Codex Assists in Achieving Persistent Root on Echo Plus 2

The author speckx used OpenAI's coding agent Codex (running the GPT-6 Sol model) to obtain persistent root access on an Echo Plus 2, which automatically recovers after a normal cold boot. The device enters BootROM mode via the 6 external contacts on the bottom of the body; MTKClient reports hardware code 0x8167, and its Kamakiri method worked out of the box on the author's machine. The full code and step-by-step reproduction guide are in the project repository. speckx says the experiment consumed about $200 of OpenAI compute credits, but other experiments were run during the same period, so the bill cannot be attributed entirely to this project. A factory reset wipes apps and helper programs, requiring the BootROM stage to be redone; the helper restores core_pattern after startup, but in the demonstrated chain SELinux remains globally in Permissive mode.

AI overview based on source reports · Updated 3 days ago