How fsquirt/hyperion works
Hyperion is a Windows anti-cheat and kernel-forensics system. Its workflow establishes client trust through TPM attestation, then continuously observes and collects runtime evidence, uploads it for cloud analysis, and returns a human- or agent-produced verdict. The graph preserves the documented attestation, hardening, driver-analysis, evidence-capture, and reverse-agent branches. Sampled source confirms selected runtime, server, and storage behavior; some subsystem links reflect README-documented responsibilities rather than inspected implementations.
Main entry points: RuntimeDetectionEngine.cs Runtime Engine · src Reverse Agent · AntiCheatService.cs User Service · PcrReplayer.cs Attestation Services
Components 24
Trust Admission
- Verifier
Verifier/RemoteVerify/Remoteattestation.cs - PCR Verification
Verifier/Verifier/PcrVerifier.cs
Client Protection
- User Service
UserService/AntiCheatService.cs - Runtime Engine
UserService/Modules/RuntimeDetectionEngine.cs - Policy Sync
UserService/Modules/PolicySync.cs
Kernel Forensics
- Driver Scanning
UserService/Modules/DriverAttach/DriverScanner.cs - Device Attachment
UserService/Modules/DriverAttach/AttachManager.cs - Kernel Service
KernelService/Driver.c - Kernel Monitoring
KernelService/DriverMonitor.c - Event Capture
UserService/Comm/WinEventTrackerManager.cs - Process Tree
UserService/Modules/ProcTree/ProcessTreeCollector.cs
Cloud Services
- Attestation API
Server/Api/AttestationEndpoints.cs - Attestation Services
Server/Services/PcrReplayer.cs - Attestation Store
Server/Data/AttestationDbContext.cs - Evidence Upload
UserService/Modules/TrackerReporter.cs - Tracker API
Server/Api/TrackerEndpoints.cs - Agent API
Server/Api/ReverseAgentEndpoints.cs - LLM Service
Server/Services/LlmApiService.cs
Analysis Agent
- Reverse Agent
opencode/packages/opencode/src
Other components
- Administrator
- TPM Hardware
- Windows Host
- Protected Game
- IDA / WinDbg
Connections 24
- Verifier → TPM Hardware: requests proof
- Verifier → Attestation API: submits attestation
- Attestation API → Attestation Services: verifies claims
- Attestation Services → PCR Verification: replays PCRs
- Attestation Services → Attestation Store: stores records
- Administrator → User Service: starts service
- User Service → Runtime Engine: starts monitoring
- Runtime Engine → Policy Sync: fetches policies
- Policy Sync → Attestation API: requests policy
- Runtime Engine → Driver Scanning: scans drivers
- Runtime Engine → Device Attachment: requests attachment
- Device Attachment → Kernel Service: sends device IOCTL
- Kernel Service → Kernel Monitoring: dispatches monitoring
- Kernel Monitoring → Runtime Engine: reports kernel evidence
- Runtime Engine → Event Capture: subscribes to events
- Runtime Engine → Process Tree: collects snapshots
- Runtime Engine → Evidence Upload: assembles evidence
- Evidence Upload → Tracker API: uploads session
- Tracker API → Agent API: queues analysis
- Reverse Agent → Agent API: claims session
- Reverse Agent → IDA / WinDbg: invokes analysis tools
- Reverse Agent → LLM Service: requests model analysis
- User Service → Protected Game: launches protected game
- Windows Host → Event Capture: provides event logs