DEV Community: çınar

Building a ~95 KB 25-in-1 Windows Memory Forensics, Module Stomping & EDR Suite in C# / Native Win32

çınar — Sun, 27 Sep 2026 21:52:13 +0000

Traditional consumer antivirus suites predominantly scan static files on disk or lose visibility after single-byte AMSI/ETW patches (0xC3 RET) and stealth Windows Defender folder exclusions.

Over the past months, I engineered ProxSuite PRO (Apex Edition v2.5 Enterprise) — a standalone, zero-dependency (~95 KB) native x64 Windows live memory forensics, anti-stealer, and second-opinion EDR command center uniting 25 proprietary engines (verified 100% clean with 0 false positives by Windows Defender).

🧬 Key Detection & Defense Engines (25-in-1 Architecture)

EvasionHunter (Module Stomping, Process Ghosting & Call-Stack Spoofing): Reads the in-memory .text section of loaded DLLs (amsi.dll, wldp.dll) and compares them byte-for-byte against clean System32 disk images. Queries NtQueryInformationThread (Win32StartAddress) to detect threads executing outside backed modules, and flags Process Ghosting / Herpaderping.
MemGuard PRO v2.0 & HollowHunter: Audits live ntdll.dll syscall prologues (4C 8B D1 B8) and scans MEM_PRIVATE RWX/WC memory regions for unbacked MZ/PE headers and shellcode stubs.
LSASS Deep Shield: Inspects HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages against SSP injection (mimilib), and detects PssCaptureSnapshot (dbgcore.dll / dbghelp.dll) & comsvcs.dll credential dumpers.
NamedPipe C2 & Live RAM IOC Scanner: Hunts Cobalt Strike (MSSE-*, postex_*), Sliver, Havoc, Brute Ratel, and Mythic named pipes + scans LOLBIN RAM for Discord webhooks, Telegram bot tokens, and Ngrok tunnels.
GhostTrace (Kernel BAM & Prefetch Forensics): Correlates Kernel Background Activity Moderator (BAM) and C:\Windows\Prefetch\*.pf to expose self-deleting droppers that executed and erased themselves from disk.
Real-Time CryptoClipGuard & Ransomware Honeypot: 600ms clipboard vault that automatically reverts hijacked BTC, ETH, SOL, and USDT wallet addresses back to your original address, paired with monitored canary files and NtSuspendProcess containment.
Kernel DACL Self-Defense, Hot-Reloadable JSON Rules & SIEM Streaming: Hardens its own process Kernel DACL (SetKernelObjectSecurity denying PROCESS_TERMINATE / PROCESS_VM_WRITE), locks its binary on disk (FILE_SHARE_READ), hot-reloads custom IOCs from prox_rules.json without recompiling, and streams alerts to Windows EventLog (ID 2050) + HTTP Webhooks (Splunk/Elastic/Discord/Slack).

⚔️ ProxSuite PRO v2.5 vs. Traditional Antivirus & EDR Suites

Capability / Attack Vector	⚡ ProxSuite PRO v2.5	🛡️ Windows Defender	🦠 Malwarebytes	🧰 Sysinternals
Module Stomping (`.text`) & Process Ghosting	✓ RAM vs Disk `.text` Diff & Stack Audit	✗ Trusts `MEM_IMAGE`	✗ Blind to Stomping	✗ None
NTDLL Syscall Unhooking (`4C 8B D1 B8`)	✓ Live Syscall Stub Verification	✗ User-mode blind	✗ Not inspected	✗ Manual WinDbg
LSASS SSP Injection & `PssCaptureSnapshot`	✓ LSA Registry + `dbgcore` Hunter	⚠️ Bypassed if PPL off	✗ No SSP audit	✗ Manual only
Cobalt Strike / Sliver / Havoc Named Pipe C2	✓ `\\.\pipe\` + Dynamic JSON Rules	⚠️ Basic static only	✗ TCP/IP focus only	⚠️ Raw pipe list
Self-Deleting Droppers (Kernel BAM & `.PF`)	✓ Automated Post-Mortem Timeline	✗ Misses deleted files	✗ Disk files only	✗ No BAM tool
Kernel DACL Self-Defense & SIEM Webhook	✓ Anti-Terminate DACL + CEF Stream	⚠️ Exclusion bypass	⚠️ Service stoppable	✗ Easily killed
RAM Footprint & Binary Size	~95 KB EXE / Zero Dependencies	~350 MB RAM	~450 MB RAM	~45 MB (20 tools)

