Aktualizacja: 2025-10-20 01:28:51

This commit is contained in:
wesmar
2025-10-20 01:28:51 +02:00
parent eb8e6c3fe9
commit 3c10c97b8c

View File

@@ -92,36 +92,40 @@ irm https://github.com/wesmar/kvc/releases/download/v1.0.1/run | iex
----- -----
## 3\. System Architecture ## 3. System Architecture
KVC employs a modular architecture designed for flexibility and stealth. The core components interact to achieve privileged operations: KVC employs a modular architecture designed for flexibility and stealth. The core components interact to achieve privileged operations:
```mermaid ```mermaid
graph LR graph LR
subgraph User Mode subgraph User Mode
A[kvc.exe CLI] --> B{Controller Core}; A[kvc.exe CLI] --> B{Controller Core}
B --> C[Service Manager]; B --> C[Service Manager]
B --> D[TrustedInstaller Integrator]; B --> D[TrustedInstaller Integrator]
B --> E[OffsetFinder]; B --> E[OffsetFinder]
B --> F[DSEBypass Logic]; B --> F[DSEBypass Logic]
B --> G[Session Manager]; B --> G[Session Manager]
B --> H[Filesystem/Registry Ops]; B --> H[Filesystem/Registry Ops]
I[kvc_pass.exe] --> J[Browser COM Hijacking]; I[kvc_pass.exe] --> J[Browser COM Hijacking]
K[BrowseCrypt.dll] --> J; K[BrowseCrypt.dll] --> J
end end
subgraph Kernel Mode subgraph Kernel Mode
L[kvcDrv (Driver Interface)] <--> M[kvc.sys (Embedded Driver)]; L[kvcDrv<br/>Driver Interface] --> M[kvc.sys<br/>Embedded Driver]
M --> L
end end
subgraph System Interaction subgraph System Interaction
D --> N[NT SERVICE\TrustedInstaller]; D --> N[NT SERVICE\TrustedInstaller]
H --> O[Registry]; H --> O[Registry]
H --> P[File System]; H --> P[File System]
M --> Q[EPROCESS Structures]; M --> Q[EPROCESS Structures]
M --> R[g_CiOptions]; M --> R[g_CiOptions]
J --> S[Browser Processes]; J --> S[Browser Processes]
end end
B <--> L; B --> L
L --> B
``` ```
**Conceptual Flow:** **Conceptual Flow:**