GhostLock 5.10

This is a kernel root exploit for the Amazon Fire Max 11 (sunstone) and the Fire TV Stick 4K Max 2nd Gen / 2023 (karat), adapted from CVE-2026-43499 in CyberMeowfia.

Supported devices

Two devices are supported, both on Fire OS 8. Each has its own build target.

Fire Max 11 (sunstone)

Fire TV Stick 4K Max 2nd Gen (karat)

Building

Requires GNU Make and Android NDK r29.

make                 # Fire Max 11 (sunstone), the default
make PROJECT=karat   # Fire TV Stick 4K Max 2nd Gen

Or build a distributable zip, which handles everything for you:

./makedist.sh                 # sunstone
PROJECT=karat ./makedist.sh   # karat

The result is written to dist/ghostlock-<date>.zip.

Usage

./root.sh

On Windows, run root.bat.

The script reboots the device, runs the exploit, and drops you into a root shell when it finishes. If it fails, it will automatically retry up to 8 times.

If successful, you will see a root shell prompt like this:

root@sunstone:/ #

On newer versions of Fire OS, Amazon added KASLR, so it might take a few minutes to fully run. Be patient. Once it is up, su works from any adb shell until the next reboot.

There is also a bind shell on 127.0.0.1:9999, kept open for as long as root lasts. The easiest way in is to run nc on the device itself:

adb shell -t "nc 127.0.0.1 9999"

Or forward the port and connect from the host:

adb forward tcp:9999 tcp:9999
stty raw -echo; nc 127.0.0.1 9999; stty sane

[!CAUTION] While you are root, our device still uses dm-verity, so any modification to the system/vendor/etc. partitions will result in a brick.

Damaging critical partitions such as LK, TEE, or Preloader will also result in a brick. Use this exploit at your own risk.

LM shell

On the Fire TV Stick, a second raw root shell is opened on 127.0.0.1:9060 for Launcher Manager.

LM normally spawns its own as the system user, but it reuses the port if it is already open, so if the exploit is holding 9060 with a root shell, it should operate as root instead.

Run the exploit first so it claims the port, then (re)launch LM.

OTAs

OTA updates are disabled automatically as soon as root succeeds. A single OTA can move you to a build that is not supported here, or that fixes the exploit.

The exact packages differ between the tablet and the Fire TV Stick, the exploit picks the right set based on the device. Look for OTA: pm ... ok lines in the output to confirm.

If any step reports not applied, run it yourself from the root shell.

On the Fire Max 11 (sunstone):

pm disable com.amazon.device.software.ota
pm disable com.amazon.kindle.otter.oobe.forced.ota
sync

On the Fire TV Stick (karat):

pm disable com.amazon.device.software.ota
pm clear com.amazon.device.software.ota
pm disable com.amazon.device.software.ota.override
pm disable-user com.amazon.sneakpeek
pm disable com.amazon.client.metrics
sync

This survives reboots but not a factory reset. To re-enable, pm enable (or pm enable-user) the same packages from a root shell.

Credits

• CyberMeowfia: original IonStack (CVE-2026-43499) exploit
• IonStackQuest3: first public port for 5.10 kernels
• Pro-me3us: karat firmware URL collection
• sweenwolf: Launcher Manager, used on FTVs