[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)

Search This thread

Wolfforlunch

Member
Nov 11, 2022
5
1
Hi Folks,

Thanks for your guide and efforts. I would appreciate some help with the following, if anyone has some spare free time to help me out:


-I don’t quite understand how to it’s possible to have the Fire Stick connected to the computer, while also having a mouse connected to it to interact with twrp. I have an OTG cable, with a micro-usb end that connects to the stick, and the other end which splices into two USBs, one for connection to a power source and one data USB that is connected to a USB Hub. (This set-up has been tested and worked before with connecting external HDDs and such on Amazon’s OG OS.)

-When I get to the fastboot stage, I try to use the adb shell to push Magisk to the device, it pushes fine, but when I try to install it, it gives me an error saying no bootable device found. I can see on the TV screen that there is an option to allow overwriting or read-only, but since I can’t have the stick connected to an OTG mouse AND the laptop at the same time, I can’t interact with twrp through TV. if I unplug the stick from the computer, while still connected to the TV, and connect it to an OTG mouse, it boots up and shows a twrp screen with a reboot countdown and when it gets to 0, it just gets stuck there and nothing happens, also OTG mouse does not appear to interact on this screen to press ‘cancel’ on reboot.

Any and all help would be greatly appreciated in advance! Sorry if this question has been answered before, I have spent countless hours searching the forum but my research skills are at newb-lvl at best.

Cheers!
 

Wolfforlunch

Member
Nov 11, 2022
5
1
If 'adb push' works fine, run 'adb shell' then 'twrp install...' or something else... Maybe type 'adb devices' first and if there is the serial, run adb shell
Thanks for your reply, really appreciate it. I have ran ‘adb devices’ and can confirm there is a serial. ‘Adb shell’ runs fine as well, but ‘twrp install’ will give an error saying something like ‘[amonet] remove boot batch
[amonet] failed to remove boot patch…’ followed by multiple other lines saying failed, failed, failed…
 

Sus_i

Senior Member
Apr 9, 2013
1,858
811
Thanks for your reply, really appreciate it. I have ran ‘adb devices’ and can confirm there is a serial. ‘Adb shell’ runs fine as well, but ‘twrp install’ will give an error saying something like ‘[amonet] remove boot batch
[amonet] failed to remove boot patch…’ followed by multiple other lines saying failed, failed, failed…
Take a picture from the error messages... never saw this kind of error.
 

emkorial

Senior Member
Mar 2, 2008
425
16
Just another FYI for any other unfortunate souls trying to make this work ...

IF you are using the Ethernet adapter to try and skip updates, you cannot connect to ADB when the Fire Stick is plugged in through the Ethernet adapter. Because of course you can't
 

Wolfforlunch

Member
Nov 11, 2022
5
1

Attachments

  • 82DC68DE-0F18-40FF-818D-3E4A854927D0.jpeg
    82DC68DE-0F18-40FF-818D-3E4A854927D0.jpeg
    4.1 MB · Views: 124

emkorial

Senior Member
Mar 2, 2008
425
16
So I got the Fire Stick connected. I could not get ADB working when connected through the Ethernet adapter, so I just did direct USB Connection

I rebooted into recovery, wiped data, wiped cache, wiped dalvik, flashed ROM. Rebooted. As promised I got the OOBE for the fire stick.

I paired the remote, connected to my Wifi network, and then it displayed the "checking for updates screen for a moment, and then just skipped it entirely and went right to the login screen. No download progress bar, I didn't kill the connection, it just skipped right over it. Maybe the ROM has that screen disabled?

So I get it all set up, turn on ADB debugging, and connected to ADB. I go into adb shell to delete any cached update file (in case it downloaded one in the background) and disable OTA. But when I enter su, I get permission denied. I checked the applications list, and Magisk is not installed! I thought pre rooted ROM's would have it preinstalled. I flashed the 6.2.6.6 rooted image from https://forum.xda-developers.com/t/...is-prerooted-stock-images-6-2-8-1_r3.3983091/ which specifically says Magisk will always be installed. But it wasn't.

