, wipe data, then boot 'hacked fastboot' and flash the boot image via fastboot (use/extract the boot img out of the stock rom).
 
  • Like
Reactions: n.sim

Wolverine86mi

Member
Jan 14, 2020
8
2
Yes

FireISO is fine, your Sticks OS version too.
As you know, you can follow the sheldon OP guide, but only a kamakiri.zip for mantis will work.

Question is what state or process auto connects to the VM?
It's the first boot stage called preloader which needs to be connected, just at the same second as the usb connection... a mess doing this with a VM.

You need to flash a clean stock rom, wipe data, then boot 'hacked fastboot' and flash the boot image via fastboot (use/extract the boot img out of the stock rom).
now I'll try, when the stick starts it tries to upgrade how can I avoid it?
 

Wheresmycar

New member
Dec 11, 2022
3
2
now I'll try, when the stick starts it tries to upgrade how can I avoid it?
On your phone, disable wifi and data and then turn on your phone's hotspot. Connect your stick to it. As soon as it connects and starts looking for the update, press the menu+back buttons simultaneously (if the stick might still have internet access through your hotspot, you could also quickly disable the hotspot immediately before pressing this key combination). It will break you out of the autoupdate process and take you to the Voice menu. Pressing the back button will let you proceed from there.
 
  • Like
Reactions: Wolverine86mi

Wheresmycar

New member
Dec 11, 2022
3
2
FireISO is fine, your Sticks OS version too.
As you know, you can follow the sheldon OP guide, but only a kamakiri.zip for mantis will work.
I had downloaded v2.0.1, but haven't yet got to a step where I do anything with it.
Question is what state or process auto connects to the VM?
It's the first boot stage called preloader which needs to be connected, just at the same second as the usb connection... a mess doing this with a VM.

You need to flash a clean stock rom, wipe data, then boot 'hacked fastboot' and flash the boot image via fastboot (use/extract the boot img out of the stock rom).
The stick only connects to my computer (and then VM) as it boots up into FireOS. I have fastboot and adb installed on my (Windows) computer from when I rooted a phone a year or two ago. Can I use those? I haven't been able to restart the computer for some time because there are too many (non-fire stick) things that are open and ongoing.

To be honest, I still don't understand how to flash anything onto the Fire Stick, including how to even install TWRP on it. I can send ADB commands to the stick over wifi, but that's about all I've been able to do with it.
 
  • Like
Reactions: Sus_i

Sus_i

Senior Member
Apr 9, 2013
1,967
903
I had downloaded v2.0.1, but haven't yet got to a step where I do anything with it.
Download rufus, then write the fireISO image to an usb storage stick.
Press whatever key applies to your PC system (F1, F2, F8, DEL or something else) to boot the usb storage...
The stick only connects to my computer (and then VM) as it boots up into FireOS.
Thats the problem. If you use the fireISO booted directly, the bootrom-step script does a handshake with the first boot-stage 'preloader'
The VM is just too slow, without the handshake in-time it won't work.
I have fastboot and adb installed on my (Windows) computer from when I rooted a phone a year or two ago. Can I use those?
Nope
I haven't been able to restart the computer for some time because there are too many (non-fire stick) things that are open and ongoing.
Stop or pause all the downloads for a while ;) :p
Jokes aside, if you keep the stick from updating, you can do the unlock anytime later.
To be honest, I still don't understand how to flash anything onto the Fire Stick, including how to even install TWRP on it. I can send ADB commands to the stick over wifi, but that's about all I've been able to do with it.
TWRP gets installed via the kamakiri scripts and you can use it via adb usb cable connection or via usb keyboard/mouse if you get an otg cable.
 
