Skip to content
1.3k
Get startedWhat it blocksDevicesPressFAQGitHub
Amazon

Fire TV

13 sticks, Cubes and televisions, 6 fully tested end to end. Each one reported by its owner.

Fully testedFire OS 7.7

Fire TV Cube, 2nd gen (AFTR)

@podulator@podulator

Fire TV Cube (2nd gen, model AFTR), full dumbtv pass: debloat + lockdown + DNS filter + launcher + YouTube replaced; verify.sh all checks passed

Developer mode
  1. Settings
  2. My Fire TV
  3. About
  4. click the device name row 7 times, then My Fire TV
  5. Developer Options
  6. ADB debugging: ON
IP address

Settings > My Fire TV > About > Network

Notes from the owner 1
  • always_on_vpn_app has been seen reverting to null across a reboot on this build (7.7.1.3 / PS7713), not just on Fire OS 6; the app's own AUTOSTART boot receiver keeps the filter running regardless, so verify.sh falls back to checking for any live tunN interface. The tun interface name is not stable across boots (seen tun0, then tun1 after the next one) — never match a hardcoded tun0.

Build PS7713.5443N · Original report

Fully testedFire OS 8.1

Fire TV Edition television (AFTOLCBC82)

@koconnorgit@iotemylabs@koconnorgit, @iotemylabs

Fire OS 8 television, two sets. A full pass on Fire OS 8.1.5.3 and again after an OTA to 8.1.8.0: debloat, lockdown and the DNS filter through the file:/// list, verify.sh exit 0 before and after a reboot. dumbtv home 1.2 takes HOME 0.3 s after Amazon's home starts, also after a reboot, and opens inputs on its own screen. A second set on 8.1.8.0: debloat (58 disabled), lockdown and youtube.sh, with blocking done by a network resolver using the same host list

Developer mode

Enabled by the owner before the session. On this build Developer Options is under Settings > Device & Software > Developer Options, with separate ADB debugging (network) and USB debugging toggles; ADB debugging is the one adb connect needs. The usual Fire OS unlock (About > click the device name 7 times) was not re-verified here.

IP address

Settings > Device & Software > About > Network (the owner supplied the address; path not re-verified)

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV and ticks Always allow. adb devices then shows authorizing and offline for about 30 s before device; keep polling, do not reconnect in a loop
  • ADB off after rebootport 5555 was closed after debloat.sh's reboot although the TV reached its home screen, so reboot_wait timed out. Turning ADB debugging off and on again in Developer Options opened it; turning it on once did not
  • Fire TV full-screen keyboardopens over personalDNSfilter's text fields and hides the dialog. Type with adb shell input text, close it with KEYCODE_BACK; the next tap after typing reopens the field instead of pressing the button, so press BACK and tap again
Notes from the owner 13
  • After the first reboot network ADB did not come back (port 5555 refused, nothing on mDNS) until the owner toggled ADB debugging off and on in Developer Options; after a later reboot it came back by itself. all.sh stops with 'device did not report boot_completed' when this happens; reconnect and continue with lockdown.sh, dnsfilter.sh and verify.sh
  • personalDNSfilter's screen cannot be navigated with the remote on this TV. Drive it with adb shell input tap at the 1920x1080 override size and check state with uiautomator dump. Edit the first filter entry's URL to the file:// path, untick the other two, then press RESTART: RELOAD FILTER reruns the previously saved config and downloads the default lists again. The log then shows 'Building index for 415 entries'
  • Three packages that debloat.sh reported absent (com.amazon.device_remote_config_sync_service, com.amazon.perfc, com.android.traceur) were present and enabled after the first reboot; pm disable-user --user 0 fixed them and they stayed disabled through a second reboot. 56 packages disabled in total, protected 0
  • Only Prime Video is preinstalled; nothing from user-apps.txt exists on this model. Absent from packages.txt on this build: media.recommendations, tv.fw.metrics, neo.minerva.logcat, tigris, vizzini.ftvcds, firetv.androidskillconnectioncapability, wha.mediabrowserservice, printspooler, bips, nfc
  • On a weak Wi-Fi link (70 percent packet loss) adb shell stalled and every script died with 'not responding'; moving the TV to a better network fixed it. The TV also advertises _adb-tls-connect on mDNS on a random port, which answers offline without pairing and Fire OS has no pairing screen: use port 5555
  • A staged OTA that had been downloaded before the pass was applied on the first reboot (Fire OS 8.1.5.3 RS8153.3202N to 8.1.8.0 RS8180.3746N). Disabled packages, app-ops, the always-on VPN and the DNS filter all survived it and verify.sh still exited 0; softwareupdates.amazon.com is blocked afterwards. The update reset two settings, alexa_wake_word_disabled and voice_disabled, back to 0; settings put secure restored them, the other 13 held
  • Launcher Inputs row: TvContract.buildChannelUriForPassthroughInput resolves to Amazon's Live TV app on this television, which lands in its channel-scan settings when no channels are scanned. Amazon's own home opens inputs through com.amazon.tv.inputpreference.service, which requires a system permission a sideloaded app cannot hold. Launcher 1.2 opens inputs on its own TvView screen instead (Options › Open inputs with › Automatic, the default; PR 33, tested on this television)
  • HOME from an HDMI input takes about 4.5 s with Amazon's Live TV app: the passthrough activity holds the display while it tears down (black screen), then dumbtv home follows within milliseconds. The launcher's own input screen releases the picture about 0.4 s after the key
  • MediaTek input packages (com.mediatek.tis, com.mediatek.dtv.tvinput.atsctuner, com.amazon.mediatek.livetv, com.amazon.tv.settings.mediatek) carry the HDMI, tuner and picture settings; they are on never-disable.txt
  • com.amazon.hedwig also provides a TV input (HedwigTvInputService, a channel source, not HDMI or the tuner); disabling it left every hardware input working
  • com.amazon.device.software.ota restarts within seconds of lockdown.sh's force-stop; only the DNS filter stops updates
  • Wi-Fi reports NOT_METERED, so lockdown.sh's data saver and background-data blacklist have no effect here; the app-op part still applies
  • youtube.sh works on this model

