A demo WinDbg Extension written in Rust for hunting malicious patterns in memory. PurpleScan targets Read-Write-Execute (RWX) memory regions, the primary footprint of shellcode loaders and fileless malware using the YARA-X engine. So named from the Process Hacker tool using purple colour to highlight imaged backed vs. memory only discrepancies or packed/compressed regions...
It uses windows-rs for memory-safe interaction with the Windows debugger engine. Iterates through the virtual address space to find committed memory with PAGE_EXECUTE_READWRITE permissions. Uses YARA-X library for fast pattern matching (much easier than consuming C library). Uses IDebugDataSpaces4 which abstracts away ability to handle live processes (attaching/local) and crash dumps (.dmp files).
In modern Windows environments, memory is typically either writable (data) or executable (code), but rarely both. RWX regions are potentially anomalous often created by malware methods like process injection and reflective loading.
Note: Advanced malware would reset memory to RX after execution, PurpleScan only works the staging phase or those that maintain RWX for self-patching and modularity. You could also expand the scanned memory area. PurpleTest is a "bad" binary that you can build and test with, either by attaching or taking a process dump. PurpleTest writes a 1KB RWX region and writes a unique string to it, purple-test-rule.yara is the triggering yara file.
-
Load the extension in WinDbg:
.load C:\path\to\purplescan.dll -
Run a scan by providing the full path to a YARA rule file:
!purplescan C:\rules\purple-test-rule.yar