# captain-coding74/avguard architecture

> Architecture diagram of the GitHub repository captain-coding74/avguard, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-24). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/captain-coding74/avguard
- Repository: https://github.com/captain-coding74/avguard

## Overview

AVGuard is a Windows file-scanning application with GUI and CLI entry points. The main workflow is user-selected or monitored files → guarded scan and detection evidence → verdict/reporting → optional quarantine, with restore/export as recovery paths. Separate branches provide integrity baselines, IOC blocklists, rule-pack management, scheduled scans, and event history. The README documents these capabilities and module responsibilities; sampled excerpts are partial, so uncertain internal call wiring is omitted.

Main entry points: [`avguard/scanner.py`](https://github.com/captain-coding74/avguard/blob/main/avguard/scanner.py) (Scan engine), [`avguard/__main__.py`](https://github.com/captain-coding74/avguard/blob/main/avguard/__main__.py) (CLI), [`avguard/gui.py`](https://github.com/captain-coding74/avguard/blob/main/avguard/gui.py) (Desktop GUI), [`avguard/watcher.py`](https://github.com/captain-coding74/avguard/blob/main/avguard/watcher.py) (Realtime watcher)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["User interfaces"]
  node_cli["CLI<br/>[__main__.py]"]
  node_gui["Desktop GUI<br/>[gui.py]"]
end

subgraph group_detection["Scanning and detection"]
  node_scanner["Scan engine<br/>[scanner.py]"]
  node_rules["YARA rules<br/>[malware.yara]"]
  node_rulepacks["Rule packs<br/>[rulepacks.py]"]
  node_archives["Archive inspection<br/>[archives.py]"]
  node_peinfo["PE analysis<br/>[peinfo.py]"]
  node_signing["Signature checks<br/>[signing.py]"]
  node_tlsh["Similarity matching<br/>[tlsh.py]"]
  node_protection["Self-protection<br/>[protection.py]"]
  node_cloud["VirusTotal lookup<br/>[cloud.py]"]
end

subgraph group_response["Threat response"]
  node_quarantine[("Quarantine and restore<br/>[quarantine.py]")]
end

subgraph group_monitoring["Monitoring and integrity"]
  node_fim["File integrity<br/>[fim.py]"]
  node_watcher["Realtime watcher<br/>[watcher.py]"]
  node_schedule["Scheduled scans<br/>[scheduling.py]"]
end

subgraph group_state["Configuration and records"]
  node_iocs[("IOC blocklist<br/>[iocs.py]")]
  node_events[("Event history<br/>[events.py]")]
  node_config["Settings and paths<br/>[config.py]"]
  node_instance["Single-writer lock<br/>[instance.py]"]
  node_logs["Logging<br/>[logsetup.py]"]
end

node_user(("User"))
node_virustotal(("VirusTotal"))
node_filesystem[("Filesystem")]
node_malwarebazaar(("MalwareBazaar feed"))

node_user -->|"runs commands"| node_cli
node_user -->|"uses"| node_gui
node_cli -->|"requests scans"| node_scanner
node_gui -->|"requests scans"| node_scanner
node_watcher -->|"dispatches changed files"| node_scanner
node_scanner -->|"checks paths"| node_protection
node_scanner -->|"matches rules"| node_rules
node_scanner -->|"loads pack rules"| node_rulepacks
node_scanner -->|"inspects archives"| node_archives
node_scanner -->|"checks structure"| node_peinfo
node_scanner -->|"checks signatures"| node_signing
node_scanner -->|"matches similarity"| node_tlsh
node_scanner -->|"checks hashes"| node_iocs
node_scanner -.->|"requests lookup"| node_cloud
node_cloud -.->|"queries"| node_virustotal
node_cli -->|"lists restores exports"| node_quarantine
node_scanner -->|"moves malicious files"| node_quarantine
node_quarantine -->|"moves and restores files"| node_filesystem
node_watcher -->|"watches changes"| node_filesystem
node_fim -->|"hashes files"| node_filesystem
node_cli -->|"runs integrity commands"| node_fim
node_gui -->|"manages integrity checks"| node_fim
node_cli -->|"imports and updates"| node_iocs
node_iocs -.->|"fetches feed"| node_malwarebazaar
node_cli -->|"manages packs"| node_rulepacks
node_gui -->|"controls monitoring"| node_watcher
node_gui -->|"configures schedules"| node_schedule
node_cli -->|"controls schedules"| node_schedule
node_scanner -->|"records scan events"| node_events
node_gui -->|"shows history"| node_events
node_cli -->|"reads settings"| node_config
node_gui -->|"reads and saves settings"| node_config
node_cli -->|"acquires writer lock"| node_instance
node_gui -->|"acquires writer lock"| node_instance
node_scanner -->|"records diagnostics"| node_logs
node_gui -->|"shows log feed"| node_logs