Build RS8153.3202N, then RS8180.3746N after a staged OTA applied on the first reboot; a second set on RS8180.3746N · Original report

Fully testedFire OS 6.7

Fire TV Stick 4K, 1st gen (AFTMM)

@niz-coder@niz-coder

Developer mode
  1. Settings
  2. My Fire TV
  3. Developer Options
  4. ADB debugging: ON. If Developer Options is missing, Settings
  5. My Fire TV
  6. About
  7. click the device name row 7 times first
IP address

Settings > My Fire TV > About > Network

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV
  • Debug tool stops on a sleeping remotemonkey --pct-syskeys 0, or am start -n; the BLE remote disconnects while idle
  • personalDNSfilter start screennothing to press; the script sends HOME after 8 s
Notes from the owner 14
  • no cmd package install-existing: system apps are only disabled, never uninstalled
  • com.amazon.firebat is Prime Video, not an OTA helper
  • com.amazon.vizzini re-enables itself at every boot
  • ps is the old toolbox one: ps -A -o NAME fails with bad pid '-A'
  • no RUN_ANY_IN_BACKGROUND app-op; RUN_IN_BACKGROUND ignore blocks background starts only
  • always_on_vpn_app is dropped at boot; the DNS filter starts from its own boot receiver once it has been opened
  • settings put secure enabled_accessibility_services is silently ignored; content insert stores it, Fire OS still refuses to bind
  • Keeper must match the home activity class, not just com.amazon.tv.launcher: MainSettingsActivity lives in the same package
  • SYSTEM_DNS=1 optionally adds android to androidAppWhiteList so the system can sync NTP past the filter VPN; apps and OTA stay filtered
  • no bootloader unlock on 6.2.8.0 and later (eFuse), no /system writes (dm-verity)
  • protected packages can only be starved, not disabled
  • Prime Video stops working unless its CDN is left unblocked (PRIME=1 in dumbtv.conf)
  • Keeper declares GET_USAGE_STATS, RECEIVE_BOOT_COMPLETED and REORDER_TASKS with maxSdkVersion=27, so Fire OS 7/8 does not request them
  • without SYSTEM_DNS=1 the clock drifts while the filter VPN is up

