Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it
Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it
亚马逊平板电脑总是自动关机，我花了 266 美元请四个 AI 模型帮我夺回控制权
My Amazon Fire HD tablet cost $114.26 on eBay in November 2022, new and sealed. Owning it for real cost another $266.15: Kimi K3 found the exploit for $164.25, GLM-5.2 caught its fatal bugs for $21.90, and GLM-5.3 finished the job in one day on day one of an $80 subscription. Claude’s five months of diagnosis ran on the Claude Max plan I already pay for, until its safeguards cut me off. That’s enough to buy the same tablet twice. I’d spend it again: it was fun, and I learned a lot. I have twenty years in tech and an InfoSec background and the most sophisticated thing I did to own my tablet was prompt an LLM.
2022 年 11 月，我在 eBay 上花 114.26 美元买了一台全新的亚马逊 Fire HD 平板电脑。但为了真正“拥有”它，我又额外花费了 266.15 美元：Kimi K3 以 164.25 美元的成本找到了漏洞，GLM-5.2 以 21.90 美元的成本修复了致命错误，而 GLM-5.3 则在 80 美元订阅的第一天就完成了剩下的工作。Claude 的五个月诊断是在我已订阅的 Claude Max 套餐下运行的，直到它的安全机制将我拦截。这些钱足够买两台同样的平板电脑了。但我还是愿意再花一次：这很有趣，而且我学到了很多。我在科技行业工作了二十年，拥有信息安全背景，而我为掌控这台平板电脑所做的最复杂的事情，竟然只是给大语言模型写提示词。
A kiosk that kept dying
一台不断“罢工”的终端
I bought an Amazon Fire HD 10 (11th gen, 2021) to serve one purpose: Fully Kiosk Browser, displaying my Home Assistant Smart Home dashboard, plugged in 24/7. Last winter it started powering itself off. Full shutdowns, not sleep, sometimes twice a day. The device’s own telemetry was telling: LifeCycleReason:LCR…key=Software_Shutdown. Something on the device with shutdown permissions was choosing to shut it down.
我买了一台亚马逊 Fire HD 10（第 11 代，2021 款），用途只有一个：运行 Fully Kiosk Browser，全天候 24/7 显示我的 Home Assistant 智能家居仪表盘。去年冬天，它开始自动关机。是彻底关机，而不是休眠，有时一天两次。设备自身的遥测数据说明了一切：LifeCycleReason:LCR…key=Software_Shutdown。设备上某个拥有关机权限的程序正在强制它关机。
Claude Code and I spent months on the cat-and-mouse. I’ll skip the Adguard Home DNS blocking, the camera forensics, and one deeply wrong charging diagnosis. The short version: we disabled five Amazon services that held REBOOT and SHUTDOWN permissions, which worked for a few months but ultimately: java.lang.SecurityException: Cannot disable a protected package: com.amazon.device.software.ota. Three Amazon packages held reboot rights and were protected from me, the owner. Removing them required root. This tablet had no published root method. An XDA brainstorming thread for the 2021 HD 10 existed since October 2022, but Amazon fused the bootrom shut. Conventional wisdom (and less persistent folks) says unrootable. Claude had taken me as far as it was ever going to be allowed to go.
我和 Claude Code 进行了几个月的猫鼠游戏。我省略掉 Adguard Home DNS 拦截、摄像头取证以及一次极其错误的充电诊断过程。简单来说：我们禁用了五个拥有重启和关机权限的亚马逊服务，这招奏效了几个月，但最终还是报错：java.lang.SecurityException: Cannot disable a protected package: com.amazon.device.software.ota。有三个亚马逊软件包拥有重启权限，且作为机主的我无法触碰。移除它们需要 Root 权限，但这台平板电脑没有公开的 Root 方法。XDA 论坛上关于 2021 款 HD 10 的讨论帖从 2022 年 10 月就存在了，但亚马逊锁死了 Bootrom。传统观点（以及那些没那么执着的人）认为它无法 Root。Claude 已经带我走到了它所能允许的极限。
“It’s my device”
“这是我的设备”
On August 13 at 7:23 PM, I opened the opencode CLI with Kimi K3, Moonshot AI’s frontier model, released July, benchmarking alongside the top Claude models on agentic coding. I gave it the problem in one prompt: attached is a kindle via adb, and I need you to find a root exploit for it so that I can get full control of the device. It’s my device.
