Hazel Fire TV temporary root

Temporary root exploit for the Amazon hazel Fire TV platform, based on CVE-2026-43499. The exploit is is intended for the ARM32 Linux 4.9 firmware shared by Hazel televisions from several manufacturers. Profiles currently cover firmware from PS7657.3645N through PS7716.5665N.

The current hardware-tested configuration is:

[!WARNING] This exploit remains firmware-specific even though it supports multiple Hazel releases. Kernel addresses, structure offsets, and reclaim settings are loaded from strict profiles. PS7716.5665N is hardware-tested; the older bundled profiles are based on static firmware analysis and still need reports from matching televisions.

Do not bypass profile matching or hand-copy addresses to an unrelated firmware. Statically generated profiles still require confirmation on matching hardware.

A failed heap reclaim may panic and reboot the TV. Root is temporary and is lost after reboot. If your TV freezes, you can always power cycle it.

What it does

The exploit uses CVE-2026-43499 to obtain temporary UID 0 from the normal ADB shell environment.

The exploit chain includes:

• ARM32 futex-PI UAF exploitation
• kernel address leak
• mm_struct cross-cache reclaim
• controlled kernel object reclaim
• kernel read/write primitives
• current task discovery
• credential patching
• a local root command server/client
• strict firmware profile selection and post-read runtime validation

After a successful run, the exploit keeps the kernel objects required by the root path alive and starts a local command daemon.

SELinux remains Enforcing. Commands executed through the root daemon retain the shell SELinux domain and the capability bounding set available on this firmware.

Files

• hazel_root.c main exploit, kernel read/write stage, credential patching, and root command client/server
• hazel_reclaim.h kernel address leak and mm_struct cross-cache reclaim
• hazel_profile.c, hazel_profile.h strict profile parser and runtime matcher
• profiles/ reviewed and generated firmware profiles
• tools/profile_creator/ Python/uv firmware analyzer and compatible-profile creator
• tools/device_scripts/ optional OTA, Amazon service, and launcher utilities

Requirements

• ADB
• Android NDK r27d
• ADB debugging enabled on the TV
• a host capable of building an ARMv7 Android executable

The examples below assume Linux and that adb is available in $PATH.

Build (optional)

Set NDK to your Android NDK r27d directory:

export NDK=/path/to/android-ndk-r27d

Then compile:

"$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang" \
    --target=armv7a-linux-androideabi28 \
    -O2 -g0 -Wall -Wextra -Wpedantic -fPIE -pie \
    hazel_root.c hazel_profile.c -o hazel_root \
    -pthread

Install

Connect to the TV using ADB.

If using network ADB:

adb connect <TV_IP>:5555

Push the exploit:

adb shell mkdir -p /data/local/tmp/profiles
adb push hazel_root /data/local/tmp/hazel_root
adb shell chmod 755 /data/local/tmp/hazel_root
adb push profiles/. /data/local/tmp/profiles/

Check profile selection without triggering the exploit:

adb shell 'cd /data/local/tmp && ./hazel_root --check-profile'

The loader requires exact matches for ro.product.device, build fingerprint, incremental version, kernel release, and architecture. It refuses malformed profiles, unknown fields, unsupported exploit paths, missing matches, and multiple matching profiles. An explicit profile can be checked with:

adb shell 'cd /data/local/tmp && ./hazel_root --check-profile --profile profiles/PROFILE.conf'

Run

Start from a clean boot:

adb shell 'cd /data/local/tmp && ./hazel_root'

A successful run ends with output similar to:

[root] uid=0 euid=0 gid=0
[ROOT] uid=0 daemon pid=... socket=@hazel_root

The reclaim is probabilistic. An unsuccessful attempt may fail cleanly or panic and reboot the TV.

If the TV reboots, let it boot normally and try again.

Once the exploit succeeds, do not launch another copy. You can close the running process, and proceed with the next commands.

Run commands as root

The same binary acts as a client for the root daemon:

adb shell 'cd /data/local/tmp && ./hazel_root --client id'

For example:

adb shell 'cd /data/local/tmp && ./hazel_root --client getenforce'
adb shell 'cd /data/local/tmp && ./hazel_root --client cat /proc/self/status'
adb shell 'cd /data/local/tmp && ./hazel_root --client "id; uname -a"'

A successful root command should report:

uid=0(root) gid=0(root) context=u:r:shell:s0

Note that UID 0 does not bypass SELinux. SELinux remains Enforcing.

Disable OTA updates

Push and run tools/device_scripts/disable_ota.sh through the root daemon:

adb push tools/device_scripts/disable_ota.sh /data/local/tmp/disable_ota.sh
adb shell chmod 755 /data/local/tmp/disable_ota.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_ota.sh"'

The script disables both Fire OS OTA packages, clears pending updater state, and verifies the resulting Package Manager state. It does not reboot the TV.

Disable Amazon package enforcement, ACR, and metrics

tools/device_scripts/disable_amazon_services.sh disables the Arcus remote-configuration proxy, the ADEP application-blocking service, Automatic Content Recognition (ACR), and the dedicated Amazon metrics packages present on the tested Hazel firmware. ACR is disabled and its stored data is cleared, but its read-only system APK is not deleted, making the operation reversible. The script does not disable CrashManager or the low-level logging packages, so kernel panic and Dropbox diagnostics remain available while developing or troubleshooting the exploit.

Push the script and run it through the root daemon:

adb push tools/device_scripts/disable_amazon_services.sh /data/local/tmp/disable_amazon_services.sh
adb shell chmod 755 /data/local/tmp/disable_amazon_services.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh"'

Show the current state without changing anything:

adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh status"'

Restore the packages later if required:

adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh restore"'

The enabled or disabled package state normally survives a reboot. Restoring the packages does not restore the package data cleared while disabling them.

