sf

Shed is an application that allow to inspect the .NET runtime of a plan inward gild to extract useful information. It tin dismiss hold upward used to inspect malicious applications inward gild to convey a commencement full general overview of which information are stored i time that the malware is executed. Shed is able to: Inject a .NET Assembly inward a remote procedure (both managed in addition to un-managed) Extract all objects stored inward the managed heap Print strings stored inward memory Save the snapshot of the heap inward a JSON format for post-processing Dump all modules that are loaded inward memory Using Shed Shed is a command line tool. To display all available options run: shed.exe --help Inspecting an already running application In gild to inspect an already running procedure yous convey to expire the pid to Shed . Example: Shed.exe --pid 2356 Inspecting a binary In gild to inspect a binary, Shed needs to execute it in addition to to attach t...