# 0xf1d0/delphi_scanner architecture

> Architecture diagram of the GitHub repository 0xf1d0/delphi_scanner, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/0xf1d0/delphi_scanner
- Repository: https://github.com/0xf1d0/delphi_scanner

## Overview

Delphi Scanner is a local Windows desktop malware scanner. A user selects or drops a PE file; the React app invokes the Tauri scan command, which gathers file metadata, parses the PE, extracts API features, vectorizes the sequence, runs CNN inference, detects suspicious API patterns, and returns a result for display. The README also documents a separate Python model-training pipeline. Its broader workflow is represented from the tree, but its internal wiring is not inferred from partial excerpts.

Main entry points: [`src-tauri/src/app/commands.rs`](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/app/commands.rs) (Tauri commands), [`src/App.tsx`](https://github.com/0xf1d0/delphi_scanner/blob/main/src/App.tsx) (Scanner app), [`src-tauri/src/core/extractor.rs`](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/extractor.rs) (API extractor), [`src/components/FileDropZone.tsx`](https://github.com/0xf1d0/delphi_scanner/blob/main/src/components/FileDropZone.tsx) (File selection)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["Desktop interface"]
  node_appui["Scanner app<br/>[App.tsx]"]
  node_dropzone["File selection<br/>[FileDropZone.tsx]"]
  node_results["Scan results<br/>[ResultsPanel.tsx]"]
  node_indicatorsui["Threat indicators"]
end

subgraph group_analysis["PE analysis"]
  node_parser["PE parser<br/>[parser.rs]"]
  node_extractor["API extractor<br/>[extractor.rs]"]
  node_ordinals["Ordinal resolver<br/>[ordinals.rs]"]
  node_entropy["Entropy metrics<br/>[entropy.rs]"]
  node_vectorizer["Sequence vectorizer<br/>[vectorizer.rs]"]
  node_inference["CNN inference<br/>[inference.rs]"]
  node_model["ONNX model<br/>[model.onnx]"]
  node_vocab["API vocabulary<br/>[vocab.json]"]
end

subgraph group_app["Application services"]
  node_commands["Tauri commands<br/>[commands.rs]"]
  node_state["App state<br/>[state.rs]"]
end

subgraph group_training["Model training"]
  node_preprocessing["Data preprocessing<br/>[preprocessing.py]"]
  node_dataset["Dataset handling<br/>[dataset.py]"]
  node_models["Model architectures<br/>[models.py]"]
  node_train["Model training<br/>[train.py]"]
  node_evaluate["Model evaluation<br/>[evaluate.py]"]
  node_export["Model export<br/>[export.py]"]
end

node_user(("Scanner user"))
node_pefile["PE file"]

node_user -->|"selects file"| node_dropzone
node_pefile -->|"dropped into"| node_dropzone
node_dropzone -->|"selects path"| node_appui
node_appui -->|"invokes scan"| node_commands
node_commands -->|"loads and parses"| node_parser
node_commands -->|"extracts features"| node_extractor
node_extractor -->|"resolves imports"| node_ordinals
node_extractor -->|"computes entropy"| node_entropy
node_commands -->|"encodes sequence"| node_vectorizer
node_vectorizer -->|"reads vocabulary"| node_vocab
node_commands -->|"predicts class"| node_inference
node_inference -->|"runs model"| node_model
node_commands -->|"uses initialized state"| node_state
node_commands -->|"returns scan result"| node_results
node_appui -->|"renders result"| node_results
node_appui -->|"renders indicators"| node_indicatorsui

