How to install a Kernel Boot Menu on the Amazon Fire TV

boot-menu-guide-header
With the recent advent of a partially unlocked bootloader, we now have the ability to install custom kernels on the Amazon Fire TV. Custom kernels increase the possibility of bricking, so it’s more important than ever that we have a reliable way of booting into recovery to fix any issues that may arise from modifying the Fire TV. That’s why Rbox, the developer behind numerous Fire TV mods, has created a boot menu which allows you to choose whether you want to boot into recovery or normally boot the currently installed kernel.

Once installed, Rbox’s boot menu will display a selection screen with the following two options every time the Fire TV boots up: KERNEL and RECOVERY. Selecting the KERNEL option will boot the currently installed kernel (i.e., a normal boot), and selecting RECOVERY will boot into ClockworkMod Custom Recovery. Once the boot menu selection screen loads, you can use the up and down arrow keys on a connected USB keyboard to make a selection. If no selection is made within 5 seconds, the Fire TV will boot normally into the kernel.

Important: This boot menu will be required to install Rbox’s pre-rooted ROMs starting with version 51.1.4.1 and above. Also, be aware that installing any older (51.1.4.0 and below) pre-rooted custom ROM will remove the boot menu. So if you install an older (51.1.4.0 and below) pre-rooted ROM, you will need to repeat this entire guide to restore Rbox’s boot menu.

Warning: This is a very delicate process. There is a high chance of bricking your Fire TV if this guide is not followed precisely. Take your time and double check each step before proceeding to the next. If something goes wrong, comment below with what happened and include a copy and paste of the entire text from your command/terminal window. I’ll do my best to help.

Installation Instructions

  1. Your Fire TV must be rooted with BusyBox installed. It’s not enough that the BusyBox APK is on your Fire TV. Actually go launch BusyBox and ensure it says “BusyBox is installed to /system/xbin/” at the top.
    busy-box-main-screen
  2. Unlock your Fire TV’s bootloader by following this guide. Your bootloader must be unlocked before proceeding with this guide or you WILL BRICK your Fire TV. If your bootloader is already unlocked, you do not need to unlock it again. (If you have ClockworkMod version 6.0.5.1.4 or above installed, then your bootloader is already unlocked)
  3. Install or update to ClockworkMod Custom Recovery version 6.0.5.1.4 or above. Do not proceed with this guide if your Fire TV is running stock recovery or ClockworkMod 6.0.5.1.3 or below.
  4. If you are following this guide in order to install Pre-Rooted ROM Version 51.1.4.1 or above (which requires this boot menu) your Fire TV should currently be running Pre-Rooted ROM Version 51.1.4.0. If it is not, you should go install it now. Pre-Rooted ROM Version 51.1.4.0 is not required to install this boot menu, but installing Pre-Rooted ROM Version 51.1.4.0 AFTER you complete this guide is a complete waste of time because Pre-Rooted ROM Version 51.1.4.0 will wipe out this boot menu and you’ll have to redo the entire guide. Pre-Rooted ROM Version 51.1.4.0 is required in order to install Pre-Rooted ROM Version 51.1.4.1 or above.
  5. Download Rbox’s boot menu .img file from here. Take note of the 32 random seeming characters labeled “md5sum” next to the file you downloaded. You will need to refer back to this later in this guide.
  6. Rename the file you just downloaded to bootmenu.img
  7. Connect to your Fire TV via ADB
  8. Transfer the bootmenu.img file to your Fire TV by running the following command:
    adb push bootmenu.img /sdcard/
    (Note: This assumes the bootmenu.img file you renamed in the above step is in the same directory as ADB, otherwise enter the full path to the file like this:
    adb push C:\full\path\to\bootmenu.img /sdcard/
    bootmenu01
  9. Run the command: adb shell
    terminal-adb-shell
  10. Run the command: su
    (Note: If this is the first time you’ve ever run su, a pop-up will appear on the Fire TV and you need to select “Grant”)
    terminal-su
  11. Run the command: /system/xbin/busybox md5sum /sdcard/bootmenu.img
    bootmenu08
    If you get a message saying “sh: /system/xbin/busybox: not found”, then you don’t have BusyBox installed. Go sideload it now AND run it to complete installation. Then repeat this step.
  12. Check that the 32 random seeming characters outputted by the previous command exactly match the 32 characters labeled “md5sum” on the download page from step 5.
    bootmenu09
    Only proceed to the next step if the numbers match exactly. If the numbers don’t match exactly, it means the file did not download or transfer intact. You therefore need to run the following 3 commands to cleanup the corrupted file and then restart this guide from step 5 (making sure to redownload the .img file):

    • rm -f /sdcard/bootmenu.img
    • exit
    • exit (yes, twice)
  13. Run the command: mount -o remount,rw /system
    bootmenu02
  14. Run the command: mkdir /system/boot
    bootmenu03
  15. Run the command:
    dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/system/boot/boot.img

    bootmenu04

  16. Run the command: mount -o remount,ro /system
    bootmenu05
  17. Run the command:
    dd if=/sdcard/bootmenu.img of=/dev/block/platform/msm_sdcc.1/by-name/boot

    bootmenu06

  18. (Optional) Run the following command to delete the bootmenu.img file from the /sdcard directory:
    rm -f /sdcard/bootmenu.img
    bootmenu07
    Note: This is optional because you can choose to leave this file in your Fire TV’s /sdcard directory to make it easier to re-install Rbox’s boot menu in the future. If you skip this step, skip steps 5 thru 8 if you need to reinstall the boot menu in the future.
  19. Run the command: exit
    terminal-exit-root
  20. Run the command (yes, again): exit
    terminal-exit-shell
  21. Restart your Fire TV by running the following command: adb reboot
    terminal-adb-reboot
  22. Your Fire TV will display a black screen for several seconds. This is normal. The screen may also flicker a few times. Eventually, you’ll see the boot menu selection screen.
    rbox-boot-menu-selection-screen
  23. To test that everything installed correctly you should first not select anything and let the boot menu normally boot into the kernel by default. Then, once on the Fire TV home screen, connect a USB keyboard and restart your Fire TV. This time select “LAUNCH RECOVERY” and ensure that you can boot into ClockworkMod Custom Recovery.

