# thefocusman/nt_file_reader architecture

> Architecture diagram of the GitHub repository thefocusman/nt_file_reader, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/thefocusman/nt_file_reader
- Repository: https://github.com/thefocusman/nt_file_reader

## Overview

This repository is a Windows PE-image toolkit: its console reader inspects executable headers and import/export metadata, while a separate loader implements image-loading support and companion programs replace Authenticode signature data or execute files. The reader maps a file, interprets its PE structures, and reports details; the loader handles relocation, import resolution, and module caching. Pointer abstractions and native-process structures support low-level memory access. The README is empty, so capabilities and relationships here are limited to the tree and shown source/index references; unsampled subsystem links are omitted where evidence is insufficient.

Main entry points: [`NT File Reader/Program.cs`](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/Program.cs) (PE reader), [`NT File Reader/Extentions.cs`](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/Extentions.cs) (Image operations), [`NT File Reader/LibraryLoader.cs`](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/LibraryLoader.cs) (Library loader), [`ImageSignature Replacer/Program.cs`](https://github.com/thefocusman/nt_file_reader/blob/master/ImageSignature%20Replacer/Program.cs) (Signature replacer)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["User tools"]
  node_reader["PE reader<br/>[Program.cs]"]
  node_signature["Signature replacer<br/>[Program.cs]"]
  node_executor["File executer<br/>[Program.cs]"]
end

subgraph group_pe["PE inspection"]
  node_peheaders["PE structures"]
  node_dosheader["DOS header<br/>[DOSHeader.cs]"]
  node_fileheader["File header<br/>[FileHeader.cs]"]
  node_optional32["PE32 optional header"]
  node_optional64["PE32+ optional header"]
  node_exports["Export directory<br/>[ExportDirectory.cs]"]
  node_sections["Section headers<br/>[SectionHeader.cs]"]
  node_imports["Import descriptors"]
end

subgraph group_loader["Image loading"]
  node_loadercore["Image operations<br/>[Extentions.cs]"]
  node_libraryloader["Library loader<br/>[LibraryLoader.cs]"]
  node_apicalls["API call shims<br/>[CustomApiCalls.cs]"]
end

subgraph group_memory["Native memory"]
  node_mapped["Mapped file"]
  node_safe["Safe pointers<br/>[SafePointer.cs]"]
  node_readonly["Read-only pointers"]
  node_pointerext["Pointer extensions"]
  node_allocated["Allocated pointers"]
  node_native["Process structures<br/>[PEB.cs]"]
end

node_user(("CLI user"))
node_windows["Windows APIs"]

node_user -->|"requests inspection"| node_reader
node_reader -->|"maps file"| node_mapped
node_reader -->|"reads header"| node_dosheader
node_reader -->|"parses PE data"| node_peheaders
node_reader -->|"lists exports"| node_exports
node_reader -->|"reads imports"| node_imports
node_reader -->|"reads strings"| node_readonly
node_user -->|"requests replacement"| node_signature
node_signature -->|"validates image"| node_dosheader
node_signature -->|"reads PE fields"| node_optional32
node_signature -->|"reads PE fields"| node_optional64
node_user -->|"requests execution"| node_executor
node_executor -->|"uses extensions"| node_loadercore
node_loadercore -->|"loads libraries"| node_libraryloader
node_loadercore -->|"allocates memory"| node_allocated
node_loadercore -->|"accesses image"| node_safe
node_loadercore -->|"validates image"| node_dosheader
node_libraryloader -->|"uses API shims"| node_apicalls
node_libraryloader -->|"reads process state"| node_native
node_libraryloader -->|"queries modules"| node_windows
node_apicalls -->|"dispatches calls"| node_loadercore
node_apicalls -->|"loads libraries"| node_libraryloader
node_safe -->|"uses extensions"| node_pointerext
node_readonly -->|"uses extensions"| node_pointerext
node_mapped -->|"uses pointers"| node_safe
node_native -->|"uses pointers"| node_safe

