How 0xf1d0/delphi_scanner works
Delphi Scanner is a local Windows desktop malware scanner. A user selects or drops a PE file; the React app invokes the Tauri scan command, which gathers file metadata, parses the PE, extracts API features, vectorizes the sequence, runs CNN inference, detects suspicious API patterns, and returns a result for display. The README also documents a separate Python model-training pipeline. Its broader workflow is represented from the tree, but its internal wiring is not inferred from partial excerpts.
Main entry points: commands.rs Tauri commands · App.tsx Scanner app · extractor.rs API extractor · FileDropZone.tsx File selection
Components 22
Desktop interface
- Scanner app
src/App.tsx - File selection
src/components/FileDropZone.tsx - Scan results
src/components/ResultsPanel.tsx - Threat indicators
src/components/IndicatorsPanel.tsx
PE analysis
- PE parser
src-tauri/src/core/parser.rs - API extractor
src-tauri/src/core/extractor.rs - Ordinal resolver
src-tauri/src/core/ordinals.rs - Entropy metrics
src-tauri/src/core/entropy.rs - Sequence vectorizer
src-tauri/src/core/vectorizer.rs - CNN inference
src-tauri/src/core/inference.rs - ONNX model
src-tauri/models/model.onnx - API vocabulary
src-tauri/models/vocab.json
Application services
- Tauri commands
src-tauri/src/app/commands.rs - App state
src-tauri/src/app/state.rs
Model training
- Data preprocessing
training/src/preprocessing.py - Dataset handling
training/src/dataset.py - Model architectures
training/src/models.py - Model training
training/src/train.py - Model evaluation
training/src/evaluate.py - Model export
training/src/export.py
Other components
- Scanner user
- PE file
Connections 16
- Scanner user → File selection: selects file
- PE file → File selection: dropped into
- File selection → Scanner app: selects path
- Scanner app → Tauri commands: invokes scan
- Tauri commands → PE parser: loads and parses
- Tauri commands → API extractor: extracts features
- API extractor → Ordinal resolver: resolves imports
- API extractor → Entropy metrics: computes entropy
- Tauri commands → Sequence vectorizer: encodes sequence
- Sequence vectorizer → API vocabulary: reads vocabulary
- Tauri commands → CNN inference: predicts class
- CNN inference → ONNX model: runs model
- Tauri commands → App state: uses initialized state
- Tauri commands → Scan results: returns scan result
- Scanner app → Scan results: renders result
- Scanner app → Threat indicators: renders indicators