sabia/docs/architecture.md

Architecture

English · Português

Two crates and one app:

crates/sabia-core   all the logic (library)
crates/sabia-cli    the `sabia` binary (CLI + local UI server)
apps/gui            interface (ui/ = HTML/CSS/JS; src-tauri/ = desktop app)

The CLI and the desktop app are thin clients: both call the core's Engine. The browser UI (sabia ui) and the Tauri one load the same apps/gui/ui/.

sabia-core

Module	Role
engine.rs	Orchestrates everything and exposes the API the CLI and GUI consume.
iface.rs, netlink.rs	Discovers interfaces and channels; toggles monitor mode via netlink/iw.
radiotap.rs	Radiotap header parsing; band and channel.
dot11.rs	802.11 frame parsing (management: beacon, probe).
eapol.rs	EAPOL and 4-way handshake field parsing.
handshake.rs	Assembles the handshake (ANonce, SNonce, MIC, PMKID) from frames.
crack.rs	Derives PMK (PBKDF2-HMAC-SHA1) and PTK, checks MIC and PMKID.
scan.rs	Hops channels and aggregates APs and clients seen.
capture.rs, inject.rs	Raw AF_PACKET capture; frame injection (deauth).
pcapreader.rs, pcapwriter.rs	.pcap read and write.
audit.rs	Local hash-chained audit trail.
doctor.rs	Diagnostics of privileges, tools and interfaces.
update.rs	Self-update from Gitea releases (curl + SHA-256).
error.rs, testutil.rs	Shared error type; test helpers.

Platform

Capture and monitor mode are Linux (AF_PACKET + netlink). Parsing (radiotap, dot11, eapol, handshake), cracking (crack) and .pcap are cross-platform, being offline — which is why the tests run on Linux in CI.

UI transport

sabia ui starts a server on 127.0.0.1 protected by a token generated on the spot; it serves index.html/app.css/app.js/logo.png embedded in the binary plus a JSON API. The Tauri app uses the same files, calling the Engine directly via Tauri commands instead of HTTP.