[Guide] Building a TWRP Fire TV Stick Rom [WIP] - Fire TV General

Since @burcbuluklu did such a nice job of creating this for mantis (4k), I've decided to copy that concept for sheldon.
I've created a couple different images, which I'll post in the next few days hopefully.
Sorry for the delay. I've actually managed to get further with this then I expected. The wait will be worth it. I've managed to bring back the OOBE (the welcome setup you have to run through when the stick is brand new). There's one last piece I would like to figure out before I post the image.
I'm looking for help on creating a script that will trigger after the OOBE is complete. There is a flag that gets set after successful completion of the OOBE so that value could be read on boot for example and then trigger the script. Would also want to ensure the script only runs once. It will just be a basic debloating script. This is the last piece of the puzzle. This is a bit out of my skill set. If you can give me a hand with this I'll be able to post a really nice complete image.
--------------------------------------
I've now managed to get around the following problem, though not as cleanly as I would like.
Unfortunately, I'm stuck at a critical part. I need to remove my amazon account before I can share it.
I've approached it in two ways but neither have been successful. First is to remove my account after everything has been setup and done, this would be a bit preferable as I've already done all the work to create this. Second is to not have to sign in with amazon to begin with. Basically disable the OOBE, build up the ROM and then re-enable OOBE so when it gets flashed it's easy to run through that part of the setup. If OOBE can't be re-enabled, then the setup to connect your remote will be the same as in the 4K thread, hopefully.
I had played with various ways to get around OOBE, getting ADB enabled out of the box etc, all with various levels of success on mantis but for whatever reason I can't get ADB enabled on sheldon. For clarification, the intent is to get ADB enabled via recovery so it's accessible before having to run through OOBE.
EDIT:
The only plausible way I've figured out is to use "deregister". Not sure how much "personal info" is left as it says it won't remove all personal info but I used a dummy account anyway. The other factor that is different from mantis/6.2.7.6, is to complete OOBE after the stick has been deregistered, the stock amazon launcher must still be enabled. When trying with another launcher set via launch manager, OOBE won't complete as it gets into a loop during the registration stage. Definitely unfortunate as I would have liked the user to end up on the customer launcher (wolf in this case) rather then having to enable it after getting through the OOBE. If anyone has a better way please let me know.

Can't you just enable ADB through IDME?

Finnzz said:
Can't you just enable ADB through IDME?
Click to expand...
Click to collapse
I'm not familiar with IDME. I couldn't find a whole lot on it. Mind pointing me in the right direction?

bnevets27 said:
I'm not familiar with IDME. I couldn't find a whole lot on it. Mind pointing me in the right direction?
Click to expand...
Click to collapse
IDME is part of the Amazon feature layer added to all their bootloaders. It includes flags to enable ADB, enable ADB with root, and enable ADB without authorization.
You can check it out if you boot up FireOS and use the command 'ADB shell IDME print'. Fos_flags is the value you are interested in in this case.
The fos_flag value can be set from within FireOS using ADB, or from fastboot. These values are written to the end of the bootloader partition, or backup bootloader. It's magic is "beefdeed", and you could edit it directly.
For more information go to Amazon's FireTV open source page, download the source for Sheldon and search the bootloader source for IDME.h

reserved

reserved

@Finnzz thanks for the suggestion but I wasn't able to figure out IDME. Looks pretty interesting though. End result is was easier to just run through the OOBE. Now that I have an image it doesn't matter too much anymore. And I think I've managed to remove all account traces. Though I still want to figure out how to get adb access and bypass the OOBE. I've seen @SweenWolf do it for mantis. Of course I can do it with an image restore but that's not really the same thing. It's not really need but interesting anyhow.
Getting close to a release, just need help making a script that triggers after the OOBE is complete. More info on that in the OP.

Related

easyroot+S-off mac/linux

I have made a script of the most popular guide for rooting the Thunderbolt right now.
http://www.androidpolice.com/2011/0...he-htc-thunderbolt-and-unlock-its-bootloader/
Long story short, I have not tested this enough to guarantee it will work for everyone. It can run on both Mac and Linux, and only requires that curl is installed (by default on Mac, and most Linux distros). I have made absolutely sure that the script did not run anything what-so-ever that is damaging without letting you verify that you want to continue several times.
Please only test at this time if you know your way around adb, and are willing to run into non-damaging issues (it may fail, but I assure you, no damage is done)
usage
Make sure the phone is plugged in and adb is installed and working, and device is showing. Start a terminal IN the adb directory and put this script in there. Start it as usual in a terminal? (rename oneClick.txt to oneClick.sh)
Both AndroidPolice & AndIRC are nor affiliated with this root process or responsible for it.
has anyone tested this? i have a mac but am not experienced in adb...was going to give it a shot when i got off work today.
@kdb424, is there some way you could provide more detailed instructions for adb noobs? if not, i'll try dbzfanatic's easy root or attempt this after learning adb myself first.
First off, thanks andrew8806 for doing that edit. I knew I had missed something.
Second, the only thing you should have to do on a mac to verify this is going to work is make sure adb is installed, and make sure your device comes up in adb devices.
If that's good, all you need to do is open a terminal and type "cd " and drag and drop the folder that adb is installed into (depending on where you installed it, it could be different or I'd just type it) then put the script in there and run
sh ./oneClick.sh
and follow the instructions in the script.
will this still wipe data?
Yes, absolutely. Long story short is that it requires that an old build be flashed on your phone so that can be hacked. It's the only know method of rooting now. All one clicks are just abusing that and simplifying as much as possible.
just got done rooting with my macbook pro. the script kdb424 wrote worked really well. there were a few hiccups along the way, not sure if they were from my terminal glitching or the script or my phone or whatever, but it worked, flashing clockworkmod right now to change the ROM.
for anyone curious, sometimes the script would just stop because some command missed or something. i would just edit kdb424's script to remove the portion that i already completed and rerun the script essentially starting it up again wherever it messed up. at the end i ran the last few lines myself but overall it was quite helpful to root, especially for someone new to ADB like me.
bkiminfinity said:
just got done rooting with my macbook pro. the script kdb424 wrote worked really well. there were a few hiccups along the way, not sure if they were from my terminal glitching or the script or my phone or whatever, but it worked, flashing clockworkmod right now to change the ROM.
for anyone curious, sometimes the script would just stop because some command missed or something. i would just edit kdb424's script to remove the portion that i already completed and rerun the script essentially starting it up again wherever it messed up. at the end i ran the last few lines myself but overall it was quite helpful to root, especially for someone new to ADB like me.
Click to expand...
Click to collapse
Thank you so much. I'm glad to hear success. I know ADB has some issues that I can not resolve. It's the same no matter how you root. Do you remember what portions gave you trouble specifically? I could take a closer look at it and iron hose things out. Once again, thanks again, and glad I could help!
Willing to try this once things get ironed out.
kdb424 said:
Do you remember what portions gave you trouble specifically? I could take a closer look at it and iron hose things out. Once again, thanks again, and glad I could help!
Click to expand...
Click to collapse
all of the md5 sums and outputs were correct so there were no brick possibility i think. if i recall correctly, sometimes pushing the PS05IMG.zip would not execute properly and the script would not continue until i reran it. i think that might've happened with both the downgrade and the s-off one, can't say for certain. some parts that hiccuped may have just been my tbolt needing extra reboots so i don't think that was the script's fault. towards the end i would just run the lines myself, i think i had to redo the ./adb shell /data/local/psneuter line the most before it took properly. i believe that was it, like i had said it was quite helpful and greatly expedited the rooting process.
Im expierienced with ADB and I have a mac. Will be trying this out now. Reporting back soon.....
Edit (after using scipt)
While the script is great, the end just turns into a #failfest. It refuses to the final file to my SD card and sites that its read only. The end I am doing manually. The rest of the script is amzing and gets a A+
Thank you so much for your feedback. I'll be looking into that. If I come up with any typos in the script, I'll update and let you know. ADB is known to act odd at times, so it may be pure ADB's fault. Definitely taking a look into though,. Enjoy your root!
I just got root using the OG method on my mac and it was a PITA. I think the big thing to know is you can use every step listed by jcase, but you need to use ./adb instead of JUST adb.
After completing root the long way, I imagine this would expedite things exponentially.

