# dc401/nostarch-evasion-engineering architecture

> Architecture diagram of the GitHub repository dc401/nostarch-evasion-engineering, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dc401/nostarch-evasion-engineering
- Repository: https://github.com/dc401/nostarch-evasion-engineering

## Overview

This repository is a book-lab collection of independent red-team and defensive tools, not one integrated application. Its broad user journey is learning design and evasion techniques, building operational tooling, then analyzing or validating detections; each chapter’s programs are generally invoked separately. The README documents a Chapter 3 cloud-scanning workflow, but no Chapter 3 source appears in the supplied tree, so it is noted here rather than represented with an unsupported path. Some links reflect README-described workflows because the corresponding source was not sampled.

Main entry points: [`chapter-04/goslowc2-firestore-1.2/goslowc2-firestore-1.2.go`](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-04/goslowc2-firestore-1.2/goslowc2-firestore-1.2.go) (Firestore C2 Agent), [`chapter-07/encode.go`](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-07/encode.go) (Hybrid Packing), [`chapter-08/gologexfil/gologexfil-1.1.go`](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-08/gologexfil/gologexfil-1.1.go) (Log Exfiltration), [`chapter-08/gologexfil/gologretrieve-1.1.go`](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-08/gologexfil/gologretrieve-1.1.go) (Log Retrieval)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_principles["Design And Evasion"]
  node_design["Design Examples"]
  node_evasion["Evasion Example<br/>[hex2cipher.py]"]
end

subgraph group_operations["Operational Tools"]
  node_c2["Firestore C2 Agent"]
  node_firestore[("Firestore")]
  node_worm["SSH Worm<br/>[main.go]"]
  node_hostenum["Host Enumeration<br/>[hostnmae.go]"]
  node_userenum["User And Groups<br/>[ug.go]"]
  node_processenum["Process Enumeration<br/>[proc.go]"]
  node_networkenum["Network Enumeration<br/>[nt.go]"]
  node_hybridpack["Hybrid Packing<br/>[encode.go]"]
  node_loader["Shellcode Loader<br/>[loader.go]"]
end

subgraph group_staging["Staging And Exfiltration"]
  node_cab["CAB Staging<br/>[gostagecab.go]"]
  node_exfil["Log Exfiltration<br/>[gologexfil-1.1.go]"]
  node_logging[("Cloud Logging")]
  node_retrieve["Log Retrieval"]
end

subgraph group_detection["Detection Tools"]
  node_analyzer["Go Binary Analyzer<br/>[go-analyzer.go]"]
  node_netdetector["Network Detector"]
  node_loggen["PAN Log Generator"]
end

subgraph group_validation["Detection Validation"]
  node_reveal["IAM Simulation<br/>[lambda-iam-sim.py]"]
  node_cloudtrail[("CloudTrail And CloudWatch")]
end

node_learner(("Security Practitioner"))

node_learner -->|"runs examples"| node_design
node_learner -->|"runs example"| node_evasion
node_learner -->|"deploys agent"| node_c2
node_c2 -->|"reads and updates"| node_firestore
node_learner -->|"runs worm"| node_worm
node_learner -->|"runs tool"| node_hostenum
node_learner -->|"runs tool"| node_userenum
node_learner -->|"runs tool"| node_processenum
node_learner -->|"runs tool"| node_networkenum
node_learner -->|"builds payload"| node_hybridpack
node_hybridpack -.->|"prepares payload for"| node_loader
node_learner -->|"runs loader"| node_loader
node_learner -->|"stages files"| node_cab
node_learner -->|"runs exfiltration"| node_exfil
node_exfil -->|"writes entries"| node_logging
node_learner -->|"retrieves data"| node_retrieve
node_retrieve -->|"reads entries"| node_logging
node_learner -->|"analyzes binary"| node_analyzer
node_learner -->|"generates logs"| node_loggen
node_loggen -.->|"supplies sample logs"| node_netdetector
node_learner -->|"analyzes traffic"| node_netdetector
node_learner -->|"runs simulation"| node_reveal
node_reveal -.->|"validates telemetry"| node_cloudtrail