  • Like
Reactions: Wheresmycar

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    So I got the Fire TV stick to boot into TWRP. But now I dont know how to control it and push the Lineage OS image to it (i'm using Ubuntu)
    Make an adb shell, twrp wipe /system, twrp wipe data, twrp wipe dalvik, and twrp wipe cache. Be sure to avoid unplugging the device! There's no recovery when booting back to a blank system. After wiping partitions, type twrp sideload, adb sideload (rom.zip always first, gapps, Magisk, etc) and let it run the install then adb reboot.
    1
    Can someone help? Whenever I tried it, I kept getting this error.
    [2024-03-29 18:14:38.974234] Waiting for device
    [2024-03-29 18:14:50.757292] Found port = /dev/ttyACM0
    [2024-03-29 18:14:50.815828] Handshake
    [2024-03-29 18:14:50.836786] Load payload from ../brom-payload/pl/pl.bin = 0x3A04 bytes
    Traceback (most recent call last):
    File "/home/samue/Downloads/kamakiri-sheldon-1.0/kamakiri/modules/main.py", line 137, in <module>
    main(dev)
    File "/home/samue/Downloads/kamakiri-sheldon-1.0/kamakiri/modules/main.py", line 25, in main
    load_pl_payload(dev)
    File "/home/samue/Downloads/kamakiri-sheldon-1.0/kamakiri/modules/load_payload.py", line 47, in load_pl_payload
    dev.send_da(0x40001000, len(payload), 0, payload)
    File "/home/samue/Downloads/kamakiri-sheldon-1.0/kamakiri/modules/common.py", line 342, in send_da
    self.check(self.read(2), to_bytes(0, 2))
    File "/home/samue/Downloads/kamakiri-sheldon-1.0/kamakiri/modules/common.py", line 103, in check
    raise RuntimeError("ERROR: Serial protocol mismatch, expected {} got {}".format(gold.hex(), test.hex()))
    RuntimeError: ERROR: Serial protocol mismatch, expected 0000 got 2001
    It's not possible to unlock it because it is running a newer version that has been patched. That's what the error means.

    NOTE: FireOS < 7.2.7.3 required. tells you right there what version you have to be on
    1
    Hi guys,
    some time ago I rooted a Sheldon Firestick using this guide. I also disabled apks for updates and other services.
    Yesterday something very weird happend: when I powered on the firestick it shown me the "Welcome screen" as a fresh device or a factory reset. I tried to insert the wifi settings and then it started searching updates, I tried to disconect the router cable on the fly but I don't know if any updates has been installed and I shut down the firestick.
    The TWRP is still there (I saw the logo on boot up), so I hope it protected the firestick from any harmful update trick.
    I'm a bit worried about how this can happen, seems like they sent some command remotely to update or similar....

    What I should do? Try to boot up and proceed with standard use? I'm searching for an old backup to flash but by now I have no success
    Did you read the first post it tells you about updates. You can grab firmware from here Thread 'Fire TV Stick Lite/3 (sheldon/p) Firmware' https://xdaforums.com/t/fire-tv-stick-lite-3-sheldon-p-firmware.4413597/ and rename it from bin to zip and flash it in TWRP
    1
    In virtual machine will not work, there was an ISO to boot from the usb with everything ready to run the exploit.

    Can you use it witch normal archlinnux instead of the special iso? Because everytime I try to boot into it, I get this Error:

    Error Fat-FS error IO charset ASCII not found

  • 44
    Read this whole guide before starting.
    This is for the 3rd gen Fire TV Stick (sheldonp) and Fire TV Stick Lite (sheldon).

    NOTE: FireOS < 7.2.7.3 required

    NOTE: This process does not require you to open your device.

    What you need:
    • A Linux installation or live-system
    • A micro-USB cable

    Install python3, PySerial, PyUSB, adb, fastboot. For Debian/Ubuntu something like this should work:
    • sudo apt update
    • sudo add-apt-repository universe
    • sudo apt install python3 python3-serial python3-usb adb fastboot dos2unix

    Make sure ModemManager is disabled or uninstalled:
    • sudo systemctl stop ModemManager
    • sudo systemctl disable ModemManager

    NOTE: If you have issues running the scripts, you might have to run them using sudo.
    Also try using different USB-ports (preferably USB-2.0-ports)


    1. Extract the attached zip-file "kamakiri-sheldon-1.0.zip" and open a terminal in that directory.

    2. Start the script:
    • sudo ./bootrom-step.sh
    It should now say Waiting for device.

    3. Plug in the stick (powered off) and wait for the script to finish.
    If it fails at some point, stop it and restart the process from step 2.

