firebreak

firebreak unlocks an Echo Dot (2nd Generation) over USB, moves it between amonet targets, or returns it to stock. Run it again with another target to move the Dot. A stopped run picks up where it left off.

Unlocking a stock Dot needs amonet-biscuit-v2.0.1.zip, which amonet publishes only on its XDA thread. A run downloads it unattended. If that fails, the run says so and opens your browser for the thread instead, because the thread itself refuses an unattended download. Either way the zip is checked against a pinned hash. Moving an already-unlocked Dot between targets needs that zip too, because the run checks the bootloader against the copy in it, and so do the runs that go through the Dot's bootrom: --short, a resume after boot0 was erased, and stock 5.5.0.3.

unlock takes the newest amonet that firebreak supports for that Fire OS, so a target no longer names an amonet version. unlock with no target takes fireos6. The older names that carry an amonet version still work and say what to use instead; those names go away in firebreak 1.0. Running firebreak with no target at all warns which command replaced the old default, and that warning goes away then too.

Run it

It needs adb and fastboot from Android platform-tools, and uv, which runs firebreak from PyPI and fetches a Python for it when needed. Each release also has firebreak.pyz, which runs as python3 firebreak.pyz on Python 3.9 or later.

uvx firebreak@latest asks PyPI for the newest release on each run. Without a network it fails, and uvx firebreak runs the copy uv already has.

macOS

These commands use Homebrew. Without it, download Google's platform-tools.

brew install --cask android-platform-tools uv
uvx firebreak@latest unlock       # fireos6
uvx firebreak@latest stock        # 8149, or name 8146, 8142, 8138, 6302, 5041, 4405, 4315, 5.5.5.4, 5.5.5.0, 5.5.4.9, 5.5.4.6, 5.5.3.1, 5.5.0.3

Linux

These commands are for Debian and Ubuntu. Run firebreak without sudo.

sudo apt install adb fastboot curl
curl -LsSf https://astral.sh/uv/install.sh | sh
uvx firebreak@latest

Windows

Install the drivers from an administrator PowerShell:

cd $env:TEMP
curl.exe -fo fastboot.cab https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2016/10/20940218_0ae8695c01fb84d1fdea5c9a04baf336ec5b1ba7.cab
curl.exe -fo mtk.cab https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2016/07/20896845_fdc6bb5aa9a9bac99adf85d931d6c21d1130a96e.cab
mkdir -Force fastboot, mtk
expand -F:* fastboot.cab fastboot
expand -F:* mtk.cab mtk
pnputil /add-driver fastboot\tplink_winusb.inf /install
pnputil /add-driver mtk\cdc-acm.inf /install
Remove-Item -Recurse fastboot.cab, mtk.cab, fastboot, mtk

The drivers have x86 and x64 builds only, so on Windows on ARM the steps that use fastboot or the bootrom cannot run.

Then open a new PowerShell, not as administrator, and run these:

winget install Google.PlatformTools
winget install astral-sh.uv
uvx --managed-python firebreak@latest

--managed-python has uv use its own Python. A Python from the Microsoft Store keeps firebreak's files where adb and fastboot cannot see them, and firebreak stops on it.

Notes

• From stock, the script asks for the fastboot gesture.
• A ring that stays solid blue at the fastboot gesture can mean a bad USB connection. Unplug, then try again or try another port. On Windows it can also mean the drivers are missing.
• A /system write that keeps failing with failed to read copy response: EOF can mean a poor USB connection. Unplug both ends of the cable, plug them back in firmly, and try another cable if it fails again.
• Do not set up a stock Dot in the Alexa app before you unlock it. On Wi-Fi it can update to a build the script does not support.
• docs/rooting.md says why each step is there.

Bootloaders

From stock, only the LK decides whether firebreak can unlock a Dot. fastboot getvar lk_build_desc reads it.

• docs/devices.md has each build's preloader, TEE and anti-rollback versions.
• An LK older than 5.5.0.3 reports none of these, and so no lk_build_desc and no pl_build_desc. firebreak unlocks such a Dot with the default fastbrick image, which amonet v2.0.1's own map gives an LK it does not know.

--fastboot

stock [BUILD] --fastboot leaves the Dot in fastboot at the end instead of letting it start the Fire OS it now holds. The next run then needs no button held, because a Dot already in fastboot is one firebreak can find by itself. Only the stock target takes it, and not with 5.5.0.3, which ends in the Dot's bootrom over a serial port.

--short

Use --short when the Dot shows no light and gives no fastboot. The run reaches the Dot's bootrom by shorting its eMMC bus as it powers up, writes amonet v1.1.0, and then goes on to the target. It takes any target; --short to unlock fireos6 has not been run on a Dot.

1. Open the Dot with a Torx T8 screwdriver. Lift the shield's lid off the eMMC by its corners; its metal frame stays on the board.
2. Find the passive marked in this photo, in the row between R60 and C52 beside the eMMC (where that is on the board). Do not use C52, which is a capacitor.
3. With the Dot unplugged, run uvx firebreak@latest --short.
4. When the script prints "Short the Dot's test point and plug it in", hold a wire from that passive to the shield frame beside it, which is ground, and plug the Dot in. A Dot plugged in before that message can go unseen. On "Short … missed", unplug it and try again.
5. Take the wire off when the script prints "The short may come off now".

Reporting a problem

When a run fails, run firebreak again with the report command, as in uvx firebreak@latest report, then please stop by #support-device-unlocking in the EchoMuse Discord and paste what it prints. It starts the Dot's recovery, prints what the Dot, its eMMC and this computer are, and the Dot's partition table, and writes no partition. A Dot already in a recovery stays there, and the Dot is left in its recovery afterwards.

report also names the device and lists its USB devices. firebreak supports only the Echo Dot (2nd Generation), but the report is the same on other Echo devices, such as the Echo (2nd Generation), and helps add them.

write-test then tells a failing eMMC from a failing cable. It pushes a pattern into the Dot's RAM, then has the Dot write it over its own cache partition and read it back, so nothing crosses USB. It erases cache, which holds nothing the Dot needs, and leaves an empty filesystem there, or says it could not.

For a Dot that shows no light, write-test --short reaches its bootrom as --short does, writes a pattern over the end of cache from this computer, and reads it back. It says whether the eMMC refused a write or the bytes did not arrive, and puts back what was there when the Dot still answers.

Credits

firebreak automates work that other people did first.

• xyz wrote amonet, a MediaTek bootrom exploit. firebreak's bootrom and payload clients follow its protocol.
• k4y0z made the first port of amonet to the Echo Dot (2nd Generation).
• Rortiz2 continued that port, released it with TWRP, and keeps the XDA thread. The bboe TWRP is a fork of their TWRP tree.
• AntiEngineer helped find the pins and bring up UART on a Dot.
• topjohnwu wrote Magisk, which roots Fire OS 5.
• Andy Goetz described how to short the eMMC bus at the passives beside R60.
• mtkclient, by bkerler, agrees with two of firebreak's bootrom addresses.
• ftvdb keeps the Fire OS builds that the tables link to.

Licence

firebreak uses the BSD 2-Clause licence, in LICENSE.txt. This repository contains no Amazon code, and firebreak is not affiliated with, endorsed by, or supported by Amazon.