# klezvirus/inceptor architecture

> Architecture diagram of the GitHub repository klezvirus/inceptor, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/klezvirus/inceptor
- Repository: https://github.com/klezvirus/inceptor

## Overview

Inceptor is a Windows template-based PE packer for penetration testers and red teams. The principal workflow starts with an operator selecting an input and options; the CLI configures an encoder chain and dispatches to a language-specific artifact generator, which transforms or embeds the payload, composes template code, and produces a binary or PowerShell artifact. Generators use compiler and configuration layers, with optional obfuscation and signing. Templates and modules provide documented AV/EDR-evasion capabilities. Edges reflect the README and indexed references; some implementation details were not sampled, so those links are omitted rather than inferred.

Main entry points: [`inceptor/generators/DotNetArtifactGenerator.py`](https://github.com/klezvirus/inceptor/blob/main/inceptor/generators/DotNetArtifactGenerator.py) (.NET generator), [`inceptor/generators/NativeArtifactGenerator.py`](https://github.com/klezvirus/inceptor/blob/main/inceptor/generators/NativeArtifactGenerator.py) (Native generator), [`inceptor/inceptor.py`](https://github.com/klezvirus/inceptor/blob/main/inceptor/inceptor.py) (Inceptor CLI), [`inceptor/engine/CodeWriter.py`](https://github.com/klezvirus/inceptor/blob/main/inceptor/engine/CodeWriter.py) (Template writer)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["Operator workflow"]
  node_cli["Inceptor CLI<br/>[inceptor.py]"]
  node_config["Configuration<br/>[Config.py]"]
end

subgraph group_transform["Payload transformation"]
  node_transformers["PE converters"]
  node_encoders["Encoder chain<br/>[EncoderChain.py]"]
end

subgraph group_templates["Template composition"]
  node_writer["Template writer<br/>[CodeWriter.py]"]
  node_modules["Template modules<br/>[TemplateModule.py]"]
  node_templatesfiles["Loader templates"]
end

subgraph group_artifacts["Artifact generation"]
  node_dotnet[".NET generator"]
  node_native["Native generator"]
  node_powershell["PowerShell generator"]
  node_compiler["Compilers<br/>[Compiler.py]"]
  node_output["Built artifact"]
end

subgraph group_enhance["Artifact customization"]
  node_obfuscator["Obfuscators<br/>[Obfuscator.py]"]
  node_signer["Code signing<br/>[CarbonCopy.py]"]
  node_evasion["Evasion techniques"]
  node_syscalls["Syscall support"]
end

node_operator(("Operator"))

node_operator -->|"configures"| node_cli
node_cli -->|"builds chain"| node_encoders
node_cli -->|"dispatches to"| node_dotnet
node_cli -->|"dispatches to"| node_native
node_cli -->|"dispatches to"| node_powershell
node_cli -->|"selects modules"| node_modules
node_dotnet -->|"reads settings"| node_config
node_native -->|"reads settings"| node_config
node_dotnet -->|"selects converter"| node_transformers
node_native -->|"selects converter"| node_transformers
node_dotnet -->|"encodes payload"| node_encoders
node_native -->|"encodes payload"| node_encoders
node_dotnet -->|"writes source"| node_writer
node_native -->|"writes source"| node_writer
node_writer -.->|"composes modules"| node_modules
node_writer -.->|"uses templates"| node_templatesfiles
node_dotnet -->|"compiles output"| node_compiler
node_native -->|"compiles output"| node_compiler
node_dotnet -->|"may obfuscate"| node_obfuscator
node_native -.->|"may obfuscate"| node_obfuscator
node_native -->|"may sign"| node_signer
node_dotnet -.->|"may sign"| node_signer
node_compiler -.->|"produces binary"| node_output
node_powershell -.->|"generates script"| node_output
node_modules -->|"embeds techniques"| node_evasion
node_evasion -.->|"supports syscall methods"| node_syscalls

