Ideal downgrade Fire TV OS via hardware (eMMC) - Fire TV Android Development

Hi every one!
I have idea downgrade Fire TV OS via hardware (eMMC)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
My Fire TV Gen 2 running on Fire TV OS version 5.2.6.1. it can't root by kingroot. i follow instruction hardware root but not work. i desolder eMMC and connect to Linux PC use Transcend USB 3.0 with SD Card Adaptor
Now i can see all partition layout via command :
- to see partition :
Code:
[COLOR="red"] - need on first time and enter your password[/COLOR]
sudo su
fdisk /dev/sda
enter "x" then enter "p"
or open Gparted to see
- to export and backup partition layout:
Code:
fdisk /dev/sda
Enter "O"
Enter name
Enter "q" to quit
Now i can dump all partition use command :
Code:
dd if=/dev/sda1 of=/home/duong/Desktop/dump/1PRO_INFO.bin
dd if=/dev/sda2 of=/home/duong/Desktop/dump/2NVRAM.bin
dd if=/dev/sda3 of=/home/duong/Desktop/dump/3TEE1.bin
dd if=/dev/sda4 of=/home/duong/Desktop/dump/4TEE2.bin
dd if=/dev/sda5 of=/home/duong/Desktop/dump/5lk.bin
dd if=/dev/sda6 of=/home/duong/Desktop/dump/6boot.img
dd if=/dev/sda7 of=/home/duong/Desktop/dump/7recovery.img
dd if=/dev/sda8 of=/home/duong/Desktop/dump/8KB.bin
dd if=/dev/sda9 of=/home/duong/Desktop/dump/9DKB.bin
dd if=/dev/sda10 of=/home/duong/Desktop/dump/10MISC.bin
dd if=/dev/sda11 of=/home/duong/Desktop/dump/11LOGO.bin
dd if=/dev/sda12 of=/home/duong/Desktop/dump/12EXPDB.bin
dd if=/dev/sda13 of=/home/duong/Desktop/dump/13system.img status=progress
dd if=/dev/sda14 of=/home/duong/Desktop/dump/14cache.img status=progress
dd if=/dev/sda15 of=/home/duong/Desktop/dump/15userdata.img status=progress
I try mount system and edit them use comand :
Code:
[COLOR="red"]- make folder "system" to root path :[/COLOR]
cd /
mkdir system
[COLOR="red"]- mount system :[/COLOR]
mount -o loop /home/duong/Desktop/dump/13system.img /system
[COLOR="Red"]- mount system to rw for modify:[/COLOR]
mount -o remount,rw /system
[COLOR="Red"]- mount system to ro:[/COLOR]
mount -o remount,ro /system
i try modify something "put manual su, supolicy" to path /system/xbin symlink "daemonsu" to "su"
put "libsupol.so" to path "/system/lib64" and remount system ro, unmount system
Now i write all partition to eMMC use command:
Code:
dd if=/home/duong/Desktop/dump/1PRO_INFO.bin of=/dev/sda1
dd if=/home/duong/Desktop/dump/2NVRAM.bin of=/dev/sda2
dd if=/home/duong/Desktop/dump/3TEE1.bin of=/dev/sda3
dd if=/home/duong/Desktop/dump/4TEE2.bin of=/dev/sda4
dd if=/home/duong/Desktop/dump/5lk.bin of=/dev/sda5
dd if=/home/duong/Desktop/dump/6boot.img of=/dev/sda6
dd if=/home/duong/Desktop/dump/7recovery.img of=/dev/sda7
dd if=/home/duong/Desktop/dump/8KB.bin of=/dev/sda8
dd if=/home/duong/Desktop/dump/9DKB.bin of=/dev/sda9
dd if=/home/duong/Desktop/dump/10MISC.bin of=/dev/sda10
dd if=/home/duong/Desktop/dump/11LOGO.bin of=/dev/sda11
dd if=/home/duong/Desktop/dump/12EXPDB.bin of=/dev/sda12
dd if=/home/duong/Desktop/dump/13system.img of=/dev/sda13 status=progress
dd if=/home/duong/Desktop/dump/14cache.img of=/dev/sda14 status=progress
dd if=/home/duong/Desktop/dump/15userdata.img of=/dev/sda15 status=progress
i solder eMMC to board but not root
I believe if your device has been root and your share all dump partition, i can downgrade Fire TV OS to old version and root it
What do you think about this?
Anyone can dump all partition via adb and share file? (your device need root and running on old version OS)
I will try it. thank
Sorry my English

---

Have you tried the old downgrade method? (Instructions here)
I would try to use that method to downgrade to 5.2.1.0, which is rootable. You can get the stock package from here. Just be sure to use the full version and not the incremental version. If the downgrade works, root using this method.