Launcher helpers

The launcher scripts are also in tools/device_scripts/. To select Projectivy:

adb push tools/device_scripts/set_projectivy_launcher.sh /data/local/tmp/set_projectivy_launcher.sh
adb shell chmod 755 /data/local/tmp/set_projectivy_launcher.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/set_projectivy_launcher.sh"'

To restore the stock launcher:

adb push tools/device_scripts/restore_stock_launcher.sh /data/local/tmp/restore_stock_launcher.sh
adb shell chmod 755 /data/local/tmp/restore_stock_launcher.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/restore_stock_launcher.sh"'

Recovery

Reboot the TV:

adb reboot

The exploit only modifies temporary kernel state, so root is lost after reboot.

Changes deliberately made to persistent Android settings or data while root was active are, of course, not necessarily reverted by rebooting.

Firmware profiles

All 24 Hazel firmware versions currently listed in the firmware archive are represented by profiles in profiles/, from PS7657.3645N through PS7716.5665N. They are all available for automatic selection when the device identity matches.

Toshiba and TCL PS7716

The PS7716 profile was produced from the TCL hazel-tm OTA and then used successfully on the Toshiba AFTHA004. Their complete kernel hashes differ due to generated build data, but the reviewed code, addresses, and structure layouts match.

The loader does not compare the analysis.* hashes at runtime. Toshiba and TCL use the same product, fingerprint, incremental build, kernel release, and architecture, while the marketing model is wildcarded. One PS7716 profile therefore covers both brands.

Older firmware

PS7702.4965N is the current 99% similarity frontier. PS7702 and every later profile passed the strict static-verified path. The older PS7657 through PS7699 profiles required independent relocation, so they are more experimental even though the profile creator found enough evidence to emit profiles for them.

Hardware scope

There is no Toshiba or TCL model check in the exploit. A profile may wildcard the marketing model while retaining exact firmware and kernel identity checks. The design can therefore support any hazel board television whose firmware matches a reviewed profile and whose kernel supports the selected exploit path.

This does not mean that every firmware reporting the hazel codename is automatically compatible. A different kernel layout, CPU topology, allocator behavior, or vendor patch may require another profile or another exploit path. The loader refuses unmatched builds instead of assuming that the shared codename is sufficient.

Do not assume compatibility with an unprofiled hazel device.

If you are interested in porting the exploit, useful target information includes:

adb shell getprop ro.product.model
adb shell getprop ro.product.device
adb shell getprop ro.product.board
adb shell getprop ro.build.version.incremental
adb shell uname -a

Create a profile from firmware

cd tools/profile_creator
uv run python profile_creator.py inspect /path/to/update.bin

To create a profile from a candidate OTA using the reviewed PS7716 profile and firmware as its reference:

uv run python profile_creator.py create /path/to/candidate.bin \
  --template ../../profiles/hazel-PS7716.5665N-5665.conf \
  --reference-firmware /path/to/update-kindle-hazel-tm-PS7716_user_5665.bin \
  --output ../../profiles/candidate.conf

The creator extracts boot.img, decompresses the ARM kernel, extracts IKCONFIG, hashes the boot components, and compares bytes at every address used by the compiled exploit path. It clones addresses only when configuration, image geometry, critical anchors, and whole-image similarity satisfy strict checks. Otherwise it refuses and requires a manual/Ghidra-assisted port.

For divergent kernels, the creator's relocate command writes a static-relocated profile from independently located address candidates and records the supporting evidence in its report. The status distinguishes address relocation from hardware validation of the complete UAF and reclaim path.

Full kernel SHA-256 is retained for provenance but is not used alone for runtime selection: Amazon model builds can differ in generated timestamps and build IDs while retaining identical executable layouts. Runtime selection uses exact Android build properties, followed by task-list anchors once kernel read access has been established.

Technical notes

This is a firmware-specific adaptation of the CVE-2026-43499 exploit chain for the vendor ARM32 Linux 4.9 kernel used by this Fire OS build.

The Hazel-specific work includes:

• adapting the futex-PI chain to the target kernel
• kernel address discovery
• mm_struct SLUB/cache shaping
• cross-cache reclaim using AF_UNIX allocations
• target-specific object and waiter layouts
• forged file operations
• configfs-backed kernel read/write
• task discovery and credential modification

The current exploit therefore should not be treated as a generic CVE-2026-43499 PoC or as a drop-in exploit for arbitrary Fire TV firmware.

Credits

This port was developed using the following public projects and reference material:

• gitchw/ghostlock-cve-2026-43499 ARM32 futex-PI UAF reference and waiter/owner/consumer chain.

• NebuSec/CyberMeowfia IonStack exploit, including the broader forged-fops, kernel read/write, and credential-patching design.

• F-19-F/IonStackQuest3 ARM32 setsockopt(MCAST_JOIN_SOURCE_GROUP) stack-stamping and synchronization reference.

• R0rt1z2/GhostLock-5.10 Additional ARM32 layouts and exploit techniques used while cross-checking the Hazel port.

• Pro-me3us/fire_television_firmware Hazel firmware archive used for compatibility analysis and profile generation.

AI disclosure

An AI coding agent was used during development, particularly to help analyze crash and disassembly data, locate and cross-check target-specific kernel addresses and structure offsets, and assist with debugging and code cleanup.

The exploit itself was tested on the target PS7716.5665N device, and the target-specific values used by the released build were validated against that firmware. AI output was treated as a research aid rather than a source of truth.