firebreak

firebreak unlocks an Echo Dot (2nd Generation) over USB, moves it between amonet targets, or returns it to stock. Run it again with another target to move the device. A stopped run picks up where it left off.

Unlocking a stock Dot needs amonet-biscuit-v2.0.1.zip, which amonet publishes only on its XDA thread. A run downloads it unattended. If that fails, the run says so and opens your browser for the thread instead, because the thread itself refuses an unattended download. Either way the zip is checked against a pinned hash. Moving an already-unlocked Dot between targets needs that zip too, because the run checks the bootloader against the copy in it, and so do the runs that go through the Dot's bootrom: --short, a resume after boot0 was erased, and stock 5.5.0.3.

unlock takes the newest amonet that firebreak supports for that Fire OS, so a target no longer names an amonet version. unlock with no target takes fireos6. The older names that carry an amonet version still work and say what to use instead; those names go away in firebreak 1.0. Running firebreak with no target at all warns which command replaced the old default, and that warning goes away then too.

Run it

It needs adb and fastboot from Android platform-tools, and uv, which runs firebreak from PyPI and fetches a Python for it when needed. Each release also has firebreak.pyz, which runs as python3 firebreak.pyz on Python 3.9 or later.

uvx firebreak@latest asks PyPI for the newest release on each run. Without a network it fails, and uvx firebreak runs the copy uv already has.

macOS

These commands use Homebrew. Without it, download Google's platform-tools.

brew install --cask android-platform-tools uv
uvx firebreak@latest unlock       # fireos6
uvx firebreak@latest stock        # 8149, or name 8344, 8338, 8146, 8142, 8138, 6302, 5041, 4405, 4315, 5.5.5.4, 5.5.5.0, 5.5.4.9, 5.5.4.6, 5.5.3.1, 5.5.0.3

Linux

These commands are for Debian and Ubuntu. Run firebreak without sudo.

sudo apt install adb fastboot curl
curl -LsSf https://astral.sh/uv/install.sh | sh
uvx firebreak@latest

Windows

Install the drivers from an administrator PowerShell:

cd $env:TEMP
curl.exe -fo fastboot.cab https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2016/10/20940218_0ae8695c01fb84d1fdea5c9a04baf336ec5b1ba7.cab
curl.exe -fo mtk.cab https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2016/07/20896845_fdc6bb5aa9a9bac99adf85d931d6c21d1130a96e.cab
mkdir -Force fastboot, mtk
expand -F:* fastboot.cab fastboot
expand -F:* mtk.cab mtk
pnputil /add-driver fastboot\tplink_winusb.inf /install
pnputil /add-driver mtk\cdc-acm.inf /install
Remove-Item -Recurse fastboot.cab, mtk.cab, fastboot, mtk

The drivers have x86 and x64 builds only, so on Windows on ARM the steps that use fastboot or the bootrom cannot run.

Then open a new PowerShell, not as administrator, and run these:

winget install Google.PlatformTools
winget install astral-sh.uv
uvx --managed-python firebreak@latest

--managed-python has uv use its own Python. A Python from the Microsoft Store keeps firebreak's files where adb and fastboot cannot see them, and firebreak stops on it.

Notes

• From stock, firebreak asks for the fastboot gesture.
• A ring that stays solid blue at the fastboot gesture can mean a cable that carries power but no data, or a bad USB connection. Try another cable, then another port. On Windows it can also mean the drivers are missing.
• A ring that restarts instead of reaching TWRP, blue with about a second of turning cyan and little or no white, has been a USB port that cannot power it. To tell, hold the + button with the device on a USB wall charger: a ring that reaches white there means TWRP runs. Then use a port on the computer itself, with nothing else on it.
• A /system write that keeps failing with failed to read copy response: EOF can mean a poor USB connection. Unplug both ends of the cable, plug them back in firmly, and try another cable if it fails again.
• Do not connect a stock device to Wi-Fi before you unlock it. Amazon can update it to a build firebreak does not support.
• docs/rooting.md says why each step is there.