click node_cli "https://github.com/captain-coding74/avguard/blob/main/avguard/__main__.py"
click node_gui "https://github.com/captain-coding74/avguard/blob/main/avguard/gui.py"
click node_scanner "https://github.com/captain-coding74/avguard/blob/main/avguard/scanner.py"
click node_rules "https://github.com/captain-coding74/avguard/blob/main/rules/malware.yara"
click node_rulepacks "https://github.com/captain-coding74/avguard/blob/main/avguard/rulepacks.py"
click node_archives "https://github.com/captain-coding74/avguard/blob/main/avguard/archives.py"
click node_peinfo "https://github.com/captain-coding74/avguard/blob/main/avguard/peinfo.py"
click node_signing "https://github.com/captain-coding74/avguard/blob/main/avguard/signing.py"
click node_tlsh "https://github.com/captain-coding74/avguard/blob/main/avguard/tlsh.py"
click node_protection "https://github.com/captain-coding74/avguard/blob/main/avguard/protection.py"
click node_cloud "https://github.com/captain-coding74/avguard/blob/main/avguard/cloud.py"
click node_quarantine "https://github.com/captain-coding74/avguard/blob/main/avguard/quarantine.py"
click node_fim "https://github.com/captain-coding74/avguard/blob/main/avguard/fim.py"
click node_watcher "https://github.com/captain-coding74/avguard/blob/main/avguard/watcher.py"
click node_schedule "https://github.com/captain-coding74/avguard/blob/main/avguard/scheduling.py"
click node_iocs "https://github.com/captain-coding74/avguard/blob/main/avguard/iocs.py"
click node_events "https://github.com/captain-coding74/avguard/blob/main/avguard/events.py"
click node_config "https://github.com/captain-coding74/avguard/blob/main/avguard/config.py"
click node_instance "https://github.com/captain-coding74/avguard/blob/main/avguard/instance.py"
click node_logs "https://github.com/captain-coding74/avguard/blob/main/avguard/logsetup.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_gui,node_user toneBlue
class node_scanner,node_rules,node_rulepacks,node_archives,node_peinfo,node_signing,node_tlsh,node_protection,node_cloud,node_filesystem toneAmber
class node_quarantine toneMint
class node_fim,node_watcher,node_schedule toneRose
class node_iocs,node_events,node_config,node_instance,node_logs,node_virustotal,node_malwarebazaar toneIndigo
```

## Components

### User interfaces

- [CLI](https://github.com/captain-coding74/avguard/blob/main/avguard/__main__.py): `avguard/__main__.py`
- [Desktop GUI](https://github.com/captain-coding74/avguard/blob/main/avguard/gui.py): `avguard/gui.py`

### Scanning and detection

- [Scan engine](https://github.com/captain-coding74/avguard/blob/main/avguard/scanner.py): `avguard/scanner.py`
- [YARA rules](https://github.com/captain-coding74/avguard/blob/main/rules/malware.yara): `rules/malware.yara`
- [Rule packs](https://github.com/captain-coding74/avguard/blob/main/avguard/rulepacks.py): `avguard/rulepacks.py`
- [Archive inspection](https://github.com/captain-coding74/avguard/blob/main/avguard/archives.py): `avguard/archives.py`
- [PE analysis](https://github.com/captain-coding74/avguard/blob/main/avguard/peinfo.py): `avguard/peinfo.py`
- [Signature checks](https://github.com/captain-coding74/avguard/blob/main/avguard/signing.py): `avguard/signing.py`