How to Uninstall Rbox’s Boot Menu
Uninstalling is very easy. Simply install any pre-rooted custom ROM older than 51.1.4.1. Doing so will overwrite the boot menu with a standard boot configuration.

ShareTweetShare+1

117 comments
  1. m says:

    I followed this guide (including unlocking the bootloader and installing the updated 6.0.1.5.4a CWM both of which worked fine), however, when I rebooted my fire in step 18, it just sits at the white amazon logo with the orange light on the front of the device on and solid. Is there anything I can do at this point or is the device fully bricked?

    Thanks

    • AFTVnews says:

      Do you happen to still have your command/terminal window open? If so, copy&paste everything here. I’m sorry, but I can’t be much help without more info to know where things went wrong.

      • m says:

        I don’t, but i figured out what happened, the file download of the bootmenu.img didn’t fully download and I neglected to check prior to flashing it and rebooting, so its fully user error and not a problem with the directions you have here. If there is anything I can try, that be great, but based on looking around, it looks like I’m SOL with this unit.

        Thanks

        • AFTVnews says:

          I’m sorry to say I don’t think there’s anything you can do to fix it. Try replying to the XDA thread with your situation.

          I appreciate you updating us with what happened. As a result, I’ve since updated the guide to include measures to detect a corrupt file before it’s applied. I’m really sorry I didn’t think of including these new steps when I first wrote the guide. It would have prevented you from bricking.

          • m says:

            Thanks for responding to my questions. The guide is excellent I really appreciate the resource. I will likely follow it again once I get a new unit (and be more careful).

  2. bula1ca says:

    What do you have connected to the USB port?

  3. bula1ca says:

    Have you check to see if file you pushed was same size as original before flashing it? I have few instances when file was not copied properly to the root. The way I flash updates is to manually push zip to Download directory, check if is the same size and only after flash it through. Have you tried to unplug power cord and plug it back in?

  4. DJ1 says:

    I followed the steps now.. i am stuck in a loop where i select the BOOT KERNEL and i get the Amazon logo and then back to BOOT MENU. Help !!!

  5. NoComicSans says:

    Rbox please, no Comic Sans

  6. chriss says:

    amazing work! just the splash screen design needs some work ;)
    word wrap and comic sans are no go’s

  7. AFTVnews says:

    I just updated the guide to use a utility from BusyBox to verify that the bootmenu.img file gets to the Fire TV intact. If you followed the guide before this change, don’t be alarmed as it’s not really required. It’s just one extra safe measure.

  8. ryo an says:

    I think I may have bricked my device. Right now I was trying to install the rbox boot menu after I installed the prerooted 51.1.40 per instructions for 51.1.41.
    Before I installed the boot menu I was able to boot fine. Now I’m stuck in the loop. Any ideas for help.
    I have the clockworkmod latest version installed

    • Ryo An says:

      Ive fixed my own issue by pushing the newest custom rom on to the sdcard and used the previous custom rom to recover it, then install the boot kernel and then used the recovery to install the latest custom rom
      Step 1: push the 51.1.4.0_514006420 updated and 51.1.4.1_514013920
      fixed to the sdcard
      Step 2: Install 51.1.4.0 through the clockwordmod recovery
      Step 3: Install necessary components within busybox
      Step 3: Install the boot kernel using the instructions from above
      Step 4: Boot in recovery
      Step 5: Install zip and locate the 51.1.4.1 on the sdcard and install.

      Thats what I did when I was stuck in the Bootloop with no amazon boot and now it works with the current build as well as Kodi

  9. Bobby says:

    For some reason after installing the boot menu I am not able to boot into recovery anymore. It stuck on the white amazon logo if launch recovery is selected on the boot menu. However I am still able to boot into the Kernel. Anyone having this issue?

  10. BoomSchtick says:

    There have been enough problems that I’m thinking of sticking with the software version I’m at. I don’t want to brick this thing and I think we are getting into some dangerous territory with the new boot menu and messing with the kernels.

    • Paul says:

      I going to stick to the version I am having. I also think that this is the first time that the risk of bricking outweighs the benefit.

      Why will this be madatory for all other updates when it is so tricky.

  11. Robbie says:

    Great write up. This mod worked exactly like you described. It was a little scary when I went to reboot, as it takes a bit of time and the screen flickered (thought I bricked my FireTV). But all worked just as described. Thanks aftvnews and rbox.

  12. Joe says:

    I have the latest Clockwork recovery in place. Therefore, I can install a rom.zip when I connect and command “adb reboot recovery”.

    Could somebody please explain why I need the new boot menu? Is this just to bypass the “adb reboot recovery” command? I just want to know why this boot menu is required for all future updates, as it seems rather dangerous at the moment.

    1) Is this boot menu required to bypass the “eFuse”?
    2) If I were to install the latest pre-rooted ROM without the new boot menu, would the eFuse somehow remove my access to Clockwork recovery?

    Thanks.

  13. Nick says:

    I almost had a heart attack installing the boot menu. I made sure that my Fire TV met all the prerequisites and followed the boot menu installation instructions carefully but when I rebooted my Fire TV it would hang on the white Amazon logo after the boot menu. Luckily booting to recovery still worked so I just downloaded the latest pre-rooted rom and now everything is working fine.

  14. ASadani says:

    Can I decrease the seconds on the boot menu? Can I remove the boot menu and boot directly to the kernel? I’m a bit confused. please help

  15. playerjuan says:

    good thinking on verifying the hash before installing. Would the boot menu persist following a factory reset?

