# meckazin/chromekatz architecture

> Architecture diagram of the GitHub repository meckazin/chromekatz, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/meckazin/chromekatz
- Repository: https://github.com/meckazin/chromekatz

## Overview

ChromeKatz is a Windows toolset for recovering Chromium browser cookies and profile encryption keys. Its user workflows are live-process cookie extraction (standalone, Beacon BOF, or in-process PIC), offline extraction from a minidump, and ElevationKatz’s suspended-browser/debugger workflow for obtaining a key and optionally parsing profile databases. The groups distinguish these product variants and the shared process/memory work. Edges reflect shown imports, sampled calls, and README-described behavior; unsampled implementations are represented only where the README establishes the capability.

Main entry points: [`CookieKatz/Main.cpp`](https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Main.cpp) (CookieKatz CLI), [`CookieKatz-PIC/Main.cpp`](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/Main.cpp) (PIC Entry), [`CookieKatz-BOF/CookieKatzBOF.cpp`](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/CookieKatzBOF.cpp) (Cookie BOF), [`ElevationKatz/Main.cpp`](https://github.com/meckazin/chromekatz/blob/main/ElevationKatz/Main.cpp) (ElevationKatz CLI)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_live["Live Cookie Extraction"]
  node_cookie_cli["CookieKatz CLI<br/>[Main.cpp]"]
  node_cookie_process["Process Targeting<br/>[Process.cpp]"]
  node_cookie_memory["Cookie Memory Scan<br/>[Memory.cpp]"]
  node_cookie_output["Cookie Output<br/>[Helper.cpp]"]
  node_pic_entry["PIC Entry<br/>[Main.cpp]"]
  node_pic_memory["PIC Memory Scan<br/>[Memory.cpp]"]
  node_pic_api["Dynamic API Resolution<br/>[GetProcAddress.cpp]"]
  node_pic_file["PIC File Output<br/>[FileIO.cpp]"]
end

subgraph group_bof["Beacon Integrations"]
  node_cookie_bof["Cookie BOF<br/>[CookieKatzBOF.cpp]"]
  node_bof_process["BOF Process Targeting<br/>[Process.cpp]"]
  node_bof_memory["BOF Cookie Scan<br/>[Memory.cpp]"]
  node_process_list["Process Listing BOF"]
end

subgraph group_offline["Minidump Parsing"]
  node_dump_cli["Minidump CLI<br/>[Main.cpp]"]
  node_dump_parser["Minidump Parser<br/>[udmp-parser.h]"]
  node_dump_memory["Dump Cookie Scan<br/>[Memory.cpp]"]
end

subgraph group_elevation["Key Recovery"]
  node_elevation_cli["ElevationKatz CLI<br/>[Main.cpp]"]
  node_elevation_bof["ElevationKatz BOF"]
  node_sqlite["SQLite Interface<br/>[sqlite3.h]"]
end

node_operator(("Operator"))
node_browser["Browser Process"]
node_beacon["Beacon Runtime"]
node_dump_file["Minidump File"]
node_profile_db[("Browser Profile Databases")]
node_elevated_browser["Suspended Browser"]

node_operator -->|"selects target"| node_cookie_cli
node_cookie_cli -->|"selects process"| node_cookie_process
node_cookie_cli -->|"scans memory"| node_cookie_memory
node_cookie_process -.->|"opens process"| node_browser
node_cookie_memory -.->|"reads memory"| node_browser
node_cookie_cli -->|"writes results"| node_cookie_output
node_operator -->|"runs in process"| node_pic_entry
node_pic_entry -->|"scans memory"| node_pic_memory
node_pic_entry -->|"resolves APIs"| node_pic_api
node_pic_entry -->|"writes output"| node_pic_file
node_operator -->|"invokes BOF"| node_cookie_bof
node_cookie_bof -->|"finds target"| node_bof_process
node_cookie_bof -->|"scans cookies"| node_bof_memory
node_cookie_bof -->|"formats output"| node_beacon
node_operator -->|"lists targets"| node_process_list
node_process_list -->|"finds processes"| node_bof_process
node_operator -->|"supplies dump"| node_dump_cli
node_dump_cli -->|"parses dump"| node_dump_parser
node_dump_cli -->|"scans dump"| node_dump_memory
node_dump_file -->|"provides input"| node_dump_cli
node_operator -->|"configures recovery"| node_elevation_cli
node_elevation_cli -->|"starts suspended"| node_elevated_browser
node_elevation_cli -->|"uses database API"| node_sqlite
node_elevation_cli -->|"parses in-memory data"| node_profile_db
node_elevated_browser -.->|"supplies memory data"| node_profile_db
node_operator -->|"invokes BOF"| node_elevation_bof
node_elevation_bof -->|"uses Beacon API"| node_beacon

