# davincee/prettyprague architecture

> Architecture diagram of the GitHub repository davincee/prettyprague, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/davincee/prettyprague
- Repository: https://github.com/davincee/prettyprague

## Overview

PrettyPrague is a Windows proof of concept that the README describes as abusing an Avast sandbox vulnerability to dump the SAM database and launch a SYSTEM shell. Its runtime is concentrated in main.cpp: the excerpt shows sandbox-aware dispatch, SAM-related registry and cryptographic operations, password restoration, and shell-launch logic. ntdll.h and offreg.h provide native-API and offline-registry interfaces used by that implementation. The excerpts are partial, so undocumented internal sequencing is omitted; README statements support the high-level capability links.

Main entry points: [`main.cpp`](https://github.com/davincee/prettyprague/blob/main/main.cpp) (SAM dump workflow), [`offreg.h`](https://github.com/davincee/prettyprague/blob/main/offreg.h) (Offline hive access), [`ntdll.h`](https://github.com/davincee/prettyprague/blob/main/ntdll.h) (Native API declarations)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["PoC runtime"]
  node_entry["Runtime dispatch<br/>[main.cpp]"]
  node_sandbox["Sandbox path<br/>[main.cpp]"]
  node_elevation["SYSTEM shell<br/>[main.cpp]"]
end

subgraph group_sam["SAM handling"]
  node_samflow["SAM dump workflow<br/>[main.cpp]"]
  node_hive["Offline hive access<br/>[offreg.h]"]
  node_crypto["Hash decryption<br/>[main.cpp]"]
  node_password["Password handling<br/>[main.cpp]"]
end

subgraph group_windows["Windows interfaces"]
  node_native["Native API declarations<br/>[ntdll.h]"]
end

node_operator(("Operator"))
node_avast["Avast sandbox"]
node_samdb[("SAM database")]
node_dump["SAM dump"]
node_system["Windows SYSTEM"]

node_operator -->|"runs"| node_entry
node_entry -->|"dispatches to"| node_sandbox
node_sandbox -->|"abuses sandbox"| node_avast
node_sandbox -->|"performs"| node_samflow
node_samflow -->|"reads hive values"| node_hive
node_samflow -->|"decrypts hashes"| node_crypto
node_samflow -->|"extracts data"| node_samdb
node_samflow -->|"produces"| node_dump
node_entry -->|"launches"| node_elevation
node_elevation -->|"spawns shell"| node_system
node_samflow -->|"restores password"| node_password
node_entry -->|"uses native APIs"| node_native

click node_entry "https://github.com/davincee/prettyprague/blob/main/main.cpp"
click node_sandbox "https://github.com/davincee/prettyprague/blob/main/main.cpp"
click node_elevation "https://github.com/davincee/prettyprague/blob/main/main.cpp"
click node_samflow "https://github.com/davincee/prettyprague/blob/main/main.cpp"
click node_hive "https://github.com/davincee/prettyprague/blob/main/offreg.h"
click node_crypto "https://github.com/davincee/prettyprague/blob/main/main.cpp"
click node_password "https://github.com/davincee/prettyprague/blob/main/main.cpp"
click node_native "https://github.com/davincee/prettyprague/blob/main/ntdll.h"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_sandbox,node_elevation toneBlue
class node_samflow,node_hive,node_crypto,node_password,node_samdb toneAmber
class node_native toneMint
class node_operator,node_avast,node_dump,node_system toneIndigo
```

## Components

### PoC runtime

- [Runtime dispatch](https://github.com/davincee/prettyprague/blob/main/main.cpp): `main.cpp`
- [Sandbox path](https://github.com/davincee/prettyprague/blob/main/main.cpp): `main.cpp`
- [SYSTEM shell](https://github.com/davincee/prettyprague/blob/main/main.cpp): `main.cpp`

### SAM handling

- [SAM dump workflow](https://github.com/davincee/prettyprague/blob/main/main.cpp): `main.cpp`
- [Offline hive access](https://github.com/davincee/prettyprague/blob/main/offreg.h): `offreg.h`
- [Hash decryption](https://github.com/davincee/prettyprague/blob/main/main.cpp): `main.cpp`
- [Password handling](https://github.com/davincee/prettyprague/blob/main/main.cpp): `main.cpp`

### Windows interfaces

- [Native API declarations](https://github.com/davincee/prettyprague/blob/main/ntdll.h): `ntdll.h`

### Other components

- **Operator**
- **Avast sandbox**
- **SAM database**
- **SAM dump**
- **Windows SYSTEM**

## Connections

- Operator → Runtime dispatch: runs (evidence: `README.md`)
- Runtime dispatch → Sandbox path: dispatches to (evidence: `main.cpp`)
- Sandbox path → Avast sandbox: abuses sandbox (evidence: `README.md`)
- Sandbox path → SAM dump workflow: performs (evidence: `README.md`)
- SAM dump workflow → Offline hive access: reads hive values (evidence: `main.cpp`)
- SAM dump workflow → Hash decryption: decrypts hashes (evidence: `main.cpp`)
- SAM dump workflow → SAM database: extracts data (evidence: `README.md`)
- SAM dump workflow → SAM dump: produces (evidence: `README.md`)
- Runtime dispatch → SYSTEM shell: launches (evidence: `README.md`)
- SYSTEM shell → Windows SYSTEM: spawns shell (evidence: `README.md`)
- SAM dump workflow → Password handling: restores password (evidence: `main.cpp`)
- Runtime dispatch → Native API declarations: uses native APIs (evidence: `main.cpp`)