# raxone/amlogic-exploit architecture

> Architecture diagram of the GitHub repository raxone/amlogic-exploit, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/raxone/amlogic-exploit
- Repository: https://github.com/raxone/amlogic-exploit

## Overview

This repository is a family of Amlogic BL31 exploit and memory-dump tools, with separate builds for S905X2, S905X3, and S922X DDR/firmware variants. The documented workflow is to load the kernel module, run the matching command-line tool, and write selected BootROM, OTP, or SRAM contents to files. The sampled entry points also show a storage-parser exploit using encrypted storage data and an SMC call. Variant nodes cover their corresponding source directories; exploit internals beyond the excerpts and the kernel-module-to-tool interface are not fully evidenced.

Main entry points: [`s905x2/main_s905x2_DDR_11`](https://github.com/raxone/amlogic-exploit/tree/main/s905x2/main_s905x2_DDR_11) (DDR 11 tool), [`s905x3/main_s905x3_DDR_17_sabrina`](https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_17_sabrina) (DDR 17 tool), [`s922x/main_s922z_DDR_12_raven`](https://github.com/raxone/amlogic-exploit/tree/main/s922x/main_s922z_DDR_12_raven) (DDR 12 tool), [`s905x2/main_s905x2_DDR_7`](https://github.com/raxone/amlogic-exploit/tree/main/s905x2/main_s905x2_DDR_7) (DDR 7 tool)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_s905x2["S905X2 variants"]
  node_cli_x2_ddr11["DDR 11 tool"]
  node_cli_x2_ddr7["DDR 7 tool"]
end

subgraph group_s905x3["S905X3 variants"]
  node_cli_x3_ddr17["DDR 17 tool"]
  node_cli_x3_ddr18["DDR 18 tool"]
  node_cli_x3_ddr21["DDR 21 tool"]
  node_cli_x3_ddr22["DDR 22 tool"]
  node_cli_x3_ddr26["DDR 26 tool"]
end

subgraph group_s922x["S922X variant"]
  node_cli_s922["DDR 12 tool"]
end

subgraph group_kernel["Kernel exploit modules"]
  node_kmod_x2["S905X2 module<br/>[khax.c]"]
  node_kmod_x3["S905X3 module<br/>[khax.c]"]
  node_kmod_s922["S922X module<br/>[khax.c]"]
end

node_user(("Device operator"))
node_soc["Amlogic target"]
node_mem[("Target memory")]
node_dumpfiles["Dump files"]

node_user -->|"runs commands"| node_cli_x2_ddr11
node_user -->|"runs commands"| node_cli_x2_ddr7
node_user -->|"runs commands"| node_cli_x3_ddr17
node_user -->|"runs commands"| node_cli_x3_ddr18
node_user -->|"runs commands"| node_cli_x3_ddr21
node_user -->|"runs commands"| node_cli_x3_ddr22
node_user -->|"runs commands"| node_cli_x3_ddr26
node_user -->|"runs commands"| node_cli_s922
node_cli_x2_ddr11 -.->|"issues SMC"| node_soc
node_cli_x2_ddr7 -.->|"issues SMC"| node_soc
node_cli_x3_ddr17 -.->|"issues SMC"| node_soc
node_cli_x3_ddr18 -.->|"issues SMC"| node_soc
node_cli_x3_ddr21 -.->|"issues SMC"| node_soc
node_cli_x3_ddr22 -.->|"issues SMC"| node_soc
node_cli_x3_ddr26 -.->|"issues SMC"| node_soc
node_cli_s922 -.->|"issues SMC"| node_soc
node_soc -.->|"exposes regions"| node_mem
node_mem -->|"dumped to"| node_dumpfiles
node_user -->|"loads module"| node_kmod_x2
node_user -->|"loads module"| node_kmod_x3
node_user -->|"loads module"| node_kmod_s922
node_kmod_x2 -.->|"enables exploit"| node_cli_x2_ddr11
node_kmod_x3 -.->|"enables exploit"| node_cli_x3_ddr17
node_kmod_s922 -.->|"enables exploit"| node_cli_s922

