# z3vxo/goblinloader architecture

> Architecture diagram of the GitHub repository z3vxo/goblinloader, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/z3vxo/goblinloader
- Repository: https://github.com/z3vxo/goblinloader

## Overview

GoblinLoader combines an operator-facing C2 service with Windows agents and memory-loading components. Operators log in, manage campaigns and files, and receive live updates; agents check in and obtain campaign tasking and payloads. The backend’s route registration, authentication, file handling, task storage, and protocol parsing are sampled; agent-handler and loader internals are represented at the documented subsystem level where source excerpts were not provided.

Main entry points: [`server/backend/internal/server/server.go`](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/server.go) (HTTP server and routes), [`server/frontend/src/pages/Dashboard.jsx`](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/Dashboard.jsx) (Dashboard), [`server/backend/internal/server/agent_handlers.go`](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/agent_handlers.go) (Agent handlers), [`ldr/src/comms/comms.c`](https://github.com/z3vxo/goblinloader/blob/main/ldr/src/comms/comms.c) (C2 communications)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ui["Operator interface"]
  node_uiapp["Web application<br/>[App.jsx]"]
  node_login["Login page<br/>[Login.jsx]"]
  node_dashboard["Dashboard<br/>[Dashboard.jsx]"]
  node_campaignui["Campaign controls<br/>[CampaignTab.jsx]"]
  node_filesui["File controls<br/>[FilesTab.jsx]"]
  node_usersui["Agent and users view<br/>[UsersTab.jsx]"]
  node_socketui["Live socket context<br/>[SocketContext.jsx]"]
  node_campaignctx["Campaign context"]
end

subgraph group_c2["C2 backend"]
  node_server["HTTP server and routes<br/>[server.go]"]
  node_authhandlers["Login and auth<br/>[auth_handlers.go]"]
  node_agenthandlers["Agent handlers<br/>[agent_handlers.go]"]
  node_campaignhandlers["Campaign handlers"]
  node_filehandlers["File handling<br/>[file_handlers.go]"]
  node_ws["WebSocket hub<br/>[ws.go]"]
  node_db[("SQLite persistence<br/>[database.go]")]
  node_tasksdb["Task persistence<br/>[db_tasks.go]"]
  node_serverparser["Agent protocol parser<br/>[parser_read.go]"]
end

subgraph group_agent["Core implant"]
  node_agent["Windows agent<br/>[entry.c]"]
  node_comms["C2 communications<br/>[comms.c]"]
  node_agentparser["Binary protocol parser<br/>[parser.c]"]
  node_module["Custom modules<br/>[ls.c]"]
end

subgraph group_loading["Loading components"]
  node_reflective["Reflective DLL loader<br/>[loader.c]"]
  node_syscalls["Direct syscalls<br/>[syscalls.c]"]
  node_exemap["EXE process mapping<br/>[loader.c]"]
end

node_operator(("Operator"))
node_payload["Payload file"]

node_operator -->|"uses"| node_uiapp
node_uiapp -->|"routes to"| node_login
node_uiapp -->|"routes to"| node_dashboard
node_dashboard -->|"renders"| node_campaignui
node_dashboard -->|"renders"| node_filesui
node_dashboard -->|"renders"| node_usersui
node_login -->|"logs in via"| node_server
node_server -->|"dispatches"| node_authhandlers
node_authhandlers -->|"verifies credentials"| node_db
node_campaignui -->|"manages campaigns"| node_server
node_filesui -->|"manages files"| node_server
node_server -->|"dispatches"| node_campaignhandlers
node_server -->|"dispatches"| node_filehandlers
node_filehandlers -->|"stores metadata"| node_db
node_filehandlers -->|"writes file"| node_payload
node_server -->|"dispatches"| node_agenthandlers
node_agenthandlers -->|"parses messages"| node_serverparser
node_agenthandlers -->|"reads and creates tasks"| node_tasksdb
node_server -->|"serves socket"| node_ws
node_ws -->|"pushes updates"| node_socketui
node_socketui -->|"provides events"| node_campaignctx
node_agent -->|"uses"| node_comms
node_comms -->|"checks in and requests tasks"| node_server
node_comms -->|"encodes and parses"| node_agentparser
node_agenthandlers -->|"returns tasking"| node_comms
node_agent -.->|"loads modules"| node_module
node_payload -->|"is tasked to"| node_agent
node_payload -.->|"DLL input"| node_reflective
node_reflective -->|"uses"| node_syscalls
node_payload -.->|"EXE input"| node_exemap