  16. Dpdoo says:

    OK I confess i made a mistake. I don’t have CWM installed, I thought I did. My question is. I’m stuck in rbox boot menu v1.0 . I was able to get to “android system recovery (3e)” but that’s it. Any chance to recover from this without CWM?
    Thank you. Grate job Guys
    Dpdoo

  17. Harry says:

    Great job on the root menu! Thank you!

    I was wondering on the next revision if you could use more standardized fonts/graphics/colors and simplify the screen. Too many fonts and colors are distracting. No Comic Sans Serif please.

    If you have a discrete elegant logo “made by rBox” smaller and less prominent. Then maybe Boot Menu as a header. Below, instead of underlining the option, having a red asterisk next to the option would really help or many inverse graphics like in the CWM software or firmware menu option menus.

    Being able to use the Amazon Remote would be great.

    Lastly, It would be nice to have the option of not having the boot menu come up on a soft boot using the remote, especially since the boot menu is a requirement for the new rooted Custom ROM (Thank you again). Instead, could the boot menu come up only after a hard reboot (ie unplugging the unit and plugging it back in). I find with XBMC/Kodi The delay in rebooting using the remote, and the necessity of having a keyboard connected and available to reduce the reboot time by pressing enter is frustrating.

    You wrote an elegant piece of software in record time. I’d love to see the boot screen’s aesthetics match the genius behind the code.

  18. Abel says:

    I had the same issues, followed the guide to the letter but after rebooting it hangs and wouldn’t go into kernel, stuck at 0 seconds. Luckily with USB keyboard attached you could select recovery menu boot before the 5 seconds countdown and I was able to boot into recovery. From there I updated to latest pre-rooted firmware 51.1.4.1 and rebooted, it wen’t into kernel boot menu and VOILA everything works from then on.
    Guide should be revised as it seems the box won’t boot after installing kernel boot menu unless you upgrade from 51.1.4.0 to 51.1.4.1.
    Thanks again.

    • Vladimir says:

      I am in the same boat, I’m currently stuck at 0 sec. I followed the guide to the letter. I did have 51.1.4.0 because that’s what the guide told me to have. Should i try to adb connect again and restart it and get into the recovery menu and update to 51.1.4.1 then do this kernel? I’m really confused.
      Here are my command files if they help.

      C:\Users\Vladimir\adt-bundle-windows-x86_64-20140702\sdk\platform-tools>adb shel
      l
      shell@android:/ $ rm -f /sdcard/rom.zip
      rm -f /sdcard/rom.zip
      shell@android:/ $ exit
      exit

      C:\Users\Vladimir\adt-bundle-windows-x86_64-20140702\sdk\platform-tools>adb push
      bootmenu.img /sdcard/
      530 KB/s (6739968 bytes in 12.397s)

      C:\Users\Vladimir\adt-bundle-windows-x86_64-20140702\sdk\platform-tools>adb shel
      l
      shell@android:/ $ su
      su
      root@android:/ # /system/xbin/busybox md5sum /sdcard/bootmenu.img
      /system/xbin/busybox md5sum /sdcard/bootmenu.img
      a8a3c28baafe43f354d92e6cc8b392d3 /sdcard/bootmenu.img
      root@android:/ # mount -o remount,rw /system
      mount -o remount,rw /system
      root@android:/ # mkdir /system/boot
      mkdir /system/boot
      root@android:/ # dd if=/sdcard/bootmenu.img of=/dev/block/platform/msm_sdcc.1/by
      -name/boot
      dev/block/platform/msm_sdcc.1/by-name/boot adb rebo
      ot

      • AFTVnews says:

        Based on the command sequence you posted, it looks like you skipped step 15 and 16, and jumped straight to step 17. If that’s true, then you overwrote your boot partition with the boot menu without first saving the original boot partition. That means your Fire TV has no way to boot.

        To fix it, boot into recovery and install the pre-rooted 51.1.4.0 ROM. Installing that version should restore your boot partition. Once done, be sure you can boot to the home screen. If you can boot normally, then you should then follow this entire guide from the beginning again.

        • Vladimir says:

          Is there anyway to add the rom without adb which won’t connect? Because I deleted the Rom file after installing it.

          • AFTVnews says:

            I know you’ve already figured this out since I saw your new comment below, but just incase others come across this comment and need an answer:

            If you can’t get ADB to connect in recovery, you should use a USB drive. Put the file on it and connect it to the Fire TV, then boot. ADB should be able to read the drive. You’ll also need a USB hub so that you can connect a USB keyboard in addition to the USB drive.

    • Vladimir says:

      How did you get the rom on the AFTV? I cannot get it to connect once I’m in recovery.

  19. Vladimir says:

    I also had deleted the previous rom.zip file from when I updated it. Am I SOL or is there anything I can do?

  20. Vladimir says:

    Or can I do a “wipe data/factory reset” through the recovery manager and start over entirely?

  21. Vladimir says:

    So I used a usb hub to use a keyboard and usb stick to update the rom in recovery mode. Got everything going. Sorry for blowing up your comments section. THANK YOU SO MUCH FOR YOUR HELP AND GUIDE YOU ARE AWESOME!!!

    • AFTVnews says:

      Great! Don’t worry about the comments. That’s what this area is here for. I’m glad you got it all worked out.

      • Dan says:

        I cannot boot into the kernel anymore and get into a loop problem where it just goes back to the boot menu. I can get into recovery mode though. So I’m trying to revert back to the pre-rooted 51.1.4.0 ROM.

        However, I cannot connect to the device anymore using adb as it keeps thinking the device is offline while in recovery mode. I’m trying to transfer the rom file back to the /sdcard of the device (I had deleted it earlier). I do have the USB hub connected to the fire tv with a keyboard and usb drive (that has the rom file). But now how do I load the rom file? I don’t see what option to do in recovery mode.

        Would really appreciate help on this because I’m stuck and the device is basically bricked for me now. Thanks!

