[UNLOCK][ROOT][TWRP][UNBRICK] FireTV 2 (sloane)

Search This thread

DanielF50

Senior Member
Jul 22, 2010
384
121
Hampshire, England
Hi there,

I have a FireStick 4k, one of those that serial # starts with G070VM1190xxxx.
It is stuck on Amazon white logo screen.
I tried adb but I get unauthorized. Tried OTG cable with keyboard and no luck.
Device is not rooted.

Any sugestion?
Yes, use the correct unlock process to fix it - this thread is for the 2nd gen FireTV box, not the 4k FireTV Stick.

Follow the process laid out here: https://forum.xda-developers.com/t/unlock-root-twrp-unbrick-fire-tv-stick-4k-mantis.3978459
 

Veg-Meat

Member
  • Mar 22, 2021
    5
    1
    @Veg-Meat

    1.Just use a flat metal pry tool such as a precision flat headed screw driver.
    Flip the box and start at the rear right side. Gently prise it open by moving around the underside of box until the cover pops off (there are no wires or anything connected to the cover). Next.. you will have to unscrew the board from the topside frame just unscrew the little screws and then just lift the board out carefully.

    2. Refer to the picture in the OP and locate the dat0. Use a thin piece of copper wire or roll a long piece of tin foil up and use this to short the little pad you see in photo.

    You can attach one end of your piece of wire or foil using sticky tape to one of the silver metal shields you see on board (this will serve as your gnd point) .. Be sure to make you're wire or foil long enough to comfortably reach the location of the dat0.

    3. The two above steps are the easy part. You will require patience as sometimes it takes a few attempts to short and get the script to run. Some succeed instantly others take many tries. But just let us know and we'll help you if your unsure.


    Regards
    Thank you for your and everyone else's responses! (Sorry I'm replying quite late, I had exams)

    I successfully opened my Fire TV 2 and unscrewed the motherboard PCB. I have made an interesting discovery though; the layout of the location of the dat0 pin from the picture is different from what I have; there is a SanDisk chip instead of the chip shown in sloane.jpg and there are more pins on my board than in the picture...

    EDIT: I'm an idiot... I wasn't looking closely enough, the pin right below the pin I circled in red on my uploaded picture is dat0... The chip might be different but the pin layouts appear to be the same... ignore this post lol

    I successfully opened my Fire TV 2 and unscrewed the motherboard PCB. I have made an interesting discovery though; the layout of the location of the dat0 pin from the picture is different from what I have; there is a SanDisk chip instead of the chip shown in sloane.jpg and there are more pins on my board than in the picture...

    So I decided to not short the pin that I have circled in red (I think it might be dat0 although I am unsure if that is the same dat0 pin as the one in sloane.jpg)

    Could this be due to a regional variant using different components?

    I have attached a few pictures of how the layout looks on my sloane device.

    The box says the model number is DV83YW, is that the same one everyone else on this thread has?
     

    Attachments

    • 1206.png
      1206.png
      2.2 MB · Views: 17
    • IMG_20210412_124811.jpg
      IMG_20210412_124811.jpg
      1.8 MB · Views: 16
    • IMG_20210412_132943_1.jpg
      IMG_20210412_132943_1.jpg
      1.7 MB · Views: 12
    • IMG_20210412_141000.jpg
      IMG_20210412_141000.jpg
      968.8 KB · Views: 16
    Last edited:

    Bertonumber1

    Senior Member
    May 17, 2020
    712
    186
    Glasgow UK
    Thank you for your and everyone else's responses! (Sorry I'm replying quite late, I had exams)

    I successfully opened my Fire TV 2 and unscrewed the motherboard PCB. I have made an interesting discovery though; the layout of the location of the dat0 pin from the picture is different from what I have; there is a SanDisk chip instead of the chip shown in sloane.jpg and there are more pins on my board than in the picture...

    EDIT: I'm an idiot... I wasn't looking closely enough, the pin right below the pin I circled in red on my uploaded picture is dat0... The chip might be different but the pin layouts appear to be the same... ignore this post lol

    I successfully opened my Fire TV 2 and unscrewed the motherboard PCB. I have made an interesting discovery though; the layout of the location of the dat0 pin from the picture is different from what I have; there is a SanDisk chip instead of the chip shown in sloane.jpg and there are more pins on my board than in the picture...

