# yukonga/ghostlock-app architecture

> Architecture diagram of the GitHub repository yukonga/ghostlock-app, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/yukonga/ghostlock-app
- Repository: https://github.com/yukonga/ghostlock-app

## Overview

GhostLock is an Android kernel-exploit application with a companion kernel-profile extractor. The main workflow is user Run → UI/repository → resolve a release-specific profile → send its binary document to the native runner → dispatch a catalogued frontend/backend/route pipeline. Profile import, editing, and OTA/image offset extraction are separate supporting capabilities. Some native and app implementation details were not excerpted; edges below are limited to README statements, excerpts, and SOURCE INDEX references.

Main entry points: [`app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt`](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt) (Profile controller), [`app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt`](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt) (App repository), [`tools/extract_rs/src/main.rs`](https://github.com/yukonga/ghostlock-app/blob/main/tools/extract_rs/src/main.rs) (Extractor CLI), [`src/core/route/pipeline.hpp`](https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/pipeline.hpp) (Pipeline runner)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_app["Android app"]
  node_activity["Main activity<br/>[MainActivity.kt]"]
  node_viewmodel["Run and profile UI"]
  node_repository["App repository"]
  node_runner["Shizuku runner"]
  node_user_service["Shell service"]
end

subgraph group_profiles["Profile configuration"]
  node_profile_controller["Profile controller"]
  node_profile_store[("Imported profiles")]
  node_asset_loader["Bundled profiles"]
  node_hocon["HOCON codec<br/>[HoconSupport.kt]"]
  node_merge["Profile merger<br/>[ProfileMerger.kt]"]
  node_resolve["Profile resolver<br/>[ProfileResolver.kt]"]
  node_export["Profile export<br/>[ProfileExporter.kt]"]
end

subgraph group_native["Native execution"]
  node_native_main["Native entrypoint<br/>[main.cpp]"]
  node_orchestrator["Pipeline orchestrator<br/>[orchestrator.hpp]"]
  node_pipeline["Pipeline runner<br/>[pipeline.hpp]"]
  node_backend["Exploit backend"]
  node_frontend["Root handoff"]
  node_route["Race middleware"]
  node_route_policy["Route policy<br/>[route_policy.hpp]"]
end

subgraph group_extractor["Offset extraction"]
  node_extractor_cli["Extractor CLI<br/>[main.rs]"]
  node_derive["Offset derivation<br/>[derive.rs]"]
  node_report["Profile report<br/>[report.rs]"]
end

node_user(("User"))
node_extract_input["OTA or boot image"]
node_profile_output["Candidate profile"]

node_user -->|"opens and runs"| node_activity
node_activity -->|"hosts"| node_viewmodel
node_viewmodel -->|"requests operations"| node_repository
node_repository -->|"resolves profiles"| node_profile_controller
node_profile_controller -->|"loads built-ins"| node_asset_loader
node_profile_controller -->|"reads overrides"| node_profile_store
node_profile_controller -->|"merges layers"| node_merge
node_profile_controller -->|"resolves config"| node_resolve
node_profile_store -->|"parses documents"| node_hocon
node_asset_loader -->|"parses assets"| node_hocon
node_profile_controller -->|"encodes config"| node_hocon
node_repository -->|"starts exploit"| node_runner
node_runner -.->|"uses Shizuku"| node_user_service
node_repository -->|"runs in-app parsing"| node_extractor_cli
node_repository -->|"stores imports"| node_profile_store
node_extract_input -->|"supplies image or OTA"| node_extractor_cli
node_extractor_cli -->|"derives offsets"| node_derive
node_extractor_cli -->|"emits report"| node_report
node_extractor_cli -->|"produces profile"| node_profile_output
node_profile_output -->|"can be imported"| node_profile_store
node_native_main -->|"dispatches execution"| node_orchestrator
node_orchestrator -->|"selects pipeline"| node_pipeline
node_pipeline -->|"runs backend"| node_backend
node_pipeline -->|"runs handoff"| node_frontend
node_pipeline -->|"calls middleware hooks"| node_route
node_route -->|"dispatches policy"| node_route_policy

