# thebadinteger/p2pwn architecture

> Architecture diagram of the GitHub repository thebadinteger/p2pwn, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/thebadinteger/p2pwn
- Repository: https://github.com/thebadinteger/p2pwn

## Overview

p2pwn is a command-line Dahua camera security scanner. The main workflow parses serial numbers or prefixes, loads scan and method settings, checks device availability over P2P, establishes a tunnel, and attempts configured credential/CVE checks; successful results can include device details, snapshots, OSD changes, CSV records, and Dahua import XML. The graph uses README-described capabilities where source excerpts do not expose the complete wiring; uncertain call paths are not expanded into helper-level flows.

Main entry points: [`core/scanner.go`](https://github.com/thebadinteger/p2pwn/blob/main/core/scanner.go) (Serial scanner), [`core/p2p/dhclient.go`](https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/dhclient.go) (Device handshake), [`main.go`](https://github.com/thebadinteger/p2pwn/blob/main/main.go) (CLI workflow), [`core/exploits.go`](https://github.com/thebadinteger/p2pwn/blob/main/core/exploits.go) (CGI, SDK, CVE checks)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI and setup"]
  node_cli["CLI workflow<br/>[main.go]"]
  node_settings["Scan settings<br/>[config.go]"]
end

subgraph group_scan["Discovery and access"]
  node_scanner["Serial scanner<br/>[scanner.go]"]
  node_availability["P2P availability<br/>[dhclient.go]"]
  node_cloud(("P2P rendezvous"))
  node_profile["Cloud profile<br/>[profile.go]"]
  node_handshake["Device handshake<br/>[dhclient.go]"]
  node_tunnel["P2P tunnel<br/>[tunnel.go]"]
  node_auth["P2P authentication<br/>[auth.go]"]
end

subgraph group_device["Device operations"]
  node_checks["CGI, SDK, CVE checks<br/>[exploits.go]"]
  node_sdk["SDK protocol<br/>[sdkbin.go]"]
  node_osd["OSD overlay<br/>[osd.go]"]
end

subgraph group_results["Results and output"]
  node_xmlcodec["XML credentials<br/>[xml.go]"]
  node_output["Scan output<br/>[scanner.go]"]
  node_filesystem[("Output files")]
end

node_operator(("Operator"))

node_operator -->|"provides targets"| node_cli
node_cli -->|"loads settings"| node_settings
node_cli -->|"starts scan"| node_scanner
node_scanner -->|"checks serials"| node_availability
node_availability -->|"builds requests"| node_profile
node_availability -->|"contacts rendezvous"| node_cloud
node_scanner -->|"opens device session"| node_handshake
node_handshake -->|"uses profile"| node_profile
node_handshake -->|"negotiates P2P"| node_cloud
node_handshake -->|"establishes tunnel"| node_tunnel
node_tunnel -->|"uses credentials"| node_auth
node_scanner -->|"runs configured checks"| node_checks
node_checks -->|"sends device requests"| node_tunnel
node_checks -->|"tries SDK login"| node_sdk
node_scanner -->|"applies overlay"| node_osd
node_scanner -->|"captures snapshot"| node_sdk
node_scanner -->|"encodes credentials"| node_xmlcodec
node_scanner -->|"records results"| node_output
node_output -->|"writes CSV and XML"| node_filesystem
node_output -->|"saves snapshots"| node_filesystem

click node_cli "https://github.com/thebadinteger/p2pwn/blob/main/main.go"
click node_settings "https://github.com/thebadinteger/p2pwn/blob/main/core/config.go"
click node_scanner "https://github.com/thebadinteger/p2pwn/blob/main/core/scanner.go"
click node_availability "https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/dhclient.go"
click node_profile "https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/profile.go"
click node_handshake "https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/dhclient.go"
click node_tunnel "https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/tunnel.go"
click node_auth "https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/auth.go"
click node_checks "https://github.com/thebadinteger/p2pwn/blob/main/core/exploits.go"
click node_sdk "https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/sdkbin.go"
click node_osd "https://github.com/thebadinteger/p2pwn/blob/main/core/osd.go"
click node_xmlcodec "https://github.com/thebadinteger/p2pwn/blob/main/core/xml.go"
click node_output "https://github.com/thebadinteger/p2pwn/blob/main/core/scanner.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_settings toneBlue
class node_scanner,node_availability,node_cloud,node_profile,node_handshake,node_tunnel,node_auth toneAmber
class node_checks,node_sdk,node_osd toneMint
class node_xmlcodec,node_output,node_filesystem toneRose
class node_operator toneIndigo
```

## Components

### CLI and setup

- [CLI workflow](https://github.com/thebadinteger/p2pwn/blob/main/main.go): `main.go`
- [Scan settings](https://github.com/thebadinteger/p2pwn/blob/main/core/config.go): `core/config.go`

### Discovery and access

- [Serial scanner](https://github.com/thebadinteger/p2pwn/blob/main/core/scanner.go): `core/scanner.go`
- [P2P availability](https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/dhclient.go): `core/p2p/dhclient.go`
- **P2P rendezvous**
- [Cloud profile](https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/profile.go): `core/p2p/profile.go`
- [Device handshake](https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/dhclient.go): `core/p2p/dhclient.go`
- [P2P tunnel](https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/tunnel.go): `core/p2p/tunnel.go`
- [P2P authentication](https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/auth.go): `core/p2p/auth.go`

### Device operations

- [CGI, SDK, CVE checks](https://github.com/thebadinteger/p2pwn/blob/main/core/exploits.go): `core/exploits.go`
- [SDK protocol](https://github.com/thebadinteger/p2pwn/blob/main/core/p2p/sdkbin.go): `core/p2p/sdkbin.go`
- [OSD overlay](https://github.com/thebadinteger/p2pwn/blob/main/core/osd.go): `core/osd.go`

### Results and output

- [XML credentials](https://github.com/thebadinteger/p2pwn/blob/main/core/xml.go): `core/xml.go`
- [Scan output](https://github.com/thebadinteger/p2pwn/blob/main/core/scanner.go): `core/scanner.go`
- **Output files**

### Other components

- **Operator**

## Connections

- Operator → CLI workflow: provides targets
- CLI workflow → Scan settings: loads settings
- CLI workflow → Serial scanner: starts scan
- Serial scanner → P2P availability: checks serials
- P2P availability → Cloud profile: builds requests
- P2P availability → P2P rendezvous: contacts rendezvous
- Serial scanner → Device handshake: opens device session
- Device handshake → Cloud profile: uses profile
- Device handshake → P2P rendezvous: negotiates P2P
- Device handshake → P2P tunnel: establishes tunnel
- P2P tunnel → P2P authentication: uses credentials
- Serial scanner → CGI, SDK, CVE checks: runs configured checks
- CGI, SDK, CVE checks → P2P tunnel: sends device requests
- CGI, SDK, CVE checks → SDK protocol: tries SDK login
- Serial scanner → OSD overlay: applies overlay
- Serial scanner → SDK protocol: captures snapshot
- Serial scanner → XML credentials: encodes credentials
- Serial scanner → Scan output: records results
- Scan output → Output files: writes CSV and XML
- Scan output → Output files: saves snapshots