aftv2-tools

Tools for rooting the Amazon Fire TV Gen 2

Overview

Tools for rooting the Amazon Fire TV Gen 2

Detected project type: Python.

At a glance

• Default branch: master
• Visibility: public
• Size: 9.5 MB
• Created: 2026-04-27
• Last updated: 2026-04-27
• Stars / Forks / Open issues: 0 / 0 / 0

Languages

Language	Bytes	Share
Python	42,095 bytes	85.1%
Shell	3,043 bytes	6.2%
C	2,703 bytes	5.5%
Batchfile	1,475 bytes	3.0%
Makefile	156 bytes	0.3%

Repository structure

• seldis/
• win_drivers/
• .gitignore (85 B)
• build_exe.bat (39 B)
• changed_blks.py (1,099 B)
• checkver.py (1,466 B)
• dd.exe (355,328 B)
• filefrag (553,936 B)
• handshake.py (2,105 B)
• install_py2exe.bat (45 B)
• install_pyserial.bat (47 B)
• md5sums.txt (443 B)
• partinfo.txt (986 B)
• patch_mmc.bat (971 B)
• patch_mmc.py (653 B)
• patch_mmc.sh (826 B)
• read32.py (1,394 B)
• read_mmc.py (9,784 B)
• README (3,226 B)
• README.md (6,097 B)
• README_WIN.txt (2,885 B)
• root_aftv2.bat (373 B)
• root_aftv2.py (13,804 B)
• root_upgrade.sh (2,217 B)
• setup.py (138 B)
• version.txt (22 B)
• write32.py (1,306 B)
• write_mmc.py (10,346 B)

Getting started

Clone the repository:

git clone https://forgejo.deployview.com/ssa/aftv2-tools.git
cd aftv2-tools

Installation

python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

Usage

Invoke the main entry point:

python3 main.py    # or the appropriate module

Original README

The content below is preserved from the previous README. Headings have been demoted so they don't compete with the new top-level sections.

Tools for rooting the Amazon Fire TV Gen 2

Overview

sh$ adb reboot ; ./handshake.py

Detected project type: Python.

At a glance

• Default branch: master
• Visibility: public
• Size: 9.5 MB
• Created: 2026-04-27
• Last updated: 2026-04-27
• Stars / Forks / Open issues: 0 / 0 / 0

Languages

Language	Bytes	Share
Python	42,095 bytes	85.1%
Shell	3,043 bytes	6.2%
C	2,703 bytes	5.5%
Batchfile	1,475 bytes	3.0%
Makefile	156 bytes	0.3%

Repository structure

• seldis/
• win_drivers/
• .gitignore (85 B)
• build_exe.bat (39 B)
• changed_blks.py (1,099 B)
• checkver.py (1,466 B)
• dd.exe (355,328 B)
• filefrag (553,936 B)
• handshake.py (2,105 B)
• install_py2exe.bat (45 B)
• install_pyserial.bat (47 B)
• md5sums.txt (443 B)
• partinfo.txt (986 B)
• patch_mmc.bat (971 B)
• patch_mmc.py (653 B)
• patch_mmc.sh (826 B)
• read32.py (1,394 B)
• read_mmc.py (9,784 B)
• README (3,226 B)
• README_WIN.txt (2,885 B)
• root_aftv2.bat (373 B)
• root_aftv2.py (13,804 B)
• root_upgrade.sh (2,217 B)
• setup.py (138 B)
• version.txt (22 B)
• write32.py (1,306 B)
• write_mmc.py (10,346 B)

Getting started

Clone the repository:

git clone https://forgejo.deployview.com/ssa/aftv2-tools.git
cd aftv2-tools

Installation

python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

Usage

Invoke the main entry point:

python3 main.py    # or the appropriate module

Original README

The content below is preserved from the previous README. Headings have been demoted so they don't compete with the new top-level sections.

