First of all, big shoutout to Rortiz2, the absolute wizard who figured this out.

This is super new, a bit risky, and definitely not for the faint of heart. Follow every step carefully or your Echo Show might end up as a fancy mirror. Okay, let’s roll.

1) Prepare Yourself (and Your Sanity)

This guide works only for:

Echo Show 5 (1st Gen – 2019)
Running Fire OS 6.5.7.0 (latest OTA version)
A computer with Windows or Linux
A MicroUSB cable that supports data transfer
For Windows folks: Install the Kindle Fire Driver from Amazon Developer Link

And of course, make sure ADB is installed and working

2) Unlocking the Bootloader

Download and extract the attached ZIP: amonet-checkers-v1.0.0.zip

Run fastbrick.bat (Windows) or fastbrick.sh (Linux). Keep that Terminal open!

Now plug in your Echo Show 5 with its AC charger and hold these buttons together: Mute + Volume Down + Volume Up. Keep holding until you see "=> FASTBOOT mode..." on the screen (Do not shutdown).

Connect the Echo Show 5 to your PC via MicroUSB. The script should detect it. Type YES when it asks and wait while it does its magic: Unlocking bootloader, Installing TWRP, … then reboot straight into TWRP.
You can now exhale!

3) Root Time!

Download Magisk 28.1 from GitHub. Rename the .apk file to .zip
Push Magisk to your device: adb push Magisk.zip /sdcard/Download/
On your Echo (inside TWRP), choose Install, find Magisk.zip, and install it without Reboot!
Now download magisk.db.zip from here, extract and push it into your Echo: adb shell mkdir -p /data/adb
adb push magisk.db /data/adb/

Reboot the device using: adb shell reboot-amonet
Once it reboots, run: fastboot oem flags 61 and then fastboot reboot
And you’re now rooted with ADB access!
To bypass the APK installation, run:
adb shell su
settings put global disable_bouncer 1

4) Installing Nova Launcher

Download Nova Launcher 6.2.19 APK and install via ADB adb install Nova.APK
Disable Amazon’s Echo show launcher:
adb shell su pm disable com.amazon.paladin
You can now access the Nova Launcher
To re-enable the default launcher:
adb shell su pm enable com.amazon.paladin

5) Installing Home Assistant

Download Home Assistant APK from GitHub Releases and install via ADB adb install Homeassistant.APK

And now open Nova Launcher, find Home Assistant, and launch it.
You now have your very own smart home dashboard running on an Echo Show 5! Now sit back and enjoy your Echo Show 5!

Exploiting

How I Unlocked My Echo Show 5 Bootloader and Installed Home Assistant

dis.uniroma1.it – Blind SQL Injection

Just another boring blog