I redid the entire process, and same thing. No Magisk. Some googling led me to this page (https://miguelmota.com/blog/rooting-a-fire-tv-stick-4k/#rooting-with-magisk) which had the Magisk download and instructions on how to flash it with TWRP. I followed those instructions, and was able to get su working. I then cleared the update cache and disabled the OTA updates

One thing I noticed is the Magisk version is different from what it was before. Before I wiped I wrote down the APK versions of everything I had on the stick, previously Magisk was version 7.3.5-de969a9d, now it say version 7.5.1. Does that matter?
So at this point I should have a totally clean 6.2.6.6 stick with nothing on it whatsoever.
 
Last edited:
  • Like
Reactions: Sus_i

Wolfforlunch

Member
Nov 11, 2022
5
1
I was able to get the twrp and the OTG mouse working, but I am still unable to install Magisk…it also said something about TWRP theme version is different than stock, or something of the sort.
 

Attachments

  • CE9863AD-D710-4B20-B79C-9ABAC59FC31C.jpeg
    CE9863AD-D710-4B20-B79C-9ABAC59FC31C.jpeg
    2.1 MB · Views: 54

Sus_i

Senior Member
Apr 9, 2013
1,858
811
I was able to get the twrp and the OTG mouse working, but I am still unable to install Magisk…it also said something about TWRP theme version is different than stock, or something of the sort.
Seems something is messed up with your gpt.
Take a look into this thread and search for 'gpt fix'
You may need to run kamakiri again with this gpt fix...
 
  • Like
Reactions: Wolfforlunch

Joe Ghost

New member
Aug 8, 2011
4
4
I did this successfully yesterday. Here are a few solutions I found:
  1. I didn't need to short the pins; the script unlocked the bootloader just fine on its own. This Fire TV Stick 4K was purchased last week.
  2. I could not build the live USB drive with Rufus in Windows. When I booted from the drive it gave some error about "IO charset ascii not found". FAT32 and NTFS were the only filesystem options in Rufus and neither of them worked. So I made the drive in Linux and it worked perfectly and took like 2 minutes. Imaging a USB drive in Linux is ridiculously easy, you literally copy the ISO file to the USB device with one command.
  3. You don't need an OTG cable. I got this ROM on the Fire Stick by using "adb push" to copy the G070VM0984752N1Q folder to /sdcard/TWRP/BACKUPS/, and then doing "twrp restore" from that backups directory in the adb shell. Then I used this fantastic guide to control the Fire Stick through ADB in order to pair the remote.
 
  • Like
Reactions: llarr

savvyyy

Member
Jan 2, 2020
39
6
Hi, one of my unrooted sticks ignored the blocked updates and now is on the latest version. Are there any solutions to root it ? Tried the this guide but I get the "RuntimeError: ERROR: Serial protocol mismatch, expected 0001 got 2001".
Thank you
 

redeyedjedi

Senior Member
May 1, 2011
828
500
I did this successfully yesterday. Here are a few solutions I found:
  1. I didn't need to short the pins; the script unlocked the bootloader just fine on its own. This Fire TV Stick 4K was purchased last week.
  2. I could not build the live USB drive with Rufus in Windows. When I booted from the drive it gave some error about "IO charset ascii not found". FAT32 and NTFS were the only filesystem options in Rufus and neither of them worked. So I made the drive in Linux and it worked perfectly and took like 2 minutes. Imaging a USB drive in Linux is ridiculously easy, you literally copy the ISO file to the USB device with one command.
  3. You don't need an OTG cable. I got this ROM on the Fire Stick by using "adb push" to copy the G070VM0984752N1Q folder to /sdcard/TWRP/BACKUPS/, and then doing "twrp restore" from that backups directory in the adb shell. Then I used this fantastic guide to control the Fire Stick through ADB in order to pair the remote.
Seriously? A stick you ordered on Amazon, or bought in a store? I'm curious where you found the older stock, I need to buy another since my dog decided to chew my remote. Right now, the sticks are cheaper than the remotes, I just wanna buy a rootable one.
 

Joe Ghost

New member
Aug 8, 2011
4
4
Seriously? A stick you ordered on Amazon, or bought in a store? I'm curious where you found the older stock, I need to buy another since my dog decided to chew my remote. Right now, the sticks are cheaper than the remotes, I just wanna buy a rootable one.
Yep from Amazon like normal. It said copyright 2020 on the box - not sure if that matters.
 
