Echo Dot V3 - echohacking/wiki GitHub Wiki

There are two versions of this device:

• the initial version use a combined eMMC + DRAM chip (eMCP), which makes it similar to the Echo Dot 2nd generation
• the revamped model use separate DRAM and a smaller capacity raw NAND chip

First version: Donut

Model number D9N29T, codename 'Donut', FCC ID 2AOAG-3668 & main logic board ID of either 30-003912 or 30-004073.

Second version: Crumpet

Model number C78MP8, codename 'Crumpet', FCC ID 2ARIW-2778, MLB ID 30-004397
The Echo Dot with Clock shares PCBs but comes with a different model number of 36EBT3 & FCC ID 2ASD2-7483.
Due to space constraints it runs a stripped-down version of Fire OS (Android).

Resources

• Dennis Giese, Guevara Noubir: Amazon Echo Dot or the Reverberating Secrets of IoT Devices
  (main focus of this paper was the eMMC model D9N29T - except for a tiny mistake: Figure 3 shows the testpoints for a C78MP8)
• Brian Dorey: Echo Dot 3rd Gen Digging Deeper (D9N29T model)
• Brian Dorey: Amazon Echo Dot 3rd Gen Smart Speaker with Clock Teardown (36EBT3 model, same PCBs as the C78MP8)

Notes:

• Holding the dot button and minus button during boot presents a different boot mode.