# mitschud/dirtyfrag architecture

> Architecture diagram of the GitHub repository mitschud/dirtyfrag, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mitschud/dirtyfrag
- Repository: https://github.com/mitschud/dirtyfrag

## Overview

DirtyFrag is an Android app for obtaining temporary root on vulnerable devices through the DirtyFrag kernel exploit, with KernelSU integration and Samsung download-mode controls. The main path is user-triggered (or optional boot-triggered) execution: the app configures an IPsec transform and runs native exploit code, which patches a library to trigger a kernel-module load; KernelSU then supplies root. Separate branches report root state, manage Samsung vault authorization, and expose settings and logs. Some native and post-exploit details are documented only at a high level; their links are shown only where the README supports them.

Main entry points: [`app/src/main/java/df/root/MainActivity.java`](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/MainActivity.java) (Main activity), [`app/src/main/jni/exp.c`](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/exp.c) (Exploit binary), [`app/src/main/java/df/root/ExploitRunner.java`](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/ExploitRunner.java) (Exploit runner), [`app/src/main/java/df/d2/Harness.java`](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/d2/Harness.java) (Vault harness)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_app["Android app"]
  node_activity["Main activity<br/>[MainActivity.java]"]
  node_binding["Activity binding"]
  node_cards["Card stack"]
  node_boot["Boot autorun<br/>[BootReceiver.java]"]
  node_reporter["Run reporter<br/>[IReporter.java]"]
end

subgraph group_exploit["Exploit runtime"]
  node_runner["Exploit runner<br/>[ExploitRunner.java]"]
  node_native["Exploit binary<br/>[exp.c]"]
  node_aes["AES routines<br/>[aes256.h]"]
  node_splice["Splice helper<br/>[splicehelper.c]"]
  node_elf["ELF parser<br/>[elf_parser.c]"]
  node_selector["Module selector<br/>[ko_select.h]"]
end

subgraph group_root["Root integration"]
  node_bootstrap["Root bootstrap<br/>[bootstrap.c]"]
  node_kernelmodule["Kernel module<br/>[dfroot.c]"]
  node_rootstate["Root state<br/>[RootState.java]"]
end

subgraph group_odin["Odin controls"]
  node_d2status["Odin status<br/>[D2Status.java]"]
  node_d2writer["Vault writer<br/>[D2Writer.java]"]
  node_harness["Vault harness<br/>[Harness.java]"]
  node_record["Vault record<br/>[DmcRecord.java]"]
  node_diagnostics["D2 diagnostics<br/>[Diagnostics.java]"]
end

node_user(("User"))
node_ipsec["Android IPsec"]
node_ksu["SU manager"]

node_user -->|"starts and configures"| node_activity
node_activity -->|"inflates"| node_binding
node_activity -->|"runs exploit"| node_runner
node_activity -->|"configures cards"| node_cards
node_boot -->|"runs on boot"| node_runner
node_runner -->|"creates transform"| node_ipsec
node_runner -->|"executes binary"| node_native
node_native -->|"uses routines"| node_aes
node_native -->|"selects module"| node_selector
node_native -.->|"uses splice primitive"| node_splice
node_native -.->|"uses ELF parsing"| node_elf
node_native -.->|"triggers shellcode"| node_bootstrap
node_bootstrap -.->|"loads module"| node_kernelmodule
node_kernelmodule -.->|"enables root integration"| node_ksu
node_activity -->|"checks run state"| node_rootstate
node_runner -->|"reports progress"| node_reporter
node_activity -->|"reads Odin status"| node_d2status
node_activity -->|"writes vault authorization"| node_d2writer
node_boot -->|"rearms authorization"| node_d2writer
node_d2writer -.->|"invokes helper"| node_harness
node_harness -->|"interprets record"| node_record
node_harness -->|"uses diagnostics"| node_diagnostics

