# dellrall/booto architecture

> Architecture diagram of the GitHub repository dellrall/booto, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dellrall/booto
- Repository: https://github.com/dellrall/booto

## Overview

Booto is an offline, read-only Linux forensic framework. Its primary workflow is CLI or TUI launch, target discovery and read-only mounting, a coordinated scan of boot and system artifacts, then a verdict and case report. The TUI also exposes device-firmware checks, findings, and evidence; the README documents additional scanner capabilities whose call sites were not sampled. Dashed links mark those unverified orchestration details rather than asserting specific calls.

Main entry points: [`src/forensic_scan.c`](https://github.com/dellrall/booto/blob/main/src/forensic_scan.c) (Scan orchestrator), [`src/tui/tui_app.c`](https://github.com/dellrall/booto/blob/main/src/tui/tui_app.c) (Interactive TUI), [`src/main.c`](https://github.com/dellrall/booto/blob/main/src/main.c) (CLI dispatcher), [`src/disk_mount.c`](https://github.com/dellrall/booto/blob/main/src/disk_mount.c) (Device discovery)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Entry and interface"]
  node_main["CLI dispatcher<br/>[main.c]"]
  node_tui["Interactive TUI<br/>[tui_app.c]"]
  node_terminal["Terminal input<br/>[terminal.c]"]
  node_panes["Pane handlers<br/>[pane.c]"]
  node_wm["BSP window manager<br/>[wm.c]"]
end

subgraph group_target["Target and scan"]
  node_discovery["Device discovery<br/>[disk_mount.c]"]
  node_mount["Read-only mounter<br/>[disk_mount.c]"]
  node_scan["Scan orchestrator<br/>[forensic_scan.c]"]
end

subgraph group_engines["Detection engines"]
  node_mbr["MBR and VBR audit<br/>[mbr_auditor.c]"]
  node_uefi["UEFI and ESP audit<br/>[uefi_analyzer.c]"]
  node_kernel["Kernel and LKM audit<br/>[kernel_inspector.c]"]
  node_initramfs["Initramfs audit"]
  node_preload["Preload scan<br/>[preload_scanner.c]"]
  node_packages["Package integrity<br/>[pkg_integrity.c]"]
  node_windows["Windows boot audit<br/>[windows_boot.c]"]
  node_firmware["Host firmware audit<br/>[firmware_auditor.c]"]
  node_rules["Signed rules<br/>[rules_loader.c]"]
end

subgraph group_output["Evidence and reporting"]
  node_reports["Case reports<br/>[case_reporter.c]"]
  node_persistence["Report persistence<br/>[persistence_mgr.c]"]
  node_logger["Forensic logs<br/>[logger.c]"]
end

node_user(("Operator"))

node_user -->|"starts"| node_main
node_main -->|"launches"| node_tui
node_main -->|"dispatches"| node_scan
node_main -.->|"configures"| node_discovery
node_tui -->|"uses"| node_terminal
node_tui -->|"uses"| node_wm
node_tui -->|"renders"| node_panes
node_tui -.->|"runs"| node_scan
node_tui -.->|"exports"| node_reports
node_discovery -.->|"selects devices"| node_mount
node_scan -->|"mounts target"| node_mount
node_scan -.->|"audits sectors"| node_mbr
node_scan -.->|"audits ESP"| node_uefi
node_scan -.->|"audits kernel"| node_kernel
node_scan -.->|"audits initramfs"| node_initramfs
node_scan -.->|"scans preload"| node_preload
node_scan -.->|"checks packages"| node_packages
node_scan -.->|"checks Windows"| node_windows
node_scan -.->|"audits host"| node_firmware
node_mbr -->|"loads signatures"| node_rules
node_firmware -->|"loads rules"| node_rules
node_scan -.->|"records results"| node_reports
node_tui -.->|"manages storage"| node_persistence
node_scan -->|"logs activity"| node_logger

