Amazon Echo Button Teardown

Amazon recently released the Echo Button, a Bluetooth Low Energy device designed for use with Echo devices (which I don’t own). Although it uses Bluetooth instead of Wi-Fi, I thought it might be a better device to repurpose than the Dash Button, due to its larger size and easily replaceable battery. Thus, I bought one to take apart.

Echo Button outside

Amazon seemed really worried about the batteries falling out, since the battery door is held shut with both a plastic tab and one Phillips #1 screw. Underneath one of the two AAA batteries is a row of exposed test points. Four other Phillips #1 screws are hidden beneath the device’s rubber feet; removing these allows the device to be opened.1

With battery door open

Once opened, there are two parts—a top half with the large button, and a bottom half with the PCB and batteries.

Halves separated

The top half consists of three plastic parts, three button contacts, and four springs.

Top half parts

The bottom half consists of one plastic piece, with the battery compartment, and the PCB, secured with two more Phillips screws.

Bottom half parts

The device can be easily disassembled and reassembled with standard tools and without damaging it.

All parts

The PCB is fairly spartan, consisting of a combined microcontroller / Bluetooth Low Energy SoC, three RGB LEDs,2 a trace antenna, and supporting components. For easy hackability, there’s a Tag-Connect SWD footprint, as well as a U.FL antenna connector and numerous cuttable traces / solder jumpers. The SoC is a Cypress CYW20735 “single-chip Bluetooth transceiver for wireless input devices.” There appear to be freely available development tools for it.

PCB top

The bottom of the PCB includes a set of test points, some of which are accessible from within the battery compartment. In particular, the SWD header is accessible via these test points with the following mapping:

 TMF2: SWDIO
 TMF9: SWCLK
TMF10: GND
TMF11: RESET
TMF12: VCC
TMF22: SWO

PCB bottom

As far as software goes, the device broadcasts as a Bluetooth Low Energy gamepad with ID EchoBtn2V8.3 I was able to successfully pair it to a computer, but I have not yet tried to use it as an input device. I have also not yet tried to connect a debugger to the SoC.


  1. There’s no glue or ultrasonic welding. 

  2. There’s also a fourth, unpopulated footprint. 

  3. The last three characters might be specific to my device. 

This entry was posted in and tagged , , , . Bookmark the permalink.

2 Responses to Amazon Echo Button Teardown

  1. Sam says:

    Hi,

    How did you interface with the buttons using your PC?
    I have tried scanning for them with iOS’s LightBlue, but I can’t seem to detect them…

    Sam

    • Matthew Petroff says:

      I connected using Linux (BlueZ 4.101), after placing the button in pairing mode by pressing it until it starts glowing orange. Here’s what hcitool knows about the button:

      $ sudo hcitool info xx:xx:xx:xx:xx:xx
      Requesting information ...
          BD Address:  xx:xx:xx:xx:xx:xx
          Device Name: EchoBtn2V8
          LMP Version:  (0x8) LMP Subversion: 0x4118
          Manufacturer: not assigned (305)
          Features page 0: 0xbf 0x06 0x46 0x78 0x58 0x1e 0x5b 0x87
             <3-slot packets>  <5-slot packets>  <encryption>  <slot offset> 
             <timing accuracy>  <role switch>  <sniff mode>  <RSSI> 
             <channel quality>  <paging scheme>  <power control> 
             <enhanced iscan>  <interlaced iscan>  <interlaced pscan> 
             <inquiry with RSSI>  <AFH cap. slave>  <AFH class. slave> 
             <LE support>  <sniff subrating>  <pause encryption> 
             <AFH cap. master>  <AFH class. master>  <extended inquiry> 
             <LE and BR/EDR>  <simple pairing>  <encapsulated PDU> 
             <non-flush flag>  <LSTO>  <inquiry TX power>  <EPC> 
             <extended features> 
          Features page 1: 0x0f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
          Features page 2: 0x40 0x18 0x09 0x00 0x14 0x12 0x09 0x00
      

Leave a Reply

Your email address will not be published. Required fields are marked *