click node_activity "https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/ui/MainActivity.kt"
click node_viewmodel "https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/ui/GhostlockViewModel.kt"
click node_repository "https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt"
click node_runner "https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/shizuku/ShizukuExploitRunner.kt"
click node_user_service "https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/shizuku/GhostlockUserService.kt"
click node_profile_controller "https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt"
click node_profile_store "https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/UserProfileStore.kt"
click node_asset_loader "https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/AssetConfigLoader.kt"
click node_hocon "https://github.com/yukonga/ghostlock-app/blob/main/profile-core/src/main/kotlin/com/ghostlock/app/data/HoconSupport.kt"
click node_merge "https://github.com/yukonga/ghostlock-app/blob/main/profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileMerger.kt"
click node_resolve "https://github.com/yukonga/ghostlock-app/blob/main/profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileResolver.kt"
click node_export "https://github.com/yukonga/ghostlock-app/blob/main/profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileExporter.kt"
click node_native_main "https://github.com/yukonga/ghostlock-app/blob/main/src/core/main.cpp"
click node_orchestrator "https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/orchestrator.hpp"
click node_pipeline "https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/pipeline.hpp"
click node_backend "https://github.com/yukonga/ghostlock-app/blob/main/src/core/session/backend/cve_2026_43499_backend.cpp"
click node_frontend "https://github.com/yukonga/ghostlock-app/blob/main/src/core/session/root_child_frontend.cpp"
click node_route "https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/route_controller.cpp"
click node_route_policy "https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/route_policy.hpp"
click node_extractor_cli "https://github.com/yukonga/ghostlock-app/blob/main/tools/extract_rs/src/main.rs"
click node_derive "https://github.com/yukonga/ghostlock-app/blob/main/tools/extract_rs/src/derive.rs"
click node_report "https://github.com/yukonga/ghostlock-app/blob/main/tools/extract_rs/src/report.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_activity,node_viewmodel,node_repository,node_runner,node_user_service,node_user toneBlue
class node_profile_controller,node_profile_store,node_asset_loader,node_hocon,node_merge,node_resolve,node_export toneAmber
class node_native_main,node_orchestrator,node_pipeline,node_backend,node_frontend,node_route,node_route_policy toneMint
class node_extractor_cli,node_derive,node_report toneRose
class node_extract_input,node_profile_output toneIndigo
```

## Components

### Android app

- [Main activity](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/ui/MainActivity.kt): `app/src/main/kotlin/com/ghostlock/app/ui/MainActivity.kt`
- [Run and profile UI](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/ui/GhostlockViewModel.kt): `app/src/main/kotlin/com/ghostlock/app/ui/GhostlockViewModel.kt`
- [App repository](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt): `app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt`
- [Shizuku runner](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/shizuku/ShizukuExploitRunner.kt): `app/src/main/kotlin/com/ghostlock/app/shizuku/ShizukuExploitRunner.kt`
- [Shell service](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/shizuku/GhostlockUserService.kt): `app/src/main/kotlin/com/ghostlock/app/shizuku/GhostlockUserService.kt`

### Profile configuration

- [Profile controller](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt): `app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt`
- [Imported profiles](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/UserProfileStore.kt): `app/src/main/kotlin/com/ghostlock/app/data/UserProfileStore.kt`
- [Bundled profiles](https://github.com/yukonga/ghostlock-app/blob/main/app/src/main/kotlin/com/ghostlock/app/data/AssetConfigLoader.kt): `app/src/main/kotlin/com/ghostlock/app/data/AssetConfigLoader.kt`
- [HOCON codec](https://github.com/yukonga/ghostlock-app/blob/main/profile-core/src/main/kotlin/com/ghostlock/app/data/HoconSupport.kt): `profile-core/src/main/kotlin/com/ghostlock/app/data/HoconSupport.kt`
- [Profile merger](https://github.com/yukonga/ghostlock-app/blob/main/profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileMerger.kt): `profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileMerger.kt`