        • Dan says:

          Nevermind about this, I solved my problem. After unplugging and plugging back in my USB drive, I could then see that proper USB options. So from the recovery menu, I went to install zip > choose zip from /storage/usbdisk (this option was not appearing before somehow), and then could select the rom zip to install.

          • tyler says:

            I am in the same situation except my zip file wont open its says can’t open /storage/usbdisk/myzipfile
            (bad)
            installation aborted.

            I’ve downloaded the same file 10 times

    • Dpdoo says:

      congrats Vladimir.
      can you explain step by step how you did it?
      thank you

  22. vtechonda says:

    I have the boot menu installed however I cannot change the selection to boot into recovery. I used both a keyboard and the controller. They both do not change the selection at all at the boot menu. I am able to boot into recovery through adb.

    • Bill says:

      Have you found anything out about this? I appear to have the same problem. I progressed through all the installation steps just fine, but when the boot menu comes up, I cannot move to the recovery selection with the usb keyboard down arrow (or mouse) so it just continues through the process of timing out and rebooting kernel. The keyboard does work fine when using it to control the booted up Fire TV.

      • Bill says:

        Solved. I had the box connected to my computer monitor for setup convenience through an HDMI to DVI adapter. Fire TV doesn’t play well with DVI. Once It was connected to a regular TV HDMI input, everything worked fine.

  23. Klyde says:

    I can’t seem to get past step 11. I have everything installed properly.
    root@android:/ # /system/xbin/busybox md5sum / sdcard/”C:\Users\Klyde\Documents\
    Klyde\Android\rootftvapks\firetv-bootmenu-1.0.img”
    ndroid\rootftvapks\firetv-bootmenu-1.0.img” <
    md5sum: can't read '/': Is a directory
    md5sum: can't open 'sdcard/C:\Users\Klyde\Documents\Klyde\Android\rootftvapks\fi
    retv-bootmenu-1.0.img': No such file or directory
    1|root@android:/ #

    • Klyde says:

      I figured out it was my error in following the steps I renamed the file as it is named in my folder firetv-bootmenu-1.0.img and that’s all it was.

  24. Chris says:

    I’m trying to recover to 51.1.4.0 by USB flash drive but during installation I get symlink: some symlinks failed
    E: Error in storage/usbdisk/name of file
    (Status 7)
    Installation aborted

    Does anyone know how to get past this?

  25. David E says:

    Thanks to your guides, I managed to get the latest pre-rooted ROM on my FireTV box, which as you know, requires this boot menu. Definitely could not have done it without you. I had printed them out, but it looked like you had updated since I had printed out, so I ended up following along in my web browser.

    Really had to pace myself on this one and read slowly, since I was going back and forth between 4 different articles. It helped to write down “high level steps” before I started so I could get the order right and have a better understanding of what I was doing.

    Since you mentioned you are re-writing some of the guides anyway, I wonder if you might put something in the form of a high-level overview like that as well, and then be able to break it down in detail alongside it. For example, Step 1 downgrade to 51.1.0.2, Step 2 reroot using towelroot, Step 3 Unlock FireTV bootloader, etc. That would make it a little easier to not get lost on this journey.

  26. Doug says:

    Great guides but can I remove the boot menu once I’m all done with everything but without downloading to an earlier version? I just don’t like how it looks and if I want to get into recovery I can simply use ADB.

  27. LocoMex says:

    Followed the guide to the letter, and all worked as advertised. Thanks for the great guide.

  28. w says:

    After installing bootmenu I just get stuck at the boot screen where the count is 0. For some reason my keyboard doesn’t allow me to change it to recovery and I have tried several keyboards. However, if I do ctrl-alt-del the unit reboots so it seems the keyboard commands are working. Any way to recover from this?

    • w says:

      Wooo….saw in another thread hitting ALT + PrintScr helps with this. After doing that, I was able to use the arrow keys and re-install a older rom. Weird, but glad it worked.

  29. Loren says:

    I successfully installed the Kernel Boot Menu by following all the instructions and then installed the Pre-Rooted 51.1.4.1_514013920
    fixed. I had an unrelated problem (password entry wasn’t showing up for adding new wifi connection) and tried downgrading back to Pre-Rooted ROM version 51.1.4.0. This of course removed the boot menu and did not solve my problem, so I performed a factory reset. It booted into Cyanogen recovery and I chose the option for factory reset. This fixed my problem (I block updates via OpenDNS)

    But now I want to know which steps are necessary to reinstall the boot menu and Pre-Rooted 51.1.4.1.

    My main question is do I need to reinstall ClockworkMod Custom Recovery? How can I check if I have it already? Or should I just reinstall it?

  30. ken dahl says:

    step 4

    Does this refer to a factor default state “prior to applying root”?

  31. tyler says:

    I am able to boot into recovery.
    But when I try and load rom using usb hub and keyboard the zip file just says can’t open and installation aborted
    I’ve tried so many times and re downloaded
    what am I doing wrong?

    • tyler says:

      just in case people have the same problem where the kernel won’t boot but you can still get into recovery. Simply connect an Ethernet cable to the fire tv and using ADBFIRE push the newest pre-rooted rom and install zip through recovery. No need to start from the beginning you already have r-box bootmenu. This is only if your boot loader is unlocked and you screwed up the process of push zip through just the ADB. Its much easier to push through adbfire then follow above steps.

  32. Mike Scott says:

    Does anyone know why the keyboard is frozen and cannot make a selection when the RBox menu appears?. Launch recovery is not able to be chosen. Keyboard is fine and works on other Fire TV device. Fire tv automatically boots into kernel mode.

    • klynt R says:

      Are you using an HDMI to DVI connection? I had exact same problem when FireTV was hooked up to my monitor via DVI connection, but it worked fine when I moved to a true HDMI to HDMI connection on my TV.

