Fire TV

How to root the Fire TV 2 on 5.2.6.8 firmware

Posted March 9, 2019

I happened to be reading AFTV News the other day and came across this article which mentioned the Fire TV 2 had been rooted on the latest firmware. The article led me to this thread at the XDA Forums where "urbanman2004" was able to root his Fire TV 2 on Windows. So I decided to write up a guide for us Mac users. All credit goes to all those involved starting with "diplomatic" who discovered this exploit which was originally created for Android tablets with MediaTek processors.

Any instructions followed in this tutorial are strictly YOUR RISK to assume.


Who is this tutorial for?

  • Those on 5.2.6.8 firmware or older. It is unknown if any newer firmware will close this exploit.
  • Mac users. I am on OS X El Capitan 10.11.
  • Fire TV 2nd generation models (2015 - 4k video) new out of the box. If you're rooted on another firmware you can restore to stock and follow this guide.


Prerequisites

  • Either a hard drive, flash drive or a microSD card in FAT 32 format and at a minimum 1 GB in capacity.
  • You'll need a USB hub (possibly powered if using an external hard drive).
  • A USB keyboard and mouse. I personally have the Logitech K400 Plus. This includes a built in trackpad.






Step 1

First determine the IP address of your Fire TV. I went to Settings, Device, About, Network. Mine is 10.0.1.23. Depending on your firmware your menus may be different.


Step 2

On your Fire TV go to Settings, Device, Developer options. Set ADB debugging to ON and Apps from Unknown Sources to OFF.

Fire TV



Step 3

Download the adbLink program here. This will allow your Mac to connect to the Fire TV over Wi-Fi. Note that the current version is 4. My screen shots will show version 3 as I'm still running El Capitan on my Mac. Install the program into your Applications folder. Launch the program. It will look similar to this. Click the New button.

Fire TV



Enter a name for your Fire TV in the Description field. Then enter your IP address in the Address field. Click Save when you're done.

Fire TV



Click Connect.

Fire TV



You'll see this pop up from adbLink. Click OK.

Fire TV



You'll see this pop up on your Fire TV. You'll need to have a keyboard/trackpad connected to your Fire TV via a USB hub. Press Enter for the check box to get checked. Press the down arrow key to highlight the OK box, and then press Enter to accept.

Fire TV



adbLink will now show the connected device, and that it's still unauthorized.

Fire TV



If you click Refresh ADB that should change it to IP Connection.

Fire TV



Step 4

Download mtk-su_r5.zip from here. It’s listed under DOWNLOAD, Current Version, Release 5. Unzip the file and leave it on your desktop.


Step 5

In adbLink click File manager.

Fire TV



In the Directory field enter /data/local/tmp   Select system from the drop down box. Click inside the right side window of the file manager (it will highlight in blue around the edges). Click the Go button.

Fire TV



Your screen should look like this. Click Push.

Fire TV



At the pop up select Files.

Fire TV



In the Finder window navigate to the mtk-su_r5 on your desktop. Go to the arm64 folder and select mtk-su. Click Open.

Fire TV



The file will now appear in the right window of the adbLink file manager.

Fire TV



Go back to the main program window and click ADB Shell.

Fire TV



A Terminal window will open.

Fire TV



Enter the following commands one at a time, pressing Enter after each one.

cd /data/local/tmp
chmod 755 mtk-su
./mtk-su



Fire TV



You should see the line: New UID/GID: 0/0 appear.

Fire TV



Enter this command and press Enter.

getenforce

You should receive the reply Permissive.

Fire TV



Step 6

Download Fire TV 2 Custom Recovery Version 7 from here. Then download a pre-rooted ROM for 5.2.6.8 firmware from here. Note that this thread is continually updated and newer pre-rooted ROMs may be available. At this time of this tutorial being posted 5.2.6.8 was the current firmware.

Place both files onto a USB flash drive formatted as FAT 32.

Connect the USB flash drive to a USB hub which is connected to the Fire TV.

In the Terminal enter

cd /storage/usbotg/



Fire TV



Enter

sh /storage/usbotg/firetv2_recovery_v7.zip



Fire TV



You should see: Extracting unzip..., Remounting /system read-write..., Extracting..., Remounting /system read-only...

Fire TV



Press the CTRL and the C key to exit the script.

Fire TV



Enter

reboot recovery



Fire TV



Step 7

The Fire TV should display this screen.

Fire TV



Note, the original instructions from the XDA forum thread says: "Your AFTV2 should reboot to a black screen displaying the Amazon logo, followed by a prompt stating that the device will automatically restart, but if not to unplug then re-plug the power source. It will not automatically restart, but DO NOT unplug the device yet." Then it says: "NOTE – whatever you do DON'T let your AFTV2 idle for too long or it will time out thus restarting, requiring you to repeat the prior steps."

So, I originally cycled power after 1 minute, but that was too soon and I had to repeat some stuff. The second time through (I had a stop watch running) I rebooted right at 5 minutes and it worked. I was greeted with the Teamwin logo! We're halfway there.

Fire TV



Next the boot selector screen appeared. Using your keyboard, press the right arrow key to select Launch Recovery.

Fire TV



Use the trackpad to get to the Install button and click it.

Fire TV



You can't read it, but the lower right gray button says Select Storage. By default mine opened to the USB flash drive. Change this as needed for your storage type. Then click on the 5.2.6.8 pre-rooted ROM file.

Fire TV



Click on the arrows at Swipe to confirm Flash.

Fire TV



It will take about a minute to flash.

Fire TV



It's hard to read, but the lower right button says Reboot System. Click it.

Fire TV



The boot selection screen by default is set to Boot Normally so you don't have to do anything. Just let it time out.

Fire TV



You'll see this screen next.

Fire TV



Step 8

Go back to adbLink and click Connect.

Fire TV



Click ADB Shell.

Fire TV



In the Terminal window enter

su



Fire TV



A prompt will appear on the Fire TV. Use the arrow keys on your keyboard to get to the Grant button and click it.

Fire TV



You’ll see root@sloane in the Terminal letting you know you are at root!

Fire TV



I find this step to be optional as TWRP does an OUTSTANDING job at protecting you against updates already. It's kind of a pain to un-root a box. However, if you want that extra bit of protection enter the following:

pm disable com.amazon.device.software.ota

and press enter. You’ll receive a disabled response.

Fire TV



You can verify the block on updates works by confirming it in Settings, My Fire TV, About, Check for System Update, when you receive this error.

Fire TV