Amazon Echo Dot 2nd gen (amazon-biscuit)
![]() Second generation Echo Dot | |
Manufacturer | Amazon |
---|---|
Name | Echo Dot (2nd gen) |
Codename | amazon-biscuit |
Model | RS03QR |
Released | 2016 |
Category | testing |
Original software | Android |
Original version | 5.1 (FireOS 5.5) |
postmarketOS kernel | 3.18.19 |
Hardware | |
Chipset | MediaTek MT8163 |
CPU | Quad-core 1.3 GHz Cortex-A53 |
Storage | 4 GB |
Memory | 512 MB |
Architecture | armv7 |
Type | embedded |
USB Networking |
Works |
---|---|
Flashing |
Works |
WiFi | |
FDE |
Broken |
Mainline | |
Audio | |
Bluetooth | |
Internal storage |
Works |
USB OTG | |
Ambient Light | |
---|---|
FOSS bootloader |
Broken |
---|---|
Contributors
- BenTheTechGuy
Users owning this device
- BenTheTechGuy (Notes: Improving port)
- Susurrus
How to unlock the bootloader
- Install mtkclient and ensure adb and fastboot are installed.
- Install Python modules flask, requests, and pyserial.
- Disable ModemManager if it is installed.
- Clone the EchoCLI repo.
- Take apart the Echo Dot following this iFixIt guide.
- Remove the IO shield to expose the components in this image. Get ready to short the components outlined in the rectangle to ground.
- Run
python main.py
and follow the instructions to root the device, shorting the outlined components when instructed. - Verify that the root succeeded by running
adb shell
to get a root shell. - If successful, put the Echo Dot back together. The device will now automatically boot to the required BootROM mode as its Preloader is purposefully broken.
- There will be a new file
preloader_no_hdr.bin
. Put it somewhere safe, because it is now required to boot the device. - The device can be booted from BootROM by running
mtk plstage --preloader=preloader_no_hdr.bin
.
How to enter flash mode
Plug the device in and run mtk plstage --preloader=preloader_no_hdr.bin
while holding the Uber (circle) button. Release it when the LED ring turns green.
Installation
pmbootstrap init
pmbootstrap install
- Select 'console' as UI since the device has no screen
- Follow #How to enter flash mode to enter fastboot
pmbootstrap flasher flash_kernel
pmbootstrap flasher flash_rootfs
- The largest partition on the device is only 1.8 GB. If more space is needed, use netboot instead of flashing rootfs.
Port status
What works:
- USB Networking
- Control of the LED ring
- Button press detection
What doesn't work:
- WiFi
- Bluetooth
- Speakers
- Microphone
- Ambient Light Sensor
LEDs
The current state of the LED ring is described in the file /sys/bus/i2c/devices/0-003f/frame
as a series of 12 hex color codes.
It can be written to in the same format to change the color. For example, to make the whole ring red (#FF0000), the command
echo "ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000" > /sys/bus/i2c/devices/0-003f/frame
could be run.
This script is an example of running a basic animation. It spins a green (#00FF00) segment around the LED ring.
#!/bin/ash frame="00ff00000000000000000000000000000000000000000000000000000000000000000000" echo "$frame" > /sys/bus/i2c/devices/0-003f/frame sleep 0.1 for ((i=1; ;++i)); do # Shift green LED over one space by adding a black "pixel"; since there # are 12 LEDs, add a green pixel instead on every 12th run of the loop. if [ $(( i % 12 )) -eq 0 ]; then shift="00ff00" else shift="000000" fi # Truncate string to only include 12 color codes frame=$(echo "${shift}${frame}" | cut -c -72) echo "$frame" > /sys/bus/i2c/devices/0-003f/frame sleep 0.1 done
The file /sys/bus/i2c/devices/0-003f/boot_animation
is used to enable or disable the Echo Dot's built-in boot animation.
By default, it stays on after boot, but this port includes init scripts to replace it with a rainbow ring when boot is finished, and put it back during shutdown.
Buttons
The kernel provides evdevs for all of the buttons on the Echo Dot. /dev/input/event1
handles the Uber button as well as the mute button, and /dev/input/event2
handles the volume buttons. In addition to event code 1 for pressing a button and 0 for releasing it, the volume buttons also have a code 2 for when they're being held down.
The LED on the mute button can be enabled with the files /sys/devices/soc/1001000.keypad/amz_privacy/enable
or /sys/devices/soc/1001000.keypad/amz_privacy/privacy_trigger
. This also mutes the microphone, as if the button was physically pressed.
The mute cannot be undone in software; the button must be manually pressed. The mute status is available in /sys/devices/soc/1001000.keypad/amz_privacy/privacy_state
.