The Fire TV Stick has been rooted by directly interfacing with the device’s 8GB eMMC storage chip. This is a hardware root that involves soldering leads to specific points on the Fire TV Stick’s circuit board; not a software root like we had with towelroot on the original Amazon Fire TV. Due to the complexity and skill involved, it is unlikely that many people will replicate this rooting procedure.

The VisionSOM-STM32MP1 provides a variety memory configuration including flexible range of DDR3L, eMMC and SD memory card that meets our customers requirements. The SoM supports connections to a variety of interfaces: two high-speed USB on-the-go with PHY, dual Ethernet, audio, display with touch panel and serial interfaces. The NAND flash memory used in eMMC storage isn't unique to eMMC and is found in other types of storage like Secure Digital (SD) cards, solid-state drives (SSD), and USB drives. EMMC storage is usually found in budget-friendly laptops, as well as tablets, Chromebooks, tablet PCs, 2-in-1 computers, and smartphones.

• It’s just tedious, so if I had the choice of green-wiring to an SD card reader (which has pretty coarse pitch), or another 0.5mm BGA landing pattern on another phone, I’d pick the SD card.
• Dec 02, 2020 The NAND flash memory used in eMMC storage isn't unique to eMMC and is found in other types of storage like Secure Digital (SD) cards, solid-state drives (SSD), and USB drives. EMMC storage is usually found in budget-friendly laptops, as well as tablets, Chromebooks, tablet PCs, 2-in-1 computers, and smartphones.
• MMC vs SD Card comparison. MultiMediaCard (MMC) is a flash memory card standard. Typically, an MMC is used as storage media for a portable device, in a form that can easily be removed for access by a PC. Secure Digital (SD) is a flash (non-volatile) memory card format and is used fo.

The guys over at GTVHacker have posted details about this rooting method and a video demonstrating the procedure. The process involves soldering connections between the Fire TV Sticks 8GB eMMC storage chip and an SD sniffer board. This then allows you to mount the Fire TV Stick’s file system on a computer using a standard SD card reader. Once the file system is directly accessible via the SD card reader, you simply copy an SU binary file to the Fire TV Stick file system and set the appropriate permissions.

As I already mentioned, most people won’t be attempting to reproduce this method. However, achieving root in any form is great news as it may lead to a software root being discovered.

Share

bula1casays:November 30, 2014 at 9:40 am

Is it possible to post on how to for programming? Connection is straight forward. Thank you

Replynydersays:November 30, 2014 at 12:04 pm

Is this a repeatable thing, or is this like the AFTV where no one else can repeat what they did?

Replymattsays:November 30, 2014 at 3:59 pm

looks like nothing to program…

solder up the sniffer, mount the filesystem like any SD card, drop SU on the filesystem…. profit!

The pinouts are posted, that’s all you need.

ReplyBrucesays:November 30, 2014 at 5:15 pm

Not being a proficient Android hacker, what do you mean by “drop SU on the filesystem”?

:-)

Replymattsays:November 30, 2014 at 8:42 pm

Copy the SU binary onto the firetv internal memory chip.

Replygoatmalesays:December 28, 2014 at 6:14 pm

A basic understanding of linux and android is required. It looks like this is an outline of the commands.. It looks like you can use the below commands:
./adb push su/system/bin/su /sdcard/su
./adb shell
su
cat /sdcard/su > /system/xbin/su
ln -s /system/xbin/su /system/bin/su
chmod 6755 /system/xbin/su
exit
exit
not sure if those are exact, but you get the idea.
http://forum.xda-developers.com/showthread.php?t=2270589

ReplyMistawessays:December 1, 2014 at 2:35 am

This would be my preferable method. I do love hardware hacking, any excuse the break out the soldering iron!

Nice work on finding the pinout!

Replyzonykelsays:December 1, 2014 at 10:52 pm

Is this also doable on an unrootable AFTV?

