Memory-scanner-for-injected-DLLs-and-shellcode-detection-C - Memory Scanner Scan running processes for: Injecte

项目说明

🛡️ MemoryScannerX

*A read-only, cross-platform memory forensics & endpoint tool written in C*

> One-line description: MemoryScannerX is a defensive CLI tool that scans the RAM ( memory) of running processes and detects suspicious memory permissions (such as RWX pages), hidden or inconsistent modules, and shellcode-like heuristic patterns — producing a transparent, explainable threat score without e, injecting into, or terminating any process.

De by: Syed Shaheer Hussain
Copyright: © 2026 Syed Shaheer Hussain. All rights reserved.
License: MIT
Language: ISO C17 (pure C, no C++)
Platforms: Linux ✅ (built & tested) | Windows ✅

#cybersecurity #memory-forensics #malware-analysis #endpoint-security #C-programming #cross-platform #defensi #DFIR #CLI-tool #open-source

---

⚠️ IMPORTANT — Scope Clarification (Please Read First)

A few items that were requested as part of this documentation are not part of this project, and have been deliberately excluded:

If a sa or a phishing/email detector is genuinely needed, those would have to be completely separate projects — similar to an earlier "RedFlag" scam-detector web app — and would need to be designed strictly within ethical and legal boundaries (for example, your own sa through Chrome's own chrome://settings/passwords page — doing this via a third-party tool is inappropriate and risky).

E below reflects only what actually exists in MemoryScannerX.

---

📖 Table of Contents

1. Introduction
2. Mission & O
3. Objectives
4. What is Memory Forensics? (Concepts)
5. Why This Project Has Value
6. Features
7. Functions / Modules Breakdown
8. GUI / Interface
9. Technologies Used
10. Architecture
11. Folder Structure
12. Flow Chart — How It Works
13. Installation
14. Running the Tool
15. Usage — Every Command Explained
16. Sample Output
17. How Threat Scoring Works
18. Ad
19. Disad / Limitations
20. Cautions & Safety Notes
21. Disclaimer
22. What Was Studied / Learned Building This
23. Future Enhancements
24. FAQ
25. Credits & Copyright

---

🧭 1. Introduction

MemoryScannerX is a command-line (CLI) defensi tool written in the C programming language. Its purpose is to, for any running process:

It works much like Task Manager and an antivirus's memory-scanning feature combined — but provides read-only only; it ne or blocks anything.

---

🎯 2. Mission & O

> Mission: To build a lightweight, dependency-free, cross-platform C tool that gi analysts, DFIR (Digital Forensics & Incident Response) professionals, and security students a safe, transparent way to look inside process memory — without any offensive or destructi.

O:

| Item | Detail |
|---|---|
| Type | Command-Line Interface (CLI) tool |
| Category | Defensi / DFIR / Endpoint |
| Core action | Read-only inspection of processes and memory |
| What it does NOT do | Modify, terminate, inject into, or suspend any process |
| Target audience | Security students, malware analysts, SOC analysts, DFIR responders |

---

🏆 3. Objectives

1. ✅ Build a portable, dependency-free C codebase that runs on both Linux and Windows.
2. ✅ Enumerate processes and memory using only documented OS APIs (/proc, , Toolhelp32, PSAPI) — no undocumented or kernel-hacking techniques.
3. ✅ Attach a plain-language reason to every detection — no black-box scoring.
4. ✅ Stay strictly within a defensi scope — no offensi, or e capability.
5. ✅ Keep the code modular so that future modules (PE/ELF parsers, hook detection, YARA, etc.) can be added easily.

---

🧪 4. What is Memory Forensics? (Concepts)

Memory forensics (also called "RAM forensics") is a cybersecurity technique that in analyzing a running system's li (RAM) to determine:

Key Concepts Used in This Project:

---

💹 5. Why This Project Has Value (Market Relevance)

---

✨ 6. Features

✅ Currently Implemented (Real, Compiled, Tested):

