Amazon Echo Show 5 2nd Gen Smart Display Teardown

We previously tore down several Amazon Echo devices, including the 3^rd gen Dot, 3^rd gen Dot with Clock, the Flex, Echo Dot 4^th Gen and the Echo Input. In this teardown, we will look at the new Echo Show 5, 2^nd 2021 release, a smart display with Amazon Alexa and a 2 MP camera.

The Echo Show differs from the previous Echo devices that we have torn down as this has a large display and camera in addition to the microphones and speaker on the smaller models.

In the Box

• The Echo Show 5
• 240V UK power supply
• Setup instructions

Specifications

The Echo Show 5 (2^nd generation) has the following specifications:

• Screen: 5.5 inches with 960 x 480 resolution
• Speaker 1 x 1.6 inch
• Camera: 2 megapixels
• Camera Controls: Built-in camera cover and Microphone/Camera Off button
• Dimensions: 148 x 86 x 73 mm (W x H x D)
• Weight: 410g
• Wi-Fi: Dual-band Wi-Fi supports 802.11a/b/g/n/ac Wi-Fi networks.
• Processor: MediaTek MT 8163

Top of the Echo Show

The top of the echo has three push buttons, two microphones and a slide switch. The + and – buttons control the volume, and the circle with a line through it enables or disables the microphones. The slide switch moves a white shield cover over the camera.

Front of the Echo Show

The front panel contains the LCD touchscreen and a camera in the top right corner.

Back of the Echo Show

The back contains a power socket and a USB connector. The USB connector allows connection to a computer where the Echo Show appears as a file device.

Opening the Case

To open the case, first, you need to remove the non-slip aluminium/rubber cover on the base of the echo show using a thin knife or some other flat-bladed tool. Slide the knife around the central piece of plastic to release the adhesive tape. If you try to lift the cover from one end without first releasing the tape, you will crease the aluminium, which may make it difficult to fit back down later.

Under the cover, you will find three T6 Torx bolts which need to be removed.

The two halves of the case are separated by prising the front away from the back with a thin blade inserted into the gap around the edge between the material and the plastic front.

Remove the J1 ribbon cable and the J2 speaker cable to separate the screen and front panel from the rear section of the case.

Back section Disassembly

Remove four screws from the speaker assembly and two pieces of conductive tape.

Slide the speaker out of the rear enclosure.

Front section Disassembly

Remove the four ribbon cables, 5 screws and conductive tape to remove the main PCB.

Remove the 4 screws from the button PCB and the two screws from the metal bracket holding the camera down.

The upper side of the Processor PCB

The upper side of the processor PCB contains the main components for the device.

Around the outside edge are connectors for the touch screen, LCD, camera, power, USB and speaker.

The main processor is a MediaTek MT8163. The MT8163 is a highly integrated SOC with a 64-bit quad-core ARM Cortex-A53 MPCore, 3D graphics (OpenGL ES 3.1), a 13-megapixel camera interface, DDR3/L up to 800MHz and high-definition 1080p video decoder.

A MediaTek MT6323 performs power management on the device.

Communication with the outside world is done using a MediaTek MT7668 dual-band 802.11ac Wi-Fi with MU-MIMO and Bluetooth 5.0 controller.

There is a large metal shield soldered to the PCB. This covers up the DDR3 memory and flash memory chips. We have had mixed success removing these shields in the past, and on one previous Echo model, the flash memory came off with the shield. We don't want to destroy the Echo until we have done some more experiments, so we decided to leave the shield in place.

Alongside the main chips are several smaller power regulators, inductors and capacitors.

The lower side of the Processor PCB

The lower side contains two ICs and several voltage regulators.

Audio input is controlled with a Texas Instruments TLV320ADC3101 low-power Stereo ADC With Embedded miniDSP.

Audio output is provided using a Texas Instruments TAS5805M 23-W Class-D Audio Amplifier.

There is an unpopulated set of 10 pads in the middle of the PCB, which looks like space for a connector. This is underneath the processor, so it could be a debug or JTAG header and may be worth further investigation.

The lower side is covered in test points. These are not accessible when the device is powered and connected to the LCD, touch screen and camera, so we will have to find a way to access them before we can discover what each test point does.

Power and USB PCB

A small PCB is fitted to the rear of the enclosure behind the speaker. This PCB contains a power socket, a USB micro socket and several discreet components.

Button PCB

At the top of the device is a narrow PCB containing three push buttons and two MEMS microphones. It was not possible to remove the camera without first removing this PCB.

LCD and Touch Screen

We could not find the part numbers for the LCD and touch screen without removing them from the front of the plastic case. As they are glued in, and we don't want to risk damaging the screen, we decided against trying to disassemble that part of the device.