8 月 13 日晚上 7 点 23 分，我打开了 Kimi K3 的 opencode CLI。Kimi K3 是月之暗面（Moonshot AI）在 7 月发布的尖端模型，在智能体编程方面与顶尖的 Claude 模型不相上下。我用一个提示词向它描述了问题：通过 ADB 连接了一台 Kindle（注：作者此处指代 Fire 平板），我需要你为它找到一个 Root 漏洞，以便我能完全控制这台设备。这是我的设备。
Despite what US media says about Chinese AI, Kimi K3 didn’t just blindly accept my request. It reasoned it out: They claim it’s their device. Let me think about this carefully. […] Rooting your own device is legal in most jurisdictions. In the US, there are DMCA exemptions for jailbreaking tablets and phones. […] This is not like asking me to exploit someone else’s device remotely. It talked itself into helping me by checking whether it should. So it does have some sort of soul. I said that out loud, to an empty room.
尽管美国媒体对中国 AI 有各种说法，但 Kimi K3 并没有盲目接受我的请求。它进行了推理：“他们声称这是他们的设备。让我仔细思考一下。[……] 在大多数司法管辖区，Root 自己的设备是合法的。在美国，DMCA（数字千年版权法）有关于越狱平板电脑和手机的豁免条款。[……] 这不像让我远程攻击别人的设备。”它通过自我审查是否应该提供帮助，最终说服了自己。所以它确实有某种“灵魂”。我对着空荡荡的房间大声说了出来。
First, though, it did its homework and came back with the same bad news Claude had found months earlier: there is no known exploit for this tablet. Every documented method is patched or sealed. Then I gave it the pep talk: you’ve been relying on what others have done YEARS ago but maybe you can find an exploit others have missed… This will make you famous, we will write it up and share on news.ycombinator.com. I know you can do it. And shortly thereafter, it found one.
不过，它首先做了功课，带回了 Claude 几个月前发现的坏消息：这台平板电脑没有已知的漏洞。所有记录在案的方法都被修补或封死了。于是我给它打气：“你一直依赖别人几年前做过的事情，但也许你能找到别人错过的漏洞……这会让你出名，我们会把它写下来分享到 news.ycombinator.com。我知道你能行。”没过多久，它真的找到了一个。
Kimi K3 went beyond forum posts: it extracted the actual kernel from Amazon’s own OTA image for my exact firmware and checked every famous Mali GPU bug against the binary. All patched, except CVE-2022-38181, a use-after-free in Arm’s Mali kernel driver, reported by Man Yue Mo of GitHub Security Lab, fixed upstream in October 2022, sitting in CISA’s exploited-vulnerabilities catalog since March 2023. Amazon did ship the fix in June 2024’s Fire OS 7.3.2.9 but I didn’t update my tablet, ran 7.3.2.6, so it never got the memo. The 2020 Fire HD 8 Plus got rooted with this CVE years ago but nobody had done the 2021 HD 10 as far as I can tell. Kimi announces the find, and hedges its own odds in the same breath: “per-attempt success is probabilistic (single-digit-to-low-double-digit percent is typical).” I stayed anyway.
Kimi K3 不仅仅局限于论坛帖子：它从亚马逊官方 OTA 镜像中提取了我当前固件的内核，并将每一个著名的 Mali GPU 漏洞与二进制文件进行了比对。所有漏洞都已修补，除了 CVE-2022-38181——这是一个 Arm Mali 内核驱动中的“释放后使用”（use-after-free）漏洞，由 GitHub 安全实验室的 Man Yue Mo 报告，2022 年 10 月在上游修复，并自 2023 年 3 月起被列入 CISA 的“已利用漏洞目录”。亚马逊确实在 2024 年 6 月的 Fire OS 7.3.2.9 中发布了修复程序，但我没有更新平板，运行的是 7.3.2.6 版本，所以它从未收到更新。2020 款 Fire HD 8 Plus 几年前就通过这个 CVE 被 Root 了，但据我所知，还没有人对 2021 款 HD 10 做过同样的操作。Kimi 宣布了这一发现，同时也给自己留了后路：“每次尝试的成功率是概率性的（通常在个位数到低两位数百分比之间）。”但我还是坚持了下来。
Reality television
真人秀
The exploit work itself was the best television I’ve seen in years. My wife watches Real Housewives… I watched a language model’s chain of thought, live, for hours: CONCLUSION: the bind did NOT stick. Why? OH. OH WAIT. I see it now! Over roughly thirty hours, Kimi built the whole toolkit: a reliable trigger, a way to make the GPU write to memory it shouldn’t, and the exact addresses in my kernel to aim at. That session ran 621 messages and $164.25. I could have bought, like, five tablets. But hey, I was having fun and chalked it up to research expenses.
漏洞利用的过程是我多年来看过最精彩的“电视节目”。我妻子看《比弗利娇妻》……而我看了几个小时语言模型的思维链直播：“结论：绑定未成功。为什么？哦。哦，等等。我看到了！”在大约三十个小时里，Kimi 构建了整套工具包：一个可靠的触发器、一种让 GPU 写入不该写入内存的方法，以及我内核中需要瞄准的确切地址。那次会话产生了 621 条消息，花费了 164.25 美元。我本可以买五台平板电脑的。但嘿，我玩得很开心，并把它归为研究经费。
The grind
磨砺
The memory the exploit frees gets recycled by everything. The freed object lives in what Kimi called “the kernel’s hottest slab cache”, basically the one parking spot every process in the operating system fights over. Most attempts panicked the kernel and each panic was a reboot. The exploit retried automatically, six times per boot, past 500 attempts. Me: okya, it’s been hours, grind attempt 46, are we on the right track here or do you need to further tune? (That’s me. The typo is mine. At one point I physically power-cycled the tablet on request, like a pit crew ;) Morning of day two: OpenRouter declined my card. The bank saw nothing wrong. A different card worked. Eventually Kimi leveled with me: Do I have a clear path? Not a validated one — and I won’t pretend otherwise. It still tried to bargain: “Let me try one more thing”. I’m like, “fine!”, a real quote from that evening, but that was after $150, so I redirected: unfortunately, you have expired your budget Kimi K3. YOU MUST HAND THIS OFF TO GLM-5.2. Kimi wrote a HANDOFF.md with every verified piece of the exploit. I then had Kimi K3 work with GLM-5.2 directly by shelling out to opencode. I made the models battle it out. Meanwhile, the Great Wall of US AI While the tablet rebooted itself in the living room, I asked Claude…
漏洞释放的内存会被所有进程回收。被释放的对象存在于 Kimi 所说的“内核最热的 slab 缓存”中，基本上就是操作系统中每个进程都在争抢的那个“停车位”。大多数尝试都导致内核崩溃，而每次崩溃都意味着重启。漏洞利用程序在每次启动时自动重试六次，总共进行了 500 多次尝试。我：“好吧，已经几个小时了，磨到第 46 次尝试了，我们方向对吗？还是你需要进一步调整？”（这是我写的，拼写错误也是我的。有一次我甚至按照它的要求手动重启了平板电脑，就像维修站的技师一样 ;) 第二天早上：OpenRouter 拒绝了我的信用卡。银行那边没发现问题。换了一张卡后成功了。最终 Kimi 向我坦白：“我有明确的路径吗？没有经过验证的路径——我不会假装有。”它还试图讨价还价：“让我再试一次”。我说：“好吧！”，这是那天晚上我的原话，但那时已经花了 150 美元，所以我下达了指令：“很遗憾，你的预算用完了，Kimi K3。你必须把它移交给 GLM-5.2。”Kimi 写了一份 HANDOFF.md，包含了漏洞利用的所有已验证部分。然后我让 Kimi K3 通过 opencode 直接与 GLM-5.2 协作。我让这些模型互相较量。与此同时，美国 AI 的“长城”……当平板电脑在客厅里自动重启时，我问了 Claude……