UK Nook Glowlight software 1.2.0 - Don't use glownooter

I got a uk glow worm on the 27th (2 days before release ) and one of the first things that I tried to do was to root with glownooter. Bad idea! I thought that I had bricked my device. I had to use a lot of trickery to recover from a loading screen lock-up and once I did the first thing that I did was backup my nook (Which i should have done before).
UPDATE!
Please try my new ROOT install pack HERE:
http://forum.xda-developers.com/showthread.php?p=34216660#post34216660
This can be used to root and install the most requested things of this thread in just one zip.
Here is a quick guide to most things you will need to do to get started. I will update this guide as I discover and build new modifications.
To Backup and Restore
Follow this guide. Please do this BEFORE any other tinkering!
http://blog.the-ebook-reader.com/20...-and-restore-nook-glow-and-nook-simple-touch/
Its important to check your backup before proceeding! Please listen to roustabout and dont skip this step... He knows what he's talking about
roustabout said:
I'd like to suggest an addition to the backup method that many folks are using - always test your restore, but dont test it (the first time) on your device.
Your backup file should be about 2 gig.
find a 2 gig or larger flash drive or sdcard and restore your backup image to that drive.
when you're done, there should be 8 partitions, as there were on your Nook to begin with.
If you can't get that working - you're not ready to root yet. Until you're sure you can restore, don't start making changes, please.
People turn up all the time having screwed themselves over by restoring a partial backup and not knowing it, or having restored only one partition from a complete backup and having blown out the partition table.
Click to expand...
Click to collapse
Thanks roustabout
To Root!
Make sure you use the CWM file suitable for your SD Card. I used "2gb_clockwork-rc2" because my card was 2gb+.
http://forum.xda-developers.com/showthread.php?t=1360994 (Thanks mali100)
Use WinImage with admin rights to restore CWM virtual hdd image to your SD.
Download tinynoot-1-of-2 and tinynoot-2-of-2
http://forum.xda-developers.com/showthread.php?t=1650593 (Thanks to eded333 and roustabout)
Put on CWM boot SD.
Install them in CWM back to back (I didn't bother with the restart in the middle as it should not make a difference considering the file content). After a restart you should have root access and an android launcher on your 1.2.0 Nook (among other files). If nook fails to boot one of the tinynoot files may have corrupted. Recover, Re-download and Retry!
To Add Apps
Using ADB to install apps is easy. Extract this to your C drive:
http://dl.dropbox.com/u/13673492/ADB + Fastboot + Drivers.zip
Navigate to the folder in a cmd prompt.
Drop your APK into the same folder and on your nook open the "adbwireless" app and enable ADB
That app will tell you what your nooks IP address is.
Then you can:
Code:
adb connect ip.address.of.nook:portnumber
adb install app_of_your_choice.apk
Setup ADB over USB
OK I have taken the liberty of building a quick driver mod to support your nook through USB. It works for me. First you need to have the android SDK if you don't already (sure you do but just in case ).
http://developer.android.com/sdk/index.html
Make sure you tick to install the android USB driver when the SDK is installed.
Browse to extras\google\usb_driver in your SDK folder (wherever you put it) and replace android_winusb.inf with my file:
http://dl.dropbox.com/u/13673492/android_winusb.inf
Next go to C:\Users\your_user_account\.android and replace adb_usb.ini with my file:
http://dl.dropbox.com/u/13673492/adb_usb.ini
In device manager, point google ADB driver to this and hopefully that should get you set up!
To test type
Code:
adb devices
Its working if you get something like this:
Code:
* daemon not running. starting it now on port ____ *
* daemon started successfully *
List of devices attached
[YOUR NOOK] device
And then try
Code:
adb install app_of_your_choice.apk
UPDATE
Install Multitouch Kernel With Overclocking
Install the CWM zip using your clockworkmod SD card
http://forum.xda-developers.com/showthread.php?t=1906507
:good: Thanks to johnjtaylor for discovering that this kernel works works.
Hopefully this more comprehensive guide will get others with this software to start playing around.
If this helps, be polite and say thankyou
Have you setup ADB yet? If you can connect with ADB and get a shell, you can execute a 'df' at the shell prompt to see how much free space is available in each partition. On my NST (no glowlight) apps seem to be installed in /data/app so see how much free space is there. On the NST, this appears to be the same partition that books purchased from B&N are placed in, so if you have a lot of books from B&N, you may have to archive some to install apps. Of course all this is going on the assumption that the NST Glow is similar to the NST in this regard.
David0226 said:
Have you setup ADB yet? If you can connect with ADB and get a shell, you can execute a 'df' at the shell prompt to see how much free space is available in each partition. On my NST (no glowlight) apps seem to be installed in /data/app so see how much free space is there. On the NST, this appears to be the same partition that books purchased from B&N are placed in, so if you have a lot of books from B&N, you may have to archive some to install apps. Of course all this is going on the assumption that the NST Glow is similar to the NST in this regard.
Click to expand...
Click to collapse
Thanks for replying. I'm actually working setting up ADB now. As for books I only just got my nook so all of my titles are epub format on an sd card so i wouldn't think it would be that. As soon as I get ADB set up I will post back my results incase it helps anyone else with this new software version.
Can you look in the documentation that comes with the reader for any reference to 'third party software' or 'GPL software'. They should list where to download / apply for the source code somewhere. Once we can see the source code we can compare it against the existing versions and identify any significant issues.
I set up ADB.
Plenty of space in all partitions including /data for the apps that I want. Managed to install through "adb install some_app_i_want.apk" so problem resides with the amazon app store. Not really an issue for me because I have a specific set of apps that I want and don't need to browse the app store.
I will try to work out what's wrong for others.
staylo said:
Can you look in the documentation that comes with the reader for any reference to 'third party software' or 'GPL software'. They should list where to download / apply for the source code somewhere. Once we can see the source code we can compare it against the existing versions and identify any significant issues.
Click to expand...
Click to collapse
Thanks. I'm looking for it now
No reference to GPL. Only references to third party software are to tell me that my warranty is no longer valid (no surprise there!)
Is there any other place I can find this info thats not the documentation?
loney01843 said:
No reference to GPL. Only references to third party software are to tell me that my warranty is no longer valid (no surprise there!)
Is there any other place I can find this info thats not the documentation?
Click to expand...
Click to collapse
Nothing obvious from the uk.nook.com website. On the US site the 'support' section links to terms of service which contain the links to the open source code (see http://www.barnesandnoble.com/container/nook_lnav.asp?pid=43307 and search for NOOK 1.1.5 OSS Release ), but I can't see an equivalent on the UK site. It's an oversight, but such things happen with a new product launch.
You can email them at [email protected] . The relevant paragraph from the US site is:
1. Notwithstanding anything to the contrary in this Agreement, certain components of the Software are licensed subject to the General Public License Version 2.0, a copy of which is attached as Exhibit A (the "GPL License"). You may not use these components except in compliance with the GPL License. In addition, you may have additional rights with respect to such components under the GPL License, including, without limitation, the right to obtain the source code for such components from us. You may obtain a copy of such source code by contacting us through the contact information provided on the Web Site. We will provide such source code in accordance with the GPL License.
I don't legally have the right to request the source code myself, because I don't own a UK NOOK yet. (Yeah, thinly veiled excuse for laziness!)
staylo said:
Nothing obvious from the uk.nook.com website. On the US site the 'support' section links to terms of service which contain the links to the open source code (see http://www.barnesandnoble.com/container/nook_lnav.asp?pid=43307 and search for NOOK 1.1.5 OSS Release ), but I can't see an equivalent on the UK site. It's an oversight, but such things happen with a new product launch.
You can email them at [email protected] . The relevant paragraph from the US site is:
1. Notwithstanding anything to the contrary in this Agreement, certain components of the Software are licensed subject to the General Public License Version 2.0, a copy of which is attached as Exhibit A (the "GPL License"). You may not use these components except in compliance with the GPL License. In addition, you may have additional rights with respect to such components under the GPL License, including, without limitation, the right to obtain the source code for such components from us. You may obtain a copy of such source code by contacting us through the contact information provided on the Web Site. We will provide such source code in accordance with the GPL License.
I don't legally have the right to request the source code myself, because I don't own a UK NOOK yet. (Yeah, thinly veiled excuse for laziness!)
