[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)
- Thread starter k4y0z
- Start date
the stick is still basically "new" (never powered/connected before yesterday) so it has whatever was from the factory in 2019. Is allowing Amazon to push the latest safe to do? Thanks.
It's currently downloading the latest from azm, but throttled to about 1k/s so I'm buying time just in case this needs to be aborted. =)
If you care about the shorting method, for later unbricking or re-do kamakiri, then only use rbox prerooted roms. Disable updates.
Hmmm, so this is my concern and confusion. I think I want/need to keep access to TWRP.
I used shorting method to install TWRP and that's where I'm at, haven't yet connected to wifi. Because I've never connected before, I've not had access to the menus so ADB is disabled. Do I have another option for installing the prerooted r2 (as you said) then r3? I thought I could do that with TWRP, but have never done so in this virgin state.
I guess I should also ask, do you think I should go further back and get the 6.2.6.6_r1 image because of the license erro fixed then?
Last edited:
I guess going back to the prerooted 6.2.6.6 is no longer an option because the link to mediafire is broken...
You don't need to flash a rom at all.
I would install magisk, then boot the stick. Setup the wifi + account, skip update with that:
How to Skip Software Updates during Initial Setup or Factory Reset on a Fire TV, Firestick, or Fire TV Cube
Since the latest software update for Fire TV devices is blocking the ability to use custom launchers, you may want to avoid updating a new or factory reset Fire TV.
Code:
adb shell
su
pm disable com.amazon.device.software.ota
pm disable com.amazon.device.software.ota.override
pm disable com.amazon.tv.forcedotaupdater.v2
pm clear com.amazon.device.software.ota
exit
exitThanks, very helpful!!
But I don't understand how to install magisk without first having adb access. Should I just do the wifi/register enable adb then install magisk to then get su access? I think that may work given I can boot to TWRP... or so I hope
I can follow the guide on ftvnews, I was actually trying that on my own but forgot the double button back+menu trick.
The one thing that is confusing is that requires registering, I had unregistered as noted in the newbie guide. No problem with registering after skating around the update?
Last edited:
I'm trying to work through installing magisk through TWRP (no surprise generated more questions). I think I need to install both the manager and magisk zip.You don't need to flash a rom at all.
I would install magisk, then boot the stick. Setup the wifi + account, skip update with that:
Enable adb, grant su access for the shell, disable updates:How to Skip Software Updates during Initial Setup or Factory Reset on a Fire TV, Firestick, or Fire TV Cube
Since the latest software update for Fire TV devices is blocking the ability to use custom launchers, you may want to avoid updating a new or factory reset Fire TV.www.aftvnews.com
I don't understand the TWRP Unmodified System Partition message. The wording isn't clear to me, do all three statements apply to keeping system partition RO?
-TWRP can leave your system partition unmodified to make it easier for you to take official updates. (I don't want this, right?)
- TWRP will be unable to prevent the stock ROM form replacing TWRP and wil not offer to root your device. (this also sounds bad, correct?)
- (in red) Installing zip or preforming adb operations may still modify the system partition (this sounds great)
I think I want to allow modifications, does allowing modifications prevent updates from wiping TWRP?
Does allowing modifications make it easier for the OS to overwrite TWRP?
Is it possible to restore the RO status, and do I want to restore RO?
If you download the magisk.apk you can rename it to .zip and flash it.
The swipe is only needed, if you want to mess with files on system.
You don't need the swipe to install roms or magisk and instead of a mouse and OTG cable, you can just use twrp commandline via adb shell (use the og fireTV usb cable), like this
Code:
adb push xy.zip /sdcard
adb shell
twrp install /sdcard/xy.zipThanks again, but I'm still having trouble. I'm still not clear on how to use ADB without it being previously enabled.
TWRP does have a sideload but when trying to start I just get the starting.... message
I tried this from the fireiso system:
Code:
# adb sideload app-release.zip
adb: sideload connection failed: no devices/emulators found
adb: trying to pre-KitKat sideload method...
adb pre-KitKat sideload connection failed: no devices/emulators foundI also wasn't clear on the comment about no mouse/OTG cable, how do I stop TWRP from rebooting to FireTV when I don't have a mouse? Am I missing something?
I think down time is my worst enemy, well that and not totally understanding exactly how this works on an OS level...
I decided to give another try with booting and interrupting the download to get back to the registration screen but I ran into what appears to be a major problem.... if I use the feature to enable voice menu that just enables the feature, it doesn't take you to the special screen that can be used to exit to the registration page... FRICK! So pissed at myself for hesitating when given the chance before... proof I failed myself by not leaning droid development 12 years ago!
