[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)

[Aldaris001]

Hi guys,

I have a fire stick 4k bought beginning of 2019 which I rooted last year successfully. Unfortunately I forgot to disable OTA so with the latest update in December, my root access was overwritten. I have tried again to use the shorting methodology but I failed so far. The stick is recognized (interestingly not in all USB ports) but the handshake fails with a weird error:

Spoiler: Error message

[[email protected] /home/kamakiri]# ./bootrom-step.sh
[2021-01-13 22:09:21.518029] Waiting for bootrom
[2021-01-13 22:10:54.295443] Found port = /dev/ttyACM0
[2021-01-13 22:11:06.422576] Handshake
Traceback (most recent call last):
File "/usr/lib/python3.7/site-packages/serial/serialposix.py", line 501, in read
'device reports readiness to read but returned no data '
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "main.py", line 119, in <module>
main(dev)
File "main.py", line 24, in main
load_payload(dev)
File "/home/kamakiri/modules/load_payload.py", line 45, in load_payload
dev.handshake()
File "/home/kamakiri/modules/common.py", line 97, in handshake
c = self._writeb(b'\xa0')
File "/home/kamakiri/modules/common.py", line 92, in _writeb
return self.dev.read()
File "/usr/lib/python3.7/site-packages/serial/serialposix.py", line 509, in read
raise SerialException('read failed: {}'.format(e))
serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

Does someone of you have a similar experience? Is there any other chance how to get maybe into twrp and then flash the image from there?

 

[Bertonumber1]

Hi guys,

I have a fire stick 4k bought beginning of 2019 which I rooted last year successfully. Unfortunately I forgot to disable OTA so with the latest update in December, my root access was overwritten. I have tried again to use the shorting methodology but I failed so far. The stick is recognized (interestingly not in all USB ports) but the handshake fails with a weird error:

Spoiler: Error message

[[email protected] /home/kamakiri]# ./bootrom-step.sh
[2021-01-13 22:09:21.518029] Waiting for bootrom
[2021-01-13 22:10:54.295443] Found port = /dev/ttyACM0
[2021-01-13 22:11:06.422576] Handshake
Traceback (most recent call last):
File "/usr/lib/python3.7/site-packages/serial/serialposix.py", line 501, in read
'device reports readiness to read but returned no data '
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "main.py", line 119, in <module>
main(dev)
File "main.py", line 24, in main
load_payload(dev)
File "/home/kamakiri/modules/load_payload.py", line 45, in load_payload
dev.handshake()
File "/home/kamakiri/modules/common.py", line 97, in handshake
c = self._writeb(b'\xa0')
File "/home/kamakiri/modules/common.py", line 92, in _writeb
return self.dev.read()
File "/usr/lib/python3.7/site-packages/serial/serialposix.py", line 509, in read
raise SerialException('read failed: {}'.format(e))
serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

Does someone of you have a similar experience? Is there any other chance how to get maybe into twrp and then flash the image from there?

This is because your not make shorting correctly.
so make sure you have short in place secured.
also check you have latest zip and its extracted to Arch linux desktop and open terminal within that folder .
sometimes we get errors sometimes we dont keep trying

 

[Aldaris001]

This is because your not make shorting correctly.
so make sure you have short in place secured.
also check you have latest zip and its extracted to Arch linux desktop and open terminal within that folder .
sometimes we get errors sometimes we dont keep trying

Thanks, I tried some more times and got it working in the end!

 

[kenmac96]

While searching for a solution, I read forums in several languages. Russians say that most likely players with serial numbers starting with 190 (after VM) have problems. G070VM190. VM170, VM180 and all previous "series" reported still can be rooted!

I can confirm. VM190 device here not coming up while USB powered and properly shorted.

 

[I_CRAFT]

I can confirm. VM190 device here not coming up while USB powered and properly shorted.

@k4y0z
Maybe you should mention it in the OP, that there is a high chance for devices with SN ...VM190... for being (atm) not rootable to prevent further confusion.

 

[k4y0z]

@k4y0z
Maybe you should mention it in the OP, that there is a high chance for devices with SN ...VM190... for being (atm) not rootable to prevent further confusion.

Done

 

[DirtyAngelicaSecured]

What are the instructions on how to put the device back together? It gets hot and I wonder if I can improve cooling by using thermal compound I place between my PC's CPU and CPU heatsink?

The foil method can short much more than needed. Are there problems with that?

 

[k4y0z]

What are the instructions on how to put the device back together?

The same way you took it apart, I don't think that needs explicit instructions.

It gets hot and I wonder if I can improve cooling by using thermal compound I place between my PC's CPU and CPU heatsink?

There should already be a thermal-pad between the CPU and the shield/heatsink.

The foil method can short much more than needed. Are there problems with that?

I don't think anyone has reported issues with that, and it's much less likely to physically damage the board.

 

[Pachacouti]

That OTG cable is fine :good:

Unfortunately, ADB doesn't work at all over OTG cables...

