Look what I have found today ... I have completely forgotten these little babies. Teardown times ahead

Let's start with the @amazon echo dot (3rd gen) ... I have bought it a while ago for 20 euros.

There are a bunch of v3 teardowns out there ... most with better pictures than mine ... but probably it will be a bit of fun for all of us ;)

just a short sidenote ... always try your device before you open it. Otherwise you do not know if you are the guy who broke it or not. And ... it blinks and talks to me

lets open this little baby now ... can you see this. Something they probably need for testing (debugging?)

so, what do we currently need for opening such smart thing? A cheap set of screwdrivers or something like a phone repair kit. I have this one in the pic and the iFixit https://www.amazon.de/iFixit-Bit-Driver-Kit-Kreuzschlitz/dp/B0189YWOIO/

and now it smiles to me. Can you see it blinky? So, we have not broken it now. Currently we can see the little speaker (this little boy works quite good) and the PCB with the connectors to the outside. Also some other testing points that could be quite interesting ...

Next step ... Get the PCBs out of the case and let it run without the "beautiful" voice of this Alexa thing

after some screws it is there and blinking ...

I think we should take a look at both sides of the @amazon echo dot main PCB. Lets see the already known side with some testing points (we dig deeper later on)

and the more interesting side

some Micron RAM

the Flash

and the Mediatek ARM CPU MT8516

usually I draw some pics during reversing ... ugly but it helps me

here we go with some more details on the flash https://www.micron.com/products/nand-flash/serial-nand/part-catalog/mt29f4g08abafah4-it

But you have to register for the datasheet. Hmmm is this the right one? http://www.farnell.com/datasheets/3151368.pdf Take a deeper look at it after some sleep ... no more beer, no more datasheet to read ;)

How do we get the right part from this small code pattern - NW943? Micron has a support site with a decoder: https://www.micron.com/support/tools-and-utilities/fbga?fbga=nw943#pnlFBGA

The RAM is probably not that interesting for us but via the decoder site you are able to get the details: https://www.micron.com/products/dram/ddr3-sdram/part-catalog/mt41k128m16jt-107

So, how could we extract the firmware from the NAND flash? My first try is always the batronix reader. It is not that expensive and there are a lot of adapters out there ... and we have it in the office - https://www.batronix.com/versand/programmiergeraete/BX48/batego-II.html

hmmm, it supports something from this flash family but in TSOP packaging. Probably we could rewire the reader to the flash manually? I will give it a try next week.