[UNLOCK][ROOT][TWRP][UNBRICK][...] FireTV 2nd gen Cube (raven)

[Pro-me3us]

Many thanks @Pro-me3us for this - good to see some progress on this device.

.... However, I've run into some problems using RAVEN2. I had previously installed the RAVEN exploit and everything was fine. I ran option 1 (in RAVEN2) for persistent root and (as SU) the script seemed to run without issue. But now the device wont boot beyond the initial boot screen. Since then every change I've made (e.g. flashing newer firmware (was on 7229/1856), wiping data in TWRP and flashing boot.img in fastboot) has only made the situation worse!

Is there any way to return to stock & restart the process? I've not updated the bootloader - the exploit still works & I can still access TWRP. But now firmware updates in TWRP are no longer working - the device won't progress beyond boot screen & I'm now stuck in bootloop Any ideas?

One thought, about people who were using the previous version. There may be a conflict between the new Magisk and old Magisk build because they have different signatures.

Do this:

1) rerun bash menu option 1), at the end will be in twrp.

2) delete the magisk.db file from within twrp
adb shell rm /data/adb/magisk.db
Then reboot, and see if FireOS loads

When in FireOS uninstall old Magisk Manager, and install new Magisk Manager from /sdcard/download

 

[JJ2017]

One thought, about people who were using the previous version..........

No, that's not working as I've already wiped the data partition in TWRP
.... I've really dug myself into a hole here which is why I'm asking if it's possible to do a complete reset!

 

[Pro-me3us]

No, that's not working as I've already wiped the data partition in TWRP
.... I've really dug myself into a hole here which is why I'm asking if it's possible to do a complete reset!

A couple things, if TWRP and Magisk are present, but you lost root, this will trigger authentication error and the device will just boot to fastboot.

If you can do a regular boot, and tell me what lsusb is reporting, I will have a better Idea what the problem is. If you see Google Inc. Celkon A88 you are in fastboot, lost root, and having authentication error. Rerunning option 1) will fix this.

If that's not working you can boot to TWRP again using option 1) and then flash one of the ota firmwares. You can start with 7229/1853 which is pretty much 1856.

You have DFU access, so no need to panic, the Cube is definitely recoverable

 

[JJ2017]

A couple things,.....

Thanks for your quick replies - i appreciate that.... But I'm OK now - re flashing vendor.img from fastboot seemed to clear the boot-loop

Now with everything back to 'normal' I will report back when i get RAVEN2 working!
Really appreciate you work on this.

=====================================
Edit: Yes, did get Raven2 working eventually & updated Firmware to latest version too - all good!

 

[Pro-me3us]

I'm OK now - re flashing vendor.img from fastboot seemed to clear the boot-loop

Vendor.img? I would not have guessed that being an issue Were you previously re-flashing individual partitions?

 

[Pro-me3us]

@JJ2017 I was able to confirm that the old version of Magisk will cause the Cube to hang after installing the new Magisk.apk over it. I added a note to the OP to first run adb shell rm /data/adb/magisk.db before patching the Cube with v2.0. It can even be run after patching with v2.0 at the black blank loading screen, followed by a reboot. This will not affect any of your previously installed Magisk modules.

I had wanted to wait for a Magisk Canary build with official package signature, but Canary builds are only coming out every +2months now, and there was no ETA on the next one. This adds a messy little complication if you already had an official build installed.

If you encounter any other issues let me know.

 

[Michajin]

Great work @Pro-me3us ! If anyone is interested, they still sell the unlockable Cube2 through Verizon to even non-customers (maybe customers can get them cheaper). Costly though $119, I would expect them to a clearance sale soon. The parts to do the exploit $10. OP is very responsive. I am very much a novice and he walked me through the process with the tiny88 card. I can't promise every cube2 verizon sells is going to be on 7.2.2.9 but the one i bought was and the refurbished ones were. If you decide to get one, make sure you dont update or anything, either do the exploit on first boot before connecting network or use the bypass from aftvnews (make sure you have a SLOW, SLOW CONNECTION SPEED (i used my metered hotspot).

 

[Pro-me3us]

Updated the OP with a newer version of TWRP and a couple bug fixes. I've also included options to boot into Fastboot, TWRP, and Amlogic Update using the buttons on the Cube during bootup.

Holding volume down still works to boot in to safe mode / disable Magisk modules, you just need to wait until the blue LEDs / first Amazon logo to press and hold. Remember that if you do this you need to manually re-enable modules in Magisk Manager, and that the OTA blocker won't be in effect until the module is re-enabled and the Cube is rebooted.

I can't promise every cube2 verizon sells is going to be on 7.2.2.9 but the one i bought was and the refurbished ones were. If you decide to get one, make sure you dont update or anything, either do the exploit on first boot before connecting network or use the bypass from aftvnews (make sure you have a SLOW, SLOW CONNECTION SPEED (i used my metered hotspot).