    So I decided to not short the pin that I have circled in red (I think it might be dat0 although I am unsure if that is the same dat0 pin as the one in sloane.jpg)

    Could this be due to a regional variant using different components?

    I have attached a few pictures of how the layout looks on my sloane device.

    The box says the model number is DV83YW, is that the same one everyone else on this thread has?
    SanDisk and Mediatek are all good mate, they do the same job some but other models of emmc tend to be less flash friendly with regard to efuse.
    Glad you succeeded in unlocking this beautiful speedy device. 😎
     
    • Like
    Reactions: Veg-Meat

    Bertonumber1

    Senior Member
    May 17, 2020
    712
    186
    Glasgow UK
    Wanted to enquire about something but didn't want to sound like a nipple asking outright :p
    What's the story with the Amazon 6.2.7.8 ota on mantis do you think they will try this with Sloane eventually.
    I'm guessing we'll be okay as long as we keep ota disabled?
     

    Veg-Meat

    Member
  • Mar 22, 2021
    5
    1
    SanDisk and Mediatek are all good mate, they do the same job some but other models of emmc tend to be less flash friendly with regard to efuse.
    Glad you succeeded in unlocking this beautiful speedy device. 😎
    Heh thanks but I have not yet succeeded in that effort...

    I have succesfully run the bootrom-step.sh 2 times but when I got to the fastboot-step.sh it would keep giving the same error:

    [email protected]:~/Downloads/amonet$ sudo ./fastboot-step.sh Press Enter to Continue... target reported max download size of 52429824 bytes sending 'recovery_x' (20644 KB)... OKAY [ 0.731s] writing 'recovery_x'... FAILED (status read failed (No such device)) finished. total time: 7.705s [email protected]:~/Downloads/amonet$ sudo ./fastboot-step.sh Press Enter to Continue... target didn't report max-download-size sending 'recovery_x' (20644 KB)... FAILED (command write failed (Cannot send after transport endpoint shutdown)) finished. total time: 0.000s

    BTW, I ran the fastboot-step.sh AFTER the white amazon logo came so I assumed that I should run the script BEFORE the white amazon logo popped up.

    I also checked lsusb and sudo fastboot devices and the result was same both times:

    lsusb
    Bus 001 Device 041: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo / FP1

    sudo fastboot devices

    G070GV17709707B8 fastboot

    But when I tried a third time, bootrom-step.sh itself gave me an error:

    [email protected]:~/Downloads/amonet$ sudo ./bootrom-step.sh [2021-04-13 08:02:47.617867] Waiting for bootrom [2021-04-13 08:04:32.205208] Found port = /dev/ttyACM0 [2021-04-13 08:04:32.207505] Handshake [2021-04-13 08:04:32.207906] Disable watchdog [2021-04-13 08:04:32.209192] Waiting for bootrom [2021-04-13 08:06:26.127637] Found port = /dev/ttyACM0 * * * Remove the short and press Enter * * * [2021-04-13 08:06:32.932850] Init crypto engine Traceback (most recent call last): File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 537, in write n = os.write(self.fd, d) OSError: [Errno 5] Input/output error During handling of the above exception, another exception occurred: Traceback (most recent call last): File "main.py", line 146, in <module> main() File "main.py", line 32, in main dev = load_payload(dev, "../brom-payload/build/payload.bin", skipwait) File "/home/pop-os/Downloads/amonet/modules/load_payload.py", line 117, in load_payload init(dev) File "/home/pop-os/Downloads/amonet/modules/load_payload.py", line 9, in init dev.write32(CRYPTO_BASE + 0x0C0C, 0) File "/home/pop-os/Downloads/amonet/modules/common.py", line 157, in write32 self.dev.write(b'\xd4') File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 571, in write raise SerialException('write failed: {}'.format(e)) serial.serialutil.SerialException: write failed: [Errno 5] Input/output error

    and I tried a fourth time and it gave the same error...

