# autoplay1999/xc3 architecture

> Architecture diagram of the GitHub repository autoplay1999/xc3, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/autoplay1999/xc3
- Repository: https://github.com/autoplay1999/xc3

## Overview

XC3 is a Windows user-mode client and CLI for managing and issuing requests to the bundled xhunter kernel driver. The principal workflow is to choose a driver path, connect (optionally exporting and starting the driver), then use CLI commands that call the client API; the API packages requests and exchanges them with the driver. The public API also exposes process protection, reporting, hooks, and process/kernel-memory operations. There is no README, and source excerpts are partial, so links for unsampled command handlers and driver internals are not inferred.

Main entry points: [`src/xc3_api/xc3api.h`](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.h) (XC3Client API), [`src/xc3_api/xc3api.cpp`](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp) (Packet transport), [`src/xc3_cli/Main.cpp`](https://github.com/autoplay1999/xc3/blob/main/src/xc3_cli/Main.cpp) (Interactive commands), [`src/xc3_api/util.hpp`](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/util.hpp) (Service utilities)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["CLI"]
  node_cli_app["Interactive commands<br/>[Main.cpp]"]
end

subgraph group_lifecycle["Driver lifecycle"]
  node_connection["Connect and disconnect<br/>[xc3api.cpp]"]
  node_driver_export["Embedded driver export<br/>[xc3api.cpp]"]
  node_driver_image["Bundled driver image<br/>[xhunter1_sys_bin.h]"]
  node_service_helpers["Service utilities<br/>[util.hpp]"]
end

subgraph group_client["Client API"]
  node_client_api["XC3Client API<br/>[xc3api.h]"]
  node_packet_transport["Packet transport<br/>[xc3api.cpp]"]
  node_hook_ops["Handle hook control<br/>[xc3api.cpp]"]
  node_pid_ops["PID protection flags<br/>[xc3api.cpp]"]
  node_report_ops["Report reader<br/>[xc3api.cpp]"]
  node_process_ops["Process access and reads<br/>[xc3api.cpp]"]
  node_kernel_ops["Kernel memory reads<br/>[xc3api.cpp]"]
  node_error_results["Result and errors<br/>[error.hpp]"]
end

subgraph group_driver["Driver boundary"]
  node_driver["xhunter kernel driver"]
end

node_user(("CLI user"))
node_windows_scm["Windows service manager"]
node_target_process["Target processes"]

node_user -->|"enters commands"| node_cli_app
node_cli_app -->|"calls API"| node_client_api
node_client_api -->|"connects lifecycle"| node_connection
node_connection -.->|"may export"| node_driver_export
node_driver_export -->|"decodes image"| node_driver_image
node_connection -->|"manages service"| node_service_helpers
node_service_helpers -->|"queries and controls"| node_windows_scm
node_client_api -->|"sends requests"| node_packet_transport
node_packet_transport -->|"exchanges packets"| node_driver
node_client_api -->|"controls hooks"| node_hook_ops
node_client_api -->|"registers PID flags"| node_pid_ops
node_client_api -->|"registers reader"| node_report_ops
node_client_api -->|"opens and reads"| node_process_ops
node_client_api -->|"reads kernel memory"| node_kernel_ops
node_process_ops -->|"accesses process"| node_target_process
node_hook_ops -->|"dispatches requests"| node_packet_transport
node_pid_ops -->|"dispatches requests"| node_packet_transport
node_report_ops -->|"dispatches requests"| node_packet_transport
node_process_ops -->|"dispatches requests"| node_packet_transport
node_kernel_ops -->|"dispatches requests"| node_packet_transport
node_client_api -->|"returns status"| node_error_results

click node_cli_app "https://github.com/autoplay1999/xc3/blob/main/src/xc3_cli/Main.cpp"
click node_client_api "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.h"
click node_connection "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp"
click node_driver_export "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp"
click node_driver_image "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xhunter1_sys_bin.h"
click node_service_helpers "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/util.hpp"
click node_packet_transport "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp"
click node_hook_ops "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp"
click node_pid_ops "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp"
click node_report_ops "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp"
click node_process_ops "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp"
click node_kernel_ops "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp"
click node_error_results "https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/error.hpp"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli_app,node_user toneBlue
class node_connection,node_driver_export,node_driver_image,node_service_helpers toneAmber
class node_client_api,node_packet_transport,node_hook_ops,node_pid_ops,node_report_ops,node_process_ops,node_kernel_ops,node_error_results toneMint
class node_driver toneRose
class node_windows_scm,node_target_process toneIndigo
```

## Components

### CLI

- [Interactive commands](https://github.com/autoplay1999/xc3/blob/main/src/xc3_cli/Main.cpp): `src/xc3_cli/Main.cpp`

### Driver lifecycle

- [Connect and disconnect](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp): `src/xc3_api/xc3api.cpp`
- [Embedded driver export](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp): `src/xc3_api/xc3api.cpp`
- [Bundled driver image](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xhunter1_sys_bin.h): `src/xc3_api/xhunter1_sys_bin.h`
- [Service utilities](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/util.hpp): `src/xc3_api/util.hpp`

### Client API

- [XC3Client API](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.h): `src/xc3_api/xc3api.h`
- [Packet transport](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp): `src/xc3_api/xc3api.cpp`
- [Handle hook control](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp): `src/xc3_api/xc3api.cpp`
- [PID protection flags](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp): `src/xc3_api/xc3api.cpp`
- [Report reader](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp): `src/xc3_api/xc3api.cpp`
- [Process access and reads](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp): `src/xc3_api/xc3api.cpp`
- [Kernel memory reads](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/xc3api.cpp): `src/xc3_api/xc3api.cpp`
- [Result and errors](https://github.com/autoplay1999/xc3/blob/main/src/xc3_api/error.hpp): `src/xc3_api/error.hpp`

### Driver boundary

- **xhunter kernel driver**

### Other components

- **CLI user**
- **Windows service manager**
- **Target processes**

## Connections

- CLI user → Interactive commands: enters commands
- Interactive commands → XC3Client API: calls API
- XC3Client API → Connect and disconnect: connects lifecycle
- Connect and disconnect → Embedded driver export: may export
- Embedded driver export → Bundled driver image: decodes image
- Connect and disconnect → Service utilities: manages service
- Service utilities → Windows service manager: queries and controls
- XC3Client API → Packet transport: sends requests
- Packet transport → xhunter kernel driver: exchanges packets
- XC3Client API → Handle hook control: controls hooks
- XC3Client API → PID protection flags: registers PID flags
- XC3Client API → Report reader: registers reader
- XC3Client API → Process access and reads: opens and reads
- XC3Client API → Kernel memory reads: reads kernel memory
- Process access and reads → Target processes: accesses process
- Handle hook control → Packet transport: dispatches requests
- PID protection flags → Packet transport: dispatches requests
- Report reader → Packet transport: dispatches requests
- Process access and reads → Packet transport: dispatches requests
- Kernel memory reads → Packet transport: dispatches requests
- XC3Client API → Result and errors: returns status