diff --git a/README.md b/README.md
index 5ed80c0..6ce05c7 100644
--- a/README.md
+++ b/README.md
@@ -92,36 +92,40 @@ irm https://github.com/wesmar/kvc/releases/download/v1.0.1/run | iex
-----
-## 3\. System Architecture
+## 3. System Architecture
KVC employs a modular architecture designed for flexibility and stealth. The core components interact to achieve privileged operations:
```mermaid
graph LR
subgraph User Mode
- A[kvc.exe CLI] --> B{Controller Core};
- B --> C[Service Manager];
- B --> D[TrustedInstaller Integrator];
- B --> E[OffsetFinder];
- B --> F[DSEBypass Logic];
- B --> G[Session Manager];
- B --> H[Filesystem/Registry Ops];
- I[kvc_pass.exe] --> J[Browser COM Hijacking];
- K[BrowseCrypt.dll] --> J;
+ A[kvc.exe CLI] --> B{Controller Core}
+ B --> C[Service Manager]
+ B --> D[TrustedInstaller Integrator]
+ B --> E[OffsetFinder]
+ B --> F[DSEBypass Logic]
+ B --> G[Session Manager]
+ B --> H[Filesystem/Registry Ops]
+ I[kvc_pass.exe] --> J[Browser COM Hijacking]
+ K[BrowseCrypt.dll] --> J
end
+
subgraph Kernel Mode
- L[kvcDrv (Driver Interface)] <--> M[kvc.sys (Embedded Driver)];
+ L[kvcDrv
Driver Interface] --> M[kvc.sys
Embedded Driver]
+ M --> L
end
+
subgraph System Interaction
- D --> N[NT SERVICE\TrustedInstaller];
- H --> O[Registry];
- H --> P[File System];
- M --> Q[EPROCESS Structures];
- M --> R[g_CiOptions];
- J --> S[Browser Processes];
+ D --> N[NT SERVICE\TrustedInstaller]
+ H --> O[Registry]
+ H --> P[File System]
+ M --> Q[EPROCESS Structures]
+ M --> R[g_CiOptions]
+ J --> S[Browser Processes]
end
- B <--> L;
+ B --> L
+ L --> B
```
**Conceptual Flow:**