# hckr-zahid/cybergun architecture

> Architecture diagram of the GitHub repository hckr-zahid/cybergun, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/hckr-zahid/cybergun
- Repository: https://github.com/hckr-zahid/cybergun

## Overview

CyberGun is a Windows-oriented threat detection and mitigation application. The main workflow starts in the desktop app, launches monitoring and scan engines, routes findings and security events through a shared signal bus, and exposes investigation and response features in the dashboard. Static, dynamic, network, intelligence-update, forensic, and quarantine capabilities are represented; edges are limited to README statements and visible imports/calls in supplied excerpts or the source index. Unsampled subsystem internals are not asserted.

Main entry points: [`gui/components/MainDashboard.py`](https://github.com/hckr-zahid/cybergun/blob/main/gui/components/MainDashboard.py) (Main dashboard), [`core/engine_launcher.py`](https://github.com/hckr-zahid/cybergun/blob/main/core/engine_launcher.py) (Engine launcher), [`core/DynamicEngine.py`](https://github.com/hckr-zahid/cybergun/blob/main/core/DynamicEngine.py) (Dynamic monitoring), [`core/SignalBus.py`](https://github.com/hckr-zahid/cybergun/blob/main/core/SignalBus.py) (Signal bus)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_app["Application"]
  node_entry["Application entry<br/>[main.py]"]
  node_guiapp["Desktop app<br/>[gui_app.py]"]
  node_launcher["Engine launcher<br/>[engine_launcher.py]"]
  node_bus["Signal bus<br/>[SignalBus.py]"]
  node_settings["Configuration<br/>[config_manager.py]"]
end

subgraph group_detect["Detection Engines"]
  node_static["Static scanning<br/>[StaticEngine.py]"]
  node_staticmods["Static detectors"]
  node_ember["EMBER model<br/>[model.py]"]
  node_dynamic["Dynamic monitoring<br/>[DynamicEngine.py]"]
  node_behavior["Behavior monitoring<br/>[BehaviorMonitor.py]"]
  node_systemmon["System monitoring<br/>[SystemMonitor.py]"]
  node_usb["USB monitoring<br/>[USBMonitor.py]"]
  node_sandbox["Sandbox simulation<br/>[SandboxSim.py]"]
  node_apitrace["API tracing<br/>[ApiTraceManager.py]"]
  node_ransom["Ransomware monitoring"]
  node_filesystem["File guard"]
  node_network["Network engine<br/>[NetworkEngine.py]"]
  node_netmods["Network analyzers"]
end

subgraph group_intel["Threat Intelligence"]
  node_downloader["Intel updater"]
end

subgraph group_respond["Investigation and Response"]
  node_quarantine[("Quarantine")]
  node_responder["Threat response<br/>[ThreatResponder.py]"]
  node_forensics["Forensic analysis"]
  node_database[("Threat database")]
end

subgraph group_ui["Dashboard"]
  node_dashboard["Main dashboard<br/>[MainDashboard.py]"]
  node_feeds["Event feeds<br/>[BehaviorFeed.py]"]
  node_networkfeed["Network feed<br/>[NetworkFeed.py]"]
  node_investigator["Forensic viewer"]
  node_updates["Update panel"]
end

node_user(("Operator"))

node_user -->|"starts"| node_entry
node_entry -->|"launches"| node_guiapp
node_entry -->|"starts engines"| node_launcher
node_guiapp -->|"shows"| node_dashboard
node_launcher -->|"creates"| node_static
node_launcher -->|"creates"| node_dynamic
node_launcher -->|"creates"| node_network
node_launcher -->|"creates"| node_filesystem
node_launcher -->|"creates"| node_downloader
node_static -->|"runs scanners"| node_staticmods
node_staticmods -->|"uses model"| node_ember
node_dynamic -->|"starts"| node_systemmon
node_dynamic -->|"starts"| node_behavior
node_dynamic -->|"starts"| node_usb
node_dynamic -->|"dispatches scans"| node_sandbox
node_behavior -->|"observes"| node_systemmon
node_behavior -->|"uses"| node_apitrace
node_network -->|"starts components"| node_netmods
node_network -.->|"gets blacklist"| node_database
node_network -->|"subscribes block requests"| node_bus
node_filesystem -->|"scans changed files"| node_static
node_static -->|"emits findings"| node_bus
node_dynamic -.->|"publishes events"| node_bus
node_bus -->|"feeds events"| node_dashboard
node_bus -->|"feeds behavior"| node_feeds
node_bus -->|"feeds network"| node_networkfeed
node_dashboard -->|"uses quarantine"| node_quarantine
node_dashboard -->|"opens"| node_investigator
node_investigator -->|"requests analysis"| node_forensics
node_dashboard -->|"shows updates"| node_updates
node_dashboard -.->|"reads threat log"| node_database
node_downloader -.->|"updates intelligence"| node_database
node_responder -.->|"isolates files"| node_quarantine
node_dashboard -.->|"configures"| node_settings