---

AFTVnews.com said:
Have you tried the old downgrade method? (Instructions here)
I would try to use that method to downgrade to 5.2.1.0, which is rootable. You can get the stock package from here. Just be sure to use the full version and not the incremental version. If the downgrade works, root using this method.
Click to expand...
Click to collapse
thank for reply.
My Fire TV 2 has not been root. it running on version 5.2.6.1. i use kingroot but not work.
i use command
"
adb devices
adb shell
su
"
/system/bin/su: not found
so i can't downgrade my device to old OS version

---

Jackie393 said:
thank for reply.
My Fire TV 2 has not been root. it running on version 5.2.6.1. i use kingroot but not work.
i use command
"
adb devices
adb shell
su
"
/system/bin/su: not found
so i can't downgrade my device to old OS version
Click to expand...
Click to collapse
What I meant is use the eMMC reader to place the 5.2.1.0 package in the /cache directory and the "command" file containing "--update_package=/cache/update.zip" in the /cache/recovery directory. Then boot into stock recovery and see if the Fire TV installs the older OS.

---

AFTVnews.com said:
What I meant is use the eMMC reader to place the 5.2.1.0 package in the /cache directory and the "command" file containing "--update_package=/cache/update.zip" in the /cache/recovery directory. Then boot into stock recovery and see if the Fire TV installs the older OS.
Click to expand...
Click to collapse
yes. i know. i will try it. thank you

---

AFTVnews.com said:
What I meant is use the eMMC reader to place the 5.2.1.0 package in the /cache directory and the "command" file containing "--update_package=/cache/update.zip" in the /cache/recovery directory. Then boot into stock recovery and see if the Fire TV installs the older OS.
Click to expand...
Click to collapse
i have trouble : cache space only 262MB, file update : 442,7MB. what should i do?
sda14 is "cache" you can see "partition" above

---

when i mount partition sda14 (cache) i can see :
file update > free space. it only have 262MB

---

Jackie393 said:
when i mount partition sda14 (cache) i can see :
file update > free space. it only have 262MB
Click to expand...
Click to collapse
Try placing the file in /sdcard/update.zip and modify the command file to contain --update_package=/sdcard/update.zip
Instead, you might need to place it in /storage/emulated/0/update.zip and modify the command file to contain --update_package=/storage/emulated/0/update.zip
The command file needs to still go in /cache/recovery/

---

AFTVnews.com said:
Try placing the file in /sdcard/update.zip and modify the command file to contain --update_package=/sdcard/update.zip
Instead, you might need to place it in /storage/emulated/0/update.zip and modify the command file to contain --update_package=/storage/emulated/0/update.zip
The command file needs to still go in /cache/recovery/
Click to expand...
Click to collapse
i mount partition sda15 "usedata". i can't find path "/storage/0/".
Try place file to "/sdcard/update.zip". Does it mean put to path "/sdcard/ "or put to Micro SD Card?
Sorry my english

---

Can i find recovery for FIRE TV GEN 2?
i can't find enywhere. www.aftvnews.com/software-fireos3/#firetvrecovery

---

Jackie393 said:
i mount partition sda15 "usedata". i can't find path "/storage/0/".
Try place file to "/sdcard/update.zip". Does it mean put to path "/sdcard/ "or put to Micro SD Card?
Sorry my english
Click to expand...
Click to collapse
Yes, this means the internal /sdcard directory. You don't need eMMC reader to place files here. Use standard ADB to transfer the file with the command: adb push update.zip /sdcard/
You'll need the eMMC reader to place the command file.