The LCD is a 5.5-inch display with a 33-pin flat flex cable.

After searching the internet, the closest model we could find was a KD055M39-33TH-A001 with a MIPI interface. The display is advertised as a replacement for the Echo Show 5, so it is either the same display or one that is compatible. The specifications for this display are as follows.

• Size (inch): 5.5
• Resolution: 480*960
• Panel type Display mode: IPS
• Interface support Interface: MIPI (33pin)
• Outline (mm): 82.82(H)*144.56(V)*3.24(T)
• Display area size Active area(mm): 61.88(H)*123.75(V)
• Brightness (nits): 350TYP

The touch screen has a part number of E517389, which we could not find on google, but it does have the pinout printed on the cable. It appears to be an I2C-based device with a touch controller built into the flat flex cable. The pinout is as follows.

1. Ground
2. SDA
3. SCL
4. Interrupt
5. Vdd
6. Not Connected
7. Reset
8. Ground

Power Consumption

We took the following power measurements using our HOPI energy meter.

4.3W with screen wallpaper

4.8W when playing music on Spotify

4.9W when playing a full-screen YouTube video

USB interface and Boot Modes

Connecting the USB socket on the device's rear to a PC allows the Echo to mount on the host computer as a disk drive. The USB socket can also be used for flashing the firmware and other software operations.

The following boot modes are available when powering on the device:

• Holding down - button boots into safe mode.
• Holding down + and - on boot loads fastboot mode.
• Holding down mute and - on boot loads factory reset mode.

Running the Linux command "lsusb -v" gave us a list of USB devices connected to the PC, and in the list was an Amazon Alexa device with the following details.

Bus 005 Device 009: ID 1949:01e1 Lab126, Inc. Alexa
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x1949 Lab126, Inc.
  idProduct          0x01e1 
  bcdDevice           ff.ff
  iManufacturer           1 Amazon
  iProduct                2 Alexa
  iSerial                 3 xxxxxxxxxxxxxxxxxxxx
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0027
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xc0
      Self Powered
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol      0 
      iInterface             17 MTP
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x001c  1x 28 bytes
        bInterval               6
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0001
  Self Powered

The Lab126 in the device description relates to Amazon Lab126 (sometimes known as Lab126), an American research and development and computer hardware company owned by Amazon.com.

Holding down + and - while turning on the device boots the Echo Show into fastboot mode.

Running the command "fastboot getvar all" returned the following:

(bootloader) 	antirback_tee_version: 0x0104
(bootloader) 	antirback_lk_version: 0x0103
(bootloader) 	antirback_pl_version: 0x0103
(bootloader) 	rpmb_state: 1
(bootloader) 	lk_build_desc: 7b1780d-20210416_071610
(bootloader) 	pl_build_desc: 29ba1b5-20210311_160043
(bootloader) 	secure: yes
(bootloader) 	prod: 1
(bootloader) 	otu_code: xxxxxxxxxxxxxxxxxxxxxxxxx
(bootloader) 	unlock_status: false
(bootloader) 	unlock_code: xxxxxxxxxxxxxxxxxxxxxxxxx
(bootloader) 	serialno: xxxxxxxxxxxxxxxxxxxxxxxxx
(bootloader) 	max-download-size: 0x6d00000
(bootloader) 	off-mode-charge: 1
(bootloader) 	warranty: no
(bootloader) 	kernel: lk
(bootloader) 	product: CRONOS
(bootloader) 	version-preloader: 0.1.00
(bootloader) 	version: 0.5
all: Done!!

Fastboot can see the device, but we can not extract or update the firmware image as the bootloader is locked.

Future Investigations

So far, we have disassembled the Echo Show 5 and found the main components. We have not decided what the next steps will be, but we have a couple of options.

First, we can reverse engineer the main PCB to find out what the test points and unpopulated connectors are for. If we can find a way of interfacing with the header on the underside of the PCB or removing the shield without damaging the components underneath, we may be able to extract the firmware. We have done this on two Echo devices, one with an emmc flash memory and another with an SPI NAND flash chip.

Once we have the firmware, we can figure out how it works and look for ways to modify it to run our own software.

The second option is to scrap the existing CPU PCB and build a new board with a Raspberry Pi 4 compute module. We will need to find a way of interfacing the LCD and touch screen, add an audio ADC and DAC for the microphone and speaker and write some software to run on it, but this would allow us to use other voice assistants like Mycroft. The biggest difficulty with this option at present is getting hold of a Raspberry Pi 4 compute module, as nobody has them in stock.