click node_uiapp "https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/App.jsx"
click node_login "https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/Login.jsx"
click node_dashboard "https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/Dashboard.jsx"
click node_campaignui "https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/tabs/CampaignTab.jsx"
click node_filesui "https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/tabs/FilesTab.jsx"
click node_usersui "https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/tabs/UsersTab.jsx"
click node_socketui "https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/context/SocketContext.jsx"
click node_campaignctx "https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/context/CampaignContext.jsx"
click node_server "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/server.go"
click node_authhandlers "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/auth_handlers.go"
click node_agenthandlers "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/agent_handlers.go"
click node_campaignhandlers "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/campaing_handlers.go"
click node_filehandlers "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/file_handlers.go"
click node_ws "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/ws/ws.go"
click node_db "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/database/database.go"
click node_tasksdb "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/database/db_tasks.go"
click node_serverparser "https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/parser/parser_read.go"
click node_agent "https://github.com/z3vxo/goblinloader/blob/main/ldr/src/entry.c"
click node_comms "https://github.com/z3vxo/goblinloader/blob/main/ldr/src/comms/comms.c"
click node_agentparser "https://github.com/z3vxo/goblinloader/blob/main/ldr/src/parser/parser.c"
click node_module "https://github.com/z3vxo/goblinloader/blob/main/modules/ls.c"
click node_reflective "https://github.com/z3vxo/goblinloader/blob/main/rLdr/core/loader.c"
click node_syscalls "https://github.com/z3vxo/goblinloader/blob/main/rLdr/core/syscalls.c"
click node_exemap "https://github.com/z3vxo/goblinloader/blob/main/exemap/core/loader.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_uiapp,node_login,node_dashboard,node_campaignui,node_filesui,node_usersui,node_socketui,node_campaignctx toneBlue
class node_server,node_authhandlers,node_agenthandlers,node_campaignhandlers,node_filehandlers,node_ws,node_db,node_tasksdb,node_serverparser toneAmber
class node_agent,node_comms,node_agentparser,node_module toneMint
class node_reflective,node_syscalls,node_exemap toneRose
class node_operator,node_payload toneIndigo
```

## Components

### Operator interface

- [Web application](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/App.jsx): `server/frontend/src/App.jsx`
- [Login page](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/Login.jsx): `server/frontend/src/pages/Login.jsx`
- [Dashboard](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/Dashboard.jsx): `server/frontend/src/pages/Dashboard.jsx`
- [Campaign controls](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/tabs/CampaignTab.jsx): `server/frontend/src/pages/tabs/CampaignTab.jsx`
- [File controls](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/tabs/FilesTab.jsx): `server/frontend/src/pages/tabs/FilesTab.jsx`
- [Agent and users view](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/pages/tabs/UsersTab.jsx): `server/frontend/src/pages/tabs/UsersTab.jsx`
- [Live socket context](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/context/SocketContext.jsx): `server/frontend/src/context/SocketContext.jsx`
- [Campaign context](https://github.com/z3vxo/goblinloader/blob/main/server/frontend/src/context/CampaignContext.jsx): `server/frontend/src/context/CampaignContext.jsx`

### C2 backend

- [HTTP server and routes](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/server.go): `server/backend/internal/server/server.go`
- [Login and auth](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/auth_handlers.go): `server/backend/internal/server/auth_handlers.go`
- [Agent handlers](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/agent_handlers.go): `server/backend/internal/server/agent_handlers.go`
- [Campaign handlers](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/campaing_handlers.go): `server/backend/internal/server/campaing_handlers.go`
- [File handling](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/server/file_handlers.go): `server/backend/internal/server/file_handlers.go`
- [WebSocket hub](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/ws/ws.go): `server/backend/internal/ws/ws.go`
- [SQLite persistence](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/database/database.go): `server/backend/internal/database/database.go`
- [Task persistence](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/database/db_tasks.go): `server/backend/internal/database/db_tasks.go`
- [Agent protocol parser](https://github.com/z3vxo/goblinloader/blob/main/server/backend/internal/parser/parser_read.go): `server/backend/internal/parser/parser_read.go`

### Core implant

- [Windows agent](https://github.com/z3vxo/goblinloader/blob/main/ldr/src/entry.c): `ldr/src/entry.c`
- [C2 communications](https://github.com/z3vxo/goblinloader/blob/main/ldr/src/comms/comms.c): `ldr/src/comms/comms.c`
- [Binary protocol parser](https://github.com/z3vxo/goblinloader/blob/main/ldr/src/parser/parser.c): `ldr/src/parser/parser.c`
- [Custom modules](https://github.com/z3vxo/goblinloader/blob/main/modules/ls.c): `modules/ls.c`

### Loading components

- [Reflective DLL loader](https://github.com/z3vxo/goblinloader/blob/main/rLdr/core/loader.c): `rLdr/core/loader.c`
- [Direct syscalls](https://github.com/z3vxo/goblinloader/blob/main/rLdr/core/syscalls.c): `rLdr/core/syscalls.c`
- [EXE process mapping](https://github.com/z3vxo/goblinloader/blob/main/exemap/core/loader.c): `exemap/core/loader.c`

### Other components

- **Operator**
- **Payload file**

## Connections

- Operator → Web application: uses
- Web application → Login page: routes to
- Web application → Dashboard: routes to
- Dashboard → Campaign controls: renders
- Dashboard → File controls: renders
- Dashboard → Agent and users view: renders
- Login page → HTTP server and routes: logs in via
- HTTP server and routes → Login and auth: dispatches
- Login and auth → SQLite persistence: verifies credentials
- Campaign controls → HTTP server and routes: manages campaigns
- File controls → HTTP server and routes: manages files
- HTTP server and routes → Campaign handlers: dispatches
- HTTP server and routes → File handling: dispatches
- File handling → SQLite persistence: stores metadata
- File handling → Payload file: writes file
- HTTP server and routes → Agent handlers: dispatches
- Agent handlers → Agent protocol parser: parses messages
- Agent handlers → Task persistence: reads and creates tasks
- HTTP server and routes → WebSocket hub: serves socket
- WebSocket hub → Live socket context: pushes updates
- Live socket context → Campaign context: provides events
- Windows agent → C2 communications: uses
- C2 communications → HTTP server and routes: checks in and requests tasks
- C2 communications → Binary protocol parser: encodes and parses
- Agent handlers → C2 communications: returns tasking
- Windows agent → Custom modules: loads modules
- Payload file → Windows agent: is tasked to
- Payload file → Reflective DLL loader: DLL input
- Reflective DLL loader → Direct syscalls: uses
- Payload file → EXE process mapping: EXE input