Split README into CN/EN with language switch buttons, add TODO roadmap section
This commit is contained in:
Huang-158
parent
561ddaaab5
commit
9d1a2389ca
230
README.md
230
README.md
@ -1,213 +1,55 @@
|
|||||||
|
<div align="center">
|
||||||
|
|
||||||
|
[](https://dotnet.microsoft.com/)
|
||||||
|
[](LICENSE)
|
||||||
|
[](https://www.microsoft.com/windows)
|
||||||
|
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<a href="README_CN.md"><img src="https://img.shields.io/badge/中文文档-点击查看-red?style=for-the-badge&logo=markdown" height="40"></a>
|
||||||
|
|
||||||
|
<a href="README_EN.md"><img src="https://img.shields.io/badge/English_Docs-Click_to_View-blue?style=for-the-badge&logo=markdown" height="40"></a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<br>
|
||||||
|
|
||||||
# MemScan-EDR
|
# MemScan-EDR
|
||||||
|
|
||||||
> **开源、轻量化、内存专项的 Windows 终端威胁检测与响应 (EDR) 工具**
|
> **Memory-Focused Windows Endpoint Detection & Response (EDR)**
|
||||||
> **Open-Source, Lightweight, Memory-Focused Windows Endpoint Detection & Response (EDR) Tool**
|
> **内存专项的 Windows 终端威胁检测与响应工具**
|
||||||
|
|
||||||
[](LICENSE)
|
A lightweight EDR tool that scans running processes, inspects memory for shellcode/injection/C2 patterns, and uses AI to classify threats in real time.
|
||||||
[](https://dotnet.microsoft.com/)
|
|
||||||
[](https://www.microsoft.com/windows)
|
|
||||||
[](https://github.com/dotnet/wpf)
|
|
||||||
|
|
||||||
**中文** | MemScan-EDR 扫描所有运行中的进程，检查内存中的 Shellcode / 注入 / C2 特征，并利用 AI（OpenAI / Claude / 本地模型）实时分类威胁。基于 C# WPF 构建，通过 `dotnet publish` 打包为单个 `.exe`，无需目标机器安装 .NET 运行时。
|
轻量级 EDR 工具，扫描运行中进程内存中的恶意特征，利用 AI 实时分类威胁。
|
||||||
|
|
||||||
**English** | MemScan-EDR scans all running processes, inspects memory for shellcode/injection/C2 patterns, and uses AI (OpenAI / Claude / local models) to classify threats in real time. Built with C# WPF for zero-dependency deployment as a single `.exe`.
|
<br>
|
||||||
|
|
||||||
|
<div align="center">
|
||||||
|
|
||||||
|
| [📖 中文文档](README_CN.md) | [📖 English Docs](README_EN.md) |
|
||||||
|
|:---:|:---:|
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 功能特性 / Features
|
## Quick Preview / 快速预览
|
||||||
|
|
||||||
### 核心能力 / Core Capabilities
|
| Dashboard 仪表盘 | Scan 扫描 | Settings 设置 |
|
||||||
|
|:---:|:---:|:---:|
|
||||||
| 能力 Capability | 描述 Description |
|
| Real-time risk stats | Process-level scan log | Multi-provider AI config |
|
||||||
|---|---|
|
|
||||||
| **进程全量采集 Process Enumeration** | PID、进程名、路径、父进程树、启动命令行、数字签名、线程数、内存用量 / PID, name, path, parent tree, command line, digital signature, thread count, memory usage |
|
|
||||||
| **内存扫描 Memory Scanning** | `VirtualQueryEx` 遍历每个已提交内存区域；检测 RWX 私有内存、未映射可执行页 / Traverses every committed region; detects RWX private memory, unbacked executable pages |
|
|
||||||
| **签名匹配 Signature Matching** | 12 条内置检测规则：NOP sled、CALL/POP EIP、ROR13 hash、CobaltStrike Beacon、Meterpreter、ReflectiveLoader、Mimikatz 等 / 12 built-in rules covering shellcode, C2, injection, and malware patterns |
|
|
||||||
| **AI 威胁分类 AI Threat Classification** | 多提供商支持（OpenAI 兼容 / Claude / Ollama / LM Studio）+ 启发式规则降级引擎 / Multi-provider support + heuristic fallback engine |
|
|
||||||
| **CE-MCP 集成 CE-MCP Integration** | 自动启动 Cheat Engine MCP 服务器，提供内核级内存操作能力 / Auto-launch Cheat Engine MCP server for kernel-level memory operations |
|
|
||||||
| **中英文界面切换 Chinese/English UI** | 一键切换全部标签、按钮、告警文本 / One-click language toggle; all labels, buttons, and alerts switch instantly |
|
|
||||||
| **单文件 EXE Single-File EXE** | `dotnet publish` 生成自包含 `MemScan-EDR.exe`，目标机器无需 .NET 运行时 / Produces a self-contained EXE — no .NET runtime needed on target |
|
|
||||||
|
|
||||||
### AI 提供商 / AI Providers
|
|
||||||
|
|
||||||
| 提供商 Provider | 描述 Description | Base URL 示例 |
