[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)

[Sus_i]

Thanks for the reply, have you any idea on which one in system/Priv is the offender ?
There are alot in there and I wouldn't know which to disable.
Appreciate your time.
Thanks.

On older fireTV devices that app is named: com.amazon.dcp.apk
Backup and rename with TWRP...

 

[Pretoriano80]

Sorry for the OT, but now that we have finally unlocked the 4k,anyone has an idea how to (properly) add exFAT/NTFS support?
I tried a few possible solutions, but i couldn't manage to mount it as RW, only read-only.

 

[sconnyuk]

On older fireTV devices that app is named: com.amazon.dcp.apk
Backup and rename with TWRP...

I've managed to get into the system, basically with root and magisk manager installed, I've installed a different launcher, and am start the launcher.
Thing is even thou Ive disabled the APK you spoke about it still boots to the screen where it asks to pair remote then WiFi then update and goes to the cannot update.
I can am start my other launcher while connected but ideally need it to go straight to the launcher, on top of this the home button brings me to the failed update screen, and the shortcut to device settings in the launcher app brings me there also.

 

[Sus_i]

I've managed to get into the system, basically with root and magisk manager installed, I've installed a different launcher, and am start the launcher.
Thing is even thou Ive disabled the APK you spoke about it still boots to the screen where it asks to pair remote then WiFi then update and goes to the cannot update.
I can am start my other launcher while connected but ideally need it to go straight to the launcher, on top of this the home button brings me to the failed update screen, and the shortcut to device settings in the launcher app brings me there also.

Ok, you may try to rename that apps too:
com.amazon.device.software.ota
com.amazon.device.software.ota.override

or if you're able to call su in adb shell, do that:
pm disable com.amazon.device.software.ota
pm disable com.amazon.device.software.ota.override

If the stock launcher doesn't start up, you may need to search/ investigate in logcat for errors

Edit: Years ago the solution was simply renaming that com.amazon.dcp.apk to skip the registration screen. I bet amaz. blocked that solution in nougat. Maybe you can find out what app starts that process. Maybe in logcat, maybe with a task manager app, idk.

 

[sconnyuk]

Ok, you may try to rename that apps too:
com.amazon.device.software.ota
com.amazon.device.software.ota.override

or if you're able to call su in adb shell, do that:
pm disable com.amazon.device.software.ota
pm disable com.amazon.device.software.ota.override

If the stock launcher doesn't start up, you may need to search/ investigate in logcat for errors

Edit: Years ago the solution was simply renaming that com.amazon.dcp.apk to skip the registration screen. I bet amaz. blocked that solution in nougat. Maybe you can find out what app starts that process. Maybe in logcat, maybe with a task manager app, idk.

ive am started my launcher (toptv launcher v1) v2 dont work for some reason while in there ive started titanium backup up and went through and frozen all update services and the services related to what you told me.
Im not sure how to use logcat but i would of thought that it would work, i could give that a go if its easy enough to use ?
is it an android app or a computer app ? or is it a service inside adb ?
appreciate taking the timeout to help by the way.

 

[Sus_i]

ive am started my launcher (toptv launcher v1) v2 dont work for some reason while in there ive started titanium backup up and went through and frozen all update services and the services related to what you told me.
Im not sure how to use logcat but i would of thought that it would work, i could give that a go if its easy enough to use ?
is it an android app or a computer app ? or is it a service inside adb ?
appreciate taking the timeout to help by the way.

Logcat is the android system log. You can print the log with adb continuous to a file on your laptop. At boot, connect adb and run:

adb logcat -d > log.txt
(CTRL C stops the log. File saves to the adb folder).

I would do the initial setup thing to the update screen, then look in logcat. Question is what apps could be the culprit for that initial setup thing, what blocks the launcher... Then try freezing with titanium or maybe better 'pm disable **.apk' that app...

 

[sconnyuk]

Logcat is the android system log. You can print the log with adb continuous to a file on your laptop. At boot, connect adb and run:

adb logcat -d > log.txt
(CTRL C stops the log. File saves to the adb folder).

I would do the initial setup thing to the update screen, then look in logcat. Question is what apps could be the culprit for that initial setup thing, what blocks the launcher... Then try freezing with titanium or maybe better 'pm disable **.apk' that app...

Will do, have had a little play with logcat and can see alot of things in the text file.
Will restore to stock and install magisk, and also quite importantly enable ADB with TWRP, then have full access to everything over adb, will post any result and logcat outputs to you tomorrow.
Thankyou for the continued support.

