So far, we have discussed background on the Echo Dot V2, and why I am interested in reusing the hardware. We have also reused the amonet exploit to dump the eMMC of the dot. As a next step, before we dive into the existing bootloader process, it would be useful to see a dump of the boot logs of the echo dot. With many embedded linux systems, including android devices, a UART is included to provide lowlevel debug information about the boot process. Read more...

The first step in our process of hacking the Echo Dot is getting a dump of the EMMC, so that we can see if we can exploit the boot chain. We have specifically chosen the Amazon Echo Dot V2 in order to aid this process. First of all, this is the last version of the Echo Dot that has a real usb port integrated in the base device. Later versions of the Echo Dot use the micro-usb port for power only, and have a proprietary footprint for the debug USB connector. Read more...

The Echo Dot V2 is an interesting smart speaker, because while it uses a very common tablet SoC, there has been very little work published about trying to root the device. In the echo dot configuration, we have 512 Megabytes of RAM, and 4 Gigabytes of EMMC, so there is plenty of space to do interesting things. The prices have also gotten quite cheap, since the devices are getting long in the tooth, and it is easy to find sellers willing to part with them for almost nothing. Read more...

Useful information for reverse engineering Echo Dot. This is a constantly edited page that will get more information as it is added. Focusing on V2, since it is new enough to be pretty powerful, but old enough to have exploits, and it is old enough not to use a custom SOC, but the same SOC as the Kindle Fire HD 8. Hardware info Teardown of Echo Dot V2: Teardown Tuesday: Amazon Echo Dot v2 Read more...

The board design for the SNES wireless controller project is proceeding nicely. I recently finished the main controller schematic, after running into multiple difficulties about how exactly to implement its electronics. Next up: laying out the circuit board. This presented its own set of challenges, which eventually led to me developing a powerful tool for simplifying the layout of complicated circuit boards. Capturing the PCB dimensions Below is a scan I made of the back of the Official Nintendo SNES Controller PCB: Read more...

One of the problems we faced when designing the schematic for the wireless SNES controller, is whether to leave the original PCB in, or fabricate a complete replacement. Implementing the controller on a smaller circuit board would make it cheaper to manufacure: most PCB prototyping companies bill by the square inch. However, using a smaller board would result in an extremely cramped layout, and might require physical modification of the plastic supports on the inside of the circuit board. Read more...

Many classic arcade and console video games can be played with a D-pad. While one can use modern controllers with these programs, they lack the elegance of the older designs. However, if one uses one of these older controllers with a USB adapter, one is forced to be tethered to the computer. Wireless SNES controllers have been done before. However, they usually don’t pay close attention to power usage, and none support multiple controllers using a single interface. Read more...

Suppose you have an old joystick that you want to use to control your latest micro-controller project. These joysticks use a DB-15 connector with a readily available pinout. A Game Port style joystick consists of digital buttons, and analog axes. In this post, I will go over how to optimally interface the axes of these types of joysticks with your microcontroller. Inside of the joystick, mounted at right angles are potentiometers, one for each axis: Read more...

I recently took a class on Embedded systems design at PSU. In this class, we covered designing memory systems, serial busses, as well as sensors, transducers, and outputs. The labs for this class used an ARM development board based on the (then Intel) PXA270 microprocessor. Students were supposed to develop software in ARM assembly to demonstrate what was learned in class. I decided to implement my solutions in C to provide more of a challenge. Read more...

Recently I took a class on Embedded Systems at Portand State University, and was required to program a bare metal ARM development board. This is a continuation of my notes on how to program the board. You can read the first part here. In order for this development environment to work, we need to implement the syscalls that newlib will use for the C standard library. Most of the required syscalls are necessary in order to access abstractions that wont make sense on the development board. Read more...