|
|
||||||
|---|---|---|
|
|
||||||
| **OpenAI 兼容 OpenAI-Compatible** | OpenAI / DeepSeek / 通义千问 / 智谱 等任意 OpenAI 格式 API | `https://api.openai.com/v1` |
|
|
||||||
| **Claude** | Anthropic Claude Messages API | `https://api.anthropic.com` |
|
|
||||||
| **本地模型 Local** | Ollama / LM Studio / vLLM / llama.cpp server | `http://127.0.0.1:11434` |
|
|
||||||
| **启发式规则 Heuristic** | 内置规则引擎，无需 API Key | N/A |
|
|
||||||
|
|
||||||
### 内置签名 / Built-in Signatures
|
|
||||||
|
|
||||||
| 签名 Signature | 类别 Category | 严重性 Severity |
|
|
||||||
|---|---|---|
|
|
||||||
| `SHELLCODE_NOP_SLED` | Shellcode | 中 Medium |
|
|
||||||
| `SHELLCODE_GETEIP` | Shellcode | 中 Medium |
|
|
||||||
| `SHELLCODE_ROR13` | Shellcode | 中 Medium |
|
|
||||||
| `C2_COBALTSTRIKE` | C2 | 高 High |
|
|
||||||
| `C2_METERPRETER` | C2 | 中 Medium |
|
|
||||||
| `INJECTION_REFLECTIVE` | 注入 Injection | 高 High |
|
|
||||||
| `INJECTION_CRT` | 注入 Injection | 中 Medium |
|
|
||||||
| `INJECTION_VAE` | 注入 Injection | 中 Medium |
|
|
||||||
| `MALWARE_MIMIKATZ` | 恶意软件 Malware | 高 High |
|
|
||||||
| `CRYPTO_MINER` | 挖矿 Crypto | 高 High |
|
|
||||||
| `RANSOM_NOTE` | 恶意软件 Malware | 高 High |
|
|
||||||
| `PS_DOWNLOAD` | 恶意软件 Malware | 中 Medium |
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 架构 / Architecture
|
## One-Line Build / 一行编译
|
||||||
|
|
||||||
```
|
|
||||||
TitleBar ── 窗口控制（最小化/最大化/关闭，语言切换）
|
|
||||||
Window Chrome (Min/Max/Close, Language Toggle)
|
|
||||||
Sidebar ── 导航（仪表盘 / 进程 / 扫描 / 设置）
|
|
||||||
Navigation (Dashboard / Processes / Scan / Settings)
|
|
||||||
Content ── 4 个视图（WPF Grid Visibility 切换）
|
|
||||||
4 Views (WPF Grid Visibility switching)
|
|
||||||
|
|
||||||
Services:
|
|
||||||
ProcessCollector ── CreateToolhelp32Snapshot + WMI → ProcessInfo[]
|
|
||||||
MemoryScanner ── VirtualQueryEx + 签名遍历 → SignatureMatch[]
|
|
||||||
AIAnalyzer ── HTTP → OpenAI/Claude/Ollama API → ScanResult
|
|
||||||
CeMcpManager ── Process.Start → python server.py
|
|
||||||
```
|
|
||||||
|
|
||||||
数据流 / Data Flow：
|
|
||||||
```
|
|
||||||
[开始扫描 Start Scan] → ProcessCollector.CollectAll()
|
|
||||||
→ 每个 ProcessInfo:
|
|
||||||
→ MemoryScanner.ScanProcess() → 签名匹配
|
|
||||||
→ MemoryScanner.GetSuspiciousRegions() → RWX 私有区域
|
|
||||||
→ QuickPreScore() — score < 0.05 则跳过 API
|
|
||||||
→ AIAnalyzer.AnalyzeProcessAsync() → ScanResult
|
|
||||||
→ 结构化 Prompt API 调用
|
|
||||||
→ ParseResponse() → RiskLevel + Score + Indicators
|
|
||||||
→ 通过 IProgress<> 实时更新 DataGrid / 统计数据
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 快速开始 / Quick Start
|
|
||||||
|
|
||||||
### 环境要求 / Prerequisites
|
|
||||||
|
|
||||||
- Windows 10 / 11 (x64)
|
|
||||||
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)（用于编译 / for building）
|
|
||||||
- 管理员权限（用于内存扫描 / for memory scanning）
|
|
||||||
|
|
||||||
### 编译构建 / Build
|
|
||||||
|
|
||||||
```powershell
|
```powershell
|
||||||
# 克隆项目 Clone
|
dotnet publish src-csharp\MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
||||||
git clone https://github.com/Huang-158/MemScan-EDR.git
|
|
||||||
cd MemScan-EDR\src-csharp
|
|
||||||
|
|
||||||
# Debug 编译
|
|
||||||
dotnet build MemScanEDR.sln
|
|
||||||
|
|
||||||
# 发布单文件 EXE（Release）
|
|
||||||
dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
|
||||||
|
|
||||||
# 运行 Run
|
|
||||||
.\publish\MemScan-EDR.exe
|
|
||||||
```
|
|
||||||
|
|
||||||
或使用便捷脚本 / Or use the convenience script：
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
.\scripts\build_csharp.bat
|
|
||||||
```
|
|
||||||
|
|
||||||
### CE-MCP 配置（可选 / Optional）
|
|
||||||
|
|
||||||
CE-MCP 通过 Cheat Engine 提供更深层的内存扫描能力。启动时如果找到 `server.py` 会自动启动。
|
|
||||||
|
|
||||||
CE-MCP provides deeper memory scanning via Cheat Engine. The application auto-starts it at launch if `server.py` is found.
