raxone/amlogic-exploit

How raxone/amlogic-exploit works

This repository is a family of Amlogic BL31 exploit and memory-dump tools, with separate builds for S905X2, S905X3, and S922X DDR/firmware variants. The documented workflow is to load the kernel module, run the matching command-line tool, and write selected BootROM, OTP, or SRAM contents to files. The sampled entry points also show a storage-parser exploit using encrypted storage data and an SMC call. Variant nodes cover their corresponding source directories; exploit internals beyond the excerpts and the kernel-module-to-tool interface are not fully evidenced.

Main entry points: main_s905x2_DDR_11 DDR 11 tool · main_s905x3_DDR_17_sabrina DDR 17 tool · main_s922z_DDR_12_raven DDR 12 tool · main_s905x2_DDR_7 DDR 7 tool

Components 15

S905X2 variants

DDR 11 tool s905x2/main_s905x2_DDR_11
DDR 7 tool s905x2/main_s905x2_DDR_7

S905X3 variants

DDR 17 tool s905x3/main_s905x3_DDR_17_sabrina
DDR 18 tool s905x3/main_s905x3_DDR_18
DDR 21 tool s905x3/main_s905x3_DDR_21
DDR 22 tool s905x3/main_s905x3_DDR_22
DDR 26 tool s905x3/main_s905x3_DDR_26

S922X variant

DDR 12 tool s922x/main_s922z_DDR_12_raven

Kernel exploit modules

S905X2 module s905x2/lkm_module/khax.c
S905X3 module s905x3/lkm_module/khax.c
S922X module s922x/lkm_module/khax.c

Other components

Device operator
Amlogic target
Target memory
Dump files

Connections 24

Device operator → DDR 11 tool: runs commands
Device operator → DDR 7 tool: runs commands
Device operator → DDR 17 tool: runs commands
Device operator → DDR 18 tool: runs commands
Device operator → DDR 21 tool: runs commands
Device operator → DDR 22 tool: runs commands
Device operator → DDR 26 tool: runs commands
Device operator → DDR 12 tool: runs commands
DDR 11 tool → Amlogic target: issues SMC
DDR 7 tool → Amlogic target: issues SMC
DDR 17 tool → Amlogic target: issues SMC
DDR 18 tool → Amlogic target: issues SMC
DDR 21 tool → Amlogic target: issues SMC
DDR 22 tool → Amlogic target: issues SMC
DDR 26 tool → Amlogic target: issues SMC
DDR 12 tool → Amlogic target: issues SMC
Amlogic target → Target memory: exposes regions
Target memory → Dump files: dumped to
Device operator → S905X2 module: loads module
Device operator → S905X3 module: loads module
Device operator → S922X module: loads module
S905X2 module → DDR 11 tool: enables exploit
S905X3 module → DDR 17 tool: enables exploit
S922X module → DDR 12 tool: enables exploit

Drawn by GitDiagram on November 10, 2026 from the repository's file tree, README and source files. Read as Markdown ·