How yukonga/ghostlock-app works
GhostLock is an Android kernel-exploit application with a companion kernel-profile extractor. The main workflow is user Run → UI/repository → resolve a release-specific profile → send its binary document to the native runner → dispatch a catalogued frontend/backend/route pipeline. Profile import, editing, and OTA/image offset extraction are separate supporting capabilities. Some native and app implementation details were not excerpted; edges below are limited to README statements, excerpts, and SOURCE INDEX references.
Main entry points: AndroidProfileConfigController.kt Profile controller · AndroidGhostlockRepository.kt App repository · main.rs Extractor CLI · pipeline.hpp Pipeline runner
Components 25
Android app
- Main activity
app/src/main/kotlin/com/ghostlock/app/ui/MainActivity.kt - Run and profile UI
app/src/main/kotlin/com/ghostlock/app/ui/GhostlockViewModel.kt - App repository
app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt - Shizuku runner
app/src/main/kotlin/com/ghostlock/app/shizuku/ShizukuExploitRunner.kt - Shell service
app/src/main/kotlin/com/ghostlock/app/shizuku/GhostlockUserService.kt
Profile configuration
- Profile controller
app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt - Imported profiles
app/src/main/kotlin/com/ghostlock/app/data/UserProfileStore.kt - Bundled profiles
app/src/main/kotlin/com/ghostlock/app/data/AssetConfigLoader.kt - HOCON codec
profile-core/src/main/kotlin/com/ghostlock/app/data/HoconSupport.kt - Profile merger
profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileMerger.kt - Profile resolver
profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileResolver.kt - Profile export
profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileExporter.kt
Native execution
- Native entrypoint
src/core/main.cpp - Pipeline orchestrator
src/core/route/orchestrator.hpp - Pipeline runner
src/core/route/pipeline.hpp - Exploit backend
src/core/session/backend/cve_2026_43499_backend.cpp - Root handoff
src/core/session/root_child_frontend.cpp - Race middleware
src/core/route/route_controller.cpp - Route policy
src/core/route/route_policy.hpp
Offset extraction
- Extractor CLI
tools/extract_rs/src/main.rs - Offset derivation
tools/extract_rs/src/derive.rs - Profile report
tools/extract_rs/src/report.rs
Other components
- User
- OTA or boot image
- Candidate profile
Connections 26
- User → Main activity: opens and runs
README.md - Main activity → Run and profile UI: hosts
app/src/main/kotlin/com/ghostlock/app/ui/MainActivity.kt - Run and profile UI → App repository: requests operations
app/src/main/kotlin/com/ghostlock/app/ui/GhostlockViewModel.kt - App repository → Profile controller: resolves profiles
app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt - Profile controller → Bundled profiles: loads built-ins
app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt - Profile controller → Imported profiles: reads overrides
app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt - Profile controller → Profile merger: merges layers
app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt - Profile controller → Profile resolver: resolves config
app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt - Imported profiles → HOCON codec: parses documents
app/src/main/kotlin/com/ghostlock/app/data/UserProfileStore.kt - Bundled profiles → HOCON codec: parses assets
app/src/main/kotlin/com/ghostlock/app/data/BuiltinProfileCatalog.kt - Profile controller → HOCON codec: encodes config
app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt - App repository → Shizuku runner: starts exploit
app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt - Shizuku runner → Shell service: uses Shizuku
README.md - App repository → Extractor CLI: runs in-app parsing
app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt - App repository → Imported profiles: stores imports
app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt - OTA or boot image → Extractor CLI: supplies image or OTA
README.md - Extractor CLI → Offset derivation: derives offsets
tools/extract_rs/src/derive.rs - Extractor CLI → Profile report: emits report
tools/extract_rs/src/report.rs - Extractor CLI → Candidate profile: produces profile
README.md - Candidate profile → Imported profiles: can be imported
README.md - Native entrypoint → Pipeline orchestrator: dispatches execution
src/core/main.cpp - Pipeline orchestrator → Pipeline runner: selects pipeline
src/core/route/orchestrator.hpp - Pipeline runner → Exploit backend: runs backend
src/core/route/pipeline.hpp - Pipeline runner → Root handoff: runs handoff
src/core/route/pipeline.hpp - Pipeline runner → Race middleware: calls middleware hooks
src/core/route/pipeline.hpp - Race middleware → Route policy: dispatches policy
src/core/route/route_controller.cpp