|
|
||||||
|
|
||||||
1. 将 [ce-mcp-server](https://github.com/Huang-158/ce-mcp-server) 放在项目同级目录 / Place ce-mcp-server next to the project
|
|
||||||
2. 或在设置界面配置 CE-MCP 服务器路径 / Or configure the path in Settings → CE-MCP Server Path
|
|
||||||
3. 设为 `disabled` 可跳过 CE-MCP / Set to `disabled` to run without CE-MCP
|
|
||||||
|
|
||||||
### AI 配置 / AI Configuration
|
|
||||||
|
|
||||||
在应用设置面板中 / Open Settings panel in the application：
|
|
||||||
|
|
||||||
1. 选择提供商 / Select provider：启发式 / OpenAI 兼容 / Claude / 本地
|
|
||||||
2. 填写 API 地址（每个提供商有预填默认值）/ Enter API Base URL (pre-filled defaults)
|
|
||||||
3. 填写 API Key（本地存储于 `data/settings.json`）/ Enter API Key (stored locally)
|
|
||||||
4. 填写模型名称（如 `gpt-4o-mini`, `claude-3-5-sonnet`, `llama3`）/ Enter Model name
|
|
||||||
5. 点击保存 / Click Save
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 项目结构 / Project Structure
|
|
||||||
|
|
||||||
```
|
|
||||||
MemScan-EDR/
|
|
||||||
├── src-csharp/
|
|
||||||
│ ├── MemScanEDR.sln
|
|
||||||
│ └── MemScanEDR/
|
|
||||||
│ ├── MemScanEDR.csproj # .NET 8 WPF 项目配置文件
|
|
||||||
│ ├── app.manifest # UAC asInvoker
|
|
||||||
│ ├── App.xaml / App.xaml.cs # 应用入口 + 崩溃日志 / Entry + crash logging
|
|
||||||
│ ├── MainWindow.xaml # WPF 界面（白色主题，4 视图） / UI (white theme, 4 views)
|
|
||||||
│ ├── MainWindow.xaml.cs # UI 逻辑 + 扫描编排 + 语言切换 / Logic + orchestrator + Lang helper
|
|
||||||
│ ├── Models/
|
|
||||||
│ │ ├── ProcessInfo.cs # 数据模型 / Data models
|
|
||||||
│ │ ├── AIConfig.cs # AI 提供商枚举 + 配置类 / Provider enum + config class
|
|
||||||
│ │ └── AppSettings.cs # JSON 持久化 / JSON persistence
|
|
||||||
│ └── Services/
|
|
||||||
│ ├── ProcessCollector.cs # P/Invoke 进程枚举 + WMI 命令行 / Process enumeration
|
|
||||||
│ ├── MemoryScanner.cs # VirtualQueryEx 扫描 + 12 条签名 / Memory scanning + signatures
|
|
||||||
│ ├── AIAnalyzer.cs # 多提供商 AI + 启发式降级 + 预过滤 / AI + heuristic + pre-filter
|
|
||||||
│ └── CeMcpManager.cs # CE-MCP 子进程生命周期管理 / Subprocess lifecycle
|
|
||||||
├── rules/
|
|
||||||
│ ├── shellcode.yar # YARA Shellcode 规则
|
|
||||||
│ ├── injection.yar # YARA 注入检测规则 / Injection rules
|
|
||||||
│ └── malware_strings.yar # YARA 恶意字符串规则 / Malware string rules
|
|
||||||
├── scripts/
|
|
||||||
│ └── build_csharp.bat # 编译 + 发布快捷脚本 / Build + publish shortcut
|
|
||||||
├── LICENSE
|
|
||||||
└── README.md
|
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## AI 分析机制 / How AI Analysis Works
|
## License / 许可证
|
||||||
|
|
||||||
AI 分析器通过精心设计的 Prompt 降低误报率：
|
MIT — see [LICENSE](LICENSE)
|
||||||
|
|
||||||
The AI analyzer uses a carefully designed prompt to reduce false positives：
|
|
||||||
|
|
||||||
1. **预过滤 Pre-filter**：没有任何可疑特征的进程（有签名、系统路径、无 RWX 内存、无签名匹配）直接标记为 `安全`，不调用 API，节省成本和耗时 / Processes with zero suspicious indicators are marked `Safe` without any API call.