      Interesting side note is that it booted much faster with the HDMI to DVI connection (within seconds), where it took longer (as stated by rbox) to boot in normal pure HDMI TV situation. Obviously my HDMI to DVI does not have audio, which may be confusing the FireTV.

      • Mike Scott says:

        No HDMI to DVI connection, just HDMI to Samsung TV. Thank you very much for your response.

        • Mike Scott says:

          klynt, I replaced the HDMI cable and everything is working fine now. I really appreciate your help !!!
          Kind regards

          • klynt R says:

            Glad you were able to isolate it. There is definitely something wonky with the FireTV and how it handles different HDMI configs. When first attempting to root the device, I had another weird experience, with the intro video just showing a white screen (after pulling the ethernet cable)… but when I switched back to the true HDMI connections on the TV… the video went white and then started playing the video like is should have. So the HDMI/DVI connection bit me twice, but is easier than running back and forth between the office and the TV room.

  33. Darryl says:

    I am an idiot. I believe I’ve just bricked the device. (It was also rooted from USA). I didn’t install Cyanogenmod and proceeded to install bootloader.. FML.

    • Darryl says:

      I used Fire TV Root Tool.

      Installed Busybox, and it was installed.

      Then I went with option 4 on the Fire TV Tool. It pushed some files, then booted the fire TV. Now when it boots up, it’s the Amazon logo (doesn’t mention fire TV).. & the white light on the front pulses.

  34. Thomas says:

    I need a mirror for firetv-bootmenu-1.0.img The mediafire download never completes for me. I’ve been trying for hours

    • Thomas says:

      this is more than frustrating. I can’t believe there isn’t a mirror somewhere. Mediafire isn’t allowing me to download this file. It will either start downloading and fail at some random point or it will start downloading at stay at 0.1/6.4 MB I want to murder someone.

  35. Chris says:

    how do you get things in the same directory as adb?

  36. Dave says:

    Hello,

    I messed up the installation process by missing/combining steps:

    a8a3c28baafe43f354d92e6cc8b392d3 /sdcard/bootmenu.img
    root@android:/ # mount -o remount,rw /system
    mount -o remount,rw /system
    root@android:/ # mkdir /system/boot
    mkdir /system/boot
    root@android:/ # dd if=/sdcard/bootmenu.img of=/dev/block/platform/msm_sd
    dev/block/platform/msm_sdcc.1/by-name/boot
    13164+0 records in
    13164+0 records out
    6739968 bytes transferred in 1.124 secs (5996412 bytes/sec)
    root@android:/ # rm -f /sdcard/bootmenu.img
    rm -f /sdcard/bootmenu.img
    root@android:/ # exit
    exit
    shell@android:/ $ exit
    exit

    C:\Users\Dave\Downloads\adbfw111\adbfw111>adb reboot
    ^C
    C:\Users\Dave\Downloads\adbfw111\adbfw111>adb connect 192.168.0.199
    unable to connect to 192.168.0.199:5555

    C:\Users\Dave\Downloads\adbfw111\adbfw111>adb connect 192.168.0.199
    unable to connect to 192.168.0.199:5555

    C:\Users\Dave\Downloads\adbfw111\adbfw111>adb connect 192.168.0.195
    unable to connect to 192.168.0.195:5555

    now I am able to boot CWM, with USB hub with USB usbstorage option.

    I try unplugging and plugging and it says:
    storage/usbdisk: Idle-unmounted
    storage/usbdisk: Checking
    storage/usbdisk: Idle-unmounted

    any help is appreciated.

    Thanks, Dave

  37. wheels498 says:

    Im stuck at step 17 ??

    C:\adbfw118>adb connect 192.168.2.102
    connected to 192.168.2.102:5555

    C:\adbfw118>adb push F:\downloads\firetv\bootmenu.img /sdcard/
    508 KB/s (6739968 bytes in 12.943s)

    C:\adbfw118>adb shell
    root@android:/ # su
    su
    root@android:/ # /system/xbin/busybox md5sum /sdcard/bootmenu.img
    /system/xbin/busybox md5sum /sdcard/bootmenu.img
    a8a3c28baafe43f354d92e6cc8b392d3 /sdcard/bootmenu.img
    root@android:/ # rm -f /sdcard/bootmenu.img
    rm -f /sdcard/bootmenu.img
    root@android:/ # exit
    exit
    root@android:/ # exit
    exit

    C:\adbfw118>mount -o remount,rw /system
    ‘mount’ is not recognized as an internal or external command,
    operable program or batch file.

    C:\adbfw118>adb shell
    root@android:/ # su
    su
    root@android:/ # mount -o remount,rw /system
    mount -o remount,rw /system
    root@android:/ # mkdir /system/boot
    mkdir /system/boot
    root@android:/ # dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/system/bo
    ot/boot.img
    dcc.1/by-name/boot of=/system/boot/boot.img <
    20480+0 records in
    20480+0 records out
    10485760 bytes transferred in 0.376 secs (27887659 bytes/sec)
    root@android:/ # mount -o remount,ro /system
    mount -o remount,ro /system
    root@android:/ # dd if=/sdcard/bootmenu.img of=/dev/block/platform/msm_sdcc.1/by
    -name/boot
    dev/block/platform/msm_sdcc.1/by-name/boot <
    /sdcard/bootmenu.img: cannot open for read: No such file or directory
    1|root@android:/ # dd if=/sdcard/bootmenu.img of=/dev/block/platform/msm_sdcc.1/
    by-name/boot
    /dev/block/platform/msm_sdcc.1/by-name/boot <
    /sdcard/bootmenu.img: cannot open for read: No such file or directory
    1|root@android:/ #

  38. Frank says:

    Aren’t these instructions out of date now that the full unlock is available?

  39. It seems the latest version of software for AFTV now comes up in ikons, KODI included of all that is installed.

    Is there plans for a new custom rom to update the AFTV as I have one that CANNOT be rooted and this would be much better than going to the application menu to start KODI every time I want to use it.

