<commit_before># Experimental Windows .text section Patch Detector
======================

Experimental: Windows .text section compare - disk versus memory

###### Original Idea
After reading about the Skeleton Key malware (http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/) develop a small tool which would compare the .text section of .exe and .dll files on disk with their RAM equivilent to detect patches.

###### Result
Working on the whole for 32bit binaries... need to add support for 64bit...

###### Features
This tool
* either for specific or all 32bit OR 64bit Windows processes enumerates the modules (.exe's and .dll's)
* find the .text (code) section in RAM
* find the .text (code) section on disk
* compares them taking into account base relocations

###### Command Line Options
* -h help
* -p [PID] - only analyze this PID
* -v - show the byte by byte diffs

###### Example Output (patched binary)
```
C:\Data\NCC\!Code\Git.Public\WindowsPatchDetector\Debug>NCCGroupWindowsPatchDetector.exe -p 6104 -v
[*] Experimental Windows Patch Detector - https://github.com/olliencc/WindowsPatchDetector
[*] NCC Group Plc - http://www.nccgroup.com/
[*] -h for help
[i] + [Amazon Music Helper.exe - PID: 6104 in session 1 - window station Console]
[i] Module C:\Users\Ollie\AppData\Local\Amazon Music\Amazon Music Helper.exe .text section at virtual address 00941000 has 0 relocations
[i] Relocations at 00F15000 of 149092 bytes
[diff] Offset 0000000e (0000100e) of 4156286: 90 versus e8 diff a8
[diff] Offset 0000000f (0000100f) of 4156286: 90 versus 55 diff 3b
[diff] Offset 00000010 (00001010) of 4156286: 90 versus 94 diff fc
[diff] Offset 00000011 (00001011) of 4156286: 90 versus 02 diff 8e
[diff] Offset 00000012 (00001012) of 4156286: 90 versus 00 diff 90
[diff] Offset 00000013 (00001013) of 4156286: 90 versus 59 diff 37
[!] 6 bytes different from a total of 4156286 - relocs 0
... snip ...<commit_msg>Readme to reflect 64bit build<commit_after># Experimental Windows .text section Patch Detector
======================

Experimental: Windows .text section compare - disk versus memory

###### Original Idea
After reading about the Skeleton Key malware (http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/) develop a small tool which would compare the .text section of .exe and .dll files on disk with their RAM equivilent to detect patches.

###### Result
Working on the whole for 32bit and 64bit binaries... 

###### Features
This tool
* either for specific or all 32bit OR 64bit Windows processes enumerates the modules (.exe's and .dll's)
* find the .text (code) section in RAM
* find the .text (code) section on disk
* compares them taking into account base relocations

###### Command Line Options
* -h help
* -p [PID] - only analyze this PID
* -v - show the byte by byte diffs

###### Example Output (patched binary)
```
C:\Data\NCC\!Code\Git.Public\WindowsPatchDetector\Debug>NCCGroupWindowsPatchDetector.exe -p 6104 -v
[*] Experimental Windows Patch Detector - https://github.com/olliencc/WindowsPatchDetector
[*] NCC Group Plc - http://www.nccgroup.com/
[*] -h for help
[i] + [Amazon Music Helper.exe - PID: 6104 in session 1 - window station Console]
[i] Module C:\Users\Ollie\AppData\Local\Amazon Music\Amazon Music Helper.exe .text section at virtual address 00941000 has 0 relocations
[i] Relocations at 00F15000 of 149092 bytes
[diff] Offset 0000000e (0000100e) of 4156286: 90 versus e8 diff a8
[diff] Offset 0000000f (0000100f) of 4156286: 90 versus 55 diff 3b
[diff] Offset 00000010 (00001010) of 4156286: 90 versus 94 diff fc
[diff] Offset 00000011 (00001011) of 4156286: 90 versus 02 diff 8e
[diff] Offset 00000012 (00001012) of 4156286: 90 versus 00 diff 90
[diff] Offset 00000013 (00001013) of 4156286: 90 versus 59 diff 37
[!] 6 bytes different from a total of 4156286 - relocs 0
... snip ...
{'fraction_non_alphanumeric': 0.10971867007672634, 'fraction_numerical': 0.10895140664961638, 'mean_word_length': 4.409405255878285, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 4, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '35423', 'n_tokens_mistral': 1581, 'n_tokens_neox': 1159, 'n_words': 504}