Build Fire TV Stick 4K 1st gen (mantis), Fire OS 6.7.1.1: debloat, lockdown, DNS filter and the Keeper launcher; verify.sh exited 0; HOME lands on dumbtv in under 0.3 s with a real remote; boot takes ~45–50 s (BOOT_COMPLETED) · Original report

Fully testedFire OS 7.7

Insignia 50" F30 Fire TV (NS-50F301NA24, AFTDCT31)

@timcunningham-sv@timcunningham-sv

Fire OS 7.7.1.7 (PS7717.5741N, Android 9, SDK 28), MediaTek panel. Full pass works with com.amazon.firebat kept enabled: 65 packages disabled, 7 protected starved, DNS filter and launcher both good, verify.sh exits 0. Nothing was uninstalled, so the pass was fully reversible.

Developer mode

Settings > Device & Software > About > click the device name row 7x. On this unit it answered 'you are already a developer', so no Developer Options row was discoverable from that screen; the ADB debugging toggle had to be found separately and switched on by hand. Until it is on, port 5555 ACTIVELY REFUSES - developer mode alone does not start the daemon.

IP address

Settings > Network > the connected network > SELECT for details. Note the details screen also lists the gateway; the IP Address row is the one needed. This unit was on wired Ethernet, not Wi-Fi.

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV with the remote; tick Always allow from this computer first, because the pass reboots twice
Notes from the owner 6
  • Windows/Git Bash: adb push rewrites the Android destination into a Windows path (observed: C:/Program Files/Git/sdcard/Android/data/...), so dnsfilter.sh dies with 'remote secure_mkdirs failed'. It prints '1 file pushed' immediately before the error. Fix: run adb through a wrapper exporting MSYS2_ARG_CONV_EXCL='/sdcard;/data;/storage;/system' - excluding every path instead breaks curl's output file
  • dnsfilter.sh force-stops the filter before pushing, and Android does not deliver BOOT_COMPLETED to a force-stopped app, so after the script's own reboot the filter never starts and the self-test reports 'the filter is not in the DNS path' on a correct install. Opening it once (monkey -p dnsfilter.android -c android.intent.category.LAUNCHER 1) clears the stopped flag; always_on_vpn_app then persists across reboots. The 'open it once' branch is gated to SDK<28 but is needed on SDK 28 too
  • com.amazon.firebat IS Prime Video here, as on Fire OS 6: it owns com.amazon.pyrocore.IgnitionActivity, the tile the user presses. With it disabled com.amazon.avod stays installed and enabled, so nothing looks removed, but starting avod's own activity opens nothing, with no crash and no app log. It is on never-disable.txt since this report (PR #52)
  • com.amazon.avod and com.tubitv.ott declare CATEGORY_LAUNCHER but no LEANBACK_LAUNCHER, so dumbtv home hides them and they never appear in Options. Do NOT work around this by adding avod to apps.show: its tile opens nothing and the real tile belongs to com.amazon.firebat, which is leanback and appears on its own once firebat is left enabled. Tubi does need an apps.show entry
  • com.android.nfc reports SUSPECT: 'Security exception: Shell cannot change component state'. Harmless - it stays enabled
  • FILTERHOSTS.TXT.idx is a directory, so the index rebuild needs rm -rf, not rm

Build PS7717.5741N · Original report

Fully testedFire OS 6.7

Insignia Fire TV Edition TV (AFTEAMR311)

@gtalusan@gtalusan

Fire OS 6.7.1.1 (Android 7.1.2) on an Insignia Fire TV Edition set: debloat, lockdown, DNS filter (after pointing fallbackDNS at the network's real resolver), the Keeper launcher and input switching all verified — verify.sh exits 0. Inputs render in dumbtv home via the built-in TvView screen; the boot takeover happens on its own around the two-minute mark through the Keeper's event path. Diagnostics (logcat tag and the optional reboot-surviving log) are documented in launcher/README.md.