I did some searching and can't find a way around this. Sure, pressing the two buttons again turns it off, but turning on just turns it on... I guess there's a flag saved somewhere I'll need to find. But I don't find anyone talking about doing that online. Is there a way to reset that setting? Will the TWRP factory wipe get this done without wiping TWRP?
I decided to give another try with booting and interrupting the download to get back to the registration screen but I ran into what appears to be a major problem.... if I use the feature to enable voice menu that just enables the feature, it doesn't take you to the special screen that can be used to exit to the registration page... FRICK! So pissed at myself for hesitating when given the chance before... proof I failed myself by not leaning droid development 12 years ago!
I did some searching and can't find a way around this. Sure, pressing the two buttons again turns it off, but turning on just turns it on... I guess there's a flag saved somewhere I'll need to find. But I don't find anyone talking about doing that online. Is there a way to reset that setting? Will the TWRP factory wipe get this done without wiping TWRP?
Last edited:
Not adb sideload. You need to boot TWRP, start adb shell and then use TWRP commandline via USB cable
TWRP Commandline Guide
</style>CLIENT SIDE/SCRIPTinstall FILENAME : install FILENAME zip file.
twrp.me
Boot the fireISO,
open a terminal in the kamakiri folder,
run ./boot-recovery.sh
and connect the stick via fireTV usb cable.
TWRP will boot and if you type adb shell in the terminal, then you can use TWRP commandline.
Now you've got a terminal open, TWRP is running.
Download magisk from here:
Releases · topjohnwu/Magisk
The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.
github.com
Then start adb shell and use:
twrp wipe data
twrp wipe cache
twrp install /sdcard/name-of-the-zip.zip
Now you should be able to skip the initial update again and magisk is installed.
Note: Never ever flash something via an APP from inside fireOS, especially not magisk updates. Only TWRP will work. Also never wipe system
Many thanks, I did as directed with a detour to backup the stick partitions before installing magisk.Note: Never ever flash something via an APP from inside fireOS, especially not magisk updates. Only TWRP will work. Also never wipe system
Whlle researching magisk I found this thread and had planned to use this version, but I followed your directions and installed 25.2 from the repo you shared.
Magisk 25.1 for Fire TV
As current and all previous Magisk releases can break any fire tv on update from manager, I made custom build of Magisk 25.1 for Fire TV Releases GitHub URL Changes: - Manager doesn't have direct install / update options - Dark theme by default...
forum.xda-developers.com
What you said in the note, "flash something" you're talking about OS updates? Does that include magisk updates? I think you're saying just use TWRP for anything operates on a system partition level, right?
I also wondered if it's possible to disable updates from the TWRP adb shell, but guessed fireOS needs to be running for that to be an option. My router has the stick restricted to LAN only so the stick can't access the updates anyway. I'll wait a while for feedback, but I think it's time to reboot -p and get to discovering what version of OS is installed!
I was able to bypass the download, and enable adb and 3rd party apps.
FireOS is v6.2.6.3
Home v6.1.3.1-004
I've got traffic blocked on the router, so home and updates aren't downloading for now.
I tried the following:
mantis:/ $ su
Permission denied
13|mantis:/ $
Prompt now has the 13| prepended.
Magisk on the FireTV has presented an upgrade option and given the previous comment about not flashing from anything other than TWRP has me frozen in my tracks. =)
Wondering if I should accept the "download and install" Magisk upgrade or should I just start pushing rbox images using TWRP?
su is aviable as soon as you grant access
Any update of the 'magisk manager' (app) is ok...
The update/upgrade of 'magisk' will only work via TWRP.
Thanks, that makes sense magisk manger vs magisk itself.su is aviable as soon as you grant access
Any update of the 'magisk manager' (app) is ok...
The update/upgrade of 'magisk' will only work via TWRP.
Although I think I now have a chicken-egg thing needing to find a way to allow magisk to download and install so I can approve su access to disable update tasks while preventing the OS from downloading the OS upgrade.
Fingers crossed the pm clear does its job
Job done! I didn't want to risk anything so opened a second shell and kept clearing any amazon .ota file while updating magisk.
Since 6.2.6.3 is older than the first version listed on rbox's custom how should I proceed? Would I still start with 6.2.8.1_r2?
Last edited:
I confirmed 6.2.6.3 needs to be updated to something newer.
I thought I understood there are a couple critical updates, is 6.2.8.1_r2 still the right next step?
Depends on you, if you like the old fireOS launcher use 6.2.7.7 (renamed to zip):
and if you like the new launcher UI then flash rbox 6.2.8.1r2.
Don't wipe anything, rom flash is enough.