|
|
||||||
|
|
||||||
2. **结构化 Prompt Structured Prompt**：每个进程生成格式化报告，包含 / Each process gets a formatted report including：
|
|
||||||
- 进程元数据（PID、名称、路径、父进程、命令行、签名者）/ Process metadata
|
|
||||||
- 网络连接（协议、远程地址、状态）/ Network connections
|
|
||||||
- 内存签名匹配（类别、严重性、描述）/ Memory signature matches
|
|
||||||
- 可疑内存区域（RWX 私有、非映像可执行页）/ Suspicious memory regions
|
|
||||||
|
|
||||||
3. **默认安全策略 Safe-by-Default Policy**：AI 被指示 >95% 的进程是良性的。需要 **多个并发指标** 才能提升风险等级——单一 RWX 区域或签名匹配并不足够 / The AI is instructed that >95% of processes are benign; requires multiple concurring indicators.
|
|
||||||
|
|
||||||
4. **启发式降级 Heuristic Fallback**：AI API 不可用时，加权启发式引擎接管，采用保守阈值（≥0.50 为可疑，≥0.75 为高危）/ Conservative thresholds take over (≥0.50 for suspicious, ≥0.75 for high).
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 声明 / Disclaimer
|
|
||||||
|
|
||||||
> **第三方 / 非关联声明 Third-Party / Non-Affiliation Statement**
|
|
||||||
>
|
|
||||||
> 本项目与 Cheat Engine、其原作者 Dark Byte 以及任何 AI 提供商（OpenAI、Anthropic 等）无任何关联。
|
|
||||||
> This project is not affiliated with Cheat Engine, Dark Byte, or any AI provider (OpenAI, Anthropic, etc.).
|
|
||||||
>
|
|
||||||
> **合法使用声明 Legal Use Statement**
|
|
||||||
>
|
|
||||||
> 本工具仅用于**合法的安全研究、教育及授权的安全评估**。未经授权对非自有或未被许可的系统使用属违法行为。使用者须遵守当地法律法规并自行承担所有风险。
|
|
||||||
> This tool is intended for **legitimate security research, education, and authorized security assessments only**. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 许可证 / License
|
|
||||||
|
|
||||||
MIT License — 详见 [LICENSE](LICENSE) / See [LICENSE](LICENSE) for full text.
|
|
||||||
|
|||||||
204
README_CN.md
Normal file
204
README_CN.md
Normal file
@ -0,0 +1,204 @@
|
|||||||
|
# MemScan-EDR
|
||||||
|
|
||||||
|
> **开源、轻量化、内存专项的 Windows 终端威胁检测与响应 (EDR) 工具**
|
||||||
|
|
||||||
|
[](LICENSE)
|
||||||
|
[](https://dotnet.microsoft.com/)
|
||||||
|
[](https://www.microsoft.com/windows)
|
||||||
|
[](https://github.com/dotnet/wpf)
|
||||||
|
|
||||||
|
MemScan-EDR 扫描所有运行中的进程，检查内存中的 Shellcode / 注入 / C2 特征，并利用 AI（OpenAI / Claude / 本地模型）实时分类威胁。基于 C# WPF 构建，通过 `dotnet publish` 打包为单个 `.exe`，无需目标机器安装 .NET 运行时。
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 待办事项
|
||||||
|
|
||||||
|
| 优先级 | 状态 | 任务 | 负责人 | 备注 |
|
||||||
|
|:---:|:---:|---|---|---|
|
||||||
|
| 🔴 高 | ⬜ 未开始 | YARA 规则文件加载与匹配引擎 | | `rules/*.yar` 文件解析 |
|
||||||
|
| 🔴 高 | ⬜ 未开始 | 网络连接 PID 关联（TCP 连接→进程） | | `GetConnectionPid()` 实现 |
|
||||||
|
| 🔴 高 | ⬜ 未开始 | 内存 Dump 与 PE 结构解析 | | 可疑进程内存导出 |
|
||||||
|
| 🟡 中 | ⬜ 未开始 | 审计日志持久化（JSON/SQLite） | | 扫描历史记录查询 |
|
||||||
|
| 🟡 中 | ⬜ 未开始 | PDF/HTML 报告导出 | | Dashboard → 一键导出 |
|
||||||
|
| 🟡 中 | ⬜ 未开始 | 定时扫描调度（每天/每小时） | | 后台定时任务 |
|
||||||
|
| 🟡 中 | ⬜ 未开始 | 进程自动终止（一键处置高危进程） | | `TerminateProcess` P/Invoke |
|
||||||
|
| 🟡 中 | ⬜ 未开始 | 隐藏进程检测（EPROCESS 链表遍历） | | CE-MCP 内核级 |
|
||||||
|
| 🟢 低 | ⬜ 未开始 | 系统托盘最小化 | | NotifyIcon + 后台运行 |
|
||||||
|
| 🟢 低 | ⬜ 未开始 | 自定义签名规则编辑器 | | GUI 内编辑 YARA/签名 |
|
||||||
|
| 🟢 低 | ⬜ 未开始 | 暗色主题切换 | | 白色/暗色双主题 |
|
||||||
|
| ✅ 完成 | ✅ 已完成 | 多 AI 提供商 + 预过滤 + 防误报 Prompt | | v1.2 |
|
||||||
|
| ✅ 完成 | ✅ 已完成 | CE-MCP 自动启动子进程管理 | | v1.1 |
|
||||||
|
| ✅ 完成 | ✅ 已完成 | 中英文界面一键切换 | | v1.1 |
|
||||||
|
| ✅ 完成 | ✅ 已完成 | 12 条内置内存签名检测 | | v1.0 |
|
||||||
|
| ✅ 完成 | ✅ 已完成 | WPF 白色主题现代化界面 | | v1.0 |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 功能特性
|
||||||
|
|
||||||
|
### 核心能力
|
||||||
|
|
||||||
|
| 能力 | 描述 |
|
||||||
|
|---|---|
|
||||||
|
| **进程全量采集** | PID、进程名、路径、父进程树、启动命令行、数字签名、线程数、内存用量 |
|
||||||
|
| **内存扫描** | `VirtualQueryEx` 遍历每个已提交内存区域；检测 RWX 私有内存、未映射可执行页 |
|
||||||