- [Profile resolver](https://github.com/yukonga/ghostlock-app/blob/main/profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileResolver.kt): `profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileResolver.kt`
- [Profile export](https://github.com/yukonga/ghostlock-app/blob/main/profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileExporter.kt): `profile-core/src/main/kotlin/com/ghostlock/app/data/profile/ProfileExporter.kt`

### Native execution

- [Native entrypoint](https://github.com/yukonga/ghostlock-app/blob/main/src/core/main.cpp): `src/core/main.cpp`
- [Pipeline orchestrator](https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/orchestrator.hpp): `src/core/route/orchestrator.hpp`
- [Pipeline runner](https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/pipeline.hpp): `src/core/route/pipeline.hpp`
- [Exploit backend](https://github.com/yukonga/ghostlock-app/blob/main/src/core/session/backend/cve_2026_43499_backend.cpp): `src/core/session/backend/cve_2026_43499_backend.cpp`
- [Root handoff](https://github.com/yukonga/ghostlock-app/blob/main/src/core/session/root_child_frontend.cpp): `src/core/session/root_child_frontend.cpp`
- [Race middleware](https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/route_controller.cpp): `src/core/route/route_controller.cpp`
- [Route policy](https://github.com/yukonga/ghostlock-app/blob/main/src/core/route/route_policy.hpp): `src/core/route/route_policy.hpp`

### Offset extraction

- [Extractor CLI](https://github.com/yukonga/ghostlock-app/blob/main/tools/extract_rs/src/main.rs): `tools/extract_rs/src/main.rs`
- [Offset derivation](https://github.com/yukonga/ghostlock-app/blob/main/tools/extract_rs/src/derive.rs): `tools/extract_rs/src/derive.rs`
- [Profile report](https://github.com/yukonga/ghostlock-app/blob/main/tools/extract_rs/src/report.rs): `tools/extract_rs/src/report.rs`

### Other components

- **User**
- **OTA or boot image**
- **Candidate profile**

## Connections

- User → Main activity: opens and runs (evidence: `README.md`)
- Main activity → Run and profile UI: hosts (evidence: `app/src/main/kotlin/com/ghostlock/app/ui/MainActivity.kt`)
- Run and profile UI → App repository: requests operations (evidence: `app/src/main/kotlin/com/ghostlock/app/ui/GhostlockViewModel.kt`)
- App repository → Profile controller: resolves profiles (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt`)
- Profile controller → Bundled profiles: loads built-ins (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt`)
- Profile controller → Imported profiles: reads overrides (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt`)
- Profile controller → Profile merger: merges layers (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt`)
- Profile controller → Profile resolver: resolves config (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt`)
- Imported profiles → HOCON codec: parses documents (evidence: `app/src/main/kotlin/com/ghostlock/app/data/UserProfileStore.kt`)
- Bundled profiles → HOCON codec: parses assets (evidence: `app/src/main/kotlin/com/ghostlock/app/data/BuiltinProfileCatalog.kt`)
- Profile controller → HOCON codec: encodes config (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidProfileConfigController.kt`)
- App repository → Shizuku runner: starts exploit (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt`)
- Shizuku runner → Shell service: uses Shizuku (evidence: `README.md`)
- App repository → Extractor CLI: runs in-app parsing (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt`)
- App repository → Imported profiles: stores imports (evidence: `app/src/main/kotlin/com/ghostlock/app/data/AndroidGhostlockRepository.kt`)
- OTA or boot image → Extractor CLI: supplies image or OTA (evidence: `README.md`)
- Extractor CLI → Offset derivation: derives offsets (evidence: `tools/extract_rs/src/derive.rs`)
- Extractor CLI → Profile report: emits report (evidence: `tools/extract_rs/src/report.rs`)
- Extractor CLI → Candidate profile: produces profile (evidence: `README.md`)
- Candidate profile → Imported profiles: can be imported (evidence: `README.md`)
- Native entrypoint → Pipeline orchestrator: dispatches execution (evidence: `src/core/main.cpp`)
- Pipeline orchestrator → Pipeline runner: selects pipeline (evidence: `src/core/route/orchestrator.hpp`)
- Pipeline runner → Exploit backend: runs backend (evidence: `src/core/route/pipeline.hpp`)
- Pipeline runner → Root handoff: runs handoff (evidence: `src/core/route/pipeline.hpp`)
- Pipeline runner → Race middleware: calls middleware hooks (evidence: `src/core/route/pipeline.hpp`)
- Race middleware → Route policy: dispatches policy (evidence: `src/core/route/route_controller.cpp`)