[userbinator]

I'm not familiar with the S5 in particular but in principle I think all you need to do is get direct write access to the filesystem and you can write whatever firmware you want, so being able to read/write the eMMC directly should be enough --- provided it's not been encrypted/password protected/etc. Correct me if I'm wrong.

[talonstriker]

On most (if not all), the "firmware" is under the /system partition. That partition is mounted as read-only. You need root to remount it as r/w.

AFAIK, rooting exploits in the past took advantage of buffer overflows and remote code exploits to execute code at a raised privilege levels. Now a days, that's also difficult since past vulnerabilities have been fixed and the proliferation of SE Linux.