Amazon Echo Show 5 (amazon-cronos)
| This device is marked as not booting. |
 Second gen Echo Show 5 | |
| Manufacturer | Amazon |
|---|---|
| Name | Echo Show 5 (2nd Gen, 2021 Release) |
| Codename | amazon-cronos |
| Model | C76N8S |
| Released | 2021 |
| Type | tablet |
| Hardware | |
| Chipset | MediaTek MT8163 |
| CPU | Quad-core 1.3 GHz Cortex-A53 |
| GPU | Mali-T720 |
| Display | 960x480 |
| Storage | 8 GB |
| Memory | 1 GB |
| Architecture | aarch64 |
| Software | |
Original software  The software and version the device was shipped with. |
Android (Fire OS) 7.1.2 (FireOS 6.5.3.1) |
Extended version The most recent supported version from the manufacturer. |
Android (Fire OS) |
| postmarketOS | |
| Category | downstream |
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline. |
no |
pmOS kernel The kernel version that runs on the device's port. |
4.9.77 |
Flashing Whether it is possible to flash the device with pmbootstrap flasher. |
Untested
|
|---|---|
USB Networking After connecting the device with USB to your PC, you can connect to it via telnet (initramfs) or SSH (booted system). |
Untested
|
Battery Whether charging and battery level reporting work. |
Untested
|
Screen Whether the display works; ideally with sleep mode and brightness control. |
Untested
|
Touchscreen |
Untested
|
Keyboard Whether the built-in physical keyboard works. |
Untested
|
Touchpad Whether the built-in touchpad works. |
Untested
|
Stylus |
Untested
|
| Multimedia | |
3D Acceleration |
Untested
|
Built-in DVB TV tuner/DVB device |
Untested
|
Audio Audio playback, microphone, headset and buttons. |
Untested
|
Camera |
Untested
|
Camera Flash |
Untested
|
IR TX |
Untested
|
IR RX |
Untested
|
| Connectivity | |
WiFi |
Untested
|
Bluetooth |
Untested
|
Ethernet |
Untested
|
GPS |
Untested
|
NFC Near Field Communication |
Untested
|
| Modem | |
Calls |
Untested
|
SMS |
Untested
|
Mobile data |
Untested
|
| Miscellaneous | |
FDE Full disk encryption and unlocking with unl0kr. |
Untested
|
USB-A Whether the full-sized USB-A port works. |
Untested
|
USB OTG USB On-The-Go or USB-C Role switching. |
Untested
|
HDMI/DP Video and audio output with HDMI or DisplayPort. |
Untested
|
| Sensors | |
Accelerometer Handles automatic screen rotation in many interfaces. |
Untested
|
Magnetometer Sensor to measure the Earth's magnetism |
Untested
|
Ambient Light Measures the light level; used for automatic screen dimming in many interfaces. |
Untested
|
Proximity |
Untested
|
Hall Effect Measures magnetic fields; usually used as a flip cover sensor |
Untested
|
Haptics |
Untested
|
Barometer Sensor to measure air pressure |
Untested
|
Power Sensor Sensor to monitor current, voltage and power. Not fuel gauge! |
Untested
|
Contributors
Users owning this device
How to enter flash mode
Your bootloader must be unlocked using amonet.
The exploit remaps the volume buttons to switch between boot modes, so with it installed you can use them to select different boot options:
- HACKED FASTBOOT mode: Access this mode by holding ONLY the Volume Down key after connecting the power source.
- TWRP / RECOVERY mode: Enter this mode by holding ONLY the Volume Up key and the after connecting the power source.
- PWNED USBDL mode: Enter this mode by holding ONLY the MUTE and VOLUME DOWN buttons while connecting the power source. The USB cable MUST also be connected.
You can also use the boot-recovery.sh and boot-fastboot.sh scripts to force either mode if the buttons aren't available.
In PWNED USBDL mode, you can use tools like MTKClient to flash the device. It is important that you NEVER modify LK, TEE1, or Preloader, as they are required for the exploit to function.
You can boot OSS bootloaders by flashing them to the expdb partition and OSS ATF by flashing it to the TEE2 partition.
Hardware variants
 |
WARNING: This device was manufactured during a period of resource constraints, resulting in multiple hardware variants with different display panels and components. Users may encounter slight differences between units. |
The following information was extracted from the stock device trees:
| Variant | Device Tree | Audio Codec | Touch Panel | Notes |
|---|---|---|---|---|
| Proto | cronos_proto |
Realtek RT5616e | Goodix GT9xx | Prototype version |
| EVT | cronos_evt |
Realtek RT5616e | Goodix GT9xx | Engineering validation |
| HVT | cronos_hvt |
Realtek RT5616e | Goodix GT9xx | Highly accelerated life test |
| DVT | cronos_dvt |
Realtek RT5616e | Goodix GT9xx | Design validation |
| DVT 3.1 | cronos_dvt_3_1 |
TI TAS5805M | Goodix GT9xx | Switched to TI audio codec |
| DVT 3.2 | cronos_dvt_3_2 |
Realtek RT5616 | Goodix GT9xx | RT5616 variant (non-e) |
| DVT 3.3 | cronos_dvt_3_3 |
TI TAS5805M | Goodix GT9xx | TAS5805M with AP GPIO control |
| PVT | cronos_pvt |
Realtek RT5616e | Goodix GT9xx | Production validation |
| PVT 4.1 | cronos_pvt_4_1 |
TI TAS5805M | Goodix GT9xx | TAS5805M with AP GPIO control |
| PVT 4.2 | cronos_pvt_4_2 |
Realtek RT5616 | Goodix GT9xx | RT5616 variant (non-e) |
| PVT 4.3 | cronos_pvt_4_3 |
Maxim MAX98396 | Goodix GT9xx | Maxim audio codec variant |
UART
UART access is available through the TP55 pad (RX). The baud rate is 921600.