# litemars/edrhookdetector architecture

> Architecture diagram of the GitHub repository litemars/edrhookdetector, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/litemars/edrhookdetector
- Repository: https://github.com/litemars/edrhookdetector

## Overview

This is a Linux system-auditing CLI that detects userspace and kernel hook signals, then reports findings as text or JSON. The principal workflow is CLI selection → scoped scans → findings and verdict. Userspace checks cover inline patches, GOT/PLT hijacks, preload settings, and VDSO differences; kernel checks cover eBPF, probes, ftrace, LSMs, and module taint. Architecture-specific scoring and ELF validation support userspace analysis. Several subsystem details are documented in the README but not visible in sampled implementation excerpts; those links cite the README rather than implying the source was inspected.

Main entry points: [`src/main.c`](https://github.com/litemars/edrhookdetector/blob/main/src/main.c) (CLI and scope), [`src/common.c`](https://github.com/litemars/edrhookdetector/blob/main/src/common.c) (Inline patch scan), [`src/kernel/kernel_hooks.h`](https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.h) (Kernel scan interface), [`src/ebpf/kernel_ebpf.c`](https://github.com/litemars/edrhookdetector/blob/main/src/ebpf/kernel_ebpf.c) (eBPF program scan)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_orchestration["Scan orchestration"]
  node_cli["CLI and scope<br/>[main.c]"]
  node_report["Findings and verdict<br/>[main.c]"]
end

subgraph group_userspace["Userspace checks"]
  node_inline["Inline patch scan<br/>[common.c]"]
  node_got["GOT/PLT scan<br/>[common.c]"]
  node_preload["Preload scan<br/>[common.c]"]
  node_vdso["VDSO comparison<br/>[common.c]"]
  node_process["Process and library discovery<br/>[common.c]"]
end

subgraph group_kernel["Kernel checks"]
  node_ebpf["eBPF program scan<br/>[kernel_ebpf.c]"]
  node_kprobes["Kprobe scan<br/>[kernel_hooks.c]"]
  node_uprobes["Uprobe scan<br/>[kernel_hooks.c]"]
  node_ftrace["Ftrace scan<br/>[kernel_hooks.c]"]
  node_lsm["Active LSM scan<br/>[kernel_hooks.c]"]
  node_modules["Tainted module scan<br/>[kernel_hooks.c]"]
end

subgraph group_internals["Analysis internals"]
  node_elf["ELF validation<br/>[elf_validation.h]"]
  node_x86score["x86 scoring and decode<br/>[arch_x86.c]"]
  node_x86interface["x86 scoring interface<br/>[arch_x86.h]"]
  node_arm64score["ARM64 hook scoring<br/>[arch_arm64.c]"]
  node_arm64interface["ARM64 scoring interface<br/>[arch_arm64.h]"]
  node_commoninterface["Shared scan types<br/>[common.h]"]
  node_ebpfinterface["eBPF scan interface<br/>[kernel_ebpf.h]"]
  node_kernelinterface["Kernel scan interface<br/>[kernel_hooks.h]"]
end

node_operator(("CLI user"))

node_operator -->|"selects scope"| node_cli
node_cli -->|"selects processes"| node_process
node_cli -->|"runs userspace"| node_inline
node_cli -->|"runs userspace"| node_got
node_cli -->|"runs userspace"| node_preload
node_cli -->|"runs userspace"| node_vdso
node_cli -->|"runs kernel"| node_ebpf
node_cli -->|"runs kernel"| node_kprobes
node_cli -->|"runs kernel"| node_uprobes
node_cli -->|"runs kernel"| node_ftrace
node_cli -->|"runs kernel"| node_lsm
node_cli -->|"runs kernel"| node_modules
node_inline -->|"reports findings"| node_report
node_got -->|"reports findings"| node_report
node_preload -->|"reports findings"| node_report
node_vdso -->|"reports findings"| node_report
node_ebpf -->|"reports findings"| node_report
node_kprobes -->|"reports findings"| node_report
node_uprobes -->|"reports findings"| node_report
node_ftrace -->|"reports findings"| node_report
node_lsm -->|"reports findings"| node_report
node_modules -->|"reports findings"| node_report
node_inline -->|"scores x86 bytes"| node_x86score
node_inline -->|"scores ARM64 bytes"| node_arm64score
node_inline -->|"validates ELF"| node_elf
node_got -->|"validates relocations"| node_elf
node_x86score -->|"implements interface"| node_x86interface
node_arm64score -->|"implements interface"| node_arm64interface
node_inline -->|"uses shared types"| node_commoninterface
node_ebpf -->|"implements interface"| node_ebpfinterface
node_kprobes -->|"declared by"| node_kernelinterface
node_uprobes -->|"declared by"| node_kernelinterface
node_ftrace -->|"declared by"| node_kernelinterface
node_lsm -->|"declared by"| node_kernelinterface
node_modules -->|"declared by"| node_kernelinterface

