memory_scan

$PName="OUTLOOK"; $p=Get-Process -Name $PName -ErrorAction SilentlyContinue; if($p){ $tPid=$p[0].Id; $cls="MemScan_$(Get-Random)"; $cs="using System; using System.Diagnostics; using System.Runtime.InteropServices; using System.Text; using System.Text.RegularExpressions; using System.Collections.Generic; public class $cls { static HashSet<string> f = new HashSet<string>(); [DllImport(`"kernel32.dll`")] public static extern IntPtr OpenProcess(uint a, bool b, int c); [DllImport(`"kernel32.dll`")] public static extern bool ReadProcessMemory(IntPtr a, IntPtr b, byte[] c, int d, out int e); [DllImport(`"kernel32.dll`")] public static extern bool CloseHandle(IntPtr a); public static void Scan(int id) { IntPtr h=OpenProcess(0x0010|0x0400, false, id); if(h==IntPtr.Zero) return; long max=Process.GetProcessById(id).VirtualMemorySize64; int size=5242880; byte[] buf=new byte[size]; Regex r=new Regex(@`"https?://[a-zA-Z0-9\-\.]+?:8443/[a-zA-Z0-9/\-?=_]+`", RegexOptions.IgnoreCase); for(long i=0; i<max; i+=size) { int read=0; if(ReadProcessMemory(h, (IntPtr)i, buf, size, out read) && read>0) { string a=Encoding.ASCII.GetString(buf, 0, read); string u=Encoding.Unicode.GetString(buf, 0, read); if(a.Contains(`":8443`")) { foreach(Match m in r.Matches(a)) { if(f.Add(m.Value)) Console.WriteLine(`"[`"+DateTime.Now.ToString(`"HH:mm:ss`")+`"] [ASCII] `"+m.Value); } } if(u.Contains(`":8443`")) { foreach(Match m in r.Matches(u)) { if(f.Add(m.Value)) Console.WriteLine(`"[`"+DateTime.Now.ToString(`"HH:mm:ss`")+`"] [Unicode] `"+m.Value); } } } } CloseHandle(h); } }"; Add-Type -TypeDefinition $cs -Language CSharp; Write-Host "[*] 실시간 메모리 감시 시작... (종료하려면 Ctrl+C를 누르세요)" -ForegroundColor Cyan; while($true) { Invoke-Expression "[$cls]::Scan($tPid)"; Start-Sleep -Milliseconds 500 } } else { Write-Host "[-] $PName 프로세스를 찾을 수 없습니다." -ForegroundColor Red }