click node_cookie_cli "https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Main.cpp"
click node_cookie_process "https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Process.cpp"
click node_cookie_memory "https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Memory.cpp"
click node_cookie_output "https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Helper.cpp"
click node_pic_entry "https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/Main.cpp"
click node_pic_memory "https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/Memory.cpp"
click node_pic_api "https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/GetProcAddress.cpp"
click node_pic_file "https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/FileIO.cpp"
click node_cookie_bof "https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/CookieKatzBOF.cpp"
click node_bof_process "https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/ChromeKatz/Process.cpp"
click node_bof_memory "https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/ChromeKatz/Memory.cpp"
click node_process_list "https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/ListChromeProcessCookies.cpp"
click node_dump_cli "https://github.com/meckazin/chromekatz/blob/main/CookieKatzMinidump/Main.cpp"
click node_dump_parser "https://github.com/meckazin/chromekatz/blob/main/CookieKatzMinidump/udmp-parser.h"
click node_dump_memory "https://github.com/meckazin/chromekatz/blob/main/CookieKatzMinidump/Memory.cpp"
click node_elevation_cli "https://github.com/meckazin/chromekatz/blob/main/ElevationKatz/Main.cpp"
click node_elevation_bof "https://github.com/meckazin/chromekatz/blob/main/ElevationKatz-BOF/ElevationKatzBOF.cpp"
click node_sqlite "https://github.com/meckazin/chromekatz/blob/main/ElevationKatz/sqlite3.h"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cookie_cli,node_cookie_process,node_cookie_memory,node_cookie_output,node_pic_entry,node_pic_memory,node_pic_api,node_pic_file,node_browser,node_elevated_browser toneBlue
class node_cookie_bof,node_bof_process,node_bof_memory,node_process_list,node_profile_db toneAmber
class node_dump_cli,node_dump_parser,node_dump_memory toneMint
class node_elevation_cli,node_elevation_bof,node_sqlite toneRose
class node_operator,node_beacon,node_dump_file toneIndigo
```

## Components

### Live Cookie Extraction

- [CookieKatz CLI](https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Main.cpp): `CookieKatz/Main.cpp`
- [Process Targeting](https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Process.cpp): `CookieKatz/Process.cpp`
- [Cookie Memory Scan](https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Memory.cpp): `CookieKatz/Memory.cpp`
- [Cookie Output](https://github.com/meckazin/chromekatz/blob/main/CookieKatz/Helper.cpp): `CookieKatz/Helper.cpp`
- [PIC Entry](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/Main.cpp): `CookieKatz-PIC/Main.cpp`
- [PIC Memory Scan](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/Memory.cpp): `CookieKatz-PIC/Memory.cpp`
- [Dynamic API Resolution](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/GetProcAddress.cpp): `CookieKatz-PIC/GetProcAddress.cpp`
- [PIC File Output](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-PIC/FileIO.cpp): `CookieKatz-PIC/FileIO.cpp`

### Beacon Integrations

- [Cookie BOF](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/CookieKatzBOF.cpp): `CookieKatz-BOF/CookieKatzBOF.cpp`
