How autoplay1999/xc3 works
XC3 is a Windows user-mode client and CLI for managing and issuing requests to the bundled xhunter kernel driver. The principal workflow is to choose a driver path, connect (optionally exporting and starting the driver), then use CLI commands that call the client API; the API packages requests and exchanges them with the driver. The public API also exposes process protection, reporting, hooks, and process/kernel-memory operations. There is no README, and source excerpts are partial, so links for unsampled command handlers and driver internals are not inferred.
Main entry points: xc3api.h XC3Client API · xc3api.cpp Packet transport · Main.cpp Interactive commands · util.hpp Service utilities
Components 17
CLI
- Interactive commands
src/xc3_cli/Main.cpp
Driver lifecycle
- Connect and disconnect
src/xc3_api/xc3api.cpp - Embedded driver export
src/xc3_api/xc3api.cpp - Bundled driver image
src/xc3_api/xhunter1_sys_bin.h - Service utilities
src/xc3_api/util.hpp
Client API
- XC3Client API
src/xc3_api/xc3api.h - Packet transport
src/xc3_api/xc3api.cpp - Handle hook control
src/xc3_api/xc3api.cpp - PID protection flags
src/xc3_api/xc3api.cpp - Report reader
src/xc3_api/xc3api.cpp - Process access and reads
src/xc3_api/xc3api.cpp - Kernel memory reads
src/xc3_api/xc3api.cpp - Result and errors
src/xc3_api/error.hpp
Driver boundary
- xhunter kernel driver
Other components
- CLI user
- Windows service manager
- Target processes
Connections 21
- CLI user → Interactive commands: enters commands
- Interactive commands → XC3Client API: calls API
- XC3Client API → Connect and disconnect: connects lifecycle
- Connect and disconnect → Embedded driver export: may export
- Embedded driver export → Bundled driver image: decodes image
- Connect and disconnect → Service utilities: manages service
- Service utilities → Windows service manager: queries and controls
- XC3Client API → Packet transport: sends requests
- Packet transport → xhunter kernel driver: exchanges packets
- XC3Client API → Handle hook control: controls hooks
- XC3Client API → PID protection flags: registers PID flags
- XC3Client API → Report reader: registers reader
- XC3Client API → Process access and reads: opens and reads
- XC3Client API → Kernel memory reads: reads kernel memory
- Process access and reads → Target processes: accesses process
- Handle hook control → Packet transport: dispatches requests
- PID protection flags → Packet transport: dispatches requests
- Report reader → Packet transport: dispatches requests
- Process access and reads → Packet transport: dispatches requests
- Kernel memory reads → Packet transport: dispatches requests
- XC3Client API → Result and errors: returns status