ReplyJsays:December 3, 2014 at 5:33 pm

Yes I’m very interested in this method on the firetv box. Great job guys!

ReplyRampartsays:December 6, 2014 at 2:54 pm

They are not using the SD sniffer board pictured here. They are using a Low Voltage e-MMC Adapter. If a SD sniffer will work please provide the information for that. Thanks

ReplyMarksays:December 10, 2014 at 10:51 pm

So, with this method, I could allow any updates Amazon pushes out and still re-root it?

ReplyAFTVnewssays:December 11, 2014 at 3:24 am

Yes, pretty much.

ReplyTimsays:December 11, 2014 at 5:18 pm

So does this method work with the SD Sniffer board in the post?

ReplyJimmy8881says:December 13, 2014 at 4:31 pm

I would like to know if the SD Sniffer board will work too since I cannot seem to find a VCCQ or D4 points on it.

ReplyJimmy8881says:December 13, 2014 at 4:32 pm

Id like to know this too, the SD sniffer board doesn’t have a VCCQ or D4 points on it.

ReplyJimmy8881says:December 13, 2014 at 4:33 pm

where would the VCCQ and D4 wires go into the SD sniffer board?

ReplyTimsays:December 15, 2014 at 5:06 am

Exactly, no Vccq and D4.

They may want to pull the image and link.

I know someone out there, other than myself, has ordered the SD Sniffer board because of this post. (which my own fault, for just skimming through the original post, from the source of the topic)

It Seems like a simple straight forward project, so I just overlooked the difference in the board.

ReplyAFTVnewssays:December 15, 2014 at 8:10 am

I’ve removed the old board reference.

ReplyJimmy8881says:December 17, 2014 at 12:26 am

Same here, now I need to find a use for the SD sniffer board lol.
hopefully maximus64 will get some of his Low Voltage e-MMC Adapters in stock soon.

ReplyJustin Davissays:January 9, 2015 at 7:45 am

Surprised the chinese have not made a FireTV stick rooter that does not require soldering like the old xbox mods using a jig of some sort and spring loaded pins.

ReplyWilliam Cobbsays:February 7, 2015 at 10:31 am

Unfortunately this isn’t like the old days of J-tagging a satellite receiver where the pins could be the size of small nails…. The soldering points on this smt board are small! A spring loaded pin device would never come close to cutting it!

Replywhat are you talking aboutsays:February 21, 2015 at 7:24 pm

im sorry but the soldering on this is simple.
if u can solder then break out your tools and have some fun.

ReplyHeshBeatboxFillsays:April 15, 2015 at 11:39 pm

Can this still be done with the latest update 54.1.1.0_user_110041020 …
or does software ver. not matter for this root method?

ReplyJoergisays:April 19, 2015 at 10:27 am

The Fire Stick can not being used with a DVI Adapter….
because of the hardware handshake (hdcp).
(see: http://amzn.to/1O5CNI7 )
Is it possible with the rooting to make this working?

Replyccssays:May 2, 2015 at 10:59 am

How does the D0-D4 and VCC map to the breakout board? I assume the clk and cmd pins are being mapped to D0-D4? There is no 5-bit mode so there is no way D0-D4 is all data lines. I tried looking for a cross reference but nothing is matching this pin out? Any ideas how the picture above maps to the Exploitee.rs Low Voltage eMMC Adapter?

ReplyIVOsays:May 22, 2015 at 5:11 pm

Also, the part when you connect to gnd the cpu is that achieved with the gnd on the eMMC or it has to be gnd on the fire stick? if is the last, Where can we get the gnd on the fire stick? ?

Replymilvoltssays:January 14, 2016 at 7:01 am

On either of 4 soder joints of usb power port,I’m assuming.

Emmc Sd Card Pinout Rj45

ReplyJohnsays:November 15, 2015 at 12:37 pm

Interesting. Have a Fire TV stick at home. May give it a try.

Reply

Umt Emmc Sd Card Pinout