Click to expand...
Click to collapse
You're obviously not that lazy. Thanks for looking and gathering all of the extra info I need. I'll send B&N an e-mail and see what they say. I wouldn't be surprised if they didn't want to hand it out considering you can use it for an easy root setup and install the amazon and kobo stores which could financially damage their advance into new territories! What are we to do! Can't even subscribe to a newspaper or magazine through the nook store yet!
I'll let you know when / if I get a response
There is a setting in nook touch tools that you need to "arm," to allow software from unknown sources to be installed before the Amazon appstore can install software on a tinynooted device.
The setting is a tickbox, "Allow non-Market apps"
Untick it if it is ticked by default, then re-tick it to get apps to install.
roustabout said:
There is a setting in nook touch tools that you need to "arm," to allow software from unknown sources to be installed before the Amazon appstore can install software on a tinynooted device.
The setting is a tickbox, "Allow non-Market apps"
Untick it if it is ticked by default, then re-tick it to get apps to install.
Click to expand...
Click to collapse
Thanks for the reply but I actually tried that. No joy. However perhaps it is this that is not working and not amazon app store. Im just installing through ADB instead. I wonder if I can enable unknown sources through ADB. Something to look at I guess!
UK tinynoot attempt failing
loney01843 said:
Thanks for the reply but I actually tried that. No joy. However perhaps it is this that is not working and not amazon app store. Im just installing through ADB instead. I wonder if I can enable unknown sources through ADB. Something to look at I guess!
Click to expand...
Click to collapse
I tried using the tinynoot process from roustabout's thread here http://forum.xda-developers.com/showthread.php?t=1650593 and am stuck on the final reboot with a "Your NOOK is starting up..." message. Could you let me know if you used a different tinynoot method/set of files?
smerrett said:
I tried using the tinynoot process from roustabout's thread here http://forum.xda-developers.com/showthread.php?t=1650593 and am stuck on the final reboot with a "Your NOOK is starting up..." message. Could you let me know if you used a different tinynoot method/set of files?
Click to expand...
Click to collapse
Yep thats what I used. You on 1.2.0 and did you back up?
I didn't backup first and to get out of the starting message I used this:
http://forum.xda-developers.com/showthread.php?t=1289233&highlight=restore
Then I made a backup using this:
http://blog.the-ebook-reader.com/20...-and-restore-nook-glow-and-nook-simple-touch/
I hope this helps!
loney01843 said:
Yep thats what I used. You on 1.2.0 and did you back up?
I didn't backup first and to get out of the starting message I used this:
http://forum.xda-developers.com/showthread.php?t=1289233&highlight=restore
Then I made a backup using this:
http://blog.the-ebook-reader.com/20...-and-restore-nook-glow-and-nook-simple-touch/
I hope this helps!
Click to expand...
Click to collapse
Thanks for the tip on screen freeze but the link to the images on that post don't work for me. I am on 1.2 and made a backup before attempting any rooting - have managed to reinstate my original nook so quite pleased with myself.
Is there any point in rooting until someone can find a way of getting apps onto the 1.2 NSTG?
smerrett said:
Thanks for the tip on screen freeze but the link to the images on that post don't work for me. I am on 1.2 and made a backup before attempting any rooting - have managed to reinstate my original nook so quite pleased with myself.
Is there any point in rooting until someone can find a way of getting apps onto the 1.2 NSTG?
Click to expand...
Click to collapse
Great that you got a backup. If you want custom apps you can either wait for a different root kit or push ahead (since you have a safety net).
As I said, it worked for me.
If you don't mind searching for the .apk files you want you can use this:
Code:
adb connect ip.address.of.nook:portnumber
adb install app_of_your_choice.apk
This has worked fine for me so far. Just don't try for custom kernels yet as they seem to give me troubles.
I will work more on this tomorrow including adjusting framework for gapps.
loney01843 said:
Great that you got a backup. If you want custom apps you can either wait for a different root kit or push ahead (since you have a safety net).
As I said, it worked for me.
If you don't mind searching for the .apk files you want you can use this:
Code:
adb connect ip.address.of.nook:portnumber
adb install app_of_your_choice.apk
This has worked fine for me so far. Just don't try for custom kernels yet as they seem to give me troubles.
I will work more on this tomorrow including adjusting framework for gapps.
Click to expand...
Click to collapse
Thanks also for the code but as this is my first foray into rooting I think I'll hang around and watch for a bit! Perhaps if I start learning some more I may feel confident enough to try it.
Do you have copies of the files needed for the factory reset - the links are still not working for me.
Thanks again and sorry for bothering you. Hope tomorrow is productive for you.
smerrett said:
Thanks also for the code but as this is my first foray into rooting I think I'll hang around and watch for a bit! Perhaps if I start learning some more I may feel confident enough to try it.
Do you have copies of the files needed for the factory reset - the links are still not working for me.
Thanks again and sorry for bothering you. Hope tomorrow is productive for you.
Click to expand...
Click to collapse
http://dl.dropbox.com/u/13673492/n2T-Recovery_0.2.img
This is the file needed to force factory reset. However a quality backup like you have is far more important.
For anyone who wants to give this a go, here is a quick guide for root access and app installs using windows tools until I can make something more complete:
Make sure you use the CWM file suitable for your SD Card. I used "2gb_clockwork-rc2" because my card was 2gb+.
http://forum.xda-developers.com/showthread.php?t=1360994
(Thanks mali100)
Use WinImage with admin rights to restore CWM virtual hdd image to your SD.
Download tinynoot-1-of-2 and tinynoot-2-of-2
http://forum.xda-developers.com/showthread.php?t=1650593
(Thanks to eded333 and roustabout)
Put on CWM boot SD.
Install them in CWM back to back (I didn't bother with the restart in the middle as it should not make a difference considering the file content). After a restart you should have root access and an android launcher on your 1.2.0 Nook (among other files). If nook fails to boot one of the tinynoot files may have corrupted. Recover, Re-download and Retry!
Using ADB to install apps is easy. Extract this to your C drive:
http://dl.dropbox.com/u/13673492/ADB + Fastboot + Drivers.zip
Navigate to the folder in a cmd prompt.
Drop your APK into the same folder and on your nook open the "adbwireless" app and enable ADB
That app will tell you what your nooks IP address is.
Then you can:
Code:
adb connect ip.address.of.nook:portnumber
adb install app_of_your_choice.apk
Hopefully this more comprehensive guide will get others with this software to start playing around.
Click thanks if this guides helpful.
loney01843 said:
If nook fails to boot one of the tinynoot files may have corrupted. Recover, Re-download and Retry!
Navigate to the folder in a cmd prompt.
Drop your APK into the same folder and on your nook open the "adbwireless" app and enable ADB
That app will tell you what your nooks IP address is.
Then you can:
Code:
adb connect ip.address.of.nook:portnumber
adb install app_of_your_choice.apk
Hopefully this more comprehensive guide will get others with this software to start playing around.
Click thanks if this guides helpful.
Click to expand...
Click to collapse
Great - thanks to your more detailed instructions, I have persevered and the second attempt at installing the tinynoot zips worked. Your post gave me the confidence to try installing apks for the first time and for anyone else who is unfamiliar with the processes used, I found these two pages useful for:
navigating within a command prompt (how naive): pcstats.com/articleview.cfm?articleid=1723&page=3
Pasting text into a command prompt (ditto): megaleecher.net/Copy_Paste_Text_Dos_Window
Sorry, as a newb I'm not trusted to post outside links yet. It took a couple of attempts of pasting and pressing enter to work out how to install using the adb code but it's not as hard as I expected.
I have tried installing the 1 Mobile Market which works but it is unable to install apps itself (not enough space).
Also, I have just installed NoRefreshToggle and can't seem to get it to work. Any thoughts - is 1.2 to blame? Really want this to work as Business Calendar Free is just a series of blinks at the moment!
Great! I'm glad you pushed onward and have root.
I am going through possibilities of other ways to install apps and mods.
No refresh is something that I would like as well but I think that the framework may need editing for 1.2.0. For fast mode a new kernel will need to be made or existing one modified.
Be aware that installing kernels not designed for this firmware can give you some serious problems.
Once I can setup app markets, I will work on these other modifications.
Stay tuned :good:
Take a look at the overclock kernel - it's got a lot of the norefresh features baked in, and gives you a nice ability to control both clock and kernel tuning (via the governor control.)
You're right, you can flash the two zips back to back with no ill effect, I was mistaken about what the second zip was doing.
I mistyped when I typed "nook touch tools," I meant nook color tools.
I'm very interested that the amazon store is not working in 1.2. I will see if the software's available for my device, so I can try to see what's happened.
As of now, the us bn site does not mention an os 1.2 for the glowlight.