Developer mode

not recorded: ADB was already enabled before this session

IP address

not recorded this session

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV and ticks Always allow; a missed dialog is re-triggered by adb disconnect + adb connect
  • ADB flaps offline while idle or on an external inputretry adb connect (recovers in seconds to minutes); worst case power-cycle. Capture logcat with logcat -f /data/local/tmp/x.log before doing anything whose evidence you need, because the file survives the power-cycle
Notes from the owner 14
  • Fire TV Edition TV, not a stick: everything including ADB runs over the wired link (eth0); the schema has no ethernet value, so adb.transport stays wifi
  • Has real HDMI inputs and an ATSC tuner. Disabling com.amazon.franktvinput and com.amazon.tifobserver (both in data/fireos6/packages.txt) breaks HDMI input switching and the dumbtv home Inputs row — they were re-enabled, and belong in never-disable.txt for TV Edition sets; com.amazon.tv.livetv too (this set has a tuner, ADTVInputService/HW16, unlike the stick the lists were written for)
  • Debloat: 62 disabled, 9 absent, 0 protected, 0 suspect. Absent: com.amazon.mvpdauth, com.amznfuse.operatorredirection, com.amazon.spiderpork, com.amazon.whad, com.amazon.whasettings, com.amazon.csm.htmlruntime, com.amazon.whisperjoin.wss.wifiprovisioner, com.mediatek.atci.service, com.android.carrierconfig
  • No YouTube or VLC preinstalled; no package from user-apps.txt present (the list is moot here)
  • com.amazon.metrics.api and com.amazon.client.metrics.api are telemetry packages not in data/fireos6/packages.txt (their siblings are); they are packages.txt candidates for every Fire OS 6 device
  • On networks whose firewall DNATs port 53 (every DNS query redirected to a local resolver), the pushed fallbackDNS (#router + the gateway IP) fails: replies arrive from the redirect target, which the app discards as unsolicited. Fix: point fallbackDNS at the real resolver (fallbackDNS = [<resolver>]::53::UDP in the pushed dnsfilter.conf)
  • First boot after installing the filter: the VPN establishment races and dies with 'network interface add tun0 … Device or resource busy'. A reboot, or opening personalDNSfilter once, brings it up cleanly
  • After a plain reboot the VPN can come up and later drop (tun0 state DOWN while the app process is alive); opening personalDNSfilter once re-establishes it and it stays — verify.sh's own advice is the recovery
  • Input switching from a third-party launcher (solved): the standard passthrough VIEW URI has no resolver on this Fire OS, and Amazon's tvinput://tunenow URI is gated by com.amazon.tv.permission.TUNE_INPUT (signature|amazon, never granted to sideloaded apps). Inputs render through the launcher's built-in TvView screen (the public API path; verified on this device) — set switch=home in home.conf. The session surface attach drives the native mux (daemon logs 'SystemControl: [CPQControl]:source input = N'); video arrives ~500 ms after the session is set up
  • Boot takeover: Fire OS's boot flow re-launches Amazon's home repeatedly for the first couple of minutes (the system starts the HOME activity over and over); each re-launch fires the foreground event the Keeper's event path watches, so the upstream Keeper takes over on its own around the two-minute mark — no boot window is needed. set-home-activity prints Success and still resolves to Amazon's launcher. One trap: moving an EMPTY task (one whose activity was just finished by the HOME-press task reset) makes Fire OS relaunch the dead activity — the Keeper never moves empty tasks
  • no cmd package install-existing: system apps are only disabled, never uninstalled
  • protected packages can only be starved, not disabled
  • without SYSTEM_DNS=1 the clock drifts while the filter VPN is up
  • adb dies whenever the TV suspends the Fire OS side (idle or displaying an external HDMI input); ping still answers, TCP does not

Build NS6711 · Original report

Fully testedFire OS 7.7

Onida 43" Fire TV Edition TV (AFTGRO001)

@humblemuzzu@humblemuzzu

Developer mode

Fire TV Stick / Cube: Settings > My Fire TV > About > click the device name row 7 times, then My Fire TV > Developer Options > ADB debugging: ON. Fire TV Edition televisions (Onida, Toshiba, AmazonBasics) use a different settings app with no "My Fire TV": Settings > Device & Software > About, then click the device name 7 times. On some of those builds the Developer Options row never renders even with development_settings_enabled=1; ADB can still be on (settings global adb_enabled=1) and everything in this repo works.

IP address

Stick / Cube: Settings > My Fire TV > About > Network. Fire TV Edition: Settings > Network > the connected network > SELECT to customise/details.

