September 4, 2020

The Amazon Dash

These were all taken out of service by Amazon sometime in 2019, so these days they are so much trash unless you can repurpose them. I bought a couple back in 2016 for $5 each figuring I would do some hacking, but the ones I received were version 2 units, which are quite hard to hack. So, it was a waste of money and a bit of time.

Opening up a version 2 unit

These are glued or plastic welded together, so you will need to cut them open. I do it in less than a minute using a dremel tool with an abrasive blade, but it is really a total waste of time unless you want the AAA alkaline battery inside before you toss the unit. You will need a number 5 torx driver also once you get inside to get at the circuit board. Mine were labeled model JK29LP. The PCB inside is labeled REV 02.

Onboard is an Atmel ATSAMG55J19. This is a Cortex-M4 ARM with fpu that will run at 120 Mhz. It has 512K of flash and 176K of SRAM. It would be great if there was access to SWD pins and/or a serial port. The following article talks about what is necessary to hack one of these.

The problem is that the unit comes with SWD disabled and very limited acess over the serial console. You could repeat his work, which includes an exploit he discovered, but I feel my time would be better spent on other devices.

The original Dash

The basic idea was pretty idiotic. You push a button an an order for a case of beans gets placed. Apparently a lot of people failed to jump on this silly bandwagon and Amazon gave it up.

The original REV-01 dash (product JK76PL) was based on an ST STM32F205 microcontroller and was much more hackable than the REV-02. It also used a lithium cell rather than a removable alkaline cell, not that that matters terribly much these days.

Lots of these are for sale on Ebay, but nobody is promising to deliver JK76PL units.

The older model is better understood and there are a multitude of hacks for it. The newer model has a more exciting controller, but is less well understood.

The old Dash was based on an STM32F205RG6 from ST (an ARM Cortex-M3 running at 120 Mhz) with 1M of flash and 128k of ram, along with a Broadcom wireless chip. Anything Broadcom makes me grimmace since they are stingy and secretive with documentation -- avoid them! This unit also includes a 16 Mbit flash chip, a Micron M25P16.

The new Dash is based on an Atmel AT SAMG55J19A-MU (an ARM Cortex-M4 running at 120 Mhz -- with floating point!!). The new unit has an Atmel ATWINC1500B wireless chip. One has to applaud the departure from Broadcom, but only time will tell how easy this new combination will be to hack. In addition, the new unit has a Bluetooth chip - the Cypress CYBL10563-68FNXI. I haven't seen anything from Cypress in a long time, so this is an interesting turn of things. The new unit has a 32 Mbit flash chip (apparently a Micron N25Q032). This is 4Mbytes of flash, double what was on the previous unit, which is pretty amazing. It does have SWDIO and SWCLK, along with additional debug pins (maybe full up JTAG).

Feedback? Questions? Drop me a line!

Tom's Computer Info / tom@mmto.org