    4. Your device should now reboot into unlocked fastboot state.

    5. Run:
    • ./fastboot-step.sh

    6. Wait for the device to reboot into TWRP.

    7. Use TWRP to flash custom ROMs, Magisk etc.

    NOTE: Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit, your device will likely not boot anymore (unless you flashed a signed image). TWRP will patch recovery/boot-images on the fly.

    NOTE: NEVER erase Preloader, otherwise you’ll hard brick the device and you won’t be able to unbrick it (since bootrom isn’t accessible).

    Important information

    Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

    TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

    For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

    It is still advised to disable OTA.

    special thanks to @Sus_i for all the testing and support.

    Contributors
    @xyz`
    @k4y0z
    @Rortiz2
    @t0x1cSH
    Source Code: https://github.com/amonet-kamakiri/kamakiri/tree/sheldon
    7
    Yeah, probably just needs a more recent FireOS installed the TZ in kamakiri is from 7.2.4.9
    Had a look into all fw bin's, TZ is the same until the newest 7.2.7.3 got an updated one...

    @etami @yacinecino @Tech0308 and all other people with the netflix/disney error):
    Can you provide more Information, i.e. what kind of stick (sheldon or sheldonp) and the installed fireOS, please!?
    Make sure (check in stettings) that the stick hasn't got an update already, because the latest OS will need the updated TZ.

    FYI, disable updates with:

    Code:
    adb shell
    su
    pm disable com.amazon.device.software.ota
    pm disable com.amazon.device.software.ota.override
    pm disable com.amazon.tv.forcedotaupdater.v2
    exit
    exit

    Maybe someone of you with a sheldonp device can install 7.2.4.9 from here, without to flash magisk behind the OS update please, to see if it works?

    Users with sheldon can flash this too, but you need to change this prop first from twrp shell:
    Code:
    adb shell
    resetprop ro.product.device sheldonp
    exit
    4
    @k4y0z will a similar unlocking method be used for the Max once we receive the 7.2.7.3 update?
    No, the Max isn't vulnerable to the preloader-exploit
    3
    @Sus_i and @bloot and @Tech0308 and @Rortiz2 just to say all your painstaking coaching and my reading paid off (for me anyway😊) Instead of magisk, flashed the older 7.2.4.2/2907 update (from before ota update processes became protected) and set LM to block updates. It also fixed the issues with Netflix, Disney etc. Will look to flash Lineage custom rom sometime, now that I know how, and also put Linux on one of my laptops. Thanks heaps!

    Open TWRP, then mount /system, go to file explorer, go to navigate to priv-app and delete the folder
    "com.amazon.device.software.ota"
    Usually you should be good to go now, but goto /data/app and check for same folder (it will have something as suffix) if its present then delete it, your ota should be blocked.
    @SweenWolf thanks for your suggested fix . . . appreciate your work (and that of your good mate TDUK😊) LM and Debloat Tool are must-haves. This other way to block updates, is it somehow more permanent or safer than thru LM or Debloat Tool?
    3
    I have the same problem since I flashed only TWRP alone and didn't installed anything on it just to be sure that my sheldon don't update ,Now any application who try to check DRM on stock firmware cause a bug and a reboot of the system. like netflix and disney+ or live tv with DRM..
    Could be that this is TZ related...
    We saw the same on mantis 4k fireTV stick, hangs and wont play if the TZ image on tee partition is too old compared to the installed fireOS version. Anyways, your problem sounds different to @Tech0308 problem.

    @Tech0308 You don't see this without a magisk install, then everything plays fine?