# calomity/usbfilelogger architecture

> Architecture diagram of the GitHub repository calomity/usbfilelogger, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/calomity/usbfilelogger
- Repository: https://github.com/calomity/usbfilelogger

## Overview

usbfilelogger is a Windows program that persists itself, injects a DLL into Task Manager, logs activity, and watches removable drives to copy selected files. Its main loop detects newly connected removable volumes and copies .txt, .pdf, and .exe files into extension-specific folders. The DLL source shows a directory-query hook that filters a configured filename; the README also identifies a system-information hook, and the header declares it. The system-information hook implementation and DLL hook-installation wiring are not visible in the sampled source, so those details are not inferred here.

Main entry points: [`main.cpp`](https://github.com/calomity/usbfilelogger/blob/main/main.cpp) (Main loop), [`rat.h`](https://github.com/calomity/usbfilelogger/blob/main/rat.h) (Runtime helpers), [`dllmain/dllmain.cpp`](https://github.com/calomity/usbfilelogger/blob/main/dllmain/dllmain.cpp) (Injected DLL hooks), [`dllmain/dllmain.h`](https://github.com/calomity/usbfilelogger/blob/main/dllmain/dllmain.h) (System info hook)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Host runtime"]
  node_main["Main loop<br/>[main.cpp]"]
  node_helpers["Runtime helpers<br/>[rat.h]"]
  node_logfiles[("Activity logs")]
  node_startup[("Run registry key")]
  node_taskmgr["Task Manager"]
  node_dllinject["DLL injection<br/>[rat.h]"]
end

subgraph group_surveillance["Drive monitoring"]
  node_staging[("Copied files")]
  node_drivewatch["Drive polling<br/>[main.cpp]"]
  node_filecopy["Extension copier<br/>[rat.h]"]
end

subgraph group_stealth["Injected hooks"]
  node_hookdll["Injected DLL hooks<br/>[dllmain.cpp]"]
  node_dirhook["Directory query filter<br/>[dllmain.cpp]"]
  node_sysinfohook["System info hook<br/>[dllmain.h]"]
end

node_windows(("Windows"))
node_removable(("Removable drive"))

node_windows -->|"starts"| node_main
node_main -->|"logs activity"| node_helpers
node_helpers -->|"appends logs"| node_logfiles
node_main -->|"sets autorun"| node_startup
node_main -->|"launches"| node_taskmgr
node_main -->|"injects via"| node_helpers
node_helpers -->|"loads DLL into"| node_taskmgr
node_main -->|"polls drives"| node_drivewatch
node_drivewatch -->|"queries volumes"| node_windows
node_removable -->|"volume detected"| node_drivewatch
node_drivewatch -->|"copies matching files"| node_filecopy
node_filecopy -->|"scans files"| node_removable
node_filecopy -->|"writes copies"| node_staging
node_taskmgr -->|"loads"| node_hookdll
node_hookdll -->|"implements"| node_dirhook
node_windows -->|"dispatches directory queries"| node_dirhook
node_hookdll -.->|"declares hook"| node_sysinfohook

click node_main "https://github.com/calomity/usbfilelogger/blob/main/main.cpp"
click node_helpers "https://github.com/calomity/usbfilelogger/blob/main/rat.h"
click node_drivewatch "https://github.com/calomity/usbfilelogger/blob/main/main.cpp"
click node_filecopy "https://github.com/calomity/usbfilelogger/blob/main/rat.h"
click node_dllinject "https://github.com/calomity/usbfilelogger/blob/main/rat.h"
click node_hookdll "https://github.com/calomity/usbfilelogger/blob/main/dllmain/dllmain.cpp"
click node_dirhook "https://github.com/calomity/usbfilelogger/blob/main/dllmain/dllmain.cpp"
click node_sysinfohook "https://github.com/calomity/usbfilelogger/blob/main/dllmain/dllmain.h"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_helpers,node_logfiles,node_startup,node_taskmgr,node_dllinject toneBlue
class node_staging,node_drivewatch,node_filecopy toneAmber
class node_hookdll,node_dirhook,node_sysinfohook toneMint
class node_windows,node_removable toneIndigo
```

## Components

### Host runtime

- [Main loop](https://github.com/calomity/usbfilelogger/blob/main/main.cpp): `main.cpp`
- [Runtime helpers](https://github.com/calomity/usbfilelogger/blob/main/rat.h): `rat.h`
- **Activity logs**
- **Run registry key**
- **Task Manager**
- [DLL injection](https://github.com/calomity/usbfilelogger/blob/main/rat.h): `rat.h`

### Drive monitoring

- **Copied files**
- [Drive polling](https://github.com/calomity/usbfilelogger/blob/main/main.cpp): `main.cpp`
- [Extension copier](https://github.com/calomity/usbfilelogger/blob/main/rat.h): `rat.h`

### Injected hooks

- [Injected DLL hooks](https://github.com/calomity/usbfilelogger/blob/main/dllmain/dllmain.cpp): `dllmain/dllmain.cpp`
- [Directory query filter](https://github.com/calomity/usbfilelogger/blob/main/dllmain/dllmain.cpp): `dllmain/dllmain.cpp`
- [System info hook](https://github.com/calomity/usbfilelogger/blob/main/dllmain/dllmain.h): `dllmain/dllmain.h`

### Other components

- **Windows**
- **Removable drive**

## Connections

- Windows → Main loop: starts
- Main loop → Runtime helpers: logs activity
- Runtime helpers → Activity logs: appends logs
- Main loop → Run registry key: sets autorun
- Main loop → Task Manager: launches
- Main loop → Runtime helpers: injects via
- Runtime helpers → Task Manager: loads DLL into
- Main loop → Drive polling: polls drives
- Drive polling → Windows: queries volumes
- Removable drive → Drive polling: volume detected
- Drive polling → Extension copier: copies matching files
- Extension copier → Removable drive: scans files
- Extension copier → Copied files: writes copies
- Task Manager → Injected DLL hooks: loads
- Injected DLL hooks → Directory query filter: implements
- Windows → Directory query filter: dispatches directory queries
- Injected DLL hooks → System info hook: declares hook