1. 📋 Process Enumeration — A list of all running processes (PID, PPID, name, path, user, architecture, thread count, RAM usage)
2. 🧠 Memory Region Scanner — Every process's memory regions (base address, size, permissions, type)
3. 🚨 RWX / Suspicious Permission Detection — Writable+Executable regions, anonymous executable memory
4. 📦 Module Enumeration — A list of loaded shared libraries/DLLs
5. 🕵️ Hidden Module / Anomaly Detection — Comparing two independent sources to find inconsistencies
6. 🐛 Shellcode Heuristic Scanner — Entropy, NOP-sled detection, zero-byte ratio, anonymous-exec memory
7. 🔢 Shannon Entropy Calculation — For identifying packed/encrypted content
8. #️⃣ Dependency-free SHA-256 Hashing — For module/file integrity
9. 📊 Transparent Threat Scoring Engine — Every finding comes with a reason and a point value, no black box
10. 📄 JSON + Plain-Text Reporting — Both machine-readable and human-readable formats
11. 💻 Full CLI — list, inspect, scan --pid, scan --all
12. 🧪 Unit Tests — Entropy, SHA-256 ( against FIPS test ), scoring logic

🔜 Not Yet Implemented (Documented Honestly, Not Faked):

---

⚙️ 7. Functions / Modules Breakdown

| Module | File(s) | Purpose |
|---|---|---|
| Platform Abstraction | utils/msx_common.h | Common types, error codes, Linux/Windows detection macros |
| Process Module | process/msx_process.* | Fetching the process list and single-process details |
| Memory Module | memory/msx_memory.* | Enumerating memory regions, reading a region |
| Module Scanner | scanner/msx_modules.* | Listing loaded libraries + hidden-module anomaly check |
| Shellcode Scanner | scanner/msx_shellcode.* | Entropy/NOP-sled/zero-ratio based heuristic scan |
| Scoring Engine | scanner/msx_scoring.* | Calculating a weighted, explainable threat score |
| Scan Engine (Orchestrator) | scanner/msx_scan_engine.* | Running all modules for a gi |
| Reporter | report/msx_report.* | Generating JSON and text reports |
| Logging | utils/msx_log.* | Timestamped, leveled console/file logging |
| Entropy Utility | utils/msx_entropy.* | Shannon entropy calculation |
| SHA-256 Utility | utils/msx_sha256.* | Dependency-free hashing |
| CLI / main | cli/main.c | Command-line argument parsing + entry point |

---

🖥️ 8. GUI / Interface

MemoryScannerX has no GUI — it is deliberately a pure CLI (Command-Line Interface) tool, exactly like ls, ps, netstat, or a Python script run from a terminal.

> 📌 If a GUI is needed in the future, a separate Python/Electron/Qt frontend could be built that calls this CLI tool as a backend (using the JSON output) — this is a natural future enhancement.

---

🧰 9. Technologies Used

| Category | Technology |
|---|---|
| Language | ISO C17 (GNU11-compatible, pure C — no C++) |
| Build System | CMake (3.16+) |
| Compilers Supported | GCC, Clang, MS/TDM-GCC (Dev-C++) |
| Linux APIs | /proc filesystem, process_() |
| Windows APIs | CreateToolhelp32Snapshot, Process32First/Next, , ReadProcessMemory, OpenProcessToken, PSAPI (EnumProcessModulesEx, GetModuleFileNameExA) |
| Threading (logging mutex) | POSIX threads (pthread) on Linux, CRITICAL_SECTION on Windows |
| Hashing | Custom dependency-free SHA-256 implementation |
| Testing | Custom lightweight test harness (no external framework required) |
| Sanitizers | AddressSanitizer + UndefinedBeha (used during de) |

---

🏛️ 10. Architecture

MemoryScannerX follows a layered, modular architecture:

Design Principle: Each layer only communicates with the layer beneath it — there is no tight coupling. This means new modules (PE parser, YARA, etc.) can be added easily without breaking existing code.

---

📁 11. Folder Structure

---

🔄 12. Flow Chart — How It Works

---

🛠️ 13. Installation

🐧 Linux

Step 1 — Install prerequisites:

Step 2 — Extract the project and create a build folder:

Step 3 — Configure with CMake:

Step 4 — Compile:

Step 5 — the build succeeded:

If this file appears (with executable permission -rwxr-xr-x), the installation was successful. ✅

---

🪟 Windows ( Studio / MSVC)

Prerequisites:

Steps:

The resulting .exe will be found at: build\Release\memoryscannerx.exe

---

🪟 Windows (Dev-C++ / TDM-GCC)

Option A — Command Line (Fastest):