[Q] psneuter outdated ?

Since more than a week i am the - nevertheless happy - owner of a N7 but still looking for a minimal way for rooting. It's my first tablet. I've run Linux 1994-99 (and revived my experience here and then) and am knowing, that the destination of the actual user (on one of several "virtual" terminals) isn't done by the OS but the user - after booting. Is this (last) booting step so deeply integrated into the downsized Linux Android, that there is no other way to get root access than to install a whole (modified) OS ?
There are still some init... files in /android (seen by "adb shell") - under Linux these files are controlling the boot process - and i'd like to read them but have not even read permissions. psneuter is the proposed tool here. "adb push" copied it, "chmod 777" apparently worked, but running psneuter (from adb shell in /data/local/tmp) resulted in:
Failed to set prot mask (Inappropriate ioctl for device)
Click to expand...
Click to collapse
I' not the only one meeting this error, but the answers on related questions of others meeting this have never been meeting the point. More searching on the net yielded this - incomplete and a bit cryptic - site: osvdb.org/74800 with:
Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android shared memory (ashmem) and ASHMEM_SET_PROT_MASK.
Click to expand...
Click to collapse
and:
Solution: Upgrade to version 2.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
Click to expand...
Click to collapse
Accordingly psneuter is useless - dead at least since June 1, 2011. Is that true ?
If you want a minimal root look no further than here.
It runs an exploit to gain root privileges, and from there installs a setuid 'su' executable (and it's companion Android app). Other than that, the ROM is not replaced - it's full stock.
Having said that, folks that fool around with their new-found root privileges inevitably wedge their OS boot somehow... and then come crying in here for help.
The android recovery (which is really just a slimmed-down alternate boot ramdisk - think of it as an improved single-user mode) can be replaced with a custom version which is useful for making full backups to mitigate such disasters. It's a damn good idea, frankly.
Since the recovery boot image is just a binary blob, it can be saved and also overwritten from a root-privileged shell using "dd" (raw copy) with the correct (recovery) partition.
PS If you just want to "look" at some files rather than rooting, you can certainly download the factory images, unpack the boot images, etc. Linux is probably the preferred platform for doing that, although it is not mandatory ... just far easier.
"adb restore <mybak.ab>" is perfectly working for me. Indeed i had a mishap with the Google_Nexus_7_ToolKit_v5.0.0 and got my pad into the same status than backuped afterwards. There won't be any crying. I feel very comfortable with anything i've done in adb.
The hint to factory images might help - i'll check, where Google is providing the droid for download to PC via http or ftp.
Sitll i am curious about psneuter. There are so many recommendations for it by administrators seemingly knowing their stuff.
Thanks, 3Jane
3Jane said:
The hint to factory images might help - i'll check, where Google is providing the droid for download to PC via http or ftp.
Click to expand...
Click to collapse
I think you were asking, here it is anyway
https://developers.google.com/android/nexus/images
Get split_bootimage.pl from here, the ramdisk can be unpacked with a gunzip+cpio pipeline.
Also, you might find extract-ikconfig to be helpful if you want to compare kernel build configs without booting the kernels examined.
have fun
Indeed: Using the exploit of motochopper alone, i was able "to root" adb without any further installing.
Thus my first goal ("cat init.rc" in the adb shell) has been reached. Thanks again, 3Jane

