DEV Community

çınar
çınar

Posted on

Building a ~95 KB 25-in-1 Windows Memory Forensics, Module Stomping & EDR Suite in C# / Native Win32

#security #csharp #cybersecurity

Traditional consumer antivirus suites predominantly scan static files on disk or lose visibility after single-byte AMSI/ETW patches (0xC3 RET) and stealth Windows Defender folder exclusions.

Over the past months, I engineered ProxSuite PRO (Apex Edition v2.5 Enterprise) — a standalone, zero-dependency (~95 KB) native x64 Windows live memory forensics, anti-stealer, and second-opinion EDR command center uniting 25 proprietary engines (verified 100% clean with 0 false positives by Windows Defender).

🧬 Key Detection & Defense Engines (25-in-1 Architecture)

  1. EvasionHunter (Module Stomping, Process Ghosting & Call-Stack Spoofing): Reads the in-memory .text section of loaded DLLs (amsi.dll, wldp.dll) and compares them byte-for-byte against clean System32 disk images. Queries NtQueryInformationThread (Win32StartAddress) to detect threads executing outside backed modules, and flags Process Ghosting / Herpaderping.
  2. MemGuard PRO v2.0 & HollowHunter: Audits live ntdll.dll syscall prologues (4C 8B D1 B8) and scans MEM_PRIVATE RWX/WC memory regions for unbacked MZ/PE headers and shellcode stubs.
  3. LSASS Deep Shield: Inspects HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages against SSP injection (mimilib), and detects PssCaptureSnapshot (dbgcore.dll / dbghelp.dll) & comsvcs.dll credential dumpers.
  4. NamedPipe C2 & Live RAM IOC Scanner: Hunts Cobalt Strike (MSSE-*, postex_*), Sliver, Havoc, Brute Ratel, and Mythic named pipes + scans LOLBIN RAM for Discord webhooks, Telegram bot tokens, and Ngrok tunnels.
  5. GhostTrace (Kernel BAM & Prefetch Forensics): Correlates Kernel Background Activity Moderator (BAM) and C:\Windows\Prefetch\*.pf to expose self-deleting droppers that executed and erased themselves from disk.
  6. Real-Time CryptoClipGuard & Ransomware Honeypot: 600ms clipboard vault that automatically reverts hijacked BTC, ETH, SOL, and USDT wallet addresses back to your original address, paired with monitored canary files and NtSuspendProcess containment.
  7. Kernel DACL Self-Defense, Hot-Reloadable JSON Rules & SIEM Streaming: Hardens its own process Kernel DACL (SetKernelObjectSecurity denying PROCESS_TERMINATE / PROCESS_VM_WRITE), locks its binary on disk (FILE_SHARE_READ), hot-reloads custom IOCs from prox_rules.json without recompiling, and streams alerts to Windows EventLog (ID 2050) + HTTP Webhooks (Splunk/Elastic/Discord/Slack).

⚔️ ProxSuite PRO v2.5 vs. Traditional Antivirus & EDR Suites

Capability / Attack Vector ⚡ ProxSuite PRO v2.5 🛡️ Windows Defender 🦠 Malwarebytes 🧰 Sysinternals
Module Stomping (.text) & Process Ghosting ✓ RAM vs Disk .text Diff & Stack Audit ✗ Trusts MEM_IMAGE ✗ Blind to Stomping ✗ None
NTDLL Syscall Unhooking (4C 8B D1 B8) ✓ Live Syscall Stub Verification ✗ User-mode blind ✗ Not inspected ✗ Manual WinDbg
LSASS SSP Injection & PssCaptureSnapshot ✓ LSA Registry + dbgcore Hunter ⚠️ Bypassed if PPL off ✗ No SSP audit ✗ Manual only
Cobalt Strike / Sliver / Havoc Named Pipe C2 ✓ \\.\pipe\ + Dynamic JSON Rules ⚠️ Basic static only ✗ TCP/IP focus only ⚠️ Raw pipe list
Self-Deleting Droppers (Kernel BAM & .PF) ✓ Automated Post-Mortem Timeline ✗ Misses deleted files ✗ Disk files only ✗ No BAM tool
Kernel DACL Self-Defense & SIEM Webhook ✓ Anti-Terminate DACL + CEF Stream ⚠️ Exclusion bypass ⚠️ Service stoppable ✗ Easily killed
RAM Footprint & Binary Size ~95 KB EXE / Zero Dependencies ~350 MB RAM ~450 MB RAM ~45 MB (20 tools)

🌐 Live Interactive Browser Simulator & Direct Download

You can test the telemetry simulator directly in your browser or download the standalone x64 executable:

🪙 Licensing & Full Commercial Source Code (Crypto Only)

All paid tiers are accepted exclusively via Cryptocurrency (USDT, BTC, ETH, SOL, LTC, XMR) with zero middleman fees:

  • 24-Hour Free Evaluation Trial: $0.00 (Generate a free trial ticket via the portal!)
  • 30-Day PRO License: $9.99
  • Permanent One-Time v2.x License: $24.99
  • 💎 Full Commercial Source Code & White-Label Rights: $499.00 (Includes the complete 3,100+ line unobfuscated C# / Win32 / NT Syscall source code for all 25 engines, Defender-clean dynamic API architecture, SIEM/Dynamic JSON Rule modules, Standalone Offline AES-256 HWID Keygen, and full commercial rebrand rights.)

👉 Generate Instant Order / Free Trial Ticket Here or reach out on X: @prox_0959

Top comments (0)