Actually, bein an electronics engineer fo over 40 years, I can honestly say that last night I cut in half 4 usb leads, 2 had the micro usb end, and I joined all the same colours to same colours, added a usb socket for power, or anything else, and a standard usb to plug into laptop, by applying a 3amp power supply, I now could jump from fireiso to windows, but what I had to do to flash the boot.img, was first use fireiso to do the first step, I then wiped everything I could see, rebooted laptop into windows, wwhile power kept me in fastboot, then I unplugged the firestick, plugged it straight back in, fastboot showed because I'd wiped everything else, I could then flash what ever I wanted (boot.img), at no time did I not use this makeshift lead. Just a heads up and a hint the more devices, requires more mA, (millamps) , so to power a firestick and mini usb bluetooth keyboard (using lead, not bluetooth), it's good to have a quality 3A 5v power supply

Edit: pc's usually only provide 500ma per usb socket, I set mine in windows to 2000 (2A), so it's understandable to think an otg wont work if your usb only puts out 500mA, standard windows settings , go to hardware settings, check each usb port's power output!

 

[behtjes]

My fire tv 4k doesn't show up when shorted. Serial number contains starts with G070VM129.. so it should be possible to use this method? I see the device when it's not shorted using lsusb. When shorted it doesn't show up. What's going wrong?

Edit: using this guide it worked:

Rooting an Amazon Fire TV Stick 4K » Miguel Mota | Software Developer

Software developer from sunny Southern California.

miguelmota.com

It's showing a different point to short than this tutorial?

 

[Geordiepaul15]

Hi all, I've loaded the ISO to a 4gb USB stick via Rufus and changed the boot sequence in the Lenovo BIOS.
For some reason the laptop will not boot via the USB.
What am I doing wrong or do I have other options?

I also tried running bootrom from command prompt but it said there was no associated application.

 

[I_CRAFT]

My fire tv 4k doesn't show up when shorted. Serial number contains starts with G070VM129.. so it should be possible to use this method? I see the device when it's not shorted using lsusb. When shorted it doesn't show up. What's going wrong?

Edit: using this guide it worked:

Rooting an Amazon Fire TV Stick 4K » Miguel Mota | Software Developer

Software developer from sunny Southern California.

miguelmota.com

It's showing a different point to short than this tutorial?

I'm glad that this guide worked for you, but he used the same points that were mention in the OP.

Hi all, I've loaded the ISO to a 4gb USB stick via Rufus and changed the boot sequence in the Lenovo BIOS.
For some reason the laptop will not boot via the USB.
What am I doing wrong or do I have other options?

I also tried running bootrom from command prompt but it said there was no associated application.

I would suggest you try again to "burn" that image to this USB drive.

So time it can happen that not all files were transfered correctly, parts of the data were still inside of the write cache while ejecting.

Spoiler: Other causes

Broken stick
Laptop can't boot from USB (I don't think so)
The image were corrupt

 

[i_teach_it]

How do you guys boot to TWRP with OTG and then connect to a PC?

I got a "hacked fastbook mode: (0) - xyz. k5y0z

Hi, I'm having the same problem..
I was able to finaly flash the bootloader, but now i'm stuck the flashboot step. On my screen I only see the Logo with hacked fastbook mode: (0) - xyz. k4y0z.

I tried to plugin the usb to my computer and do ./flashboot-step.sh and it just mentions waiting for any device.

Is there any other steps I need to do?

Regards,

 

[Bertonumber1]

Hi, I'm having the same problem..
I was able to finaly flash the bootloader, but now i'm stuck the flashboot step. On my screen I only see the Logo with hacked fastbook mode: (0) - xyz. k4y0z.

I tried to plugin the usb to my computer and do ./flashboot-step.sh and it just mentions waiting for any device.

Is there any other steps I need to do?

Regards,

hacked fastboot screen....
Connect to your stick and inside terminal/CMD type:
sudo ./fastboot-step.sh

Your device will reboot to twrp

If not, try swapping cables/ports and running the command again.
Regards

 

[Bertonumber1]

My fire tv 4k doesn't show up when shorted. Serial number contains starts with G070VM129.. so it should be possible to use this method? I see the device when it's not shorted using lsusb. When shorted it doesn't show up. What's going wrong?

Edit: using this guide it worked:

Rooting an Amazon Fire TV Stick 4K » Miguel Mota | Software Developer

Software developer from sunny Southern California.

miguelmota.com

It's showing a different point to short than this tutorial?

You can't be shorting correctly, some SOCs differ on the board. But the exploit should still work if shorting properly.
Just make sure to use a piece of foil or thin wire and be sure it's connecting with the resistor/points securely.


Regards

 

[i_teach_it]

hacked fastboot screen....
Connect to your stick and inside terminal/CMD type:
sudo ./fastboot-step.sh

Your device will reboot to twrp

If not, try swapping cables/ports and running the command again.
Regards

Thanks for the suggestion.. I swapped cables and port .. I was able to do everything without a hitch.. Root, Change Mac addr. , add apps, etc.

Regards,

 

[jorges4lu2]

Hi,

I have a Firestick 4K with the serial G4N0VM060... Is it vulnerable? I bought it December 2020.

Thanks in advance.

 

[Sus_i]

Hi,

I have a Firestick 4K with the serial G4N0VM060... Is it vulnerable? I bought it December 2020.

Thanks in advance.

Most likely, but nobody knows. Try it...

 

[The shadow 5249]

I have trouble with the root image. After half hour using my firestick 4k i lost wifi signal and need to reboot for get it back. Any suggestion?

 

[turilo]

I'll have to try all this out on my useless 4k Firestick. It's the second gen early 2020 I believe. I'm assuming it being on latest updates wouldn't matter