  • Like
Reactions: Sus_i

yellow101

New member
Nov 24, 2022
2
0
I did this successfully yesterday. Here are a few solutions I found:
  1. I didn't need to short the pins; the script unlocked the bootloader just fine on its own. This Fire TV Stick 4K was purchased last week.
  2. I could not build the live USB drive with Rufus in Windows. When I booted from the drive it gave some error about "IO charset ascii not found". FAT32 and NTFS were the only filesystem options in Rufus and neither of them worked. So I made the drive in Linux and it worked perfectly and took like 2 minutes. Imaging a USB drive in Linux is ridiculously easy, you literally copy the ISO file to the USB device with one command.
  3. You don't need an OTG cable. I got this ROM on the Fire Stick by using "adb push" to copy the G070VM0984752N1Q folder to /sdcard/TWRP/BACKUPS/, and then doing "twrp restore" from that backups directory in the adb shell. Then I used this fantastic guide to control the Fire Stick through ADB in order to pair the remote.
Hi, How were you able to flash with out OTG? I dont have OTG and im stuck in TWRP.
 

Joe Ghost

New member
Aug 8, 2011
4
4
Hi, How were you able to flash with out OTG? I dont have OTG and im stuck in TWRP.
I had the Fire Stick plugged into the computer and used ADB for everything. First copy the files with "adb push". Type "adb help" to see the exact usage - in this case it's "adb push -p <local> <remote>" where <local> and <remote> are the G070VM0984752N1Q and /sdcard/TWRP/BACKUPS directories, respectively. It should show you the progress of the files being copied. Then use "adb shell" to gain access to the Fire Stick's terminal, and then within that, "cd" to the BACKUPS directory and run "twrp restore SDB G070VM0984752N1Q". "twrp" command usage is here. Hope that helps
 
  • Like
Reactions: llarr and yellow101

RDYRDY

New member
Nov 25, 2022
1
0
Hello guys, I purchased my firestick 4k in the August of 2019 and have been updating it ever since, I rooted my phone with magisk and so i thought why can't i do the same with my firestick and that's how i found this thread. I'm on the latest update and hence i want to know if Amazon blocked this method, below I've attached the details of my firesticks software, i want to know if this process works with fireos 6.2.9.3 has it been patched @Sus_i , @Joe Ghost ?
Thank you,
RDY
 

Attachments

  • IMG_20221125_185131~2.jpg
    IMG_20221125_185131~2.jpg
    416.3 KB · Views: 17
Last edited:

dallimjp

New member
Sep 18, 2010
1
0
I'm having a hell of a time getting the pins sorted. My fire stick looks very similar but the pins aren't even close to the same position.

Can anyone tell me which pins to short?
 

Attachments

  • 16696077965173632130647225208338.jpg
    16696077965173632130647225208338.jpg
    1.5 MB · Views: 42

Sus_i

Senior Member
Apr 9, 2013
1,858
811
I'm having a hell of a time getting the pins sorted. My fire stick looks very similar but the pins aren't even close to the same position.

Can anyone tell me which pins to short?
Just grab one of the capacitors near the edge of the eMMC with tweezers, i.e. bridge both sides.
You can also put a bit of tinfoil between the shield and the part on there.

Anyways, do you know that shorting method gets blocked via update 6281 or later?

There is also a new method which works without to short anything (same method as for sheldon), but this gets also blocked via fireOS 6287 or later.
 
  • Like
Reactions: Kramar111

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    But when I try to run 'su' or 'pm' I get "Not found". I tried 'su' and 'pm' via adb shell and twrp terminal with same results.
    You are in TWRP, and already have root. Package Manager isn't available until you boot FireOS.
    2
    What is the proper procedure to get it updated to 6.2.9.4?? I assume the DRM is out of date and Netflix and prime show a black screen. It also seems this root blocks updates, as it just boots to twrp and the update never happens.
    As you've got a stick with 6281 (already burned efuse = shorting method gone), there isn't a special procedure required, you would just need to flash the rom you like...

    If you go to 6.2.9.4 you may flash the TZ too (if there are DRM playback issues or black screens).
    Easiest way to do this is take/extract the TZ image from 6.2.9.4 rom and overwrite the TZ image from kamakiri 2.1 folder. Then re-do the bootrom/fastboot-step.
    I am perfectly ok with manually updating but can't seem to find the bins anywhere. Any help here would be appreciated.
    1
    As you've got a stick with 6281 (already burned efuse = shorting method gone), there isn't a special procedure required, you would just need to flash the rom you like...

