Amazon Echo Spot 2017 (amazon-rook)
This device has been tested with postmarketOS, but its device package has not yet been added to the postmarketOS repositories. This means that it cannot be selected in pmbootstrap. Status: Mainlining in progress. Boots to initramfs with mainline kernel. Working on getting graphics up. |
![]() Amazon Echo Spot (2017 release) | |
Manufacturer | Amazon |
---|---|
Name | Echo Spot (2017) |
Codename | amazon-rook |
Model | VN94DQ |
Released | 2017 |
Type | embedded |
Hardware | |
Chipset | MediaTek MT8163 |
CPU | Quad-core 1.3 GHz Cortex-A53 |
GPU | Mali-T720 |
Display | 480x480 IPS LCD |
Storage | 8 GB |
Memory | 2 GB |
Architecture | aarch64 |
Software | |
Original software The software and version the device was shipped with. |
FireOS 5 |
Extended version The most recent supported version from the manufacturer. |
FireOS 5 |
FOSS bootloader | no |
postmarketOS | |
Category | testing |
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline. |
yes |
Unixbench score Unixbench Whetstone/Dhrystone score. See Unixbench. |
1266.1 |
Flashing It is possible to flash the device with pmbootstrap flasher . |
Works
|
---|---|
USB Networking After connecting the device with USB to your PC, you can connect to it via telnet (initramfs) or SSH (booted system). |
Works
|
Internal storage eMMC, SD cards, UFS, ... |
Works
|
Screen Display works. Ideally with sleep mode and brightness control. |
Partial
|
Touchscreen |
Works
|
Multimedia | |
3D Acceleration |
Works
|
Audio Audio playback, microphone, headset and buttons. |
Broken
|
Camera |
Broken
|
Connectivity | |
WiFi |
Works
|
Bluetooth |
Broken
|
GPS |
Broken
|
Miscellaneous | |
FDE Full disk encryption and unlocking with unl0kr. |
Broken
|
Users owning this device
Contributors
- R0rt1z2
- bengris32
- itsVixano
How to enter flash mode
You need to unlock the bootloader using amonet: https://xdaforums.com/t/unlock-root-twrp-unbrick-amazon-echo-spot-2017-rook.4754878/
The unlock provides a hacked fastboot mode, which is the one you must use for flashing. Stock fastboot will remain locked because of how the exploit works.
To access hacked fastboot mode, you have two options:
- Run the
boot-fastboot.sh
script from the amonet package.
- Hold all three buttons at the same time while booting, but ONLY AFTER the Amazon logo appears (not before).
To access TWRP / recovery mode, you can either:
- Run the
boot-recovery.sh
script from the amonet package. - Press and hold Volume - and Mute while turning on the device.
As long as STOCK (NOT HACKED) fastboot mode is accessible (by holding all three buttons while booting), you can enter bootrom by running the brick.sh
script again, then re-run bootrom-step.sh
to unbrick the device.
If fastboot mode isn't accessible and the device is bricked, YOU'LL NEED TO OPEN IT UP and short CLK to unbrick the device.
NOTE: The general rule is to flash boot and recovery images to the boot_x and recovery_x partitions, since the original partitions contain the exploit.
However, hacked fastboot mode and TWRP handle the remapping automatically, so you can safely flash to boot or recovery instead in these two modes. |
Status
Feature | Components | Status | Notes |
---|---|---|---|
USB | MediaTek USB Controller1 | Y | Working in mainline |
eMMC | MediaTek MSDC1 | Y | Working in mainline |
Display | MediaTek DRM1
MediaTek DSI1 |
N | Any writes to DSI registers causes the system to hang. Using simpledrm for now. |
GPU | ARM Mali-T7201 | Y | Working with Panfrost |
UART | MediaTek UART1
APDMA1 |
Y | Working with APDMA support |
I2C | MediaTek I2C1 | Y | Working in mainline |
SPI | MediaTek SPI1 | P | Untested in mainline |
Power | MediaTek SCPSYS1
MediaTek PWRAP1 MediaTek MT6323 |
Y | SCPSYS and PWRAP with MT6323 PMIC working |
Clocks | MediaTek Clock Controller1
MediaTek FHCTL1 |
P | Missing details of a few clocks
Frequency Hopping (FHCTL) requires work |
Pin Control / EINT | MediaTek Pinctrl1 | Y | Working in mainline |
SMP | ARM Cortex CPU cores1 | P | Requires downstream hacks on old ATF. High chance of random kernel panics and hangs when it's enabled, but it seems to work fine on the rare few boots that it decides to. |
Watchdog | MediaTek WDT1 | Y | Working in mainline |
IOMMU | MediaTek IOMMU1 | N | Possibly broken |
USB Wi-Fi | BCM43566 | Y | Working with brcmfmac driver. Though, trying to use it with onboard_usb_dev causes a kernel panic.
|
Front Camera |
MediaTek IMGSYS1 |
N |
1: Part of SoC
UART
UART access is available through the TM3 pad (RX). By default, kernel logs are not displayed to UART since this is disabled by LK. The baud rate is 921600
.

However, with the exploit installed, you can forcefully enable them by flashing a custom MISC image. You can generate (and flash) this image using the following command(s):
dd if=/dev/zero of=misc-uart.bin bs=1 count=32 echo -ne "UART_PLEASE" | dd of=misc-uart.bin bs=1 seek=16 conv=notrunc fastboot flash MISC misc-uart.bin