The last batch of 2nd gen Cubes manufactured have PS7229, so if anyone can find a new unit anywere, it can be rooted. If you patch the Cube right out of the box before registration, the Magisk OTA blocker module should be in effect during setup. Hold 'back'+'menu' when you get the checking for update error, to skip that step.

Thanks for the feedback, I think the new v2.1 should cover a couple of the issues you encountered while patching with v2.0

Edit: Yes, did get Raven2 working eventually & updated Firmware to latest version too - all good!

Great! The new version of TWRP will show all the main partitions now consistently. This may have been why you had issues with your backup?

To restore a previous firmware you only need to flash:
boot
data
odm_image
product_image
vendor_image
system_image

These are the only partitions that get updated with OTA updates. There's also the bootloader but it's blocked in TWRP and should never be updated. For a complete Cube backup you can use bash menu 7) Download partitions with Amlogic burn mode to dump everything to your computer. Those .img files can be flashed back to the Cube from Fastboot or TWRP.

 

[Michajin]

This is awesome...

• Cube's physical buttons can be used on bootup
  • Volume Up ---> Fastboot
  • Volume Down ---> TWRP recovery
  • Action button ---> Amlogic Update

 

[Pro-me3us]

Magisk Canary build v25.208 is newly available.

Magisk included with Raven boot menu 2.0 and 2.1 has a different signature than the official build line. There's no need to upgrade if you don't want to, but if you want to hop back on the official build line:

1. Download Magisk v25.208+ to Cube's Download folder
   
   
2. Reboot to TWRP. Open Magisk Manager, tap on reboot icon in top right corner, select 'Reboot to Recovery'. Alternatively, reboot, press and hold volume down on Cube.
   
   
3. Flash Magisk apk in TWRP. Connect a mouse to the Cube, tap install button, select Magisk apk
   
   
4. Reboot to FireOS, install Magisk apk to enable Magisk Manager.

If you don't have a mouse or prefer to use a computer:

1. Connect computer to Cube with microUSB to USB-A cable
   
   
2. Reboot to TWRP adb shell reboot recovery, or use either method above.
   
   
3. Flash Magisk apk
   adb shell
twrp install '/data/media/0/Download/<magisk-filename.apk>'
   
   
4. Reboot to FireOS and install Magisk apk

Once back on the official Magisk build line, all future Magisk updates can be done directly through Magisk Manager.

If the Cube hangs at the FireOS logo during bootup, delete the magisk.db file (adb shell rm /data/adb/magisk.db). You can either open an adb connection (connected computer) at the logo, or delete magisk.db in TWRP.

 

[Pro-me3us]

A couple DFU dongles were added to Tindie for anyone with a Cube still on pre PS7273 firmware.

 

[cali.s]

any chance to root current firmware?

 

[Pro-me3us]

any chance to root current firmware?

Unfortunately no, this rooting method uses two vulnerabilities that were both patched in PS7273. This is all there is for the 2nd gen Cube currently

 

[Pro-me3us]

There are refurbished 2nd gen Cubes on Woot for $40. No idea if these are on pre7273 firmware.

I'm rolling the dice and in for one.

 

[butterchips]

I don't know how to read schematics, but if I get this exact dongle, do I lift the top pin or bottom pin from the PCB?

 

[errut]

does this Method work for PS7633/3445?

 

[Pro-me3us]

do I lift the top pin or bottom pin from the PCB?

You lift pin2 and connect it to pin8 with a wire

@errut This DFU based method of rooting the Cube only works up to Firmware PS7242/3516.

Unfortunately there's nothing for PS7633/3445. I'd suggest blocking updates to prevent any further updates, in case a new method is ever found.

@butterchips you can use this newer method to root your Cube, but assuming your Cube is on Firmware PS7242/3516 or older, I'd still recommend making a DFU dongle so that you have it as a recovery option if you ever get in trouble.

 

[boxster03]

There are refurbished 2nd gen Cubes on Woot for $40. No idea if these are on pre7273 firmware.

I'm rolling the dice and in for one.

Appreciate all your work and help. Have you checked what OS version came on the woot deal?

 

[Pro-me3us]

Have you checked what OS version came on the woot deal?

The two Woot Cubes I've seen came with firmware between PS7273 and PS7292. I don't know that there was a set firmware version.

 

[boxster03]

So to make the hdmi dongle, I have to DISCONNECT pin2 from the pcb (GND) and via a wire connect pin2 to pin8 (+5V) (pin2 goes from GND to +5V)?

How to find out whether the method will work for the Woot deal refurb cube 2 I received recently? I don't know what firmware it is on (still in box). If I connect and power up, then sign on to Amazon, will it lose the chance of rooting? I believe I can stop it from auto update FireOS at initial set up by the method discussed in other threads and sign on to amazon to find what OS it is.

What are the chances it is a rootable OS <7242??? If it is 7273 will this method work? I am wondering if it is worth dealing with those tiny pins with the soldering iron I have (it is not meant for such small pins).