Unlock & install

Set it up once on Wi-Fi and sign in to an Amazon account

Yes, even though Alexa is about to be removed. Two reasons: the exploit needs a supported Fire OS version and updates only arrive when registered, and the stock backup you make later can only be restored to a Show that was registered before the unlock. Any Amazon account works; it does not need to be the household one.

Let it update, then check the version

Settings, Device Options, About. Supported Fire OS versions for the exploit are 6.5.4.8, 6.5.5.0, 6.5.6.4, 6.5.7.0, or anything newer than 6.5.7.0. If it shows something between those, leave it plugged in on Wi-Fi until it updates past 6.5.7.0. The latest amonet package has a generic payload, so any current version is fine.

Optional: deregister

Once the version is right you can deregister it from the Amazon account in Settings if you prefer. It has no effect on the unlock.

Boot the PC into Linux and unpack the amonet zip

Copy the amonet-cronos zip to the live Linux desktop, extract it, and open a terminal inside the extracted folder. On Windows instead: install the Kindle Fire USB driver (or Google's USB driver), extract the zip, and use the .bat scripts.

Start the script first

chmod +x *.sh
./fastbrick.sh

It waits for a device. On Windows double-click fastbrick.bat.

Put the Show in FASTBOOT mode

Plug the Show into its power adapter while holding all three buttons (volume down, volume up, and mute) at once. Keep holding until the screen prints => FASTBOOT mode.... Then connect the micro-USB cable to the PC. The script detects it within a few seconds.

Type YES and follow the prompts

The script confirms the device is a cronos and asks you to type YES. It then walks through the exploit, printing instructions for both the terminal and the Show's screen. After the ten-second grace period do not touch anything. The whole thing takes up to five minutes and ends with the Show rebooting into TWRP, a touch recovery menu.

If it fails

If the script cannot see the device, it is almost always the cable (charge-only) or a Mac/VM USB hiccup. Repeat from a real Linux boot. If the exploit was interrupted before the grace period, the Show boots normally and you can simply start over.

Run the backup script while the Show sits in TWRP

./backup.sh

On Windows: backup.bat. It uses adb to pull boot.ab, system.ab and data.ab into a folder. Copy that folder somewhere permanent (Nextcloud or the NAS). This is the only way the Show can ever be an Alexa device again; a fresh Fire OS install crashes at its setup wizard after the unlock.

Never touch the critical partitions

Part of the exploit lives in the first block of the boot and recovery partitions. From here on, only flash boot images from hacked fastboot or TWRP, never with dd from a running system, and never flash LK, preloader or TZ. techo5's installer follows these rules.

Copy the ROM to the Show

Still in TWRP, from the PC:

adb push lineage-18.1-*-cronos.zip /sdcard/

Wipe

On the Show's screen in TWRP: Wipe → Format Data, type yes, tap the check mark. Then Wipe → Advanced Wipe, tick Data, System, Cache, swipe to wipe.

Flash

Install, pick the LineageOS zip, swipe to flash. When it finishes, Wipe → Format Data once more (type yes), then Reboot → System. First boot takes a few minutes.

Set up LineageOS just enough

• Skip everything in the wizard except Wi-Fi. Join the network the Show will live on.
• Settings → About tablet → tap Build number seven times.
• Settings → System → Developer options → turn on USB debugging.
• Plug into the PC and run adb devices. Tap Allow on the Show's screen when it asks to trust the computer. The output should list a serial with device next to it.

The mute button is the power button, the "battery" it reports is fake, and the microphones are quiet under LineageOS; all expected.

Clone and dry-run

git clone https://github.com/HuskerMinion/techo5
cd techo5
python3 tools/install-show.py --dry-run

The dry run checks the toolchain, finds the Show over adb, confirms its kernel is 4.9.337-g8d928c5176cc (the LineageOS v0.4 kernel), and shows what it would do.

Run it for real

python3 tools/install-show.py

It asks for the device serial (offered from adb), a name for Home Assistant such as Kitchen, and a confirmation before the irreversible part. Then, on its own: downloads and verifies the current release, pushes the root filesystem, reboots to fastboot and flashes the techo5 boot image, boots a rescue environment, creates the two-slot store, installs the root filesystem into slot A, and provisions the name and a random encryption key over the USB serial console.

Save the key it prints

Near the end the installer prints the ESPHome encryption key (a base64 string). Copy it. Home Assistant asks for it in the next stage, and it is only shown once. If you miss it, it lives on the device at /data/misc/techo5/psk, reachable over the rescue console.

First boot

The Show reboots into techo5 and shows the clock. If instead the screen says hacked fastboot, run fastboot continue from the PC. After five minutes of healthy running the slot commits itself as good; until then a failed boot would roll back automatically.

Discovery

Settings → Devices & services. The Show appears under Discovered as an ESPHome device with the name you gave it. Click Add and paste the key.

First settings

• Time zone: it starts on UTC and takes HA's zone as soon as it connects.
• Wake word: default is "Alexa". Change it in the device's settings (swipe down on the Show) or in HA.
• Under the ESPHome entry, allow the device to perform Home Assistant actions so it can call services.
• Dashboard: see the Home Assistant side page.

Updates from now on

New techo5 releases show up on HA's update card. They install into the other slot and boot on trial; if the daemon is unhealthy after five minutes the Show returns to the previous slot by itself.