1. Locate the TDM-GCC-64\bin folder inside your Dev-C++ installation (usually C:\Program Files (x86)\Embarcadero\Dev-Cpp\TDM-GCC-64\bin)
2. Use cmd.exe from that folder, or add it to your PATH
3. Na to the project root folder, then run:

Option B — Dev-C++ GUI Project:

1. File → New → Project → Console Application → C Project (⚠️ C, not C++)
2. Delete the default main.c
3. Project → Add to Project → add all 12 .c files (listed above)
4. Project → Project Options → Directories → Include Directories → add the include\ folder
5. Project → Project Options → Parameters:
- Compiler: -std=gnu11 -DWIN -D_WIN32_WINNT=0x0600
- Linker: -lpsapi -lad
6. Execute → Compile or press F9

> 💡 Note: If -std=c17/-std=gnu17 produces an error, use -std=gnu11 instead — the code does not use anything C17-specific that would fail under gnu11.

---

▶️ 14. Running the Tool

> ⚠️ Most Important Note: This is a CLI tool — like a Python script. Double-clicking it will open and immediately close the window, and no output will be . Always run it from a terminal/cmd.

Step-by-Step (Windows):

1. Press Windows key + R
2. Type cmd, press Enter
3. Na to the folder containing the .exe:

4. Run the command:

*(or whatever name you gave your .exe)*

Step-by-Step (Linux):

Why Run as Admin/Root?

---

📘 15. Usage — Every Command Explained

1️⃣ list — Show All Running Processes

Purpose: Similar to Task Manager — lists all processes: PID, PPID, name, architecture, executable path.

---

2️⃣ inspect --pid <PID> — Details of One Process

Purpose: Shows full details of a specific process: name, path, command line, user, architecture, thread count, RAM (RSS/VM size), integrity level (Windows).

Where do I get the PID? Run list first, then copy the PID from there.

---

3️⃣ scan --pid <PID> — Full Security Scan of One Process

What it does:

Optional flags:

---

4️⃣ scan --all — Scan All Processes

What it does: Scans every accessible process on the system one by one and reports any that appear suspicious.

Optional flags:

---

5️⃣ --help / -h — Help Message

6️⃣ -- — Show

---

🖨️ 16. Sample Output

Output of the list command:

Output of scan --pid (clean/benign process):

Output of scan --pid (suspicious process — RWX memory found):

---

⚖️ 17. How Threat Scoring Works

Every suspicious finding earns points, and the total score is con into a risk level:

| Finding | Default Points |
|---|---:|
| Writable+Executable region | +20 |
| Anonymous executable memory | +15 |
| Module anomaly (hidden/inconsistent) | +30 |
| Deleted backing file (unlinked binary) | +35 |
| Shellcode NOP-sled pattern | +25 |
| High entropy executable region | +15 |

| Total Score | Risk Level |
|---:|---|
| 0 | None |
| 1–24 | 🟢 Low |
| 25–59 | 🟡 Medium |
| 60–99 | 🟠 High |
| 100+ | 🔴 Critical |

> 💡 Transparency Guarantee: Every point comes attached with a plain-language reason — there is no "black box AI score." You can see exactly why a score was produced.

---

✅ 18. Ad

1. 🪶 Lightweight & Dependency-Free — Only a C compiler is required, no hea to install
2. 🔓 Fully Open-Source-Style Code — The entire source code is a, no hidden binary blobs
3. 🖥️ True Cross-Platform Design — The same architecture works for both Linux and Windows
4. 🔍 Transparent Scoring — Every detection is explainable
5. 🛡️ 100% Read-Only / Safe — Ne or harms the target process
6. 📚 Educational Value — Excellent for learning OS internals, memory management, and security concepts
7. ⚡ Fast — Efficient buffered memory reads, minimal o

---

⚠️ 19. Disad / Limitations

1. 🖥️ No GUI — Command-line only, which may be difficult for non-technical users
2. 🪟 Windows Path Untested — The code has been written but not compiled/ on a real Windows machine in this de en
3. 🔐 Pri — Without admin/root, other users' processes cannot be scanned properly
4. 🧩 Incomplete Feature Set — PE/ELF parsers, YARA, hook detection, and hollowing detection are not yet implemented
5. 📉 Weaker Hidden-Module Detection on Linux — Because both comparison "views" are derived from /proc/maps, a genuinely independent cross-check would require ptrace/link_map
6. 🐌 Single-Threaded — Concurrent/parallel scanning is not yet implemented, which may be slightly slow on larger systems

