Fire TV Stick Rooted via Hardware Soldering Method

fire-tv-stick-emmc-pinout
The Fire TV Stick has been rooted by directly interfacing with the device’s 8GB eMMC storage chip. This is a hardware root that involves soldering leads to specific points on the Fire TV Stick’s circuit board; not a software root like we had with towelroot on the original Amazon Fire TV. Due to the complexity and skill involved, it is unlikely that many people will replicate this rooting procedure.

The guys over at GTVHacker have posted details about this rooting method and a video demonstrating the procedure. The process involves soldering connections between the Fire TV Sticks 8GB eMMC storage chip and an SD sniffer board. This then allows you to mount the Fire TV Stick’s file system on a computer using a standard SD card reader. Once the file system is directly accessible via the SD card reader, you simply copy an SU binary file to the Fire TV Stick file system and set the appropriate permissions.

As I already mentioned, most people won’t be attempting to reproduce this method. However, achieving root in any form is great news as it may lead to a software root being discovered.

ShareTweetShare+1

28 comments
  1. bula1ca says:

    Is it possible to post on how to for programming? Connection is straight forward. Thank you

  2. nyder says:

    Is this a repeatable thing, or is this like the AFTV where no one else can repeat what they did?

  3. matt says:

    looks like nothing to program…

    solder up the sniffer, mount the filesystem like any SD card, drop SU on the filesystem…. profit!

    The pinouts are posted, that’s all you need.

  4. Mistawes says:

    This would be my preferable method. I do love hardware hacking, any excuse the break out the soldering iron!

    Nice work on finding the pinout!

  5. zonykel says:

    Is this also doable on an unrootable AFTV?

  6. J says:

    Yes I’m very interested in this method on the firetv box. Great job guys!

  7. Rampart says:

    They are not using the SD sniffer board pictured here. They are using a Low Voltage e-MMC Adapter. If a SD sniffer will work please provide the information for that. Thanks

  8. Mark says:

    So, with this method, I could allow any updates Amazon pushes out and still re-root it?

  9. Tim says:

    So does this method work with the SD Sniffer board in the post?

  10. Jimmy8881 says:

    where would the VCCQ and D4 wires go into the SD sniffer board?

  11. Tim says:

    Exactly, no Vccq and D4.

    They may want to pull the image and link.

    I know someone out there, other than myself, has ordered the SD Sniffer board because of this post. (which my own fault, for just skimming through the original post, from the source of the topic)

    It Seems like a simple straight forward project, so I just overlooked the difference in the board.

  12. Justin Davis says:

    Surprised the chinese have not made a FireTV stick rooter that does not require soldering like the old xbox mods using a jig of some sort and spring loaded pins.

  13. William Cobb says:

    Unfortunately this isn’t like the old days of J-tagging a satellite receiver where the pins could be the size of small nails…. The soldering points on this smt board are small! A spring loaded pin device would never come close to cutting it!

  14. what are you talking about says:

    im sorry but the soldering on this is simple.
    if u can solder then break out your tools and have some fun.

  15. HeshBeatboxFill says:

    Can this still be done with the latest update 54.1.1.0_user_110041020 …
    or does software ver. not matter for this root method?

  16. Joergi says:

    The Fire Stick can not being used with a DVI Adapter….
    because of the hardware handshake (hdcp).
    (see: http://amzn.to/1O5CNI7 )
    Is it possible with the rooting to make this working?

  17. ccs says:

    How does the D0-D4 and VCC map to the breakout board? I assume the clk and cmd pins are being mapped to D0-D4? There is no 5-bit mode so there is no way D0-D4 is all data lines. I tried looking for a cross reference but nothing is matching this pin out? Any ideas how the picture above maps to the Exploitee.rs Low Voltage eMMC Adapter?

  18. IVO says:

    Also, the part when you connect to gnd the cpu is that achieved with the gnd on the eMMC or it has to be gnd on the fire stick? if is the last, Where can we get the gnd on the fire stick? ?

  19. John says:

    Interesting. Have a Fire TV stick at home. May give it a try.

Leave a Reply

Your email address will not be published. Required fields are marked *

*