 

[mircam]

Thanks

Good job! Thanks for your hard work k4y0z and @xyz, you are the best! Thank you all who helped them in this task!
For noobies like me, who want to revive firestick (mine at startup just loop forever with starting screen and reboot): after your stick enter in TWRP just type "Adb shell twrp wipe data" on your console, and then "adb shell twrp reboot"

 

[asislife20]

Anyone else have trouble accessing any of the stick Amazon settings after this? I was able to do it and successfully root, but now none of the settings will open you click and it just automatically closes.

 

[menace211]

This is for the 4K FireStick only correct? The 4K Pendant is still a no go?

 

[bilitte22]

Magisk

I m wondering if Magisk can be installed via twrp after rooting the fire tv stick 4k.To block update I need superuser access so I can block Ota update provided that magiskmanager apk is installed.
Can anyone shed the light on that.

---------- Post added at 04:21 AM ---------- Previous post was at 04:16 AM ----------

There are three options for interacting with TWRP:

1. A mouse via USB-OTG
2. TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html
3. Via /cache/recovery/command

Example for /cache/recovery/command:

echo "--update_package=/path/to/zipfile" > /cache/recovery/command
echo "--wipe_cache" >> /cache/recovery/command
reboot recovery

Should you somehow end in a bootloop, TWRP contains a special boot menu that will be displayed when you boot the stick with an OTG-cable connected.
It will give you 5 seconds to hit cancel and stay in TWRP or reboot into the OS otherwise.

NOTE:This will only work if the boot-exploit is still there.

Thanks k4y0z.

 

[rbox]

Well that was easy! And my stick isn't on the latest version, so I'll be able to get some update URLs and make a prerooted ROM hopefully this weekend.

 

[Sus_i]

Will do, have had a little play with logcat and can see alot of things in the text file.

Yeah, it prints all sys messages in that file, you could set filters but I think it isn't necessary. Run the log only up to the failed update screen and then stop the log...

Well that was easy! And my stick isn't on the latest version, so I'll be able to get some update URLs and make a prerooted ROM hopefully this weekend.

Thank you very much :good:

I've collected three URLs, partial updates from 6.2.3.1 to 6.2.6.5. Let me know if that is helpful in any way, idk.

 

[rbox]

I've collected three URLs, partial updates from 6.2.3.1 to 6.2.6.5. Let me know if that is helpful in any way, idk.

I'd need a base full image. I can apply a partial to a full, but I can't create a full from only a partial.

 

[Sus_i]

I'd need a base full image. I can apply a partial to a full, but I can't create a full from only a partial.

Yeah, thats what I've expected. I've updated my sticks to latest infront of the unlock... unfortunately there was no way to let the update fail to collect a full, as the stick stores the update bin in cache.

---------- Post added at 09:59 AM ---------- Previous post was at 09:48 AM ----------

I m wondering if Magisk can be installed via twrp after rooting the fire tv stick 4k.

Of course.
You can use a otg cable, a usb hub + usb stick and a mouse...
or you have to power the stick with your laptop, boot into twrp with: adb reboot recovery
and then run something like this:

adb push ~/Desktop/Magisk-v19.3.zip /sdcard/
adb shell
twrp install /sdcard/Magisk-v19.3.zip
twrp wipe cache
reboot -p

 

[Pretoriano80]

Anyone knows how to unpack the boot.img?Never messed with MTK stuff and so far all tools are failing.
My goal is to modify the ramdisk.

 

[Rortiz2]

Anyone knows how to unpack the boot.img?Never messed with MTK stuff and so far all tools are failing.
My goal is to modify the ramdisk.

Yep. It uses an special Header like in my Aquaris M8.
For me, 0smosis unpack tools worked fine:good:
https://forum.xda-developers.com/showthread.php?t=2073775

 

[Pretoriano80]

Yep. It uses an special Header like in my Aquaris M8.
For me, 0smosis unpack tools worked fine:good:
https://forum.xda-developers.com/showthread.php?t=2073775

AIK was the first thing to try but it fails.

 

[k4y0z]

Anyone knows how to unpack the boot.img?Never messed with MTK stuff and so far all tools are failing.
My goal is to modify the ramdisk.

Yep. It uses an special Header like in my Aquaris M8.
For me, 0smosis unpack tools worked fine:good:
https://forum.xda-developers.com/showthread.php?t=2073775

AIK was the first thing to try but it fails.

The MTK-Header isn't used and isn't actually needed on most of these devices, I usually leave it out when building boot/recovery-images.

The reason it fails is probably because you are trying to unpack the kamakiri-patched boot-img
Use the following command before trying to unpack it:

dd if=boot.img of=boot.img bs=512 count=2 skip=2 conv=notrunc

 

[Pretoriano80]

The MTK-Header isn't used and isn't actually needed on most of these devices, I usually leave it out when building boot/recovery-images.

The reason it fails is probably because you are trying to unpack the kamakiri-patched boot-img
Use the following command before trying to unpack it:

Yep, that did the trick, thank you!