click node_main "https://github.com/dellrall/booto/blob/main/src/main.c"
click node_tui "https://github.com/dellrall/booto/blob/main/src/tui/tui_app.c"
click node_terminal "https://github.com/dellrall/booto/blob/main/src/tui/terminal.c"
click node_panes "https://github.com/dellrall/booto/blob/main/src/tui/pane.c"
click node_wm "https://github.com/dellrall/booto/blob/main/src/tui/wm.c"
click node_discovery "https://github.com/dellrall/booto/blob/main/src/disk_mount.c"
click node_mount "https://github.com/dellrall/booto/blob/main/src/disk_mount.c"
click node_scan "https://github.com/dellrall/booto/blob/main/src/forensic_scan.c"
click node_mbr "https://github.com/dellrall/booto/blob/main/src/mbr_auditor.c"
click node_uefi "https://github.com/dellrall/booto/blob/main/src/uefi_analyzer.c"
click node_kernel "https://github.com/dellrall/booto/blob/main/src/kernel_inspector.c"
click node_initramfs "https://github.com/dellrall/booto/blob/main/src/initramfs_auditor.c"
click node_preload "https://github.com/dellrall/booto/blob/main/src/preload_scanner.c"
click node_packages "https://github.com/dellrall/booto/blob/main/src/pkg_integrity.c"
click node_windows "https://github.com/dellrall/booto/blob/main/src/windows_boot.c"
click node_firmware "https://github.com/dellrall/booto/blob/main/src/firmware_auditor.c"
click node_rules "https://github.com/dellrall/booto/blob/main/src/rules_loader.c"
click node_reports "https://github.com/dellrall/booto/blob/main/src/case_reporter.c"
click node_persistence "https://github.com/dellrall/booto/blob/main/src/persistence_mgr.c"
click node_logger "https://github.com/dellrall/booto/blob/main/src/logger.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_tui,node_terminal,node_panes,node_wm toneBlue
class node_discovery,node_mount,node_scan toneAmber
class node_mbr,node_uefi,node_kernel,node_initramfs,node_preload,node_packages,node_windows,node_firmware,node_rules toneMint
class node_reports,node_persistence,node_logger toneRose
class node_user toneIndigo
```

## Components

### Entry and interface

- [CLI dispatcher](https://github.com/dellrall/booto/blob/main/src/main.c): `src/main.c`
- [Interactive TUI](https://github.com/dellrall/booto/blob/main/src/tui/tui_app.c): `src/tui/tui_app.c`
- [Terminal input](https://github.com/dellrall/booto/blob/main/src/tui/terminal.c): `src/tui/terminal.c`
- [Pane handlers](https://github.com/dellrall/booto/blob/main/src/tui/pane.c): `src/tui/pane.c`
- [BSP window manager](https://github.com/dellrall/booto/blob/main/src/tui/wm.c): `src/tui/wm.c`

### Target and scan

- [Device discovery](https://github.com/dellrall/booto/blob/main/src/disk_mount.c): `src/disk_mount.c`
- [Read-only mounter](https://github.com/dellrall/booto/blob/main/src/disk_mount.c): `src/disk_mount.c`
- [Scan orchestrator](https://github.com/dellrall/booto/blob/main/src/forensic_scan.c): `src/forensic_scan.c`

### Detection engines

- [MBR and VBR audit](https://github.com/dellrall/booto/blob/main/src/mbr_auditor.c): `src/mbr_auditor.c`
- [UEFI and ESP audit](https://github.com/dellrall/booto/blob/main/src/uefi_analyzer.c): `src/uefi_analyzer.c`
- [Kernel and LKM audit](https://github.com/dellrall/booto/blob/main/src/kernel_inspector.c): `src/kernel_inspector.c`
- [Initramfs audit](https://github.com/dellrall/booto/blob/main/src/initramfs_auditor.c): `src/initramfs_auditor.c`
- [Preload scan](https://github.com/dellrall/booto/blob/main/src/preload_scanner.c): `src/preload_scanner.c`
- [Package integrity](https://github.com/dellrall/booto/blob/main/src/pkg_integrity.c): `src/pkg_integrity.c`
- [Windows boot audit](https://github.com/dellrall/booto/blob/main/src/windows_boot.c): `src/windows_boot.c`
- [Host firmware audit](https://github.com/dellrall/booto/blob/main/src/firmware_auditor.c): `src/firmware_auditor.c`
- [Signed rules](https://github.com/dellrall/booto/blob/main/src/rules_loader.c): `src/rules_loader.c`

### Evidence and reporting

- [Case reports](https://github.com/dellrall/booto/blob/main/src/case_reporter.c): `src/case_reporter.c`
- [Report persistence](https://github.com/dellrall/booto/blob/main/src/persistence_mgr.c): `src/persistence_mgr.c`
- [Forensic logs](https://github.com/dellrall/booto/blob/main/src/logger.c): `src/logger.c`

### Other components

- **Operator**

## Connections

- Operator → CLI dispatcher: starts
- CLI dispatcher → Interactive TUI: launches (evidence: `src/main.c`)
- CLI dispatcher → Scan orchestrator: dispatches (evidence: `src/main.c`)
- CLI dispatcher → Device discovery: configures
- Interactive TUI → Terminal input: uses (evidence: `src/tui/tui_app.c`)
- Interactive TUI → BSP window manager: uses (evidence: `src/tui/tui_app.c`)
- Interactive TUI → Pane handlers: renders (evidence: `src/tui/tui_app.c`)
- Interactive TUI → Scan orchestrator: runs
- Interactive TUI → Case reports: exports
- Device discovery → Read-only mounter: selects devices (evidence: `src/disk_mount.c`)
- Scan orchestrator → Read-only mounter: mounts target
- Scan orchestrator → MBR and VBR audit: audits sectors
- Scan orchestrator → UEFI and ESP audit: audits ESP
- Scan orchestrator → Kernel and LKM audit: audits kernel
- Scan orchestrator → Initramfs audit: audits initramfs
- Scan orchestrator → Preload scan: scans preload
- Scan orchestrator → Package integrity: checks packages
- Scan orchestrator → Windows boot audit: checks Windows
- Scan orchestrator → Host firmware audit: audits host
- MBR and VBR audit → Signed rules: loads signatures (evidence: `src/mbr_auditor.c`)
- Host firmware audit → Signed rules: loads rules (evidence: `src/firmware_auditor.c`)
- Scan orchestrator → Case reports: records results
- Interactive TUI → Report persistence: manages storage
- Scan orchestrator → Forensic logs: logs activity (evidence: `src/forensic_scan.c`)