click node_design "https://github.com/dc401/nostarch-evasion-engineering/tree/main/chapter-01"
click node_evasion "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-02/hex2cipher.py"
click node_c2 "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-04/goslowc2-firestore-1.2/goslowc2-firestore-1.2.go"
click node_worm "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-05/main.go"
click node_hostenum "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-06/hostnmae.go"
click node_userenum "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-06/ug.go"
click node_processenum "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-06/proc.go"
click node_networkenum "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-06/nt.go"
click node_hybridpack "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-07/encode.go"
click node_loader "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-07/loader.go"
click node_cab "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-08/gostagecab/gostagecab.go"
click node_exfil "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-08/gologexfil/gologexfil-1.1.go"
click node_retrieve "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-08/gologexfil/gologretrieve-1.1.go"
click node_analyzer "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-09/go-analyzer/go-analyzer.go"
click node_netdetector "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-09/network-detector/network-ttp-detector-1.1.py"
click node_loggen "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-09/network-detector/pan-log-generator-1.1.py"
click node_reveal "https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-10/lambda-iam-sim.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_design,node_evasion toneBlue
class node_c2,node_firestore,node_worm,node_hostenum,node_userenum,node_processenum,node_networkenum,node_hybridpack,node_loader toneAmber
class node_cab,node_exfil,node_logging,node_retrieve toneMint
class node_analyzer,node_netdetector,node_loggen toneRose
class node_reveal,node_cloudtrail,node_learner toneIndigo
```

## Components

### Design And Evasion

- [Design Examples](https://github.com/dc401/nostarch-evasion-engineering/tree/main/chapter-01): `chapter-01`
- [Evasion Example](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-02/hex2cipher.py): `chapter-02/hex2cipher.py`

### Operational Tools

- [Firestore C2 Agent](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-04/goslowc2-firestore-1.2/goslowc2-firestore-1.2.go): `chapter-04/goslowc2-firestore-1.2/goslowc2-firestore-1.2.go`
- **Firestore**
- [SSH Worm](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-05/main.go): `chapter-05/main.go`
- [Host Enumeration](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-06/hostnmae.go): `chapter-06/hostnmae.go`
- [User And Groups](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-06/ug.go): `chapter-06/ug.go`
- [Process Enumeration](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-06/proc.go): `chapter-06/proc.go`
- [Network Enumeration](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-06/nt.go): `chapter-06/nt.go`
- [Hybrid Packing](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-07/encode.go): `chapter-07/encode.go`
- [Shellcode Loader](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-07/loader.go): `chapter-07/loader.go`

### Staging And Exfiltration

- [CAB Staging](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-08/gostagecab/gostagecab.go): `chapter-08/gostagecab/gostagecab.go`
- [Log Exfiltration](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-08/gologexfil/gologexfil-1.1.go): `chapter-08/gologexfil/gologexfil-1.1.go`
- **Cloud Logging**
- [Log Retrieval](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-08/gologexfil/gologretrieve-1.1.go): `chapter-08/gologexfil/gologretrieve-1.1.go`

### Detection Tools

- [Go Binary Analyzer](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-09/go-analyzer/go-analyzer.go): `chapter-09/go-analyzer/go-analyzer.go`
- [Network Detector](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-09/network-detector/network-ttp-detector-1.1.py): `chapter-09/network-detector/network-ttp-detector-1.1.py`
- [PAN Log Generator](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-09/network-detector/pan-log-generator-1.1.py): `chapter-09/network-detector/pan-log-generator-1.1.py`

### Detection Validation

- [IAM Simulation](https://github.com/dc401/nostarch-evasion-engineering/blob/main/chapter-10/lambda-iam-sim.py): `chapter-10/lambda-iam-sim.py`
- **CloudTrail And CloudWatch**

### Other components

- **Security Practitioner**

## Connections

- Security Practitioner → Design Examples: runs examples
- Security Practitioner → Evasion Example: runs example
- Security Practitioner → Firestore C2 Agent: deploys agent
- Firestore C2 Agent → Firestore: reads and updates
- Security Practitioner → SSH Worm: runs worm
- Security Practitioner → Host Enumeration: runs tool
- Security Practitioner → User And Groups: runs tool
- Security Practitioner → Process Enumeration: runs tool
- Security Practitioner → Network Enumeration: runs tool
- Security Practitioner → Hybrid Packing: builds payload
- Hybrid Packing → Shellcode Loader: prepares payload for
- Security Practitioner → Shellcode Loader: runs loader
- Security Practitioner → CAB Staging: stages files
- Security Practitioner → Log Exfiltration: runs exfiltration
- Log Exfiltration → Cloud Logging: writes entries
- Security Practitioner → Log Retrieval: retrieves data
- Log Retrieval → Cloud Logging: reads entries
- Security Practitioner → Go Binary Analyzer: analyzes binary
- Security Practitioner → PAN Log Generator: generates logs
- PAN Log Generator → Network Detector: supplies sample logs
- Security Practitioner → Network Detector: analyzes traffic
- Security Practitioner → IAM Simulation: runs simulation
- IAM Simulation → CloudTrail And CloudWatch: validates telemetry