  40. Carlos says:

    Hello, I followed all the steps and everything went fine, later I wanted to factory restore to my FireTV and formatted data , cache, system, sd card, and something devil, after that I installed the rom.zip without a problem now FireTV boots fine but can not select recovery on the boot menu, its stuck on boot kernel , what can I do ?

  41. corleone says:

    1st question- Can I follow this guide if I have full un-locked bootloader?

    2nd- If you are following this guide in order to install Pre-Rooted ROM Version 51.1.4.1 (which requires this boot menu) your Fire TV should currently be running Pre-Rooted ROM Version 51.1.4.0. If it is not, you should go install it now. 

    Can I follow this guide using stock rom 51.1.01 or should I first install 51.1.4.0 pre-rooted rom? Thanks

  42. Bruno Orsolon says:

    Hello, I’ve made a mistake and probably bricked my Fire TV.
    I’ve posted details here: http://forum.xda-developers.com/fire-tv/help/brick-recover-t3062250

    Can someone take a look at the post and tell me if my unit can be recovered?

    Thanks

    • mj says:

      hey i just left you a relpy on your xda forum post. connect a usb keyborad. when you see the amazon logo pass ALT and I and PRINT SCREEN/SYSRQ keys at the sametime. do this 4 to 5 times and it will boot to CWM.

  43. Oleh says:

    Hi!

    I installed ClockworkMod Custom Recovery version 6.0.5.1.4a (paragraph 3 of this manual).
    After that I immediately installed 51.1.5.0_515020820 custom RОМ.
    Now the device is not loaded.
    On the screen there is an inscription: amazon fireTV.

    Help me, pls.

  44. Stevie G says:

    Might have bricked my fire tv

    any assistance gents

    C:\fire>adb start-server

    C:\fire>adb connect 192.168.1.100
    connected to 192.168.1.100:5555

    C:\fire>adb reboot recovery
    ^C
    C:\fire>adb start-server

    C:\fire>adb connect 192.168.1.100
    connected to 192.168.1.100:5555

    C:\fire>sdb push bootmenu.img /sdcard/
    ‘sdb’ is not recognized as an internal or external command,
    operable program or batch file.

    C:\fire>adb push bootmenu.img /sdcard/
    cannot stat ‘bootmenu.img’: No such file or directory

    C:\fire>adb push bootmenu /sdcard/
    cannot stat ‘bootmenu’: No such file or directory

    C:\fire>adb push bootmenu.zip /sdcard/
    1193 KB/s (460104059 bytes in 376.597s)

    C:\fire>adb shell
    shell@android:/ $ su
    su
    root@android:/ # /system/xbin/busybox md5sum /sdcard/bootmenu.img
    /system/xbin/busybox md5sum /sdcard/bootmenu.img
    md5sum: can’t open ‘/sdcard/bootmenu.img’: No such file or directory
    1|root@android:/ # /system/xbin/busybox md5sum /sdcard/bootmenu.zip
    /system/xbin/busybox md5sum /sdcard/bootmenu.zip
    4429327daeed0df852731d81fa9b1f54 /sdcard/bootmenu.zip
    root@android:/ # mount -o remount,rw /system
    mount -o remount,rw /system
    root@android:/ # mkdir /system/boot
    mkdir /system/boot
    root@android:/ # dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/system/bo
    ot/boot.img
    dcc.1/by-name/boot of=/system/boot/boot.img <
    20480+0 records in
    20480+0 records out
    10485760 bytes transferred in 0.469 secs (22357697 bytes/sec)
    root@android:/ # mount -o remount,ro /system
    mount -o remount,ro /system
    root@android:/ # dd if=/sdcard/bootmenu.img of=/dev/block/platform/msm_sdcc.1/by
    -name/boot
    dev/block/platform/msm_sdcc.1/by-name/boot <
    /sdcard/bootmenu.img: cannot open for read: No such file or directory
    1|root@android:/ # dd if=/sdcard/bootmenu.zip of=/dev/block/platform/msm_sdcc.1/
    by-name/boot
    /dev/block/platform/msm_sdcc.1/by-name/boot adb reboot
    ^C
    C:\fire>adb start-server

  45. Stevie G says:

    I did not see i ran out of space

    dev/block/platform/msm_sdcc.1/by-name/boot <
    /sdcard/bootmenu.img: cannot open for read: No such file or directory
    1|root@android:/ # dd if=/sdcard/bootmenu.zip of=/dev/block/platform/msm_sdcc.1/
    by-name/boot
    /dev/block/platform/msm_sdcc.1/by-name/boot <
    /dev/block/platform/msm_sdcc.1/by-name/boot: write error: No space left on devic
    e
    20481+0 records in
    20480+0 records out
    10485760 bytes transferred in 1.350 secs (7767229 bytes/sec)
    1|root@android:/ # exit
    exit

    it just comes up with white amazon screen and orange light of fire tv

  46. Ninefingers says:

    Hi there. I’ve two fire tv’s. One is on FW 51.1.0.2 and rooted. I havent installed anything except kodi.
    No partial bootloader, no full unlock, ClockWorkMod. Nothing.
    I’ve bought the second one 4 days ago. And I’ve started to follow AFTV news sites guide.
    I’ve succesfully updated it to the fw version 51.1.4.0. When i tried to install Rbox’s boot menu to my second fire TV
    I’ve accidentaly installed it to my first fire tv (the one with fw 51.1.0.2). And its bricked. It hangs on white amazon logo.
    Any advice?

  47. jonathan says:

    no sure what happened but now when i did the reboot , my ftv stays on the Amazon smilling logo.

    • Ninefingers says:

      I still can’t get past white amazon logo. :(
      Since I haven’t installed Clockworkmod I guess there is no hope of recovery.

  48. Nolram says:

    I just successfully updated to 51.1.5.0 via booting into recovery mode through adb. The process was just fine but I am still trying to understand the purpose of the Kernel Boot Menu.

