Huang-158 9c1b655feb Add Gitea mirror clone URL to README

2026-07-16 10:48:47 +08:00

6.9 KiB

Raw Blame History

MemScan-EDR

Open-Source, Lightweight, Memory-Focused Windows Endpoint Detection & Response (EDR) Tool

MemScan-EDR scans all running processes, inspects memory for shellcode/injection/C2 patterns, and uses AI (OpenAI / Claude / local models) to classify threats in real time. Built with C# WPF for zero-dependency deployment as a single .exe.

Features

Core Capabilities

Capability	Description
Process Enumeration	Full process list with PID, name, path, parent tree, command line, digital signature, thread count, memory usage
Memory Scanning	`VirtualQueryEx` traversal of every committed region; detects RWX private memory, unbacked executable pages
Signature Matching	12 built-in detection rules: NOP sled, CALL/POP EIP, ROR13 hash, CobaltStrike Beacon, Meterpreter, ReflectiveLoader, Mimikatz, etc.
AI Threat Classification	Multi-provider support (OpenAI-compatible / Claude / Ollama / LM Studio) + heuristic fallback engine
CE-MCP Integration	Auto-launch Cheat Engine MCP server for kernel-level memory operations
Chinese / English UI	One-click language toggle; all labels, buttons, and alerts switch instantly
Single-File EXE	`dotnet publish` produces a self-contained `MemScan-EDR.exe` — no .NET runtime needed on target

AI Providers

Provider	Description	Base URL Example
OpenAI-Compatible	OpenAI / DeepSeek / Qwen / Zhipu / any OpenAI-format API	`https://api.openai.com/v1`
Claude	Anthropic Claude via Messages API	`https://api.anthropic.com`
Local	Ollama / LM Studio / vLLM / llama.cpp server	`http://127.0.0.1:11434`
Heuristic	Built-in rule engine (no API key needed)	N/A

Built-in Signatures

Signature	Category	Severity
`SHELLCODE_NOP_SLED`	Shellcode	Medium
`SHELLCODE_GETEIP`	Shellcode	Medium
`SHELLCODE_ROR13`	Shellcode	Medium
`C2_COBALTSTRIKE`	C2	High
`C2_METERPRETER`	C2	Medium
`INJECTION_REFLECTIVE`	Injection	High
`INJECTION_CRT`	Injection	Medium
`INJECTION_VAE`	Injection	Medium
`MALWARE_MIMIKATZ`	Malware	High
`CRYPTO_MINER`	Crypto	High
`RANSOM_NOTE`	Malware	High
`PS_DOWNLOAD`	Malware	Medium

Architecture

TitleBar ── Window Chrome (Min/Max/Close, Language Toggle)
Sidebar ── Navigation (Dashboard / Processes / Scan / Settings)
Content ── 4 Views (WPF Grid Visibility switching)

Services:
  ProcessCollector ── CreateToolhelp32Snapshot + WMI → ProcessInfo[]
  MemoryScanner    ── VirtualQueryEx + signature walk  → SignatureMatch[]
  AIAnalyzer       ── HTTP → OpenAI/Claude/Ollama API  → ScanResult
  CeMcpManager     ── Process.Start → python server.py

Data flow:

[Start Scan] → ProcessCollector.CollectAll()
    → for each ProcessInfo:
        → MemoryScanner.ScanProcess() → signature matches
        → MemoryScanner.GetSuspiciousRegions() → RWX private regions
        → QuickPreScore() — skip API if score < 0.05
        → AIAnalyzer.AnalyzeProcessAsync() → ScanResult
    → Update DataGrid / Stats in real-time via IProgress<>

Quick Start

Prerequisites

Windows 10 / 11 (x64)
.NET 8 SDK
Administrator privileges (for memory scanning)

Build

git clone https://github.com/Huang-158/MemScan-EDR.git
# Or clone from Gitea mirror
# git clone http://39.96.40.167/Huang-158/MemScan-EDR.git
cd MemScan-EDR\src-csharp

dotnet build MemScanEDR.sln

dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish

.\publish\MemScan-EDR.exe

Or:

.\scripts\build_csharp.bat

CE-MCP Setup (Optional)

Place ce-mcp-server next to the project
Or configure the path in Settings → CE-MCP Server Path
Set to disabled to run without CE-MCP

AI Configuration

Select provider: Heuristic / OpenAI-Compatible / Claude / Local
Enter API Base URL
Enter API Key (stored locally)
Enter Model name
Click Save

How AI Analysis Works

Pre-filter: Clean processes (signed, system path, no RWX, no sig matches) → Safe, skip API
Structured Prompt: Each process gets metadata, connections, signatures, suspicious regions
Safe-by-Default: AI told >95% are benign; needs multiple concurring indicators
Heuristic Fallback: Conservative thresholds (≥0.50 suspicious, ≥0.75 high) when API is down

Project Structure

MemScan-EDR/
├── src-csharp/
│   ├── MemScanEDR.sln
│   └── MemScanEDR/
│       ├── MemScanEDR.csproj
│       ├── App.xaml / App.xaml.cs
│       ├── MainWindow.xaml / MainWindow.xaml.cs
│       ├── Models/
│       │   ├── ProcessInfo.cs
│       │   ├── AIConfig.cs
│       │   └── AppSettings.cs
│       └── Services/
│           ├── ProcessCollector.cs
│           ├── MemoryScanner.cs
│           ├── AIAnalyzer.cs
│           └── CeMcpManager.cs
├── rules/
│   ├── shellcode.yar
│   ├── injection.yar
│   └── malware_strings.yar
├── scripts/
│   └── build_csharp.bat
├── LICENSE
├── README.md       # 中文文档（默认）
└── README_EN.md    # English docs (current)

TODO

1. YARA rule file loading & matching engine
2. TCP connection PID association
3. Memory dump & PE structure analysis
4. Audit log persistence
5. Report export (PDF / HTML)
6. Scheduled scan
7. One-click terminate high-risk processes
8. Hidden process detection (EPROCESS walk)
9. Multi AI provider + anti-false-positive (v1.2)
10. CE-MCP auto-start (v1.1)
11. Chinese/English UI toggle (v1.1)
12. 12 built-in memory signatures (v1.0)
13. WPF white-theme UI (v1.0)

Disclaimer

This project is not affiliated with Cheat Engine, Dark Byte, or any AI provider (OpenAI, Anthropic, etc.).

This tool is intended for legitimate security research, education, and authorized security assessments only. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.

License

MIT License — see LICENSE.

6.9 KiB Raw Blame History