202 lines
8.4 KiB
Markdown
202 lines
8.4 KiB
Markdown
# MemScan-EDR
|
|
|
|
> **Open-Source, Lightweight, Memory-Focused Windows Endpoint Detection & Response (EDR) Tool**
|
|
|
|
[](LICENSE)
|
|
[](https://dotnet.microsoft.com/)
|
|
[](https://www.microsoft.com/windows)
|
|
[](https://github.com/dotnet/wpf)
|
|
|
|
MemScan-EDR scans all running processes, inspects memory for shellcode/injection/C2 patterns, and uses AI (OpenAI / Claude / local models) to classify threats in real time. Built with C# WPF for zero-dependency deployment as a single `.exe`.
|
|
|
|
---
|
|
## Screenshots
|
|
|
|
| Dashboard | Scan Progress | Settings |
|
|
|-----------|--------------|----------|
|
|
| Real-time risk dashboard with live process statistics | Real-time scan log with per-process results | Multi-provider AI configuration panel |
|
|
|
|
---
|
|
## Features
|
|
|
|
### Core Capabilities
|
|
|
|
| Capability | Description |
|
|
|------------|-------------|
|
|
| **Process Enumeration** | Full process list with PID, name, path, parent tree, command line, digital signature, thread count, memory usage |
|
|
| **Memory Scanning** | `VirtualQueryEx` traversal of every committed region; detects RWX private memory, unbacked executable pages |
|
|
| **Signature Matching** | 12 built-in detection rules: NOP sled, CALL/POP EIP, ROR13 hash, CobaltStrike Beacon, Meterpreter, ReflectiveLoader, Mimikatz, etc. |
|
|
| **AI Threat Classification** | Multi-provider support (OpenAI-compatible / Claude / Ollama / LM Studio) + heuristic fallback engine |
|
|
| **CE-MCP Integration** | Auto-launch Cheat Engine MCP server for kernel-level memory operations |
|
|
| **Chinese / English UI** | One-click language toggle; all labels, buttons, and alerts switch instantly |
|
|
| **Single-File EXE** | `dotnet publish` produces a self-contained `MemScan-EDR.exe` — no .NET runtime needed on target |
|
|
|
|
### AI Providers
|
|
|
|
| Provider | Description | Base URL Example |
|
|
|----------|-------------|-----------------|
|
|
| **OpenAI-Compatible** | OpenAI / DeepSeek / Qwen / Zhipu / any OpenAI-format API | `https://api.openai.com/v1` |
|
|
| **Claude** | Anthropic Claude via Messages API | `https://api.anthropic.com` |
|
|
| **Local** | Ollama / LM Studio / vLLM / llama.cpp server | `http://127.0.0.1:11434` |
|
|
| **Heuristic** | Built-in rule engine (no API key needed) | N/A |
|
|
|
|
### Built-in Signatures
|
|
|
|
| Signature | Category | Severity |
|
|
|-----------|----------|----------|
|
|
| `SHELLCODE_NOP_SLED` | Shellcode | Medium |
|
|
| `SHELLCODE_GETEIP` | Shellcode | Medium |
|
|
| `SHELLCODE_ROR13` | Shellcode | Medium |
|
|
| `C2_COBALTSTRIKE` | C2 | High |
|
|
| `C2_METERPRETER` | C2 | Medium |
|
|
| `INJECTION_REFLECTIVE` | Injection | High |
|
|
| `INJECTION_CRT` | Injection | Medium |
|
|
| `INJECTION_VAE` | Injection | Medium |
|
|
| `MALWARE_MIMIKATZ` | Malware | High |
|
|
| `CRYPTO_MINER` | Crypto | High |
|
|
| `RANSOM_NOTE` | Malware | High |
|
|
| `PS_DOWNLOAD` | Malware | Medium |
|
|
|
|
---
|
|
## Architecture
|
|
|
|
```
|
|
TitleBar ── Window Chrome (Min/Max/Close, Language Toggle)
|
|
Sidebar ── Navigation (Dashboard / Processes / Scan / Settings)
|
|
Content ── 4 Views (WPF Grid Visibility switching)
|
|
|
|
Services:
|
|
ProcessCollector ── CreateToolhelp32Snapshot + WMI → ProcessInfo[]
|
|
MemoryScanner ── VirtualQueryEx + signature walk → SignatureMatch[]
|
|
AIAnalyzer ── HTTP → OpenAI/Claude/Ollama API → ScanResult
|
|
CeMcpManager ── Process.Start → python server.py
|
|
```
|
|
|
|
Data flows:
|
|
```
|
|
[Start Scan] → ProcessCollector.CollectAll()
|
|
→ for each ProcessInfo:
|
|
→ MemoryScanner.ScanProcess() → signature matches
|
|
→ MemoryScanner.GetSuspiciousRegions() → RWX private regions
|
|
→ QuickPreScore() — skip API if score < 0.05
|
|
→ AIAnalyzer.AnalyzeProcessAsync() → ScanResult
|
|
→ API call with structured prompt
|
|
→ ParseResponse() → RiskLevel + Score + Indicators
|
|
→ Update DataGrid / Stats in real-time via IProgress<>
|
|
```
|
|
|
|
---
|
|
## Quick Start
|
|
|
|
### Prerequisites
|
|
|
|
- Windows 10 / 11 (x64)
|
|
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0) (for building)
|
|
- Administrator privileges (for memory scanning)
|
|
|
|
### Build
|
|
|
|
```powershell
|
|
# Clone
|
|
git clone https://github.com/Huang-158/MemScan-EDR.git
|
|
cd MemScan-EDR\src-csharp
|
|
|
|
# Build (Debug)
|
|
dotnet build MemScanEDR.sln
|
|
|
|
# Publish single-file EXE (Release)
|
|
dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
|
|
|
# Run
|
|
.\publish\MemScan-EDR.exe
|
|
```
|
|
|
|
Or use the convenience script:
|
|
|
|
```powershell
|
|
.\scripts\build_csharp.bat
|
|
```
|
|
|
|
### CE-MCP Setup (Optional)
|
|
|
|
CE-MCP provides deeper memory scanning via Cheat Engine. The application auto-starts it at launch if `server.py` is found.
