Amazon Echo Dot 2nd gen (amazon-biscuit)

From postmarketOS
Amazon Echo Dot (2nd gen)
Second generation Echo Dot
Second generation Echo Dot
Manufacturer Amazon
Name Echo Dot (2nd gen)
Codename amazon-biscuit
Model RS03QR
Released 2016
Category testing
Pre-built images no
Original software Android
Original version 5.1 (FireOS 5.5)
postmarketOS kernel 3.18.19
Chipset MediaTek MT8163
CPU Quad-core 1.3 GHz Cortex-A53
Storage 4 GB
Memory 512 MB
Architecture ARMv7
Type embedded
USB Networking
Internal storage
Ambient Light
FOSS bootloader


  • BenTheTechGuy

Users owning this device

  • BenTheTechGuy (Notes: Improving port)
  • Dragon863 (Notes: creator of EchoCLI, investigating untethered)
  • Neko (Notes: Stock, for now)

How to unlock the bootloader

  • Install mtkclient and ensure adb and fastboot are installed.
  • Install Python modules flask, requests, and pyserial.
  • Disable ModemManager if it is installed.
  • Clone the EchoCLI repo.
  • Take apart the Echo Dot following this iFixIt guide.
  • Remove the IO shield to expose the components in this image. Get ready to short the components outlined in the rectangle to ground.
  • Run python and follow the instructions to root the device, shorting the outlined components when instructed.
  • Verify that the root succeeded by running adb shell to get a root shell.
  • If successful, put the Echo Dot back together. The device will now automatically boot to the required BootROM mode as its Preloader is purposefully broken.
  • There will be a new file preloader_no_hdr.bin. Put it somewhere safe, because it is now required to boot the device.
  • The device can be booted from BootROM by running mtk plstage --preloader=preloader_no_hdr.bin.

How to enter flash mode

Plug the device in and run mtk plstage --preloader=preloader_no_hdr.bin while holding the Uber (circle) button. Release it when the LED ring turns green.


  • pmbootstrap init
  • pmbootstrap install
  • Select 'console' as UI since the device has no screen
  • Follow #How to enter flash mode to enter fastboot
  • pmbootstrap flasher flash_kernel
  • pmbootstrap flasher flash_rootfs
  • The largest partition on the device is only 1.8 GB. If more space is needed, use netboot instead of flashing rootfs.

Port status

What works:

  • USB Networking
  • Control of the LED ring
  • Button press detection

What doesn't work:

  • WiFi
  • Bluetooth
  • Speakers
  • Microphone
  • Ambient Light Sensor


The current state of the LED ring is described in the file /sys/bus/i2c/devices/0-003f/frame as a series of 12 hex color codes. It can be written to in the same format to change the color. For example, to make the whole ring red (#FF0000), the command echo "ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000" > /sys/bus/i2c/devices/0-003f/frame could be run.

This script is an example of running a basic animation. It spins a green (#00FF00) segment around the LED ring.


echo "$frame" > /sys/bus/i2c/devices/0-003f/frame
sleep 0.1

for ((i=1; ;++i)); do
	# Shift green LED over one space by adding a black "pixel"; since there
	# are 12 LEDs, add a green pixel instead on every 12th run of the loop.
	if [ $(( i % 12 )) -eq 0 ]; then

	# Truncate string to only include 12 color codes
	frame=$(echo "${shift}${frame}" | cut -c -72)
	echo "$frame" > /sys/bus/i2c/devices/0-003f/frame
	sleep 0.1

The file /sys/bus/i2c/devices/0-003f/boot_animation is used to enable or disable the Echo Dot's built-in boot animation. By default, it stays on after boot, but this port includes init scripts to replace it with a rainbow ring when boot is finished, and put it back during shutdown.


The kernel provides evdevs for all of the buttons on the Echo Dot. /dev/input/event1 handles the Uber button as well as the mute button, and /dev/input/event2 handles the volume buttons. In addition to event code 1 for pressing a button and 0 for releasing it, the volume buttons also have a code 2 for when they're being held down.

The LED on the mute button can be enabled with the files /sys/devices/soc/10010000.keypad/amz_privacy/enable or /sys/devices/soc/10010000.keypad/amz_privacy/privacy_trigger. This also mutes the microphone, as if the button was physically pressed. The mute cannot be undone in software; the button must be manually pressed. The mute status is available in /sys/devices/soc/10010000.keypad/amz_privacy/privacy_state.

See also