# fsquirt/hyperion architecture

> Architecture diagram of the GitHub repository fsquirt/hyperion, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/fsquirt/hyperion
- Repository: https://github.com/fsquirt/hyperion

## Overview

Hyperion is a Windows anti-cheat and kernel-forensics system. Its workflow establishes client trust through TPM attestation, then continuously observes and collects runtime evidence, uploads it for cloud analysis, and returns a human- or agent-produced verdict. The graph preserves the documented attestation, hardening, driver-analysis, evidence-capture, and reverse-agent branches. Sampled source confirms selected runtime, server, and storage behavior; some subsystem links reflect README-documented responsibilities rather than inspected implementations.

Main entry points: [`UserService/Modules/RuntimeDetectionEngine.cs`](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/RuntimeDetectionEngine.cs) (Runtime Engine), [`opencode/packages/opencode/src`](https://github.com/fsquirt/hyperion/tree/Hyperion/opencode/packages/opencode/src) (Reverse Agent), [`UserService/AntiCheatService.cs`](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/AntiCheatService.cs) (User Service), [`Server/Services/PcrReplayer.cs`](https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Services/PcrReplayer.cs) (Attestation Services)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_trust["Trust Admission"]
  node_verifier["Verifier"]
  node_pcr["PCR Verification<br/>[PcrVerifier.cs]"]
end

subgraph group_client["Client Protection"]
  node_user_service["User Service"]
  node_runtime_engine["Runtime Engine"]
  node_policy_sync["Policy Sync<br/>[PolicySync.cs]"]
end

subgraph group_forensics["Kernel Forensics"]
  node_driver_scan["Driver Scanning<br/>[DriverScanner.cs]"]
  node_driver_attach["Device Attachment<br/>[AttachManager.cs]"]
  node_kernel_driver["Kernel Service<br/>[Driver.c]"]
  node_kernel_monitor["Kernel Monitoring<br/>[DriverMonitor.c]"]
  node_event_capture["Event Capture"]
  node_process_tree["Process Tree"]
end

subgraph group_cloud["Cloud Services"]
  node_attestation_api["Attestation API"]
  node_attestation_services["Attestation Services<br/>[PcrReplayer.cs]"]
  node_attestation_db[("Attestation Store")]
  node_tracker_reporter["Evidence Upload<br/>[TrackerReporter.cs]"]
  node_tracker_api["Tracker API"]
  node_reverse_agent_api["Agent API"]
  node_llm_service["LLM Service<br/>[LlmApiService.cs]"]
end

subgraph group_analysis["Analysis Agent"]
  node_reverse_agent["Reverse Agent"]
end

node_admin(("Administrator"))
node_tpm{{"TPM Hardware"}}
node_windows{{"Windows Host"}}
node_game(("Protected Game"))
node_reverse_tools{{"IDA / WinDbg"}}

node_verifier -->|"requests proof"| node_tpm
node_verifier -->|"submits attestation"| node_attestation_api
node_attestation_api -->|"verifies claims"| node_attestation_services
node_attestation_services -->|"replays PCRs"| node_pcr
node_attestation_services -->|"stores records"| node_attestation_db
node_admin -->|"starts service"| node_user_service
node_user_service -->|"starts monitoring"| node_runtime_engine
node_runtime_engine -->|"fetches policies"| node_policy_sync
node_policy_sync -.->|"requests policy"| node_attestation_api
node_runtime_engine -->|"scans drivers"| node_driver_scan
node_runtime_engine -->|"requests attachment"| node_driver_attach
node_driver_attach -->|"sends device IOCTL"| node_kernel_driver
node_kernel_driver -->|"dispatches monitoring"| node_kernel_monitor
node_kernel_monitor -->|"reports kernel evidence"| node_runtime_engine
node_runtime_engine -->|"subscribes to events"| node_event_capture
node_runtime_engine -->|"collects snapshots"| node_process_tree
node_runtime_engine -->|"assembles evidence"| node_tracker_reporter
node_tracker_reporter -->|"uploads session"| node_tracker_api
node_tracker_api -->|"queues analysis"| node_reverse_agent_api
node_reverse_agent -->|"claims session"| node_reverse_agent_api
node_reverse_agent -.->|"invokes analysis tools"| node_reverse_tools
node_reverse_agent -.->|"requests model analysis"| node_llm_service
node_user_service -->|"launches protected game"| node_game
node_windows -->|"provides event logs"| node_event_capture

