# Rooting a fire hd 10 because apparently I have problems > Source: > Published: 2026-09-02 01:17:13+00:00 # rooting a fire hd 10 because apparently i have problems this started because i wanted to root a fire hd 10 11th gen i got for free current fire os. locked bootloader. no flashing old firmware. preferably without opening it. i figured old android 9 tablet, old 4.4 kernel, mediatek. how hard can this be. i ended up spending days throwing basically every surface i could find at it. mali, ion, cmdq, binder, amazon services, bootloader stuff, weird vendor garbage. most of it went nowhere. and i used a stupid number of AI tools getting there. not because i had some grand "multi agent security research architecture." i kept hitting usage limits. that is basically the reason. I am cheap. I have a 20/mo chagpt subscription and a 10/month opencode go. chatgpt/daybreak would get somewhere useful then i would burn the limit. switch stacks. big pickle and kimi k3 from my opencode go subscrioption. another model. keep going. at some point this stopped being a project and became a feverish desire to see uid=0 before the heat death of the universe the research repo gradually turned into a giant pile of: this doesn't work this CVE is patched this looks vulnerable but isn't reachable this DMA engine claims it completed but didn't actually write anything this vendor driver behaves nothing like the public source dont try this again we already wasted 3 hours on it which, ironically, made the models way more useful because i could keep handing the next one the pile instead of starting over. eventually we found two things that actually mattered. first, Fire OS has this root service called `time_update` . it reads `persist.sys.saved_time` . which is supposed to contain a timestamp. it also apparently enjoys shell syntax. so this: ``` x[$(sleep 30;/system/bin/sh /data/securedStorageLocation/t/b)]000 ``` survives reboot, waits for `/data` , and eventually runs the script as: ``` uid=0(root) u:r:time_update:s0 ``` full linux capabilities too. which sounds like game over. except SELinux still says no. ofc. stupid SELinux getting in the way all the time so we had root and still needed root. great. the second half came from binder. Amazon's kernel still has the bug fixed by CVE-2019-2181. that bug is absolutely not ours. but getting it from "old binder CVE exists" to something useful on this exact tablet took a lot more work. we ended up with controlled binder corruption, then a kernel address leak, then eventually a very dumb but very useful primitive: write eight zero bytes somewhere. the somewhere was `selinux_enforcing` . after that: ``` getenforce Permissive ``` now the stupid `time_update` root process suddenly becomes real useful root. from there i got a root service running and then built a live Magisk setup without touching boot or system. that became SnuSnuRoot. ## did we actually find anything new yes. one definitely novel bug came out of the Mali work. `HWCNT_READER_SETUP` accepts `buffer_count=0` because of a broken power-of-two check. it can leave behind an orphaned client / bad state and appears useful for leaks and DoS. it did not get us root. the binder vulnerability itself is old. CVE-2019-2181. the exploit chain built around it on this Fire tablet appears to be new. and i have not found prior work showing the `persist.sys.saved_time` / `time_update` trick being used as a persistent arbitrary script carrier to uid 0. so that one is at least apparently undocumented. ## the funniest part near the finish line i hit more usage limits. i did not want to wait. like at all. Chatgpt said i had to wait till the 5th. burned a week and a reset in a few days lol so out of desperation i downloaded Qwen3-Coder-30B-A3B Q5_K_M, ran it locally with llama.cpp, pointed OpenCode at the research tree and kept going. on my own hardware. that wasn't some ideological "local AI future" thing. i was impatient. the cloud models were rate limited and i wanted this fucking tablet rooted. and it worked well enough to finish. that is probably the part of this whole thing that surprised me most. not that an AI found a vulnerability. it didn't just magically do that. but that after enough research had accumulated in files, logs, scripts and dead-end notes, i could swap the brain out for a 30B local model because the important part was becoming the state of the project, not which model remembered the conversation. anyway. locked fire hd 10. current firmware. no boot modification. ``` uid=0(root) getenforce=Permissive Magisk=running ``` death by snu snu.