|
| **签名匹配** | 12 条内置检测规则：NOP sled、CALL/POP EIP、ROR13 hash、CobaltStrike Beacon、Meterpreter、ReflectiveLoader、Mimikatz 等 |
|
||||||
|
| **AI 威胁分类** | 多提供商支持（OpenAI 兼容 / Claude / Ollama / LM Studio）+ 启发式规则降级引擎 |
|
||||||
|
| **CE-MCP 集成** | 自动启动 Cheat Engine MCP 服务器，提供内核级内存操作能力 |
|
||||||
|
| **中英文界面切换** | 一键切换全部标签、按钮、告警文本 |
|
||||||
|
| **单文件 EXE** | `dotnet publish` 生成自包含 `MemScan-EDR.exe`，目标机器无需 .NET 运行时 |
|
||||||
|
|
||||||
|
### AI 提供商
|
||||||
|
|
||||||
|
| 提供商 | 描述 | Base URL 示例 |
|
||||||
|
|---|---|---|
|
||||||
|
| **OpenAI 兼容** | OpenAI / DeepSeek / 通义千问 / 智谱 等 | `https://api.openai.com/v1` |
|
||||||
|
| **Claude** | Anthropic Claude Messages API | `https://api.anthropic.com` |
|
||||||
|
| **本地模型** | Ollama / LM Studio / vLLM / llama.cpp | `http://127.0.0.1:11434` |
|
||||||
|
| **启发式规则** | 内置规则引擎，无需 API Key | N/A |
|
||||||
|
|
||||||
|
### 内置签名
|
||||||
|
|
||||||
|
| 签名 | 类别 | 严重性 |
|
||||||
|
|---|---|---|
|
||||||
|
| `SHELLCODE_NOP_SLED` | Shellcode | 中 |
|
||||||
|
| `SHELLCODE_GETEIP` | Shellcode | 中 |
|
||||||
|
| `SHELLCODE_ROR13` | Shellcode | 中 |
|
||||||
|
| `C2_COBALTSTRIKE` | C2 | 高 |
|
||||||
|
| `C2_METERPRETER` | C2 | 中 |
|
||||||
|
| `INJECTION_REFLECTIVE` | 注入 | 高 |
|
||||||
|
| `INJECTION_CRT` | 注入 | 中 |
|
||||||
|
| `INJECTION_VAE` | 注入 | 中 |
|
||||||
|
| `MALWARE_MIMIKATZ` | 恶意软件 | 高 |
|
||||||
|
| `CRYPTO_MINER` | 挖矿 | 高 |
|
||||||
|
| `RANSOM_NOTE` | 恶意软件 | 高 |
|
||||||
|
| `PS_DOWNLOAD` | 恶意软件 | 中 |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 架构
|
||||||
|
|
||||||
|
```
|
||||||
|
TitleBar ── 窗口控制（最小化/最大化/关闭，语言切换）
|
||||||
|
Sidebar ── 导航（仪表盘 / 进程 / 扫描 / 设置）
|
||||||
|
Content ── 4 个视图（WPF Grid Visibility 切换）
|
||||||
|
|
||||||
|
服务层:
|
||||||
|
ProcessCollector ── CreateToolhelp32Snapshot + WMI → ProcessInfo[]
|
||||||
|
MemoryScanner ── VirtualQueryEx + 签名遍历 → SignatureMatch[]
|
||||||
|
AIAnalyzer ── HTTP → OpenAI/Claude/Ollama → ScanResult
|
||||||
|
CeMcpManager ── Process.Start → python server.py
|
||||||
|
```
|
||||||
|
|
||||||
|
数据流：
|
||||||
|
```
|
||||||
|
[开始扫描] → ProcessCollector.CollectAll()
|
||||||
|
→ 每个进程:
|
||||||
|
→ MemoryScanner.ScanProcess() → 签名匹配
|
||||||
|
→ MemoryScanner.GetSuspiciousRegions() → RWX 私有区域
|
||||||
|
→ QuickPreScore() — score < 0.05 跳过 API
|
||||||
|
→ AIAnalyzer.AnalyzeProcessAsync() → ScanResult
|
||||||
|
→ IProgress<> 实时更新界面
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 快速开始
|
||||||
|
|
||||||
|
### 环境要求
|
||||||
|
|
||||||
|
- Windows 10 / 11 (x64)
|
||||||
|
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
|
||||||
|
- 管理员权限（用于内存扫描）
|
||||||
|
|
||||||
|
### 编译构建
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
git clone https://github.com/Huang-158/MemScan-EDR.git
|
||||||
|
cd MemScan-EDR\src-csharp
|
||||||
|
|
||||||
|
# Debug 编译
|
||||||
|
dotnet build MemScanEDR.sln
|
||||||
|
|
||||||
|
# 发布单文件 EXE
|
||||||
|
dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
||||||
|
|
||||||
|
# 运行
|
||||||
|
.\publish\MemScan-EDR.exe
|
||||||
|
```
|
||||||
|
|
||||||
|
或：
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
.\scripts\build_csharp.bat
|
||||||
|
```
|
||||||
|
|
||||||
|
### CE-MCP 配置（可选）
|
||||||
|
|
||||||
|
1. 将 [ce-mcp-server](https://github.com/Huang-158/ce-mcp-server) 放在项目同级目录
|
||||||
|
2. 或在设置界面 → CE-MCP 服务器路径 配置
|
||||||
|
3. 设为 `disabled` 可跳过 CE-MCP
|
||||||
|
|
||||||
|
### AI 配置
|
||||||
|
|
||||||
|
1. 选择提供商：启发式 / OpenAI 兼容 / Claude / 本地
|
||||||
|
2. 填写 API 地址
|
||||||
|
3. 填写 API Key（本地存储）
|
||||||
|
4. 填写模型名称
|
||||||