- [BOF Process Targeting](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/ChromeKatz/Process.cpp): `CookieKatz-BOF/ChromeKatz/Process.cpp`
- [BOF Cookie Scan](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/ChromeKatz/Memory.cpp): `CookieKatz-BOF/ChromeKatz/Memory.cpp`
- [Process Listing BOF](https://github.com/meckazin/chromekatz/blob/main/CookieKatz-BOF/ListChromeProcessCookies.cpp): `CookieKatz-BOF/ListChromeProcessCookies.cpp`

### Minidump Parsing

- [Minidump CLI](https://github.com/meckazin/chromekatz/blob/main/CookieKatzMinidump/Main.cpp): `CookieKatzMinidump/Main.cpp`
- [Minidump Parser](https://github.com/meckazin/chromekatz/blob/main/CookieKatzMinidump/udmp-parser.h): `CookieKatzMinidump/udmp-parser.h`
- [Dump Cookie Scan](https://github.com/meckazin/chromekatz/blob/main/CookieKatzMinidump/Memory.cpp): `CookieKatzMinidump/Memory.cpp`

### Key Recovery

- [ElevationKatz CLI](https://github.com/meckazin/chromekatz/blob/main/ElevationKatz/Main.cpp): `ElevationKatz/Main.cpp`
- [ElevationKatz BOF](https://github.com/meckazin/chromekatz/blob/main/ElevationKatz-BOF/ElevationKatzBOF.cpp): `ElevationKatz-BOF/ElevationKatzBOF.cpp`
- [SQLite Interface](https://github.com/meckazin/chromekatz/blob/main/ElevationKatz/sqlite3.h): `ElevationKatz/sqlite3.h`

### Other components

- **Operator**
- **Browser Process**
- **Beacon Runtime**
- **Minidump File**
- **Browser Profile Databases**
- **Suspended Browser**

## Connections

- Operator → CookieKatz CLI: selects target
- CookieKatz CLI → Process Targeting: selects process (evidence: `CookieKatz/Main.cpp`)
- CookieKatz CLI → Cookie Memory Scan: scans memory (evidence: `CookieKatz/Main.cpp`)
- Process Targeting → Browser Process: opens process
- Cookie Memory Scan → Browser Process: reads memory
- CookieKatz CLI → Cookie Output: writes results
- Operator → PIC Entry: runs in process
- PIC Entry → PIC Memory Scan: scans memory (evidence: `CookieKatz-PIC/Main.cpp`)
- PIC Entry → Dynamic API Resolution: resolves APIs (evidence: `CookieKatz-PIC/Main.cpp`)
- PIC Entry → PIC File Output: writes output (evidence: `CookieKatz-PIC/Main.cpp`)
- Operator → Cookie BOF: invokes BOF
- Cookie BOF → BOF Process Targeting: finds target (evidence: `CookieKatz-BOF/CookieKatzBOF.cpp`)
- Cookie BOF → BOF Cookie Scan: scans cookies (evidence: `CookieKatz-BOF/CookieKatzBOF.cpp`)
- Cookie BOF → Beacon Runtime: formats output
- Operator → Process Listing BOF: lists targets
- Process Listing BOF → BOF Process Targeting: finds processes (evidence: `CookieKatz-BOF/ListChromeProcessCookies.cpp`)
- Operator → Minidump CLI: supplies dump
- Minidump CLI → Minidump Parser: parses dump (evidence: `CookieKatzMinidump/Main.cpp`)
- Minidump CLI → Dump Cookie Scan: scans dump (evidence: `CookieKatzMinidump/Main.cpp`)
- Minidump File → Minidump CLI: provides input
- Operator → ElevationKatz CLI: configures recovery
- ElevationKatz CLI → Suspended Browser: starts suspended (evidence: `ElevationKatz/Main.cpp`)
- ElevationKatz CLI → SQLite Interface: uses database API (evidence: `ElevationKatz/Main.cpp`)
- ElevationKatz CLI → Browser Profile Databases: parses in-memory data
- Suspended Browser → Browser Profile Databases: supplies memory data
- Operator → ElevationKatz BOF: invokes BOF
- ElevationKatz BOF → Beacon Runtime: uses Beacon API (evidence: `ElevationKatz-BOF/ElevationKatzBOF.cpp`)