{"slug": "rooting-a-fire-hd-10-because-apparently-i-have-problems", "title": "Rooting a fire hd 10 because apparently I have problems", "summary": "A developer who spent days rooting an Amazon Fire HD 10 11th gen tablet documented the process, revealing two apparently novel vulnerabilities: a root service called time_update that can be abused via the persist.sys.saved_time property to run arbitrary scripts as uid=0, and a new exploit chain for the old binder bug CVE-2019-2181 that disables SELinux. The developer also used a mix of cloud AI tools and a locally run Qwen3-Coder-30B-A3B model to overcome usage limits, resulting in a tool called SnuSnuRoot.", "body_md": "# rooting a fire hd 10 because apparently i have problems\n\nthis started because i wanted to root a fire hd 10 11th gen i got for free\n\ncurrent fire os. locked bootloader. no flashing old firmware. preferably without opening it.\n\ni figured old android 9 tablet, old 4.4 kernel, mediatek. how hard can this be.\n\ni ended up spending days throwing basically every surface i could find at it. mali, ion, cmdq, binder, amazon services, bootloader stuff, weird vendor garbage.\n\nmost of it went nowhere.\n\nand i used a stupid number of AI tools getting there.\n\nnot because i had some grand \"multi agent security research architecture.\"\n\ni kept hitting usage limits.\n\nthat is basically the reason. I am cheap. I have a 20/mo chagpt subscription and a 10/month opencode go.\n\nchatgpt/daybreak would get somewhere useful then i would burn the limit. switch stacks. big pickle and kimi k3 from my opencode go subscrioption. another model. keep going.\n\nat some point this stopped being a project and became a feverish desire to see uid=0 before the heat death of the universe\n\nthe research repo gradually turned into a giant pile of:\n\nthis doesn't work\n\nthis CVE is patched\n\nthis looks vulnerable but isn't reachable\n\nthis DMA engine claims it completed but didn't actually write anything\n\nthis vendor driver behaves nothing like the public source\n\ndont try this again we already wasted 3 hours on it\n\nwhich, ironically, made the models way more useful because i could keep handing the next one the pile instead of starting over.\n\neventually we found two things that actually mattered.\n\nfirst, Fire OS has this root service called `time_update`\n\n.\n\nit reads `persist.sys.saved_time`\n\n.\n\nwhich is supposed to contain a timestamp.\n\nit also apparently enjoys shell syntax.\n\nso this:\n\n```\nx[$(sleep 30;/system/bin/sh /data/securedStorageLocation/t/b)]000\n```\n\nsurvives reboot, waits for `/data`\n\n, and eventually runs the script as:\n\n```\nuid=0(root)\nu:r:time_update:s0\n```\n\nfull linux capabilities too.\n\nwhich sounds like game over.\n\nexcept SELinux still says no. ofc. stupid SELinux getting in the way all the time\n\nso we had root and still needed root.\n\ngreat.\n\nthe second half came from binder.\n\nAmazon's kernel still has the bug fixed by CVE-2019-2181. that bug is absolutely not ours.\n\nbut getting it from \"old binder CVE exists\" to something useful on this exact tablet took a lot more work.\n\nwe ended up with controlled binder corruption, then a kernel address leak, then eventually a very dumb but very useful primitive:\n\nwrite eight zero bytes somewhere.\n\nthe somewhere was `selinux_enforcing`\n\n.\n\nafter that:\n\n```\ngetenforce\nPermissive\n```\n\nnow the stupid `time_update`\n\nroot process suddenly becomes real useful root.\n\nfrom there i got a root service running and then built a live Magisk setup without touching boot or system.\n\nthat became SnuSnuRoot.\n\n## did we actually find anything new\n\nyes.\n\none definitely novel bug came out of the Mali work.\n\n`HWCNT_READER_SETUP`\n\naccepts `buffer_count=0`\n\nbecause of a broken power-of-two check.\n\nit can leave behind an orphaned client / bad state and appears useful for leaks and DoS.\n\nit did not get us root.\n\nthe binder vulnerability itself is old. CVE-2019-2181.\n\nthe exploit chain built around it on this Fire tablet appears to be new.\n\nand i have not found prior work showing the `persist.sys.saved_time`\n\n/ `time_update`\n\ntrick being used as a persistent arbitrary script carrier to uid 0.\n\nso that one is at least apparently undocumented.\n\n## the funniest part\n\nnear the finish line i hit more usage limits.\n\ni did not want to wait.\n\nlike at all. Chatgpt said i had to wait till the 5th. burned a week and a reset in a few days lol\n\nso out of desperation i downloaded Qwen3-Coder-30B-A3B Q5_K_M, ran it locally with llama.cpp, pointed OpenCode at the research tree and kept going.\n\non my own hardware.\n\nthat wasn't some ideological \"local AI future\" thing.\n\ni was impatient.\n\nthe cloud models were rate limited and i wanted this fucking tablet rooted.\n\nand it worked well enough to finish.\n\nthat is probably the part of this whole thing that surprised me most.\n\nnot that an AI found a vulnerability.\n\nit didn't just magically do that.\n\nbut that after enough research had accumulated in files, logs, scripts and dead-end notes, i could swap the brain out for a 30B local model because the important part was becoming the state of the project, not which model remembered the conversation.\n\nanyway.\n\nlocked fire hd 10.\n\ncurrent firmware.\n\nno boot modification.\n\n```\nuid=0(root)\ngetenforce=Permissive\nMagisk=running\n```\n\ndeath by snu snu.", "url": "https://wpnews.pro/news/rooting-a-fire-hd-10-because-apparently-i-have-problems", "canonical_source": "https://voidnullvalue.github.io/SnuSnuRoot/", "published_at": "2026-09-02 01:17:13+00:00", "updated_at": "2026-09-02 01:52:08.211250+00:00", "lang": "en", "topics": ["ai-tools", "ai-research"], "entities": ["Amazon Fire HD 10", "ChatGPT", "OpenCode", "Qwen3-Coder-30B-A3B", "llama.cpp", "SnuSnuRoot", "CVE-2019-2181"], "alternates": {"html": "https://wpnews.pro/news/rooting-a-fire-hd-10-because-apparently-i-have-problems", "markdown": "https://wpnews.pro/news/rooting-a-fire-hd-10-because-apparently-i-have-problems.md", "text": "https://wpnews.pro/news/rooting-a-fire-hd-10-because-apparently-i-have-problems.txt", "jsonld": "https://wpnews.pro/news/rooting-a-fire-hd-10-because-apparently-i-have-problems.jsonld"}}