Amazon Echo Input Teardown

Published on Tuesday 03 December 2019
Categories: Home Automation |

In the black Friday sale at Amazon we purchased an Amazon Echo Input which is a small voice-controlled device that requires an external speaker and uses the Amazon Alexa voice command service.

As this is the second Amazon echo device we have purchased, we decided to take it apart to see what you get for your £15.00.

In the Box

The echo input
240V UK power supply
USB Power cable
5mm Audio cable
Things to try leaflet
Setup instructions

Top of the Echo

The top of the echo input has two buttons, four microphone holes and LED.

Case Base

The base has the serial number, product logos and certification marks.

On the side is a power input socket and headphone / audio out 3.5mm stereo socket.

To open the case first you need to remove the rubber non-slip cover on the base of the echo input, using a thin knife or some other flat bladed tool.

Under the cover you will find four torx bolts. Removing the bolts allows you to remove the plastic base which has a metal shield and an RFID tag.

Case Top

Inside the top half of the case is another metal shield. Removing this reveals the main PCB and the top half of the plastic case which has additional metal shielding and the control buttons.

PCB Top

The top of the PCB has two buttons with an RGB LED in the centre.

Next to the left button on the photo below is what appears to be a light sensor IC and there is a LVC74A by Texas Instruments which is a Dual Positive-Edge-Triggered D-Type Flip-Flop.

The sides of the PCB have cut-outs which house the 3.5mm audio port and the USB power socket.

There is a small metal shield which covers the 4Gb KLM4G1FETE Samsung eMMC that contains the operating system and other software.

PCB Base

On the underside of the PCB is a large metal shield with conductive pads. Each side has a metal housing which appears to be related to the antennas and a smaller metal shield which houses the Wifi IC.

There are four microphones marked M2270 0975.

The large metal shield is removed by unclipping it around the edges. It is also held to the main processor via a heat transfer pad.

The main CPU is a Mediatek MT8516BAAA ARM 64-bit ARM Cortex-A35 processor which is the same chip used on the Echo dot.

Memory is provided using two Skyunix H5TC2G63GFR 2Gb low power Double Data Rate III (DDR3L) Synchronous DRAM ICs.

The four microphones feed into two TLV320ADC3101 chips from Texas Instruments. The TLV320ADC3101 is a Stereo ADC with an embedded mini digital signal processor. The Echo input uses the four microphones to locate the direction the voice is coming from and filter out background noise.

Above one of the ADC chips is a small 8 pin IC marked ES33 868 A7Z6.

The smaller metal shield is removed by melting the solder around its edges.

The metal shield houses the MediaTek MT7658CSN dual-band Wi-Fi and Bluetooth controller with an ARM Cortex-R4 CPU. The MT7658CSN manages communication to wi-fi and Bluetooth devices and connects to two PCB antennas located on the outer edges of the board.

The eMMC Chip

Whilst removing the metal shield which covers the eMMC storage chip, using our hot air reflow station, the chip accidently came off with the metal. As we don’t have any way to re-ball a BGA chip we thought we would try to connect to the chip to try to access the data on it and see if the content is encrypted or not.

We found several commercially available BGA sockets but these are very expensive and so we looked for an alternative way to access the chips contents.

eMMC uses the same communication protocols as SD Memory cards, so we found a pinout for the Micro SD card standard and using a MicroSD to SD card adapter we matched the pins on the Micro SD adapter with the corresponding pins on the eMMC IC. Using some 0.1mm enamelled wire, a new extra fine soldering iron tip and a lot of flux we carefully soldered wires between the SD card adapter and the IC. The eMMC IC is 11mm x 10mm x 0.8mm. 153 pins, 0.5mm ball pitch.

The SD card adapter was then plugged into a USB card reader and connected to one of our Linux computers. Linux automatically mounted several ext4 partitions which indicated that the adapter was working successfully. We then used the Linux tool dd to make a copy of the entire drive to an image file that we could then inspect without risking the original version.

A quick look through the partition structure of the drive indicated that it was an android based system and after some research online we found that it was based on Amazons Fire OS. We don’t plan on doing anything with what we have found as we don’t have the knowledge or time to try modifying the contents of the drive, or have any way of fitting the chip back onto the PCB but it was a useful experiment in recovering data from eMMC memory chips.