Amazon Fire TV Cube and Fire TV 3 have been Rooted

A group that goes by the name Exploitee.rs is claiming to have rooted the Amazon Fire TV Cube and Amazon Fire TV 3 (pendant). The exploit, colorfully named FireFU, has not yet been verified to work by anyone outside of the group, but their explanation of the exploit and their instructions are quite thorough, so there isn’t any reason to believe that their claims aren’t genuine. Unfortunately, the rooting method they’ve come up with is unlikely to be performed by many people because it relies on using a microcontroller, such as an Arduino or Teensy board, to force the Fire TV Cube or Fire TV 3 to enter a firmware upgrade mode by communicating over their HDMI connection.

This new rooting method relies on two separate vulnerabilities that work together to allow the user to run unsigned code that roots the device. The first vulnerability uses the HDMI port’s Display Data Channel (DDC), which is a communication channel that allows two devices to talk to one another over the HDMI connection. The group discovered that, by sending a specific command over this HDMI communication channel, it causes the Amlogic CPU in both the Fire TV Cube and Fire TV 3 to enter Device Firmware Upgrade (DFU) mode, which is a state where the streaming player’s firmware can be modified. Both devices use the exact same Amlogic CPU, and this discovery is specific to Amlogic CPU, so it’s unlikely to work on other Fire TV models, such as the new Fire TV Stick 4K, which uses a MediaTek CPU.

Arduino Duo Microcontroller Board

It is this first step that likely makes this rooting method unachievable by most people because in order to send the HDMI signal that puts the device into DFU mode, a microcontroller is used and connected to the Fire TV device’s HDMI port. The creators of this rooting method have successfully executed the exploit using an Arduino Due board and a Teensy 3 board, but any microcontroller that can provide an I2C bus should also work.

After putting the Fire TV Cube or Fire TV 3 into DFU mode, the device is primed for new firmware, but it’s still not possible to load custom firmware because its bootloader is locked, which means it will only accept firmware that was created by Amazon. This is where the second vulnerability comes in. The rooting method causes a heap overflow that modifies the device’s memory, which tricks it into thinking its bootloader is unlocked. With a temporarily unlocked bootloader, it’s just a matter of using Android’s regular fastboot utility to flash a new boot image and new recovery image that roots the device.

Theoretically, if a method were found that puts the streaming device into DFU mode without the need of a microcontroller board, it would be possible to root the device using only a computer. Unless that happens, this rooting method will probably remain viable by only a small number of diehard enthusiasts, much like the eMMC hardware rooting method. Additionally, without a widespread and easily achievable rooting method, it’s unlikely that the Fire TV Cube and Fire TV 3 will see the same kind of pre-rooted ROM and custom recovery support that the Fire TV 1, Fire TV 2, and Fire TV Stick 1 have seen.

ShareTweetShare+1

12 comments
  1. Flokic says:

    I figure you postponed those root plans for updated FTV2s that you had? Amazon isn’t helping with all these new devices being released and in need of some reviews/testing hehe.

  2. Joe Bangles says:

    So what would be a good ROM to flash onto it?

    • AFTVnews says:

      There are no compatible ROMs. Even the older Fire TVs that have been rooted for years have never had any custom ROMs made, apart from rbox’s pre-rooted stock images.

    • 2WhlWzrd says:

      The author of this exploit suggests that hardware of an Odroid C2 is very similar to that of the Cube and Pendant, and an image intended for that may be able to run with little or no modification. LibreELEC sounds very promising.

  3. Ismael vargas says:

    How can I get one fire cube box but if the price is lower den what it is now because I heard it works good okay thank you

  4. Michajin says:

    I have a raspberry pi3 and a extra firetv3. I will give it a try this weekend and see if it works.

  5. Hamond says:

    Dag, good to see root! Wish it was a stick 2. But…progress!

Leave a Reply

Your email address will not be published. Required fields are marked *

*

Get notified of new posts

Enter your email address to receive notifications of new posts by email.