[SUPPORT] Ouya Boot Menu Support Thread

Hello everyone,
This thread previously was a discussion area for the Ouya Boot Menu feature during its early development.
It's now being transitioned to a support area. The new project description/download page is at:
http://forum.xda-developers.com/showthread.php?t=2499673.
Thanks!
CWM Bootloop
Hal9k+1 said:
Hello everyone, attached is the ZIP of an updated CWM Recovery IMG file.
This image is based on the latest stock Ouya kernel in GitHub. The kernel contains some newer HDMI code, which will hopefully increase the chance of getting the CWM graphics showing up properly. I also turned off HDMI’s HDCP in the compile (not needed for a utility partition such as this), and grabbed a patch from Kulve’s Ouya kernel fork to really ensure HDCP bypass.
More importantly, the image contains Tasssadar’s excellent work involving KExec-HardBoot. This technology should allow for the implementation of a “fastboot boot”-related capability from a running ROM, enabling kernel chain loading. The recovery image in particular will be a place to practice with KExec-HardBoot, and come up with a booting method that could eventually be flashed to the boot/kernel partition.
It is fine (and recommended) to fastboot to this image as a quick verification of things. However, it will be necessary to flash to the Recovery (“SOS”) partition for proper testing of KExec-HardBoot, since there’s an embedded reboot (to Recovery in this case) in there. Do *NOT* flash this to the Boot.
A simple chain load test can be done by extracting “zImage” from this image, and “initramfs.cpio.gz” from your current ROM kernel. (Included is “unmkbootimg” that can help here - runs on Linux.) Push these to /tmp on the Ouya while it is running this image. Then enter the Ouya shell and do:
kexec --load-hardboot zImage --initrd initramfs.cpio.gz --mem-min=0xA0000000 --command-line=”$(cat /proc/cmdline)”
kexec -e
It should come up with this new kernel under your current ROM’s environment. As verification, you should see kexec files under /sys/kernel.
I’m looking to implement a basic chain loading application. It would come up before the Recovery and ADB services, and do the following:
% Pause for a bit, to allow any Alt-SysRq keyboard action (jump to Recovery or Bootloader) that may be needed.
% Check for any attached USB mass-storage devices (e.g., thumb drive), and look for the file “kernel.img”. Pull it in and boot it if present.
% If that failed, then look to “/system/kernel.img” on the Ouya itself, and boot it.
% And if that didn’t pan out, then exit and allow Recovery/ADB services to come up.
I hope all of this will be of help to others along the way!
Click to expand...
Click to collapse
Will this help with the problem I have?..
New update today it downloads automatically and then reboot to CWM and it fail verification...reboot system and it does all over again?...Any ideas Plz
View2Askew said:
Will this help with the problem I have?..
New update today it downloads automatically and then reboot to CWM and it fail verification...reboot system and it does all over again?...Any ideas Plz
Click to expand...
Click to collapse
Sorry, I'm not sure I understand. It sounds like the new stock firmware update is failing to go in, perhaps because of consistent download corruption. Whether you're actually being dropped in to the recovery partition is unclear. You might try the download again with the other networking type (Ethernet vs WiFi). You might also just disconnect from the network for the time being, and see if you remain in the firmware without interruption. From there you can consider setting up ADB to see if you can administer the Ouya from a PC.
My post is more for the developers at heart, just in case my investigation piqued anyone's interest. Ideally the post would go in the Development section, but I evidently need a few more posts here to unlock that area.
Best of luck!
Dual booting
Yes, please do enable dual/multi booting
Is there something I can do to help in that regard?
kulve said:
Yes, please do enable dual/multi booting
Is there something I can do to help in that regard?
Click to expand...
Click to collapse
Thanks kulve, and thank you for the kernel patch set. I need to get familiar with the offerings there.
I don't see any blockages in my plan so far; I just need to start in and see what comes up. At least it's a better feeling than the dead-ends encountered with the U-Boot and regular KExec investigations.
Someone more enterprising could possibly port in the MultiROM project, but I'll stick with this. Will let you know if I get stuck.
My findings so far...
- I've finally decided that shutting off HDCP in the build does nothing to help avoid the funky pink/purple squeezed screen that sometimes appears when CWM comes up. With my Asus monitor, I see the issue when the monitor was in sleep mode. Likewise, if I can switch the monitor to HDMI input at the same time as starting Recovery, then it's fine. It may be possible to hack in a fix by somehow starting and closing an HDMI session shortly before CWM itself starts. (I don't want to fight this too hard but would be nice to resolve.)
- I see how to pull the kernel and ramdisk out of an Android image (on the Ouya itself), so that they could be passed to KExec-HardBoot. I've done it with a script as a test but it may end up in an executable.
- I tried out a USB thumb drive. It's detected but no block device is made available under /dev -- I've finally decided that support is likely in a kernel module, which does not exist on the Recovery image. I'm probably not going to sweat this due to the next item.
- I notice that the CWM application can read the Ouya power button as something comparable to a keyboard key press. Borrowing this capability may allow us to count the button presses in a limited time range, and thus boot an appropriate image. (Would be easier than dealing with the pairing of the controller, but at least still wouldn't require a keyboard.) With this line of thought, I'm thinking the main image could sit in /system while any alternates could be in /sdcard or /data.
So in general, studying the code of the CWM application appears to be the next direction. Thanks - feel free to send any ideas.
Hal9k+1 said:
- I've finally decided that shutting off HDCP in the build does nothing to help avoid the funky pink/purple squeezed screen that sometimes appears when CWM comes up. With my Asus monitor, I see the issue when the monitor was in sleep mode. Likewise, if I can switch the monitor to HDMI input at the same time as starting Recovery, then it's fine. It may be possible to hack in a fix by somehow starting and closing an HDMI session shortly before CWM itself starts. (I don't want to fight this too hard but would be nice to resolve.)
Click to expand...
Click to collapse
What does the rendering in CWM? Is it Android or something lower level? I think my kernel has better HDMI support but for that the software needs to use that explicitly instead of the default one as there is not internal LCD panel (/dev/graphics/fb0 vs. fb1).
kulve said:
What does the rendering in CWM? Is it Android or something lower level? I think my kernel has better HDMI support but for that the software needs to use that explicitly instead of the default one as there is not internal LCD panel (/dev/graphics/fb0 vs. fb1).
Click to expand...
Click to collapse
It does look to be low-level, as CWM directly opens /dev/graphics/fb0 and uses ioctl() on it. I've decided to try my own compile of CWM as it does look to be a nice base for the booting effort. Will definitely look to your patches for the improved HDMI when I'm all ready -- thanks!
