skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-sample-acquire

Acquire fileless and memory-resident malware samples by locating anomalous executable memory regions at runtime.

64|9|Updated Aug 17, 2026
Search Tags:#reverse engineering#memory dump#malware analysis#memory forensics#process injection#fileless malware#sample acquisition
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-sample-acquire-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-sample-acquire
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-sample-acquire
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-sample-acquire-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When analyzing fileless malware, injected payloads, or memory-resident implants, there is often no sample file on disk to analyze—only observable symptoms. This Skill turns a live phenomenon into an analyzable sample by locating anomalous executable memory and the execution context that reaches it, then dumping and reconstructing the payload. ## Core Features & Use Cases - Anomalous executable memory scanning: Enumerate VAD regions (Windows), VMAs via /proc/<pid>/maps (Linux), Mach VM regions (macOS), or capability provenance (seL4) to find unbacked or tampered executable memory. - Execution context attribution: Correlate thread start addresses, current PC/RIP, and call-stack return addresses with suspicious regions, catching trampoline and SetThreadContext evasion. - Event-triggered dumping: Use Sysmon/ETW, BPF LSM, or Endpoint Security events only as triggers, with memory scanning as ground truth, then dump entire regions and rebuild header-stripped PE/ELF/Mach-O payloads. - Use Case: A server runs a memory-resident web shell with no file on disk. Use this Skill to identify the anonymous executable region, confirm a thread's stack returns into it, dump the full region at the protection-change moment, and classify the recovered code blob for analysis. ## Quick Start Analyze this host where the malware leaves no file on disk and help me locate and dump the injected in-memory payload.

Frequently Asked Questions about re-sample-acquire

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract a fileless malware sample from memory?▼

Scan for anomalous executable memory regions (unbacked or protection-changed), attribute threads and call stacks to those regions, then dump the entire region at the trigger moment. Rebuild header-stripped payloads from the dumped region content rather than searching for PE or ELF headers.

How to detect process injection on Windows using memory analysis?▼

Enumerate regions with VirtualQueryEx looking for MEM_PRIVATE executable pages, cross-check MEM_IMAGE mappings against the PEB module list for unlinked modules, and inspect thread start addresses plus call stacks. Tools like PE-sieve and HollowsHunter automate this artifact-based detection.

Can I read another process's memory on macOS with root?▼

No. SIP and Hardened Runtime cause task_for_pid to return EPERM for protected processes regardless of root. You need the target to have get-task-allow entitlement or an Endpoint Security client with proper entitlements and user approval.

Why does hooking mmap and mprotect miss some injections on Linux?▼

User-space hooks are bypassed by direct syscalls, shared segment mappings, and overwriting existing executable regions. Use syscall tracepoints, kprobes, or BPF LSM hooks like file_mprotect as triggers, with /proc/<pid>/maps scanning as ground truth.

When should I not use live memory sample acquisition?▼

Skip it when a sample file already exists on disk (use triage instead), when working from an offline full-memory image (use memory forensics), or when you lack written authorization, since enumeration, hooking, and memory reads trigger EDR and anti-cheat monitoring.

Related Skills

Explore More Software Engineering Skills→
UseAI-proUseAI-pro
70

skill-guard

Monitor active OpenClaw skills for runtime security violations.

Official
Advanced
JameZUKJameZUK
39

arkana-analyze

Analyze malware binaries with Arkana to produce structured digests and IOCs.

Community
Advanced
xalgordxalgord
954

detecting-process-hollowing-technique

Detect process hollowing by analyzing memory sections, EDR telemetry, and parent-child process anomalies.

Community
Intermediate
jd-opensourcejd-opensource
299

pentest-ctf-forensics

Identify and extract artifacts from memory dumps, PCAPs, and disk images.

Official
Intermediate