click node_activity "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/MainActivity.java"
click node_binding "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/ActivityMainBinding.java"
click node_cards "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/CardStackLayout.java"
click node_boot "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/BootReceiver.java"
click node_runner "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/ExploitRunner.java"
click node_native "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/exp.c"
click node_aes "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/aes256.h"
click node_splice "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/splicehelper.c"
click node_elf "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/elf_parser.c"
click node_selector "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/ko_select.h"
click node_bootstrap "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/bootstrap.c"
click node_kernelmodule "https://github.com/mitschud/dirtyfrag/blob/master/lkm/dfroot.c"
click node_rootstate "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/RootState.java"
click node_reporter "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/IReporter.java"
click node_d2status "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/D2Status.java"
click node_d2writer "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/D2Writer.java"
click node_harness "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/d2/Harness.java"
click node_record "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/d2/DmcRecord.java"
click node_diagnostics "https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/d2/Diagnostics.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_activity,node_binding,node_cards,node_boot,node_reporter,node_user toneBlue
class node_runner,node_native,node_aes,node_splice,node_elf,node_selector toneAmber
class node_bootstrap,node_kernelmodule,node_rootstate toneMint
class node_d2status,node_d2writer,node_harness,node_record,node_diagnostics toneRose
class node_ipsec,node_ksu toneIndigo
```

## Components

### Android app

- [Main activity](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/MainActivity.java): `app/src/main/java/df/root/MainActivity.java`
- [Activity binding](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/ActivityMainBinding.java): `app/src/main/java/df/root/ActivityMainBinding.java`
- [Card stack](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/CardStackLayout.java): `app/src/main/java/df/root/CardStackLayout.java`
- [Boot autorun](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/BootReceiver.java): `app/src/main/java/df/root/BootReceiver.java`
- [Run reporter](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/IReporter.java): `app/src/main/java/df/root/IReporter.java`

### Exploit runtime

- [Exploit runner](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/ExploitRunner.java): `app/src/main/java/df/root/ExploitRunner.java`
- [Exploit binary](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/exp.c): `app/src/main/jni/exp.c`
- [AES routines](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/aes256.h): `app/src/main/jni/aes256.h`
- [Splice helper](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/splicehelper.c): `app/src/main/jni/splicehelper.c`
- [ELF parser](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/elf_parser.c): `app/src/main/jni/elf_parser.c`
- [Module selector](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/ko_select.h): `app/src/main/jni/ko_select.h`

### Root integration

- [Root bootstrap](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/jni/bootstrap.c): `app/src/main/jni/bootstrap.c`
- [Kernel module](https://github.com/mitschud/dirtyfrag/blob/master/lkm/dfroot.c): `lkm/dfroot.c`
- [Root state](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/RootState.java): `app/src/main/java/df/root/RootState.java`

### Odin controls

- [Odin status](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/D2Status.java): `app/src/main/java/df/root/D2Status.java`
- [Vault writer](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/root/D2Writer.java): `app/src/main/java/df/root/D2Writer.java`
- [Vault harness](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/d2/Harness.java): `app/src/main/java/df/d2/Harness.java`
- [Vault record](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/d2/DmcRecord.java): `app/src/main/java/df/d2/DmcRecord.java`
- [D2 diagnostics](https://github.com/mitschud/dirtyfrag/blob/master/app/src/main/java/df/d2/Diagnostics.java): `app/src/main/java/df/d2/Diagnostics.java`

### Other components

- **User**
- **Android IPsec**
- **SU manager**

## Connections

- User → Main activity: starts and configures (evidence: `README.md`)
- Main activity → Activity binding: inflates (evidence: `app/src/main/java/df/root/MainActivity.java`)
- Main activity → Exploit runner: runs exploit (evidence: `app/src/main/java/df/root/MainActivity.java`)
- Main activity → Card stack: configures cards (evidence: `app/src/main/java/df/root/MainActivity.java`)
- Boot autorun → Exploit runner: runs on boot (evidence: `app/src/main/java/df/root/BootReceiver.java`)
- Exploit runner → Android IPsec: creates transform (evidence: `app/src/main/java/df/root/ExploitRunner.java`)
- Exploit runner → Exploit binary: executes binary (evidence: `app/src/main/java/df/root/ExploitRunner.java`)
- Exploit binary → AES routines: uses routines (evidence: `app/src/main/jni/exp.c`)
- Exploit binary → Module selector: selects module (evidence: `app/src/main/jni/exp.c`)
- Exploit binary → Splice helper: uses splice primitive
- Exploit binary → ELF parser: uses ELF parsing
- Exploit binary → Root bootstrap: triggers shellcode (evidence: `README.md`)
- Root bootstrap → Kernel module: loads module (evidence: `README.md`)
- Kernel module → SU manager: enables root integration (evidence: `README.md`)
- Main activity → Root state: checks run state (evidence: `app/src/main/java/df/root/MainActivity.java`)
- Exploit runner → Run reporter: reports progress (evidence: `app/src/main/java/df/root/ExploitRunner.java`)
- Main activity → Odin status: reads Odin status (evidence: `app/src/main/java/df/root/MainActivity.java`)
- Main activity → Vault writer: writes vault authorization (evidence: `app/src/main/java/df/root/MainActivity.java`)
- Boot autorun → Vault writer: rearms authorization (evidence: `app/src/main/java/df/root/BootReceiver.java`)
- Vault writer → Vault harness: invokes helper
- Vault harness → Vault record: interprets record (evidence: `app/src/main/java/df/d2/Harness.java`)
- Vault harness → D2 diagnostics: uses diagnostics (evidence: `app/src/main/java/df/d2/Harness.java`)