atrexus/vulkan

How atrexus/vulkan works

Vulkan is a Windows command-line PE dumper that reads a selected process module, restores its in-memory image, and writes the result as a PE file. Its main workflow is CLI configuration and process opening, memory-image reconstruction (including page decryption and section handling), optional import rebuilding and rebasing, then file output. The README also documents waiting for a process and creating a minidump. The dumper implementation is only partially excerpted, so some workflow links below rely on README statements rather than inspected call sites.

Main entry points: main.cpp CLI entry · image.cpp PE image · dumper.cpp Dump workflow · import_directory.cpp Import rebuilding

Components 11

Command line

CLI entry src/main.cpp

Image restoration

Dump workflow src/dumper.cpp
Section restoration src/dumper.cpp
Import rebuilding src/pe/import_directory.cpp

PE image model

PE image src/pe/image.cpp
Section headers src/pe/section_headers.cpp
PE utilities include/pe/util.hpp

Other components

Operator
Target process
Dump file
Process minidump

Connections 14

Operator → CLI entry: configures README.md
CLI entry → Target process: opens src/main.cpp
CLI entry → Dump workflow: starts dump src/main.cpp
Dump workflow → Target process: reads module README.md
Dump workflow → Section restoration: restores sections README.md
Section restoration → PE image: fills image
Dump workflow → Import rebuilding: rebuilds imports src/dumper.cpp
Import rebuilding → PE image: updates image
PE image → Import rebuilding: owns directory src/pe/image.cpp
PE image → Section headers: uses headers src/pe/image.cpp
CLI entry → PE image: saves result src/main.cpp
CLI entry → Dump file: writes file src/main.cpp
CLI entry → Process minidump: can create
PE image → PE utilities: uses alignment src/pe/image.cpp

Drawn by GitDiagram on October 1, 2026 from the repository's file tree, README and source files. Read as Markdown ·