# nadavazari/accepttunneling architecture

> Architecture diagram of the GitHub repository nadavazari/accepttunneling, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nadavazari/accepttunneling
- Repository: https://github.com/nadavazari/accepttunneling

## Overview

This is a process-injection tool that hijacks a listening service’s accept() GOT entry to relay specially marked connections to a remote endpoint, with a magic sequence intended to unhook it. The main workflow is explicit in main.c and the README; sampled code supports process discovery, ELF resolution, ptrace injection and relay behavior. Several injection details and the unhook branch are documented but their full implementation was not sampled, so uncertain internal links are omitted.

Main entry points: [`inject/hook.c`](https://github.com/nadavazari/accepttunneling/blob/master/inject/hook.c) (Hook orchestration), [`main.c`](https://github.com/nadavazari/accepttunneling/blob/master/main.c) (CLI workflow), [`hook/accept_hook.c`](https://github.com/nadavazari/accepttunneling/blob/master/hook/accept_hook.c) (accept GOT hook), [`elf/got.c`](https://github.com/nadavazari/accepttunneling/blob/master/elf/got.c) (GOT resolution)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_discovery["Target discovery"]
  node_main["CLI workflow<br/>[main.c]"]
  node_pid["Listener PID lookup<br/>[pid.c]"]
  node_exe["Executable lookup<br/>[exe.c]"]
end

subgraph group_resolve["ELF resolution"]
  node_got["GOT resolution<br/>[got.c]"]
  node_sym["Symbol resolution<br/>[sym.c]"]
  node_elfload["ELF loading<br/>[load.c]"]
  node_maps["Process mappings<br/>[maps.c]"]
end

subgraph group_inject["Hook injection"]
  node_hookinject["Hook orchestration<br/>[hook.c]"]
  node_ptrace["Target process control<br/>[ptrace.c]"]
  node_acceptgot["accept GOT hook<br/>[accept_hook.c]"]
  node_config["Hook configuration<br/>[accept_hook.h]"]
end

subgraph group_relay["Traffic relay"]
  node_tcp["TCP relay<br/>[accept_hook.c]"]
  node_unhook["Magic unhook<br/>[accept_hook.c]"]
end

node_operator(("Operator"))
node_service(("Target service"))
node_client(("Marked client"))
node_remote(("Tunnel destination"))

node_operator -->|"runs"| node_main
node_main -->|"finds listener"| node_pid
node_pid -->|"returns PID"| node_main
node_main -->|"resolves executable"| node_exe
node_main -->|"finds accept GOT"| node_got
node_got -->|"loads ELF"| node_elfload
node_got -->|"gets load base"| node_maps
node_main -->|"requests injection"| node_hookinject
node_hookinject -->|"resolves libc symbols"| node_sym
node_sym -->|"loads ELF"| node_elfload
node_hookinject -->|"attaches and patches"| node_ptrace
node_hookinject -->|"reads mapped libraries"| node_maps
node_hookinject -->|"copies hook blob"| node_acceptgot
node_hookinject -->|"writes config"| node_config
node_ptrace -->|"writes target memory"| node_service
node_service -->|"dispatches accept"| node_acceptgot
node_client -->|"sends magic"| node_acceptgot
node_acceptgot -->|"runs relay"| node_tcp
node_tcp -->|"connects and relays"| node_remote
node_acceptgot -->|"returns ordinary fd"| node_service
node_client -.->|"sends kill magic"| node_unhook
node_unhook -.->|"restores GOT entries"| node_service

