How bgx-11/shadowlog works
1. Repository shape
- This is a Windows-only Go monorepo with three runtime binaries: the main agent (WinUpdateSvc.exe), a local forensic viewer/decryptor (Decryptor.exe), and a cleanup tool (Uninstaller.exe).
- It also includes a separate Next.js marketing/documentation site under site/, plus build/release artifacts like a manifest and packaged ZIP.
2. Primary runtime boundary
- main.go is the entrypoint for the installed monitor/service-like agent.
- Its job is to initialize the environment, elevate privileges, apply anti-analysis checks, load encrypted config, set persistence, then start telemetry collection and outbound delivery.
3. Configuration and identity layer
- The config/ package centralizes encrypted configuration storage, machine-specific key derivation, and filesystem/registry path handling.
- A notable boundary is that configuration is stored in the Windows Registry rather than a normal config file, while runtime data is written to a disguised Windows directory path.
4. Monitoring and capture subsystem
- The monitor/ package is the core telemetry engine.
- Submodules split by signal source: clipboard (clipboard.go), USB events (usb.go), Wi‑Fi information (wifi.go), network channels (smtp.go, doh.go), and command/control or shutdown logic (killswitch.go).
- monitor.go acts as the orchestration layer for hooks, window/context tracking, and screenshot capture.
5. Data flow from event to record
- Captured events are contextualized with active-window/process metadata, then written locally and/or forwarded out through configured channels.
- The design emphasizes a single event pipeline feeding multiple sinks: local encrypted storage, email, DNS-over-HTTPS, and other network-based delivery paths.
6. Local storage and log management
- The repository uses encrypted local log storage with rotation support to bound disk usage.
- The storage path is intentionally disguised under a legitimate-looking Windows cache location, and the README indicates timestamp spoofing to reduce forensic visibility.
7. Outbound delivery boundaries
- Exfiltration is not hard-wired to one transport; it is modularized across SMTP email and DNS-over-HTTPS, with Telegram-related command/control behavior implied by the kill-switch logic.
- This makes the network boundary a fan-out stage rather than a single endpoint, with different transports acting as primary and fallback channels.
8. Persistence and removal
- persistence/persistence.go handles startup persistence, likely through registry Run keys and scheduled tasks as described in the README.
- uninstaller/main.go is a separate operational boundary that reverses those changes and purges stored artifacts, rather than being embedded into the main agent flow.
9. Decryptor / forensic viewer
- decryptor/main.go is an offline companion tool for reading the encrypted local data store and presenting it in a dashboard at localhost.
- Architecturally, it is the inverse of the agent: it consumes the agent’s stored artifacts, unlocks them using either a password or machine-bound derivation, and exposes them for analysis/export.
10. Setup UI and public site
- ui/ui.go is the local configuration/setup layer for the agent, including initial onboarding and delivery-channel setup.
- The site/ directory is a separate Next.js frontend for the product website, privacy/terms pages, and download navigation; it is not part of the Windows runtime, but it supports distribution and user-facing setup documentation.
11. Build and packaging
- build.bat, the .manifest, and generated .syso resource file show a Windows-focused build pipeline with embedded elevation behavior.
- The release artifacts (ShadowLog_Release_v4.0.zip, the EXEs) indicate the repo is organized around producing a packaged Windows deployment rather than a library or server application.
12. High-level architecture in one sentence
- The system is a Windows agent that collects contextual user activity, stores it locally in encrypted form, sends it through multiple outbound channels, persists itself on the host, and is paired with separate decryptor and uninstaller utilities plus a standalone marketing website.
Main entry points: monitor.go Telemetry engine · main.go Agent entry · build.bat Windows build · config.go Config core
Components 18
Windows runtime
Installed agent, telemetry, persistence, and companion utilities.
- Agent entry · Initializes the installed Windows agent and starts the core runtime.
main.go - Setup UI · Local onboarding and delivery-channel configuration layer.
ui/ui.go - Config core · Encrypted configuration storage and access boundary.
config/config.go - Machine keys · Machine-bound key derivation for protecting local data and config.
config/machine.go - Paths · Windows registry and filesystem path handling for disguised runtime storage.
config/paths.go - Telemetry engine · Coordinates hooks, context tracking, and capture flow.
monitor/monitor.go - Clipboard · Captures clipboard-derived events.
monitor/clipboard.go - USB · Captures USB-related events.
monitor/usb.go - Wi-Fi · Captures wireless/network environment information.
monitor/wifi.go - SMTP · Email-based outbound delivery path.
monitor/smtp.go - DoH · DNS-over-HTTPS delivery path.
monitor/doh.go - Kill switch · Remote control and shutdown boundary for the monitoring runtime.
monitor/killswitch.go - Persistence · Startup persistence installation and removal logic.
persistence/persistence.go - Decryptor · Offline tool that unlocks and displays encrypted local data.
decryptor/main.go - Uninstaller · Removes persistence and purges stored artifacts.
uninstaller/main.go
Public site
Next.js marketing and documentation frontend.
- Website · Public marketing and documentation site.
site/app/page.js
Build and release
Windows packaging and shipped artifacts.
- Windows build · Build and packaging flow for the Windows binaries and release artifacts.
build.bat - Release bundle · Packaged release outputs and shipped binaries.
ShadowLog_Release_v4.0.zip
Connections 25
- Agent entry → Config core: load · Loads encrypted runtime configuration.
- Agent entry → Machine keys: derive · Uses machine-bound identity for keys and protection.
- Agent entry → Paths: resolve · Resolves registry and filesystem storage locations.
- Agent entry → Setup UI: bootstrap · Invokes local setup and channel configuration.
- Agent entry → Persistence: install · Applies startup persistence.
- Agent entry → Telemetry engine: start · Starts the telemetry and capture pipeline.
- Telemetry engine → Clipboard: source · Reads clipboard events into the pipeline.
- Telemetry engine → USB: source · Reads USB events into the pipeline.
- Telemetry engine → Wi-Fi: source · Reads Wi-Fi context into the pipeline.
- Telemetry engine → SMTP: fan-out · Sends records through email delivery.
- Telemetry engine → DoH: fan-out · Sends records through DNS-over-HTTPS delivery.
- Telemetry engine → Kill switch: control · Checks for remote stop or command-control actions.
- Telemetry engine → Config core: read/write · Uses configuration for capture and delivery behavior.
- Config core → Machine keys: protect · Binds stored secrets to the host machine.
- Config core → Paths: store · Uses registry and disguised directory paths.
- Decryptor → Config core: unlock · Reads the encrypted store using password or machine-bound derivation.
- Decryptor → Paths: locate · Finds the agent's local stored artifacts.
- Uninstaller → Persistence: remove · Reverses startup persistence changes.
- Uninstaller → Paths: purge · Deletes stored artifacts and traces.
- Website → Release bundle: distribute · Supports product distribution and download navigation.
- Windows build → Release bundle: package · Produces the Windows release bundle and executables.
- Windows build → Agent entry: compile · Builds the primary agent binary.
- Windows build → Decryptor: compile · Builds the decryptor utility.
- Windows build → Uninstaller: compile · Builds the cleanup utility.
- Windows build → Website: build · Builds the Next.js site for distribution.