Hal9k+1 said:
It does look to be low-level, as CWM directly opens /dev/graphics/fb0 and uses ioctl() on it. I've decided to try my own compile of CWM as it does look to be a nice base for the booting effort. Will definitely look to your patches for the improved HDMI when I'm all ready -- thanks!
Click to expand...
Click to collapse
I noticed your comments related to this on the "Ouya CWM Recovery" thread but I'm not allowed to post there, so I'll post here.
Or actually repost as I'm mostly repeating myself. I had all kinds of issues in getting output using /dev/graphics/fb0 in Linux with the stock Ouya kernel but after some fixes the fb1 seems to work quite reliable. I get the output even if I don't have HDMI plugged in during the boot and it chooses the right resolution both for my TV (1080p) and for my monitor (1680x1050).
To all: I have updated the attachment that's present on the first post. I've synced to the latest Ouya kernel and pulled in the next HDMI patch set from Kulve. My HDMI issue now appears to be fully resolved.
Kulve: Thanks so much for refocusing me! I should have grabbed the patch from day 1, but that summary description had me a bit spooked. Note that I kept the HDMI/PRIMARY symbol enabled, so there's still only the fb0 device on this kernel.
With this handled and due to my thinking in general, I'm going to back away from trying to compile CWM itself -- I don't want to invest in CM10.1's environment at this time. Instead I will borrow CWM's UI and input technology to build an independent front-end with this Ubuntu/glibc environment I have working. My idea is to release another Recovery image when that's ready so we'll have a chance to practice/debug before moving to the Boot image.
Hal9k+1 said:
Kulve: Thanks so much for refocusing me! I should have grabbed the patch from day 1, but that summary description had me a bit spooked. Note that I kept the HDMI/PRIMARY symbol enabled, so there's still only the fb0 device on this kernel.
Click to expand...
Click to collapse
Hit the Thanks button
Anyway, do you have your kernel source code somewhere? Being able to use multiple resolutions on HDMI while keeping it as primary might be something that many Ouya Android gamers want as they might be able to play at 720p then.
ooo nice, ill try it out and see what happens
kulve said:
Hit the Thanks button
Anyway, do you have your kernel source code somewhere? Being able to use multiple resolutions on HDMI while keeping it as primary might be something that many Ouya Android gamers want as they might be able to play at 720p then.
Click to expand...
Click to collapse
Done! :laugh:
My modified files were tarred up and placed in the ZIP; let me know of any possible issue. I'm not planning on a GIT account, but anyone may feel free to pull anything back to their project. Also I understand that sticking with HDMI/PRIMARY may reduce some of the capability/flexibility you're seeing, but I wanted to stay honored to the Android/CM layout expectation if possible.
Hal9k+1 said:
Done! :laugh:
My modified files were tarred up and placed in the ZIP; let me know of any possible issue. I'm not planning on a GIT account, but anyone may feel free to pull anything back to their project. Also I understand that sticking with HDMI/PRIMARY may reduce some of the capability/flexibility you're seeing, but I wanted to stay honored to the Android/CM layout expectation if possible.
Click to expand...
Click to collapse
Any chance of getting some concise installation instructions?
zondajag said:
Any chance of getting some concise installation instructions?
Click to expand...
Click to collapse
Here's a quick executive summary until I can update the 1st post.
I'm reminded there's another XDA project (Ouya Safe Recovery) with a very similar goal as this, and works by reversing the Boot and Recovery concepts. However it's completely incompatible with us, and those users should not be doing any flashing -- at least not until we have a Boot image ready.
First step is to get rcvy092613.img to the Ouya in its /tmp directory. This may be done with an "adb push rcvy092613.img /tmp" command, or can by done through Secure Copy if an appropriate SSH server is set up.
Next step is to access the Ouya shell, either running from the main ROM or from a Recovery ROM. Be sure to become root (ensure "#" in the prompt) as needed.
Run the following to back up the old image:
cd /dev/block/platform/sdhci-tegra.3/by-name/
dd if=SOS of=/sdcard/old_rcvy.img
Make sure the new image is correct - should see "2a882d1ba8c2d543503cacb49ab0d397":
md5sum /tmp/rcvy092613.img
On to flashing Recovery:
dd if=/tmp/rcvy092613.img of=SOS
Now wait at least a full minute in case there is any internal flushing still taking place. And to finish up:
sync
reboot recovery
Aye....never enough time to tinker it seems, especially with getting over this flu.
At this point I have my own compiled code splitting the boot image file, as well as counting the power button clicks.
I want to see if I can make a welcome/instruction screen, probably by getting CWM's minui down to its core essence. From there it will hopefully just be normal integration work to achieve a new Recovery for testing.
Everyone, a new boot menu is ready for testing. Please read through the first post to see if you'd like to try it out. Apologies once again for the delay in getting this ready.
Hal9k+1 said:
Everyone, a new boot menu is ready for testing. Please read through the first post to see if you'd like to try it out. Apologies once again for the delay in getting this ready.
Click to expand...
Click to collapse
Did I read correctly that the image support multibooting?
kulve said:
Did I read correctly that the image support multibooting?
Click to expand...
Click to collapse
Hi again Kulve. It supports three Android boot images - the main + two alternates: kernel.img, kernelA1.img, & kernelA2.img. It prefers to see the selected image in /sdcard, but will shift to /system as needed.
So, it is multi-booting, but you should keep in mind that there is still only the single /system partition. So installing two normal ROMs together probably won't work out, due to that common storage area. However, one of the ROMs could be based out of /system, while any others could use some form of external/networked storage. Note that the Android image format contains both the kernel and the initial ramdisk, so I feel that a multi-boot arrangement could be done.
Hal9k+1 said:
Hi again Kulve. It supports three Android boot images - the main + two alternates: kernel.img, kernelA1.img, & kernelA2.img. It prefers to see the selected image in /sdcard, but will shift to /system as needed.
So, it is multi-booting, but you should keep in mind that there is still only the single /system partition. So installing two normal ROMs together probably won't work out, due to that common storage area. However, one of the ROMs could be based out of /system, while any others could use some form of external/networked storage. Note that the Android image format contains both the kernel and the initial ramdisk, so I feel that a multi-boot arrangement could be done.
Click to expand...
Click to collapse
My kernel is hard coded to mount the Debian (or whatever) rootfs from /dev/sdaX so Ouya's internal partitioning doesn't matter. It would be really cool to be able to put kernelA1.im to /sdcard, an USB flash drive to the USB port and boot to Debian without tinkering with adb/fastboot/etc. on a PC.
I'm not currently using any initrd-images but adding something simple should be straightforward.