click node_entry "https://github.com/hckr-zahid/cybergun/blob/main/main.py"
click node_guiapp "https://github.com/hckr-zahid/cybergun/blob/main/gui/gui_app.py"
click node_launcher "https://github.com/hckr-zahid/cybergun/blob/main/core/engine_launcher.py"
click node_bus "https://github.com/hckr-zahid/cybergun/blob/main/core/SignalBus.py"
click node_static "https://github.com/hckr-zahid/cybergun/blob/main/core/StaticEngine.py"
click node_staticmods "https://github.com/hckr-zahid/cybergun/tree/main/static_scanners"
click node_ember "https://github.com/hckr-zahid/cybergun/blob/main/EMBER2024/src/thrember/model.py"
click node_dynamic "https://github.com/hckr-zahid/cybergun/blob/main/core/DynamicEngine.py"
click node_behavior "https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/BehaviorMonitor.py"
click node_systemmon "https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/SystemMonitor.py"
click node_usb "https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/USBMonitor.py"
click node_sandbox "https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/SandboxSim.py"
click node_apitrace "https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/ApiTraceManager.py"
click node_ransom "https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/RansomwareMonitor.py"
click node_filesystem "https://github.com/hckr-zahid/cybergun/blob/main/core/FileSystemMonitor.py"
click node_network "https://github.com/hckr-zahid/cybergun/blob/main/core/NetworkEngine.py"
click node_netmods "https://github.com/hckr-zahid/cybergun/tree/main/network_scanners"
click node_quarantine "https://github.com/hckr-zahid/cybergun/blob/main/core/QuarantineManager.py"
click node_responder "https://github.com/hckr-zahid/cybergun/blob/main/core/ThreatResponder.py"
click node_forensics "https://github.com/hckr-zahid/cybergun/blob/main/core/ForensicAnalyzer.py"
click node_database "https://github.com/hckr-zahid/cybergun/blob/main/core/database_manager.py"
click node_downloader "https://github.com/hckr-zahid/cybergun/blob/main/core/ThreatDownloader.py"
click node_dashboard "https://github.com/hckr-zahid/cybergun/blob/main/gui/components/MainDashboard.py"
click node_feeds "https://github.com/hckr-zahid/cybergun/blob/main/gui/components/BehaviorFeed.py"
click node_networkfeed "https://github.com/hckr-zahid/cybergun/blob/main/gui/components/NetworkFeed.py"
click node_investigator "https://github.com/hckr-zahid/cybergun/blob/main/gui/components/ForensicInvestigator.py"
click node_updates "https://github.com/hckr-zahid/cybergun/blob/main/gui/components/ThreatUpdatePanel.py"
click node_settings "https://github.com/hckr-zahid/cybergun/blob/main/core/config_manager.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_guiapp,node_launcher,node_bus,node_settings toneBlue
class node_static,node_staticmods,node_ember,node_dynamic,node_behavior,node_systemmon,node_usb,node_sandbox,node_apitrace,node_ransom,node_filesystem,node_network,node_netmods toneAmber
class node_downloader toneMint
class node_quarantine,node_responder,node_forensics,node_database toneRose
class node_dashboard,node_feeds,node_networkfeed,node_investigator,node_updates,node_user toneIndigo
```

## Components

### Application

- [Application entry](https://github.com/hckr-zahid/cybergun/blob/main/main.py): `main.py`
- [Desktop app](https://github.com/hckr-zahid/cybergun/blob/main/gui/gui_app.py): `gui/gui_app.py`
- [Engine launcher](https://github.com/hckr-zahid/cybergun/blob/main/core/engine_launcher.py): `core/engine_launcher.py`
- [Signal bus](https://github.com/hckr-zahid/cybergun/blob/main/core/SignalBus.py): `core/SignalBus.py`
- [Configuration](https://github.com/hckr-zahid/cybergun/blob/main/core/config_manager.py): `core/config_manager.py`

### Detection Engines

- [Static scanning](https://github.com/hckr-zahid/cybergun/blob/main/core/StaticEngine.py): `core/StaticEngine.py`
- [Static detectors](https://github.com/hckr-zahid/cybergun/tree/main/static_scanners): `static_scanners`
- [EMBER model](https://github.com/hckr-zahid/cybergun/blob/main/EMBER2024/src/thrember/model.py): `EMBER2024/src/thrember/model.py`
- [Dynamic monitoring](https://github.com/hckr-zahid/cybergun/blob/main/core/DynamicEngine.py): `core/DynamicEngine.py`
- [Behavior monitoring](https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/BehaviorMonitor.py): `dynamic_scanners/BehaviorMonitor.py`
- [System monitoring](https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/SystemMonitor.py): `dynamic_scanners/SystemMonitor.py`
- [USB monitoring](https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/USBMonitor.py): `dynamic_scanners/USBMonitor.py`
- [Sandbox simulation](https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/SandboxSim.py): `dynamic_scanners/SandboxSim.py`
