# qurolvov/phoenix-evasion-research architecture

> Architecture diagram of the GitHub repository qurolvov/phoenix-evasion-research, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/qurolvov/phoenix-evasion-research
- Repository: https://github.com/qurolvov/phoenix-evasion-research

## Overview

Phoenix is a Python research/demo framework for defensive security analysts. Its documented workflow is to launch a CLI assessment, run anti-analysis checks and demonstrations of obfuscation and syscall research, then generate a Markdown research report. The sampled source places these responsibilities in one module and shows the framework coordinating them. The README advertises additional capabilities, but the tree contains no separate implementations; unsampled claims are not represented as runtime components.

Main entry points: [`src/phoenix_evasion_research.py`](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py) (Phoenix framework), [`src/__main__.py`](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/__main__.py) (CLI entry point)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Assessment flow"]
  node_cli["CLI entry point<br/>[__main__.py]"]
  node_main["Argument handling"]
  node_framework["Phoenix framework"]
  node_reporter["Report generation"]
end

subgraph group_research["Research capabilities"]
  node_security["Security demonstrations"]
  node_anti_debug["Debugger checks"]
  node_sandbox["Sandbox checks"]
  node_obfuscator["String obfuscation"]
  node_syscalls["Syscall research"]
end

subgraph group_environment["Host interaction"]
  node_windows["Windows APIs"]
  node_ntdll["On-disk ntdll"]
end

node_analyst(("Researcher"))

node_analyst -->|"starts assessment"| node_cli
node_cli -->|"calls"| node_main
node_main -->|"runs assessment"| node_framework
node_framework -->|"runs checks"| node_security
node_security -->|"checks debugger"| node_anti_debug
node_security -->|"checks sandbox"| node_sandbox
node_framework -->|"demonstrates"| node_obfuscator
node_framework -->|"demonstrates"| node_syscalls
node_framework -->|"generates report"| node_reporter
node_anti_debug -.->|"uses APIs"| node_windows
node_sandbox -.->|"checks host"| node_windows
node_syscalls -.->|"loads libraries"| node_windows
node_syscalls -.->|"reads file"| node_ntdll

click node_cli "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/__main__.py"
click node_main "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py"
click node_framework "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py"
click node_security "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py"
click node_anti_debug "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py"
click node_sandbox "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py"
click node_obfuscator "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py"
click node_syscalls "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py"
click node_reporter "https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_main,node_framework,node_reporter toneBlue
class node_security,node_anti_debug,node_sandbox,node_obfuscator,node_syscalls toneAmber
class node_windows,node_ntdll toneMint
class node_analyst toneIndigo
```

## Components

### Assessment flow

- [CLI entry point](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/__main__.py): `src/__main__.py`
- [Argument handling](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py): `src/phoenix_evasion_research.py`
- [Phoenix framework](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py): `src/phoenix_evasion_research.py`
- [Report generation](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py): `src/phoenix_evasion_research.py`

### Research capabilities

- [Security demonstrations](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py): `src/phoenix_evasion_research.py`
- [Debugger checks](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py): `src/phoenix_evasion_research.py`
- [Sandbox checks](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py): `src/phoenix_evasion_research.py`
- [String obfuscation](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py): `src/phoenix_evasion_research.py`
- [Syscall research](https://github.com/qurolvov/phoenix-evasion-research/blob/main/src/phoenix_evasion_research.py): `src/phoenix_evasion_research.py`

### Host interaction

- **Windows APIs**
- **On-disk ntdll**

### Other components

- **Researcher**

## Connections

- Researcher → CLI entry point: starts assessment
- CLI entry point → Argument handling: calls
- Argument handling → Phoenix framework: runs assessment
- Phoenix framework → Security demonstrations: runs checks
- Security demonstrations → Debugger checks: checks debugger
- Security demonstrations → Sandbox checks: checks sandbox
- Phoenix framework → String obfuscation: demonstrates
- Phoenix framework → Syscall research: demonstrates
- Phoenix framework → Report generation: generates report
- Debugger checks → Windows APIs: uses APIs
- Sandbox checks → Windows APIs: checks host
- Syscall research → Windows APIs: loads libraries
- Syscall research → On-disk ntdll: reads file