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV
  • VPN connection requestadb shell appops set dnsfilter.android ACTIVATE_VPN allow before launching; the dialog is phone-sized and ignores the remote
  • Unable to Detect Your Remotekeep com.amazon.vizzini enabled; block its domains instead
Notes from the owner 7
  • a disabled persistent priv-app can keep running; debloat.sh has a residual-process pass
  • the launcher hook can be cleared, leaving Amazon's home; scripts/launcher.sh restores it
  • after every boot a blank FallbackHome shows for ~15 s
  • the DNS filter must never be force-stopped; reboot instead
  • no bootloader unlock, no /system writes (dm-verity)
  • protected packages can only be starved, not disabled
  • Prime Video stops working unless its CDN is left unblocked (PRIME=1 in dumbtv.conf)

Build Fire TV Edition television, Fire OS 7.7.1.x · Original report

Partly testedFire OS 7.6

Fire TV Stick 4K Max, 1st gen (AFTKA), Fire OS 7.6.9.7

@dchuk@dchuk

Fire OS 7.6.9.7 (Android 9) on a Fire TV Stick 4K Max: debloat, lockdown and the launcher work unchanged. The DNS filter needed the manual restart in quirks (issue #15); after that verify.sh passed every check.

Developer mode

not recorded: ADB was already enabled before this session

IP address

not recorded this session

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV; tick Always allow from this computer
Notes from the owner 5
  • DNS filter: after dnsfilter.sh's adb reboot the ACTIVATE_VPN app-op was back to default (ignore), always_on_vpn_app was null and the app was stopped=true notLaunched=true, so no tun0 and nothing blocked. Same symptom as issue #15 on a Sony Google TV. Fix that worked: appops set dnsfilter.android ACTIVATE_VPN allow, settings put secure always_on_vpn_app dnsfilter.android, am start -n dnsfilter.android/.DNSProxyActivity, then reboot; the VPN came up by itself on the next boot
  • com.android.nfc ships disabled by the system (dumpsys: enabled=2), so pm disable-user fails with 'Shell cannot change component state for com.android.nfc/null to 3' and debloat.sh reports SUSPECT. It is off already and the rest of the pass is unaffected; #24 reports it as already disabled
  • No package in packages.txt was refused as protected. Absent on this model: media.recommendations, perfc, neo.minerva.logcat, device_remote_config_sync_service, alexadirectivebrokerservice, firetv.androidskillconnectioncapability, rtcsessioncontroller, tv.democontent.provider, tv.localgallery
  • com.amazon.tv.developer.dataservice keeps running after its disable; the residual-process pass turns its ops off and blocks its data
  • Launcher: the accessibility HOME takeover works as on Fire OS 7.7; HOME from inside Netflix lands on dumbtv home

Build PS7697.4800N · Original report

Partly testedFire OS 7.7

Fire TV Stick 4K Max, 1st gen (AFTKA), Fire OS 7.7.1.3

@harupong@harupong

Fire OS 7 build PS7713.5443N: debloat, lockdown and the dumbtv home takeover work, verify.sh exits 0. DNS filter not installed (DNSFILTER=0 by choice), so partial. Alexa and Silk kept via KEEP_APPS.

Developer mode

not recorded: ADB was already enabled before this session

IP address

not recorded this session

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV
Notes from the owner 6
  • com.android.nfc reports SUSPECT (Shell cannot change component state): it ships disabled (enabled=2), so nothing changes and it is harmless
  • Keeping Alexa takes more than KEEP_APPS: debloat.sh still writes secure voice_disabled=1 and alexa_wake_word_disabled=1, which had to be set back to 0 by hand
  • KEEP_APPS only accepts packages that are in the removal lists; listing every installed app to be safe stops debloat.sh with 'matches nothing in the removal lists'
  • No package in packages.txt was refused (protected 0). Absent on this model: media.recommendations, neo.minerva.logcat, device_remote_config_sync_service, tv.democontent.provider, tv.localgallery
  • This build has no 'cmd package install-existing', so system apps are only disabled, never uninstalled
  • lockdown.sh turns Data Saver on for the whole TV, which can also restrict background data for apps the user keeps

Build PS7713.5443N · Original report

Partly testedFire OS 8.1

Fire TV Stick 4K Max, 2nd gen (AFTKRT)

