# powershellmafia/powersploit architecture

> Architecture diagram of the GitHub repository powershellmafia/powersploit, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/powershellmafia/powersploit
- Repository: https://github.com/powershellmafia/powersploit

## Overview

PowerSploit is a PowerShell penetration-testing toolkit; the README describes capabilities across execution, script modification, persistence, exfiltration, reconnaissance, and other phases. This tree is only a native-code subset, so the graph emphasizes the demonstrated reflective-loading examples and NTFS file-reading path, plus the listed logon-token component. Source excerpts do not establish how the logon programs connect or how the broader PowerShell commands are implemented; those links are omitted.

Main entry points: [`Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp`](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp) (Parser harness), [`Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp`](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp) (Parser DLL API), [`Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp`](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp) (Logon token tool), [`CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL/DemoDLL/DemoDLL.cpp`](https://github.com/powershellmafia/powersploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL/DemoDLL/DemoDLL.cpp) (Demo DLL)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_reflective["Reflective PE examples"]
  node_reflective_feature["Reflective PE injection"]
  node_demo_dll["Demo DLL<br/>[DemoDLL.cpp]"]
  node_remote_dll["Remote DLL demo<br/>[dllmain.cpp]"]
  node_demo_exe["Demo executables"]
  node_target_exe["Injection target demo"]
end

subgraph group_ntfs["NTFS file access"]
  node_ntfs_feature["Raw NTFS file copy"]
  node_parser_harness["Parser harness<br/>[NTFSParser.cpp]"]
  node_parser_dll["Parser DLL API<br/>[NTFSParserDLL.cpp]"]
  node_output_file["Copied output file"]
end

subgraph group_ntfsinternals["NTFS parsing internals"]
  node_ntfs_volume["Volume access<br/>[NTFS_FileRecord.h]"]
  node_file_records["File records<br/>[NTFS_FileRecord.h]"]
  node_attributes["NTFS attributes<br/>[NTFS_Attribute.h]"]
  node_dll_records["DLL file records<br/>[NTFS_FileRecord.h]"]
  node_dll_attributes["DLL attributes<br/>[NTFS_Attribute.h]"]
end

subgraph group_logon["Logon components"]
  node_logon_tool["Logon token tool<br/>[LogonUser.cpp]"]
  node_logon_dll["Logon support DLL<br/>[logon.cpp]"]
end

node_operator(("PowerShell operator"))

node_operator -.->|"invokes"| node_reflective_feature
node_reflective_feature -.->|"loads example"| node_demo_dll
node_reflective_feature -.->|"injects example"| node_remote_dll
node_parser_harness -->|"loads and calls"| node_parser_dll
node_parser_harness -->|"writes bytes"| node_output_file
node_parser_dll -->|"opens volume"| node_ntfs_volume
node_parser_dll -->|"parses records"| node_dll_records
node_parser_dll -->|"reads stream"| node_dll_attributes
node_parser_harness -->|"includes parser types"| node_file_records
node_parser_harness -->|"includes parser types"| node_attributes
node_ntfs_feature -.->|"uses parser"| node_parser_harness
node_logon_tool -.-> node_logon_dll

click node_demo_dll "https://github.com/powershellmafia/powersploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL/DemoDLL/DemoDLL.cpp"
click node_remote_dll "https://github.com/powershellmafia/powersploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL_RemoteProcess/DemoDLL_RemoteProcess/dllmain.cpp"
click node_demo_exe "https://github.com/powershellmafia/powersploit/tree/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoExe"
click node_target_exe "https://github.com/powershellmafia/powersploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/ExeToInjectInTo/ExeToInjectInTo/ExeToInjectInTo.cpp"
click node_parser_harness "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp"
click node_parser_dll "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp"
click node_ntfs_volume "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h"
click node_file_records "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h"
click node_attributes "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFS_Attribute.h"
click node_dll_records "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_FileRecord.h"
click node_dll_attributes "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Attribute.h"
click node_logon_tool "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp"
click node_logon_dll "https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/LogonUser/LogonUser/logon/logon.cpp"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_reflective_feature,node_demo_dll,node_remote_dll,node_demo_exe,node_target_exe toneBlue
class node_ntfs_feature,node_parser_harness,node_parser_dll,node_output_file toneAmber
class node_ntfs_volume,node_file_records,node_attributes,node_dll_records,node_dll_attributes toneMint
class node_logon_tool,node_logon_dll toneRose
class node_operator toneIndigo
```

## Components

### Reflective PE examples

- **Reflective PE injection**
- [Demo DLL](https://github.com/powershellmafia/powersploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL/DemoDLL/DemoDLL.cpp): `CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL/DemoDLL/DemoDLL.cpp`
- [Remote DLL demo](https://github.com/powershellmafia/powersploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL_RemoteProcess/DemoDLL_RemoteProcess/dllmain.cpp): `CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL_RemoteProcess/DemoDLL_RemoteProcess/dllmain.cpp`
- [Demo executables](https://github.com/powershellmafia/powersploit/tree/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoExe): `CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoExe`
- [Injection target demo](https://github.com/powershellmafia/powersploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection_Resources/ExeToInjectInTo/ExeToInjectInTo/ExeToInjectInTo.cpp): `CodeExecution/Invoke-ReflectivePEInjection_Resources/ExeToInjectInTo/ExeToInjectInTo/ExeToInjectInTo.cpp`

### NTFS file access

- **Raw NTFS file copy**
- [Parser harness](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp): `Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp`
- [Parser DLL API](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp): `Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp`
- **Copied output file**

### NTFS parsing internals

- [Volume access](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h): `Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h`
- [File records](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h): `Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h`
- [NTFS attributes](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParser/NTFS_Attribute.h): `Exfiltration/NTFSParser/NTFSParser/NTFS_Attribute.h`
- [DLL file records](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_FileRecord.h): `Exfiltration/NTFSParser/NTFSParserDLL/NTFS_FileRecord.h`
- [DLL attributes](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Attribute.h): `Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Attribute.h`

### Logon components

- [Logon token tool](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp): `Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp`
- [Logon support DLL](https://github.com/powershellmafia/powersploit/blob/master/Exfiltration/LogonUser/LogonUser/logon/logon.cpp): `Exfiltration/LogonUser/LogonUser/logon/logon.cpp`

### Other components

- **PowerShell operator**

## Connections

- PowerShell operator → Reflective PE injection: invokes (evidence: `README.md`)
- Reflective PE injection → Demo DLL: loads example (evidence: `README.md`)
- Reflective PE injection → Remote DLL demo: injects example (evidence: `README.md`)
- Parser harness → Parser DLL API: loads and calls (evidence: `Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp`)
- Parser harness → Copied output file: writes bytes (evidence: `Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp`)
- Parser DLL API → Volume access: opens volume (evidence: `Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp`)
- Parser DLL API → DLL file records: parses records (evidence: `Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp`)
- Parser DLL API → DLL attributes: reads stream (evidence: `Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp`)
- Parser harness → File records: includes parser types (evidence: `Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp`)
- Parser harness → NTFS attributes: includes parser types (evidence: `Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp`)
- Raw NTFS file copy → Parser harness: uses parser (evidence: `README.md`)
- Logon token tool → Logon support DLL