memscan

KO | EN

gitlite — search

#hacktoberfest #typescript #llm #go #machine-learning #deep-learning #linux #docker #awesome #kubernetes #vue #pytorch #mcp #openai

(★ 129)

Searches for strings, regex, credit card numbers of magnetic stripe card tracks in a Windows process's memory space

File Explorer

Download Latest Version (.zip)

- - AssemblyInfo.cs
- app.config
- memscan.csproj
- memscan.csproj.user
- Program.cs
.gitattributes
.gitignore
LICENSE
memscan.sln
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# memscan
Searches for strings, regex, credit card numbers of magnetic stripe card tracks in a process's memory space

Memory/Process Scanner  
Written by Matt Lewis, NCC Group 2014  
Updated by Tom Watson, NCC Group 2015  
Thanks to Jesse Bullock for lots of great ideas

Released as open source by NCC Group Plc - http://www.nccgroup.com/

Developed by Matt Lewis and Tom Watson, matt [dot] lewis [at] nccgroup [dot] com & tom [dot] watson [at] nccgroup [dot] com

http://www.github.com/nccgroup/memscan

Released under AGPL, see LICENSE for more information

Synopsis - keeps scanning a process memory space for a search string (unicode and ascii), regex pattern, credit card data or magnetic stripe data then if found, spits these out either to stdout, a file or a socket to a remote listener

Useful for memory scraping a process, a post-exploitation POC or instrumentation tool to be used during fuzzing.

TODO - Lots of duplicated code could be refactored out

Code adapted from http://www.codeproject.com/Articles/716227/Csharp-How-to-Scan-a-Process-Memory  
Original code licensed under CPOL: http://www.codeproject.com/info/cpol10.aspx

# Usage

memscan  
    -string -s [pid] [Remote IP] [Remote Port] [delay] [width] [search term]    
    -string -f [pid] [filename] [delay] [width] [search term]  
    -string -o [pid] [delay] [width] [search term]  
    -regex -s [pid] [Remote IP] [Remote Port] [delay] [width] [regex]  
    -regex -f [pid] [filename] [delay] [width] [regex]  
    -regex -o [pid] [delay] [width] [regex]  
    -ccdata -s [pid] [Remote IP] [Remote Port] [delay]  
    -ccdata -f [pid] [filename] [delay]  
    -ccdata -o [pid] [delay]  
    -msdata -s [pid] [Remote IP] [Remote Port] [delay]  
    -msdata -f [pid] [filename] [delay]  
    -msdata -o [pid] [delay]  
    -proclist

Flag Definitions:  
    -string         search for string  
    -regex          search for regex pattern  
    -ccdata         search for credit card data  
    -msdata         search for magenetic stripe data  
    -s              write output to socket  
    -f              write output to a file  
    -o              write output to terminal  
    delay           time to wait between each memchunk scan  
    width           amount of data to display before and after search term  
    string          to look for in memory (spaces allowed)  
    regex           to look for in memory (e.g. 3[47][0-9]{13})

memscan

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

memscan

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README