🌐 Live Interactive Browser Simulator & Direct Download

You can test the telemetry simulator directly in your browser or download the standalone x64 executable:

🌐 Interactive Web Portal & Simulator: https://prox0959.github.io/ProxSuite-PRO/
⚡ Direct Standalone .EXE Download: https://prox0959.github.io/ProxSuite-PRO/ProxSuitePRO.exe
💻 GitHub Repository: https://github.com/prox0959/ProxSuite-PRO

🪙 Licensing & Full Commercial Source Code (Crypto Only)

All paid tiers are accepted exclusively via Cryptocurrency (USDT, BTC, ETH, SOL, LTC, XMR) with zero middleman fees:

24-Hour Free Evaluation Trial: $0.00 (Generate a free trial ticket via the portal!)
30-Day PRO License: $9.99
Permanent One-Time v2.x License: $24.99
💎 Full Commercial Source Code & White-Label Rights: $499.00 (Includes the complete 3,100+ line unobfuscated C# / Win32 / NT Syscall source code for all 25 engines, Defender-clean dynamic API architecture, SIEM/Dynamic JSON Rule modules, Standalone Offline AES-256 HWID Keygen, and full commercial rebrand rights.)

👉 Generate Instant Order / Free Trial Ticket Here or reach out on X: @prox_0959

Building 9 Zero-Dependency Cybersecurity & DFIR Tools in Pure Python and Win32 API

çınar — Fri, 25 Sep 2026 17:25:20 +0000

Hey DEV community! 👋

I'm Çınar, a high school student from Turkey studying low-level systems architecture, Windows internals, and Digital Forensics & Incident Response (DFIR).

When an incident responder plugs a triage USB into a compromised enterprise workstation or an isolated host, they cannot run pip install psutil scapy cryptography. Furthermore, bundling third-party C-extension wheels across different Windows builds often breaks due to missing Visual C++ Redistributable DLLs.

Over the past few months, I challenged myself to build 9 open-source security tools under one strict engineering rule: Zero External PyPI Dependencies. Everything runs strictly on the Python Standard Library (ctypes, struct, winreg, socket, sqlite3, math) and direct Win32 / NT Kernel API calls.

Here is the technical breakdown of the suite and how each tool works under the hood!

🔍 1. Sub-Second Live Forensics & DFIR

⚡ OmniTriage — Live Incident Response Engine

prox0959 / OmniTriage

Zero-dependency, sub-second Windows live digital forensics & incident response (DFIR) triage engine for USB responders.

In live response, collection order is critical. Calling disk-heavy browsers or registry parsers before capturing active network sockets destroys volatile evidence. OmniTriage enforces the RFC 3227 Order of Volatility:

Tier 1 (Volatile Memory & Network): Active TCP/UDP sockets, DNS cache, and running processes.
Tier 2 (System & Persistence): Registry Run keys, ShimCache, and ROT13-decoded UserAssist records.
Tier 3 (Disk & Application Artifacts): Locked Chromium SQLite history, PowerShell ConsoleHost_history.txt, and temp staging executables.

Instead of spawning noisy wmic.exe or tasklist.exe child processes, OmniTriage calls kernel32.dll directly via ctypes (CreateToolhelp32Snapshot), completing full host triage in 0.88 seconds from a 10MB Portable Python USB folder while generating a SHA-256 evidence manifest.

import ctypes
from ctypes import wintypes

TH32CS_SNAPPROCESS = 0x00000002

# Captures full process tree in <15ms with zero subprocess creation
h_snap = ctypes.windll.kernel32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)

🕵️‍♂️ ShadowTrace — Program Execution Forensics

prox0959 / ShadowTrace

Even if an attacker deletes an executable after running it, Windows retains execution telemetry in the registry. ShadowTrace decodes ROT13-obfuscated UserAssist keys (CEBFF5CD...) and unpacks binary registry structures to recover execution counts, focus duration (ms), and 64-bit FILETIME timestamps.

