Huang-158 601773d487 v1.2: Clean release with rewritten README, Chinese/English UI, AI anti-false-positive, CE-MCP auto-start

2026-07-15 11:50:35 +08:00

8.4 KiB

Raw Blame History

MemScan-EDR

Open-Source, Lightweight, Memory-Focused Windows Endpoint Detection & Response (EDR) Tool

MemScan-EDR scans all running processes, inspects memory for shellcode/injection/C2 patterns, and uses AI (OpenAI / Claude / local models) to classify threats in real time. Built with C# WPF for zero-dependency deployment as a single .exe.

Screenshots

Dashboard	Scan Progress	Settings
Real-time risk dashboard with live process statistics	Real-time scan log with per-process results	Multi-provider AI configuration panel

Features

Core Capabilities

Capability	Description
Process Enumeration	Full process list with PID, name, path, parent tree, command line, digital signature, thread count, memory usage
Memory Scanning	`VirtualQueryEx` traversal of every committed region; detects RWX private memory, unbacked executable pages
Signature Matching	12 built-in detection rules: NOP sled, CALL/POP EIP, ROR13 hash, CobaltStrike Beacon, Meterpreter, ReflectiveLoader, Mimikatz, etc.
AI Threat Classification	Multi-provider support (OpenAI-compatible / Claude / Ollama / LM Studio) + heuristic fallback engine
CE-MCP Integration	Auto-launch Cheat Engine MCP server for kernel-level memory operations
Chinese / English UI	One-click language toggle; all labels, buttons, and alerts switch instantly
Single-File EXE	`dotnet publish` produces a self-contained `MemScan-EDR.exe` — no .NET runtime needed on target

AI Providers

Provider	Description	Base URL Example
OpenAI-Compatible	OpenAI / DeepSeek / Qwen / Zhipu / any OpenAI-format API	`https://api.openai.com/v1`
Claude	Anthropic Claude via Messages API	`https://api.anthropic.com`
Local	Ollama / LM Studio / vLLM / llama.cpp server	`http://127.0.0.1:11434`
Heuristic	Built-in rule engine (no API key needed)	N/A

Built-in Signatures

Signature	Category	Severity
`SHELLCODE_NOP_SLED`	Shellcode	Medium
`SHELLCODE_GETEIP`	Shellcode	Medium
`SHELLCODE_ROR13`	Shellcode	Medium
`C2_COBALTSTRIKE`	C2	High
`C2_METERPRETER`	C2	Medium
`INJECTION_REFLECTIVE`	Injection	High
`INJECTION_CRT`	Injection	Medium
`INJECTION_VAE`	Injection	Medium
`MALWARE_MIMIKATZ`	Malware	High
`CRYPTO_MINER`	Crypto	High
`RANSOM_NOTE`	Malware	High
`PS_DOWNLOAD`	Malware	Medium

Architecture

TitleBar ── Window Chrome (Min/Max/Close, Language Toggle)
Sidebar ── Navigation (Dashboard / Processes / Scan / Settings)
Content ── 4 Views (WPF Grid Visibility switching)

Services:
  ProcessCollector ── CreateToolhelp32Snapshot + WMI → ProcessInfo[]
  MemoryScanner    ── VirtualQueryEx + signature walk  → SignatureMatch[]
  AIAnalyzer       ── HTTP → OpenAI/Claude/Ollama API  → ScanResult
  CeMcpManager     ── Process.Start → python server.py

Data flows:

[Start Scan] → ProcessCollector.CollectAll()
    → for each ProcessInfo:
        → MemoryScanner.ScanProcess() → signature matches
        → MemoryScanner.GetSuspiciousRegions() → RWX private regions
        → QuickPreScore() — skip API if score < 0.05
        → AIAnalyzer.AnalyzeProcessAsync() → ScanResult
            → API call with structured prompt
            → ParseResponse() → RiskLevel + Score + Indicators
    → Update DataGrid / Stats in real-time via IProgress<>