    Can someone help me understand the a couple things about the Kernel Boot Menu:
    1. Is the main purpose to be able to launch into recovery without using adb command?

    2. Do I absolutely need a USB keyboard to use Kernel Boot Menu? Can you use remotely control the menu via adb commands (see http://www.aftvnews.com/how-to-remotely-control-clockworkmod-on-the-amazon-fire-tv-using-adb/) ?

    I don’t have a USB keyboard so the Kernel Boot Menu is useless to me if I need a keyboard.

    Any feedback to help improve my understanding of Kernel Boot Menu is greatly appreciated.

  49. henning says:

    HELP: I have CWM 6.0.5.1.4a and installed the latest rooted rom. Now I have a bricked device in boot loop. I am able to get into CWM with the ALT+i+prt scrn method.
    I have tried installing varoius roms but my device does the same every time. It is just stuck in the color Fire TV logo.
    Since I don’t have SU from CWM I cannot get ADB to upgrade to kernel boot menu or downgrade to stock firmware.

    What should I do? Any help greatly appreciated!

  50. Keith says:

    Hi just wanted to add my experience because I think it will help other dumbasses like myself. I kept getting a file not found error from my adb push command and abandoned the upgrade for months. What I eventually realized was that I named the file “bootmenu.img” so it’s full name was “bootmenu.img.img”,which is why it couldn’t be found. Don’t be a dumbass like me and put the extension in the name!

    • Ryan says:

      Dude that’s a common mistake don’t beat yourself up. People make that mistake all the time; You see “bootmenu.img” and think “.img” is the extension when it’s really part f the file name. To avoid this in the future, just set Windows Explorer to show file extensions by default. In your case the file would have clearly been listed as “bootmenu.img.img” because the .img extension at the end would be visible.

      To change this setting check out http://windows.microsoft.com/en-us/windows/show-hide-file-name-extensions

  51. coops says:

    I am on stuck on black and white amazon logo on 51.1.4.0 with cwm.
    the alt+print+i command in boot does not work.

    please help !

    • nathan says:

      me 2
      I guess the next option is usb cable.

      /system/xbin/busybox md5sum /sdcard/recovery.img

      root@android:/ # ^C
      C:\Users\Nathan\Desktop\adbfw126>adb push bootmenu.img /sdcard/
      522 KB/s (468180019 bytes in 874.735s)

      C:\Users\Nathan\Desktop\adbfw126>abd shell
      ‘abd’ is not recognized as an internal or external command,
      operable program or batch file.

      C:\Users\Nathan\Desktop\adbfw126>abd shell
      ‘abd’ is not recognized as an internal or external command,
      operable program or batch file.

      C:\Users\Nathan\Desktop\adbfw126>adb shell
      root@android:/ # su
      su
      root@android:/ # /system/xbin/busybox md5sum /sdcard/bootmenu.img
      /system/xbin/busybox md5sum /sdcard/bootmenu.img
      b1b48348cb56c0b83a3affc9fd06e07e /sdcard/bootmenu.img
      root@android:/ # mount -o remount,rw /system
      mount -o remount,rw /system
      root@android:/ # mkdir /system/boot
      mkdir /system/boot
      root@android:/ # dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/system/bo
      ot/boot.img
      dcc.1/by-name/boot of=/system/boot/boot.img <
      20480+0 records in
      20480+0 records out
      10485760 bytes transferred in 0.485 secs (21620123 bytes/sec)
      root@android:/ # mount -o remount,ro /system
      mount -o remount,ro /system
      root@android:/ # dd if=/sdcard/bootmenu.img of=/dev/block/platform/msm_sdcc.1/by
      -name/boot
      dev/block/platform/msm_sdcc.1/by-name/boot adb reboot

      • nathan says:

        /dev/block/platform/msm_sdcc.1/by-name/boot: write error: No space left on devic
        e
        20481+0 records in
        20480+0 records out
        10485760 bytes transferred in 1.018 secs (10300353 bytes/sec)
        1|root@android:/ # rm -f /sdcard/bootmenu.img
        rm -f /sdcard/bootmenu.img
        root@android:/ # exit
        exit
        root@android:/ # exit
        exit

  52. Habenjero says:

    HELP: I have CWM 6.0.5.1.4a and tried this tutorial but now I have a boot loop!

    The boot menu does show up and I am able to go into CWM.

    When it boot loops, I see the Amazon logo for about a second and then it reboots?

  53. Anthony says:

    ok.. so i followed the steps and i still cant get passed this.
    Any help? please

    C:\android-sdk-windows\platform-tools>adb shell
    root@android:/ # su
    root@android:/ # /system/xbin/busybox md5sum /sdcard/bootmenu.img
    a8a3c28baafe43f354d92e6cc8b392d3 /sdcard/bootmenu.img
    root@android:/ # rm -f /sdcard/bootmenu.img
    root@android:/ # exit
    root@android:/ # exit

    C:\android-sdk-windows\platform-tools>mkdir /system/boot
    The syntax of the command is incorrect.

  54. Swap says:

    My AFTV seems fully bricked.

    I have CWM 6.0.5.1.4a.

    Followed this tutorial, rebooted and stuck on White Amazon Logo. USB Keyboard sequence (Alt I PrnScreen ) doesn’t work, just a static Orange or Amber Light with White Amazon Logo. Keyboard numlock/capslock led light doesn’t change which seems keyboard doesn’t work at all.

    Any solutions ? Or is it a paperweight now, lil expensive one :)

    Logs below –

    C:\adb>adb install stericson.busybox.apk
    3444 KB/s (2708141 bytes in 0.767s)
    pkg: /data/local/tmp/stericson.busybox.apk
    Success

    C:\adb>adb shell
    root@android:/ # pm disable com.amazon.dcp
    pm disable com.amazon.dcp
    Package com.amazon.dcp new state: disabled
    root@android:/ # busybox
    busybox
    BusyBox v1.23.2-Stericson (2015-04-10 10:51:32 CDT) multi-call binary.
    BusyBox is copyrighted by many authors between 1998-2012.
    Licensed under GPLv2. See source distribution for detailed
    copyright notices.