@gerardo-galvez-hl@gerardo-galvez-hl

Fire OS 8.1.8.2 (Android 11): debloat.sh and lockdown.sh ran clean and verify.sh passed with the DNS and home checks skipped. dnsfilter.sh and launcher.sh were not run by choice (DNS filtering is done network-wide by Pi-hole), so status is partial

Developer mode

ADB debugging was already enabled from an earlier session (Settings > My Fire TV > Developer Options > ADB debugging: ON); the click count to unlock Developer Options was not recorded

IP address

not recorded this session: the address was read from the router's DHCP leases

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV on the first adb connect from a new machine; tick Always allow
Notes from the owner 7
  • Different model from catalog/devices/fireos-amazon-aftkm.yaml (issue #8) but the same codename (karat) and build (RS8182.3811N, Fire OS 8.1.8.2), so the Fire OS 8 findings there (Android/data unreachable from adb) most likely apply here too. dnsfilter.sh and launcher.sh were not run on this unit. The Fire OS 8 HOME fix in launcher 1.2 was confirmed on an AFTKRT by its author (PR #49)
  • debloat.sh printed 'no cmd package install-existing' although the command exists (line 120 of cmd package help): need_device runs adb shell 'cmd package help' | grep -q install-existing under set -o pipefail; grep -q exits on the first match, adb gets a broken pipe and returns 255, so REINSTALL=0. Reproduced 5/5 with pipefail, 3/3 succeed without it. Timing-dependent: the issue #8 run on the same build detected it (10 removed). Harmless here, every package was disabled instead of uninstalled
  • debloat.sh: 0 removed, 58 disabled, 0 protected, 0 suspect, 9 absent (none of the regional user apps are installed). com.amazon.ceviche and com.amazon.neo.minerva.logcat kept running after disable-user and were starved; after a reboot ceviche stays stopped but minerva.logcat is running again while still disabled
  • Unlike issue #8, com.amazon.dummy.settings and com.android.traceur were still disabled after a reboot here (both were disabled, not uninstalled)
  • lockdown.sh: device.metrics, crashmanager, ftvads.deeplinking, tv.csapp, software.ota and ota.override all accepted RUN_ANY_IN_BACKGROUND ignore and the background-data blacklist; device.rdmapplication is absent
  • com.amazon.vizzini had been disabled weeks earlier with pm disable-user by another debloat tool and was found enabled again, consistent with keeping it in never-disable.txt
  • Not caused by dumbtv, but easy to blame on it: Plex for Fire TV 2026.20.0 (targetSdk 36) is denied the sticky HDMI_AUDIO_PLUG broadcast (Permission Denial ... DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION), cannot detect passthrough, bans the audio codec ('Audio codec banned on device') and transcodes TrueHD to EAC3. Fix in the app: Settings > Audio > Passthrough: HDMI with TrueHD and EAC3 enabled

Build RS8182.3811N · Original report

Partly testedFire OS 8.1

Fire TV Stick 4K Plus (AFTMA08C15)

@edrmundy@edrmundy

Fire OS 8 (Android 11), build RS8185.3891N: debloat (58 disabled, 0 protected, 0 suspect), lockdown and the DNS filter (415 entries) all work and verify.sh exits 0. HOME stayed on Amazon's home with launcher 1.1; 1.2 carries the fix

Developer mode
  1. Settings
  2. My Fire TV
  3. About
  4. click the device name 7 times, then My Fire TV
  5. Developer Options
  6. ADB debugging: ON
IP address

