firebreak unlocks and roots an Echo Dot (2nd Generation), an Echo (2nd Generation) or an Echo Dot (3rd Generation) over USB, or returns it to stock. Run it again with another target to move the device. A stopped run picks up where it left off.
Note
All of this is possible because of Rortiz2's work. firebreak runs the unlocks they publish on XDA, one thread for each Echo:
Caution
Avoid connecting a stock Echo to Wi-Fi before you unlock it. Amazon can update the device to a build firebreak does not support.
Install firebreak's prerequisites. Then plug your Echo into your computer, and run:
uvx firebreak@latest unlockOn Windows, run uvx --managed-python firebreak@latest unlock instead, as
Windows says. Follow any instructions that may appear.
firebreak needs adb and fastboot from Android platform-tools, and
uv, which runs firebreak from PyPI.
These commands use Homebrew. Without it, download Google's platform-tools.
brew install --cask android-platform-tools uv
brew install libusb # for an Echo Dot (3rd Generation)These commands are for Debian and Ubuntu. Run firebreak without sudo.
sudo apt install adb fastboot curl libusb-1.0-0
curl -LsSf https://astral.sh/uv/install.sh | shThese udev rules let your own user open the Echo in each of its USB modes, so
firebreak needs no sudo. A run that cannot open the Echo prints the same
commands.
sudo groupadd -f plugdev
sudo tee /etc/udev/rules.d/51-echo-dot.rules >/dev/null <<'EOF'
SUBSYSTEM=="usb", ATTR{idVendor}=="1949", MODE="0660", GROUP="plugdev", TAG+="uaccess"
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4ee2", MODE="0660", GROUP="plugdev", TAG+="uaccess"
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="d001", MODE="0660", GROUP="plugdev", TAG+="uaccess"
SUBSYSTEM=="usb", ATTR{idVendor}=="0bb4", ATTR{idProduct}=="0c01", MODE="0660", GROUP="plugdev", TAG+="uaccess"
SUBSYSTEM=="usb", ATTR{idVendor}=="0e8d", ATTR{idProduct}=="0003", MODE="0660", GROUP="plugdev", TAG+="uaccess"
SUBSYSTEM=="usb", ATTR{idVendor}=="0e8d", ATTR{idProduct}=="201c", MODE="0660", GROUP="plugdev", TAG+="uaccess"
SUBSYSTEM=="tty", ATTRS{idVendor}=="0e8d", ATTRS{idProduct}=="0003", MODE="0660", GROUP="plugdev", TAG+="uaccess"
SUBSYSTEM=="tty", ATTRS{idVendor}=="1949", ATTRS{idProduct}=="2007", MODE="0660", GROUP="plugdev", TAG+="uaccess"
EOF
sudo udevadm control --reload
sudo udevadm trigger
sudo usermod -aG plugdev "$USER"
adb kill-serverThen log in again, so your shell has the plugdev group.
Warning
firebreak has been tested on Windows only from an administrator PowerShell, for both the setup and the run.
winget install Google.PlatformTools
winget install astral-sh.uv
cd $env:TEMP
curl.exe -fo fastboot.cab https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2016/10/20940218_0ae8695c01fb84d1fdea5c9a04baf336ec5b1ba7.cab
curl.exe -fo mtk.cab https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2016/07/20896845_fdc6bb5aa9a9bac99adf85d931d6c21d1130a96e.cab
curl.exe -fLo UsbDk.msi https://github.com/daynix/UsbDk/releases/download/v1.00-22/UsbDk_1.0.22_x64.msi
curl.exe -fLo libusb.7z https://github.com/libusb/libusb/releases/download/v1.0.30/libusb-1.0.30.7z
mkdir -Force fastboot, mtk
expand -F:* fastboot.cab fastboot
expand -F:* mtk.cab mtk
pnputil /add-driver fastboot\tplink_winusb.inf /install
pnputil /add-driver mtk\cdc-acm.inf /install
$d = "$env:LOCALAPPDATA\Programs\libusb"
mkdir -Force $d
tar -xf libusb.7z -C $d VS2022/MS64/dll/libusb-1.0.dll
Remove-Item -Recurse fastboot.cab, mtk.cab, fastboot, mtk
[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$d\VS2022\MS64\dll", "User")
Start-Process msiexec -Wait -ArgumentList "/i $env:TEMP\UsbDk.msi /qn"
Remove-Item UsbDk.msiThen open a new administrator PowerShell, so it has the new PATH, and run firebreak:
uvx --managed-python firebreak@latest unlockTip
--managed-python makes uv use its own Python. firebreak stops on a Python
from the Microsoft Store, because adb and fastboot cannot see the files it
keeps.
Windows on ARM, Windows 11 25H2 and Windows older than 11 23H2 have limits: see Windows in the troubleshooting guide.
uvx firebreak@latest --help prints this:
usage: firebreak [-h] [--credits] [--no-update-check] [--verbose] [--version]
COMMAND ...