|
5. 点击保存
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## AI 分析机制
|
||||||
|
|
||||||
|
1. **预过滤**：无任何可疑特征的进程直接标记为`安全`，不调用 API
|
||||||
|
2. **结构化 Prompt**：每个进程生成含元数据、网络连接、内存签名、可疑区域的格式化报告
|
||||||
|
3. **默认安全策略**：AI 被指示 >95% 的进程是良性的；需要多个并发指标才提升风险等级
|
||||||
|
4. **启发式降级**：API 不可用时采用保守阈值（≥0.50 可疑，≥0.75 高危）
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 项目结构
|
||||||
|
|
||||||
|
```
|
||||||
|
MemScan-EDR/
|
||||||
|
├── src-csharp/
|
||||||
|
│ ├── MemScanEDR.sln
|
||||||
|
│ └── MemScanEDR/
|
||||||
|
│ ├── MemScanEDR.csproj
|
||||||
|
│ ├── App.xaml / App.xaml.cs
|
||||||
|
│ ├── MainWindow.xaml / MainWindow.xaml.cs
|
||||||
|
│ ├── Models/
|
||||||
|
│ │ ├── ProcessInfo.cs
|
||||||
|
│ │ ├── AIConfig.cs
|
||||||
|
│ │ └── AppSettings.cs
|
||||||
|
│ └── Services/
|
||||||
|
│ ├── ProcessCollector.cs
|
||||||
|
│ ├── MemoryScanner.cs
|
||||||
|
│ ├── AIAnalyzer.cs
|
||||||
|
│ └── CeMcpManager.cs
|
||||||
|
├── rules/
|
||||||
|
│ ├── shellcode.yar
|
||||||
|
│ ├── injection.yar
|
||||||
|
│ └── malware_strings.yar
|
||||||
|
├── scripts/
|
||||||
|
│ └── build_csharp.bat
|
||||||
|
├── LICENSE
|
||||||
|
├── README.md # 语言切换入口
|
||||||
|
├── README_CN.md # 中文文档（当前）
|
||||||
|
└── README_EN.md # English docs
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 声明
|
||||||
|
|
||||||
|
> 本项目与 Cheat Engine、其原作者 Dark Byte 以及任何 AI 提供商（OpenAI、Anthropic 等）无任何关联。
|
||||||
|
>
|
||||||
|
> 本工具仅用于**合法的安全研究、教育及授权的安全评估**。未经授权对非自有或未被许可的系统使用属违法行为。使用者须遵守当地法律法规并自行承担所有风险。
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 许可证
|
||||||
|
|
||||||
|
MIT License — 详见 [LICENSE](LICENSE)。
|
||||||
201
README_EN.md
Normal file
201
README_EN.md
Normal file
@ -0,0 +1,201 @@
|
|||||||
|
# MemScan-EDR
|
||||||
|
|
||||||
|
> **Open-Source, Lightweight, Memory-Focused Windows Endpoint Detection & Response (EDR) Tool**
|
||||||
|
|
||||||
|
[](LICENSE)
|
||||||
|
[](https://dotnet.microsoft.com/)
|
||||||
|
[](https://www.microsoft.com/windows)
|
||||||
|
[](https://github.com/dotnet/wpf)
|
||||||
|
|
||||||
|
MemScan-EDR scans all running processes, inspects memory for shellcode/injection/C2 patterns, and uses AI (OpenAI / Claude / local models) to classify threats in real time. Built with C# WPF for zero-dependency deployment as a single `.exe`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## TODO / Roadmap
|
||||||
|
|
||||||
|
| Priority | Status | Task | Assignee | Notes |
|
||||||
|
|:---:|:---:|---|---|---|
|
||||||
|
| 🔴 High | ⬜ Todo | YARA rule file loading & matching engine | | Parse `rules/*.yar` |
|
||||||
|
| 🔴 High | ⬜ Todo | TCP connection PID association | | `GetConnectionPid()` impl |
|
||||||
|
| 🔴 High | ⬜ Todo | Memory dump & PE structure analysis | | Export suspicious process memory |
|
||||||
|
| 🟡 Medium | ⬜ Todo | Audit log persistence (JSON/SQLite) | | Scan history query |
|
||||||
|
| 🟡 Medium | ⬜ Todo | PDF/HTML report export | | One-click from Dashboard |
|
||||||
|
| 🟡 Medium | ⬜ Todo | Scheduled scan (daily/hourly) | | Background timer |
|
||||||
|
| 🟡 Medium | ⬜ Todo | One-click terminate high-risk processes | | `TerminateProcess` P/Invoke |
|
||||||
|
| 🟡 Medium | ⬜ Todo | Hidden process detection (EPROCESS walk) | | Kernel-level via CE-MCP |
|
||||||
|
| 🟢 Low | ⬜ Todo | System tray minimize | | NotifyIcon + background |
|
||||||
|
| 🟢 Low | ⬜ Todo | Custom signature rule editor | | In-GUI YARA/sig editor |
|
||||||
|
| 🟢 Low | ⬜ Todo | Dark theme toggle | | White/Dark dual theme |
|
||||||
|
| ✅ Done | ✅ Done | Multi AI provider + pre-filter + anti-FP prompt | | v1.2 |