click node_appui "https://github.com/0xf1d0/delphi_scanner/blob/main/src/App.tsx"
click node_dropzone "https://github.com/0xf1d0/delphi_scanner/blob/main/src/components/FileDropZone.tsx"
click node_results "https://github.com/0xf1d0/delphi_scanner/blob/main/src/components/ResultsPanel.tsx"
click node_indicatorsui "https://github.com/0xf1d0/delphi_scanner/blob/main/src/components/IndicatorsPanel.tsx"
click node_commands "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/app/commands.rs"
click node_state "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/app/state.rs"
click node_parser "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/parser.rs"
click node_extractor "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/extractor.rs"
click node_ordinals "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/ordinals.rs"
click node_entropy "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/entropy.rs"
click node_vectorizer "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/vectorizer.rs"
click node_inference "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/inference.rs"
click node_model "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/models/model.onnx"
click node_vocab "https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/models/vocab.json"
click node_preprocessing "https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/preprocessing.py"
click node_dataset "https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/dataset.py"
click node_models "https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/models.py"
click node_train "https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/train.py"
click node_evaluate "https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/evaluate.py"
click node_export "https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/export.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_appui,node_dropzone,node_results,node_indicatorsui,node_user toneBlue
class node_parser,node_extractor,node_ordinals,node_entropy,node_vectorizer,node_inference,node_model,node_vocab toneAmber
class node_commands,node_state toneMint
class node_preprocessing,node_dataset,node_models,node_train,node_evaluate,node_export toneRose
class node_pefile toneIndigo
```

## Components

### Desktop interface

- [Scanner app](https://github.com/0xf1d0/delphi_scanner/blob/main/src/App.tsx): `src/App.tsx`
- [File selection](https://github.com/0xf1d0/delphi_scanner/blob/main/src/components/FileDropZone.tsx): `src/components/FileDropZone.tsx`
- [Scan results](https://github.com/0xf1d0/delphi_scanner/blob/main/src/components/ResultsPanel.tsx): `src/components/ResultsPanel.tsx`
- [Threat indicators](https://github.com/0xf1d0/delphi_scanner/blob/main/src/components/IndicatorsPanel.tsx): `src/components/IndicatorsPanel.tsx`

### PE analysis

- [PE parser](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/parser.rs): `src-tauri/src/core/parser.rs`
- [API extractor](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/extractor.rs): `src-tauri/src/core/extractor.rs`
- [Ordinal resolver](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/ordinals.rs): `src-tauri/src/core/ordinals.rs`
- [Entropy metrics](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/entropy.rs): `src-tauri/src/core/entropy.rs`
- [Sequence vectorizer](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/vectorizer.rs): `src-tauri/src/core/vectorizer.rs`
- [CNN inference](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/core/inference.rs): `src-tauri/src/core/inference.rs`
- [ONNX model](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/models/model.onnx): `src-tauri/models/model.onnx`
- [API vocabulary](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/models/vocab.json): `src-tauri/models/vocab.json`

### Application services

- [Tauri commands](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/app/commands.rs): `src-tauri/src/app/commands.rs`
- [App state](https://github.com/0xf1d0/delphi_scanner/blob/main/src-tauri/src/app/state.rs): `src-tauri/src/app/state.rs`

### Model training

- [Data preprocessing](https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/preprocessing.py): `training/src/preprocessing.py`
- [Dataset handling](https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/dataset.py): `training/src/dataset.py`
- [Model architectures](https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/models.py): `training/src/models.py`
- [Model training](https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/train.py): `training/src/train.py`
- [Model evaluation](https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/evaluate.py): `training/src/evaluate.py`
- [Model export](https://github.com/0xf1d0/delphi_scanner/blob/main/training/src/export.py): `training/src/export.py`

### Other components

- **Scanner user**
- **PE file**

## Connections

- Scanner user → File selection: selects file
- PE file → File selection: dropped into
- File selection → Scanner app: selects path
- Scanner app → Tauri commands: invokes scan
- Tauri commands → PE parser: loads and parses
- Tauri commands → API extractor: extracts features
- API extractor → Ordinal resolver: resolves imports
- API extractor → Entropy metrics: computes entropy
- Tauri commands → Sequence vectorizer: encodes sequence
- Sequence vectorizer → API vocabulary: reads vocabulary
- Tauri commands → CNN inference: predicts class
- CNN inference → ONNX model: runs model
- Tauri commands → App state: uses initialized state
- Tauri commands → Scan results: returns scan result
- Scanner app → Scan results: renders result
- Scanner app → Threat indicators: renders indicators