If you want to flash a more recent fireOS at some point, make sure you think twice, i.e. keep your efuse from burning: @SweenWolf uploaded a patch somewhere which deletes the efuse burn script and @Pretoriano80 does also similar patches including his awesome custom kernel:
[KERNEL][FireTV Stick 4K] Custom Kernel For AFTV 4k - 6.2.9.4
Warning !!! Use this kernel on your own risk !!! I can't be held responsible for any kind of damage or data loss !!! Features: SDCARDFS exFAT and F2FS support Wireguard Advanced TCP options CIFS and NFS support Insecure ADB v1...
forum.xda-developers.com
Thanks again. I guess my interest wasn't clear, I wasn't really asking about options but appreciate that. I really don't want to use the box for anything other than the basics (at least right now). I just want to keep it open and I was asking to avoid what happened back in October 2019 (page-12+) all that mess with credentials reapplying boot image and all that when others were upgrading from 6.2.6.3.
I agree, avoiding the efuse will be important moving forward, so will take a look into the Sweenwolf mod, and Pretoriano80 kernel.
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
1
I had the same symptoms with an unopened 4K obtained from a private sale.
I contacted Amazon and they replied that it was because the serial number of the device had been erased due to a return or some other reason.
I was able to get to the home screen by restoring the data I had backed up on my other 4K, but I can't use the store, so some apps that depend on Amazon are not available.
Some apps that rely on Amazon can be avoided by installing from AptoideTV.1
I was in trouble with the same error before, but I was told by this reply.
Delete the following comments in kamakiri > modules > main.py
if rpmb != b"\x00" * 0x100:
dev.reboot()
raise RuntimeError("downgrade failure, giving up")
lines 72-74 -
70NOTE: There have been multiple reports of devices with serial numbers containing VM190 or higher being shipped with DL-Mode disabled in BROM.
These devices cannot be unlocked using kamakiri.
These devices do not show up at all on USB when shorted.
After the old bootrom-exploit (amonet) we've been using for unlocking all these Fire-gadgets is closed in more recent Mediatek SOCs like the one used in the FireTV Stick 4K, @xyz` has done it again and found another bootrom-exploit.
Together we proudly present kamakiri for the FireTV Stick 4K.
Before proceeding make sure to read and understand this entire post.
Running this exploit requires a patched linux-kernel on the PC you are using.
We have put together a Live-ISO that already contains all prerequisites required for running kamakiri.
You can find the current version of the ISO at:
https://github.com/amonet-kamakiri/fireiso/releases
It can be burned to a CD or to a USB-flashdrive.
Current Version: kamakiri-mantis-v2.0.1.zip
You will need to open the device and remove the heatshield on the side without the antennas (2 square bricks).
NOTE: It is not required to desolder or force the shield off, it is just clipped onto a frame. (The attached picture may be a bit misleading, since it also has the frame removed)
You will need something for shorting (wire, aluminum foil etc.)
- Boot the ISO
- Download and extract the exploit package.
- Open a terminal in the kamakiri directory
- Run
Code:./bootrom-step.sh - Short one of the points in the attached photo to ground (the cage of the shielding).
Ideally you want to use DAT0, since that is tiny it might be easier to short the point marked CLK instead.
It is very important that you use a piece of soft wire or aluminum foil or something similar for shorting. Don't use tweezers as that makes it incredibly easy to knock of the capacitor off the PCB and kill the board! - Connect the stick to your computer (while keeping it shorted)
- The script should tell you to release the short and hit enter
- Once finished run
Code:./fastboot-step.sh - Your device will now reboot into TWRP
Important information
Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).
It is still advised to disable OTA.
thanks to @hwmod for the picture
thanks to @Sus_i for providing an update.bin
thanks to @zeroepoch for developing aftv2-tools
Contributors
k4y0z, xyz`
Source Code: https://github.com/amonet-kamakiri/16There are three options for interacting with TWRP:
- A mouse via USB-OTG
- TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html
- Via /cache/recovery/command
Example for /cache/recovery/command:
Code:echo "--update_package=/path/to/zipfile" > /cache/recovery/command echo "--wipe_cache" >> /cache/recovery/command reboot recovery
Should you somehow end in a bootloop, TWRP contains a special boot menu that will be displayed when you boot the stick with an OTG-cable connected.
It will give you 5 seconds to hit cancel and stay in TWRP or reboot into the OS otherwise.
NOTE:This will only work if the boot-exploit is still there.13I'v just uploaded a new Version of the unlock for mantis.
It comes with an all new TWRP (3.6.1) and an unlock method that works even for fused devices with firmware version < 6.2.8.7, no shorting needed!
For detailed instructions check https://forum.xda-developers.com/t/...k-3-and-fire-tv-stick-lite-sheldon-p.4410297/ (Use mantis-zip from here, will update instructions here in a bit)11
New posts
-
-
TURBOUI ROM for `Samsung Galaxy S20FE- Latest: robertowhistle
-
[Discussion] Magisk Delta - Another unofficial third-party Magisk fork- Latest: monkeymechanic
