26 matches found
XenoScan
XenoScan XenoScan is a memory scanner which can be used to scan the memory of processes to locate the specific locations of important values. These types of tools are typically used when hacking video games, as they allow one to locate the values representing the game's state in memory. XenoScan ...
Squalr
Squalr Squalr Official Website Join us on our Discord Channel Squalr is a highly performant dynamic analysis reverse-engineering tool written in Rust. First and foremost, Squalr is a lightning fast memory scanner, allowing the user to search for and modify running process memory. Fast scans are...
ComfyEngine
ComfyEngine Qt-based memory scanner / watchlist playground inspired by Cheat Engine but built natively for Linux and tuned for my workflow: clean docks, pointer graphs, fast patching, and zero fear of losing context when you bounce between scanner, scripts, and notes. ComfyEngine gives you a clea...
DeepSleep
DeepSleep A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC. Huge thanks to @waldoirc for documenting large parts of this technique on his blog This implementation is different in that it does not make use of any APCs and is fully implemented as PIC. Description I have...
DeathSleep
██████╗ ███████╗ █████╗ ████████╗██╗ ██╗███████╗██╗ ███████╗███████╗██████╗ ██╔══██╗██╔════╝██╔══██╗╚══██╔══╝██║ ██║██╔════╝██║ ██╔════╝██╔════╝██╔══██╗ ██║ ██║█████╗ ███████║ ██║ ███████║███████╗██║ █████╗ █████╗ ██████╔╝ ██║ ██║██╔══╝ ██╔══██║ ██║ ██╔══██║╚════██║██║ ██╔══╝ ██╔══╝ ██╔═══╝...
ReClass.NET
ReClass.NET This is a port of ReClass to the .NET platform with lots of additional features. Features Support for x86 / x64 File import from ReClass 2007-2016 and ReClass QT Memory Nodes Arrays and Pointers to every other node types Hex 8 / 16 / 32 / 64 Int 8 / 16 / 32 / 64 UInt 8 / 16 / 32 / 64...
YAMA-dev
YAMA Yet Another Memory Analyzer for malware detection Concept YAMA is a system for generating scanner that can inspect specific malware during incident response. The scanner generated by YAMA is designed to explore the memory of Windows OS and detect malware. With the increasing prevalence of...
AceLdr
AceLdr - Avoid Memory Scanners A position-independent reflective loader for Cobalt Strike. Zero results from Hunt-Sleeping-Beacons, BeaconHunter, BeaconEye, Patriot, Moneta, PE-sieve, or MalMemDetect. Features Easy to Use Import a single CNA script before generating shellcode. Dynamic Memory...
patriot
Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...
Cronos
Cronos Este proyecto fue coautoría de Descripción PoC de una nueva técnica de ofuscación de suspensión basada en Ekko que aprovecha los temporizadores con espera para cifrar el proceso actual con RC4 y cambiar los permisos de RW a RX para evadir los escáneres de memoria. Una explicación más...
TickTock
TickTock Este repositorio demuestra un escáner de memoria PoC para enumerar los temporizadores de cola de temporizadores timer-queue timers utilizados en Ekko Sleep Obfuscation: https://github.com/Cracked5pider/Ekko. Para un análisis técnico completo, consulte la publicación del blog adjunta aquí...
BlockOpenHandle
BlockOpenHandle Block any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote memory scanners POC...
NORM-EDR
NORM-EDR NORM Normal EDR is an experimental kernel-mode EDR research project focused on explainable detection rather than silent blocking. Instead of assigning scores or killing processes, NORM answers one question: Why does this binary look suspicious? This project is built step-by-step in publi...
Voidgate
VOIDGATE Descripción: Una técnica que se puede utilizar para evadir los escáneres de memoria de AV/EDR. Puede usarse para ocultar shellcodes conocidos y detectados como msfvenom realizando descifrado sobre la marcha de instrucciones individuales de ensamblador cifradas, haciendo así que los...
memscan
memscan Busca cadenas, expresiones regulares, números de tarjeta de crédito y pistas de tarjetas de banda magnética en el espacio de memoria de un proceso Escáner de memoria/procesos Escrito por Matt Lewis, NCC Group 2014 Actualizado por Tom Watson, NCC Group 2015 Gracias a Jesse Bullock por much...
MappedImagesDetector
MappedImagesDetector Native Windows memory scanner for detecting malicious DLL injections and in-memory malware MappedImagesDetector is a low-level C++20 Windows tool designed to detect malicious DLL injection techniques used by modern malware, including manual-mapped DLLs, erased PE headers, and...
kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
A resource exhaustion vulnerability was found in the Kernel Same-page Merging KSM subsystem of the Linux kernel. When scanning processes with large sparse virtual memory mappings e.g., 32 TiB with one mapped page, ksmd inefficiently walks every address rather than skipping unmapped holes. This...
CVE-2023-34970: Use After Free
A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory...