# scr34m/php-malware-scanner architecture

> Architecture diagram of the GitHub repository scr34m/php-malware-scanner, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/scr34m/php-malware-scanner
- Repository: https://github.com/scr34m/php-malware-scanner

## Overview

This is a command-line and embeddable PHP malware scanner. Its main workflow accepts a directory and scan options, traverses eligible files, checks them against signature rules (or the alternative base64 rules), consults hash whitelists, and formats findings and scan statistics. Additional documented capabilities include WordPress checksum whitelisting, a combined whitelist, and optional AST-based checks. The scanner is largely implemented in scan.php; the excerpts omit some internals, so uncertain call wiring is not shown.

Main entry points: [`scan.php`](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php) (Scanner runtime), [`ast_visitor.php`](https://github.com/scr34m/php-malware-scanner/blob/master/ast_visitor.php) (AST checks), [`definitions`](https://github.com/scr34m/php-malware-scanner/tree/master/definitions) (Text and regex rules), [`base64_patterns`](https://github.com/scr34m/php-malware-scanner/tree/master/base64_patterns) (Base64 rules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_workflow["Scan workflow"]
  node_scanner["Scanner runtime<br/>[scan.php]"]
  node_directory_walk["Directory traversal<br/>[scan.php]"]
  node_file_scan["File scanning<br/>[scan.php]"]
end

subgraph group_detection["Detection sources"]
  node_standard_rules["Text and regex rules"]
  node_base64_rules["Base64 rules"]
  node_ast_checks["AST checks<br/>[ast_visitor.php]"]
end

subgraph group_allowlists["Whitelist sources"]
  node_hash_checks["Hash allowlisting<br/>[scan.php]"]
  node_default_whitelist["Default hashes<br/>[whitelist.txt]"]
  node_custom_whitelist["Custom whitelist<br/>[scan.php]"]
  node_combined_whitelist["Combined whitelist<br/>[scan.php]"]
  node_wordpress_checksums["WordPress checksums<br/>[scan.php]"]
end

subgraph group_results["Results"]
  node_finding_output["Finding output<br/>[scan.php]"]
  node_run_stats["Run statistics<br/>[scan.php]"]
end

node_operator(("Operator"))
node_php_parser["PHP Parser"]
node_combined_service["Combined database service"]
node_wordpress_api["WordPress API"]

node_operator -->|"starts scan"| node_scanner
node_scanner -->|"traverses paths"| node_directory_walk
node_directory_walk -->|"selects files"| node_file_scan
node_file_scan -->|"matches patterns"| node_standard_rules
node_file_scan -.->|"matches encoded patterns"| node_base64_rules
node_file_scan -.->|"checks syntax"| node_ast_checks
node_ast_checks -.->|"parses with"| node_php_parser
node_scanner -->|"checks hashes"| node_hash_checks
node_hash_checks -->|"reads hashes"| node_default_whitelist
node_hash_checks -->|"reads configured list"| node_custom_whitelist
node_scanner -.->|"updates when enabled"| node_combined_whitelist
node_combined_whitelist -.->|"fetches database"| node_combined_service
node_scanner -.->|"loads version hashes"| node_wordpress_checksums
node_wordpress_checksums -.->|"fetches checksums"| node_wordpress_api
node_file_scan -->|"reports findings"| node_finding_output
node_scanner -->|"reports totals"| node_run_stats

click node_scanner "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"
click node_directory_walk "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"
click node_file_scan "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"
click node_standard_rules "https://github.com/scr34m/php-malware-scanner/tree/master/definitions"
click node_base64_rules "https://github.com/scr34m/php-malware-scanner/tree/master/base64_patterns"
click node_ast_checks "https://github.com/scr34m/php-malware-scanner/blob/master/ast_visitor.php"
click node_hash_checks "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"
click node_default_whitelist "https://github.com/scr34m/php-malware-scanner/blob/master/whitelist.txt"
click node_custom_whitelist "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"
click node_combined_whitelist "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"
click node_wordpress_checksums "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"
click node_finding_output "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"
click node_run_stats "https://github.com/scr34m/php-malware-scanner/blob/master/scan.php"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_scanner,node_directory_walk,node_file_scan toneBlue
class node_standard_rules,node_base64_rules,node_ast_checks,node_combined_service toneAmber
class node_hash_checks,node_default_whitelist,node_custom_whitelist,node_combined_whitelist,node_wordpress_checksums,node_wordpress_api toneMint
class node_finding_output,node_run_stats toneRose
class node_operator,node_php_parser toneIndigo
```

## Components

### Scan workflow

- [Scanner runtime](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`
- [Directory traversal](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`
- [File scanning](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`

### Detection sources

- [Text and regex rules](https://github.com/scr34m/php-malware-scanner/tree/master/definitions): `definitions`
- [Base64 rules](https://github.com/scr34m/php-malware-scanner/tree/master/base64_patterns): `base64_patterns`
- [AST checks](https://github.com/scr34m/php-malware-scanner/blob/master/ast_visitor.php): `ast_visitor.php`

### Whitelist sources

- [Hash allowlisting](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`
- [Default hashes](https://github.com/scr34m/php-malware-scanner/blob/master/whitelist.txt): `whitelist.txt`
- [Custom whitelist](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`
- [Combined whitelist](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`
- [WordPress checksums](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`

### Results

- [Finding output](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`
- [Run statistics](https://github.com/scr34m/php-malware-scanner/blob/master/scan.php): `scan.php`

### Other components

- **Operator**
- **PHP Parser**
- **Combined database service**
- **WordPress API**

## Connections

- Operator → Scanner runtime: starts scan
- Scanner runtime → Directory traversal: traverses paths
- Directory traversal → File scanning: selects files
- File scanning → Text and regex rules: matches patterns
- File scanning → Base64 rules: matches encoded patterns
- File scanning → AST checks: checks syntax
- AST checks → PHP Parser: parses with
- Scanner runtime → Hash allowlisting: checks hashes
- Hash allowlisting → Default hashes: reads hashes
- Hash allowlisting → Custom whitelist: reads configured list
- Scanner runtime → Combined whitelist: updates when enabled
- Combined whitelist → Combined database service: fetches database
- Scanner runtime → WordPress checksums: loads version hashes
- WordPress checksums → WordPress API: fetches checksums
- File scanning → Finding output: reports findings
- Scanner runtime → Run statistics: reports totals