I spent $266 and four AI models to own my tablet. GLM-5.3 finished it in a day
An InfoSec professional recounts how he spent $266.15 on AI models to root his Amazon Fire HD 10 tablet, which Amazon kept shutting down. After Claude hit safeguards, Kimi K3 found a Mali GPU exploit (CVE-2022-38181) but failed to exploit it. GLM-5.2 diagnosed the issue, and GLM-5.3, released the day before, solved it in one day by discovering a kernel build shift and achieving root. The author removed all Amazon packages with reboot permissions, permanently stopping the shutdowns.
Your actual goal was never “root” — it was: stop Amazon from killing your kiosk and get their software off your device. Root is the tool.
- AntonyGarand
Nice to see the capabilities of the model but the article has heavy AI tones, making it boring to read.
an AI:DR; is enough: the models found unpatched vulnerabilities and managed to create an exploit to root the tablet, chinese models did it while American ones fell back to their safeguards.
- mrandish
I bought 4 of the same tablet (Fire HD 10) on Black Friday 2021 for Home Assistant dashboards and a Fire HD 10 Pro (edit: actually Plus) I use as an E-reader/browser (with KOReader/Firefox). To save money I got the cheaper version with lockscreen ads pre-installed but before ever letting them online I ran Fire Toolbox to remove the ads, debloat, block updating and install Google services. Fire Toolbox is excellent: https://xdaforums.com/t/windows-linux-tool-fire-toolbox-v45-...
I've never had the problems OP describes but my tablets all came with FireOS v7.3.2.1 and I've never let them update. I think Amazon started locking down later firmware versions more but Fire Toolbox can still do quite a bit to tame and decruft later versions. The XDA forum for Fire Toolbox has a lot of posts covering exploits and workarounds for later FireOS versions.
Once the Amazon cruft is tamed, I still haven't found a meaningfully better 10-inch thin/light Android tablet than the 2021 Fire HD 10 Pro. It has wireless charging, weighs 430g and at 247 x 166 x 9.2 mm no one makes a 10" that's much lighter, smaller or thinner. The only slight downside is FireOS 7 is based on Android 9 and new versions of a few apps are starting to require later APIs. I'd gladly pay ~$250 for a 10" Android 16 tablet with wireless charging that was as thin & light but had smaller bezels for overall smaller size.
- rcarmo
As I was reading this, I realized that the ESP32 HomeKit debugging session I had running was taking a while, and this happened:
Me: what are you doing?
Agent: I’m resolving Apple’s private video-resolution lookup table to determine whether iOS 26 supports 320×240 for HomeKit live streaming.
The decompiled source hides the numeric constants, so I:
- Downloaded/extracted the iOS 26.1 arm64e dyld cache to /workspace/tmp/ios26-dyld/.
- Built and installed the read-only apfs-fuse utility needed to mount Apple’s APFS image.
- Planned to extract HomeKitDaemon and decode its resolution table.
Me: Oh, OK. Carry on then
These are weird times.
- Almondsetat
I know this might be controversial, but unleashing a sea of models to reverse engineer hardware and give it open source and linux support might just be the future
- cgearhart
I understand why “prompt kiddie” feels accurate, but I don’t think it is. Expertise is _amplified_ with LLM agents. The same $300 of tokens given to my plumber—who is an _excellent_ plumber—is unlikely to produce the same outcome.
- bpavuk
okay. where is the source code? the writeup (HANDOFF link at the end) looks decent at the first glance, and it's much more easy to rebuild an exploit from a writeup than without it, but I don't feel like hunting down a tablet with your exact Fire OS version, importing U.S. hardware into Ukraine, paying all the levies, shipment costs, etc. only to get my hands on the hardware and hack it myself to see if your exploit works. this entire thing too easily could be moot.
in tangential defense, I can only say that Gemini 2.5 Flash-Lite was enough for me to set older Dishonored: DotO builds free of Denuvo yet it had much harder time with DEATHLOOP, so I don't discard this article too easily. (in fact, I alone went much farther than any LLM I threw at it at the time Gemini 2.5 was a hot thing.) still, I have sky-high doubts about it. too hard to falsify
- soared
Would anyone be able to describe the workflow set up? OP, how are you getting seemingly innocuous prompts to run for so long?
I’d like to improve my skills - I am surely in actual prompt kiddie territory.
But I’ve got a personal injury claim coming up that is very complex, with tons of docs, legal speak, laws, etc. I’m hoping to have a set up like OPs that can go deep for a long time. How do I set that up? (Currently looking at Claude projects for context file storage, and just asking gemini for now to convert pdfs to raw text, and summarize them)
I’ve also got a cheap scanner that throws errors no matter what os/hardware I use. Sounds like a fun thing to throw some time at.
- raybb
If someone could do something similar but to install Linux on old iPads that would be amazing. Their specs are ok but when the app store stops providing versions of apps for your OS it really makes them nearly useless.