Bootloaders

From stock, only the LK decides whether firebreak can unlock a device. fastboot getvar lk_build_desc reads it.

• docs/devices.md has each build's preloader, TEE and anti-rollback versions.
• An LK older than 5.5.0.3 reports none of these, and so no lk_build_desc and no pl_build_desc. firebreak unlocks such a Dot with the default fastbrick image, which amonet v2.0.1's own map gives an LK it does not know.

--fastboot

stock [BUILD] --fastboot leaves the device in fastboot at the end instead of letting it start the Fire OS it now holds. The next run then needs no button held, because a device already in fastboot is one firebreak can find by itself. Only the stock target takes it, and not with 5.5.0.3, which ends in the Dot's bootrom over a serial port.

--no-wait

stock [BUILD] --no-wait starts the writes at once. Without it the run counts down 10 seconds first, which is the last point Ctrl-C leaves the device as it is. Only the stock target takes it.

--short

Use --short when the Dot shows no light and gives no fastboot. The run reaches the Dot's bootrom by shorting its eMMC bus as it powers up, writes amonet v1.1.0, and then goes on to the target. It takes any target; --short to unlock fireos6 has not been run on a Dot.

1. Open the Dot with a Torx T8 screwdriver. Lift the shield's lid off the eMMC by its corners; its metal frame stays on the board.
2. Find the passive marked in this photo, in the row between R60 and C52 beside the eMMC (where that is on the board). Do not use C52, which is a capacitor.
3. With the Dot unplugged, run uvx firebreak@latest unlock fireos5 --short.
4. When firebreak prints "Short … test point and plug it in", hold a wire from that passive to the shield frame beside it, which is ground, and plug the Dot in. A Dot plugged in before that message can go unseen. On "Short … missed", unplug it and try again.
5. Take the wire off when firebreak prints "The short may come off now".

Reporting a problem

When a run fails, run firebreak again with the report command, as in uvx firebreak@latest report, then please stop by #support-device-unlocking in the EchoMuse Discord and paste what it prints. It starts the device's recovery, prints what the device, its eMMC and this computer are, and the device's partition table, and writes no partition. A device already in a recovery stays there, and it is left in its recovery afterwards.

report also names the device and lists its USB devices. An Echo (2nd Generation) takes unlock fireos6, which roots Fire OS 6 6436 with amonet-radar v1.0.0, and stock, which returns one on amonet to that build. Both have run on an Echo, and neither is proven: the first boot after the root needed the Echo power-cycled by hand, which firebreak does not ask for. Both are refused unless the run passes --run-on-unproven-path. Every other target is for the Echo Dot (2nd Generation). The report is the same on other Echo devices and helps add them.

write-test then tells a failing eMMC from a failing cable. It pushes a pattern into the Dot's RAM, then has the Dot write it over its own cache partition and read it back, so nothing crosses USB. It erases cache, which holds nothing the Dot needs, and leaves an empty filesystem there, or says it could not.

For a Dot that shows no light, write-test --short reaches its bootrom as --short does, writes a pattern over the end of cache from this computer, and reads it back. It says whether the eMMC refused a write or the bytes did not arrive, and puts back what was there when the Dot still answers.

Credits

firebreak automates work that other people did first.

• xyz wrote amonet, a MediaTek bootrom exploit. firebreak's bootrom and payload clients follow its protocol.
• k4y0z made the first port of amonet to the Echo Dot (2nd Generation).
• Rortiz2 continued that port, released it with TWRP, and keeps the XDA thread. The bboe TWRP is a fork of their TWRP tree.
• AntiEngineer helped find the pins and bring up UART on a Dot.
• topjohnwu wrote Magisk, which roots Fire OS 5.
• Andy Goetz described how to short the eMMC bus at the passives beside R60.
• mtkclient, by bkerler, agrees with two of firebreak's bootrom addresses.
• ftvdb keeps the Fire OS builds that the tables link to.

Licence

firebreak uses the BSD 2-Clause licence, in LICENSE.txt. This repository contains no Amazon code, and firebreak is not affiliated with, endorsed by, or supported by Amazon.