EasyHook VS open_safety

Memory manipulation can be done very easily by pinvoking Read/WriteProcessMemory(), but it's not really fun nor very powerful, you'll almost always need to hook some function, and for that you'll need some form of binary patching or DLL injection. The latter is not practical to do in C# because it depends on the CLRuntime, which would require a loader written in a lang like C++ anyway (take a look at this dead project). Idk any tutorials but take a look at Frida.re, Ghidra and maybe CheatEngine.

Example: https://github.com/EasyHook/EasyHook/issues/16

Malware delivered as an email with a link to a zip file containing a .js file is one of the most common methods of delivery, right behind word macros. The "map the .js extension to notepad.exe" is a common security trick with a measurable, immediate drop in malware in large orgs. You can deploy it via GPO or InTune.

Personal promotion, I built this as a better alternative:

https://github.com/technion/open_safety

Note the built in .js parser hasn't basically ever updated, if you're writing for this you're writing like you're targetting IE5.

Allow me to reference my own workaround for those vectors:

https://github.com/technion/open_safety

https://github.com/technion/open_safety

The time I've spent on the Github actions is substantively higher than the time I've spent on the .rs files. Of course you can't "test actions before commit" in the way you can actual code, so I kept having to make branches, make 15 commits like "try action fix again", followed by squashing them all down and merging.