Join Date: Aug 2007
Posts: 1957
|
Kategorie: Tools
Entwickler: evolution536
Beschreibung:
Features
- Accessing processes remotely, also system processes when running as Administrator;
- Memory scanning for primitive types, strings and byte sequences;
- Filtering scan results (a.k.a. Next scan);
- Supports relative addresses and offsets;
- Creating, saving and reusing address tables containing scan results.
- Changing values at memory addresses and freeze them;
- Viewing PE (Portable Executable) information about the opened process;
- Viewing and dumping sections;
- Viewing threads, change priority, suspend, resume and create threads remotely;
- Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk;
- Allocating memory blocks remotely;
- Generating code snippets from address tables;
- Hotkeys to automate actions that do not require user input;
- Viewing import address table of loaded process and its modules;
- Settings hooks on the IAT of a process and its modules and restoring export addresses;
- Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information;
- Viewing and closing handles in the loaded process;
- Disassembling executable pages in a process to provide memory view and program flow control;
- Walking heaps in the opened process as side feature of the disassembler;
- Debugging executable code and data to find out what the flow of a program is;
- Plugin system featuring CrySearch extensions to be written in MASM, C or C++;
- Generate signatures and byte-arrays from selected disassembly;
- Create memory dissections of specific parts of the process' memory and save them to the address table;
- A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems.
v2.04:
- Added feature to NOP out selected rows using right-click menu in the disassembly window;
- Fixed a bug in the PE window where the image base of an x64 process would be truncated to 32-bits;
- Fixed a bug where freezing and thawing addresses in the address table would not work properly anymore;
- Added the possibility to edit multiple selected address table entries at the same time, only by right-clicking and excluding editing the address;
- Reduced the timeout for retrieving window icons in the open process window;
- Improved the disassembler window:
- Added an option to go back to the entrypoint in the toolstrip and the right-click menu;
- Added resolving of intermodular function calls to functions in the import address table;
- Added heavy parallellism to the disassembler, greatly increasing processing speeds.
- Added a threshold to the amount of rows that can be selected for signature or byte array generation. This threshold is set to 256;
- Partially added masking for signature generation in the disassembly window.
Screenshots:
Download:
CrySearch Memory Scanner v2.04
|
Deutsch