---

🚧 20. Cautions & Safety Notes

1. ⚠️ Root/Administrator access grants full system — only run this tool in a trusted en
2. ⚠️ in a test en before running on any production/critical system for the first time
3. ⚠️ scan --all scans every process on the entire system — this may temporarily use more CPU/IO on larger systems
4. ⚠️ This tool is not a replacement for antivirus — it is a /analysis tool and does not automatically remove or block anything
5. ⚠️ Before running on Windows, notify your antivirus/EDR — memory-reading tools can sometimes trigger false-positive A (because the technique is used by both memory scanners and malware alike)
6. ⚠️ When modifying the source code, maintain the read-only/defensi — adding offensi capability to this project goes against its core design principle

---

📜 21. Disclaimer

> This software is provided "AS IS", without warranty of any kind — neither of performance nor fitness for a particular purpose. The de (Syed Shaheer Hussain) is not responsible for any direct or indirect damage resulting from the use of this software.
>
> This tool is built solely for defensi, and authorized security research purposes. Use it only on your own systems, or where you have explicit permission to do so. Scanning others' systems without permission may be illegal under the laws of your jurisdiction.
>
> This tool contains no offensi, or malware-generation capability — and none will be added in the future.

---

🎓 22. What Was Studied / Learned Building This

The following topics were studied/learned while building this project:

1. 🧠 Operating System Internals — memory, process management, /proc filesystem structure
2. 🪟 Windows Win32 API Programming — Toolhelp32, PSAPI, Access Tokens, Integrity Levels
3. 🐧 Linux Systems Programming — /proc/pid/maps, process_, POSIX APIs
4. 🔐 Applied Cryptography Basics — SHA-256 algorithm (implemented from scratch, without a library)
5. 📊 Information Theory — Shannon entropy and its security applications
6. 🏗️ C Systems Programming — Manual memory management, platform abstraction (#ifdef), macro-based generics
7. 🛡️ Malware Analysis Fundamentals — RWX detection, shellcode indicators, hidden module concepts
8. 🧪 Software Engineering Practices — Modular architecture, unit testing, sanitizer-based debugging (ASan/UBSan)
9. 🔧 Build Systems — CMake configuration for cross-platform, multi-compiler projects

---

🚀 23. Future Enhancements & Roadmap

Phase 2 (Planned):

Phase 3 (Planned):

Phase 4 (Planned):

---

❓ 24. FAQ

Q: What is this tool for?
A: Defensi forensics — for malware analysis, DFIR, and learning/performing endpoint .

Q: Is this an antivirus?
A: No. It doesn't "remove" or "block" anything — it only shows what is suspicious.

Q: Can this harm any process?
A: No. It has a 100% read-only design — there is no write, inject, or terminate operation anywhere in the entire codebase.

Q: Nothing happens when I double-click it — is that a bug?
A: No — this is a CLI tool. Run it from a terminal/cmd with a command like .exe list.

Q: Has it been tested on Windows?
A: The code has been written and designed against Windows APIs, but could not be compiled/ on an actual Windows machine in this de en (which was a Linux sandbox). Test carefully the first time you run it.

Q: Can it show Chrome's sa?
A: No, and it never will. This feature is outside the scope of this project and has been deliberately excluded (credential har risk).

---

🧾 25. Credits & Copyright

> Built with 🛡️ for defensi learning and research.

---

📌 Quick Reference Cheat-Sheet

| Command | Purpose |
|---|---|
| memoryscannerx list | Show all processes |
| memoryscannerx inspect --pid X | Details of one process |
| memoryscannerx scan --pid X | Full scan of one process |
| memoryscannerx scan --all | Scan all processes |
| memoryscannerx scan --all --min-risk medium | Show only Medium+ risk processes |
| memoryscannerx scan --pid X --json out.json | Save the report as JSON |
| memoryscannerx --help | Help message |
| memoryscannerx -- | Show |

🔚 End of Documentation.

项目信息

开发语言：C

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Memory Scanner Scan running processes for: Injected DLLs RWX memory pages Shellcode signatures Hidden processes展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。