    And after the bootrom error, it stops and goes into a white amazon logo screen stuck until I disconnect power.

    I am assuming that I broke something on the fireTV? I was using aluminium foil with the silver GND thing and it always made sizzling noises and left marks when touching the GND but I don't think that is the problem...

    Also also, when I did lsusb on the white amazon logo screen, it gave the same result as after a SUCCESFUL bootrom-step.sh:


    lsusb
    Bus 001 Device 041: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo / FP1

    sudo fastboot devices

    G070GV17709707B8 fastboot

    I am sure that the lsusb result is the fire tv because that result is the only one that pops up when connecting the usb during white amazon logo mode.

    I will redownload the zip file and try out the script to see if it works again if not I don't know other steps I can try...

    [EDIT]: oof, I even tried v1.0.0 script and while it told me to remove the short much more quickly it also gave some weird error about Input/output, I might aswell try letting it cool down for a few hours and try with resetting the live USB installer of Pop!_OS so I have a fresh environment...

    Here is the error for diagnostic purposes:

    [email protected]:~/Downloads/v1/amonet$ sudo ./bootrom-step.sh [2021-04-13 08:44:20.612655] Waiting for bootrom [2021-04-13 08:44:33.430417] Found port = /dev/ttyACM0 [2021-04-13 08:44:33.432691] Handshake [2021-04-13 08:44:33.433128] Disable watchdog * * * Remove the short and press Enter * * * [2021-04-13 08:44:38.132168] Init crypto engine [2021-04-13 08:44:38.147479] Disable caches [2021-04-13 08:44:38.147843] Disable bootrom range checks [2021-04-13 08:44:38.158430] Load payload from ../brom-payload/build/payload.bin = 0x4760 bytes [2021-04-13 08:44:38.160626] Send payload [2021-04-13 08:44:38.619063] Let's rock [2021-04-13 08:44:38.619571] Wait for the payload to come online... [2021-04-13 08:44:38.623306] all good [2021-04-13 08:44:38.623383] Check GPT Traceback (most recent call last): File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 537, in write n = os.write(self.fd, d) OSError: [Errno 5] Input/output error During handling of the above exception, another exception occurred: Traceback (most recent call last): File "main.py", line 143, in <module> main() File "main.py", line 44, in main switch_user(dev) File "/home/pop-os/Downloads/v1/amonet/modules/functions.py", line 111, in switch_user dev.emmc_switch(0) File "/home/pop-os/Downloads/v1/amonet/modules/common.py", line 226, in emmc_switch self.dev.write(p32_be(part)) File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 571, in write raise SerialException('write failed: {}'.format(e)) serial.serialutil.SerialException: write failed: [Errno 5] Input/output error

    It seems this process has been much easier for everyone else than me lol but I've definitely learned a lot in this process! Thanks for all the help everyone!
     
    Last edited:

    Bertonumber1

    Senior Member
    May 17, 2020
    712
    186
    Glasgow UK
    Heh thanks but I have not yet succeeded in that effort...

    I have succesfully run the bootrom-step.sh 2 times but when I got to the fastboot-step.sh it would keep giving the same error:

    [email protected]:~/Downloads/amonet$ sudo ./fastboot-step.sh Press Enter to Continue... target reported max download size of 52429824 bytes sending 'recovery_x' (20644 KB)... OKAY [ 0.731s] writing 'recovery_x'... FAILED (status read failed (No such device)) finished. total time: 7.705s [email protected]:~/Downloads/amonet$ sudo ./fastboot-step.sh Press Enter to Continue... target didn't report max-download-size sending 'recovery_x' (20644 KB)... FAILED (command write failed (Cannot send after transport endpoint shutdown)) finished. total time: 0.000s

    BTW, I ran the fastboot-step.sh AFTER the white amazon logo came so I assumed that I should run the script BEFORE the white amazon logo popped up.

    I also checked lsusb and sudo fastboot devices and the result was same both times:

    lsusb
    Bus 001 Device 041: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo / FP1

    sudo fastboot devices

    G070GV17709707B8 fastboot

    But when I tried a third time, bootrom-step.sh itself gave me an error:

    [email protected]:~/Downloads/amonet$ sudo ./bootrom-step.sh [2021-04-13 08:02:47.617867] Waiting for bootrom [2021-04-13 08:04:32.205208] Found port = /dev/ttyACM0 [2021-04-13 08:04:32.207505] Handshake [2021-04-13 08:04:32.207906] Disable watchdog [2021-04-13 08:04:32.209192] Waiting for bootrom [2021-04-13 08:06:26.127637] Found port = /dev/ttyACM0 * * * Remove the short and press Enter * * * [2021-04-13 08:06:32.932850] Init crypto engine Traceback (most recent call last): File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 537, in write n = os.write(self.fd, d) OSError: [Errno 5] Input/output error During handling of the above exception, another exception occurred: Traceback (most recent call last): File "main.py", line 146, in <module> main() File "main.py", line 32, in main dev = load_payload(dev, "../brom-payload/build/payload.bin", skipwait) File "/home/pop-os/Downloads/amonet/modules/load_payload.py", line 117, in load_payload init(dev) File "/home/pop-os/Downloads/amonet/modules/load_payload.py", line 9, in init dev.write32(CRYPTO_BASE + 0x0C0C, 0) File "/home/pop-os/Downloads/amonet/modules/common.py", line 157, in write32 self.dev.write(b'\xd4') File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 571, in write raise SerialException('write failed: {}'.format(e)) serial.serialutil.SerialException: write failed: [Errno 5] Input/output error

    and I tried a fourth time and it gave the same error...

    And after the bootrom error, it stops and goes into a white amazon logo screen stuck until I disconnect power.

    I am assuming that I broke something on the fireTV? I was using aluminium foil with the silver GND thing and it always made sizzling noises and left marks when touching the GND but I don't think that is the problem...

    Also also, when I did lsusb on the white amazon logo screen, it gave the same result as after a SUCCESFUL bootrom-step.sh:


    lsusb
    Bus 001 Device 041: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo / FP1

    sudo fastboot devices

    G070GV17709707B8 fastboot

    I am sure that the lsusb result is the fire tv because that result is the only one that pops up when connecting the usb during white amazon logo mode.

    I will redownload the zip file and try out the script to see if it works again if not I don't know other steps I can try...

    It seems this process has been much easier for everyone else than me lol but I've definitely learned a lot in this process! Thanks for all the help everyone!
    Jeez, sorry man, I take it the sloane was one of those export/display devices?
    You should keep trying .. Don't give up 👍
     
    • Like
    Reactions: Veg-Meat

    Veg-Meat

    Member
  • Mar 22, 2021
    5
    1
    Jeez, sorry man, I take it the sloane was one of those export/display devices?
    You should keep trying .. Don't give up 👍
    I DID IT! I just kept re-trying lol it seemed that at one point it was Type1 bricked so I followed the steps for that then shorted it again and did the rest!

    Thank you so much everyone, especially @Bertonumber1 for all your help and support with all this cool stuff I managed to boot TWRP on my sloane box! I am currently testing FireOS and going to check whether TWRP is still bootable or not and then I am going to try and get it to run either Debian Linux or Arch Linux ARM so I can use it like a Raspberry Pi with more powerful hardware!

    This has been a great learning process on how to do this kind of stuff as I have only had experience before with using Xiaomi's Bootloader Unlocker which is much simpler than this!

    Thank you @Rortiz2 for making this great tool to unlock the capabilities of my FireTV2. I would like to ask your permission to make a blog post on this with a guide on how I did it as I would like to make it slightly easier for new users to understand how to do this without having to bother forum members on this thread like I have :)
     
    • Like
    Reactions: LocoMexican

    Rortiz2

    Senior Member
    Mar 1, 2018
    2,026
    1,228
    Barcelona
    I DID IT! I just kept re-trying lol it seemed that at one point it was Type1 bricked so I followed the steps for that then shorted it again and did the rest!

    Thank you so much everyone, especially @Bertonumber1 for all your help and support with all this cool stuff I managed to boot TWRP on my sloane box! I am currently testing FireOS and going to check whether TWRP is still bootable or not and then I am going to try and get it to run either Debian Linux or Arch Linux ARM so I can use it like a Raspberry Pi with more powerful hardware!

    This has been a great learning process on how to do this kind of stuff as I have only had experience before with using Xiaomi's Bootloader Unlocker which is much simpler than this!

    Thank you @Rortiz2 for making this great tool to unlock the capabilities of my FireTV2. I would like to ask your permission to make a blog post on this with a guide on how I did it as I would like to make it slightly easier for new users to understand how to do this without having to bother forum members on this thread like I have :)
    Sure, just mention the original thread.
     
    • Like
    Reactions: Veg-Meat

    meohmy

    Senior Member
    Aug 7, 2015
    85
    18
    I have updated 2 x firetv's in the past using amonet 1.01, magisk and os 5.2.7.6 but upon trying to update
    another box today using amonet 1.1 the process has gone wrong.
    From a pre rooted rom I booted into twrp and installed amonet 1.1 and did the wipe
    as before, then installed SU as opposed to magisk plus os5.2.7.8
    The box then rebooted to the amazon interface successfully, I then tried to reboot into twrp using the adb commands
    'reboot twrp' which caused the box to reboot back to the amazon interface. I then tried 'reboot recovery'
    and the box rebooted to a failure screen - see photo. It appears that twrp has been overwritten by the amazon os.

    The box will reboot successfully into the amazon software but I am unsure how to get twrp re-installed.
    I have tried to start from scratch and reload a prerooted rom but after chmod of mtk-su the script fails to run,
    probably because of the different file structure.

    Any help would be gratefully appreciated.
     

    Attachments

    • 1.jpg
      1.jpg
      59.4 KB · Views: 11

    Michajin

    Senior Member
    Oct 23, 2012
    1,230
    480
    I have updated 2 x firetv's in the past using amonet 1.01, magisk and os 5.2.7.6 but upon trying to update
    another box today using amonet 1.1 the process has gone wrong.
    From a pre rooted rom I booted into twrp and installed amonet 1.1 and did the wipe
    as before, then installed SU as opposed to magisk plus os5.2.7.8
    The box then rebooted to the amazon interface successfully, I then tried to reboot into twrp using the adb commands
    'reboot twrp' which caused the box to reboot back to the amazon interface. I then tried 'reboot recovery'
    and the box rebooted to a failure screen - see photo. It appears that twrp has been overwritten by the amazon os.

    The box will reboot successfully into the amazon software but I am unsure how to get twrp re-installed.
    I have tried to start from scratch and reload a prerooted rom but after chmod of mtk-su the script fails to run,
    probably because of the different file structure.

    Any help would be gratefully appreciated.
    The prerooted rom disables stock recovery (stock or TWRP if flashed over stock). TWRP from the pre-root runs on 2nd init and disables stock recovery. Likely you disabled the rcovery, wit hthe prerooted rom, then when you wiped you lost TWRP. I would suggest you try the shorting method now, unless you have root access.
     

    meohmy

    Senior Member
    Aug 7, 2015
    85
    18
    The install of amonet 1.1 was successful and the wipe in the new twrp was also successfully completed
    as I read the confirmation of the new file system in the new twrp install after wipe, I am therefor not sure if the pre rooted rom was the cause. If there are no other suggestions then I may have to go down the shorting route but hopefully not.
     

    Michajin

    Senior Member
    Oct 23, 2012
    1,230
    480
    The install of amonet 1.1 was successful and the wipe in the new twrp was also successfully completed
    as I read the confirmation of the new file system in the new twrp install after wipe, I am therefor not sure if the pre rooted rom was the cause. If there are no other suggestions then I may have to go down the shorting route but hopefully not.
    If you flashed the pre-rooted rom, it will disable TWRP on the unlocked version.

    "Starting with this update, stock recovery will be disabled to prevent stock updates from being flashed. Please refer to the instructions above for managing stock recovery."

    Try this....

    Managing Stock Recovery
    Starting with 5.0.5_r3, stock recovery gets disabled. This means you cannot reboot in to stock recovery manually or automatically because of a system update. This will make it safer for people who forget to disable updates. You should still disable updates though. If for whatever reason, you want to reenable it, or verify it is disabled, you can use the manage_recovery program. Under normal circumstances, you should never need to use manage_recovery.
    • Connect to adb and start a shell
    • Switch to root with su
    • Run manage_recovery (if you do not run su first, it will seem to run, but won't actually be able to do anything)
      Code:
      manage_recovery

    There are 3 different scenarios that manage_recovery will detect and prompt for.

    The first is when stock recovery is disabled, it will look like this:
    Code:
    Checking current stock recovery status... NOT STOCK
    Checking for reason... DISABLED
    Stock recovery is currently disabled,
    Would you like to enable it?
    Type 'yes' to enable it, anything else to quit.
     

    meohmy

    Senior Member
    Aug 7, 2015
    85
    18
    Unfortunately that did not work, says su not found. I also tried 'manage_recovery to see what would happen and that wasn't found either.
    Many thanks for your reply but I think I will need to read the whole thread again and resort to the shorting method. I hope my hands will be steady enough, as the wife always says 'age is a bugger'
     

    Michajin

    Senior Member
    Oct 23, 2012
    1,230
    480
    Unfortunately that did not work, says su not found. I also tried 'manage_recovery to see what would happen and that wasn't found either.
    Many thanks for your reply but I think I will need to read the whole thread again and resort to the shorting method. I hope my hands will be steady enough, as the wife always says 'age is a bugger'
    I would suggest to use magisk and use a stock rom, then block updates. The shorting method wasn't bad, i had to use it when i installed a prerooted version. Use aluminum foil, it may take a few times. If you can find root access you probably dont need to short.
     

    meohmy

    Senior Member
    Aug 7, 2015
    85
    18
    When using the shorting method I assume you only short DAT0 to ground?

    In post 2 of this thread it says that 'If FireOS is still accessible there are other means of recovery, don't continue.' I can boot up into FireOS with no problems and the box will work, I just seem to have lost my option of booting to recovery. What are the other methods of recovery please as my eyes are are threatening to go on strike from so much reading.:cool:
     

    LocoMexican

    Senior Member
    Mar 12, 2017
    95
    19
    Sus_i, is there a way an unsophisticated but interested member such as myself can capture future new full stock sloane updates such that it can be installed on my device short of having to ask admins such as yourself to do that job for me? It's probably over my pay grade, but if it's not too complicated, maybe you can post a suggestion. Thanks.
     

    mekz1

    New member
    Apr 14, 2021
    2
    0
    So I'm a little in over my head and don't want to use this place as a hand-hold section but I had a few small questions as I'm now waiting on a A-A cable to arrive in the mail before I can tinker with any of this. I got the Fire TV 2nd and power cable separately in the past week - can plug it and get the kiosk mode to respond to some keyboard commands with ctrl alt escape + print screen and what not (read somewhere else to do that) - I take it that's a good sign and not a completely dead device if it's opening up other menus still) - I'm unfamiliar with Linux and wondering if I can use win10 virtual environment system for Linux or better off going with a full Linux install - Either way it should be an interesting experience
    Secondly I'm a little unsure of whether I'm supposed to actually open the hardware / Fire TV up and maybe "do something" to a chip in there..If so that's completely grey area but in some of the "walkthru's" it looks like there might be more program based solutions where none of that's necessary. My only wish for this Fire TV device anyways is to getting it functioning as just any regular product you'd get directly from Amazon without any extra software btw if that would make the process any easy

    Either way I'm not look for all the answers, just a few points in the right direction since I got a couple days before my cord gets here - From what I read it seems like there's some good failsafes built in the software side of things so I can screw it up for hours on end and not have to come back with each little problem (right?)
     

    Sus_i

    Senior Member
    Apr 9, 2013
    1,044
    392
    Sus_i, is there a way an unsophisticated but interested member such as myself can capture future new full stock sloane updates such that it can be installed on my device short of having to ask admins such as yourself to do that job for me? It's probably over my pay grade, but if it's not too complicated, maybe you can post a suggestion. Thanks.

    Take a look here:

    Note: You don't need to mess with the build.prop for new updates, only if you want to pull an older one.
     

    Top Liked Posts

    • There are no posts matching your filters.
    • 2
      I finally managed to recover my Firetv using the instructions provided, but with a twist.
      No matter how hard I tried I could not short dat0 successfully using any type of foil or pin etc so I decided to go the 'hard easy' route.
      I soldered some mobile phone speaker wire to dat0 pin and, along with a micro switch from an old satellite receiver which I mounted to a screw hole, I managed with no problems. Should I need to recover the box in future I just press the switch to short, I have now ordered a mobile phone microswitch which I will mount on the rear of the circuit board then drill a hole in the bottom plate so I won't have to open the box again.
      1
      So far I have not tried many things, I have just been doing a crap ton of research lol. I found that there is a Chromebook device which has the exact same model of CPU as this Fire TV 2 and there is an ArchLinuxARM image for it already with the rootfs only problem is I have not yet figured out how to flash it onto the FireTV2, I need to learn how to make those custom ROM zip files with the boot.img and flash the rootfs and stuff... As for Debian Linux, there does not seem to be much support for this CPU so I have currently focused my efforts on ArchLinuxARM to aim to get a successful bootup...

      There is also a Linux distribution called postmarketOS (based on Alpine Linux) which is designed for smartphones and they have some tools which allow you to make a .zip file of their Linux distro in TWRP and someone has already made a succesful port of postmarketOS for their AmazonFireTV 1st Generation Box. I am currently trying to get postmarketOS to boot up on the AmazonFireTV2 in order to see what Linux on this thing would be like. I also got some help from a NixOS Mobile (a Linux distribution for mobile phones based on NixOS) developer who has pointed me in the direction of some resources in order to figure out how to package Linux Distros into TWRP flashable .zip files.
      Thanks for the update and good luck.
      1
      Hi
      Sucessfully unlocked and rooted my fire tv2 and tryng to block updates but getting the java error below, Using Minimal ADB and Fastboot on Windows 10, any advice please.
      jb

      pm disable com.amazon.device.software.ota
      Error: java.lang.SecurityException: Permission Denial: attempt to change component state from pid=10543, uid=2000, package uid=32012
      You need to setup magisk apk, grant permissions and use the same command with root privilege
      1
      If
      Hi
      Sucessfully unlocked and rooted my fire tv2 and tryng to block updates but getting the java error below, Using Minimal ADB and Fastboot on Windows 10, any advice please.
      You say you are unlocked and rooted and using adb in a windows environment. If so, Open a terminal and use adb commands and follow the posted script? For instance:
      adb connect 192.168.X.XXX
      If you get connection, then:
      adb shell
      su
      pm disable com.amazon.device.software.ota
      pm disable com.amazon.device.software.ota.override
      pm disable com.amazon.tv.forcedotaupdater.v2
      pm clear com.amazon.device.software.ota
      exit
      exit

      If your device is not rooted, you will not get past the command "su". If this is the case, then install Magist (I use v22) from twrp. Reboot system. Go to settings and then "applications" and see if magist is there. If so, open it and it will ask you to download the app (what used to be magist manager). From the installed app, go to app settings and set up your super user permissions. You can change the prompt for su there to "grant" always and not have to deal with your mouse situation. And, if you want to use the mouse, you can change the amount of time you have to respond to the prompt up to I believe 30 or 40 seconds. Regardless, if you set default to "grant", you can then go back to your adb set-up and enter the blocking commands. Hope this helps. Been there done that too. Good luck.
      1
      Hi Guys, thanks for the help and guidance/pointers, found the part in Magisk settings, (Automatic Response to Grant)
      Then all commands worked fine, now ota blocked.
      Regards jb
    • 8
      Read this whole guide before starting.

      This is for the 2nd gen Fire TV (sloane)

      Current relase: amonet-sloane-v1.1

      NOTE: This process does not require you to open your device if you're already rooted or you have TWRP.
      NOTE: If something goes horribly wrong and your device gets bricked, you'll have to open it and unbrick it through bootrom (post 2).
      NOTE: This process will modify the partition-table (GPT) of your device.

      NOTE: Your device will be reset to factory defaults (including internal storage) during this process.
      NOTE: Flashing prerooted ROM will disable unlocked TWRP. It's recommended to flash an stock update.bin
      until that gets sorted out.