Customizing the Fire TV Stick 4K (mantis) - Debloat - Replace launcher and Testing

EDIT (12/08/22): Parts of this guide may be out of date, it hasn't been updated since December 2019.
TL; DR Version in the second post, it's also a short overall summary. Might be best to have a look so you don't get overwhelmed by this first post.
Just thought I would share my experience with the 4K. Just as an FYI this is my first firestick and I've only had it for about a week but I've been playing with it quite a bit.
Personally I'm interested in removing all amazon related products/apps/services etc. With the exception of the store as I would like to get some of my apps through it.
Making it as lean and fast as possible.
Getting as close to AndroidTV as possible without losing any functionally and keeping stability.
I'm primarily interested in Plex and/or Kodi (with no addon apps, just vanilla kodi).
Having root. I like to have the ability to do anything, and I personally found rooting the stick easy so I found no reason not to do it. With that in mind everything I did I had root. I have no idea if any of these steps work without root.
Pre info
I chose to not flash the Prerooted Stock Image due to the comment Sus_i made here. I updated, then rooted.
EDIT (12/08/22): Updating before rooting is no longer recommended.
Step1
Plug it in, run through the setup and let it update. Go to settings -> My Fire TV -> Developer Options and enable ADB Debugging and Apps from Unknown Sources.
Step 2
Root it!
Guide here
This guide/post was helpful also. There is a good video of them opening up the firestick to access the necessary point to short/ground to allow the root script to work. Just be careful with what you use. I just used a small copper wire.
After getting root. Put it back in the case. and plug it in to your tv.
Step 3
Running commands with adb
Get and install adblink, link here
Information on how to use it is on the site. You will need to get the IP address of the firestick. Go to setting -> device -> network -> about
open adblink
click adb shell
type
Code:
reboot recovery
then enter
You'll now be in TWRP
Step 4
Install Magisk
Get the latest stable magisk zip from here
No need for the Magisk Manager apk, that will get installed with the above zip.
Put the zip in the same folder that the adblink.exe is in. (you can find that by clicking adb shell in adb link and then typing exit, then enter. It will show you where you should put the zip file)
Open adblink if you closed it (just leave it open)
click adb shell
which should show the bellow on screen
Code:
mantis:/$
type exit
then paste the following (replace the "Magisk-v20.1.zip" with the correct name of the magisk zip you downloaded)
Code:
adb push Magisk-v20.1.zip /sdcard/
then type
Code:
adb shell
echo "--update_package=/sdcard/Magisk-v20.1.zip" > /cache/recovery/command
echo "--wipe_cache" >> /cache/recovery/command
reboot recovery
It will reboot and install magisk, then reboot to the launcher.
You can now check if you like if magisk is installed correctly and if you have root (you should)
Step 5
Install [Magisk][Module] FireTV 4K Stick Add-Ons
This gets rid of the amazon launcher and does a few other things, including installing xposed framework.
Follow the instructions in that thread. But here's some additional info. Which is just a copy of how we installed magisk.
Download and put the zip in the same folder that the adblink.exe is in.
Open adblink if you closed it (just leave it open)
click adb shell
which should show the bellow on screen
Code:
mantis:/$
type exit
then paste the following (replace the "AFTV-MM-1.9.zip" with the correct name of the AFTV-MM .zip you downloaded)
Code:
adb push AFTV-MM-1.9.zipp /sdcard/
then type
Code:
adb shell
echo "--update_package=/sdcard/AFTV-MM-1.9.zip" > /cache/recovery/command
echo "--wipe_cache" >> /cache/recovery/command
reboot recovery
It will reboot and install AFTV-MM, then reboot to the launcher. It does some things automatically on first boot and may reboot on it's own just let it do it's thing. Some additional commands need to be run via ADB, go to the thread and follow the instructions there: [Magisk][Module] FireTV 4K Stick Add-Ons
Step 6
Remove amazon bloat. *More info below*
Now I've seen a few lists here and there and tried to guess which things to disable on my own until I found these scripts.
Now these scripts weren't made for the 4k (mantis) firestick as you can see from the compatibility list. But I assumed the packages installed would be close so I'm guessing this isn't a bad starting point. But just remember this clearly wasn't meant for this device.
Download the script from here All credit for the original script goes to esc0rtd3w.
and put it in your adblink folder.
Open adblink if you closed it (just leave it open)
click adb shell
which should show the bellow on screen
Code:
mantis:/$
type exit
Code:
adb push bloat-disable.sh /sdcard/
then type
Code:
adb shell
su
cp /sdcard/bloat-disable.sh /data/local/tmp/
chmod 755 /data/local/tmp/bloat-disable.sh
sh /data/local/tmp/bloat-disable.sh
The script will then disable all the bloat. If you would like to enable all the bloat then use this script, download it and follow the same instruction from above. If you just need to enable a single app/service then you can run:
Code:
adb shell
su
pm enable com.amazon.dcp
replacing "com.amazon.dcp" with the app you want to enable.
Step 7
If you want Kodi as the launcher
You can get a modified apk here The thread where this came from originally is here Discussion of an update here
Side load the apk with adblink. Should be self explanatory, click install apk. Once installed open LauncherHijack and select Kodi as the launcher.
Step 8
Setting Kodi (or any other launcher) as the launcher
Install Launcher Hijack (Clone Mod), get the apk here
Follow the instructions here to install it and get it working. By now you should be getting comfortable with abdlink, use it to install the apks and run the adb shell commands.
Other apps to install
Smart Youtube TV (no ads)
OpenVPN install if you want or need it. In my case I need to slightly deviate from the guide. I simply didn't need to create the login.conf file. I Just copied opvn config over and then in settings chose "Certificates" for type and insert the password in "private key password".
That's it for now. I'm curious what other modifications can be done on the 4K (mantis). I'm thinking about/planning on trying a few I've seen around. I think as long as I can get back to TWRP then worse case I should be able to flash the stock ROM to recover. Would be interested to hear what other people may have pulled off.
*Step 6 more info*
This script will remove all packages that esc0rtd3w deemed safe to remove as of Fire OS 5.2.7.2 on the FireStick2. It will leave the amazon launcher enabled and allow use of the amazon app store. The amazon app store can also be disabled but disabling the amazon launcher breaks access to the settings.
My slightly edited version of his script
esc0rtd3w firestick-loader github. All credit for the script goes to him.
List of services/packages that are new for Fire OS 6.2.6.8
If anyone can inform me of the packages/services that can be safely disabled, please let me know and I can include them in the script. For now they are left untouched/enabled.
Info I found and used for this post
[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)
[Magisk][Module] FireTV 4K Stick Add-Ons
[FireTVStick4k] Updated Info November 2019
[NEWBIE GUIDE] How to Unlock Bootloader/Root and install Addons FireStick 4k
FireTV4k Stick: Achieving Root With Magisk
[LAUNCHER] XBMC/Kodi for Fire TV (Root)
Updated Kodi 18.5 version by the developer elmerohuesoWhich is posted here
Install OpenVPN on fireTV (no root required)
Running scripts on the Firestick, in this case the disable-bloat.sh script
This assumes you have an understanding of how to use adb and if more detail of any of the following steps is necessary then follow the steps in the first post.
Step 1
Plug it in, run through the setup and let it update. Enable ADB and Unknown Sources.
Step 2
Root it!
Guide here
Step 3
Get adb installed
Step 4
Install Magisk
Step 5
Install [Magisk][Module] FireTV 4K Stick Add-Ons
Step 6
Remove amazon bloat.
Download the script from here
Run on firestick via ADB
Step 7
If you want Kodi as the launcher, See the first post.
Step 8
Setting Kodi (or any other launcher) as the launcher, See the first post.
Step 9
Install other apps
OpenVPN install Seeing first post for more info
Smart Youtube TV (no ads)
Step 10
Other Tweaks
Stop firestick from going to sleep/returning to the home screen.
Things that don't work or I'm interested in trying to get working.
-Can't "install" apps from amazon. The app store is there and can install from "the cloud" but can't search for new apps. Likely due to something being disabled., just not sure what. I assume installing from amazon web into the cloud or something like that could be a work around. Might be that the only way to search for apps is with the default launcher?