    If you go to 6.2.9.4 you may flash the TZ too (if there are DRM playback issues or black screens).
    Easiest way to do this is take/extract the TZ image from 6.2.9.4 rom and overwrite the TZ image from kamakiri 2.1 folder. Then re-do the bootrom/fastboot-step.

    Done and done. Thanks, this is exactly what I was looking for. Now, is there a semi up to date list of what system apps can be deleted? Time to go looking.
    1
    Done and done. Thanks, this is exactly what I was looking for. Now, is there a semi up to date list of what system apps can be deleted? Time to go looking.
    Maybe use adb shell pm disable instead, so it's easy to enable again if something goes wrong ;)
  • 70
    NOTE: There have been multiple reports of devices with serial numbers containing VM190 or higher being shipped with DL-Mode disabled in BROM.
    These devices cannot be unlocked using kamakiri.
    These devices do not show up at all on USB when shorted.


    After the old bootrom-exploit (amonet) we've been using for unlocking all these Fire-gadgets is closed in more recent Mediatek SOCs like the one used in the FireTV Stick 4K, @xyz` has done it again and found another bootrom-exploit.
    Together we proudly present kamakiri for the FireTV Stick 4K.

    Before proceeding make sure to read and understand this entire post.

    Running this exploit requires a patched linux-kernel on the PC you are using.
    We have put together a Live-ISO that already contains all prerequisites required for running kamakiri.
    You can find the current version of the ISO at:
    https://github.com/amonet-kamakiri/fireiso/releases

    It can be burned to a CD or to a USB-flashdrive.

    Current Version: kamakiri-mantis-v2.0.1.zip


    You will need to open the device and remove the heatshield on the side without the antennas (2 square bricks).
    NOTE: It is not required to desolder or force the shield off, it is just clipped onto a frame. (The attached picture may be a bit misleading, since it also has the frame removed)

    You will need something for shorting (wire, aluminum foil etc.)

    1. Boot the ISO
    2. Download and extract the exploit package.
    3. Open a terminal in the kamakiri directory
    4. Run
      Code:
      ./bootrom-step.sh
    5. Short one of the points in the attached photo to ground (the cage of the shielding).
      Ideally you want to use DAT0, since that is tiny it might be easier to short the point marked CLK instead.
      It is very important that you use a piece of soft wire or aluminum foil or something similar for shorting. Don't use tweezers as that makes it incredibly easy to knock of the capacitor off the PCB and kill the board!
    6. Connect the stick to your computer (while keeping it shorted)
    7. The script should tell you to release the short and hit enter
    8. Once finished run
      Code:
      ./fastboot-step.sh
    9. Your device will now reboot into TWRP

    Important information

    Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)

    TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

    For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

    It is still advised to disable OTA.

    thanks to @hwmod for the picture
    thanks to @Sus_i for providing an update.bin
    thanks to @zeroepoch for developing aftv2-tools

    Contributors
    k4y0z, xyz`
    Source Code: https://github.com/amonet-kamakiri/
    16
    There are three options for interacting with TWRP:
    1. A mouse via USB-OTG
    2. TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html
    3. Via /cache/recovery/command

    Example for /cache/recovery/command:
    Code:
    echo "--update_package=/path/to/zipfile" > /cache/recovery/command
    echo "--wipe_cache" >> /cache/recovery/command
    reboot recovery

    Should you somehow end in a bootloop, TWRP contains a special boot menu that will be displayed when you boot the stick with an OTG-cable connected.
    It will give you 5 seconds to hit cancel and stay in TWRP or reboot into the OS otherwise.

    NOTE:This will only work if the boot-exploit is still there.
    13
    I'v just uploaded a new Version of the unlock for mantis.
    It comes with an all new TWRP (3.6.1) and an unlock method that works even for fused devices with firmware version < 6.2.8.7, no shorting needed!
    For detailed instructions check https://forum.xda-developers.com/t/...k-3-and-fire-tv-stick-lite-sheldon-p.4410297/ (Use mantis-zip from here, will update instructions here in a bit)
    12
    Well that was easy! And my stick isn't on the latest version, so I'll be able to get some update URLs and make a prerooted ROM hopefully this weekend.
    11
    Is this something that Amazon can fix with future updates? I am holding off until we have a more refined rom..

    No, the only way they can fix it is with a new hardware revision.