Rooting an Amazon Fire HD 10 using GLM-5.3 and Kimi K3

An Amazon Fire HD 10 (11th gen, 2021) was successfully rooted and debloated using a combination of four AI models, costing $266.15 in API tokens and subscriptions. The process involved identifying a known but unpatched kernel vulnerability (CVE-2022-38181) and using agentic coding models to build a working exploit, eventually removing over 100 Amazon system packages to prevent the device from shutting itself down.

The Problem: Protected System Packages

For a user deploying the tablet as a Home Assistant kiosk, the device began powering itself off multiple times daily. Telemetry logs indicated a Software_Shutdown event, triggered by system services with reboot and shutdown permissions.

While several Amazon services could be disabled via ADB, three specific packages—including com.amazon.device.software.ota—were protected and could not be disabled. Because the bootloader was fused shut and no published root method existed for this specific hardware/firmware combination, the only way to remove these protected packages was to obtain root access.

The AI-Driven Exploit Chain

Rooting the device required a multi-model pipeline, as different models exhibited varying capabilities in vulnerability research and exploit development.

1. Discovery with Kimi K3

Kimi K3 (by Moonshot AI) was used to identify the vulnerability. After the user prompted the model to find a root exploit for their own device, Kimi K3 extracted the kernel from Amazon's OTA image and cross-referenced it against known Mali GPU bugs.

It identified CVE-2022-38181, a use-after-free vulnerability in Arm's Mali kernel driver. Although patched upstream in October 2022 and by Amazon in June 2024 (Fire OS 7.3.2.9), the user's device was running version 7.3.2.6, leaving it vulnerable. Kimi K3 then spent approximately 30 hours and $164.25 in tokens to build the trigger and the memory-write primitive.

2. Refinement with GLM-5.2

After Kimi K3 hit a plateau of repeated kernel panics, the project was handed off to GLM-5.2. This model identified a design bug in the exploit's trigger, stopping a cycle of 500+ failed attempts. However, GLM-5.2 incorrectly concluded that a lack of cache coherency between the CPU and GPU on the chipset was a hardware-level limitation that would prevent the exploit from working.

3. Execution with GLM-5.3

GLM-5.3 (from Z.ai) was used to finalize the root. Within one day of a $80 subscription, GLM-5.3 identified two critical errors in the previous models' assumptions:

• Kernel Relocation: The kernel was shifted by 0x5C000 relative to the OTA image used for analysis.
• Memory Format: The MediaTek implementation of the Mali driver's page tables differed from the Arm reference source, meaning the previous memory-write primitives were writing in the wrong format.

By correcting these offsets and formats, GLM-5.3 successfully flipped the selinux_enforcing flag to permissive and overwrote process credentials to grant a root shell. The total time from handoff to root was 8 hours and 5 minutes.

Comparison of AI Safeguards

Throughout the process, the user encountered significant friction with US-based models. Claude (Anthropic) and Codex (OpenAI) repeatedly triggered "cyber" safeguards, refusing to summarize logs or answer technical questions about CPU cache coherency, even when the target was the user's own hardware.

"American frontier models won’t help and Chinese will, but not without reasoning about whether they should."

This highlights a growing divide where security researchers and hobbyists are increasingly turning to Chinese frontier models to perform legitimate cybersecurity work that is blocked by the broad, blunt safeguards of US models.

Technical Summary of the Root

• Vulnerability: CVE-2022-38181 (Use-after-free in Arm Mali GPU driver).
• Method: Use-after-free to reclaim memory with controlled data $\rightarrow$ GPU write primitive into physical memory $\rightarrow$ flip selinux_enforcing $\rightarrow$ overwrite process credentials for root shell.
• Outcome: Used root access to execute pm uninstall --user 0 on protected system packages, removing 100+ Amazon packages without modifying the system partition.
• Applicability: This method is specific to Fire OS 7.3.2.6 on the 2021 HD 10; it is patched in version 7.3.2.9.