๐ง MEMORY
๐ฌ Intermediate โ Advanced
๐ What You'll Learn Here
Scanning process memory, memory dumps, and live system memory for injected code and in-memory malware.
Learning Outline
- 1. Process Memory Scanning (Linux) โ `/proc/[pid]/mem` and `/proc/[pid]/maps`
- 2. Process Memory Scanning (Windows) โ `--pid` flag with OpenProcess
- 3. Memory Dump Analysis โ Scanning raw memory dumps from Volatility/Rekall
- 4. Shellcode Detection โ Hunting for position-independent code
- 5. Process Injection Patterns โ Detecting reflective DLL injection, process hollowing
- 6. Unpacking in Memory โ Scanning after decryption in RAM
- 7. Physical Memory Scanning โ Direct physical memory access
๐ ๏ธ MEMORY SCANNER (Coming Soon)
Scan running processes and memory dumps interactively.
Scan running processes and memory dumps interactively.
๐ Resources
- ๐ Process Scanning Documentation
- ๐ฌ Volatility Framework
- ๐ช Win-YARA (Process scanning for Windows)
- ๐ FireEye: Memory Scanning with YARA
โ๏ธ Practice Challenge
Write a YARA rule to detect a process containing the string "malware" in its memory regions. Test with a simple test process.