🔌 GhostUSB — Removable Storage Hardware Forensics

prox0959 / GhostUSB

Parses USBSTOR and USB registry hives to extract hardware Vendor IDs, Product IDs, firmware revisions, and serial numbers, reconstructing a chronological USB connection timeline for physical exfiltration investigations.

🛡️ 2. Windows Internals & Kernel Memory Defense

🛡️ MemGuard — LSASS Memory Shield & Handle Auditor

prox0959 / MemGuard

Credential dumpers like Mimikatz and ProcDump require a handle to lsass.exe with PROCESS_VM_READ (0x0010) permissions (MITRE T1003.001).

Queries the NT Kernel Handle Table directly from usermode via ntdll.NtQuerySystemInformation (SystemExtendedHandleInformation / Class 64).
When it catches an unauthorized process holding a read handle to lsass.exe, it calls ntdll.NtSuspendProcess to freeze the attacker process in RAM rather than killing it, preserving volatile evidence for the SOC.
Scans ntdll.dll export stubs in memory to detect 0xE9 inline EDR hooks.

📋 CryptoClipGuard — Real-Time Clipboard Hijack Shield

prox0959 / CryptoClipGuard

Monitors Windows clipboard state changes via Win32 API to defend against crypto-clipper malware. If a background process silently swaps a copied BTC, ETH, SOL, or USDT wallet address, it immediately rolls back the clipboard to the original address and logs the offending PID.

📡 3. Network Defense & Information Theory

📡 SpectralCovert — Covert Channel & Entropy Leak Detector

prox0959 / SpectralCovert

Enterprise firewalls often permit ICMP Echo (Type 8/0) blindly, which APTs abuse to smuggle data inside ping payloads or packet timing. SpectralCovert uses two mathematical models:

Payload Tunneling via Normalized Shannon Entropy (H(X)): Separates deterministic OS ping padding from AES/XOR encrypted exfiltration streams.
Timing Channels via Sarle's Bimodality Coefficient (BC > 0.555): Analyzes Inter-Packet Delays (IPD) using skewness and kurtosis to detect and automatically decode hidden binary bitstreams in packet jitter.

import math
from collections import Counter

def normalized_shannon_entropy(data: bytes) -> float:
    if not data:
        return 0.0
    length = len(data)
    counts = Counter(data)
    entropy = -sum((c / length) * math.log2(c / length) for c in counts.values())
    return entropy / 8.0  # Normalized to [0.0, 1.0]

🌐 ProxNet — Live Network Threat Visualizer & IDS

prox0959 / ProxNet

Combines active ARP discovery, OUI vendor lookup, and TTL OS fingerprinting with a live D3.js force-directed physics graph over WebSockets to flag ARP spoofing and exposed management ports (445 SMB, 3389 RDP).

🤖 4. AI Security & Behavioral Biometrics

🤖 PromptSentry — Deterministic AI Prompt Injection Firewall

prox0959 / PromptSentry

A sub-millisecond (~0.18ms) reverse proxy gateway protecting LLMs (OWASP LLM01). Applies Unicode NFKC normalization to neutralize Cyrillic/Greek homoglyph bypasses, strips invisible zero-width characters (U+200B), decodes smuggled Base64/Hex payloads, and evaluates structural jailbreak heuristics before token consumption.

🧬 KeyDNA — Keystroke Dynamics Biometric Authentication

prox0959 / KeyDNA

Captures microsecond keystroke Dwell Time and Flight Time in JavaScript. Even if an attacker steals a plaintext password, KeyDNA blocks login attempts when the typing rhythm deviates from the user's statistical profile.

🚀 Full Portfolio & Feedback

All 9 tools are MIT licensed and available on my GitHub profile:
👉 github.com/prox0959

I'm currently preparing for university admissions in Computer Science (targeting ETH Zurich) and building out my next tool focused on deterministic antivirus false-positive reduction. If you have any feedback on the code, Win32 API implementations, or forensic methodology, I'd love to hear your thoughts in the comments!