Change the firmware on an Echo Dot (2nd Generation), an Echo (2nd
Generation) or an Echo Dot (3rd Generation) over USB: unlock it, or return it
to stock. It discovers what state the Echo is in and moves it toward the
target.
positional arguments:
COMMAND the command to run, one of those listed below
options:
-h, --help show this help message and exit
--credits show acknowledgement of those whose work firebreak is
built upon and exit
--no-update-check do not ask PyPI whether a newer firebreak exists
--verbose print each adb and fastboot command, its exit status and
the time, and each state the Echo reaches
--version show program's version number and exit
commands for the Echo Dot (2nd Generation):
stock [BUILD]
Amazon's Fire OS BUILD, 8149 when left out, which erases the whole
Dot.
unlock [TARGET], where TARGET is one of:
fireos6, the default
boot-root.zip's root adb on the Fire OS 6 already installed, which
keeps the Dot's setup; with --factory-reset, Fire OS 6 8149 with
TWRP 3.7.0, with the Dot erased.
fireos5
rooted Fire OS 5.5.5.4 on amonet v1.1.0, with TWRP 3.7.0_9-bboe2.
commands for the Echo Dot (3rd Generation):
stock [BUILD]
Amazon's Fire OS BUILD, 8349 when left out, which erases the whole
Echo and locks it again.
unlock [TARGET], where TARGET is one of:
fireos6, the default
boot-root.zip's root adb on the Fire OS 6 already installed, which
keeps the Echo's setup; with --factory-reset, Fire OS 6 8349, with
the Echo erased.
commands for the Echo (2nd Generation):
stock [BUILD]
Amazon's Fire OS BUILD, 8149 when left out, which erases the whole
Echo.
unlock [TARGET], where TARGET is one of:
fireos6, the default
boot-root.zip's root adb on the Fire OS 6 already installed, which
keeps the Echo's setup; with --factory-reset, Fire OS 6 8149, with
the Echo erased.
Run it again with another of these to move the Echo there.
commands that reach one entry point and stop there:
reboot
start the Echo's firmware, as an ordinary power-on does. It reboots
an Echo in its TWRP or its fastboot, and leaves one that already
runs its firmware alone. An Echo held in its bootrom needs a power
cycle, and it says so. It writes nothing.
fastboot
start the Echo's fastboot, whichever bootloader it holds. It reboots
an Echo that answers adb, and asks for the button gesture where it
cannot. It writes nothing.
twrp
start the Echo's TWRP. On an unlocked Echo it restarts into the
recovery already there and writes nothing, and says what to do where
that is not a TWRP. A locked Echo has to be unlocked first, which
erases it, so that one is asked about.
bootrom
hold the Echo in its bootrom, where amonet's payload can reach the
eMMC with no firmware running. It asks before it clears boot0, which
is what leaves an Echo startable from its bootrom alone. An Echo
that shows no light cannot be reached this way: `firebreak short` is
for that one.
short
hold the bootrom of an Echo that shows no light, by shorting its
test point. It says where to short, waits for the bootrom, says when
the short may come off, and leaves amonet's payload holding it. It
writes nothing, and --device picks whose test point to describe.
other commands:
report
print what the Echo and this computer are, and the Echo's partition
table, for a support request. It starts the Echo's recovery to read
them and writes no partition.
survey OTA [OTA ...]
read each Amazon OTA zip for the tables in docs/devices.md. It needs
no Echo.
write-test
write a known pattern over the Echo's cache partition and read it
back, which tells a failing eMMC from a failing USB cable because
nothing crosses USB. It leaves a fresh empty filesystem there, or
says it could not.
Run `firebreak COMMAND --help` for what that command takes.
- docs/troubleshooting.md: USB and cable problems, Windows limits, and an Echo Dot (2nd Generation) with no light.
- docs/unlocking.md: why each step is there.
- docs/measurements.md: the ring at each step, so you can tell where a run has got to.
When a run fails, run uvx firebreak@latest report. Then go to
#echo-support in the
0x7E Labs Discord and paste what it prints. It
writes no partition.
firebreak automates work that other people did first.
- xyz wrote amonet, a MediaTek bootrom exploit. firebreak's bootrom and payload clients follow its protocol.
- k4y0z made the first port of amonet to the Echo Dot (2nd Generation).
- Rortiz2 continued
that port, released
it with TWRP, and keeps its
XDA thread.
Rortiz2 also wrote amonet-radar and kamakiri-donut, the unlocks for the
Echo (2nd Generation)
and the
Echo Dot (3rd Generation).
The
bboeTWRP is a fork of their TWRP tree. - AntiEngineer helped find the pins and bring up UART on a Dot.
- topjohnwu wrote Magisk, which roots Fire OS 5.
- Andy Goetz described how to short the eMMC bus at the passives beside R60.
- mtkclient, by bkerler, agrees with two of firebreak's bootrom addresses.
- ftvdb keeps an archive of Fire OS builds.
firebreak uses the BSD 2-Clause licence, in LICENSE.txt. This repository contains no Amazon code, and firebreak is not affiliated with, endorsed by, or supported by Amazon.