How qurolvov/phoenix-evasion-research works
Phoenix is a Python research/demo framework for defensive security analysts. Its documented workflow is to launch a CLI assessment, run anti-analysis checks and demonstrations of obfuscation and syscall research, then generate a Markdown research report. The sampled source places these responsibilities in one module and shows the framework coordinating them. The README advertises additional capabilities, but the tree contains no separate implementations; unsampled claims are not represented as runtime components.
Main entry points: phoenix_evasion_research.py Phoenix framework · __main__.py CLI entry point
Components 12
Assessment flow
- CLI entry point
src/__main__.py - Argument handling
src/phoenix_evasion_research.py - Phoenix framework
src/phoenix_evasion_research.py - Report generation
src/phoenix_evasion_research.py
Research capabilities
- Security demonstrations
src/phoenix_evasion_research.py - Debugger checks
src/phoenix_evasion_research.py - Sandbox checks
src/phoenix_evasion_research.py - String obfuscation
src/phoenix_evasion_research.py - Syscall research
src/phoenix_evasion_research.py
Host interaction
- Windows APIs
- On-disk ntdll
Other components
- Researcher
Connections 13
- Researcher → CLI entry point: starts assessment
- CLI entry point → Argument handling: calls
- Argument handling → Phoenix framework: runs assessment
- Phoenix framework → Security demonstrations: runs checks
- Security demonstrations → Debugger checks: checks debugger
- Security demonstrations → Sandbox checks: checks sandbox
- Phoenix framework → String obfuscation: demonstrates
- Phoenix framework → Syscall research: demonstrates
- Phoenix framework → Report generation: generates report
- Debugger checks → Windows APIs: uses APIs
- Sandbox checks → Windows APIs: checks host
- Syscall research → Windows APIs: loads libraries
- Syscall research → On-disk ntdll: reads file