|
||||||
|
| ✅ Done | ✅ Done | CE-MCP auto-start subprocess management | | v1.1 |
|
||||||
|
| ✅ Done | ✅ Done | Chinese/English UI one-click toggle | | v1.1 |
|
||||||
|
| ✅ Done | ✅ Done | 12 built-in memory signature detections | | v1.0 |
|
||||||
|
| ✅ Done | ✅ Done | WPF white-theme modern UI | | v1.0 |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Features
|
||||||
|
|
||||||
|
### Core Capabilities
|
||||||
|
|
||||||
|
| Capability | Description |
|
||||||
|
|---|---|
|
||||||
|
| **Process Enumeration** | Full process list with PID, name, path, parent tree, command line, digital signature, thread count, memory usage |
|
||||||
|
| **Memory Scanning** | `VirtualQueryEx` traversal of every committed region; detects RWX private memory, unbacked executable pages |
|
||||||
|
| **Signature Matching** | 12 built-in detection rules: NOP sled, CALL/POP EIP, ROR13 hash, CobaltStrike Beacon, Meterpreter, ReflectiveLoader, Mimikatz, etc. |
|
||||||
|
| **AI Threat Classification** | Multi-provider support (OpenAI-compatible / Claude / Ollama / LM Studio) + heuristic fallback engine |
|
||||||
|
| **CE-MCP Integration** | Auto-launch Cheat Engine MCP server for kernel-level memory operations |
|
||||||
|
| **Chinese / English UI** | One-click language toggle; all labels, buttons, and alerts switch instantly |
|
||||||
|
| **Single-File EXE** | `dotnet publish` produces a self-contained `MemScan-EDR.exe` — no .NET runtime needed on target |
|
||||||
|
|
||||||
|
### AI Providers
|
||||||
|
|
||||||
|
| Provider | Description | Base URL Example |
|
||||||
|
|---|---|---|
|
||||||
|
| **OpenAI-Compatible** | OpenAI / DeepSeek / Qwen / Zhipu / any OpenAI-format API | `https://api.openai.com/v1` |
|
||||||
|
| **Claude** | Anthropic Claude via Messages API | `https://api.anthropic.com` |
|
||||||
|
| **Local** | Ollama / LM Studio / vLLM / llama.cpp server | `http://127.0.0.1:11434` |
|
||||||
|
| **Heuristic** | Built-in rule engine (no API key needed) | N/A |
|
||||||
|
|
||||||
|
### Built-in Signatures
|
||||||
|
|
||||||
|
| Signature | Category | Severity |
|
||||||
|
|---|---|---|
|
||||||
|
| `SHELLCODE_NOP_SLED` | Shellcode | Medium |
|
||||||
|
| `SHELLCODE_GETEIP` | Shellcode | Medium |
|
||||||
|
| `SHELLCODE_ROR13` | Shellcode | Medium |
|
||||||
|
| `C2_COBALTSTRIKE` | C2 | High |
|
||||||
|
| `C2_METERPRETER` | C2 | Medium |
|
||||||
|
| `INJECTION_REFLECTIVE` | Injection | High |
|
||||||
|
| `INJECTION_CRT` | Injection | Medium |
|
||||||
|
| `INJECTION_VAE` | Injection | Medium |
|
||||||
|
| `MALWARE_MIMIKATZ` | Malware | High |
|
||||||
|
| `CRYPTO_MINER` | Crypto | High |
|
||||||
|
| `RANSOM_NOTE` | Malware | High |
|
||||||
|
| `PS_DOWNLOAD` | Malware | Medium |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Architecture
|
||||||
|
|
||||||
|
```
|
||||||
|
TitleBar ── Window Chrome (Min/Max/Close, Language Toggle)
|
||||||
|
Sidebar ── Navigation (Dashboard / Processes / Scan / Settings)
|
||||||
|
Content ── 4 Views (WPF Grid Visibility switching)
|
||||||
|
|
||||||
|
Services:
|
||||||
|
ProcessCollector ── CreateToolhelp32Snapshot + WMI → ProcessInfo[]
|
||||||
|
MemoryScanner ── VirtualQueryEx + signature walk → SignatureMatch[]
|
||||||
|
AIAnalyzer ── HTTP → OpenAI/Claude/Ollama API → ScanResult
|
||||||
|
CeMcpManager ── Process.Start → python server.py
|
||||||
|
```
|
||||||
|
|
||||||
|
Data flow:
|
||||||
|
```
|
||||||
|
[Start Scan] → ProcessCollector.CollectAll()
|
||||||
|
