Cookie Consent by Free Privacy Policy Generator ๐Ÿ“Œ MemoryMapper - Lightweight Library Which Allows The Ability To Map Both Native And Managed Assemblies Into Memory

๐Ÿ  Team IT Security News

TSecurity.de ist eine Online-Plattform, die sich auf die Bereitstellung von Informationen,alle 15 Minuten neuste Nachrichten, Bildungsressourcen und Dienstleistungen rund um das Thema IT-Sicherheit spezialisiert hat.
Ob es sich um aktuelle Nachrichten, Fachartikel, Blogbeitrรคge, Webinare, Tutorials, oder Tipps & Tricks handelt, TSecurity.de bietet seinen Nutzern einen umfassenden รœberblick รผber die wichtigsten Aspekte der IT-Sicherheit in einer sich stรคndig verรคndernden digitalen Welt.

16.12.2023 - TIP: Wer den Cookie Consent Banner akzeptiert, kann z.B. von Englisch nach Deutsch รผbersetzen, erst Englisch auswรคhlen dann wieder Deutsch!

Google Android Playstore Download Button fรผr Team IT Security



๐Ÿ“š MemoryMapper - Lightweight Library Which Allows The Ability To Map Both Native And Managed Assemblies Into Memory


๐Ÿ’ก Newskategorie: IT Security Nachrichten
๐Ÿ”— Quelle: feedproxy.google.com


Memory Mapper is a lightweight library which allows the ability to map both native and managed assemblies into memory by either using process injection of a process specified by the user or self-injection; the technique of injecting an assembly into the currently running process attempting to do the injection. The library comes with tools not only to map assemblies, but with the capabilities to encrypt, decrypt, and generate various amounts of cryptographically strong data.

Requirements
Note: (For the running assembly using Memory Mapper ONLY โ€” not for stubs/shellcode)
  • Windows 7 SP1 & Higher
  • .NET Framework 4.6.1

Features
  • Explore the structure of a PE (portable executable)
  • Read resources from both managed and native assemblies
  • Map native assemblies into memory using process injection and self-injection
  • Map managed assemblies into memory using process injection and other techniques
  • Obtain an array of bytes for any file of any file size
  • Encrypt and decrypt entire files and raw bytes
  • Generate and validate checksums of files and raw bytes
  • Generate cryptographically strong random data using a SecureRandom object
  • Comes bundled with multiple encryption and hashing algorithms

    Encryption
    • AES (ECB)
    • AES (CBC)
    • AES (CFB)
    • AES (OFB)
    • AES (CTR)

    Hashing
    • MD5
    • RIPEMD160
    • SHA1
    • SHA256
    • SHA384
    • SHA512

Examples

Native Injection
This example shows how to statically map a native assembly into memory using the NativeLoader tool. The example loads the file by reading all of its bytes from disk and then injects the PE (portable executable) associated with the bytes directly into memory. Using the native loader in conjunction with Dynamic Code Compilation found in my Amaterasu library one could accomplish on-the-fly code compilation and injection all from code in-memory.
using System;
using System.IO;
using System.Reflection;
using MemoryMapper;

namespace Example
{
class Program
{
static void Main(string[] args)
{
// Get the bytes of the file we want to load.
var filePath = "FileToReadBytesOf";
var fileBytes = File.ReadAllBytes(filePath);

// Check if the assembly is managed or native.
bool isManaged = false;
try
{
// Note โ€” this is one of the simplest variations of checking assemblies
var assemblyName = AssemblyName.GetAssemblyName(filePath);
if (assemblyName != null)
if (assemblyName.FullName != null)
isManaged = true;
}
catch { isManaged = false; }

// Try loading the assembly if it's tr uly native.
if (!isManaged)
{
NativeLoader loader = new NativeLoader();
if (loader.LoadAssembly(fileBytes))
Console.WriteLine("Assembly loaded successfully!");
else
Console.WriteLine("Assembly could not be loaded.");
}

// Wait for user interaction.
Console.Read();
}
}
}

Managed Injection
This example shows how to statically map a managed assembly into memory by reading in its bytes โ€” or by using an embedded byte array โ€” and then using the ManagedLoader to inject into a currently running process. Almost any managed assembly can be mapped using the provided ManagedLoader tool.
using System;
using System.IO;
using System.Reflection;
using MemoryMapper;

namespace Example
{
class Program
{
static void Main(string[] args)
{
// Get the bytes of the file we want to load.
var filePath = "FileToReadBytesOf";
var fileBytes = File.ReadAllBytes(filePath);

// Check if the assembly is managed or native.
bool isManaged = false;
try
{
// Note โ€” this is one of the simplest variations of checking assemblies
var assemblyName = AssemblyName.GetAssemblyName(filePath);
if (assemblyName != null)
if (assemblyName.FullName != null)
isManaged = true;
}
catch { isManaged = false; }

// Try loading the assembly if it's tr uly managed.
if (isManaged)
{
// Set the name of a surrogate process - the process we'll inject into.
var processName = "explorer.exe"; // Can also be the current process's name for self-injection.
ManagedLoader loader = new ManagedLoader();
if (loader.LoadAssembly(fileBytes, processName))
Console.WriteLine("Assembly loaded successfully!");
else
Console.WriteLine("Assembly could not be loaded.");
}

// Wait for user interaction.
Console.Read();
}
}
}

Credits
Icon: DesignBolts
http://www.designbolts.com/


...



