Earlier this week, Amazon’s new $50 Fire tablet was rooted. This new tablet shares a lot of similarities with the 2nd-gen Fire TV since both run Fire OS 5 and both use a MediaTek CPU. After talking with csolanol, one of the creators of the Fire tablet’s rooting method, and rbox, creator of the 1st-gen Fire TV’s custom recovery and ROMs, it seems the 2nd-gen Fire TV might have a bootloader capable of accepting custom boot images which could lead to rooting the device.
An Android device’s boot image contains the device’s kernel and ramdisk. Skipping the technical details, the boot image is what launches first on power up to prepare the device for the operating system. Most Android devices, including the 1st-gen Fire TV and Fire TV Stick, ship with a locked bootloader which prevents anyone from modifying the device’s boot image. Modifying the boot image is done with a utility called fastboot. On the 1st-gen Fire TV and Fire TV Stick, running fastboot commands will result in an error message informing you the device’s bootloader is locked. Running those same fastboot commands on the new Fire tablet and the 2nd-gen Fire TV does not result in an error message, indicating the device’s bootloader is at least partially unlocked.
To gain root access, one needs to modify the device’s system files which are normally protected from being changed. Most rooting methods use an exploit to trick the operating system into allowing a regular user to modify the protected system files. The Fire tablet rooting method does not use an exploit, but instead takes advantage of the devices unlocked bootloader by simply loading a customized boot image that sets the entire system partition as writable upon boot up, instead of setting it as a read-only file system like it is normally configured.
The team that rooted the Fire tablet simply extracted the boot image from the device’s software update package provided by Amazon, and modified it to mount the system partition as writable. They then took this modified boot image and used it to boot the tablet, which they could do because of the unlocked state of the tablet’s bootloader.
The 2nd-gen Fire TV appears to have a similarly unlocked bootloader that will accept modified boot images. The problem is, we do not have the Fire TV’s original boot image to use as a base for the modified version. This is because Amazon switched to incremental updates on the new Fire TV. The boot images that can be extracted from the 2nd-gen Fire TV’s software updates are only patches and are incomplete. Without the original boot image, there is no way to achieve root with the same method as the Fire tablet. We don’t even know if the 2nd-gen Fire TV will accept a modified boot image in the same manner, since Amazon may be checking the boot image’s signature which would be rejected if it’s modified. The 1st-gen Fire TV and the Fire TV Stick are not vulnerable to this new possible root method, so those device are no closer to being rooted. The 2nd-gen Fire TV appears to accept custom boot images, since it does not reject fastboot commands, but we won’t know for sure until we have the stock boot image to use for testing.
Amazon can close this rooting avenue with a software update, so you might want to block updates once you’re happy with the state of bug fixes that Amazon is still releasing, if you want to root your 2nd-gen Fire TV. That said though, there is no way to know if we’ll ever get a complete original boot image, so you might be waiting forever. Theoretically, if someone is able to successfully hardware root the 2nd-gen Fire TV, they could then extract the boot image directly. That is likely the best bet to getting the original boot image, since it doesn’t seem like Amazon will ever provide a complete (non-partial) software update for the 2nd-gen Fire TV. I know of only one person who is attempting to hardware root the 2nd-gen Fire TV. Hopefully this new information about the bootloader will spur others to give it a shot.