click node_cli_x2_ddr11 "https://github.com/raxone/amlogic-exploit/tree/main/s905x2/main_s905x2_DDR_11"
click node_cli_x2_ddr7 "https://github.com/raxone/amlogic-exploit/tree/main/s905x2/main_s905x2_DDR_7"
click node_cli_x3_ddr17 "https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_17_sabrina"
click node_cli_x3_ddr18 "https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_18"
click node_cli_x3_ddr21 "https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_21"
click node_cli_x3_ddr22 "https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_22"
click node_cli_x3_ddr26 "https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_26"
click node_cli_s922 "https://github.com/raxone/amlogic-exploit/tree/main/s922x/main_s922z_DDR_12_raven"
click node_kmod_x2 "https://github.com/raxone/amlogic-exploit/blob/main/s905x2/lkm_module/khax.c"
click node_kmod_x3 "https://github.com/raxone/amlogic-exploit/blob/main/s905x3/lkm_module/khax.c"
click node_kmod_s922 "https://github.com/raxone/amlogic-exploit/blob/main/s922x/lkm_module/khax.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli_x2_ddr11,node_cli_x2_ddr7 toneBlue
class node_cli_x3_ddr17,node_cli_x3_ddr18,node_cli_x3_ddr21,node_cli_x3_ddr22,node_cli_x3_ddr26,node_mem toneAmber
class node_cli_s922 toneMint
class node_kmod_x2,node_kmod_x3,node_kmod_s922 toneRose
class node_user,node_soc,node_dumpfiles toneIndigo
```

## Components

### S905X2 variants

- [DDR 11 tool](https://github.com/raxone/amlogic-exploit/tree/main/s905x2/main_s905x2_DDR_11): `s905x2/main_s905x2_DDR_11`
- [DDR 7 tool](https://github.com/raxone/amlogic-exploit/tree/main/s905x2/main_s905x2_DDR_7): `s905x2/main_s905x2_DDR_7`

### S905X3 variants

- [DDR 17 tool](https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_17_sabrina): `s905x3/main_s905x3_DDR_17_sabrina`
- [DDR 18 tool](https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_18): `s905x3/main_s905x3_DDR_18`
- [DDR 21 tool](https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_21): `s905x3/main_s905x3_DDR_21`
- [DDR 22 tool](https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_22): `s905x3/main_s905x3_DDR_22`
- [DDR 26 tool](https://github.com/raxone/amlogic-exploit/tree/main/s905x3/main_s905x3_DDR_26): `s905x3/main_s905x3_DDR_26`

### S922X variant

- [DDR 12 tool](https://github.com/raxone/amlogic-exploit/tree/main/s922x/main_s922z_DDR_12_raven): `s922x/main_s922z_DDR_12_raven`

### Kernel exploit modules

- [S905X2 module](https://github.com/raxone/amlogic-exploit/blob/main/s905x2/lkm_module/khax.c): `s905x2/lkm_module/khax.c`
- [S905X3 module](https://github.com/raxone/amlogic-exploit/blob/main/s905x3/lkm_module/khax.c): `s905x3/lkm_module/khax.c`
- [S922X module](https://github.com/raxone/amlogic-exploit/blob/main/s922x/lkm_module/khax.c): `s922x/lkm_module/khax.c`

### Other components

- **Device operator**
- **Amlogic target**
- **Target memory**
- **Dump files**

## Connections

- Device operator → DDR 11 tool: runs commands
- Device operator → DDR 7 tool: runs commands
- Device operator → DDR 17 tool: runs commands
- Device operator → DDR 18 tool: runs commands
- Device operator → DDR 21 tool: runs commands
- Device operator → DDR 22 tool: runs commands
- Device operator → DDR 26 tool: runs commands
- Device operator → DDR 12 tool: runs commands
- DDR 11 tool → Amlogic target: issues SMC
- DDR 7 tool → Amlogic target: issues SMC
- DDR 17 tool → Amlogic target: issues SMC
- DDR 18 tool → Amlogic target: issues SMC
- DDR 21 tool → Amlogic target: issues SMC
- DDR 22 tool → Amlogic target: issues SMC
- DDR 26 tool → Amlogic target: issues SMC
- DDR 12 tool → Amlogic target: issues SMC
- Amlogic target → Target memory: exposes regions
- Target memory → Dump files: dumped to
- Device operator → S905X2 module: loads module
- Device operator → S905X3 module: loads module
- Device operator → S922X module: loads module
- S905X2 module → DDR 11 tool: enables exploit
- S905X3 module → DDR 17 tool: enables exploit
- S922X module → DDR 12 tool: enables exploit