Hardware Root Amazon FireTV

Step by Step - How to hardware root the Amazon FireTV

The FireTV is a superb little media player, fast, cheap small - but restricted by Amazon. To really enjoy the device you need root access. All UK models and US models purchased now cannot be software rooted any more. The only way to obtain root is to hardware root.

Thanks to the following sites and members of their forums for the information I learned:

https://www.exploitee.rs / Maximus64 for creating the eMMC adaptor and initial hardware root.

The XDA Developers forum Click here for thread for lots of assistance and questions answered - a great community of many knowledgable people.

Shopping list:

1 - Maximus64 eMMC adaptor - order from the exploit.rs shop. Click here.

2 - Fine tipped soldering iron

3 - Solder!

4 - Wire. I used 0.1mm enamelled copper wire - its needs to be thin and flexible due to the very small points on the board.

5 - A decent SD Card reader. Note: Decent! The inbuilt MacBook pro one and a cheapo one didn't work for me, the one recommended by the exploitee's does. This transcend one on Amazon works perfectly and is only £6 delivered. Click here.

6 - Small phillips screwdriver, guitar pick or iPhone opening tool or a knife (i used a knife)

Step 1

Disassemble the FireTV. Follow the guide here. Videos here Part 1, Part 2, Part 3, Part 4, Part 5

Step 2

Look at the PCB layout below and work out where the points are.

Original Hi-Res version is on the exploitee.rs web site. Click here.

• Remove the resistor at CLK (this is a 0 ohm resistor - do not worry if you loose or break it, it can be replaced with a wire shorting the two connections - this is actually easier than replacing the resistor).


• Now solder wires to the CLK, DAT0, CMD and GND points from the image above. See image:

• Next cut the wires as short as you can, mine were 5 - 6 cm and solder to the corresponding points on the eMMC adaptor:

 

Thats all the soldering done! Now fireup your PC boot into Linux (I used Ubuntu from a USB stick on a MAC), connect the Sandisk SD Reader and carefully plug in the eMMC adaptor. The EXT4 partitions on the eMMC should now be mounted. Video here.

The software bit (Copy SU over to the FireTV eMMC):

To gain root, we need to copy over SU to the XBIN folder on the correct EXT4 volume.

• Boot into Linux
• Connect the power supply to the FireTV board
• Connect the SDReader that contains the eMMC adaptor to your USB port.
• The volumes will be detected, you can browse the GUI and make a note of the volume that contains the XBIN folder.

We now mount the volume as read/write, copy the SU binary to the XBIN folder and set the correct permissions. Run from terminal.

• dmesg | tail
• mount
• sudo su
• cp /pathtosu/su //xbinvolumename/xbin/su
• chown 0:0 /xbinvolumename/xbin/su
• chmod 6755 !$
• ls -l !$ (Check result)
• exit
• exit

The SU binary is now on the XBIN folder. De-solder your wires from the FireTV. Replace the resistor you removed with a piece of wire (easy) or the actual resistor if you prefer. Reassemble the FireTV and plug her in!

Your FireTV is now rooted.

Next thing to do is disable updates. Ill cover that in a upcoming post.