Settings > About > Network

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV; tick Always allow
Notes from the owner 10
  • DNS filter on Fire OS 8 (Android 11): the app folder is not writable over adb, so dnsfilter.sh pushes the blocklist to /sdcard/Android/media/dnsfilter.android/ and the app has to be pointed at it by hand. Advanced settings > Configure filter update > the row labelled <new> > edit it: category custom, name dumbtv, URL file:///storage/emulated/0/Android/media/dnsfilter.android/dumbtv-blocklist.txt (three slashes - the app strips file:// and needs the leading slash), untick every built-in entry, set the update interval to 3650 days, then RELOAD FILTER. The log then reads Building index for 415 entries
  • personalDNSfilter writes a default config on first start with 1Hosts-light, StevenBlack and HageziPro active (381269 entries) and refreshes on its own, so the built-in entries must be unticked by hand and the update interval raised to 3650 days, otherwise the pushed list is overwritten
  • The Fire TV on-screen keyboard (com.amazon.tv.ime) swallows key events while a text field is focused: KEYCODE_DEL lands only every few tries unless the deletes are batched into one adb shell input keyevent 67 67 67 call, KEYCODE_MOVE_HOME and the D-pad never arrive, and taps on other fields land one field behind. To clear a field: tap its left edge so the cursor sits at position 0, then a batched KEYCODE_DEL, then adb shell input text
  • Launcher 1.1: the Guard was bound and its alarm fired, but Android 11 never started dumbtv home and HOME stayed on Amazon's. Launcher 1.2 fixes this (the launch waits for the Guard's cover window to draw); not yet re-tested on this stick. Every HOME press also logs an SELinux denial for see_home_task from com.amazon.tv.devicecontrol, which is Amazon's own and harmless. fosservices.jar contains CustomHomeButtonHandler, which reads the manifest metadata com.amazon.metadata.CUSTOM_HOME: a possible second route
  • com.amazon.firebat is Prime Video on this model too (versionName PVFTV-324.0104-L, real app in /data, stub in /system/system_ext/priv-app). It is on never-disable.txt
  • The filter VPN is revoked when personalDNSfilter is killed. The RESTART button in the app brings it back; always_on_vpn_app plus the Autostart checkbox bring it back after a reboot. Do not am force-stop the filter app
  • No package in packages.txt was refused (protected 0). Absent on this model: tv.fw.metrics, katoch, vizzini.ftvcds, tv.democontent.provider, tv.localgallery, wha.mediabrowserservice, printspooler, bips, nfc; device.rdmapplication from protected.txt; whisperjoin.middleware.np from never-disable.txt
  • com.amazon.device.software.ota and .ota.override share one UID (10087)
  • cmd package help exits 255 on this build, so the scripts cannot tell whether install-existing exists. It no longer matters for a new run: debloat.sh only disables Amazon packages
  • A third-party VPN client is installed on this TV and competes for the single VPN slot with the DNS filter: connecting it takes the filter offline

Build RS8185.3891N · Original report

Partly testedFire OS 8.1

Fire TV Stick 4K, 2nd gen (AFTKM)

@gleesonb@humblemuzzu@gleesonb, @humblemuzzu

Fire OS 8.1.8.2 (Android 11): debloat, lockdown and the DNS filter work, the filter through one manual step in the app. The HOME takeover did not work with launcher 1.1; launcher 1.2 carries the fix.

Developer mode

not recorded: ADB was already enabled before this session

IP address

not recorded this session

Needed a person
  • USB debugging authorizationhuman presses Allow on the TV; tick Always allow
  • Fire TV full-screen keyboardopens over any text field and swallows input tap and D-pad; type into the focused field with adb shell input text, then KEYCODE_BACK to close it; taps on other fields land one step behind
Notes from the owner 10
  • shell gets Permission denied on /sdcard/Android/data/<pkg> (list, read and push, SELinux enforcing), so the DNS filter config and list cannot be pushed; dnsfilter.sh now pushes the list to /sdcard/Android/media/dnsfilter.android/ and prints the one manual step
  • Working DNS filter route: in personalDNSfilter Advanced settings > Configure filter update, point one entry at file:///storage/emulated/0/Android/media/dnsfilter.android/dumbtv-blocklist.txt, untick the rest, reboot. The TV then blocks as on Fire OS 7
  • personalDNSfilter's legacy migration from /sdcard/PersonalDNSFilter runs but sees nothing (scoped storage hides shell-pushed non-media files), so it writes a default config with 1Hosts-light, StevenBlack and HaGeZi Pro active; its first download can hang ('Cannot stop - pending operation') until a reboot
  • adb backup is off (BackupManager is not available for user 0; bmgr activate needs a system permission) and there is no DocumentsUI, so neither adb restore nor the app's own Backup and restore can deliver a config
  • Launcher: Guard's alarm-fired launch is blocked by Android 11 background-activity-start rules (logcat: 'Background activity start ... callingUidHasAnyVisibleWindow: false'), so HOME stays on Amazon's home. verify.sh still reports the hook as bound, because it is; press HOME to check. Fixed in launcher 1.2: the Guard launches only after its cover window has drawn (PR 31), confirmed on an AFTKRT and an AFTOLCBC82, not yet re-tested on this stick
  • No package in packages.txt was refused (protected 0). Absent on this model: tv.fw.metrics, katoch, vizzini.ftvcds, tv.democontent.provider, tv.localgallery, wha.mediabrowserservice, printspooler, bips, nfc; device.rdmapplication from protected.txt; whisperjoin.middleware.np from never-disable.txt
  • Many Amazon apps ship as -stub APKs in /system/system_ext/priv-app with the real app in /data; pm uninstall -k --user 0 drops the /data copy and the stub stays, so restore.sh can still bring them back
  • com.amazon.dummy.settings and com.android.traceur come back enabled after a reboot
  • com.amazon.device.software.ota and .ota.override share one UID
  • EU-region device: avs-alexa-18-eu.amazon.com resolved before it was added to extra-hosts.txt; ktpx-eu-south-2.amazon.com (launcher content) and session-manager-euf.amazonfiretvapp.com (unclassified) are deliberately not blocked