click node_reader "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/Program.cs"
click node_signature "https://github.com/thefocusman/nt_file_reader/blob/master/ImageSignature%20Replacer/Program.cs"
click node_executor "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Executer/Program.cs"
click node_mapped "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/CMemoryMappedFile.cs"
click node_peheaders "https://github.com/thefocusman/nt_file_reader/tree/master/NT%20File%20Reader/System/Reflection/PortableExecutable"
click node_dosheader "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/DOSHeader.cs"
click node_fileheader "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/FileHeader.cs"
click node_optional32 "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/OptionalHeaders32.cs"
click node_optional64 "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/OptionalHeaders64.cs"
click node_exports "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/ExportDirectory.cs"
click node_sections "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/SectionHeader.cs"
click node_imports "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/ImportDescriptor.cs"
click node_loadercore "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/Extentions.cs"
click node_libraryloader "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/LibraryLoader.cs"
click node_apicalls "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/CustomApiCalls.cs"
click node_safe "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/SafePointer.cs"
click node_readonly "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/ReadOnlySafePointer.cs"
click node_pointerext "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/SafePointerExtentions.cs"
click node_allocated "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/AllocatedPointer.cs"
click node_native "https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/WindowsNative/PEB.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_reader,node_signature,node_executor,node_user toneBlue
class node_peheaders,node_dosheader,node_fileheader,node_optional32,node_optional64,node_exports,node_sections,node_imports toneAmber
class node_loadercore,node_libraryloader,node_apicalls,node_windows toneMint
class node_mapped,node_safe,node_readonly,node_pointerext,node_allocated,node_native toneRose
```

## Components

### User tools

- [PE reader](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/Program.cs): `NT File Reader/Program.cs`
- [Signature replacer](https://github.com/thefocusman/nt_file_reader/blob/master/ImageSignature%20Replacer/Program.cs): `ImageSignature Replacer/Program.cs`
- [File executer](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Executer/Program.cs): `NT File Executer/Program.cs`

### PE inspection

- [PE structures](https://github.com/thefocusman/nt_file_reader/tree/master/NT%20File%20Reader/System/Reflection/PortableExecutable): `NT File Reader/System/Reflection/PortableExecutable`
- [DOS header](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/DOSHeader.cs): `NT File Reader/System/Reflection/PortableExecutable/DOSHeader.cs`
- [File header](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/FileHeader.cs): `NT File Reader/System/Reflection/PortableExecutable/FileHeader.cs`
- [PE32 optional header](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/OptionalHeaders32.cs): `NT File Reader/System/Reflection/PortableExecutable/OptionalHeaders32.cs`
- [PE32+ optional header](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/OptionalHeaders64.cs): `NT File Reader/System/Reflection/PortableExecutable/OptionalHeaders64.cs`
- [Export directory](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/ExportDirectory.cs): `NT File Reader/System/Reflection/PortableExecutable/ExportDirectory.cs`
- [Section headers](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/System/Reflection/PortableExecutable/SectionHeader.cs): `NT File Reader/System/Reflection/PortableExecutable/SectionHeader.cs`
- [Import descriptors](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/ImportDescriptor.cs): `NT File Reader/ImportDescriptor.cs`

### Image loading

- [Image operations](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/Extentions.cs): `NT File Reader/Extentions.cs`
- [Library loader](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/LibraryLoader.cs): `NT File Reader/LibraryLoader.cs`
- [API call shims](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/CustomApiCalls.cs): `NT File Reader/CustomApiCalls.cs`

### Native memory

- [Mapped file](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/CMemoryMappedFile.cs): `NT File Reader/CMemoryMappedFile.cs`
- [Safe pointers](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/SafePointer.cs): `NT File Reader/SafePointer.cs`
- [Read-only pointers](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/ReadOnlySafePointer.cs): `NT File Reader/ReadOnlySafePointer.cs`
- [Pointer extensions](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/SafePointerExtentions.cs): `NT File Reader/SafePointerExtentions.cs`
- [Allocated pointers](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/AllocatedPointer.cs): `NT File Reader/AllocatedPointer.cs`
- [Process structures](https://github.com/thefocusman/nt_file_reader/blob/master/NT%20File%20Reader/WindowsNative/PEB.cs): `NT File Reader/WindowsNative/PEB.cs`

### Other components

- **CLI user**
- **Windows APIs**

## Connections

- CLI user → PE reader: requests inspection (evidence: `NT File Reader/Program.cs`)
- PE reader → Mapped file: maps file (evidence: `NT File Reader/Program.cs`)
- PE reader → DOS header: reads header (evidence: `NT File Reader/Program.cs`)
- PE reader → PE structures: parses PE data (evidence: `NT File Reader/Program.cs`)
- PE reader → Export directory: lists exports (evidence: `NT File Reader/Program.cs`)
- PE reader → Import descriptors: reads imports (evidence: `NT File Reader/Program.cs`)
- PE reader → Read-only pointers: reads strings (evidence: `NT File Reader/Program.cs`)
- CLI user → Signature replacer: requests replacement (evidence: `ImageSignature Replacer/Program.cs`)
- Signature replacer → DOS header: validates image (evidence: `ImageSignature Replacer/Program.cs`)
- Signature replacer → PE32 optional header: reads PE fields (evidence: `ImageSignature Replacer/Program.cs`)
- Signature replacer → PE32+ optional header: reads PE fields (evidence: `ImageSignature Replacer/Program.cs`)
- CLI user → File executer: requests execution (evidence: `NT File Executer/Program.cs`)
- File executer → Image operations: uses extensions (evidence: `NT File Executer/Program.cs`)
- Image operations → Library loader: loads libraries (evidence: `NT File Reader/Extentions.cs`)
- Image operations → Allocated pointers: allocates memory (evidence: `NT File Reader/Extentions.cs`)
- Image operations → Safe pointers: accesses image (evidence: `NT File Reader/Extentions.cs`)
- Image operations → DOS header: validates image (evidence: `NT File Reader/Extentions.cs`)
- Library loader → API call shims: uses API shims (evidence: `NT File Reader/LibraryLoader.cs`)
- Library loader → Process structures: reads process state (evidence: `NT File Reader/LibraryLoader.cs`)
- Library loader → Windows APIs: queries modules (evidence: `NT File Reader/LibraryLoader.cs`)
- API call shims → Image operations: dispatches calls (evidence: `NT File Reader/CustomApiCalls.cs`)
- API call shims → Library loader: loads libraries (evidence: `NT File Reader/CustomApiCalls.cs`)
- Safe pointers → Pointer extensions: uses extensions (evidence: `NT File Reader/SafePointer.cs`)
- Read-only pointers → Pointer extensions: uses extensions (evidence: `NT File Reader/ReadOnlySafePointer.cs`)
- Mapped file → Safe pointers: uses pointers (evidence: `NT File Reader/CMemoryMappedFile.cs`)
- Process structures → Safe pointers: uses pointers (evidence: `NT File Reader/WindowsNative/PEB.cs`)