→ for each ProcessInfo:
|
||||||
|
→ MemoryScanner.ScanProcess() → signature matches
|
||||||
|
→ MemoryScanner.GetSuspiciousRegions() → RWX private regions
|
||||||
|
→ QuickPreScore() — skip API if score < 0.05
|
||||||
|
→ AIAnalyzer.AnalyzeProcessAsync() → ScanResult
|
||||||
|
→ Update DataGrid / Stats in real-time via IProgress<>
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
- Windows 10 / 11 (x64)
|
||||||
|
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
|
||||||
|
- Administrator privileges (for memory scanning)
|
||||||
|
|
||||||
|
### Build
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
git clone https://github.com/Huang-158/MemScan-EDR.git
|
||||||
|
cd MemScan-EDR\src-csharp
|
||||||
|
|
||||||
|
dotnet build MemScanEDR.sln
|
||||||
|
|
||||||
|
dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
||||||
|
|
||||||
|
.\publish\MemScan-EDR.exe
|
||||||
|
```
|
||||||
|
|
||||||
|
Or:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
.\scripts\build_csharp.bat
|
||||||
|
```
|
||||||
|
|
||||||
|
### CE-MCP Setup (Optional)
|
||||||
|
|
||||||
|
1. Place [ce-mcp-server](https://github.com/Huang-158/ce-mcp-server) next to the project
|
||||||
|
2. Or configure the path in Settings → CE-MCP Server Path
|
||||||
|
3. Set to `disabled` to run without CE-MCP
|
||||||
|
|
||||||
|
### AI Configuration
|
||||||
|
|
||||||
|
1. Select provider: Heuristic / OpenAI-Compatible / Claude / Local
|
||||||
|
2. Enter API Base URL
|
||||||
|
3. Enter API Key (stored locally)
|
||||||
|
4. Enter Model name
|
||||||
|
5. Click Save
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## How AI Analysis Works
|
||||||
|
|
||||||
|
1. **Pre-filter**: Clean processes (signed, system path, no RWX, no sig matches) → `Safe`, skip API
|
||||||
|
2. **Structured Prompt**: Each process gets metadata, connections, signatures, suspicious regions
|
||||||
|
3. **Safe-by-Default**: AI told >95% are benign; needs multiple concurring indicators
|
||||||
|
4. **Heuristic Fallback**: Conservative thresholds (≥0.50 suspicious, ≥0.75 high) when API is down
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Project Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
MemScan-EDR/
|
||||||
|
├── src-csharp/
|
||||||
|
│ ├── MemScanEDR.sln
|
||||||
|
│ └── MemScanEDR/
|
||||||
|
│ ├── MemScanEDR.csproj
|
||||||
|
│ ├── App.xaml / App.xaml.cs
|
||||||
|
│ ├── MainWindow.xaml / MainWindow.xaml.cs
|
||||||
|
│ ├── Models/
|
||||||
|
│ │ ├── ProcessInfo.cs
|
||||||
|
│ │ ├── AIConfig.cs
|
||||||
|
│ │ └── AppSettings.cs
|
||||||
|
│ └── Services/
|
||||||
|
│ ├── ProcessCollector.cs
|
||||||
|
│ ├── MemoryScanner.cs
|
||||||
|
│ ├── AIAnalyzer.cs
|
||||||
|
│ └── CeMcpManager.cs
|
||||||
|
├── rules/
|
||||||
|
│ ├── shellcode.yar
|
||||||
|
│ ├── injection.yar
|
||||||
|
│ └── malware_strings.yar
|
||||||
|
├── scripts/
|
||||||
|
│ └── build_csharp.bat
|
||||||
|
├── LICENSE
|
||||||
|
├── README.md # Language switch entry
|
||||||
|
├── README_CN.md # 中文文档
|
||||||
|
└── README_EN.md # English docs (current)
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Disclaimer
|
||||||
|
|
||||||
|
> This project is not affiliated with Cheat Engine, Dark Byte, or any AI provider (OpenAI, Anthropic, etc.).
|
||||||
|
>
|
||||||
|
> This tool is intended for **legitimate security research, education, and authorized security assessments only**. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
MIT License — see [LICENSE](LICENSE).
|
||||||
Loading…
Reference in New Issue
Block a user