click node_cli "https://github.com/litemars/edrhookdetector/blob/main/src/main.c"
click node_report "https://github.com/litemars/edrhookdetector/blob/main/src/main.c"
click node_inline "https://github.com/litemars/edrhookdetector/blob/main/src/common.c"
click node_got "https://github.com/litemars/edrhookdetector/blob/main/src/common.c"
click node_preload "https://github.com/litemars/edrhookdetector/blob/main/src/common.c"
click node_vdso "https://github.com/litemars/edrhookdetector/blob/main/src/common.c"
click node_process "https://github.com/litemars/edrhookdetector/blob/main/src/common.c"
click node_ebpf "https://github.com/litemars/edrhookdetector/blob/main/src/ebpf/kernel_ebpf.c"
click node_kprobes "https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c"
click node_uprobes "https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c"
click node_ftrace "https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c"
click node_lsm "https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c"
click node_modules "https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c"
click node_elf "https://github.com/litemars/edrhookdetector/blob/main/src/elf_validation.h"
click node_x86score "https://github.com/litemars/edrhookdetector/blob/main/src/arch/arch_x86.c"
click node_x86interface "https://github.com/litemars/edrhookdetector/blob/main/src/arch/arch_x86.h"
click node_arm64score "https://github.com/litemars/edrhookdetector/blob/main/src/arch/arch_arm64.c"
click node_arm64interface "https://github.com/litemars/edrhookdetector/blob/main/src/arch/arch_arm64.h"
click node_commoninterface "https://github.com/litemars/edrhookdetector/blob/main/src/common.h"
click node_ebpfinterface "https://github.com/litemars/edrhookdetector/blob/main/src/ebpf/kernel_ebpf.h"
click node_kernelinterface "https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.h"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_report,node_operator toneBlue
class node_inline,node_got,node_preload,node_vdso,node_process toneAmber
class node_ebpf,node_kprobes,node_uprobes,node_ftrace,node_lsm,node_modules toneMint
class node_elf,node_x86score,node_x86interface,node_arm64score,node_arm64interface,node_commoninterface,node_ebpfinterface,node_kernelinterface toneRose
```

## Components

### Scan orchestration

- [CLI and scope](https://github.com/litemars/edrhookdetector/blob/main/src/main.c): `src/main.c`
- [Findings and verdict](https://github.com/litemars/edrhookdetector/blob/main/src/main.c): `src/main.c`

### Userspace checks

- [Inline patch scan](https://github.com/litemars/edrhookdetector/blob/main/src/common.c): `src/common.c`
- [GOT/PLT scan](https://github.com/litemars/edrhookdetector/blob/main/src/common.c): `src/common.c`
- [Preload scan](https://github.com/litemars/edrhookdetector/blob/main/src/common.c): `src/common.c`
- [VDSO comparison](https://github.com/litemars/edrhookdetector/blob/main/src/common.c): `src/common.c`
- [Process and library discovery](https://github.com/litemars/edrhookdetector/blob/main/src/common.c): `src/common.c`

### Kernel checks

- [eBPF program scan](https://github.com/litemars/edrhookdetector/blob/main/src/ebpf/kernel_ebpf.c): `src/ebpf/kernel_ebpf.c`
- [Kprobe scan](https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c): `src/kernel/kernel_hooks.c`
- [Uprobe scan](https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c): `src/kernel/kernel_hooks.c`
- [Ftrace scan](https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c): `src/kernel/kernel_hooks.c`
- [Active LSM scan](https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c): `src/kernel/kernel_hooks.c`
- [Tainted module scan](https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.c): `src/kernel/kernel_hooks.c`

### Analysis internals

- [ELF validation](https://github.com/litemars/edrhookdetector/blob/main/src/elf_validation.h): `src/elf_validation.h`