click node_verifier "https://github.com/fsquirt/hyperion/blob/Hyperion/Verifier/RemoteVerify/Remoteattestation.cs"
click node_pcr "https://github.com/fsquirt/hyperion/blob/Hyperion/Verifier/Verifier/PcrVerifier.cs"
click node_attestation_api "https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Api/AttestationEndpoints.cs"
click node_attestation_services "https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Services/PcrReplayer.cs"
click node_attestation_db "https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Data/AttestationDbContext.cs"
click node_user_service "https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/AntiCheatService.cs"
click node_runtime_engine "https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/RuntimeDetectionEngine.cs"
click node_policy_sync "https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/PolicySync.cs"
click node_driver_scan "https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/DriverAttach/DriverScanner.cs"
click node_driver_attach "https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/DriverAttach/AttachManager.cs"
click node_kernel_driver "https://github.com/fsquirt/hyperion/blob/Hyperion/KernelService/Driver.c"
click node_kernel_monitor "https://github.com/fsquirt/hyperion/blob/Hyperion/KernelService/DriverMonitor.c"
click node_event_capture "https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Comm/WinEventTrackerManager.cs"
click node_process_tree "https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/ProcTree/ProcessTreeCollector.cs"
click node_tracker_reporter "https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/TrackerReporter.cs"
click node_tracker_api "https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Api/TrackerEndpoints.cs"
click node_reverse_agent_api "https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Api/ReverseAgentEndpoints.cs"
click node_reverse_agent "https://github.com/fsquirt/hyperion/tree/Hyperion/opencode/packages/opencode/src"
click node_llm_service "https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Services/LlmApiService.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_verifier,node_pcr toneBlue
class node_user_service,node_runtime_engine,node_policy_sync toneAmber
class node_driver_scan,node_driver_attach,node_kernel_driver,node_kernel_monitor,node_event_capture,node_process_tree toneMint
class node_attestation_api,node_attestation_services,node_attestation_db,node_tracker_reporter,node_tracker_api,node_reverse_agent_api,node_llm_service toneRose
class node_reverse_agent,node_admin,node_tpm,node_windows,node_game,node_reverse_tools toneIndigo
```

## Components

### Trust Admission

- [Verifier](https://github.com/fsquirt/hyperion/blob/Hyperion/Verifier/RemoteVerify/Remoteattestation.cs): `Verifier/RemoteVerify/Remoteattestation.cs`
- [PCR Verification](https://github.com/fsquirt/hyperion/blob/Hyperion/Verifier/Verifier/PcrVerifier.cs): `Verifier/Verifier/PcrVerifier.cs`

### Client Protection

- [User Service](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/AntiCheatService.cs): `UserService/AntiCheatService.cs`
- [Runtime Engine](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/RuntimeDetectionEngine.cs): `UserService/Modules/RuntimeDetectionEngine.cs`
- [Policy Sync](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/PolicySync.cs): `UserService/Modules/PolicySync.cs`

### Kernel Forensics

- [Driver Scanning](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/DriverAttach/DriverScanner.cs): `UserService/Modules/DriverAttach/DriverScanner.cs`
- [Device Attachment](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/DriverAttach/AttachManager.cs): `UserService/Modules/DriverAttach/AttachManager.cs`
- [Kernel Service](https://github.com/fsquirt/hyperion/blob/Hyperion/KernelService/Driver.c): `KernelService/Driver.c`
- [Kernel Monitoring](https://github.com/fsquirt/hyperion/blob/Hyperion/KernelService/DriverMonitor.c): `KernelService/DriverMonitor.c`
- [Event Capture](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Comm/WinEventTrackerManager.cs): `UserService/Comm/WinEventTrackerManager.cs`
- [Process Tree](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/ProcTree/ProcessTreeCollector.cs): `UserService/Modules/ProcTree/ProcessTreeCollector.cs`

### Cloud Services

- [Attestation API](https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Api/AttestationEndpoints.cs): `Server/Api/AttestationEndpoints.cs`
- [Attestation Services](https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Services/PcrReplayer.cs): `Server/Services/PcrReplayer.cs`
- [Attestation Store](https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Data/AttestationDbContext.cs): `Server/Data/AttestationDbContext.cs`
- [Evidence Upload](https://github.com/fsquirt/hyperion/blob/Hyperion/UserService/Modules/TrackerReporter.cs): `UserService/Modules/TrackerReporter.cs`
- [Tracker API](https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Api/TrackerEndpoints.cs): `Server/Api/TrackerEndpoints.cs`
- [Agent API](https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Api/ReverseAgentEndpoints.cs): `Server/Api/ReverseAgentEndpoints.cs`
- [LLM Service](https://github.com/fsquirt/hyperion/blob/Hyperion/Server/Services/LlmApiService.cs): `Server/Services/LlmApiService.cs`

### Analysis Agent

- [Reverse Agent](https://github.com/fsquirt/hyperion/tree/Hyperion/opencode/packages/opencode/src): `opencode/packages/opencode/src`

### Other components

- **Administrator**
- **TPM Hardware**
- **Windows Host**
- **Protected Game**
- **IDA / WinDbg**

## Connections

- Verifier → TPM Hardware: requests proof
- Verifier → Attestation API: submits attestation
- Attestation API → Attestation Services: verifies claims
- Attestation Services → PCR Verification: replays PCRs
- Attestation Services → Attestation Store: stores records
- Administrator → User Service: starts service
- User Service → Runtime Engine: starts monitoring
- Runtime Engine → Policy Sync: fetches policies
- Policy Sync → Attestation API: requests policy
- Runtime Engine → Driver Scanning: scans drivers
- Runtime Engine → Device Attachment: requests attachment
- Device Attachment → Kernel Service: sends device IOCTL
- Kernel Service → Kernel Monitoring: dispatches monitoring
- Kernel Monitoring → Runtime Engine: reports kernel evidence
- Runtime Engine → Event Capture: subscribes to events
- Runtime Engine → Process Tree: collects snapshots
- Runtime Engine → Evidence Upload: assembles evidence
- Evidence Upload → Tracker API: uploads session
- Tracker API → Agent API: queues analysis
- Reverse Agent → Agent API: claims session
- Reverse Agent → IDA / WinDbg: invokes analysis tools
- Reverse Agent → LLM Service: requests model analysis
- User Service → Protected Game: launches protected game
- Windows Host → Event Capture: provides event logs