Quick Start

Prerequisites

Windows 10 / 11 (x64)
.NET 8 SDK (for building)
Administrator privileges (for memory scanning)

Build

# Clone
git clone https://github.com/Huang-158/MemScan-EDR.git
cd MemScan-EDR\src-csharp

# Build (Debug)
dotnet build MemScanEDR.sln

# Publish single-file EXE (Release)
dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish

# Run
.\publish\MemScan-EDR.exe

Or use the convenience script:

.\scripts\build_csharp.bat

CE-MCP Setup (Optional)

CE-MCP provides deeper memory scanning via Cheat Engine. The application auto-starts it at launch if server.py is found.

Place ce-mcp-server next to the project
Or configure the path in Settings → CE-MCP Server Path
Set to disabled to run without CE-MCP

AI Configuration

Open Settings panel in the application:

Select provider: Heuristic / OpenAI-Compatible / Claude / Local
Enter API Base URL (pre-filled defaults for each provider)
Enter API Key (stored locally in data/settings.json)
Enter Model name (e.g. gpt-4o-mini, claude-3-5-sonnet, llama3)
Click Save

Project Structure

MemScan-EDR/
├── src-csharp/
│   ├── MemScanEDR.sln
│   └── MemScanEDR/
│       ├── MemScanEDR.csproj          # .NET 8 WPF project
│       ├── app.manifest               # UAC asInvoker
│       ├── App.xaml / App.xaml.cs     # Application entry + crash logging
│       ├── MainWindow.xaml            # WPF UI (white theme, 4 views)
│       ├── MainWindow.xaml.cs         # UI logic + scan orchestrator + Lang helper
│       ├── Models/
│       │   ├── ProcessInfo.cs         # Data models (ProcessInfo, ScanResult, Signature, etc.)
│       │   ├── AIConfig.cs            # AI provider enum + config class
│       │   └── AppSettings.cs         # JSON persistence (settings.json)
│       └── Services/
│           ├── ProcessCollector.cs    # P/Invoke process enumeration + WMI command lines
│           ├── MemoryScanner.cs       # VirtualQueryEx scanning + 12 built-in signatures
│           ├── AIAnalyzer.cs          # Multi-provider AI + heuristic fallback + pre-filter
│           └── CeMcpManager.cs        # CE-MCP subprocess lifecycle
├── rules/
│   ├── shellcode.yar                  # YARA shellcode rules
│   ├── injection.yar                  # YARA injection rules
│   └── malware_strings.yar            # YARA malware string rules
├── scripts/
│   └── build_csharp.bat               # Build + publish shortcut
├── LICENSE
└── README.md

How AI Analysis Works

The AI analyzer uses a carefully designed prompt to reduce false positives:

Pre-filter: Processes with zero suspicious indicators (signed, system path, no RWX memory, no signature matches) are marked Safe without any API call — saving cost and time.
Structured Prompt: Each process gets a formatted report including:
- Process metadata (PID, name, path, parent, command line, signer)
- Network connections (protocol, remote address, state)
- Memory signature matches (category, severity, description)
- Suspicious memory regions (RWX private, unbacked executable)
Safe-by-Default Policy: The AI is instructed that >95% of processes are benign. It requires multiple concurring indicators to elevate risk level — a single RWX region or signature match alone is not enough.
Heuristic Fallback: If the AI API is unavailable, a weighted heuristic engine takes over with conservative thresholds (≥0.50 for suspicious, ≥0.75 for high).

Disclaimer

Third-Party / Non-Affiliation Statement

This project is not affiliated with Cheat Engine, its original author Dark Byte, or any AI provider (OpenAI, Anthropic, etc.).

Legal Use Statement

This tool is intended for legitimate security research, education, and authorized security assessments only. Unauthorized use against systems you do not own or have permission to test is illegal. Users are responsible for complying with all applicable laws.

License

MIT License — see LICENSE for full text.

8.4 KiB Raw Blame History