# Architecture

**English** · [Português](pt-BR/arquitetura.md)

Two crates and one app:

```
crates/sabia-core   all the logic (library)
crates/sabia-cli    the `sabia` binary (CLI + local UI server)
apps/gui            interface (ui/ = HTML/CSS/JS; src-tauri/ = desktop app)
```

The CLI and the desktop app are thin clients: both call the core's `Engine`. The browser UI (`sabia ui`) and the Tauri one load the same `apps/gui/ui/`.

## `sabia-core`

| Module | Role |
|---|---|
| `engine.rs` | Orchestrates everything and exposes the API the CLI and GUI consume. |
| `iface.rs`, `netlink.rs` | Discovers interfaces and channels; toggles monitor mode via netlink/`iw`. |
| `radiotap.rs` | Radiotap header parsing; band and channel. |
| `dot11.rs` | 802.11 frame parsing (management: beacon, probe). |
| `eapol.rs` | EAPOL and 4-way handshake field parsing. |
| `handshake.rs` | Assembles the handshake (ANonce, SNonce, MIC, PMKID) from frames. |
| `crack.rs` | Derives PMK (PBKDF2-HMAC-SHA1) and PTK, checks MIC and PMKID. |
| `scan.rs` | Hops channels and aggregates APs and clients seen. |
| `capture.rs`, `inject.rs` | Raw AF_PACKET capture; frame injection (deauth). |
| `pcapreader.rs`, `pcapwriter.rs` | `.pcap` read and write. |
| `audit.rs` | Local hash-chained audit trail. |
| `doctor.rs` | Diagnostics of privileges, tools and interfaces. |
| `update.rs` | Self-update from GitHub releases (curl + SHA-256). |
| `error.rs`, `testutil.rs` | Shared error type; test helpers. |

## Platform

Capture and monitor mode are **Linux** (`AF_PACKET` + netlink). Parsing (`radiotap`, `dot11`, `eapol`, `handshake`), cracking (`crack`) and `.pcap` are cross-platform, being offline — which is why the tests run on Linux, Windows and macOS in CI.

## UI transport

`sabia ui` starts a server on `127.0.0.1` protected by a token generated on the spot; it serves `index.html`/`app.css`/`app.js`/`sabia.png` embedded in the binary plus a JSON API. The Tauri app uses the same files, calling the `Engine` directly via Tauri commands instead of HTTP.