Known (datasheet/published):
- 4× ARM Cortex-A7 @ up to 1.3GHz, 28nm TSMC
- ARM Mali-450 MP4 GPU @ 500MHz
- Integrated HDMI 1.4 transmitter (no external HDMI IC needed)
- Dual-channel 32-bit LPDDR2/LPDDR3 controller
- eMMC 5.0 + SD 3.0 + NAND flash controller
- USB 2.0 HS OTG controller (480Mbps)
- 2× I²C, 4× UART, SPI, PCM/I²S audio
- Hardware H.264/H.265/VP8 decode (up to 1080p60)
- Hardware H.264 encode
- ARM TrustZone security extension
- Hardware AES/SHA/RSA crypto accelerator
- 2× MIPI CSI camera interface (up to 13MP)
Theoretical (engineering extrapolation):
- Camera ISP pipeline completely present — with hardware modification (CSI connector added)
and custom kernel driver, camera input possible
- I²S audio: audio subsystem present; with custom ROM, external I²S DAC could be added
to unpopulated pads for audio output
- USB host: OTG port fully capable in silicon — adding USB data wiring (hardware mod)
would enable USB keyboard/storage with custom firmware
Security/Research:
- MediaTek DA (Download Agent) mode accessible via UART at boot — enables flash re-write
- TrustZone TEE (MTEE — MediaTek Trusted Execution Environment) isolates secure boot keys
- Known CVE: MTK-SU (2020) — root exploit affecting MT8127D class, likely patched on
later Amazon OTA builds but unpatched on abandoned units
Known:
- 802.11a/b/g/n/ac 2×2 MIMO, dual-band
- Bluetooth 4.1 + BLE
- Internal ARM Cortex-M3 running WiFi firmware
- Supports 20/40/80MHz channel widths
- MU-MIMO capable in hardware (client side)
Theoretical:
- Monitor mode / packet injection — possible with custom firmware (nexmon project supports
BCM43xx family); enables passive WiFi sniffing and active frame injection
- Bluetooth HCI raw mode — possible with ADB + bt snoop log
- WiFi firmware patching via nexmon: https://github.com/seemoo-lab/nexmon
Authored: Albert Lane + Claude Sonnet 4.6 · SovereignAudits™ · 2026-06-10