api_finder2

$PName="olk"; $p=Get-Process -Name $PName -ErrorAction SilentlyContinue; if($p){ $tPid=$p[0].Id; $cls="MemScan_$(Get-Random)"; $cs="using System; using System.Diagnostics; using System.Runtime.InteropServices; using System.Text; using System.Text.RegularExpressions; using System.Collections.Generic; public class $cls { static HashSet<int> f = new HashSet<int>(); [DllImport(`"kernel32.dll`")] public static extern IntPtr OpenProcess(uint a, bool b, int c); [DllImport(`"kernel32.dll`")] public static extern bool ReadProcessMemory(IntPtr a, IntPtr b, byte[] c, int d, out int e); [DllImport(`"kernel32.dll`")] public static extern bool CloseHandle(IntPtr a); public static void Scan(int id) { IntPtr h=OpenProcess(0x0010|0x0400, false, id); if(h==IntPtr.Zero) { Console.WriteLine(`"[-] OpenProcess Error`"); return; } long max=Process.GetProcessById(id).VirtualMemorySize64; int size=5242880; byte[] buf=new byte[size]; Console.WriteLine(`"[*] Outlook (PID: `"+id+`") 메모리 덤프 스캔 중... (8443, 8444 포트 패킷 탐색)`"); for(long i=0; i<max; i+=size) { int read=0; if(ReadProcessMemory(h, (IntPtr)i, buf, size, out read) && read>0) { string a=Encoding.ASCII.GetString(buf, 0, read); string u=Encoding.Unicode.GetString(buf, 0, read); Dump(a, `":8443`"); Dump(u, `":8443`"); Dump(a, `":8444`"); Dump(u, `":8444`"); } } CloseHandle(h); Console.WriteLine(`"[*] 스캔 완료.`"); } static void Dump(string s, string port) { int idx=0; while((idx=s.IndexOf(port, idx, StringComparison.OrdinalIgnoreCase)) != -1) { int start = Math.Max(0, idx - 400); int len = Math.Min(s.Length - start, 1600); string chunk = s.Substring(start, len); if(f.Add(chunk.GetHashCode())) { string clean = Regex.Replace(chunk, @`"[^\x20-\x7E\r\n\t]+`", `"\n...\n`"); Console.WriteLine(`"\n---\n`" + clean.Trim() + `"\n---`"); } idx += port.Length; } } }"; Add-Type -TypeDefinition $cs -Language CSharp; Invoke-Expression "[$cls]::Scan($tPid)" } else { Write-Host "[-] $PName 프로세스를 찾을 수 없습니다." -ForegroundColor Red }