click node_main "https://github.com/nadavazari/accepttunneling/blob/master/main.c"
click node_pid "https://github.com/nadavazari/accepttunneling/blob/master/proc/pid.c"
click node_exe "https://github.com/nadavazari/accepttunneling/blob/master/proc/exe.c"
click node_got "https://github.com/nadavazari/accepttunneling/blob/master/elf/got.c"
click node_sym "https://github.com/nadavazari/accepttunneling/blob/master/elf/sym.c"
click node_elfload "https://github.com/nadavazari/accepttunneling/blob/master/elf/load.c"
click node_maps "https://github.com/nadavazari/accepttunneling/blob/master/proc/maps.c"
click node_hookinject "https://github.com/nadavazari/accepttunneling/blob/master/inject/hook.c"
click node_ptrace "https://github.com/nadavazari/accepttunneling/blob/master/inject/ptrace.c"
click node_acceptgot "https://github.com/nadavazari/accepttunneling/blob/master/hook/accept_hook.c"
click node_config "https://github.com/nadavazari/accepttunneling/blob/master/include/hook/accept_hook.h"
click node_tcp "https://github.com/nadavazari/accepttunneling/blob/master/hook/accept_hook.c"
click node_unhook "https://github.com/nadavazari/accepttunneling/blob/master/hook/accept_hook.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_pid,node_exe,node_client toneBlue
class node_got,node_sym,node_elfload,node_maps toneAmber
class node_hookinject,node_ptrace,node_acceptgot,node_config toneMint
class node_tcp,node_unhook toneRose
class node_operator,node_service,node_remote toneIndigo
```

## Components

### Target discovery

- [CLI workflow](https://github.com/nadavazari/accepttunneling/blob/master/main.c): `main.c`
- [Listener PID lookup](https://github.com/nadavazari/accepttunneling/blob/master/proc/pid.c): `proc/pid.c`
- [Executable lookup](https://github.com/nadavazari/accepttunneling/blob/master/proc/exe.c): `proc/exe.c`

### ELF resolution

- [GOT resolution](https://github.com/nadavazari/accepttunneling/blob/master/elf/got.c): `elf/got.c`
- [Symbol resolution](https://github.com/nadavazari/accepttunneling/blob/master/elf/sym.c): `elf/sym.c`
- [ELF loading](https://github.com/nadavazari/accepttunneling/blob/master/elf/load.c): `elf/load.c`
- [Process mappings](https://github.com/nadavazari/accepttunneling/blob/master/proc/maps.c): `proc/maps.c`

### Hook injection

- [Hook orchestration](https://github.com/nadavazari/accepttunneling/blob/master/inject/hook.c): `inject/hook.c`
- [Target process control](https://github.com/nadavazari/accepttunneling/blob/master/inject/ptrace.c): `inject/ptrace.c`
- [accept GOT hook](https://github.com/nadavazari/accepttunneling/blob/master/hook/accept_hook.c): `hook/accept_hook.c`
- [Hook configuration](https://github.com/nadavazari/accepttunneling/blob/master/include/hook/accept_hook.h): `include/hook/accept_hook.h`

### Traffic relay

- [TCP relay](https://github.com/nadavazari/accepttunneling/blob/master/hook/accept_hook.c): `hook/accept_hook.c`
- [Magic unhook](https://github.com/nadavazari/accepttunneling/blob/master/hook/accept_hook.c): `hook/accept_hook.c`

### Other components

- **Operator**
- **Target service**
- **Marked client**
- **Tunnel destination**

## Connections

- Operator → CLI workflow: runs
- CLI workflow → Listener PID lookup: finds listener
- Listener PID lookup → CLI workflow: returns PID
- CLI workflow → Executable lookup: resolves executable
- CLI workflow → GOT resolution: finds accept GOT
- GOT resolution → ELF loading: loads ELF
- GOT resolution → Process mappings: gets load base
- CLI workflow → Hook orchestration: requests injection
- Hook orchestration → Symbol resolution: resolves libc symbols
- Symbol resolution → ELF loading: loads ELF
- Hook orchestration → Target process control: attaches and patches
- Hook orchestration → Process mappings: reads mapped libraries
- Hook orchestration → accept GOT hook: copies hook blob
- Hook orchestration → Hook configuration: writes config
- Target process control → Target service: writes target memory
- Target service → accept GOT hook: dispatches accept
- Marked client → accept GOT hook: sends magic
- accept GOT hook → TCP relay: runs relay
- TCP relay → Tunnel destination: connects and relays
- accept GOT hook → Target service: returns ordinary fd
- Marked client → Magic unhook: sends kill magic
- Magic unhook → Target service: restores GOT entries