- [API tracing](https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/ApiTraceManager.py): `dynamic_scanners/ApiTraceManager.py`
- [Ransomware monitoring](https://github.com/hckr-zahid/cybergun/blob/main/dynamic_scanners/RansomwareMonitor.py): `dynamic_scanners/RansomwareMonitor.py`
- [File guard](https://github.com/hckr-zahid/cybergun/blob/main/core/FileSystemMonitor.py): `core/FileSystemMonitor.py`
- [Network engine](https://github.com/hckr-zahid/cybergun/blob/main/core/NetworkEngine.py): `core/NetworkEngine.py`
- [Network analyzers](https://github.com/hckr-zahid/cybergun/tree/main/network_scanners): `network_scanners`

### Threat Intelligence

- [Intel updater](https://github.com/hckr-zahid/cybergun/blob/main/core/ThreatDownloader.py): `core/ThreatDownloader.py`

### Investigation and Response

- [Quarantine](https://github.com/hckr-zahid/cybergun/blob/main/core/QuarantineManager.py): `core/QuarantineManager.py`
- [Threat response](https://github.com/hckr-zahid/cybergun/blob/main/core/ThreatResponder.py): `core/ThreatResponder.py`
- [Forensic analysis](https://github.com/hckr-zahid/cybergun/blob/main/core/ForensicAnalyzer.py): `core/ForensicAnalyzer.py`
- [Threat database](https://github.com/hckr-zahid/cybergun/blob/main/core/database_manager.py): `core/database_manager.py`

### Dashboard

- [Main dashboard](https://github.com/hckr-zahid/cybergun/blob/main/gui/components/MainDashboard.py): `gui/components/MainDashboard.py`
- [Event feeds](https://github.com/hckr-zahid/cybergun/blob/main/gui/components/BehaviorFeed.py): `gui/components/BehaviorFeed.py`
- [Network feed](https://github.com/hckr-zahid/cybergun/blob/main/gui/components/NetworkFeed.py): `gui/components/NetworkFeed.py`
- [Forensic viewer](https://github.com/hckr-zahid/cybergun/blob/main/gui/components/ForensicInvestigator.py): `gui/components/ForensicInvestigator.py`
- [Update panel](https://github.com/hckr-zahid/cybergun/blob/main/gui/components/ThreatUpdatePanel.py): `gui/components/ThreatUpdatePanel.py`

### Other components

- **Operator**

## Connections

- Operator → Application entry: starts
- Application entry → Desktop app: launches (evidence: `main.py`)
- Application entry → Engine launcher: starts engines (evidence: `main.py`)
- Desktop app → Main dashboard: shows (evidence: `gui/gui_app.py`)
- Engine launcher → Static scanning: creates (evidence: `core/engine_launcher.py`)
- Engine launcher → Dynamic monitoring: creates (evidence: `core/engine_launcher.py`)
- Engine launcher → Network engine: creates (evidence: `core/engine_launcher.py`)
- Engine launcher → File guard: creates (evidence: `core/engine_launcher.py`)
- Engine launcher → Intel updater: creates (evidence: `core/engine_launcher.py`)
- Static scanning → Static detectors: runs scanners (evidence: `core/StaticEngine.py`)
- Static detectors → EMBER model: uses model (evidence: `static_scanners/MLDetector.py`)
- Dynamic monitoring → System monitoring: starts (evidence: `core/DynamicEngine.py`)
- Dynamic monitoring → Behavior monitoring: starts (evidence: `core/DynamicEngine.py`)
- Dynamic monitoring → USB monitoring: starts (evidence: `core/DynamicEngine.py`)
- Dynamic monitoring → Sandbox simulation: dispatches scans (evidence: `core/DynamicEngine.py`)
- Behavior monitoring → System monitoring: observes (evidence: `dynamic_scanners/BehaviorMonitor.py`)
- Behavior monitoring → API tracing: uses (evidence: `dynamic_scanners/BehaviorMonitor.py`)
- Network engine → Network analyzers: starts components (evidence: `core/NetworkEngine.py`)
- Network engine → Threat database: gets blacklist
- Network engine → Signal bus: subscribes block requests (evidence: `core/NetworkEngine.py`)
- File guard → Static scanning: scans changed files (evidence: `core/FileSystemMonitor.py`)
- Static scanning → Signal bus: emits findings (evidence: `core/StaticEngine.py`)
- Dynamic monitoring → Signal bus: publishes events (evidence: `core/DynamicEngine.py`)
- Signal bus → Main dashboard: feeds events (evidence: `gui/components/MainDashboard.py`)
- Signal bus → Event feeds: feeds behavior (evidence: `gui/components/BehaviorFeed.py`)
- Signal bus → Network feed: feeds network (evidence: `gui/components/NetworkFeed.py`)
- Main dashboard → Quarantine: uses quarantine (evidence: `gui/components/MainDashboard.py`)
- Main dashboard → Forensic viewer: opens (evidence: `gui/components/MainDashboard.py`)
- Forensic viewer → Forensic analysis: requests analysis (evidence: `gui/components/ForensicInvestigator.py`)
- Main dashboard → Update panel: shows updates (evidence: `gui/components/MainDashboard.py`)
- Main dashboard → Threat database: reads threat log
- Intel updater → Threat database: updates intelligence
- Threat response → Quarantine: isolates files
- Main dashboard → Configuration: configures