- [x86 scoring and decode](https://github.com/litemars/edrhookdetector/blob/main/src/arch/arch_x86.c): `src/arch/arch_x86.c`
- [x86 scoring interface](https://github.com/litemars/edrhookdetector/blob/main/src/arch/arch_x86.h): `src/arch/arch_x86.h`
- [ARM64 hook scoring](https://github.com/litemars/edrhookdetector/blob/main/src/arch/arch_arm64.c): `src/arch/arch_arm64.c`
- [ARM64 scoring interface](https://github.com/litemars/edrhookdetector/blob/main/src/arch/arch_arm64.h): `src/arch/arch_arm64.h`
- [Shared scan types](https://github.com/litemars/edrhookdetector/blob/main/src/common.h): `src/common.h`
- [eBPF scan interface](https://github.com/litemars/edrhookdetector/blob/main/src/ebpf/kernel_ebpf.h): `src/ebpf/kernel_ebpf.h`
- [Kernel scan interface](https://github.com/litemars/edrhookdetector/blob/main/src/kernel/kernel_hooks.h): `src/kernel/kernel_hooks.h`

### Other components

- **CLI user**

## Connections

- CLI user → CLI and scope: selects scope (evidence: `README.md`)
- CLI and scope → Process and library discovery: selects processes (evidence: `README.md`)
- CLI and scope → Inline patch scan: runs userspace (evidence: `README.md`)
- CLI and scope → GOT/PLT scan: runs userspace (evidence: `README.md`)
- CLI and scope → Preload scan: runs userspace (evidence: `README.md`)
- CLI and scope → VDSO comparison: runs userspace (evidence: `README.md`)
- CLI and scope → eBPF program scan: runs kernel (evidence: `README.md`)
- CLI and scope → Kprobe scan: runs kernel (evidence: `README.md`)
- CLI and scope → Uprobe scan: runs kernel (evidence: `README.md`)
- CLI and scope → Ftrace scan: runs kernel (evidence: `README.md`)
- CLI and scope → Active LSM scan: runs kernel (evidence: `README.md`)
- CLI and scope → Tainted module scan: runs kernel (evidence: `README.md`)
- Inline patch scan → Findings and verdict: reports findings (evidence: `README.md`)
- GOT/PLT scan → Findings and verdict: reports findings (evidence: `README.md`)
- Preload scan → Findings and verdict: reports findings (evidence: `README.md`)
- VDSO comparison → Findings and verdict: reports findings (evidence: `README.md`)
- eBPF program scan → Findings and verdict: reports findings (evidence: `README.md`)
- Kprobe scan → Findings and verdict: reports findings (evidence: `README.md`)
- Uprobe scan → Findings and verdict: reports findings (evidence: `README.md`)
- Ftrace scan → Findings and verdict: reports findings (evidence: `README.md`)
- Active LSM scan → Findings and verdict: reports findings (evidence: `README.md`)
- Tainted module scan → Findings and verdict: reports findings (evidence: `README.md`)
- Inline patch scan → x86 scoring and decode: scores x86 bytes (evidence: `src/common.c`)
- Inline patch scan → ARM64 hook scoring: scores ARM64 bytes (evidence: `src/common.c`)
- Inline patch scan → ELF validation: validates ELF (evidence: `src/common.c`)
- GOT/PLT scan → ELF validation: validates relocations (evidence: `src/common.c`)
- x86 scoring and decode → x86 scoring interface: implements interface (evidence: `src/arch/arch_x86.c`)
- ARM64 hook scoring → ARM64 scoring interface: implements interface (evidence: `src/arch/arch_arm64.c`)
- Inline patch scan → Shared scan types: uses shared types (evidence: `src/common.c`)
- eBPF program scan → eBPF scan interface: implements interface (evidence: `src/ebpf/kernel_ebpf.c`)
- Kprobe scan → Kernel scan interface: declared by (evidence: `src/kernel/kernel_hooks.h`)
- Uprobe scan → Kernel scan interface: declared by (evidence: `src/kernel/kernel_hooks.h`)
- Ftrace scan → Kernel scan interface: declared by (evidence: `src/kernel/kernel_hooks.h`)
- Active LSM scan → Kernel scan interface: declared by (evidence: `src/kernel/kernel_hooks.h`)
- Tainted module scan → Kernel scan interface: declared by (evidence: `src/kernel/kernel_hooks.h`)