https://forum.xda-developers.

com/fire-tv/development/unbrick-fire-tv-stick-2-anti-
rollback-t3986303

This guide is only for the Fire TV 2 2015 (not stick) codenamed "sloane" with
mt8173.
This will flash correct partitions and TWRP into it.
This WILL NOT clean RPMB neither will unlock the device.
I am not responsable of any physical damage in your device, YOU choose to make this
modifications.

NOTE: You will need to open the device so be prepared

NOTE: This will flash 5.6.2.8 images meaning RPMB will be updated.

MATERIAL NEEDED:

Linux based system.

USB A-A Cable.
Something conductive (paperclip, tweezers, etc).
Something to open the device.

- Install python3, PySerial, adb, fastboot:

Code:

sudo apt update

sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot

- Uninstall/disable modemmanager:
Code:

sudo apt remove modemmanager

PROCEDURE:
0. Open up the device. You can use a pick or a kinfe or any special tool to open it
up.
1. Locate DAT0 in the attatched image. You will need to flip the motherboard.
2. Download amonet-mt8173-sloane from downloads and unpack it.
3. Open the unpacked folder of amonet, open a terminal inside it and type:
Code:

sudo ./bootrom-step.sh

4. Wait until you see something like:

Code:

[2019-02-07 14:35:59.478924] Waiting for bootrom

5. Once that message shows up, connect the A-A cable but not the power supply.
After that, prepare the short and at same time you short DAT0 with GND, plug in the
power supply to the wall.
6. The script will ask you to remove the short. When this happens, stop shorting
DAT0 and then press enter.
7. Wait until it finishes.
8. The device should now reboot into TWRP. Please, consider now flashing a
prerooted ROM or LineageOS 12.1 for get full TWRP.

NOTES:
In lsusb boot-rom shows up as:
Code:

Bus 001 Device 009: ID 0e8d:0003 MediaTek Inc. MT6227 phone

If you see:
Code:

Bus 001 Device 013: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader

means you're in preloader mode. Try shorting again.

If somehow you have a corrupt gpt (shouldn't happen), just run:

Code:

sudo ./gpt-fix.sh

If TWRP freezes, DON'T UNPLUG THE THE POWER SUPPLY, instead, open an adb shell
session and type the following command to restart TWRP:
Code:

killall recovery

Please, your bootloader is still LOCKED. If you flash custom kernels/unsigned boots
(i.e: Magisk Manager, etc) the bootloader will refuse to load the boot image and
you will be not able to boot in TWRP anymore unless you re-unbrick the device.

THANKS:
- @CFKod for his patience and for test the script
- @retyre & @k4y0z for the initial port to mt8173
- @xyz` for his original exploit for the HD8 2018.
- @Sus_i for locate DAT0, DAT1 and DAT2.
- @rbox for TWRP/Boot menu.

DOWNLOAD:

amonet-sloane-v1.3.zip (Or attachments)