      To update to the current release if you are already unlocked, just flash the zip in TWRP.

      What you need:
      • A Linux installation or live-system
      • A a-a cable
      1. Download the attached zip-file "amonet-sloane-v1.1zip".
      2. Copy the zip-file to the internal storage of the box or copy the zip-file to an external SD/USB storage and connect it to the box.
      3. Reboot the FireTV to rbox's TWRP recovery and flash the zip-file.

      NOTE: If you are on firmware 5.2.7.3 or newer, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
      If you chose the brick option, you need to continue with bootrom-step-minimal.sh:




      NOTE: Please refer to the #2 post on how to prepare your environment before proceeding.
      NOTE: If you use this method to unlock the device you don't need to flash the unlock-zip once you're in TWRP.

      Once the zip-file finished flashing, disconnect the device and run:
      Code:
      sudo ./bootrom-step-minimal.sh
      Then plug the device back in.

      The device will reboot to hacked fastboot mode (Static Amazon White Logo + white blinking LED).
      Then run:
      Code:
      sudo ./fastboot-step.sh


      After that, the device will reboot to unlocked TWRP. Then go to Wipe > Format Data and type "YES".
      You can now install Magisk from there.

      Important information

      NOTE: This has nothing to do with the unlock process.

      You have 10 seconds to force TWRP to keep ADB over USB active by using
      Code:
      adb wait-for-recovery && adb shell setprop twrp.usb.mode 0

      In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.
      TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.

      Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)

      Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.

      TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

      For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

      It is still advised to disable OTA.

      Very special thanks to @k4y0z and @t0x1cSH for making all this possible by porting the LK exploit to sloane and implementing the RPMB-key derivation for sloane.
      Special thanks also to @xyz` for making all this possible and releasing the original amonet exploit for karnak.
      Special thanks also to @retyre for porting the bootrom-exploit to mt8173.
      Special thanks also to @Sus_i and @DanielF50 for testing.
      Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
      5
      When I tried to install Magisk in TWRP it failed. It isn't that big of a problem as I am running one of Rbox's pre rooted ROMs but just thought it was odd.

      It was Magisk 19.5? I believe, can't remember off the top of my head.
      You are probably using rbox-twrp instead unlocked twrp.
      I don't think there's any reason to use an old Magisk release either.

      Unfortunately the update overwrote the prerooted version with a standard unrooted version and you would have to go through the whole process again to unlock, but you would have to use the latest prerooted version once it is available so there no updates to mess it up. and then block future updates after that. I decided to just wait for the newest prerooted version so I don't have to go through the process again.

      The good thing is that it is a fully functional unit for reasonably cheap.
      Can you please stop giving nonsense advice?
      1. There is no reason to redo the unlock.
      2. We currently DO NOT recommend using the prerooted ROM together with the unlock.
      5
      In case someone needs some newer 'full OTA update' packages of the stock rom, only for sloane:

      Fire OS 5.2.7.3 (652614020).

      Fire OS 5.2.7.4 (656638420).

      Fire OS 5.2.7.6 (659654620).

      5.2.7.6 is the latest OS (as of today).
      Don't forget to rename the file, i.e. .bin to .zip.
      5
      According to Amazon the latest software update is Amazon Fire TV (2nd Generation): Fire OS 5.2.7.8 (664657320) not 5.2.8.8.
      but I haven't found a link for it yet.

      Me too. Where to find link for full stock Fire OS 5.2.7.8 (664657320)? I'd like to keep my practice demo up to date.

      Fire OS 5.2.7.8 (664657620) for sloane:


      md5: 087cef3f082b0017231e8b938feaeec7
      5
      I would advise you pull your ROM's boot.img, patch it with MagiskManager & then flash this manually via hacked fastboot, otherwise it won't work & you'll probably brick your device again.

      Don't worry, magisk flashing in TWRP works (now). ;)
    Our Apps
    Get our official app!
    The best way to access XDA on your phone
    Nav Gestures
    Add swipe gestures to any Android
    One Handed Mode
    Eases uses one hand with your phone