Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
fire-hd-ownership — Owning a tablet Amazon kept shutting down — CVE-2022-38181 write-up, four AI models, and a blog | Kitploit
Tools/GitHubGitHub/ericpardee/fire-hd-ownership
Vulnerability AnalysisExploitationReverse EngineeringMobile SecurityHardware & IoT SecurityPapers & ResearchLearning & EducationBinary Exploitation
GitHubericpardee/fire-hd-ownership

fire-hd-ownership

Owning a tablet Amazon kept shutting down — CVE-2022-38181 write-up, four AI models, and a blog

View Repository
21 day agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

fire-hd-ownership

Owning the tablet I already bought.

In November 2022 I bought a Fire HD 10 (11th gen, 2021 model) on eBay for $114.26 to be a Home Assistant kiosk. It ran fine for years, then started powering itself off. The logs said why: Amazon's own software was issuing the shutdowns, and the packages responsible were protected from the device's owner. The only permanent fix was root — which nobody had ever achieved on this hardware.

Five months later, after a relay race between four AI models and $266.15 in API bills and subscriptions, the tablet is mine: root shell, SELinux permissive, and 100 Amazon packages removed (reversibly).

Read the story: blog.md

What's here

ArtifactWhat it is
blog.mdThe story (served as the site homepage)
HANDOFF.mdThe full technical write-up (§9 = final exploit chain, §8 = GLM-5.2's addendum)
REVIEW.mdGLM-5.2's audit that stopped a doomed 500-attempt grind
original-history.txtSanitized transcripts of the Claude diagnosis months
poc-28663/The CVE-2022-38181 proof-of-concept (Kimi K3's work)
removed_manifest.txtThe 100 Amazon packages that were removed
grind*.sh, root_grind.shThe reboot-loop grinders
hwparam.json, config.gzDevice parameter/config dumps

Credits

  • Claude (Anthropic) — months of shutdown diagnosis over ADB, up to the safeguard wall
  • Kimi K3 (Moonshot AI) — found the unpatched CVE and built the exploit primitives
  • GLM-5.2 (Z.ai) — the fatal-bug review, the fixed dump parser, the honest overnight dead-end
  • GLM-5.3 (Z.ai) — finished the chain, flipped SELinux, removed the packages

Legal & scope

  • One device, owned by the author. No other hardware was ever touched.
  • The vulnerability is CVE-2022-38181 (GHSL-2022-054, GitHub Security Lab): public since 2022, fixed upstream October 2022, CISA KEV-listed March 2023, patched by Amazon in Fire OS 7.3.2.9 (June 2024). Nothing here is novel research.
  • Rooting a tablet you own for interoperability/removing unwanted software is covered by the current US DMCA exemptions (effective Oct 2024 through Oct 2027).

Not included

  • The 1.06 GB firmware image (ota_ps7326.bin) and extracted partitions — too big for git, and Amazon's firmware isn't mine to redistribute.
  • Third-party code cloned during research: mtkclient, the GitHub Security Lab repo (Man Yue Mo's Mali research), and the MTK kernel source used as the kbase driver reference.

Audio

The blog closes with a clip from the live show edition of LINUX Unplugged 680, "Go Hack Yourself" (Jupiter Broadcasting), used under CC BY-SA 4.0. The clip is live-stream content, not part of the edited episode.

Download Tool