firebreak

firebreak unlocks an Echo Dot (2nd Generation) over USB, moves it between amonet targets, or returns it to stock. Run it again with another target to move the Dot. A stopped run picks up where it left off.

target	the Dot ends with	time
amonet-biscuit-v1.1.0-bboe (default)	rooted Fire OS 5.5.5.4 on amonet v1.1.0, TWRP 3.7.0_9-bboe2	about 9 min from stock
amonet-biscuit-v1.1.0	the same, with amonet v1.1.0's TWRP 3.2.3	about 10 s from amonet-biscuit-v1.1.0-bboe
amonet-biscuit-v2.0.0	rooted Fire OS 6 8146 on amonet v2.0.0; opens your browser to download boot-root.zip from the amonet XDA thread	about 5 min from amonet-biscuit-v1.1.0-bboe
stock [BUILD]	stock Fire OS at that build, with the Dot erased: Fire OS 6 8149 when left out, or Fire OS 5 from 5.5.0.3 to 5.5.5.4	about 3 min from amonet-biscuit-v1.1.0-bboe

Run it

It needs adb and fastboot from Android platform-tools, and uv, which runs firebreak from PyPI and fetches a Python for it when needed. Each release also has firebreak.pyz, which runs as python3 firebreak.pyz on Python 3.9 or later.

uvx firebreak@latest asks PyPI for the newest release on each run. Without a network it fails, and uvx firebreak runs the copy uv already has.

macOS

These commands use Homebrew. Without it, download Google's platform-tools.

brew install --cask android-platform-tools uv
uvx firebreak@latest              # amonet-biscuit-v1.1.0-bboe
uvx firebreak@latest stock        # 8149, or name 8146, 8142, 8138, 6302, 5041, 4405, 4315, 5.5.5.4, 5.5.5.0, 5.5.4.9, 5.5.4.6, 5.5.3.1, 5.5.0.3

Linux

These commands are for Debian and Ubuntu. Run firebreak without sudo.

sudo apt install adb fastboot curl
curl -LsSf https://astral.sh/uv/install.sh | sh
uvx firebreak@latest

Windows

Run these in PowerShell. Open a new terminal after the installs.

winget install Google.PlatformTools
winget install astral-sh.uv
uvx --managed-python firebreak@latest

--managed-python has uv use its own Python. A Python from the Microsoft Store keeps firebreak's files where adb and fastboot cannot see them, and firebreak stops on it.

The bootrom step also needs MediaTek's VCOM driver. It runs for --short, for a Dot on amonet v2.0.0 left in fastboot, and to resume a run stopped while it rewrote the bootloader; the script says when. The driver is "MediaTek USB Port" 3.0.1504.0 from the Microsoft Update Catalog. Install it from an administrator PowerShell:

cd $env:TEMP
curl.exe -o mtk.cab https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2016/07/20896845_fdc6bb5aa9a9bac99adf85d931d6c21d1130a96e.cab
mkdir mtk; expand -F:* mtk.cab mtk
pnputil /add-driver mtk\cdc-acm.inf /install

It has x86 and x64 builds only, so Windows on ARM cannot run the bootrom step.

Notes

• From stock, the script asks for the fastboot gesture.
• A ring that stays solid blue at the fastboot gesture can mean a bad USB connection. Unplug, then try again or try another port.
• Do not set up a stock Dot in the Alexa app before you unlock it. On Wi-Fi it can update to a build the script does not support.
• docs/rooting.md says why each step is there.

Bootloaders

From stock, only the LK decides whether firebreak can unlock a Dot. fastboot getvar lk_build_desc reads it.

lk_build_desc	ships in
63cb91b-20221007_072309	Fire OS 6 4405 to 8149
41fb3ce-20221007_151724	Fire OS 6 4310, 4313, 4315
beb022a-20211202_231918	Fire OS 5.5.5.4
a828f29-20210822_210511	Fire OS 5.5.4.9, 5.5.5.0
f379dba-20170906_000423	Fire OS 5.5.3.1 to 5.5.4.6
0e1d0d9-20161018_220224	Fire OS 5.5.0.3

• docs/devices.md has each build's preloader, TEE and anti-rollback versions.

--short

Use --short when the Dot shows no light and gives no fastboot. The run reaches the Dot's bootrom by shorting its eMMC bus as it powers up, writes amonet v1.1.0, and then goes on to the target. It takes any target; --short to amonet-biscuit-v2.0.0 has not been run on a Dot. On Windows it needs the VCOM driver.

1. Open the Dot with a Torx T8 screwdriver. Lift the shield's lid off the eMMC by its corners; its metal frame stays on the board.
2. Find the passive marked in this photo, in the row between R60 and C52 beside the eMMC (where that is on the board). Do not use C52, which is a capacitor.
3. With the Dot unplugged, run uvx firebreak@latest --short.
4. When the script prints "Short the Dot's test point and plug it in", hold a wire from that passive to the shield frame beside it, which is ground, and plug the Dot in. A Dot plugged in before that message can go unseen. On "Short … missed", unplug it and try again.
5. Take the wire off when the script prints "The short may come off now".

Reporting a problem

When a run fails, run firebreak again with the report command, as in uvx firebreak@latest report, then please stop by #support-device-unlocking in the EchoMuse Discord and paste what it prints. It starts the Dot's recovery, prints what the Dot, its eMMC and this computer are, and the Dot's partition table, and writes no partition. A Dot already in a recovery stays there, and the Dot is left in its recovery afterwards.

report also names the device and lists its USB devices. firebreak supports only the Echo Dot (2nd Generation), but the report is the same on other Echo devices, such as the Echo (2nd Generation), and helps add them.

write-test then tells a failing eMMC from a failing cable. It pushes a pattern into the Dot's RAM, then has the Dot write it over its own cache partition and read it back, so nothing crosses USB. It erases cache, which holds nothing the Dot needs, and leaves an empty filesystem there, or says it could not.

For a Dot that shows no light, write-test --short reaches its bootrom as --short does, writes a pattern over the end of cache from this computer, and reads it back. It says whether the eMMC refused a write or the bytes did not arrive, and puts back what was there when the Dot still answers.

Credits

firebreak automates work that other people did first.

• xyz wrote amonet, a MediaTek bootrom exploit. firebreak's bootrom and payload clients follow its protocol.
• k4y0z made the first port of amonet to the Echo Dot (2nd Generation).
• Rortiz2 continued that port, released it with TWRP, and keeps the XDA thread. The bboe TWRP is a fork of their TWRP tree.
• AntiEngineer helped find the pins and bring up UART on a Dot.
• topjohnwu wrote Magisk, which roots Fire OS 5.
• Andy Goetz described how to short the eMMC bus at the passives beside R60.
• mtkclient, by bkerler, agrees with two of firebreak's bootrom addresses.
• ftvdb keeps the Fire OS builds that the tables link to.

Licence

firebreak uses the BSD 2-Clause licence, in LICENSE.txt. This repository contains no Amazon code, and firebreak is not affiliated with, endorsed by, or supported by Amazon.