๐Ÿ“Œ United Nations Sets Standards on Peaceful Assemblies and the Use of Less Lethal Weapons


๐Ÿ“ˆ 33.52 Punkte

๐Ÿ“Œ ExecuteAssembly - Load/Inject .NET Assemblies


๐Ÿ“ˆ 31.73 Punkte

๐Ÿ“Œ HTTPDirFS - a filesystem which allows you to mount HTTP directory listings, and servers which support Subsonic API.


๐Ÿ“ˆ 29.56 Punkte

๐Ÿ“Œ Opinion on a Browser extension idea and a JS library for both symmetric and asymmetric encryption and secure hashing


๐Ÿ“ˆ 26.37 Punkte

๐Ÿ“Œ Building a Modern Document Website for React Native Library Like React Native ECharts


๐Ÿ“ˆ 26.06 Punkte

๐Ÿ“Œ Interesting discussion thread on ycombinator about both docker including devs from both


๐Ÿ“ˆ 26 Punkte

๐Ÿ“Œ Interesting discussion thread on ycombinator about both Docker & LXD including devs from both


๐Ÿ“ˆ 26 Punkte

๐Ÿ“Œ UK Home Office web form snafu allows you to both agree and disagree โ€“ strongly โ€“ all at once


๐Ÿ“ˆ 24.76 Punkte

๐Ÿ“Œ Pyrdp - RDP Man-In-The-Middle And Library For Python3 With The Ability To Watch Connections Live Or After The Fact


๐Ÿ“ˆ 24.65 Punkte

๐Ÿ“Œ Zomato: Zomato Map server going out of memory while resizing map image


๐Ÿ“ˆ 24.11 Punkte

๐Ÿ“Œ Attacks growing in both scope and sophistication, exposing gaps in the cloud native toolchain


๐Ÿ“ˆ 23.83 Punkte

๐Ÿ“Œ ssh-context - Bash wrapper around ssh which provides you ability to use contexts (as in kubectl) for SSH.


๐Ÿ“ˆ 23.77 Punkte

๐Ÿ“Œ Arch Linux vs. OpenSUSE Tumbleweed - Both rolling release distributions; which one do you prefer and why ?


๐Ÿ“ˆ 23.69 Punkte

๐Ÿ“Œ Dell's XPS 13 2-in-1 and XPS 15 are both beautiful, but which one is best?


๐Ÿ“ˆ 23.69 Punkte

๐Ÿ“Œ Is there any person who has used the Vega 11 on both windows and linux? Which one gives you better performance?


๐Ÿ“ˆ 23.69 Punkte

๐Ÿ“Œ Credit Lock and Credit Freeze: Which Service Is Best for You? Both!


๐Ÿ“ˆ 23.69 Punkte

๐Ÿ“Œ Telegram Now Allows You to Delete All Your Private Messages Anytime from both Sender & Receiver


๐Ÿ“ˆ 22.97 Punkte

๐Ÿ“Œ Telegram allows users to delete any sent/received message from both sides with no time limit


๐Ÿ“ˆ 22.97 Punkte

๐Ÿ“Œ Telegram allows users to delete any sent/received message from both sides with no time limit


๐Ÿ“ˆ 22.97 Punkte

๐Ÿ“Œ CVE-2020-7454: Details on how a bug in the libalias library impacted both Oracle VirtualBox and FreeBSD


๐Ÿ“ˆ 22.78 Punkte

๐Ÿ“Œ How to Update Kodi Library Both Automatically and Manually


๐Ÿ“ˆ 22.78 Punkte

๐Ÿ“Œ IRC privacy: HexChat addon which enforces privacy settings and allows quick use of Tor and I2P


๐Ÿ“ˆ 22.45 Punkte

๐Ÿ“Œ Snapdragon 8 Gen 3 vs A17 Pro from Apple: Both have ray tracing, but which one is better?


๐Ÿ“ˆ 21.9 Punkte

๐Ÿ“Œ Oathkeeper: A cloud native Identity and Access Proxy (IAP) which authenticates and authorizes incoming HTTP requests. (Go)


๐Ÿ“ˆ 21.53 Punkte











matomo