click node_cli "https://github.com/klezvirus/inceptor/blob/main/inceptor/inceptor.py"
click node_config "https://github.com/klezvirus/inceptor/blob/main/inceptor/config/Config.py"
click node_transformers "https://github.com/klezvirus/inceptor/blob/main/inceptor/converters/TransformerFactory.py"
click node_encoders "https://github.com/klezvirus/inceptor/blob/main/inceptor/encoders/EncoderChain.py"
click node_writer "https://github.com/klezvirus/inceptor/blob/main/inceptor/engine/CodeWriter.py"
click node_modules "https://github.com/klezvirus/inceptor/blob/main/inceptor/engine/modules/TemplateModule.py"
click node_templatesfiles "https://github.com/klezvirus/inceptor/tree/main/inceptor/templates/public"
click node_dotnet "https://github.com/klezvirus/inceptor/blob/main/inceptor/generators/DotNetArtifactGenerator.py"
click node_native "https://github.com/klezvirus/inceptor/blob/main/inceptor/generators/NativeArtifactGenerator.py"
click node_powershell "https://github.com/klezvirus/inceptor/blob/main/inceptor/generators/PowerShellArtifactGenerator.py"
click node_compiler "https://github.com/klezvirus/inceptor/blob/main/inceptor/compilers/Compiler.py"
click node_obfuscator "https://github.com/klezvirus/inceptor/blob/main/inceptor/obfuscators/Obfuscator.py"
click node_signer "https://github.com/klezvirus/inceptor/blob/main/inceptor/signers/CarbonCopy.py"
click node_evasion "https://github.com/klezvirus/inceptor/tree/main/inceptor/engine/modules"
click node_syscalls "https://github.com/klezvirus/inceptor/tree/main/inceptor/syscalls"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_config toneBlue
class node_transformers,node_encoders toneAmber
class node_writer,node_modules,node_templatesfiles toneMint
class node_dotnet,node_native,node_powershell,node_compiler,node_output toneRose
class node_obfuscator,node_signer,node_evasion,node_syscalls,node_operator toneIndigo
```

## Components

### Operator workflow

- [Inceptor CLI](https://github.com/klezvirus/inceptor/blob/main/inceptor/inceptor.py): `inceptor/inceptor.py`
- [Configuration](https://github.com/klezvirus/inceptor/blob/main/inceptor/config/Config.py): `inceptor/config/Config.py`

### Payload transformation

- [PE converters](https://github.com/klezvirus/inceptor/blob/main/inceptor/converters/TransformerFactory.py): `inceptor/converters/TransformerFactory.py`
- [Encoder chain](https://github.com/klezvirus/inceptor/blob/main/inceptor/encoders/EncoderChain.py): `inceptor/encoders/EncoderChain.py`

### Template composition

- [Template writer](https://github.com/klezvirus/inceptor/blob/main/inceptor/engine/CodeWriter.py): `inceptor/engine/CodeWriter.py`
- [Template modules](https://github.com/klezvirus/inceptor/blob/main/inceptor/engine/modules/TemplateModule.py): `inceptor/engine/modules/TemplateModule.py`
- [Loader templates](https://github.com/klezvirus/inceptor/tree/main/inceptor/templates/public): `inceptor/templates/public`

### Artifact generation

- [.NET generator](https://github.com/klezvirus/inceptor/blob/main/inceptor/generators/DotNetArtifactGenerator.py): `inceptor/generators/DotNetArtifactGenerator.py`
- [Native generator](https://github.com/klezvirus/inceptor/blob/main/inceptor/generators/NativeArtifactGenerator.py): `inceptor/generators/NativeArtifactGenerator.py`
- [PowerShell generator](https://github.com/klezvirus/inceptor/blob/main/inceptor/generators/PowerShellArtifactGenerator.py): `inceptor/generators/PowerShellArtifactGenerator.py`
- [Compilers](https://github.com/klezvirus/inceptor/blob/main/inceptor/compilers/Compiler.py): `inceptor/compilers/Compiler.py`
- **Built artifact**

### Artifact customization

- [Obfuscators](https://github.com/klezvirus/inceptor/blob/main/inceptor/obfuscators/Obfuscator.py): `inceptor/obfuscators/Obfuscator.py`
- [Code signing](https://github.com/klezvirus/inceptor/blob/main/inceptor/signers/CarbonCopy.py): `inceptor/signers/CarbonCopy.py`
- [Evasion techniques](https://github.com/klezvirus/inceptor/tree/main/inceptor/engine/modules): `inceptor/engine/modules`
- [Syscall support](https://github.com/klezvirus/inceptor/tree/main/inceptor/syscalls): `inceptor/syscalls`

### Other components

- **Operator**

## Connections

- Operator → Inceptor CLI: configures (evidence: `README.md`)
- Inceptor CLI → Encoder chain: builds chain (evidence: `inceptor/inceptor.py`)
- Inceptor CLI → .NET generator: dispatches to (evidence: `inceptor/inceptor.py`)
- Inceptor CLI → Native generator: dispatches to (evidence: `inceptor/inceptor.py`)
- Inceptor CLI → PowerShell generator: dispatches to (evidence: `inceptor/inceptor.py`)
- Inceptor CLI → Template modules: selects modules (evidence: `inceptor/inceptor.py`)
- .NET generator → Configuration: reads settings (evidence: `inceptor/generators/DotNetArtifactGenerator.py`)
- Native generator → Configuration: reads settings (evidence: `inceptor/generators/NativeArtifactGenerator.py`)
- .NET generator → PE converters: selects converter (evidence: `inceptor/generators/DotNetArtifactGenerator.py`)
- Native generator → PE converters: selects converter (evidence: `inceptor/generators/NativeArtifactGenerator.py`)
- .NET generator → Encoder chain: encodes payload (evidence: `inceptor/generators/DotNetArtifactGenerator.py`)
- Native generator → Encoder chain: encodes payload (evidence: `inceptor/generators/NativeArtifactGenerator.py`)
- .NET generator → Template writer: writes source (evidence: `inceptor/generators/DotNetArtifactGenerator.py`)
- Native generator → Template writer: writes source (evidence: `inceptor/generators/NativeArtifactGenerator.py`)
- Template writer → Template modules: composes modules
- Template writer → Loader templates: uses templates
- .NET generator → Compilers: compiles output (evidence: `inceptor/generators/DotNetArtifactGenerator.py`)
- Native generator → Compilers: compiles output (evidence: `inceptor/generators/NativeArtifactGenerator.py`)
- .NET generator → Obfuscators: may obfuscate (evidence: `inceptor/generators/DotNetArtifactGenerator.py`)
- Native generator → Obfuscators: may obfuscate
- Native generator → Code signing: may sign (evidence: `inceptor/generators/NativeArtifactGenerator.py`)
- .NET generator → Code signing: may sign (evidence: `inceptor/generators/DotNetArtifactGenerator.py`)
- Compilers → Built artifact: produces binary
- PowerShell generator → Built artifact: generates script
- Template modules → Evasion techniques: embeds techniques (evidence: `README.md`)
- Evasion techniques → Syscall support: supports syscall methods