ayoubfaouzi / al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
GNU General Public License v2.0
5.94k stars 1.18k forks source link

Fix ScanForModules_MemoryWalk_Hidden and add new .NET structure scan. #238

Closed gsuberland closed 3 years ago

gsuberland commented 3 years ago

The memory walk check was broken because it assumed that memory regions would be executable. It also started at the wrong address - AllocationBase is the start of the allocator region, whereas BaseAddress is the actual start of the region. This has now been fixed.

This commit also adds a new check, which scans for memory structures that the .NET runtime creates to track loaded modules. This should catch injected modules even if they're dynamically loaded from memory.

This fixes #234 and #237.