How mitschud/dirtyfrag works
DirtyFrag is an Android app for obtaining temporary root on vulnerable devices through the DirtyFrag kernel exploit, with KernelSU integration and Samsung download-mode controls. The main path is user-triggered (or optional boot-triggered) execution: the app configures an IPsec transform and runs native exploit code, which patches a library to trigger a kernel-module load; KernelSU then supplies root. Separate branches report root state, manage Samsung vault authorization, and expose settings and logs. Some native and post-exploit details are documented only at a high level; their links are shown only where the README supports them.
Main entry points: MainActivity.java Main activity · exp.c Exploit binary · ExploitRunner.java Exploit runner · Harness.java Vault harness
Components 22
Android app
- Main activity
app/src/main/java/df/root/MainActivity.java - Activity binding
app/src/main/java/df/root/ActivityMainBinding.java - Card stack
app/src/main/java/df/root/CardStackLayout.java - Boot autorun
app/src/main/java/df/root/BootReceiver.java - Run reporter
app/src/main/java/df/root/IReporter.java
Exploit runtime
- Exploit runner
app/src/main/java/df/root/ExploitRunner.java - Exploit binary
app/src/main/jni/exp.c - AES routines
app/src/main/jni/aes256.h - Splice helper
app/src/main/jni/splicehelper.c - ELF parser
app/src/main/jni/elf_parser.c - Module selector
app/src/main/jni/ko_select.h
Root integration
- Root bootstrap
app/src/main/jni/bootstrap.c - Kernel module
lkm/dfroot.c - Root state
app/src/main/java/df/root/RootState.java
Odin controls
- Odin status
app/src/main/java/df/root/D2Status.java - Vault writer
app/src/main/java/df/root/D2Writer.java - Vault harness
app/src/main/java/df/d2/Harness.java - Vault record
app/src/main/java/df/d2/DmcRecord.java - D2 diagnostics
app/src/main/java/df/d2/Diagnostics.java
Other components
- User
- Android IPsec
- SU manager
Connections 22
- User → Main activity: starts and configures
README.md - Main activity → Activity binding: inflates
app/src/main/java/df/root/MainActivity.java - Main activity → Exploit runner: runs exploit
app/src/main/java/df/root/MainActivity.java - Main activity → Card stack: configures cards
app/src/main/java/df/root/MainActivity.java - Boot autorun → Exploit runner: runs on boot
app/src/main/java/df/root/BootReceiver.java - Exploit runner → Android IPsec: creates transform
app/src/main/java/df/root/ExploitRunner.java - Exploit runner → Exploit binary: executes binary
app/src/main/java/df/root/ExploitRunner.java - Exploit binary → AES routines: uses routines
app/src/main/jni/exp.c - Exploit binary → Module selector: selects module
app/src/main/jni/exp.c - Exploit binary → Splice helper: uses splice primitive
- Exploit binary → ELF parser: uses ELF parsing
- Exploit binary → Root bootstrap: triggers shellcode
README.md - Root bootstrap → Kernel module: loads module
README.md - Kernel module → SU manager: enables root integration
README.md - Main activity → Root state: checks run state
app/src/main/java/df/root/MainActivity.java - Exploit runner → Run reporter: reports progress
app/src/main/java/df/root/ExploitRunner.java - Main activity → Odin status: reads Odin status
app/src/main/java/df/root/MainActivity.java - Main activity → Vault writer: writes vault authorization
app/src/main/java/df/root/MainActivity.java - Boot autorun → Vault writer: rearms authorization
app/src/main/java/df/root/BootReceiver.java - Vault writer → Vault harness: invokes helper
- Vault harness → Vault record: interprets record
app/src/main/java/df/d2/Harness.java - Vault harness → D2 diagnostics: uses diagnostics
app/src/main/java/df/d2/Harness.java