    Usage: busybox [function [arguments]…]
    or: busybox –list[-full]
    or: busybox –install [-s] [DIR]
    or: function [arguments]…

    BusyBox is a multi-call binary that combines many common Unix
    utilities into a single executable. ……..
    xzcat, yes, zcat, zcip

    C:\adb>adb connect 192.168.100.177
    connected to 192.168.100.177:5555

    C:\adb>adb shell
    root@android:/ # exit
    exit

    C:\adb>adb reboot recovery
    ^C
    C:\adb>adb connect 192.168.100.177
    connected to 192.168.100.177:5555

    C:\adb>adb push bootmenu.img /sdcard/bootmenu.img
    3700 KB/s (90958 bytes in 0.024s)

    C:\adb>adb shell

    root@android:/ # cd /sdcard
    cd /sdcard
    root@android:/sdcard # ls
    ls
    Alarms
    Android
    BubbleUPnP
    DCIM
    Documents
    Download
    LazyList
    Movies
    Music
    Notifications
    Pictures
    Podcasts
    Ringtones
    TunnyBrowser
    XBMC-TORRENT-MOUNT
    amazonmp3
    backups
    bootmenu.img
    clockworkmod
    logcat.txt
    logcat.txt.1
    media
    null
    pnr_report
    recovery.img
    yahoo
    root@android:/sdcard # su
    su
    root@android:/storage/emulated/legacy # mount -o remount,rw /system
    mount -o remount,rw /system
    root@android:/storage/emulated/legacy # mkdir /system/boot
    mkdir /system/boot
    root@android:/storage/emulated/legacy # dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/system/boot/boot.img
    atform/msm_sdcc.1/by-name/boot of=/system/boot/boot.img <
    20480+0 records in
    20480+0 records out
    10485760 bytes transferred in 0.443 secs (23669887 bytes/sec)

    root@android:/storage/emulated/legacy # mount -o remount,ro /system
    mount -o remount,ro /system

    root@android:/storage/emulated/legacy # dd if=/sdcard/bootmenu.img of=/dev/block/platform/msm_sdcc.1/by-name/boot
    enu.img of=/dev/block/platform/msm_sdcc.1/by-name/boot adb reboot
    ^C

    White Amazon Logo with Orange / Amber static light, Alt I PrnScreen doesn’t work!!

  55. Swap says:

    I realize now that the img file I downloaded didn’t download properly, only 89KB in size.

    Sadly I followed this tutorial – http://forum.xda-developers.com/fire-tv/orig-development/firetv-boot-menu-t2941729

    This didn’t state anywhere to verify MD5 checksum.

    Bricked!!

    No way to go into recovery ??

  56. Swap says:

    I managed to fix AFTV and bring it back to life!

    Since I did the bootloader unlock correctly, I used the Fastboot technique to enter Recovery using a USB Male to Male cable.

    http://www.aftvnews.com/how-to-unbrick-and-prevent-bricking-an-amazon-fire-tv/#toc3.1

  57. Feroz says:

    Hi Dear sir I am a regular visitor of your site and glad to see the successes you being have. I have never posted any comments due to my bad English. I have been on your site before the days you received the take down notice from Amazon and glad to see you still around and growing. I see you have fantastic guides and I have rooted long time ago using your guide but now I have another rootable FTV and It is confusing “not the Guide method” but steps to take 1st steps to last with latest custom rom.
    I have blocked Ama update from router over a year.
    now please tell am i correct in steps from start to finish I am not Techie
    1, Root
    2, Unlock Bootloader
    3, cwm Recovery
    4,Kernal
    5 Custom rom
    Please tell me I know all your guides but I do not know sequence of steps to follow Thanks if you reply if not still a great site and lol you on radio show too . sorry for spelling, verb and whatever adgective things are.

  58. kyle says:

    Im getting some messed up stuff i followed the guide exactly but it’s not working for me with the mkdir. I think it has to do with the mounting step.

    C:\Users\Kyle\Desktop\fastboot>adb push bootmenu.img /sdcard/
    557 KB/s (6739968 bytes in 11.815s)

    C:\Users\Kyle\Desktop\fastboot>adb shell
    root@android:/ # su
    su
    root@android:/ # /system/xbin/busybox md5sum /sdcard/bootmenu.img
    /system/xbin/busybox md5sum /sdcard/bootmenu.img
    a8a3c28baafe43f354d92e6cc8b392d3 /sdcard/bootmenu.img
    root@android:/ # mount -o remount,rw /system
    mount -o remount,rw /system
    Usage: mount [-r] [-w] [-o options] [-t type] device directory
    1|root@android:/ # mkdir /system/boot
    mkdir /system/boot
    mkdir failed for /system/boot, Read-only file system
    255|root@android:/ #

  59. Blake says:

    I am in a boot loop after doing this, and a bit stuck. I can get into CWM but I cannot get a USB drive to be recognized through 3 different hubs I have here. I need this so I can also get the keyboard to work. Any ideas on what to try next?

  60. Navin says:

    Background
    Version: 51.1.4.0_514006420
    Busy box installed, rooted, unlocked, CWM Recovery

    After following this process, I am stuck in the recovery screen. It does not boot into kernel or give me the boot menu option.

    My goal is to install boot menu and update to latest ROM

    • Milton says:

      I’ve got the boot menu screen successfully with similar version 51.1.4.0_514006420, the only issue I noticed, before install the boot menu was that the Busy box v1.24.1 appears uninstalled so I re-installed it a couple of times and it worked properly.

  61. Hileut says:

    I have a question. Can I use a Touchscreen with the fire TV?

Leave a Reply

Your email address will not be published. Required fields are marked *

*