---

AFTVnews.com said:
Yes, this means the internal /sdcard directory. You don't need eMMC reader to place files here. Use standard ADB to transfer the file with the command: adb push update.zip /sdcard/
You'll need the eMMC reader to place the command file.
Click to expand...
Click to collapse
i place file command to /cache/recovery (eMMC)
and put update.zip to path /sdcard/
i use command via adb
Code:
adb devices
adb reboot recovery
after Fire TV reboot to recovery and nothing

---

i think if i have 15 partition, file partition layout . i flash them, may be it work because bootloader block or recovery block downgrade to old version

---

I view path "META-INF/com/google/android/update-script" of file update.zip. i can see partition will flash
Code:
getprop("ro.product.device") == "sloane" || abort("This package is for \"sloane\" devices; this is a \"" + getprop("ro.product.device") + "\".");
show_progress(0.750000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/platform/mtk-msdc.0/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/platform/mtk-msdc.0/by-name/boot");
show_progress(0.200000, 10);
package_extract_file("images/preloader.img", "/dev/block/mmcblk0boot0");
package_extract_file("images/lk.bin", "/dev/block/platform/mtk-msdc.0/by-name/lk");
package_extract_file("images/tz.img", "/dev/block/platform/mtk-msdc.0/by-name/TEE1");
#
# Edify script to copy the correct logo image
#
ui_print("Copying logo.bin to LOGO partition ...");
package_extract_file("images/logo.bin", "/dev/block/platform/mtk-msdc.0/by-name/LOGO");
package_extract_file("META-INF/com/amazon/android/target.blocklist", "/cache/recovery/last_blocklist");
set_metadata("/cache/recovery/last_blocklist", "uid", 0, "gid", 0, "mode", 0444, "capabilities", 0x0);
but i don't know "preloader.img" flash to "mmcblk0boot0". what does this mean?

---

Resolve. I can downgrade my fire tv to OS version 5.2.1.0 and root it in here :
https://forum.xda-developers.com/fire-tv/development/share-hardware-downgrade-fire-tv-gen-2-t3817059

---

tried a few times to get that eMMC reader, sold out or discon would be nice to have a work around for those with a latest firmware boot locked firetv gen 2 laying around

---

Drjizzocyst said:
tried a few times to get that eMMC reader, sold out or discon would be nice to have a work around for those with a latest firmware boot locked firetv gen 2 laying around
Click to expand...
Click to collapse
- You need de-soldering eMMC, then connect eMMC to PC(run linux) use USB Card Read (eMMC type 153, VCC, VCCq, GND, CLK, CMD, DAT0).
- Use PC flash firmware version 5.2.1.0 to eMMC
- Soldring eMMC to board and plug in power to Fire Gen 2
- Install KingRoot and try root (because 5.2.1.0 OS version can be root with KingRoot)

---

Jackie393 said:
- You need de-soldering eMMC, then connect eMMC to PC(run linux) use USB Card Read (eMMC type 153, VCC, VCCq, GND, CLK, CMD, DAT0).
- Use PC flash firmware version 5.2.1.0 to eMMC
- Soldring eMMC to board and plug in power to Fire Gen 2
- Install KingRoot and try root (because 5.2.1.0 OS version can be root with KingRoot)
Click to expand...
Click to collapse
Probably super obvious, but is desoldering the eMMC on the gen2 the only way to read it with a PC? The gen1 you could read it without removing the chip. Assuming this is the case, anyone know of any guides or videos on how one would safely go about desoldering it (and resoldering it back)? I'm trying to unbrick one that was improperly attempted to be unrooted via an OTA firmware.

---

falk0069 said:
Probably super obvious, but is desoldering the eMMC on the gen2 the only way to read it with a PC? The gen1 you could read it without removing the chip. Assuming this is the case, anyone know of any guides or videos on how one would safely go about desoldering it (and resoldering it back)? I'm trying to unbrick one that was improperly attempted to be unrooted via an OTA firmware.
Click to expand...
Click to collapse
I try find all point on Fire TV Gen 2. but i can't find CLK point. that mean only de-soldring eMMC to try root.
This my video to soldring eMMC to board, my skill not best
Sorry my english

---

Jackie393 said:
I try find all point on Fire TV Gen 2. but i can't find CLK point. that mean only de-soldring eMMC to try root.
This my video to soldring eMMC to board, my skill not best
Sorry my english
Click to expand...
Click to collapse
I suppose this was a project you wanted to do because you wanted to achieve root via the EMMC write?
If not why not use the short method instead, and save desoldering emmc, would you prefer to do it this way?
Either way I am intrigued.... Good work