How to root the Fire TV 2 on 5.2.6.8 firmware

Posted March 9, 2019

I happened to be reading AFTV News the other day and came across this article which mentioned the Fire TV 2 had been rooted on the latest firmware. The article led me to this thread at the XDA Forums where "urbanman2004" was able to root his Fire TV 2 on Windows. So I decided to write up a guide for us Mac users. All credit goes to all those involved starting with "diplomatic" who discovered this exploit which was originally created for Android tablets with MediaTek processors.

Any instructions followed in this tutorial are strictly YOUR RISK to assume.

Who is this tutorial for?

Those on 5.2.6.8 firmware or older. It is unknown if any newer firmware will close this exploit.
Mac users. I am on OS X El Capitan 10.11.
Fire TV 2nd generation models (2015 - 4k video) new out of the box. If you're rooted on another firmware you can restore to stock and follow this guide.

Prerequisites

Either a hard drive, flash drive or a microSD card in FAT 32 format and at a minimum 1 GB in capacity.
You'll need a USB hub (possibly powered if using an external hard drive).
A USB keyboard and mouse. I personally have the Logitech K400 Plus. This includes a built in trackpad.

Step 1

First determine the IP address of your Fire TV. I went to Settings, Device, About, Network. Mine is 10.0.1.23. Depending on your firmware your menus may be different.

Step 2

On your Fire TV go to Settings, Device, Developer options. Set ADB debugging to ON and Apps from Unknown Sources to OFF.

Step 3

Download the adbLink program here. This will allow your Mac to connect to the Fire TV over Wi-Fi. Note that the current version is 4. My screen shots will show version 3 as I'm still running El Capitan on my Mac. Install the program into your Applications folder. Launch the program. It will look similar to this. Click the New button.

Enter a name for your Fire TV in the Description field. Then enter your IP address in the Address field. Click Save when you're done.

Click Connect.

You'll see this pop up from adbLink. Click OK.

You'll see this pop up on your Fire TV. You'll need to have a keyboard/trackpad connected to your Fire TV via a USB hub. Press Enter for the check box to get checked. Press the down arrow key to highlight the OK box, and then press Enter to accept.

adbLink will now show the connected device, and that it's still unauthorized.

If you click Refresh ADB that should change it to IP Connection.

Step 4

Download mtk-su_r5.zip from here. It’s listed under DOWNLOAD, Current Version, Release 5. Unzip the file and leave it on your desktop.

Step 5

In adbLink click File manager.

In the Directory field enter /data/local/tmp Select system from the drop down box. Click inside the right side window of the file manager (it will highlight in blue around the edges). Click the Go button.

Your screen should look like this. Click Push.

At the pop up select Files.

In the Finder window navigate to the mtk-su_r5 on your desktop. Go to the arm64 folder and select mtk-su. Click Open.

The file will now appear in the right window of the adbLink file manager.

Go back to the main program window and click ADB Shell.

A Terminal window will open.

Enter the following commands one at a time, pressing Enter after each one.

cd /data/local/tmp
chmod 755 mtk-su
./mtk-su

You should see the line: New UID/GID: 0/0 appear.

Enter this command and press Enter.

getenforce

You should receive the reply Permissive.

Step 6

Download Fire TV 2 Custom Recovery Version 7 from here. Then download a pre-rooted ROM for 5.2.6.8 firmware from here. Note that this thread is continually updated and newer pre-rooted ROMs may be available. At this time of this tutorial being posted 5.2.6.8 was the current firmware.

Place both files onto a USB flash drive formatted as FAT 32.

Connect the USB flash drive to a USB hub which is connected to the Fire TV.

In the Terminal enter

cd /storage/usbotg/

Enter

sh /storage/usbotg/firetv2_recovery_v7.zip

You should see: Extracting unzip..., Remounting /system read-write..., Extracting..., Remounting /system read-only...

Press the CTRL and the C key to exit the script.

Enter

reboot recovery

Step 7

The Fire TV should display this screen.

Note, the original instructions from the XDA forum thread says: "Your AFTV2 should reboot to a black screen displaying the Amazon logo, followed by a prompt stating that the device will automatically restart, but if not to unplug then re-plug the power source. It will not automatically restart, but DO NOT unplug the device yet." Then it says: "NOTE – whatever you do DON'T let your AFTV2 idle for too long or it will time out thus restarting, requiring you to repeat the prior steps."

So, I originally cycled power after 1 minute, but that was too soon and I had to repeat some stuff. The second time through (I had a stop watch running) I rebooted right at 5 minutes and it worked. I was greeted with the Teamwin logo! We're halfway there.

Next the boot selector screen appeared. Using your keyboard, press the right arrow key to select Launch Recovery.

Use the trackpad to get to the Install button and click it.

You can't read it, but the lower right gray button says Select Storage. By default mine opened to the USB flash drive. Change this as needed for your storage type. Then click on the 5.2.6.8 pre-rooted ROM file.

Click on the arrows at Swipe to confirm Flash.

It will take about a minute to flash.

It's hard to read, but the lower right button says Reboot System. Click it.

The boot selection screen by default is set to Boot Normally so you don't have to do anything. Just let it time out.

You'll see this screen next.

Step 8

Go back to adbLink and click Connect.

Click ADB Shell.

In the Terminal window enter

su

A prompt will appear on the Fire TV. Use the arrow keys on your keyboard to get to the Grant button and click it.

You’ll see root@sloane in the Terminal letting you know you are at root!

I find this step to be optional as TWRP does an OUTSTANDING job at protecting you against updates already. It's kind of a pain to un-root a box. However, if you want that extra bit of protection enter the following:

pm disable com.amazon.device.software.ota

and press enter. You’ll receive a disabled response.

You can verify the block on updates works by confirming it in Settings, My Fire TV, About, Check for System Update, when you receive this error.