mseek - process scanner / memory search tool for strings and regular expressions

A fast and powerful tool to search for strings and patterns in the memory space of running processes on a 64-bit/32bits Windows system.

In the example below, you see it was used to crack the F-Secure Freedome VPN client

---

🛠 How to Build - Information

./Build.bat 

Or

Visual Studio 2019

Version generation

Avoid version files generation to mess your commits:

git update-index --assume-unchanged src/version.cpp
git update-index --assume-unchanged build.nfo

📦 Usage

mseek.exe <-s string> <-p PID | -n PROCESSNAME | -i FILE> [options]

🔧 Required Arguments:

• -s <string> : String to search for
• -p <PID> : Target a specific process by its ID
  or
• -n <PROCESSNAME> : Target a process by its name
  or
• -i <file> : Read multiple search strings from a file (one per line)

---

🧩 Options

---

💡 Examples

1. Search for a string in a specific process using process name ¹

mseek.exe -n fsvpnservice_64.exe -s "<key>" 

2. Search for a string in a specific process using process id ²

mseek.exe -pid 2476 -s "<key>" 

3. Search for a string, print 200 bytes after found instance ³ Get the address: 0x0000027B10F5E70E

mseek.exe -n fsvpnservice_64.exe -s "<key>" -x -a 200

4. Search for a string, print 100 bytes before found instance ⁴ Get the address: 0x0000027B10F5EDE4

mseek.exe -n fsvpnservice_64.exe -s "<key>" -x -b 100

5. Get Delta Memory using addresses ⁵

Diff the address: 0x0000027B10F5EDE4 - 0x0000027B10F5E70E = 1750

6. Search for a string, print 1750 bytes after found instance, output in file, printable charcaters only ⁶

---

💡 REGEX patterns

The example below will look for all GUIDS with this REGEX pattern⁷ : "\{[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}"

1. Search for a REGEX PATTERN, in PRIVATE memory, output in file, printable charcaters only ⁷

mseek.exe -n fsvpnservice_64.exe -s "\{[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}" -t private -r -o "d:\mem.txt" -x -z

---

32bit Version Build in Win32 Configuration

NOTE

IF NOT RUNNNIG AS ADMIN, Some Process Are Not Accessible! If you cannot read a process memory, open a shell as administrator!

Auto-Elevate Privilege

You can use -e to auto -elevate privileges (not fully supported, best you run directly in admin mode). If detected, auto elevate will sleep on exit, because a new window is opened and you want to read the results.

---

Wishlist and Planned Features

1. Add an option to output search results in JSON or CSV fornats so that they can be easily parsed in PowerShell
2. Add a Encryption Pattern detction, brute-force decryption of memory segments.

---

📝 License

This software is provided as-is for educational and forensic analysis purposes. Use responsibly.

---

Created by Guillaume Plante

mseek has been helping developers and analysts dig into memory since 2022.

---

[1]

---

[2]

---

[3]

---

[4]

---

[5]

---

[6]

---

[7]