- [Similarity matching](https://github.com/captain-coding74/avguard/blob/main/avguard/tlsh.py): `avguard/tlsh.py`
- [Self-protection](https://github.com/captain-coding74/avguard/blob/main/avguard/protection.py): `avguard/protection.py`
- [VirusTotal lookup](https://github.com/captain-coding74/avguard/blob/main/avguard/cloud.py): `avguard/cloud.py`

### Threat response

- [Quarantine and restore](https://github.com/captain-coding74/avguard/blob/main/avguard/quarantine.py): `avguard/quarantine.py`

### Monitoring and integrity

- [File integrity](https://github.com/captain-coding74/avguard/blob/main/avguard/fim.py): `avguard/fim.py`
- [Realtime watcher](https://github.com/captain-coding74/avguard/blob/main/avguard/watcher.py): `avguard/watcher.py`
- [Scheduled scans](https://github.com/captain-coding74/avguard/blob/main/avguard/scheduling.py): `avguard/scheduling.py`

### Configuration and records

- [IOC blocklist](https://github.com/captain-coding74/avguard/blob/main/avguard/iocs.py): `avguard/iocs.py`
- [Event history](https://github.com/captain-coding74/avguard/blob/main/avguard/events.py): `avguard/events.py`
- [Settings and paths](https://github.com/captain-coding74/avguard/blob/main/avguard/config.py): `avguard/config.py`
- [Single-writer lock](https://github.com/captain-coding74/avguard/blob/main/avguard/instance.py): `avguard/instance.py`
- [Logging](https://github.com/captain-coding74/avguard/blob/main/avguard/logsetup.py): `avguard/logsetup.py`

### Other components

- **User**
- **VirusTotal**
- **Filesystem**
- **MalwareBazaar feed**

## Connections

- User → CLI: runs commands
- User → Desktop GUI: uses
- CLI → Scan engine: requests scans
- Desktop GUI → Scan engine: requests scans
- Realtime watcher → Scan engine: dispatches changed files
- Scan engine → Self-protection: checks paths
- Scan engine → YARA rules: matches rules
- Scan engine → Rule packs: loads pack rules
- Scan engine → Archive inspection: inspects archives
- Scan engine → PE analysis: checks structure
- Scan engine → Signature checks: checks signatures
- Scan engine → Similarity matching: matches similarity
- Scan engine → IOC blocklist: checks hashes
- Scan engine → VirusTotal lookup: requests lookup
- VirusTotal lookup → VirusTotal: queries
- CLI → Quarantine and restore: lists restores exports
- Scan engine → Quarantine and restore: moves malicious files
- Quarantine and restore → Filesystem: moves and restores files
- Realtime watcher → Filesystem: watches changes
- File integrity → Filesystem: hashes files
- CLI → File integrity: runs integrity commands
- Desktop GUI → File integrity: manages integrity checks
- CLI → IOC blocklist: imports and updates
- IOC blocklist → MalwareBazaar feed: fetches feed
- CLI → Rule packs: manages packs
- Desktop GUI → Realtime watcher: controls monitoring
- Desktop GUI → Scheduled scans: configures schedules
- CLI → Scheduled scans: controls schedules
- Scan engine → Event history: records scan events
- Desktop GUI → Event history: shows history
- CLI → Settings and paths: reads settings
- Desktop GUI → Settings and paths: reads and saves settings
- CLI → Single-writer lock: acquires writer lock
- Desktop GUI → Single-writer lock: acquires writer lock
- Scan engine → Logging: records diagnostics
- Desktop GUI → Logging: shows log feed