-Voice search doesn't work. Looks like some people have kind of gotten it to work but I have not.
-Chromecast support.
Both would likely have a better chance if google play services/store could be installed. I see there was some effort put forth in trying to do that on previous firetvstick models so I may try some of the info that is out there. Seeing as we now have root its a lot more possible.....I assume.
reserved 1
reserved 2
I keep meaning to test nanodroid with microg & the patched play store. I've not done it yet as I was afraid patching the system would screw everything up & I had so much difficulty getting bootloader patched to begin with. It may not be necessary to patch system, I recall using an xposed module for spoofing some time ago on an old phone so that could be a possibility.
It might not work, but there's probably less that can go wrong as there's less "deep" system integration than using official gapps. Just an idea if you fancy trying it.
Booting between FireOS and TWRP
Below are the first steps in rooting the firestick 4k:
Once it reboot’s into TWRP do you now have root privs?
Can you stop here and not install a “pre-rooted image”?
Can I now boot between FireOS and TWRP if so How?
Thank You,
1.Boot the ISO
2.Download and extract the exploit package.
3.Open a terminal in the kamakiri directory
Run
Code:
4. ./bootrom-step.sh
Short one of the points in the attached photo to ground (the cage of the shielding).
Ideally you want to use DAT0, since that is tiny it might be easier to short the point marked CLK instead.
It is very important that you use a piece of soft wire or aluminum foil or something similar for shorting. Don't use tweezers as that makes it incredibly easy to knock of the capacitor off the PCB and kill the board!
5. Connect the stick to your computer (while keeping it shorted)Both USB and HDMI ???
6. The script should tell you to release the short and hit enter
Once finished run
Code:
7. ./fastboot-step.sh
Your device will now reboot into TWRP
RPM99 said:
Below are the first steps in rooting the firestick 4k:
Once it reboot’s into TWRP do you now have root privs? (Yes, but you need to install magisk to manage su)
Can you stop here and not install a “pre-rooted image”? (Yes, you don't need to install the image)
Can I now boot between FireOS and TWRP if so How? (adb commands or the reboot menu if you have the magisk module installed. For adb, insure you have adb debugging turned on, then log into the firestick (that's all in the guide) and run "reboot recovery")
Thank You,
1.Boot the ISO
2.Download and extract the exploit package.
3.Open a terminal in the kamakiri directory
Run
Code:
4. ./bootrom-step.sh
Short one of the points in the attached photo to ground (the cage of the shielding).
Ideally you want to use DAT0, since that is tiny it might be easier to short the point marked CLK instead.
It is very important that you use a piece of soft wire or aluminum foil or something similar for shorting. Don't use tweezers as that makes it incredibly easy to knock of the capacitor off the PCB and kill the board!
5. Connect the stick to your computer (while keeping it shorted)Both USB and HDMI ??? (hdmi isn't needed, just usb)
6. The script should tell you to release the short and hit enter
Once finished run
Code:
7. ./fastboot-step.sh
Your device will now reboot into TWRP
Click to expand...
Click to collapse
I replied inline in brackets. On mobile so a pain to in another way.
Thanks for the clarification
bnevets27 said:
I replied inline in brackets. On mobile so a pain to in another way.
Click to expand...
Click to collapse
Hi,
Inline with great answers is just fine, thank you.
I will investigate magisk, I didn't realize that's what it is for.
And "reboot recovery" at the adb command line will put me back in TWRP mode - This was great info!!
I ordered a new firestick to try this on, it will be here next week so I have some time to read up.
Thanks again,
Steve
More questions if you can please
RPM99 said:
Hi,
Inline with great answers is just fine, thank you.
I will investigate magisk, I didn't realize that's what it is for.
And "reboot recovery" at the adb command line will put me back in TWRP mode - This was great info!!
I ordered a new firestick to try this on, it will be here next week so I have some time to read up.
Thanks again,
Steve
Click to expand...
Click to collapse
When you short to ground and then plug into usb to boot firestick is that considered bootloader mode?
At what point is the greatest risk of bricking the firestick?
Thanks,
Steve
RPM99 said:
When you short to ground and then plug into usb to boot firestick is that considered bootloader mode?
At what point is the greatest risk of bricking the firestick?
Thanks,
Steve
Click to expand...
Click to collapse
I guess that would probably be technically correct.
Only time there's a chance of bricking, usually for flash anything, is during the writing process. Or a corrupt file.
I've done a hand full and haven't had any issues. Just take normal precautions like do what you can to prevent a power outage during the flash and once it's plugged in and flashing don't touch anything till its finished.
Personally I plugged in the mirco USB into the firestick first, then lined up the USB into the computer but didn't push it in. Held a small solid copper wire against the rf shield (the metal that surrounds the chip) and touched the side of what I think is a capacitor (you can't get to clk without taking the surrounding metal piece off). It's the "other" point they mention you can use. While doing that with one hand I plug in the USB to the computer. Remember the script has to be run first, waiting to see the stick before you plug it in.
If you miss time it or don't make the connection, the script just won't tell you to remove the short and press enter, so you'll just have to try again.
bnevets27 said:
...
Both would likely have a better chance if google play services/store could be installed. I see there was some effort put forth in trying to do that on previous firetvstick models so I may try some of the info that is out there. Seeing as we now have root its a lot more possible.....I assume.
Click to expand...
Click to collapse
Did you try https://forum.xda-developers.com/fire-tv/development/magisk-gapps-fireos-6-t4019095 ?
Kramar111 said:
Did you try https://forum.xda-developers.com/fire-tv/development/magisk-gapps-fireos-6-t4019095 ?
Click to expand...
Click to collapse
I haven't no. I might have missed that one. I've been pretty happy the the end result of using his module in this thread. And after updating to the latest version, voice search is working for me.
I have some other projects at the moment so I'm not working on this but I'll come back to later on.
bnevets27 said:
I haven't no. I might have missed that one. I've been pretty happy the the end result of using his module in this thread. And after updating to the latest version, voice search is working for me.
I have some other projects at the moment so I'm not working on this but I'll come back to later on.
Click to expand...
Click to collapse
When you say voice search is working, does that mean you can click the little mic icon at the top left of the Android TV launcher and it will search? Does it work well? Thanks
gogorman said:
When you say voice search is working, does that mean you can click the little mic icon at the top left of the Android TV launcher and it will search? Does it work well? Thanks
Click to expand...
Click to collapse
Yeah you have to click the mic on screen then the mic on the remote. Seems to work pretty well but haven't used it much more then just to see if it worked.
bnevets27 said:
Step 2
Root it!
Guide here
Click to expand...
Click to collapse
This exploit does not give you root. This unlocks the bootloader and then installs TWRP recovery.
.... I just used a small copper wire.
Click to expand...
Click to collapse
I used a Reese's candy wrapper! I just rolled it between my fingers and wedged it under the metal "cover," touching the CLK and DATA points. Then plugged it in to the USB port.
Step 4
Install Magisk
Click to expand...
Click to collapse
This is what gives you ROOT access.
Took me a while, reading through all the threads, to figure out which exploit does what.
Step 5
Install [Magisk][Module] FireTV 4K Stick Add-Ons
Click to expand...
Click to collapse
This module is great. It also disables Amazon firmware updates. There are a bunch of other tips in that thread too.
Thanks for the tips and tricks!
When trying to run the disable script I get i get an error at the last command. /data/local/tmp/bloat-disable.sh[7]: syntax error: 'newline' unexpected.When running command " sh /data/local/tmp/bloat-disable.sh "
Can you create a bloat-disable script dedicated to fire stick 4k (mantis) ? that would be beneficial for everyone.

Categories

Resources