1amfine2333 / evileye

A [BeaconEye](https://github.com/CCob/BeaconEye) implement in Golang.

EvilEye

EvilEye is a BeaconEye implement in Golang.

Try & Run

download EvilEye in releases

./EvilEye.exe

Build

go install github.com/akkuman/EvilEye

As a package to use

package main

import (
	"fmt"
	"time"

	"github.com/akkuman/EvilEye/beaconeye"
)

func main() {
	v1 := time.Now()
	evilResults := make(chan beaconeye.EvilResult)
	go func() {
		err := beaconeye.FindEvil(evilResults)
		if err != nil {
			panic(err)
		}
	}()
	for v := range evilResults {
		fmt.Printf("%s: %x\n", v.Name, v.Match)
	}
	v2 := time.Now()
	fmt.Printf("The program took %v to run\n", v2.Sub(v1))
}

TODO

• Extraction configuration from memory

References

• Windows 10 Nt Heap Exploitation (English version)
• @d1nfinite 's PR on BeaconEye: [Bug Fix] Scan Heap Blocks
• 如何正确的 "手撕" Cobalt Strike
• win 10 heap internal & exploitation
• SEGMENT HEAP的简单分析和WINDBG EXTENSION
• NtApiDotNet repository