=== Patching a Partition ===

sh$ adb reboot ; ./handshake.py

sh$ cmp -l system.orig.img system.root.img > system.diff

sh$ ./patch_mmc.sh 0x00000000058e0000 system.root.img system.diff

NOTE: Cut and restore power to exit the preloader

Once you have root you can just write the file to the partition to restore.

adb$ dd if=system.orig.img of=/dev/block/platform/mtk-msdc.0/by-name/system bs=1m adb$ sync adb$ reboot

=== Modifying a File ===

NOTE: system partition @ 0x00000000058e0000

adb$ filefrag -v /system/bin/logcat_log.sh Filesystem type is: ef53 File size of /system/bin/logcat_log.sh is 587 (1 block of 4096 bytes) ext: logical_offset: physical_offset: length: expected: flags: 0: 0.. 0: 307248.. 307248: 1: last,eof /system/bin/logcat_log.sh: 1 extent found

adb$ reboot

sh$ ./handshake.py

sh$ ./read_mmc.py $((0x00000000058e0000+(3072484096))) $((14096)) file.out

sh$ file.out

sh$ ./write_mmc.py $((0x00000000058e0000+(307248*4096))) file.out

NOTE: It's a good idea to keep the original contents backed up

NOTE: The non-zero'd contents should be the same length as the original file and also the overall file size, (multiple of 4096 normally)

TIP: You can use an invalid read to exit the preloader although you have to wait for a 5 second timeout before it reboots. EX: ./read32.py 0 1

=== Initial Rooting ===

To run commands on the device as root you need to initially patch a service script that runs within the init context (others work but you can do less). One such script is /system/bin/logcat_log.sh. Using the procedure above you can modify the file to eval an android parameter of your choosing.

eval getprop debug.log.command

For the patched logcat_log.sh script above you could run a command using:

adb$ setprop debug.log.command "date > /data/out" adb$ setprop debug.log.logcat.enable y

To load a kernel module you need to first get the file into a location and context that the service script can read, for example /data. This is done using a similar trick to modifying the flash contents in the preloader.

dd if=/dev/block/mmcblk0p15 of=/data/file.ko
bs=1 skip=$((66528*4096)) count=128371

NOTE: Here you use the actual file size not the block based size

FYI: I've never had to copy a file with more than 1 extent. Not sure what would need to change in the procedure for that case.

Once you have the module in /data you simply run "insmod /data/file.ko"

Once SELinux is in permissive mode you can execute su to get a root adb shell. You will need to first copy the su binary from the SuperSU update zip package. One copy of su should be named daemonsu and other just su. To then enable su use the following setup commands:

chown root.root /data/su chmod 6755 /data/su chmod 755 /data/daemonsu /data/daemonsu --auto-daemon &

You can then run /data/su to become root and then run the normal SuperSU update script. To run the update script you will need to create /tmp and mount it as tmpfs and also have unzip in your path.

=== References ===

• http://mattboyer.github.io/PYaffs/2014/07/31/Hacklog%233.html
• https://sturmflut.github.io/mediatek/2015/07/04/mediatek-details-partitions-and-preloader/

Contributing

Contributions are welcome. The typical workflow is:

1. Open an issue describing the change you'd like to make.
2. Fork the repository (or create a feature branch if you have write access).
3. Commit your changes with clear, descriptive messages.
4. Open a pull request against the master branch.

Please follow the existing code style and include tests or reproduction steps where relevant.

License

No LICENSE file is currently present in this repository. Treat the contents as all rights reserved by the author until an explicit license is added. If you intend to share or accept contributions, consider adding an OSI-approved license such as MIT, Apache-2.0, or GPL-3.0.

Repository

• Browse: https://forgejo.deployview.com/ssa/aftv2-tools
• Clone (HTTPS): https://forgejo.deployview.com/ssa/aftv2-tools.git
• Clone (SSH): ssh://git@forgejo.deployview.com:30143/ssa/aftv2-tools.git

---

This README was generated automatically based on repository metadata, contents, and any prior README content. Edit any section above to add project-specific detail.

Contributing

Contributions are welcome. The typical workflow is:

1. Open an issue describing the change you'd like to make.
2. Fork the repository (or create a feature branch if you have write access).
3. Commit your changes with clear, descriptive messages.
4. Open a pull request against the master branch.

Please follow the existing code style and include tests or reproduction steps where relevant.

License

No LICENSE file is currently present in this repository. Treat the contents as all rights reserved by the author until an explicit license is added. If you intend to share or accept contributions, consider adding an OSI-approved license such as MIT, Apache-2.0, or GPL-3.0.

Repository

• Browse: https://forgejo.deployview.com/ssa/aftv2-tools
• Clone (HTTPS): https://forgejo.deployview.com/ssa/aftv2-tools.git
• Clone (SSH): ssh://git@forgejo.deployview.com:30143/ssa/aftv2-tools.git

---

This README was generated automatically based on repository metadata, contents, and any prior README content. Edit any section above to add project-specific detail.