|
|
|
|
1. Place [ce-mcp-server](https://github.com/Huang-158/ce-mcp-server) next to the project
|
|
2. Or configure the path in Settings → CE-MCP Server Path
|
|
3. Set to `disabled` to run without CE-MCP
|
|
|
|
### AI Configuration
|
|
|
|
Open Settings panel in the application:
|
|
|
|
1. Select provider: Heuristic / OpenAI-Compatible / Claude / Local
|
|
2. Enter API Base URL (pre-filled defaults for each provider)
|
|
3. Enter API Key (stored locally in `data/settings.json`)
|
|
4. Enter Model name (e.g. `gpt-4o-mini`, `claude-3-5-sonnet`, `llama3`)
|
|
5. Click Save
|
|
|
|
---
|
|
## Project Structure
|
|
|
|
```
|
|
MemScan-EDR/
|
|
├── src-csharp/
|
|
│ ├── MemScanEDR.sln
|
|
│ └── MemScanEDR/
|
|
│ ├── MemScanEDR.csproj # .NET 8 WPF project
|
|
│ ├── app.manifest # UAC asInvoker
|
|
│ ├── App.xaml / App.xaml.cs # Application entry + crash logging
|
|
│ ├── MainWindow.xaml # WPF UI (white theme, 4 views)
|
|
│ ├── MainWindow.xaml.cs # UI logic + scan orchestrator + Lang helper
|
|
│ ├── Models/
|
|
│ │ ├── ProcessInfo.cs # Data models (ProcessInfo, ScanResult, Signature, etc.)
|
|
│ │ ├── AIConfig.cs # AI provider enum + config class
|
|
│ │ └── AppSettings.cs # JSON persistence (settings.json)
|
|
│ └── Services/
|
|
│ ├── ProcessCollector.cs # P/Invoke process enumeration + WMI command lines
|
|
│ ├── MemoryScanner.cs # VirtualQueryEx scanning + 12 built-in signatures
|
|
│ ├── AIAnalyzer.cs # Multi-provider AI + heuristic fallback + pre-filter
|
|
│ └── CeMcpManager.cs # CE-MCP subprocess lifecycle
|
|
├── rules/
|
|
│ ├── shellcode.yar # YARA shellcode rules
|
|
│ ├── injection.yar # YARA injection rules
|
|
│ └── malware_strings.yar # YARA malware string rules
|
|
├── scripts/
|
|
│ └── build_csharp.bat # Build + publish shortcut
|
|
├── LICENSE
|
|
└── README.md
|
|
```
|
|
|
|
---
|
|
## How AI Analysis Works
|
|
|
|
The AI analyzer uses a carefully designed prompt to reduce false positives:
|
|
|
|
1. **Pre-filter**: Processes with zero suspicious indicators (signed, system path, no RWX memory, no signature matches) are marked `Safe` without any API call — saving cost and time.
|
|
|
|
2. **Structured Prompt**: Each process gets a formatted report including:
|
|
- Process metadata (PID, name, path, parent, command line, signer)
|
|
- Network connections (protocol, remote address, state)
|
|
- Memory signature matches (category, severity, description)
|
|
- Suspicious memory regions (RWX private, unbacked executable)
|
|
|
|
3. **Safe-by-Default Policy**: The AI is instructed that >95% of processes are benign. It requires **multiple concurring indicators** to elevate risk level — a single RWX region or signature match alone is not enough.
|
|
|
|
4. **Heuristic Fallback**: If the AI API is unavailable, a weighted heuristic engine takes over with conservative thresholds (≥0.50 for suspicious, ≥0.75 for high).
|
|
|
|
---
|
|
## Disclaimer
|
|
|
|
> **Third-Party / Non-Affiliation Statement**
|
|
>
|
|
> This project is not affiliated with Cheat Engine, its original author Dark Byte, or any AI provider (OpenAI, Anthropic, etc.).
|
|
>
|
|
> **Legal Use Statement**
|
|
>
|
|
> This tool is intended for **legitimate security research, education, and authorized security assessments only**. Unauthorized use against systems you do not own or have permission to test is illegal. Users are responsible for complying with all applicable laws.
|
|
|
|
---
|
|
## License
|
|
|
|
MIT License — see [LICENSE](LICENSE) for full text.
|