Build RS8182.3811N · Original report

Partly testedFire OS 7.7

Fire TV Stick, 3rd gen (AFTSSS)

@B3NR1S@B3NR1S

Debloat and the DNS filter work; verify.sh confirmed every blocking rule after the VPN prompt was accepted by hand. Keep battery optimisation off for personalDNSfilter so Fire OS does not stop it.

Developer mode
  1. Settings
  2. My Fire TV
  3. About
  4. click the device name 7 times, then My Fire TV
  5. Developer Options
  6. ADB debugging: ON
IP address

Settings > My Fire TV > About > Network

Needed a person
  • Allow VPN connectionVPN permissions weren't granted automatically. Launching personalDNSfilter via ADB (adb shell monkey -p dnsfilter.android 1) brought up the permission dialog, which I accepted using the Fire TV remote. Running the verification script afterwards confirmed that all blocking rules are active
Partly testedFire OS 7.7

Hisense 58U6HF Fire TV (AFTHA001)

@murilaiooo@murilaiooo

Partial hardware report for Hisense 58U6HF (AFTHA001). Physical HOME and HDMI checks passed using a private build based on upstream 1.1; package removal and DNS behavior were deliberately not tested. No device IDs, network details or logs are attached.

Developer mode

ADB debugging was already enabled before this session. Its exact activation path was not independently verified on this TV.

IP address

Not independently verified: the owner supplied the TV's network address.

Needed a person
  • ADB authorization on first connectionaccept the debugging authorization on the physical TV; confirm adb devices shows device, not unauthorized
  • PC cannot reach TV over LAN while the TV is on a separate Wi-Fi band/SSIDOn this setup, the TV became reachable after client isolation was disabled and access from the wireless network to wired ports was allowed. Both endpoints were on the same IPv4 subnet; the bands alone were not proven to be the cause. Check isolation and routing before changing ADB.
Notes from the owner 7
  • Fire TV Edition television with real HDMI inputs. Passing the HDMI tile's passthrough URI to the default Amazon app did not provide the desired input switching. A local TvView-based HDMI activity using the public TV Input Framework displayed HDMI 1; video/audio, Back and physical HOME were confirmed. This independently supports the approach in PR #33.
  • Physical remote verification on the final local build: pressing HOME while Amazon Home was open returned to dumbtv; HDMI 1 -> HOME and another app -> HOME also returned to dumbtv. This is NOT a claim that unmodified upstream launcher 1.1 passes those scenarios.
  • ADB package snapshot found 273 packages, 2 already disabled. No Amazon system package was disabled, uninstalled or modified during the launcher experiment.
  • Launcher-only, locally patched APK, not an upstream release: the full debloat, lockdown, DNS filter and upstream verify.sh were not run.
  • The experimental Amazon-visit HOME workaround requires ADB-granted android.permission.READ_LOGS; do not enable that broad permission by default without a security/design review.
  • HDCP/DRM from external sources, CEC/ARC, suspend/resume, other HDMI ports and parental PIN were not fully certified.
  • ADB snapshots do not include full system firmware, private application data or DRM material; rollback is not a byte-for-byte system image.

Build Fire OS 7.7.1.7, PS7717.5741N (Android 9, SDK 28) · Original report